(TargetFilename:\\AppData\\Local\\Temp\\* TargetFilename:PROCEXP152.sys) (-(Image:\\procexp64.exe* OR Image:\\procexp.exe* OR Image:\\procmon64.exe* OR Image:\\procmon.exe*))