As seen in the above request, the Trojan will generate a URL for its beacon with the following structure:http://<c2 domain>/chk?<hex(Environment.UserName/Environment.MachineName)> The Trojan will issue a request to this URL to check (hence the chk string in the URL) to see if the C2 server has a command for the Trojan to run