(TargetFilename:\\AppData\\Roaming\\Oracle\\bin\\java* TargetFilename:.exe*) OR (TargetFilename:\\Retrive* TargetFilename:.vbs*)