(Image:\\schtasks.exe OR OriginalFileName:schtasks.exe) ((CommandLine:\ \-create\ * OR CommandLine:\ \/create\ * OR CommandLine:\ –create\ * OR CommandLine:\ —create\ * OR CommandLine:\ ―create\ *) (CommandLine:\ audiodg* OR CommandLine:\ conhost* OR CommandLine:\ dwm.exe* OR CommandLine:\ explorer* OR CommandLine:\ lsass* OR CommandLine:\ lsm* OR CommandLine:\ mmc* OR CommandLine:\ msiexec* OR CommandLine:\ regsvr32* OR CommandLine:\ rundll32* OR CommandLine:\ services* OR CommandLine:\ spoolsv* OR CommandLine:\ svchost* OR CommandLine:\ taskeng* OR CommandLine:\ taskhost* OR CommandLine:\ wininit* OR CommandLine:\ winlogon*))