(Image:\\schtasks.exe (CommandLine:\/Create* CommandLine:\/RU* CommandLine:\/TR* CommandLine:C\:\\Users\\* CommandLine:\\AppData\\Local\\*) (CommandLine:NT\ AUT* OR CommandLine:\ SYSTEM\ *)) (-((ParentImage:\\AppData\\Local\\Temp\\* ParentImage:TeamViewer_.exe*) Image:\\schtasks.exe CommandLine:\/TN\ TVInstallRestore*))