When generating the URL for the HTTP requests issued to the C2 server, the Trojan chooses a random folder from the following to include within the URL path: watch/? search/? find/? results/? open/? search/? close/? XAgent also will choose several parameters names from the following list when finishing the construction of the C2 URL: itwm= text= from=