If the Trojan receives this echo, it will create the following file that the Trojan uses as a signal that it was able to successfully communicate with its C2 server: %APPDATA%\Windows\ShwDoc.srv If the Trojan determines the C2 server wishes to send a command, it sends an HTTP request to the following URL: hxxp://www.windowspatch[.]com/tahw?<hex(STDOUT of whoami command)> The Trojan will first check the response to this request for the string spoo, which signifies the C2 does not wish to issue a command