((TargetFilename:\:\\ProgramData\\* OR TargetFilename:\\AppData\\Local\\*) TargetFilename:\\\\[a-zA-Z]{5,6}\\.wll) OR (TargetFilename:\\win32log.exe OR TargetFilename:\\crdss.exe)