Command Description   search Searches for corresponding files   search&upload Encrypts and adds the corresponding files to the upload directory with the provided name   uploadfile Encrypts and adds the specified file to the upload directory with the provided name   uploadfolder Encrypts and adds the mentioned directory to the upload directory with the provided name   shellexecute Silently executes received command with cmd.exe   wmic Silently executes received command with wmic.exe (for WMI commands)   sendIEPass Encrypts and adds all gathered browser data into files for upload to C2   uninstall Removes files, directory and BITS tasks    Cryptography To decrypt the configuration data, the malware uses XOR with 25-character keys such as “waEHleblxiQjoxFJQaIMLdHKz” that are different for every sample