Image:\\schtasks.exe (CommandLine:\/delete* OR CommandLine:\/change*) (CommandLine:\/TN* CommandLine:\\Microsoft\\Windows\\Defrag\\ScheduledDefrag*)