Sqlite Module In Temp Folder

This analytic detects the creation of `sqlite32.dll` or `sqlite64.dll` files within the `%temp%` directory. This activity is often associated with the IcedID malware, which utilizes sqlite3 modules to parse browser databases and exfiltrate sensitive information like banking details, credit card information, and credentials. Detection of this behavior could indicate data theft and compromise of user accounts.