Behavioral Analysis

schtasks.exe "schtasks" /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\System32\PhotoScreensaver\conhost.exe'" /rl HIGHEST /f

schtasks.exe "schtasks" /create /tn "IMEDICTUPDATE" /sc ONLOGON /tr "'C:\Python27\Scripts\IMEDICTUPDATE.exe'" /rl HIGHEST /f

schtasks.exe "schtasks" /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\System32\nlsbres\csrss.exe'" /rl HIGHEST /f

schtasks.exe "schtasks" /create /tn "winlogon" /sc ONLOGON /tr "'C:\PerfLogs\Admin\winlogon.exe'" /rl HIGHEST /f

schtasks.exe "schtasks" /create /tn "lsm" /sc ONLOGON /tr "'C:\Python27\libs\lsm.exe'" /rl HIGHEST /f

schtasks.exe "schtasks" /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Documents and Settings\WmiPrvSE.exe'" /rl HIGHEST /f

schtasks.exe "schtasks" /create /tn "taskhost" /sc ONLOGON /tr "'C:\Windows\System32\NlsLexicons004c\taskhost.exe'" /rl HIGHEST /f

cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\test22\AppData\Local\Temp\wpC7TVl2rc.bat"