In an attempt to hide stolen information, this variant of BitRAT stores collected data (keystrokes, clipboard data, etc.) in an alternate data stream (ADS) file that is majority encoded in Base64.