TRINITY malware used by  identifies payment card track data on the victim and then copies it to a local file in a subdirectory of C:\Windows\. Once the malware collects the data,  actors compressed data and moved it to another staging system before exfiltration.