TargetFilename:\\ntds.dit ((ParentImage:\\cscript.exe OR ParentImage:\\httpd.exe OR ParentImage:\\nginx.exe OR ParentImage:\\php\-cgi.exe OR ParentImage:\\powershell.exe OR ParentImage:\\pwsh.exe OR ParentImage:\\w3wp.exe OR ParentImage:\\wscript.exe) OR (ParentImage:\\apache* OR ParentImage:\\tomcat* OR ParentImage:\\AppData\\* OR ParentImage:\\Temp\\* OR ParentImage:\\Public\\* OR ParentImage:\\PerfLogs\\*))