(Image:\\where.exe OR OriginalFileName:where.exe) (CommandLine:places.sqlite* OR CommandLine:cookies.sqlite* OR CommandLine:formhistory.sqlite* OR CommandLine:logins.json* OR CommandLine:key4.db* OR CommandLine:key3.db* OR CommandLine:sessionstore.jsonlz4* OR CommandLine:History* OR CommandLine:Bookmarks* OR CommandLine:Cookies* OR CommandLine:Login\ Data*)