How TA444 Is Being Used in an Infection Chain

The two primary methods that I see are sort of a beachhead, the very initial access sort of point that TA444 uses them for and it's basically a command line to download something from remote URL. So they are sort of like one time throw out use from at least everything that I've seen. And so it's it can be like as like heavyweight, I guess as you want it to be or as lightweight,.