Astaroth Spambot - Browser Profile Staged to ChromeAuto Path
Detects creation of files or folders under the hard-coded staging directory C:\Users\Public\Temp\ChromeAuto_. Astaroth's spambot copies the victim's browser "User Data" profile directory to this path so it can spawn a fresh browser instance carrying the victim's active WhatsApp Web session cookies and stored browser credentials, bypassing authentication entirely.
YARA-L
