0.js also downloads two additional files from the C&C server (green.ddd and green.tmp) The first of these files, green.ddd, is an executable file internally named “SEDll_Win32.dll”. This is a known backdoor used by this actor since 2014 for the same purpose: decrypting and executing the final JavaScript backdoor “Orz