Technical Information
Malicious functions
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data
- %LOCALAPPDATA%\microsoft\edge\user data\default\login data
Modifies file system
Creates the following files
- %TEMP%\nv\debug.log
- %TEMP%\nv\e_sqlite3.dll
- %TEMP%\eac96bdd4cb34213ac97375019d08e2c
- %TEMP%\619c57a208d94343866745db39eda98d
- %TEMP%\cdp_d09ac7c4\local state
- %TEMP%\cdp_d09ac7c4\default\cookies
- %TEMP%\cdp_d09ac7c4\default\preferences
- %TEMP%\cdp_d09ac7c4\default\secure preferences
- %TEMP%\cdp_d09ac7c4\default\web data
- %TEMP%\cdp_d09ac7c4\default\login data
- %TEMP%\cdp_d09ac7c4\default\history-journal
- %TEMP%\etilqs_7qarxebcnw9cauc
- %TEMP%\cdp_d09ac7c4\default\data_reduction_proxy_leveldb\manifest-000001
- %TEMP%\cdp_d09ac7c4\default\data_reduction_proxy_leveldb\000001.dbtmp
- %TEMP%\cdp_d09ac7c4\default\extension cookies-journal
- %TEMP%\etilqs_8yxlyr6z3qt1ywi
- %TEMP%\cdp_d09ac7c4\default\databases\databases.db-journal
- %TEMP%\etilqs_5cjvr2zfdjlsprx
- %TEMP%\cdp_d09ac7c4\default\top sites-journal
- %TEMP%\etilqs_orcvmq3ok77miez
- %TEMP%\cdp_d09ac7c4\default\data_reduction_proxy_leveldb\log
- %TEMP%\cdp_d09ac7c4\default\history
- %TEMP%\cdp_d09ac7c4\default\databases\databases.db
- %TEMP%\cdp_d09ac7c4\default\extension cookies
- %TEMP%\cdp_d09ac7c4\default\top sites
- %TEMP%\cdp_d09ac7c4\default\favicons-journal
- %TEMP%\etilqs_0wg7mdjy3rc9ibz
- %TEMP%\cdp_d09ac7c4\default\current session
- %TEMP%\cdp_d09ac7c4\default\shortcuts-journal
- %TEMP%\cdp_d09ac7c4\default\345a.tmp
- %TEMP%\cdp_d09ac7c4\default\favicons
- %TEMP%\cdp_d09ac7c4\3843.tmp
- %TEMP%\cdp_d09ac7c4\default\shortcuts
- %TEMP%\cdp_d09ac7c4\default\visited links
- %TEMP%\cdp_d09ac7c4\default\3c99.tmp
- %TEMP%\cdp_d09ac7c4\safe browsing cookies-journal
- %TEMP%\etilqs_a8qumfxv3uciqio
- %TEMP%\cdp_d09ac7c4\default\network action predictor-journal
- %TEMP%\0f2ec6c77e4844079fb74b0dfaacee68-journal
- %TEMP%\0f2ec6c77e4844079fb74b0dfaacee68
- %TEMP%\16ea9de651604c6481af500c5fece6c7-journal
- %TEMP%\16ea9de651604c6481af500c5fece6c7
- %TEMP%\43751e71f5204430a089cead6a6fe62c
- %TEMP%\ee7baa3ab0524ede8bbd9d63158fac06
- %TEMP%\cdp_8c242a1b\local state
- %TEMP%\cdp_8c242a1b\default\preferences
- %TEMP%\cdp_8c242a1b\default\secure preferences
- %TEMP%\cdp_8c242a1b\default\web data
- %TEMP%\cdp_8c242a1b\default\login data
- %TEMP%\cdp_8c242a1b\crashpad\settings.dat
- %TEMP%\cdp_8c242a1b\crashpad\throttle_store.dat
- %TEMP%\cdp_8c242a1b\crashpadmetrics-active.pma
- %TEMP%\cdp_8c242a1b\browsermetrics\browsermetrics-6a7d68da-9e4.pma
- %TEMP%\cdp_8c242a1b\last version
- %TEMP%\cdp_8c242a1b\141f243b-d650-46a3-b4a9-1ef8436479d4.tmp
- %TEMP%\cdp_8c242a1b\33980965-3a31-409f-bb92-c802d9c854a7.tmp
- %TEMP%\cdp_8c242a1b\browsermetrics\browsermetrics-6a7d68de-10e4.pma
- %TEMP%\cdp_8c242a1b\default\code cache\js\index
- %TEMP%\cdp_8c242a1b\default\sync data\leveldb\manifest-000001
- %TEMP%\cdp_8c242a1b\default\sync data\leveldb\000001.dbtmp
- %TEMP%\cdp_8c242a1b\default\code cache\wasm\index
- %TEMP%\cdp_8c242a1b\default\media history-journal
- %TEMP%\cdp_8c242a1b\default\sync data\leveldb\log
- %TEMP%\cdp_8c242a1b\default\history-journal
- %TEMP%\cdp_8c242a1b\default\sync data\leveldb\000003.log
- %TEMP%\cdp_8c242a1b\firstlaunchafterinstallation
- %TEMP%\cdp_8c242a1b\default\site characteristics database\manifest-000001
- %TEMP%\cdp_8c242a1b\default\media history
- %TEMP%\cdp_8c242a1b\default\00213670-7bc1-4e72-8cf5-025c8d077c92.tmp
- %TEMP%\cdp_8c242a1b\default\site characteristics database\000001.dbtmp
- %TEMP%\cdp_8c242a1b\default\history
- %TEMP%\cdp_8c242a1b\default\manifest-000001
- %TEMP%\cdp_8c242a1b\default\000001.dbtmp
- %TEMP%\cdp_8c242a1b\default\site characteristics database\log
- %TEMP%\cdp_8c242a1b\shadercache\gpucache\index
- %TEMP%\cdp_8c242a1b\default\site characteristics database\000003.log
- %TEMP%\cdp_8c242a1b\default\local storage\leveldb\manifest-000001
- %TEMP%\cdp_8c242a1b\default\local storage\leveldb\000001.dbtmp
- %TEMP%\cdp_8c242a1b\shadercache\gpucache\data_0
- %TEMP%\cdp_8c242a1b\shadercache\gpucache\data_1
- %TEMP%\cdp_8c242a1b\shadercache\gpucache\data_2
- %TEMP%\cdp_8c242a1b\shadercache\gpucache\data_3
- %TEMP%\cdp_8c242a1b\grshadercache\gpucache\index
- %TEMP%\cdp_8c242a1b\grshadercache\gpucache\data_0
- %TEMP%\cdp_8c242a1b\grshadercache\gpucache\data_1
- %TEMP%\cdp_8c242a1b\grshadercache\gpucache\data_2
- %TEMP%\cdp_8c242a1b\default\top sites-journal
- %TEMP%\cdp_8c242a1b\grshadercache\gpucache\data_3
- %TEMP%\cdp_8c242a1b\default\favicons-journal
- %TEMP%\cdp_8c242a1b\default\gpucache\index
- %TEMP%\cdp_8c242a1b\default\manifest-000002
- %TEMP%\cdp_8c242a1b\default\cookies-journal
- %TEMP%\cdp_8c242a1b\default\local storage\leveldb\log
- %TEMP%\cdp_8c242a1b\default\000002.dbtmp
- %TEMP%\cdp_8c242a1b\default\top sites
- %TEMP%\cdp_8c242a1b\default\favicons
- %TEMP%\cdp_8c242a1b\default\gpucache\data_0
- %TEMP%\cdp_8c242a1b\default\gpucache\data_1
- %TEMP%\cdp_8c242a1b\default\gpucache\data_2
- %TEMP%\cdp_8c242a1b\default\gpucache\data_3
- %TEMP%\cdp_8c242a1b\default\session storage\manifest-000001
- %TEMP%\cdp_8c242a1b\default\session storage\000001.dbtmp
- %TEMP%\cdp_8c242a1b\default\log
- %TEMP%\cdp_8c242a1b\default\cookies
- %TEMP%\cdp_8c242a1b\default\web data-journal
- %TEMP%\cdp_8c242a1b\default\sessions\session_13431077347886119
- %TEMP%\cdp_8c242a1b\default\session storage\log
- %TEMP%\cdp_8c242a1b\default\session storage\000003.log
- %TEMP%\cdp_8c242a1b\default\code cache\js\index-dir\temp-index
- %TEMP%\cdp_8c242a1b\default\visited links
- %TEMP%\cdp_8c242a1b\default\code cache\wasm\index-dir\temp-index
- %TEMP%\cdp_8c242a1b\default\shared_proto_db\metadata\manifest-000001
- %TEMP%\cdp_8c242a1b\default\shared_proto_db\metadata\000001.dbtmp
- %TEMP%\cdp_8c242a1b\default\43eac811-52b8-49cc-80fd-2fa920c0caef.tmp
- %TEMP%\cdp_8c242a1b\default\platform notifications\manifest-000001
- %TEMP%\cdp_8c242a1b\default\platform notifications\000001.dbtmp
- %TEMP%\cdp_8c242a1b\default\microsoft edge.lnk
- %TEMP%\cdp_8c242a1b\default\shared_proto_db\metadata\log
- %TEMP%\cdp_8c242a1b\default\shared_proto_db\metadata\000003.log
- %TEMP%\cdp_8c242a1b\default\platform notifications\log
- %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\microsoft edge (2).lnk
- %TEMP%\cdp_8c242a1b\default\cache\index
- %TEMP%\cdp_8c242a1b\default\cache\data_0
- %TEMP%\cdp_8c242a1b\default\cache\data_1
- %TEMP%\cdp_8c242a1b\default\cache\data_2
- %TEMP%\cdp_8c242a1b\default\cache\data_3
- %TEMP%\fdae2283bd934c1d8a2a8cf10d5867cf-journal
- %TEMP%\fdae2283bd934c1d8a2a8cf10d5867cf
- %TEMP%\cdp_8c242a1b\cd3f66ad-35c8-4157-a7ce-ccb0b350c821.tmp
- %TEMP%\05d647343abe4ce598af13519a94e8f7
- %TEMP%\cdp_8c242a1b\default\extension state\manifest-000001
- %TEMP%\cdp_8c242a1b\default\extension state\000001.dbtmp
- %TEMP%\cdp_8c242a1b\default\extension state\log
- %TEMP%\cdp_8c242a1b\default\reporting and nel-journal
- %TEMP%\cdp_8c242a1b\default\reporting and nel
- %TEMP%\63f1882c84624e7d80502b502df5c08d
- %TEMP%\cdp_8c242a1b\default\6b0ea655-f4bb-4395-9248-a5e04887183b.tmp
- %TEMP%\cdp_8c242a1b\default\5f85d504-36e4-4f86-8029-19a26643e298.tmp
- %TEMP%\cdp_8c242a1b\default\heavy_ad_intervention_opt_out.db-journal
- %TEMP%\cdp_8c242a1b\default\data_reduction_proxy_leveldb\manifest-000001
- %TEMP%\cdp_8c242a1b\default\data_reduction_proxy_leveldb\000001.dbtmp
- %TEMP%\cdp_8c242a1b\default\data_reduction_proxy_leveldb\manifest-000002
- %TEMP%\cdp_8c242a1b\default\heavy_ad_intervention_opt_out.db
- %TEMP%\cdp_8c242a1b\default\data_reduction_proxy_leveldb\000002.dbtmp
- %TEMP%\cdp_8c242a1b\default\data_reduction_proxy_leveldb\log
- %TEMP%\cdp_8c242a1b\default\previews_opt_out.db-journal
- %TEMP%\cdp_8c242a1b\default\previews_opt_out.db
- %TEMP%\cdp_8c242a1b\default\shortcuts-journal
- %TEMP%\cdp_8c242a1b\default\network action predictor-journal
- %TEMP%\cdp_8c242a1b\default\shortcuts
- %TEMP%\cdp_8c242a1b\870cae27-f891-4904-be76-7ad2d1fbfb12.tmp
- %TEMP%\cdp_8c242a1b\last browser
- %TEMP%\cdp_8c242a1b\default\preferredapps
- %TEMP%\cdp_8c242a1b\default\budgetdatabase\manifest-000001
- %TEMP%\cdp_8c242a1b\default\network action predictor
- %TEMP%\cdp_8c242a1b\default\budgetdatabase\000001.dbtmp
- %TEMP%\cdp_8c242a1b\default\budgetdatabase\log
- %TEMP%\cdp_8c242a1b\default\feature engagement tracker\eventdb\manifest-000001
- %TEMP%\cdp_8c242a1b\default\feature engagement tracker\eventdb\000001.dbtmp
- %TEMP%\cdp_8c242a1b\default\feature engagement tracker\eventdb\log
- %TEMP%\cdp_8c242a1b\default\feature engagement tracker\availabilitydb\manifest-000001
- %TEMP%\cdp_8c242a1b\default\feature engagement tracker\availabilitydb\000001.dbtmp
- %TEMP%\cdp_8c242a1b\default\autofillstrikedatabase\manifest-000001
- %TEMP%\cdp_8c242a1b\default\autofillstrikedatabase\000001.dbtmp
- %TEMP%\cdp_8c242a1b\default\feature engagement tracker\availabilitydb\log
- %TEMP%\cdp_8c242a1b\default\feature engagement tracker\availabilitydb\000003.log
- %TEMP%\cdp_8c242a1b\default\autofillstrikedatabase\log
- %TEMP%\cdp_8c242a1b\default\b89e2d1b-496e-4397-8816-cc0a4836a090.tmp
- %TEMP%\cdp_8c242a1b\569ca21b-1b4b-4a5f-a086-a683af6a94bd.tmp
- %TEMP%\cdp_8c242a1b\browsermetrics-spare.pma.tmp
Deletes following files that it created itself
