SPEAR found that El Machete relied on two primary means to achieve persistence: scheduled tasks and the startup folder. Scheduled tasks commonly used ‘HD_Audio’, ‘Java_Upda’, or ‘Microsoft_up’ as the task name and generally pointed to one of the executables below