: A legitimate, digitally signed executable (often a renamed Windows system tool or a common application like VLC or OneDrive).
: Attempts to reach out to a Command and Control (C2) server via HTTP/HTTPS to receive further instructions. 3. Forensic Artifacts
: Scans for virtual machines or debuggers to avoid analysis.