Figure 12: DrAGon_MidDLe stores the list of proxy URLs used to interact with C2 server Section 2 The second section of the PowerShell script has the ability to perform encryption and decryption of messages that are exchanged between the system and the C2 server