(Image:\\dsquery.exe OR OriginalFileName:dsquery.exe) CommandLine:trustedDomain*