The archive is usually generated by "infostealer" malware (such as Raccoon, RedLine, or Vidar). It packages targeted data locally before uploading it to a Command and Control (C2) server.

Stolen tokens from applications like Discord, Telegram, or cryptocurrency wallets. Malware Behavior

Text files or JSON metadata detailing the hardware, IP address, and running processes of the infected host.