Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    101s
  • max time network
    109s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/12/2024, 15:20

General

  • Target

    thorium_AVX2_mini_installer.exe

  • Size

    176.5MB

  • MD5

    0c9631215e5c59f7fee9f77fe6546d34

  • SHA1

    45aed1c72e51d1eeaa8105938e80a38808961f3a

  • SHA256

    9ef8fae12b8291f3de3a53c0e30b71d1a6684dc1607668f577334d67e1038c31

  • SHA512

    04fe163f3d158a0a3df3e5ee89c96c481ae634b543ab32fcc745519fae39a929db8d93e45a15f38873c6b03e43903d5dcf15aee1f5428cc42530126086836868

  • SSDEEP

    3145728:+dDjbjAMpiIQirB/NF8yZiC5HSuQ+N/2q+y3LCaGclmtLIWJuRaQ9T4nITY:+dDHjAMpWkfGqiSHvMoLCaGYCI4MaMgU

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 16 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

  • Executes dropped EXE 59 IoCs
  • Loads dropped DLL 64 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks system information in the registry 2 TTPs 2 IoCs

    System information is often read in order to detect sandboxing environments.

  • Drops file in Program Files directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 46 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\thorium_AVX2_mini_installer.exe
    "C:\Users\Admin\AppData\Local\Temp\thorium_AVX2_mini_installer.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3420
    • C:\Users\Admin\AppData\Local\Temp\CR_D7424.tmp\setup.exe
      "C:\Users\Admin\AppData\Local\Temp\CR_D7424.tmp\setup.exe" --install-archive="C:\Users\Admin\AppData\Local\Temp\CR_D7424.tmp\CHROME.PACKED.7Z"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:972
      • C:\Users\Admin\AppData\Local\Temp\CR_D7424.tmp\setup.exe
        C:\Users\Admin\AppData\Local\Temp\CR_D7424.tmp\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Thorium\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Thorium --annotation=ver=128.0.6613.189 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff7511ec6e0,0x7ff7511ec6f0,0x7ff7511ec700
        3⤵
        • Executes dropped EXE
        PID:1308
      • C:\Users\Admin\AppData\Local\Temp\CR_D7424.tmp\setup.exe
        "C:\Users\Admin\AppData\Local\Temp\CR_D7424.tmp\setup.exe" --verbose-logging --create-shortcuts=0 --install-level=0
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Modifies registry class
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2064
        • C:\Users\Admin\AppData\Local\Temp\CR_D7424.tmp\setup.exe
          C:\Users\Admin\AppData\Local\Temp\CR_D7424.tmp\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Thorium\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Thorium --annotation=ver=128.0.6613.189 --initial-client-data=0x25c,0x260,0x264,0x238,0x268,0x7ff7511ec6e0,0x7ff7511ec6f0,0x7ff7511ec700
          4⤵
          • Executes dropped EXE
          PID:5088
      • C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe
        "C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe" --from-installer
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks system information in the registry
        • Drops file in Program Files directory
        • Enumerates system info in registry
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:2896
        • C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe
          C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Thorium\User Data" /prefetch:4 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Thorium\User Data" --monitor-self-argument=/prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Thorium\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Thorium --annotation=ver=128.0.6613.189 --initial-client-data=0xf4,0xf8,0xfc,0xd4,0x100,0x7ffd9cca5b58,0x7ffd9cca5b68,0x7ffd9cca5b78
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:2224
          • C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe
            C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Thorium\User Data" /prefetch:4 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Thorium\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Thorium --annotation=ver=128.0.6613.189 --initial-client-data=0x138,0x13c,0x140,0x114,0x144,0x7ff688cd97f8,0x7ff688cd9804,0x7ff688cd9810
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:2760
        • C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe
          "C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe" --type=gpu-process --start-stack-profiler --gpu-preferences=UAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1968,i,12211617299547150109,3424271437139717313,262144 --variations-seed-version --mojo-platform-channel-handle=1964 /prefetch:2
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4192
        • C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe
          "C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --start-stack-profiler --field-trial-handle=2192,i,12211617299547150109,3424271437139717313,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:3
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:400
        • C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe
          "C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --field-trial-handle=2364,i,12211617299547150109,3424271437139717313,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:8
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4672
        • C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe
          "C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe" --type=renderer --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2908,i,12211617299547150109,3424271437139717313,262144 --variations-seed-version --mojo-platform-channel-handle=2940 /prefetch:1
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3804
        • C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe
          "C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe" --type=renderer --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2924,i,12211617299547150109,3424271437139717313,262144 --variations-seed-version --mojo-platform-channel-handle=2976 /prefetch:1
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3808
        • C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe
          "C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=4676,i,12211617299547150109,3424271437139717313,262144 --variations-seed-version --mojo-platform-channel-handle=4632 /prefetch:8
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4668
        • C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe
          "C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=4788,i,12211617299547150109,3424271437139717313,262144 --variations-seed-version --mojo-platform-channel-handle=4632 /prefetch:8
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4292
        • C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe
          "C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=5028,i,12211617299547150109,3424271437139717313,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:8
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2052
        • C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe
          "C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=4808,i,12211617299547150109,3424271437139717313,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2164
        • C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe
          "C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=4972,i,12211617299547150109,3424271437139717313,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:8
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1828
        • C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe
          "C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=4880,i,12211617299547150109,3424271437139717313,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:8
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2448
        • C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe
          "C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=5556,i,12211617299547150109,3424271437139717313,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2580
        • C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe
          "C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=5708,i,12211617299547150109,3424271437139717313,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:8
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4172
        • C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe
          "C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=5844,i,12211617299547150109,3424271437139717313,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:8
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1112
        • C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe
          "C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=5864,i,12211617299547150109,3424271437139717313,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:8
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5100
        • C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe
          "C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe" --type=renderer --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=5736,i,12211617299547150109,3424271437139717313,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:2
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5412
        • C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe
          "C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe" --type=renderer --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=5748,i,12211617299547150109,3424271437139717313,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:2
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5804
        • C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe
          "C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe" --type=renderer --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=5772,i,12211617299547150109,3424271437139717313,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:2
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5200
        • C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe
          "C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe" --type=renderer --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=5936,i,12211617299547150109,3424271437139717313,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:1
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:4668
        • C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe
          "C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=4760,i,12211617299547150109,3424271437139717313,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:8
          4⤵
          • Executes dropped EXE
          PID:5628
        • C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe
          "C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=5340,i,12211617299547150109,3424271437139717313,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:8
