(TargetObject:\\System\\CurrentControlSet\\Services\\* TargetObject:\\NetworkProvider*) (-((TargetObject:\\System\\CurrentControlSet\\Services\\WebClient\\NetworkProvider* OR TargetObject:\\System\\CurrentControlSet\\Services\\LanmanWorkstation\\NetworkProvider* OR TargetObject:\\System\\CurrentControlSet\\Services\\RDPNP\\NetworkProvider*) OR Image:C\:\\Windows\\System32\\poqexec.exe))