will attempt to detect if the infected host is configured to a proxy. If so,  will send beacons via an HTTP POST request; otherwise it will send beacons via UDP/6000.  will also use HTTP to download resources that contain an IP address and Port Number pair to connect to for further C2. Adversaries can also use  to establish an RDP connection with a controller over TCP/7519.