There are three types of URLs present in the decrypted configuration. The first type of URL listed in the configuration data is used for the plain HTTP (that is, non-Tor) communication with C&amp;C servers. The bot reports to the C&amp;C server using the typical request pattern: for example, the initial checkin to the C&amp;C server is in the form of: cfg_url + “/images/” + encoded_data + (.jpeg||.gif||.bmp