ParentImage:\\winrshost.exe (-Image:C\:\\Windows\\System32\\conhost.exe)