They may write code to remote system processes to hide their activity from the user.
They often use the Windows Task Scheduler ( schtasks.exe ) to ensure they run automatically every time the computer starts. DDOS.exe
Files named "DDOS.exe" or similar (e.g., "NXBBSEC-DDOS.exe") are almost exclusively identified as malware in sandbox environments: They may write code to remote system processes