(Image:\\bitsadmin.exe OR OriginalFileName:bitsadmin.exe) ((CommandLine:\/SetNotifyCmdLine* (CommandLine:%COMSPEC%* OR CommandLine:cmd.exe* OR CommandLine:regsvr32.exe*)) OR (CommandLine:\/Addfile* (CommandLine:http\:* OR CommandLine:https\:* OR CommandLine:ftp\:* OR CommandLine:ftps\:*)))