(CommandLine:\\AppData\\Roaming\\Oracle* CommandLine:\\java* CommandLine:.exe\ *) OR (CommandLine:cscript.exe* CommandLine:Retrive* CommandLine:.vbs\ *)