All the text files are now packed into the archive temp.zip (%temp%\temp.zip) - zip is Base64 encoded (with a custom key, same as that used in the malicious document) and then copied to post.txt - txt is uploaded to the control server