DLL unhooking: Gets rid of EDR hooks by loading a contemporary copy of “ntdll.dll” from disk to stay away from system hollowing detectionCreating a scheduled endeavor to execute the malware employing PowerShell. PowerShell will decompress and decrypt the final payload (Provider) which will be injected into your winlogon.exe approach and execute