Executes dropped EXE

Loads dropped DLL

Contacts third-party web service commonly abused for C2

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Creates a large amount of network flows

This may indicate a network scan to discover remotely running services.

Looks up external IP address via web service

Uses a legitimate IP lookup service to find the infected system's external IP.

Password Policy Discovery

Attempt to access detailed information about the password policy used within an enterprise network.