: It may delete existing system tasks (like WindowsUpdateCheck ) and recreate them with "Highest" privileges to point toward its own launcher in %APPDATA% .

: The malware often kills existing PowerShell instances to replace them with hidden processes running from application data folders. Risk Assessment

Threat intelligence reports from Hybrid Analysis categorize this activity as high-risk, as it is often part of a broader campaign involving , data exfiltration , and the deployment of persistent web shells.