Executes dropped EXE

Loads dropped DLL

Unexpected DNS network traffic destination

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Creates a large amount of network flows

This may indicate a network scan to discover remotely running services.

Looks up external IP address via web service

Uses a legitimate IP lookup service to find the infected system's external IP.

Drops file in System32 directory

Suspicious use of SetThreadContext

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.