The C2 communications begins with a beacon to the following URL: hxxp://www.windowspatch[.]com/khc?<hex(STDOUT of whoami command)> If the C2 server wishes to send a command, it will respond to the beacon above by echoing the whoami command results sent by the Trojan to the C2 in the URL