(OriginalFileName:Cmd.Exe OR OriginalFileName:CONHOST.EXE OR OriginalFileName:7z.exe OR OriginalFileName:7za.exe OR OriginalFileName:7zr.exe OR OriginalFileName:WinRAR.exe OR OriginalFileName:wevtutil.exe OR OriginalFileName:net.exe OR OriginalFileName:net1.exe OR OriginalFileName:netsh.exe OR OriginalFileName:InstallUtil.exe) (-(Image:\\cmd.exe OR Image:\\conhost.exe OR Image:\\7z.exe OR Image:\\7za.exe OR Image:\\7zr.exe OR Image:\\WinRAR.exe OR Image:\\wevtutil.exe OR Image:\\net.exe OR Image:\\net1.exe OR Image:\\netsh.exe OR Image:\\InstallUtil.exe))