(Image:\\schtasks.exe (CommandLine:\ \-create\ * OR CommandLine:\ \/create\ * OR CommandLine:\ –create\ * OR CommandLine:\ —create\ * OR CommandLine:\ ―create\ *)) (CommandLine:curl\ * CommandLine:http* CommandLine:\-o*) CommandLine:powershell*