(Image:\\wscript.exe OR Image:\\cscript.exe OR Image:\\mshta.exe) (CommandLine:\:\\Perflogs\\* OR CommandLine:\:\\Temp\\* OR CommandLine:\:\\Tmp\\* OR CommandLine:\:\\Users\\Public\\* OR CommandLine:\:\\Windows\\Temp\\* OR CommandLine:\\AppData\\Local\\Temp\\* OR CommandLine:\\AppData\\Roaming\\Temp\\* OR CommandLine:\\Start\ Menu\\Programs\\Startup\\* OR CommandLine:\\Temporary\ Internet* OR CommandLine:\\Windows\\Temp* OR CommandLine:%LocalAppData%\\Temp\\* OR CommandLine:%TEMP%* OR CommandLine:%TMP%*) (CommandLine:.hta* OR CommandLine:.js* OR CommandLine:.jse* OR CommandLine:.vba* OR CommandLine:.vbe* OR CommandLine:.vbs* OR CommandLine:.wsf* OR CommandLine:.wsh*)