(Image:\\conhost.exe (ParentImage:\\explorer.exe OR ParentImage:\\lsass.exe OR ParentImage:\\regsvr32.exe OR ParentImage:\\rundll32.exe OR ParentImage:\\services.exe OR ParentImage:\\smss.exe OR ParentImage:\\spoolsv.exe OR ParentImage:\\svchost.exe OR ParentImage:\\userinit.exe OR ParentImage:\\wininit.exe OR ParentImage:\\winlogon.exe)) (-(ParentCommandLine:\-k\ apphost\ \-s\ AppHostSvc* OR ParentCommandLine:\-k\ imgsvc* OR ParentCommandLine:\-k\ localService\ \-p\ \-s\ RemoteRegistry* OR ParentCommandLine:\-k\ LocalSystemNetworkRestricted\ \-p\ \-s\ NgcSvc* OR ParentCommandLine:\-k\ NetSvcs\ \-p\ \-s\ NcaSvc* OR ParentCommandLine:\-k\ netsvcs\ \-p\ \-s\ NetSetupSvc* OR ParentCommandLine:\-k\ netsvcs\ \-p\ \-s\ wlidsvc* OR ParentCommandLine:\-k\ NetworkService\ \-p\ \-s\ DoSvc* OR ParentCommandLine:\-k\ wsappx\ \-p\ \-s\ AppXSvc* OR ParentCommandLine:\-k\ wsappx\ \-p\ \-s\ ClipSVC* OR ParentCommandLine:\-k\ wusvcs\ \-p\ \-s\ WaaSMedicSvc*)) (-(ParentCommandLine:C\:\\Program\ Files\ \(x86\)\\Dropbox\\Client\\* OR ParentCommandLine:C\:\\Program\ Files\\Dropbox\\Client\\*))