When the user clicks download, they don't get the software. Instead, they usually get a . The password is provided in a text file or on the site. This is done to prevent antivirus programs from scanning the contents of the archive before it’s opened. The Payload

: A static image claiming the file was scanned by McAfee or Norton and found to be "Clean."

Inside the archive is an .exe file disguised as an "Activator" or "Setup." Once run, the "story" takes a dark turn: