It is capable of the following functions:  Collect file/folder/drive information Download files and additional malware Launch/terminate/enumerate process Update configuration data Delete files Inject code from files to other running process Utilize proxy Open reverse shell Run in passive mode — instead of actively connecting to the command and control (C&C) server, the backdoor will open and listen to a port then receive commands through it  Once the backdoor is loaded, it will then load the encrypted configuration file Auditcred.dll.mui/rOptimizer.dll.mui to extract the C&C information and connect to it