(Image:\\dsacls.exe OR OriginalFileName:DSACLS.EXE) (CommandLine:\/user\:* CommandLine:\/passwd\:*)