The screenshot in Figure 8 of the inf method within a Cannon sample (SHA256: 4405cfbf28. ) shows the information gathered that is exfiltrated to the C2 via email, specifically with RunningPlace and LogicalDrives header strings