(Image:\\auditpol.exe OR OriginalFileName:AUDITPOL.EXE) (CommandLine:disable* OR CommandLine:clear* OR CommandLine:remove* OR CommandLine:restore*)