All of these files reside in the victim’s %TEMP% directory:    Filename Description   9PT568.dat Contains victim unique identifier   TPX498.dat Keystroke logs   edg499.dat List of interesting files   TPX499.dat Temporarily holds screenshot when given command by C2   up Temporarily contains downloaded file to be executed when given command by C2      Other changes we noticed in this variant include how the malware obfuscates C2 information stored via dead drop resolvers