(((Image:\\schtasks.exe OR OriginalFileName:schtasks.exe) (CommandLine:create* CommandLine:ONSTART*)) OR ((Image:\\reg.exe OR OriginalFileName:reg.exe) (CommandLine:add* CommandLine:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run*))) ((CommandLine:rundll32* CommandLine:.wll* CommandLine:#1*) (CommandLine:Sens\ Api* OR CommandLine:OneDrive*))