Findings are cross-referenced with databases like or ANY.RUN .

It may attempt to create registry keys or scheduled tasks to ensure it runs every time the system boots.

Manual inspection in a secure environment reveals the malware's specific behaviors: