[How malware steals data]

Hi,

I'm not sure if this is the place to ask this.

I recently ran a scan after receiving pop-ups. Malwarebytes found a few infected files, including two ( log & dclog) located in Temp file. They were labelled in red 'stolen.data'. I have seen this a few times on the forum. ( I do not have the scan log since I reformatted my comp after that to ensure complete removal of the infection.)

Are these files temporary storage of stolen data before being transferred to the hacker, or has the data already been sent?

Would appreciate your clarification. Thanks.