The output of the downloaded batch file is saved to “%PUBLIC%\Libraries\tp\&lt;batch filename&gt;.txt”. The script will then upload the output of this batch file by including the data in a sequence of DNS queries. The exfiltrates the output of the batch script by splitting up the data within the text file into chunks up to 23 bytes and sends the data within a series of DNS queries that have the following structure