ParentImage:\\sqlps.exe OR ((Image:\\sqlps.exe OR OriginalFileName:sqlps.exe) (-ParentImage:\\sqlagent.exe))