Once the system identifier is obtained, the payload gathers system specific information and sends it to the C2 server. The tunneling protocol transmits data by sending a series of DNS queries with the data within the subdomain of the C2 domain. The following shows the specific IP addresses or strings used by the C2 to transmit a success or cancel message depending on the type of DNS query used for C2 communications