admin@338 actors used the following commands after exploiting a machine with LOWBALL malware to obtain information about files and directories: "dir c:\ >> %temp%\download" "dir "c:\Documents and Settings" >> %temp%\download" "dir "c:\Program Files\" >> %temp%\download" "dir d:\ >> %temp%\download"