(FileName:\\AppData\\Local\\Microsoft\\Credentials\\* OR FileName:\\AppData\\Roaming\\Microsoft\\Credentials\\* OR FileName:\\AppData\\Local\\Microsoft\\Vault\\* OR FileName:\\ProgramData\\Microsoft\\Vault\\*) (-(Image:C\:\\Program\ Files\\* OR Image:C\:\\Program\ Files\ \(x86\)\\* OR Image:C\:\\Windows\\system32\\* OR Image:C\:\\Windows\\SysWOW64\\*))