Sample_10120351200_ISO_035117img.exe "C:\Users\test22\AppData\Local\Temp\Sample_10120351200_ISO_035117img.exe"
204vbc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
2660cmd.exe "C:\Windows\System32\cmd.exe" /c schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\test22\AppData\Roaming\update\update.exe'" /f
2888schtasks.exe schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\test22\AppData\Roaming\update\update.exe'" /f
2232cmd.exe "C:\Windows\System32\cmd.exe" /c copy "C:\Users\test22\AppData\Local\Temp\Sample_10120351200_ISO_035117img.exe" "C:\Users\test22\AppData\Roaming\update\update.exe"
2904