          4⤵
          • Executes dropped EXE
          PID:5684
        • C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe
          "C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=6088,i,12211617299547150109,3424271437139717313,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:8
          4⤵
          • Executes dropped EXE
          PID:5356
        • C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe
          "C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=5692,i,12211617299547150109,3424271437139717313,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:8
          4⤵
          • Executes dropped EXE
          PID:5476
        • C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe
          "C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=5144,i,12211617299547150109,3424271437139717313,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:8
          4⤵
          • Executes dropped EXE
          PID:5496
        • C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe
          "C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=5300,i,12211617299547150109,3424271437139717313,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:8
          4⤵
          • Executes dropped EXE
          PID:5908
        • C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe
          "C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=5180,i,12211617299547150109,3424271437139717313,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
          4⤵
          • Executes dropped EXE
          PID:6036
        • C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe
          "C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=6204,i,12211617299547150109,3424271437139717313,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:8
          4⤵
          • Executes dropped EXE
          PID:6116
        • C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe
          "C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=6360,i,12211617299547150109,3424271437139717313,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:8
          4⤵
          • Executes dropped EXE
          PID:5180
        • C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe
          "C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=6504,i,12211617299547150109,3424271437139717313,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:8
          4⤵
          • Executes dropped EXE
          PID:5136
        • C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe
          "C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=6668,i,12211617299547150109,3424271437139717313,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:8
          4⤵
          • Executes dropped EXE
          PID:2164
        • C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe
          "C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=6716,i,12211617299547150109,3424271437139717313,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:8
          4⤵
          • Executes dropped EXE
          PID:4144
        • C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe
          "C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=6212,i,12211617299547150109,3424271437139717313,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:8
          4⤵
          • Executes dropped EXE
          PID:208
        • C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe
          "C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=6844,i,12211617299547150109,3424271437139717313,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:8
          4⤵
          • Executes dropped EXE
          PID:5532
        • C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe
          "C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=3188,i,12211617299547150109,3424271437139717313,262144 --variations-seed-version --mojo-platform-channel-handle=6832 /prefetch:8
          4⤵
          • Executes dropped EXE
          PID:5432
        • C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe
          "C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=6996,i,12211617299547150109,3424271437139717313,262144 --variations-seed-version --mojo-platform-channel-handle=7012 /prefetch:8
          4⤵
          • Executes dropped EXE
          PID:5540
        • C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe
          "C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe" --type=renderer --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --field-trial-handle=6936,i,12211617299547150109,3424271437139717313,262144 --variations-seed-version --mojo-platform-channel-handle=6972 /prefetch:1
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:2548
        • C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe
          "C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=5468,i,12211617299547150109,3424271437139717313,262144 --variations-seed-version --mojo-platform-channel-handle=7124 /prefetch:8
          4⤵
          • Executes dropped EXE
          PID:6072
        • C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe
          "C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe" --type=renderer --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --field-trial-handle=5732,i,12211617299547150109,3424271437139717313,262144 --variations-seed-version --mojo-platform-channel-handle=7096 /prefetch:1
          4⤵
          • Executes dropped EXE
          PID:6112
        • C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe
          "C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe" --type=renderer --start-stack-profiler --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --field-trial-handle=5328,i,12211617299547150109,3424271437139717313,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:1
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:5852
        • C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe
          "C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe" --type=renderer --start-stack-profiler --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --field-trial-handle=5336,i,12211617299547150109,3424271437139717313,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:1
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:5804
        • C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe
          "C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=5388,i,12211617299547150109,3424271437139717313,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:8
          4⤵
          • Executes dropped EXE
          PID:2904
        • C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe
          "C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe" --type=renderer --start-stack-profiler --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --field-trial-handle=6812,i,12211617299547150109,3424271437139717313,262144 --variations-seed-version --mojo-platform-channel-handle=7064 /prefetch:1
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:2652
        • C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe
          "C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe" --type=renderer --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --field-trial-handle=3128,i,12211617299547150109,3424271437139717313,262144 --variations-seed-version --mojo-platform-channel-handle=6860 /prefetch:1
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:5584
        • C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe
          "C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe" --type=renderer --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --field-trial-handle=7060,i,12211617299547150109,3424271437139717313,262144 --variations-seed-version --mojo-platform-channel-handle=6976 /prefetch:1
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:5640
        • C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe
          "C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe" --type=renderer --start-stack-profiler --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --field-trial-handle=7040,i,12211617299547150109,3424271437139717313,262144 --variations-seed-version --mojo-platform-channel-handle=3056 /prefetch:1
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:1384
        • C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe
          "C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=2972,i,12211617299547150109,3424271437139717313,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
          4⤵
          • Executes dropped EXE
          PID:5240
        • C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe
          "C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe" --type=renderer --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --field-trial-handle=6800,i,12211617299547150109,3424271437139717313,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:1
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:5512
        • C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe
          "C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe" --type=renderer --start-stack-profiler --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --field-trial-handle=3088,i,12211617299547150109,3424271437139717313,262144 --variations-seed-version --mojo-platform-channel-handle=6872 /prefetch:1
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:5908
        • C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe
          "C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=7120,i,12211617299547150109,3424271437139717313,262144 --variations-seed-version --mojo-platform-channel-handle=7028 /prefetch:8
          4⤵
          • Executes dropped EXE
          • Modifies registry class
          PID:4464
        • C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe
          "C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --audio-codecs-from-edid=0 --video-capture-use-gpu-memory-buffer --field-trial-handle=6004,i,12211617299547150109,3424271437139717313,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:8
          4⤵
          • Executes dropped EXE
          PID:1300
        • C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe
          "C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=6980,i,12211617299547150109,3424271437139717313,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:8
          4⤵
          • Executes dropped EXE
          PID:3204
        • C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe
          "C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=6156,i,12211617299547150109,3424271437139717313,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:8
          4⤵
          • Executes dropped EXE
          PID:2652
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
    1⤵
      PID:2948
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x398 0x39c
      1⤵
        PID:4104

