Gr8 post,I have read that "an AutoIt automation script can be converted into a compressed, stand-alone executable which can be run on computers that do not have the AutoIt interpreter installed" so why in this case “txsexy.exe” i.e Legitimate AutoIT v3 Executable was used ?

I have seen standalone ones but cant figure out why would a attacker increase his executables size by incorparting a legitimate exe when he/she could have made a standalone(bpouses + ogrtsfsrpaz.LRD)...