(ParentImage:\\sllauncher.exe Image:\\svchost.exe) OR (ParentImage:\\AppData\\Roaming\\* Image:\\svchost.exe CommandLine:\-k*)