((OriginalFileName:wscript.exe OR OriginalFileName:cscript.exe) OR (Image:\\wscript.exe OR Image:\\cscript.exe)) (CommandLine:.csv* OR CommandLine:.dat* OR CommandLine:.doc* OR CommandLine:.gif* OR CommandLine:.jpeg* OR CommandLine:.jpg* OR CommandLine:.png* OR CommandLine:.ppt* OR CommandLine:.txt* OR CommandLine:.xls* OR CommandLine:.xml*)