The earliest variant of Mirage uses an HTTP POST request to transmit the initial phonehome request. This phone-home request contains detailed system information of the infected system to give the C2 server a rough profile of each system that is infected and