Changes its process name

Reads user data of web browsers

Reads stored browser data which can include saved credentials.

Checks CPU configuration

Checks CPU information which indicate if the system is a virtual machine.

Legitimate hosting services abused for malware hosting/C2

Reads CPU attributes