AC,CNAME,MX,TXT,SRV,SOA Uses the regular expression ‘Address:\s+(\d+.\d+.\d+.\d+)’ and uses the decimal value in the first octet of that IPv4 address    Table 1 Breakdown of query types Once the system identifier is obtained, the payload gathers system specific information and sends it to the C2 server