In the bat execution, the script extracts two independent binaries from your base64 encoded text, AES decrypts, and GZIP decompresses it to provide two separate byte arrays.The payload InstallStager.exe is usually a compilation in the open up-resource rootkit named r77-rootkit – a fileless ring 3 rootkit published in .NET. This rootkit supports t