Executes dropped EXE

Unexpected DNS network traffic destination

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Writes a Windows system DLL name to a user directory

A module named after a system DLL outside System32 can be loaded instead of the real one by a program searching that directory.

Network Service Discovery

Attempt to gather information on host's network.

Writes to the Master Boot Record (MBR)

Bootkits write to the MBR to gain persistence at a level below the operating system.

Drops file in System32 directory