- %TEMP%\eac96bdd4cb34213ac97375019d08e2c
- %TEMP%\619c57a208d94343866745db39eda98d
- %TEMP%\cdp_d09ac7c4\default\345a.tmp
- %TEMP%\cdp_d09ac7c4\default\3c99.tmp
- %TEMP%\cdp_d09ac7c4\default\cookies
- %TEMP%\cdp_d09ac7c4\default\current session
- %TEMP%\cdp_d09ac7c4\default\databases\databases.db
- %TEMP%\cdp_d09ac7c4\default\databases\databases.db-journal
- %TEMP%\cdp_d09ac7c4\default\data_reduction_proxy_leveldb\current
- %TEMP%\cdp_d09ac7c4\default\data_reduction_proxy_leveldb\log
- %TEMP%\cdp_d09ac7c4\default\data_reduction_proxy_leveldb\manifest-000001
- %TEMP%\cdp_d09ac7c4\default\extension cookies
- %TEMP%\cdp_d09ac7c4\default\extension cookies-journal
- %TEMP%\cdp_d09ac7c4\default\favicons
- %TEMP%\cdp_d09ac7c4\default\favicons-journal
- %TEMP%\cdp_d09ac7c4\default\history
- %TEMP%\cdp_d09ac7c4\default\history-journal
- %TEMP%\cdp_d09ac7c4\default\login data
- %TEMP%\cdp_d09ac7c4\default\network action predictor-journal
- %TEMP%\cdp_d09ac7c4\default\preferences
- %TEMP%\cdp_d09ac7c4\default\secure preferences
- %TEMP%\cdp_d09ac7c4\default\shortcuts
- %TEMP%\cdp_d09ac7c4\default\shortcuts-journal
- %TEMP%\cdp_d09ac7c4\default\top sites
- %TEMP%\cdp_d09ac7c4\default\top sites-journal
- %TEMP%\cdp_d09ac7c4\default\visited links
- %TEMP%\cdp_d09ac7c4\default\web data
- %TEMP%\cdp_d09ac7c4\local state
- %TEMP%\cdp_d09ac7c4\safe browsing cookies-journal
- %TEMP%\0f2ec6c77e4844079fb74b0dfaacee68-journal
- %TEMP%\16ea9de651604c6481af500c5fece6c7-journal
- %TEMP%\43751e71f5204430a089cead6a6fe62c
- %TEMP%\ee7baa3ab0524ede8bbd9d63158fac06
- %TEMP%\cdp_8c242a1b\default\00213670-7bc1-4e72-8cf5-025c8d077c92.tmp
- %TEMP%\cdp_8c242a1b\default\manifest-000001
- %TEMP%\cdp_8c242a1b\browsermetrics\browsermetrics-6a7d68da-9e4.pma
- %TEMP%\cdp_8c242a1b\browsermetrics\browsermetrics-6a7d68de-10e4.pma
- %TEMP%\cdp_8c242a1b\crashpad\settings.dat
- %TEMP%\cdp_8c242a1b\crashpad\throttle_store.dat
- %TEMP%\cdp_8c242a1b\crashpadmetrics.pma
- %TEMP%\cdp_8c242a1b\default\cache\data_0
- %TEMP%\cdp_8c242a1b\default\cache\data_1
- %TEMP%\cdp_8c242a1b\default\cache\data_2
- %TEMP%\cdp_8c242a1b\default\cache\data_3
- %TEMP%\cdp_8c242a1b\default\cache\index
- %TEMP%\cdp_8c242a1b\default\code cache\js\index
- %TEMP%\cdp_8c242a1b\default\code cache\js\index-dir\the-real-index
- %TEMP%\cdp_8c242a1b\default\code cache\wasm\index
- %TEMP%\cdp_8c242a1b\default\code cache\wasm\index-dir\the-real-index
- %TEMP%\cdp_8c242a1b\default\current
- %TEMP%\cdp_8c242a1b\default\gpucache\data_0
- %TEMP%\cdp_8c242a1b\default\gpucache\data_1
- %TEMP%\cdp_8c242a1b\default\gpucache\data_2
- %TEMP%\cdp_8c242a1b\default\gpucache\data_3
- %TEMP%\cdp_8c242a1b\default\gpucache\index
- %TEMP%\cdp_8c242a1b\default\local storage\leveldb\current
- %TEMP%\cdp_8c242a1b\default\microsoft edge.lnk
- %TEMP%\cdp_8c242a1b\default\platform notifications\current
- %TEMP%\cdp_8c242a1b\default\preferences
- %TEMP%\cdp_8c242a1b\default\secure preferences
- %TEMP%\cdp_8c242a1b\default\session storage\current
- %TEMP%\cdp_8c242a1b\default\shared_proto_db\metadata\current
- %TEMP%\cdp_8c242a1b\default\site characteristics database\current
