(TargetObject:\\SOFTWARE\\Microsoft\\NetSh* Details:.dll*) (-(Image:C\:\\Windows\\System32\\poqexec.exe (Details:ipmontr.dll OR Details:iasmontr.dll OR Details:ippromon.dll)))