(Image:\\net.exe OR Image:\\net1.exe) (CommandLine:user* CommandLine:add* CommandLine:DarkGate* CommandLine:SafeMode*)