: Screenshots of your desktop and lists of installed hardware. Indicators of Compromise (IoCs)

: Notifications from Windows Defender or your AV regarding "Trojan:Win32/Stealer" or "Injection" attempts.

: Saved passwords, credit card info, and autofill data.

: The malware typically performs "information stealing," which includes:

: Allowing attackers to bypass Multi-Factor Authentication (MFA) by hijacking active login sessions.

: Users are directed to download the .rar file under the guise of obtaining a free version of paid software.