Behavioral Analysis

findstr.exe findstr /I "opssvc wrsa"

tasklist.exe tasklist

tasklist.exe tasklist

findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"

cmd.exe cmd /c md 764661

extrac32.exe extrac32 /Y /E Fm

findstr.exe findstr /V "Tunnel" Addresses

cmd.exe cmd /c copy /b 764661\Macromedia.com + Totally + York + Drunk + Baghdad + Benz + Glasses + Pac + Tender + Racing + Deluxe + Derived 764661\Macromedia.com

cmd.exe cmd /c copy /b ..\Complement + ..\Soundtrack + ..\Plumbing + ..\Hills F

Macromedia.com Macromedia.com F

choice.exe choice /d y /t 15