: It frequently modifies the Windows Registry or creates scheduled tasks to ensure it runs automatically upon system startup.

: Often spread through phishing emails containing malicious attachments or links, or bundled with "cracked" software downloads.

: Upon launch, the process may appear as a background task to avoid alerting the user.