(((Image:\\net.exe OR Image:\\net1.exe) OR (OriginalFileName:net.exe OR OriginalFileName:net1.exe)) (CommandLine:\ use\ * CommandLine:\:*\\* CommandLine:\/USER\:*\ *)) (-CommandLine:\ )