(Image:\\ntdsutil.exe OR OriginalFileName:ntdsutil.exe) ((CommandLine:snapshot* CommandLine:mount\ *) OR (CommandLine:ac* CommandLine:\ i* CommandLine:\ ntds*))