If Koadic finds that the system is conducive to the attacker’s interests, it downloads a base64-encrypted version of the ANEL malware from the Command-and-Control (C&C) server and executes it.  Encrypted ANEL is decrypted using the “certutil -docode” command.