cmd.exe "C:\Windows\System32\cmd.exe" /c start /wait "ntkaP" C:\Users\test22\AppData\Local\Temp\Mnemonic.chm
2544hh.exe "C:\Windows\hh.exe" -decompile C:\ProgramData\chm C:\Users\test22\AppData\Local\Temp\Mnemonic.chm
2908cmd.exe "C:\Windows\System32\cmd.exe" /c start /MIN REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v cloud /t REG_SZ /d "%ProgramData%\chm\src\cloud.exe" /f
2996reg.exe REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v cloud /t REG_SZ /d "C:\ProgramData\chm\src\cloud.exe" /f
3060