(Image:\\SharpDPAPI.exe OR OriginalFileName:SharpDPAPI.exe) OR ((CommandLine:\ backupkey\ * OR CommandLine:\ blob\ * OR CommandLine:\ certificates\ * OR CommandLine:\ credentials\ * OR CommandLine:\ keepass\ * OR CommandLine:\ masterkeys\ * OR CommandLine:\ rdg\ * OR CommandLine:\ vaults\ *) ((CommandLine:\ \{* CommandLine:\}\:*) OR (CommandLine:\ \/file\:* OR CommandLine:\ \/machine* OR CommandLine:\ \/mkfile\:* OR CommandLine:\ \/password\:* OR CommandLine:\ \/pvk\:* OR CommandLine:\ \/server\:* OR CommandLine:\ \/target\:* OR CommandLine:\ \/unprotect*)))