CoolClient Clipboard Monitor Storage AppxProvisioning.xml File Creation

Kaung Khant Ko@kaungkhantko

•updated Jan 27, 2026•25•1•164

Monitors for the creation of 'C:\ProgramData\AppxProvisioning.xml'. The updated CoolClient backdoor, used by the HoneyMyte APT group, uses this specific file path to store XOR-encrypted clipboard and active window monitoring data.