Once the preliminary system information has been gathered by the instrumentor, it will usually download and deploy three key implants on the endpoint. All these implants are DLL files meant to serve very specific purposes.A marker file "qwer.txt" is created by the instrumentor script prior to downloading and deploying any of the implants. This file acts as an infection marker for the implants that check for the presence of this file before performing any malicious activities. The instrumentor script downloads the DLL implants and then creates a temporary PowerShell script to deploy the DLL on the infected system.The DLL implants downloaded to a file on disk usually have their first byte modified. This is used as an evasion mechanism to prevent recognition of the executable file format. Once the DLL is downloaded, the PowerShell script resets its first byte to 0x4D. The DLL is then deployed on the endpoint using rundll32.exe.PowerShell script modifying and running the DLL implant using rundll32.exe