((ParentImage:\:\\Temp\\* OR ParentImage:\\AppData\\Local\\* OR ParentImage:\\AppData\\Roaming\\* OR ParentImage:\\Temporary\ Internet* OR ParentImage:\\Users\\Public\\* OR ParentImage:\\Windows\\Temp\\*) Image:\\schtasks.exe CommandLine:\/Create\ *) (-(CommandLine:update_task.xml* OR CommandLine:unattended.ini*))