It developed a file stealer to search C:\ and collect files with certain extensions. It also executed a script to enumerate all drives, store them as a list, and upload generated files to the C2 server.