EventID:5145 ((RelativeTargetName:\\mimidrv* OR RelativeTargetName:\\lsass* OR RelativeTargetName:\\windows\\minidump\\* OR RelativeTargetName:\\hiberfil* OR RelativeTargetName:\\sqldmpr*) OR (RelativeTargetName:Windows\\NTDS\\ntds.dit OR RelativeTargetName:Windows\\System32\\config\\SAM OR RelativeTargetName:Windows\\System32\\config\\SECURITY OR RelativeTargetName:Windows\\System32\\config\\SYSTEM))