(CommandLine:\/generic\:Microsoft_Windows_Shell_ZipFolder\:filename=* CommandLine:.zip* CommandLine:\/pass\:* CommandLine:\/user\:*) OR (CommandLine:\/delete* CommandLine:Microsoft_Windows_Shell_ZipFolder\:filename=* CommandLine:.zip*)