Betro.exe "C:\Users\test22\AppData\Local\Temp\Betro.exe"
2760cmd.exe "cmd" /c mkdir "C:\Users\test22\AppData\Roaming\uno"
2824cmd.exe "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\test22\AppData\Roaming\uno\uno.exe'" /f
2876schtasks.exe schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\test22\AppData\Roaming\uno\uno.exe'" /f
2996cmd.exe "cmd" /c copy "C:\Users\test22\AppData\Local\Temp\Betro.exe" "C:\Users\test22\AppData\Roaming\uno\uno.exe"
2916