1) Wscript makes subsequent DNS requests for a Stage Two payload 2) ‘Rundll32.exe -> PicturesViewer.dll, DllRegisterServer,’ allowing for C2 communication 3) MSIExec, spawning multiple Cmd.exe processes and Explorer injection 4) Commands run by the C2