(Image:\\schtasks.exe OR OriginalFileName:schtasks.exe) CommandLine:\/Create* (CommandLine:FromBase64String* OR CommandLine:encodedcommand*) (CommandLine:Get\-ItemProperty* OR CommandLine:\ gp\ *) (CommandLine:HKCU\:* OR CommandLine:HKLM\:* OR CommandLine:registry\:\:* OR CommandLine:HKEY_*)