((Image:\\ADExp.exe OR Image:\\ADExplorer.exe OR Image:\\ADExplorer64.exe OR Image:\\ADExplorer64a.exe) OR OriginalFileName:AdExp OR Description:Active\ Directory\ Editor OR Product:Sysinternals\ ADExplorer) CommandLine:snapshot*