Command   Description    0x31  Fingerprint System via WMI and Registry    0x32  Drop File and execute    0x33  Remote Shell    0x34  Terminate connection with C2    0x35  Download and run batch script    0x36  Download file on machine    0x37  Upload File    Table 2: FELIXROOT backdoor commands Figure 9 shows the log message decrypted from memory using the same mechanism shown in Figure 6 and Figure 7 for every command executed