Figure 8 CARROTBAT downloading final payload via certutil   The downloaded CAB file has the following properties:    MD5 a943e196b83c4acd9c5ce13e4c43b4f4   SHA1 e66e416f300c7efb90c383a7630c9cfe901ff9fd   SHA256 cfe436c1f0ce5eb7ac61b32cd073cc4e4b21d5016ceef77575bef2c2783c2d62   File Type Microsoft Cabinet archive data, 181248 bytes, 3 files      The following three files and their descriptions are dropped by this CAB file:      Filename Purpose   Install.bat Installation batch script responsible for copying the other files to C:\Users\Public\Downloads and setting the Run registry key to ensure persistence