(Image:\\SharpLDAPmonitor.exe OR OriginalFileName:SharpLDAPmonitor.exe) OR (CommandLine:\/user\:* CommandLine:\/pass\:* CommandLine:\/dcip\:*)