After the threat has installed itself, dropped its files, and gathered some information about the system it contacts the command and control server on port 80 and sends some basic information about the compromised