an identifier unique for each victim (generated via CoCreateGuid API) - executable name and path - geolocation of the victim (retrieved via http://ipinfo.io/json) - strings necessary for creating and deleting the startup .LNK file - notes specific to the victim device (the C&C operator supplies these, if any, via a backdoor command) - flags to indicate an action has already been performed, such as stealing Google Chrome stored credentials stealing Outlook data - stealing Google Chrome stored credentials - stealing Outlook data