The file is saved to: C:\Users\[Username]\AppData\Local\Temp\notepad.exe  00 00 04  Content after command ID is written to: C:\Users\[Username]\AppData\Local\Temp\notepad2.exe  00 00 05  The files notepad1.exe and notepad2.exe are concatenated together and written to C:\Users\[Username]\AppData\Local\Temp\newnotepad.exe and executed  00 00 06  The contents of the following file is sent to the server: C:\Users\[Username]\AppData\Local\Temp\note.txt  00 00 07  The string following the command ID is executed using "cmd /C" and results are sent to server   Links to APT3 On October 28, we observed APT3 sending out spearphishing messages containing a compressed executable attachment