The main C2 loop starts after the initial upload of the reconnaissance data, iterating once every approximately 30 seconds. For the first five minutes, each iteration will capture a screenshot of the display and upload it to the "normal" subdirectory with an encoded timestamp as the filename. After the first five minutes, the screenshot uploads once every five minutes