Commands   Description    0x97A168D9697D40DD  Download and validate file (XXHash comparison) from C2 server    0x7CF812296CCC68D5  Upload file to C2 server    0x652CB1CEFF1C0A00  Load PE file    0x27595F1F74B55278  Download, validate (XXHash comparison), execute file, and send output to C2 server    0xD290626C85FB1CE3  Format the current timestamp    0x409C7A89CFF0A727  Capture the desktop screenshot in PNG format and send it to C2    None of the above  The received buffer is executed via cmd.exe and the output is then sent to the C2 server    Table 5: Supported commands  Conclusion While APT10 consistently targets the same geolocation and industry, the malware they use is actively evolving