Following successful infiltration, the malware persists through registry: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run The command line execution leads to PowerShell code executed from a different registry value .