are hardcoded in each sample (from three to six URLs in a single sample) and it will iterate over the hardcoded list of C&C server addresses until it is able to decode a valid C&C URL successfully. An example