(Image:\\schtasks.exe* OR OriginalFileName:schtasks.exe) (CommandLine:wscript* OR CommandLine:vbscript* OR CommandLine:cscript* OR CommandLine:wmic\ * OR CommandLine:wmic.exe* OR CommandLine:regsvr32.exe* OR CommandLine:powershell* OR CommandLine:\\AppData\\*) (CommandLine:once* CommandLine:00\:00*)