according to our telemetry, the fetched payload is a Windows DLL containing backdoor functionalities. Using this inmemory backdoor, the malware operator executed numerous shell commands to gather victim information: