Primarily Windows-based systems via phishing or compromised software installers. 1. Key Contents A "collection" archive of this type generally contains:

Immediately change all passwords for accounts that were logged in on the machine.

If you have encountered this file in a real-world environment:

Disconnect the affected machine from the network to prevent further data exfiltration.

Often deployed via a loader that executes in memory to evade detection by standard antivirus.

Text files containing captured browser passwords, cookies, and autofill data.