((Image:\\wscript.exe OR OriginalFileName:wscript.exe) CommandLine:manage\-bde.wsf*) OR (((ParentImage:\\cscript.exe OR ParentImage:\\wscript.exe) ParentCommandLine:manage\-bde.wsf*) (-Image:\\cmd.exe))