(SourceImage:\\powershell.exe OR SourceImage:\\pwsh.exe) (-SourceParentImage:\:\\Windows\\System32\\CompatTelRunner.exe)