The run command (1) creates the process cmd.exe /c with the command parameters appended and will write the output of the command in hexadecimal format to the file %APPDATA%\tmpCa.vbs. The Trojan will then read the hexadecimal formatted contents of this file in 1500 byte blocks, sending each 1500 bytes of data from the file to the C2 server via an HTTP GET request to a URL with the following structure: http://&lt;c2 domain&gt;/resp. hex(Environment.UserName/Environment.MachineName)&gt;AAZ&lt;hex(command prompt output)&gt; The upload command (2) writes data provided by the C2 to a specified file. hex(Environment.UserName/Environment.MachineName)&gt;AAZ&lt;hex("File Uploaded")&gt; The download command (3) reads the contents of a specified file and sends the data to the C2 server. If the file does not exist, the Trojan will send the C2 server a message &lt; File Not Found &gt; by sending the following URL: http://&lt;c2 domain&gt;/resp. hex(Environment.UserName/Environment.MachineName)&gt;AAZ&lt;hex("&lt; File Not Found &gt;")&gt; If the file exists, the Trojan will read the contents of the specified file and compresses the contents using the GZipStream class. The Trojan then gets the hexadecimal values of the compressed data and will replace the following hexadecimal values on each line with ASCII characters to further compressed the data