Attempts to remain hidden from cybersecurity analysis by explicitly checking its environment for signs of debugging. Leverages existing Windows registry key that is enabled by default in Windows 10 to store configuration data. Employs polymorphic code, changing its runtime footprint during code execution to thwart memory analysis and evade signaturing. Uses position independent code (PIC) to throw off static analysis tools