(EventID:4663 ObjectType:File AccessMask:0x1) ((ObjectName:\\User\ Data\\Default\\Login\ Data* OR ObjectName:\\User\ Data\\Local\ State* OR ObjectName:\\User\ Data\\Default\\Network\\Cookies*) OR (FileName:\\cookies.sqlite OR FileName:\\places.sqlite OR FileName:release\\key3.db OR FileName:release\\key4.db OR FileName:release\\logins.json)) (-(ProcessName:System OR (ProcessName:C\:\\Program\ Files\ \(x86\)\\* OR ProcessName:C\:\\Program\ Files\\* OR ProcessName:C\:\\Windows\\system32\\* OR ProcessName:C\:\\Windows\\SysWOW64\\*))) (-(ProcessName:C\:\\ProgramData\\Microsoft\\Windows\ Defender\\* (ProcessName:\\MpCopyAccelerator.exe OR ProcessName:\\MsMpEng.exe)))