Batch script invoked by the web browser extension via native messaging to launch the Python backdoor.
