• Hides processes, files, network connections, etc.
• Out of the box, single file installer
• Fileless persistence, in-memory injection

• In-memory decryption & execution
• Two-layer execution architecture

• Execution without any files
• Process injection
• Persistence

... It's technically not even there