cmd /c pull &lt;filename&gt;: Adds filename to temp.zip, Base64 encodes, and uploads to control server - cmd /c chip &lt;string&gt;: Deletes current ipnet.ini config file. cmd /c put &lt;new_file_name&gt; &lt;existing_file_name&gt;: Copies existing file to new file name. Deletes existing file. user &lt;parameters&gt;: Executes downloaded file with parameters specified using CreateProcessAsUser - cmd /c &lt;command&gt;: Executes command on infected endpoint