(ParentImage:\\svchost.exe ParentCommandLine:\-s\ WebClient* Image:\\rundll32.exe CommandLine:C\:\\windows\\system32\\davclnt.dll,DavSetCookie* CommandLine:://\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}) (-(CommandLine:\:\/\/10.* OR CommandLine:\:\/\/192.168.* OR CommandLine:\:\/\/172.16.* OR CommandLine:\:\/\/172.17.* OR CommandLine:\:\/\/172.18.* OR CommandLine:\:\/\/172.19.* OR CommandLine:\:\/\/172.20.* OR CommandLine:\:\/\/172.21.* OR CommandLine:\:\/\/172.22.* OR CommandLine:\:\/\/172.23.* OR CommandLine:\:\/\/172.24.* OR CommandLine:\:\/\/172.25.* OR CommandLine:\:\/\/172.26.* OR CommandLine:\:\/\/172.27.* OR CommandLine:\:\/\/172.28.* OR CommandLine:\:\/\/172.29.* OR CommandLine:\:\/\/172.30.* OR CommandLine:\:\/\/172.31.* OR CommandLine:\:\/\/127.* OR CommandLine:\:\/\/169.254.*))