The PowerShell chain is launched from an obfuscated JScript scriptlet previously downloaded from the command and control (C2) server and launched using cmstp.exe. PowerShell downloader The downloaded PowerShell script code is obfuscated in several layers before the last layer is reached. Beginning of the "download and load" shellcode The shellcode is relatively simple and begins with a XOR loop that deobfuscates the rest of the code