| Feature | | Fake / Virus | | :--- | :--- | :--- | | Location | C:\Windows\System32 | C:\Users\YourName\AppData\Local\Temp or C:\ProgramData | | Publisher | Microsoft Windows | Unknown or "Microsoft Corporation" (spoofed) | | File Size | ~500 KB – 1 MB | Varies widely (often much larger) | | CPU Usage | Spikes only during active searches or indexing. Idles at 0% | Often runs constantly at 20-50% CPU | | Digital Signature | Valid Microsoft signature | Invalid or missing signature |