((Image:\\find.exe OR Image:\\findstr.exe) OR (OriginalFileName:FIND.EXE OR OriginalFileName:FINDSTR.EXE)) (CommandLine:cpassword* CommandLine:\\sysvol\\* CommandLine:.xml*)