Please help to identify the following description belonging to which technique in MITRE and the corresponding tactics: DarkGate installation includes binary code stored in a file located in a hidden directory, such as <code>shell.txt</code>, that is decrypted then executed. DarkGate uses hexadecimal-encoded shellcode payloads during installation that are called via Windows API <code>CallWindowProc()</code> to decode and then execute.