tokens: 2015–2016 Starting from mid-2015 , the Trojan began using the AES algorithm to encrypt data communicated between the infected device and the C & C : Also starting with the same version , data is sent in a POST request to the relative address with the format “ / [ number ] ” ( a pseudo-randomly generated number in the range 0–9999 ) .