((ParentImage:\\j2ee\\cluster\\apps\\sap.com\\irj\\servlet_jsp\\irj\\work* OR ParentImage:\\j2ee\\cluster\\apps\\sap.com\\irj\\servlet_jsp\\irj\\root*) OR (CurrentDirectory:\\j2ee\\cluster\\apps\\sap.com\\irj\\servlet_jsp\\irj\\work* OR CurrentDirectory:\\j2ee\\cluster\\apps\\sap.com\\irj\\servlet_jsp\\irj\\root*)) (Image:\\cmd.exe OR Image:\\powershell.exe OR Image:\\powershell_ise.exe OR Image:\\pwsh.exe OR Image:\\wscript.exe OR Image:\\cscript.exe OR Image:\\regsvr32.exe OR Image:\\rundll32.exe OR Image:\\mshta.exe OR Image:\\certutil.exe OR Image:\\bitsadmin.exe OR Image:\\python.exe)