The switch statement checks for 19 cases, between 101 and 119. (Updated to correct command IDs, thanks @mykill!)    Command ID Function   Description   101 getInfoOSX Gathers username and OSX version and responds using the encrypted form of the following string: “Mac OS X – [OSX version] x64<br>\nUser name – [username]”   102 getProcessList Runs “ps aux” to obtain a list of running processes   103 remoteShell Runs supplied command using “/bin/sh”   104 getInstalledAPP Gets a list of installed applications by running the command “ls -la /Applications”   105 showBackupIosFolder Checks to see if an IOS device was backed up to the system by running the command “ls -la ~/Library/Application\ Support/MobileSync/Backup/”   106 downloadFileFromPath Uploads a file from a specified path   107 createFileInSystem Downloads a file, specifically provided within the C2 server’s HTTP response   108 execFile Executes a specified file on the system using the NSTask:launch method   109 deletFileFromPath Deletes a specified file using the NSFileManager:removeFileAtPath method   110 takeScreenShot Takes a screenshot using the CGGetActiveDisplayList, CGDisplayCreateImage, NSImage:initWithCGImage methods