RogueRobin uses a command prompt to run a PowerShell script from Excel. To assist in establishing persistence, RogueRobin creates "%APPDATA%\OneDrive.bat" and saves the following string to it:"powershell.exe -WindowStyle Hidden -exec bypass -File “%APPDATA%\OneDrive.ps1”".