Scheduled Task from a Browser or Compression Utility Descendant

sequence with maxspan=5m
 [process where event.action == "start" and
 (process.Ext.relative_file_creation_time <= 1800 or process.Ext.relative_file_name_modify_time <= 1800) and
 (process.code_signature.trusted == false or process.code_signature.exists==false) and
 not process.code_signature.status : ("errorExpired", "errorCode_endpoint*") and

 /* Direct Child */
 (
  (process.executable : ("?:\\Users\\*\\Downloads\\*", "*\\AppData\\Local\\Temp\\*") and
   process.parent.name: ("explorer.exe", "chrome.exe", "msedge.exe", "firefox.exe", "7zFM.exe", "iexplore.exe", "winrar.exe")) or

 /* Descendant */
  descendant of [
  process where event.action == "start" and
  (process.code_signature.trusted == false or process.code_signature.exists==false)
  and process.parent.name: ("explorer.exe", "chrome.exe", "msedge.exe", "firefox.exe", "7zFM.exe", "iexplore.exe", "winrar.exe") and
  process.executable: ("*\\Downloads\\*", "*\\AppData\\Local\\Temp\\*") and
  process.pe.original_file_name != "Adobe Installer" and
  not process.hash.sha256 :
                  ("aaeaae8a88cab0ff1401e8c8e0fca3d92c758844e17b198355951c8fc842ccaa",
                   "62925978d2c0de2c69801302eb7040cb633068a44cd83415d15f8c25f5bebff6",
                   "be7beb3d9b8c56e1395bfee0d31503e0156eeba0312d385ca77068b95d1d4bea",
                   "c3ab138aa176fda1a43e3a38d376e8ec284b610d9dacb9db0d08e503d071e4fe",
                   "52e1e3053aadaccf78837dffaaa6f9ed41b201e0019f22a4880a5327d7650206",
                   "a6296af76588a81448c2e7dced89daa29a4eba92a0ce7e5da2b868cd6e511bda")
  ]
 ) and
 not (process.executable : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*") and process.code_signature.trusted == true) and
 process.pe.imphash != "28a18f58924d2f4dd2bffbbc85a12952"
 ] by process.entity_id
 [file where event.action : "creation" and process.name : "svchost.exe" and
  file.path : ("?:\\Windows\\Tasks\\*", "?:\\Windows\\System32\\Tasks\\*")] by Effective_process.entity_id