The following commands are supported by the malware:  Command ID  Description  00 00 00  Content after command ID is written to: C:\Users\[Username]\AppData\Local\Temp\notepad1.exe  00 00 01  Deletes the files: C:\Users\[Username]\AppData\Local\Temp\notepad.exe C:\Users\[Username]\AppData\Local\Temp\newnotepad.exe  00 00 02  Malware exits  00 00 03  Malware downloads the URL that follows the command ID