Create processes Write responses from the control server to a file Send information for all drives Write data sent by the control server to a temporary file matching the file path pattern %temp%\DWS00* Change the time of a file as specified by the control server  The malware changing the file time