We have seen the following HTTP POST parameters within the Zebrocy C++ samples: porg structOne oq volume DDE Details The author of the DDE document used in the February 2018 attacks used some obfuscation techniques in an attempt to evade detection