(Image:\\SharpMove.exe OR OriginalFileName:SharpMove.exe) OR (CommandLine:computername=* (CommandLine:action=create* OR CommandLine:action=dcom* OR CommandLine:action=executevbs* OR CommandLine:action=hijackdcom* OR CommandLine:action=modschtask* OR CommandLine:action=modsvc* OR CommandLine:action=query* OR CommandLine:action=scm* OR CommandLine:action=startservice* OR CommandLine:action=taskscheduler*))