enquiry_00207301020785png.exe "C:\Users\test22\AppData\Local\Temp\enquiry_00207301020785png.exe"
2504enquiry_00207301020785png.exe "C:\Users\test22\AppData\Local\Temp\enquiry_00207301020785png.exe"
1108cmd.exe "C:\Windows\System32\cmd.exe" /c schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\test22\AppData\Roaming\browser\browser.exe'" /f
2256schtasks.exe schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\test22\AppData\Roaming\browser\browser.exe'" /f
816cmd.exe "C:\Windows\System32\cmd.exe" /c copy "C:\Users\test22\AppData\Local\Temp\enquiry_00207301020785png.exe" "C:\Users\test22\AppData\Roaming\browser\browser.exe"
2540