(TargetObject:\\Services\\W32Time\\TimeProviders* TargetObject:\\DllName) (-(Details:%SystemRoot%\\System32\\vmictimeprovider.dll OR Details:%systemroot%\\system32\\w32time.dll OR Details:C\:\\Windows\\SYSTEM32\\w32time.DLL))