(Image:\\nltest.exe OR OriginalFileName:nltestrk.exe) ((CommandLine:server* CommandLine:query*) OR (CommandLine:\/user* OR CommandLine:all_trusts* OR CommandLine:dclist\:* OR CommandLine:dnsgetdc\:* OR CommandLine:domain_trusts* OR CommandLine:dsgetdc\:* OR CommandLine:parentdomain* OR CommandLine:trusted_domains*))