((Image:\\esentutl.exe OR OriginalFileName:\\esentutl.exe) (CommandLine:vss* OR CommandLine:\ \-m\ * OR CommandLine:\ \/m\ * OR CommandLine:\ –m\ * OR CommandLine:\ —m\ * OR CommandLine:\ ―m\ * OR CommandLine:\ \-y\ * OR CommandLine:\ \/y\ * OR CommandLine:\ –y\ * OR CommandLine:\ —y\ * OR CommandLine:\ ―y\ *)) OR (CommandLine:\\config\\RegBack\\sam* OR CommandLine:\\config\\RegBack\\security* OR CommandLine:\\config\\RegBack\\system* OR CommandLine:\\config\\sam* OR CommandLine:\\config\\security* OR CommandLine:\\config\\system\ * OR CommandLine:\\repair\\sam* OR CommandLine:\\repair\\security* OR CommandLine:\\repair\\system* OR CommandLine:\\windows\\ntds\\ntds.dit*)