(OriginalFileName:MpCmdRun.exe OR Image:\\MpCmdRun.exe OR CommandLine:MpCmdRun.exe* OR Description:Microsoft\ Malware\ Protection\ Command\ Line\ Utility) (CommandLine:DownloadFile* CommandLine:url*)