cmd /c pull <filename>: Adds filename to temp.zip, Base64 encodes, and uploads to control server - cmd /c chip <string>: Deletes current ipnet.ini config file. cmd /c put <new_file_name> <existing_file_name>: Copies existing file to new file name. Deletes existing file. user <parameters>: Executes downloaded file with parameters specified using CreateProcessAsUser - cmd /c <command>: Executes command on infected endpoint