(OriginalFileName:HH.exe OR Image:\\hh.exe) (CommandLine:http\:\/\/* OR CommandLine:https\:\/\/* OR CommandLine:\\\\*)