(Initiated:true (Image:\\wscript.exe OR Image:\\cscript.exe)) (-((DestinationIp:127.* OR DestinationIp:10.* OR DestinationIp:172.16.* OR DestinationIp:172.17.* OR DestinationIp:172.18.* OR DestinationIp:172.19.* OR DestinationIp:172.20.* OR DestinationIp:172.21.* OR DestinationIp:172.22.* OR DestinationIp:172.23.* OR DestinationIp:172.24.* OR DestinationIp:172.25.* OR DestinationIp:172.26.* OR DestinationIp:172.27.* OR DestinationIp:172.28.* OR DestinationIp:172.29.* OR DestinationIp:172.30.* OR DestinationIp:172.31.* OR DestinationIp:192.168.* OR DestinationIp:169.254.* OR DestinationIp:\:\:1 OR DestinationIp:fe8* OR DestinationIp:fe9* OR DestinationIp:fea* OR DestinationIp:feb* OR DestinationIp:fc* OR DestinationIp:fd*) OR DestinationIp:20.0.* OR DestinationIp:20.1.* OR DestinationIp:20.2.* OR DestinationIp:20.3.* OR DestinationIp:20.4.* OR DestinationIp:20.5.* OR DestinationIp:20.6.* OR DestinationIp:20.7.* OR DestinationIp:20.8.* OR DestinationIp:20.9.* OR DestinationIp:20.10.* OR DestinationIp:20.11.* OR DestinationIp:20.12.* OR DestinationIp:20.13.* OR DestinationIp:20.14.* OR DestinationIp:20.15.* OR DestinationIp:20.16.* OR DestinationIp:20.17.* OR DestinationIp:20.18.* OR DestinationIp:20.19.* OR DestinationIp:20.20.* OR DestinationIp:20.21.* OR DestinationIp:20.22.* OR DestinationIp:20.23.* OR DestinationIp:20.24.* OR DestinationIp:20.25.* OR DestinationIp:20.26.* OR DestinationIp:20.27.* OR DestinationIp:20.28.* OR DestinationIp:20.29.* OR DestinationIp:20.30.* OR DestinationIp:20.31.*))