(Image:\\VMwareToolBoxCmd.exe OR OriginalFileName:toolbox\-cmd.exe) (CommandLine:\ script\ * CommandLine:\ set\ *) (CommandLine:\:\\PerfLogs\\* OR CommandLine:\:\\Temp\\* OR CommandLine:\:\\Windows\\System32\\Tasks\\* OR CommandLine:\:\\Windows\\Tasks\\* OR CommandLine:\:\\Windows\\Temp\\* OR CommandLine:\\AppData\\Local\\Temp*)