Audio surveillance: The malware uses the NAudio library to interact with the microphone and manage the audio stream. The library is stored server-side and pushed to the victim’s machine using a special command. The bot will display the messages using a standard message box. The log includes the process name used by the victim, and keystrokes. The theft is performed by a specific component that enumerates credentials saved in various browsers. Process manager: The attacker can obtain a list of running processes and terminate these by using a specific button