1) Communicate with the C2, try to forward ports with UPnP and determine available ports and report them to the C2. The usual C2 communication protocol used here is HTTP POST RC4-ciphered JSON data. Instead of saving the downloaded file, QakBot measures the download speed and deletes the received file. 3) Set up external PROXY-C2 connection that was received with command 37 (update config)/module 274 (proxy) by the stager