(FileName:\\Appdata\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat OR (FileName:\\cookies.sqlite OR FileName:\\places.sqlite OR FileName:release\\key3.db OR FileName:release\\key4.db OR FileName:release\\logins.json) OR (FileName:\\User\ Data\\Default\\Login\ Data* OR FileName:\\User\ Data\\Local\ State*)) (-(Image:System OR (Image:C\:\\Program\ Files\ \(x86\)\\* OR Image:C\:\\Program\ Files\\* OR Image:C\:\\Windows\\system32\\* OR Image:C\:\\Windows\\SysWOW64\\*))) (-((Image:C\:\\ProgramData\\Microsoft\\Windows\ Defender\\* (Image:\\MpCopyAccelerator.exe OR Image:\\MsMpEng.exe)) OR (Image:\\thor.exe OR Image:\\thor64.exe)))