First, they use COM object hijacking to make the malware persistent on the system even though the custom backdoor is installed only for a few hours. Second, the hex-encoded string is the C&amp;C used by the custom backdoor while in the Delphi backdoor the C&amp;C is embedded in the configuration