DarkWatchman runs through a standard set of operations on startup, and then continues to loop through a smaller group of functions on a regular basis to feed information back to the C2 server and get new commands. When initially executed by the scheduled task, DarkWatchman checks the registry for an autostart JavaScript snippet and if one exists evaluates it