Image:\\QuarksPwDump.exe OR (CommandLine:\ \-dhl OR CommandLine:\ \-\-dump\-hash\-local OR CommandLine:\ \-dhdc OR CommandLine:\ \-\-dump\-hash\-domain\-cached OR CommandLine:\ \-\-dump\-bitlocker OR CommandLine:\ \-dhd\  OR CommandLine:\ \-\-dump\-hash\-domain\  OR CommandLine:\-\-ntds\-file)