- %TEMP%\cdp_8c242a1b\default\sync data\leveldb\current
- %TEMP%\cdp_8c242a1b\firstlaunchafterinstallation
- %TEMP%\cdp_8c242a1b\grshadercache\gpucache\data_0
- %TEMP%\cdp_8c242a1b\grshadercache\gpucache\data_1
- %TEMP%\cdp_8c242a1b\grshadercache\gpucache\data_2
- %TEMP%\cdp_8c242a1b\grshadercache\gpucache\data_3
- %TEMP%\cdp_8c242a1b\grshadercache\gpucache\index
- %TEMP%\cdp_8c242a1b\last version
- %TEMP%\cdp_8c242a1b\local state
- %TEMP%\cdp_8c242a1b\shadercache\gpucache\data_0
- %TEMP%\cdp_8c242a1b\shadercache\gpucache\data_1
- %TEMP%\cdp_8c242a1b\shadercache\gpucache\data_2
- %TEMP%\cdp_8c242a1b\shadercache\gpucache\data_3
- %TEMP%\cdp_8c242a1b\shadercache\gpucache\index
- %TEMP%\fdae2283bd934c1d8a2a8cf10d5867cf-journal
- %TEMP%\05d647343abe4ce598af13519a94e8f7
- %TEMP%\63f1882c84624e7d80502b502df5c08d
- %TEMP%\cdp_8c242a1b\default\data_reduction_proxy_leveldb\manifest-000001
Moves the following files
- from %TEMP%\cdp_d09ac7c4\default\data_reduction_proxy_leveldb\000001.dbtmp to %TEMP%\cdp_d09ac7c4\default\data_reduction_proxy_leveldb\current
- from %TEMP%\cdp_d09ac7c4\3843.tmp to %TEMP%\cdp_d09ac7c4\local state
- from %TEMP%\cdp_8c242a1b\crashpadmetrics-active.pma to %TEMP%\cdp_8c242a1b\crashpadmetrics.pma
- from %TEMP%\cdp_8c242a1b\default\sync data\leveldb\000001.dbtmp to %TEMP%\cdp_8c242a1b\default\sync data\leveldb\current
- from %TEMP%\cdp_8c242a1b\default\site characteristics database\000001.dbtmp to %TEMP%\cdp_8c242a1b\default\site characteristics database\current
- from %TEMP%\cdp_8c242a1b\default\000001.dbtmp to %TEMP%\cdp_8c242a1b\default\current
- from %TEMP%\cdp_8c242a1b\default\local storage\leveldb\000001.dbtmp to %TEMP%\cdp_8c242a1b\default\local storage\leveldb\current
- from %TEMP%\cdp_8c242a1b\default\session storage\000001.dbtmp to %TEMP%\cdp_8c242a1b\default\session storage\current
- from %TEMP%\cdp_8c242a1b\default\code cache\js\index-dir\temp-index to %TEMP%\cdp_8c242a1b\default\code cache\js\index-dir\the-real-index
- from %TEMP%\cdp_8c242a1b\default\code cache\wasm\index-dir\temp-index to %TEMP%\cdp_8c242a1b\default\code cache\wasm\index-dir\the-real-index
- from %TEMP%\cdp_8c242a1b\default\shared_proto_db\metadata\000001.dbtmp to %TEMP%\cdp_8c242a1b\default\shared_proto_db\metadata\current
- from %TEMP%\cdp_8c242a1b\default\platform notifications\000001.dbtmp to %TEMP%\cdp_8c242a1b\default\platform notifications\current
- from %TEMP%\cdp_8c242a1b\default\extension state\000001.dbtmp to %TEMP%\cdp_8c242a1b\default\extension state\current
- from %TEMP%\cdp_8c242a1b\default\6b0ea655-f4bb-4395-9248-a5e04887183b.tmp to %TEMP%\cdp_8c242a1b\default\network persistent state
- from %TEMP%\cdp_8c242a1b\default\data_reduction_proxy_leveldb\000001.dbtmp to %TEMP%\cdp_8c242a1b\default\data_reduction_proxy_leveldb\current
- from %TEMP%\cdp_8c242a1b\default\budgetdatabase\000001.dbtmp to %TEMP%\cdp_8c242a1b\default\budgetdatabase\current
- from %TEMP%\cdp_8c242a1b\default\feature engagement tracker\eventdb\000001.dbtmp to %TEMP%\cdp_8c242a1b\default\feature engagement tracker\eventdb\current
