CommandLine:\\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy* (CommandLine:\\NTDS.dit* OR CommandLine:\\SYSTEM* OR CommandLine:\\SECURITY*)