It has deleted the exfiltrated data on disk after transmission. It has also used an instrumentor script to terminate browser processes running on an infected system and then delete the cookie files on disk.