Randor wrote:It also writes to C:\Users\{Some User}\AppData\Local\Chromium\
OK,
So I debugged the problem.
When I open a local PDF file from the hard drive with the 'SRWare Iron' browser it created the default Chromium profile. Stack looks like this:
Code: Select all
"ntoskrnl.exe","NtWriteFile + 0x416","0xfffff80002a74636","C:\Windows\system32\ntoskrnl.exe"
"ntoskrnl.exe","setjmpex + 0x3ab3","0xfffff80002767d93","C:\Windows\system32\ntoskrnl.exe"
"ntdll.dll","ZwWriteFile + 0x14","0x7ffe69de4f54","C:\Windows\System32\ntdll.dll"
"KernelBase.dll","WriteFile + 0x76","0x7ffe66a27826","C:\Windows\System32\KernelBase.dll"
"chrome.dll","GetHandleVerifier + 0x40abf","0x7ffe4359db7f","F:\Iron\Iron\chrome.dll"
"chrome.dll","ChromeMain + 0xc82e08","0x7ffe4317d938","F:\Iron\Iron\chrome.dll"
"chrome.dll","ChromeMain + 0xc82cca","0x7ffe4317d7fa","F:\Iron\Iron\chrome.dll"
"chrome.dll","ChromeMain + 0xc7fd28","0x7ffe4317a858","F:\Iron\Iron\chrome.dll"
"chrome.dll","GetHandleVerifier + 0x606f0","0x7ffe435bd7b0","F:\Iron\Iron\chrome.dll"
"chrome.dll","GetHandleVerifier + 0x5ff64","0x7ffe435bd024","F:\Iron\Iron\chrome.dll"
"chrome.dll","GetHandleVerifier + 0x3fbb1","0x7ffe4359cc71","F:\Iron\Iron\chrome.dll"
"chrome.dll","GetHandleVerifier + 0x11e7a","0x7ffe4356ef3a","F:\Iron\Iron\chrome.dll"
"kernel32.dll","BaseThreadInitThunk + 0x14","0x7ffe69a08364","C:\Windows\System32\kernel32.dll"
"ntdll.dll","RtlUserThreadStart + 0x21","0x7ffe69da5e91","C:\Windows\System32\ntdll.dll"