((Image:\\net.exe OR Image:\\net1.exe) OR (OriginalFileName:net.exe OR OriginalFileName:net1.exe)) (CommandLine:\ accounts* OR CommandLine:\ group* OR CommandLine:\ localgroup* OR CommandLine:\ share* OR CommandLine:\ start* OR CommandLine:\ stop\ * OR CommandLine:\ user* OR CommandLine:\ view*)