(CommandLine:xcopy\ \/S\ \/E\ \/C\ \/Q\ \/H\ \\\\* CommandLine:\\sysvol\\*) OR (CommandLine:adexplorer\ \-snapshot\ \"\"\ c\:\\users\\* CommandLine:\\downloads\\* CommandLine:.snp*)