 Figure 7: The components dropped in the %Application Data%\Microsoft\CLR\* directory PRB-Backdoor is a backdoor that takes its name from the function used in the final PowerShell script payload, as seen in the figure below.  Figure 8.