(TargetObject:HKLM\\System\\CurrentControlSet\\Services\\NalDrv\\ImagePath OR TargetObject:HKLM\\System\\CurrentControlSet\\Services\\PROCEXP152\\ImagePath) (-((Image:\\procexp64.exe OR Image:\\procexp.exe OR Image:\\procmon64.exe OR Image:\\procmon.exe OR Image:\\handle.exe OR Image:\\handle64.exe) Details:\\WINDOWS\\system32\\Drivers\\PROCEXP152.SYS*))