((Image:\\curl.exe OR OriginalFileName:curl.exe) CommandLine:://[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3} CommandLine:http* (CommandLine:\ \-O* OR CommandLine:\-\-remote\-name* OR CommandLine:\-\-output*)) (-(CommandLine:.bat OR CommandLine:.bat\" OR CommandLine:.dat OR CommandLine:.dat\" OR CommandLine:.dll OR CommandLine:.dll\" OR CommandLine:.exe OR CommandLine:.exe\" OR CommandLine:.gif OR CommandLine:.gif\" OR CommandLine:.hta OR CommandLine:.hta\" OR CommandLine:.jpeg OR CommandLine:.jpeg\" OR CommandLine:.log OR CommandLine:.log\" OR CommandLine:.msi OR CommandLine:.msi\" OR CommandLine:.png OR CommandLine:.png\" OR CommandLine:.ps1 OR CommandLine:.ps1\" OR CommandLine:.psm1 OR CommandLine:.psm1\" OR CommandLine:.vbe OR CommandLine:.vbe\" OR CommandLine:.vbs OR CommandLine:.vbs\" OR CommandLine:.bat' OR CommandLine:.dat' OR CommandLine:.dll' OR CommandLine:.exe' OR CommandLine:.gif' OR CommandLine:.hta' OR CommandLine:.jpeg' OR CommandLine:.log' OR CommandLine:.msi' OR CommandLine:.png' OR CommandLine:.ps1' OR CommandLine:.psm1' OR CommandLine:.vbe' OR CommandLine:.vbs'))