Reads WinSCP keys stored on the system

Tries to access WinSCP stored sessions.

Reads user/profile data of web browsers

Infostealers often target stored browser data, which can include saved credentials etc.

Accesses Microsoft Outlook profiles

Detects references to legitimate web services potentially used as dead drop resolvers

Detects Telegram, Steam, and other legitimate web-service references that may be used to retrieve secondary C2 infrastructure.