backdoors are sometimes executed using PowerShell launchers and have in some cases used predictable filenames. For example, NetSupportrelated scripts and executables observed during COLDDRAW incidents have typically used the filename ra or ra<#> whereas BUGHATCH