((Image:\\cscript.exe OR Image:\\wscript.exe) OR (OriginalFileName:cscript.exe OR OriginalFileName:wscript.exe)) CommandLine:.vbs\ \-register\ *