Task Scheduler can be great, but you may need to see what's trying to update.
UNC6692 relies on email bombing and social engineering to infect victims with Snow malware: Snowbelt, Snowglaze, and ...