 Command  Behavior  Compress_Files  Compresses specified files or directories to a ZIP archive  Decompress_File  Extracts files from a specified ZIP archive  AutoRun  Creates a scheduled task for persistence  CloseEverything  Kills the Everything process with the command “TASKKILL /F /IM Everything.exe”  OpenEverything  Downloads and runs Everything from voidtools  CloseFFmpegLive  Kills the FFmpeg process with the command “TASKKILL /F /IM ffmpeg.exe”  OpenFFmpegLive  Downloads and runs FFmpeg (for screen video capture)  DeleteFile  Deletes files or directories at specified locations  CreateDir  Creates a directory at a specified location  ShowFiles  Gets the disk partition or lists a specified directory with detailed information, including file name, file path, size, create time, and time of modification  Download_File  Downloads a URL and saves the file to a specified location  Upload_File  Uploads the victim’s files to cloud storage  uUninstall  Kills the BIOPASS RAT process and deletes installed files.  CloseObsLive  Kills the OBS process with command “TASKKILL /F /IM obs64.exe”  Open_Obs_Live  Downloads OBS Studio and starts live streaming  ProcessList  Lists processes on the victim’s environment and their process identifier (PID)  KillProcess  Kills the process specified by PID with the TASKKILL command  ScreenShot  Takes a screenshot and uploads it to cloud storage  Shell  Executes commands or scripts (subcommands with prefixes subprocess, python, noreturn, getversion, restart)  SnsInfo  Lists QQ, WeChat, and Aliwangwang directories  InstallTcpdump  Downloads and installs the tcpdump tool  PackingTelegram  Compresses and uploads Telegram's “tdata” directory to cloud storage  CloseProxy  Kills frpc process with command “TASKKILL /F /IM frpc.exe”  OpenProxy  Downloads and installs the frp proxy client in the “%PUBLIC%” folder  OpenVnc  Downloads and installs jsmpeg-vnc tool in the “%PUBLIC%/vnc/” folder  CloseVnc  Kills the VNC process with the command “TASKKILL /F /IM vdwm.exe”  GetBrowsersCookies  Decrypts the cookie file of the browser and uploads it to cloud storage  GetBrowsersLogins  Decrypts the login file of the browser and uploads it to cloud storage  GetBrowsersHistories  Uploads the history file of the browser to cloud storage  GetBrowsersBookmarks  Uploads the bookmark file of the browser to cloud storage   Table 2.