(Image:\\ping.exe OR Image:\\arp.exe) ((CommandLine:\ 0x* OR CommandLine:\/\/0x* OR CommandLine:.0x* OR CommandLine:.00x*) OR (CommandLine:http\:\/\/%* CommandLine:%2e*) OR (CommandLine:https?://[0-9]{1,3}\\.[0-9]{1,3}\\.0[0-9]{3,4} OR CommandLine:https?://[0-9]{1,3}\\.0[0-9]{3,7} OR CommandLine:https?://0[0-9]{3,11} OR CommandLine:https?://(?:0[0-9]{1,11}\\.){3}0[0-9]{1,11} OR CommandLine:https?://0[0-9]{1,11} OR CommandLine: [0-7]{7,13})) (-CommandLine:https?://(?:(?:25[0-5]|(?:2[0-4]|1\\d|[1-9])?\\d)(?:\\.|\\b)){4})