(Image:\\DismHost.exe (ParentCommandLine:\/Online* ParentCommandLine:\/Disable\-Feature*)) OR (Image:\\Dism.exe (CommandLine:\/Online* CommandLine:\/Disable\-Feature*))