((Image:\\net.exe OR Image:\\net1.exe) CommandLine:time*) OR (Image:\\w32tm.exe CommandLine:tz*)