(Image:\\wbadmin.exe OR OriginalFileName:WBADMIN.EXE) ((CommandLine:\ recovery* CommandLine:recoveryTarget* CommandLine:itemtype\:File*) (CommandLine:\\config\\SAM* OR CommandLine:\\config\\SECURITY* OR CommandLine:\\config\\SYSTEM* OR CommandLine:\\Windows\\NTDS\\NTDS.dit*))