- from %TEMP%\cdp_8c242a1b\default\feature engagement tracker\availabilitydb\000001.dbtmp to %TEMP%\cdp_8c242a1b\default\feature engagement tracker\availabilitydb\current
- from %TEMP%\cdp_8c242a1b\default\autofillstrikedatabase\000001.dbtmp to %TEMP%\cdp_8c242a1b\default\autofillstrikedatabase\current
- from %TEMP%\cdp_8c242a1b\browsermetrics-spare.pma.tmp to %TEMP%\cdp_8c242a1b\browsermetrics-spare.pma
Modifies the following files
- %LOCALAPPDATA%\google\chrome\application\debug.log
- %LOCALAPPDATA%\microsoft\tokenbroker\cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres
Substitutes the following files
- %TEMP%\cdp_8c242a1b\crashpadmetrics-active.pma
- %TEMP%\cdp_8c242a1b\default\cache\data_1
- %TEMP%\cdp_8c242a1b\default\cache\data_0
- %TEMP%\cdp_8c242a1b\local state
- %TEMP%\cdp_8c242a1b\default\preferences
- %TEMP%\cdp_8c242a1b\default\code cache\js\index-dir\the-real-index
Network activity
UDP
- DNS ASK google.com
Miscellaneous
Searches for the following windows
- ClassName: 'Chrome_MessageWindow' WindowName: '%TEMP%\cdp_d09ac7c4'
- ClassName: 'Chrome_MessageWindow' WindowName: '%TEMP%\cdp_8c242a1b'
Executes the following
- '<SYSTEM32>\cmd.exe' /c copy /y "%LOCALAPPDATA%\Google\Chrome\User Data\Local State" "%TEMP%\eac96bdd4cb34213ac97375019d08e2c" >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c copy /y "%LOCALAPPDATA%\Google\Chrome\User Data\Local State" "%TEMP%\619c57a208d94343866745db39eda98d" >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c copy /y "%LOCALAPPDATA%\Microsoft\Edge\User Data\Local State" "%TEMP%\43751e71f5204430a089cead6a6fe62c" >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c copy /y "%LOCALAPPDATA%\Microsoft\Edge\User Data\Local State" "%TEMP%\ee7baa3ab0524ede8bbd9d63158fac06" >nul 2>&1
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --disable-gpu --remote-debugging-port=22548 --user-data-dir="%TEMP%\cdp_8c242a1b" --profile-directory="Default" --no-first-run --no-default-browser-check --disable-extensions --disable-componen...
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --disable-gpu --remote-debugging-port=22548 --user-data-dir="%TEMP%\cdp_8c242a1b" --profile-directory=Default --no-first-run --no-default-browser-check --disable-extensions --disable-component-...
- '<SYSTEM32>\cmd.exe' /c copy /y "%APPDATA%\Opera Software\Opera Stable\Local State" "%TEMP%\05d647343abe4ce598af13519a94e8f7" >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c copy /y "%APPDATA%\Opera Software\Opera Stable\Local State" "%TEMP%\63f1882c84624e7d80502b502df5c08d" >nul 2>&1
- '%ProgramFiles(x86)%\microsoft\edge\application\89.0.774.68\identity_helper.exe' --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1860,16807237459704077055,17890844626659829221,131072 --disable-features=OptimizationGuideModelDownlo...
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --disable-gpu --remote-debugging-port=22548 --user-data-dir="%TEMP%\cdp_8c242a1b" --profile-directory=Default --no-first-run --no-default-browser-check --disable-extensions --disable-component-...' (with hidden window)
