– The malware creates a scheduled task or registry run entry, often masquerading as a Windows Update or Adobe service.
