(FileName:\\User\ Data\\Default\\Cookies* OR FileName:\\User\ Data\\Default\\History* OR FileName:\\User\ Data\\Default\\Network\\Cookies* OR FileName:\\User\ Data\\Default\\Web\ Data*) (-(Image:System OR (Image:C\:\\Program\ Files\ \(x86\)\\* OR Image:C\:\\Program\ Files\\* OR Image:C\:\\Windows\\system32\\* OR Image:C\:\\Windows\\SysWOW64\\*))) (-(Image:C\:\\ProgramData\\Microsoft\\Windows\ Defender\\* (Image:\\MpCopyAccelerator.exe OR Image:\\MsMpEng.exe)))