The C2 server response to a beacon sent by a variant of  contains a 36-character GUID value that is used as an encryption key for subsequent network communications. Some variants of  use various XOR operations to encrypt C2 data.