(Image:\\schtasks.exe OR Image:\\wscript.exe OR Image:\\mshta.exe) TargetFilename:\\AppData\\Roaming\\Microsoft\\* (TargetFilename:.txt OR TargetFilename:.xml)