(Image:\\schtasks.exe OR OriginalFileName:schtasks.exe) (CommandLine:\/change* CommandLine:\/TN* CommandLine:\/RU* CommandLine:\/RP*)