(TargetFilename:\\PROCEXP* TargetFilename:.sys) (-(Image:\\procexp.exe OR Image:\\procexp64.exe))