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files\chrome_Unpacker_BeginUnzipping2896_595436644\manifest.json

        Filesize

        98B

        MD5

        173a166f8d69c960097d4c956931564d

        SHA1

        917906d2c3e700413b2a5521c411253598beffd4

        SHA256

        8fdad0838c61ad933a0a2df6950eb8e2d80488581393aee0bc3fb61505816ffb

        SHA512

        ddbf4ecd68e60d08ef235abc6bbeab1c6d50017f48f89efd68c1777526cc87c11b0c145053ebfdcb2e1172dc1f4f61b430d823270fb910bc9c0b988a8ddc78e5

      • C:\Users\Admin\AppData\Local\Temp\409e9bcb-b8ae-4977-8ffc-457303f4802b.tmp

        Filesize

        1B

        MD5

        5058f1af8388633f609cadb75a75dc9d

        SHA1

        3a52ce780950d4d969792a2559cd519d7ee8c727

        SHA256

        cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

        SHA512

        0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

      • C:\Users\Admin\AppData\Local\Temp\CR_D7424.tmp\setup.exe

        Filesize

        3.2MB

        MD5

        5d37d438cabbe30dd415f56e5580b0ed

        SHA1

        b555d8725afeb4ca2fe4177b5acfba6b9b2dc5c8

        SHA256

        2ff178b824b58c9099769cb6c6c696f076551f33c92d6445f452f12bb18859ba

        SHA512

        8ab11c5bf536430ca019b68739d1fdf7c6ff6e4ab5184594f2a4bb721b0bf0d0148596cb872055a1b385383187cad781774884f3b10a6ef29ddee36a904bafcb

