cloud-srv-1.test.mydnsserver.live. 300 IN AAAA 5648:31d2:6548:8b52:6048:8b52:1848:8b52 Where5648:31d2:6548:8b52:6048:8b52:1848:8b52is a part of your payload. So, the agent will resolve some domains to retrieve the payload and then decode it and finally inject it into memory. ...