((Image:\\EXCEL.EXE OR Image:\\POWERPNT.EXE OR Image:\\WINWORD.exe) OR (OriginalFileName:Excel.exe OR OriginalFileName:POWERPNT.EXE OR OriginalFileName:WinWord.exe)) (CommandLine:http\:\/\/* OR CommandLine:https\:\/\/*)