The Trojan then gets the hexadecimal values of the compressed data and will replace the following hexadecimal values on each line with ASCII characters to further compressed the data:   String of hexadecimal values Character replacement 000000 z 00000 x 0000 y 000 g 00 w 01 t   The Trojan then writes 1500 bytes of the hexadecimal formatted data, one per line to a temporary file in the SpecialFolder.CommonApplicationData folder named as:<day><hour><second><millisecond>.tmp The Trojan will then read each line from this temporary file and send them to the C2 server by issuing requests to a URL structured as follows:http://<c2 domain>/resp?<hex(Environment.UserName/Environment.MachineName)>ABZ<hex(1500 characters of hexadecimal formatted file contents)> Once all of the lines of hexadecimal formatted data in the temporary file are sent to the C2 server, the Trojan will send a request to the C2 server to notify the data has been successfully transmitted via a URL structured as follows:http://<c2 domain>/resp?<hex(Environment.UserName/Environment.MachineName)>ABZFinish  Overlaps with Previous OilRig Group Attacks Since May 2016, we have continued to monitor and uncover various attacks and tools associated with the OilRig group