ParentImage:\\javaw.exe (ParentCommandLine:Harmony* OR ParentCommandLine:lexicom* OR ParentCommandLine:VersaLex* OR ParentCommandLine:VLTrader*) Image:\\cmd.exe (CommandLine:powershell* OR CommandLine:\ \-enc\ * OR CommandLine:\ \-EncodedCommand* OR CommandLine:.Download*)