Behavioral Analysis

schtasks.exe "schtasks" /create /tn "sys32" /sc ONLOGON /tr "C:\Users\test22\AppData\Local\Temp\stub.exe" /rl HIGHEST /f

schtasks.exe "schtasks" /create /tn "sys32" /sc ONLOGON /tr "C:\Users\test22\AppData\Roaming\SubDir\sys32.exe" /rl HIGHEST /f

cmd.exe cmd /c ""C:\Users\test22\AppData\Local\Temp\Dq3byUuThJIV.bat" "