(Image:\\print.exe OR OriginalFileName:Print.EXE) ((CommandLine:\-D* OR CommandLine:\/D* OR CommandLine:–D* OR CommandLine:—D* OR CommandLine:―D*) (CommandLine:\\config\\SAM* OR CommandLine:\\config\\SECURITY* OR CommandLine:\\config\\SYSTEM* OR CommandLine:\\windows\\ntds\\ntds.dit*))