To obtain the session ID and pre-shared key, the payload will issue a query to resolve the following domain: mail. random number between 100000 and 999999&gt;.&lt;c2 name&gt; This request notifies the C2 server that the payload is about to send system specific data as part of the initial handshake