((Image:\\winrs.exe OR OriginalFileName:winrs.exe) (CommandLine:\-r\:localhost* OR CommandLine:\/r\:localhost* OR CommandLine:–r\:localhost* OR CommandLine:—r\:localhost* OR CommandLine:―r\:localhost* OR CommandLine:\-r\:127.0.0.1* OR CommandLine:\/r\:127.0.0.1* OR CommandLine:–r\:127.0.0.1* OR CommandLine:—r\:127.0.0.1* OR CommandLine:―r\:127.0.0.1* OR CommandLine:\-r\:\[\:\:1\]* OR CommandLine:\/r\:\[\:\:1\]* OR CommandLine:–r\:\[\:\:1\]* OR CommandLine:—r\:\[\:\:1\]* OR CommandLine:―r\:\[\:\:1\]* OR CommandLine:\-remote\:localhost* OR CommandLine:\/remote\:localhost* OR CommandLine:–remote\:localhost* OR CommandLine:—remote\:localhost* OR CommandLine:―remote\:localhost* OR CommandLine:\-remote\:127.0.0.1* OR CommandLine:\/remote\:127.0.0.1* OR CommandLine:–remote\:127.0.0.1* OR CommandLine:—remote\:127.0.0.1* OR CommandLine:―remote\:127.0.0.1* OR CommandLine:\-remote\:\[\:\:1\]* OR CommandLine:\/remote\:\[\:\:1\]* OR CommandLine:–remote\:\[\:\:1\]* OR CommandLine:—remote\:\[\:\:1\]* OR CommandLine:―remote\:\[\:\:1\]*)) OR ((Image:\\winrs.exe OR OriginalFileName:winrs.exe) (-(CommandLine:\-r\:* OR CommandLine:\/r\:* OR CommandLine:–r\:* OR CommandLine:—r\:* OR CommandLine:―r\:* OR CommandLine:\-remote\:* OR CommandLine:\/remote\:* OR CommandLine:–remote\:* OR CommandLine:—remote\:* OR CommandLine:―remote\:*)))