(FileName:\\* (FileName:\\sysvol\\* FileName:\\Policies\\*) (FileName:audit.csv OR FileName:Files.xml OR FileName:GptTmpl.inf OR FileName:groups.xml OR FileName:Registry.pol OR FileName:Registry.xml OR FileName:scheduledtasks.xml OR FileName:scripts.ini OR FileName:services.xml)) (-((Image:C\:\\Program\ Files\ \(x86\)\\* OR Image:C\:\\Program\ Files\\* OR Image:C\:\\Windows\\system32\\* OR Image:C\:\\Windows\\SysWOW64\\*) OR Image:C\:\\Windows\\explorer.exe))