It was heavily obfuscated, keeping users in the dark about what they’re installing and running.