ParentImage:C\:\\Windows\\PSEXESVC.exe (User:AUTHORI* OR User:AUTORI*)