Figure 5: Registry Activity The script then determines the version of Powershell that is being used on the infected system. If the switch associated with the execution of Stage 3 was passed to the 'pre_logic' function at the beginning of this stage, the Stage 3 payload will then be executed immediately