A thorough explanation of what information is collected can be found in a breakdown by Cofense from late 2018.   The script verifies all parts of the malware have been downloaded.  After downloading the payload, the XSL script checks to make sure every piece of the malware was downloaded.   One of the twelve download commands as detected by the Cybereason platform in same variant of Astaroth.   The twelve downloaded files