((Image:\\ADExp.exe OR Image:\\ADExplorer.exe OR Image:\\ADExplorer64.exe OR Image:\\ADExplorer64a.exe) OR OriginalFileName:AdExp OR Description:Active\ Directory\ Editor OR Product:Sysinternals\ ADExplorer) CommandLine:snapshot* (CommandLine:\\Downloads\\* OR CommandLine:\\Users\\Public\\* OR CommandLine:\\AppData\\* OR CommandLine:\\Windows\\Temp\\*)