The payload will use a specific regular expressions dependent on the type of DNS query was used to obtain the command string, which can be seen in Table 2:    DNS TYPE Regex Pattern   A Address:\s+(\d+.\d+.\d+.\d+)   AC \d+-\d+-(\d+)-([\w\d+/=]+)-\d-.ac.$Global:domain   AAAA Address:\s+(([a-fA-F0-9]{0,4}:{1,4}[\w|:]+){1,8})   CNAME,MX,TXT,SRV,SOA (\d+)-([\w\d/=+]{0,})\-.$Global:domain    Table 2 Types of responses provided by C2 These regular expressions are used to build strings that the payload will then subject to its command handler