The Trojan will respond to the C2 to notify it of a successful upload by sending a URL structured as follows:http://<c2 domain>/resp?<hex(Environment.UserName/Environment.MachineName)>AAZ<hex(“File Uploaded”)> The download command (3) reads the contents of a specified file and sends the data to the C2 server