Our analysis shows that the following filenames would store the webshell contents on the server in the event of successful exploitation:  0xd0m7.jsp myshell.jsp shell.jsp tomcatwar.jsp wpz.jsp  The webshell contents written to these files are very similar to the code included in the publicly available PoC as well.