In requesting commands, sending execution results of OS commands or collected authentication information, Flagpro accesses a C&C server with specific URL paths and queries. It encodes data with Base64 and sends to the C&C server. Following table shows relations between Flagpro’s activities and the URL paths and queries