When extracted and executed, files inside this archive typically perform the following actions:

: Some variants attempt to disable Windows Defender real-time protection or change registry values to ensure they run automatically (persistence).

: Monitors and captures keyboard inputs or scrapes saved passwords from browsers. Recommended Actions If you have downloaded or attempted to open this file:

: Reads computer name, machine GUID, and location settings.

: Likely an InfoStealer (such as RedLine or similar families) that targets browser data and crypto wallets.