      • C:\Users\Admin\AppData\Local\Temp\c9c5457e-182c-4020-a689-378e63a791fa.tmp

        Filesize

        3.8MB

        MD5

        297f77b04891682356b28e6b93fcc4b0

        SHA1

        dd6598ead3dddf30f813e0ffc07d96333280fa6f

        SHA256

        9c03a3001b5c81d82b2d0ff8d929f2d14ac597e8baf96edd5b688ed88c89323d

        SHA512

        14757ef8b9205ea35d73431bbccd1d8216ea0a16fa9fa1781ba230d90156dd60ebb980b406e07bdeb33f31a8581745138c512a356987beb8bec83747b0639b6e

      • C:\Users\Admin\AppData\Local\Temp\scoped_dir2896_1030966411\CRX_INSTALL\_locales\en\messages.json

        Filesize

        711B

        MD5

        558659936250e03cc14b60ebf648aa09

        SHA1

        32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

        SHA256

        2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

        SHA512

        1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

      • C:\Users\Admin\AppData\Local\Temp\scoped_dir2896_1030966411\a89af072-d9f6-4963-9143-3b9f94ceb527.tmp

        Filesize

        150KB

        MD5

        14937b985303ecce4196154a24fc369a

        SHA1

        ecfe89e11a8d08ce0c8745ff5735d5edad683730

        SHA256

        71006a5311819fef45c659428944897184880bcdb571bf68c52b3d6ee97682ff

        SHA512

        1d03c75e4d2cd57eee7b0e93e2de293b41f280c415fb2446ac234fc5afd11fe2f2fcc8ab9843db0847c2ce6bd7df7213fcf249ea71896fbf6c0696e3f5aee46c

      • C:\Users\Admin\AppData\Local\Thorium\Application\128.0.6613.189\chrome_elf.dll

        Filesize

        1.4MB

        MD5

        41ade746233397c63df981b6c550c366

        SHA1

        1c4d803855b5579393f421d3ee134b5fe02593b7

        SHA256

        40450a9008f5078546c6cbe84742f77c71195fa4fd7367f17ed286193c1cf5c5

        SHA512

        1b177a882005eeae17cb58e5c180bfcd1854162985a72f39c5372421070bcf82647edc2610a25fa9989d35a0dc1e056433f757e73851aaf2e3cf0769c625b905

      • C:\Users\Admin\AppData\Local\Thorium\Application\128.0.6613.189\d3dcompiler_47.dll

        Filesize

        4.7MB

        MD5

        a7349236212b0e5cec2978f2cfa49a1a

        SHA1

        5abb08949162fd1985b89ffad40aaf5fc769017e

        SHA256

        a05d04a270f68c8c6d6ea2d23bebf8cd1d5453b26b5442fa54965f90f1c62082

        SHA512

        c7ff4f9146fefedc199360aa04236294349c881b3865ebc58c5646ad6b3f83fca309de1173f5ebf823a14ba65e5ada77b46f20286d1ea62c37e17adbc9a82d02

      • C:\Users\Admin\AppData\Local\Thorium\Application\128.0.6613.189\dxcompiler.dll

        Filesize

        26.0MB

        MD5

        702ccaea983885b51f220b79bff0fff0

        SHA1

        7fe878a485ff2316d9c6400b380daf988b85f3dd

        SHA256

        908b9fabc3127375d1ac09dab35edc614232f252701bb2b55d4885d7587af9c6

        SHA512

        cb6cacc3f8408a00f62d1ca30d8da3f5c821cac8c96f3d9f35f2bc282b6662b8efe4233a6b00279a7c43f58251efc0c0493e6771cad471d1fb14a9a8aac0a4e2

      • C:\Users\Admin\AppData\Local\Thorium\Application\128.0.6613.189\dxil.dll

        Filesize

        1.4MB

        MD5

        88490ebe28ab3caea518b055aed20d9f

        SHA1

        8701b9ec26ffb2be0abbcb0ed1c310df1928887d

        SHA256

        6c37738cd2fb4d659b0f49dead8311ae75c93b8c6602b991c00e070f7be20bc1

        SHA512

        a41486c4cea6cf89a61a0da44c9243fac900aedcc75ccae8ec3faa4085f5b8fb5391e457ffc7ffeecce4ecfcefb86a3e2ff037df18f26bb69ce045ba63df63c9

      • C:\Users\Admin\AppData\Local\Thorium\Application\128.0.6613.189\ffmpeg.dll

        Filesize

        4.1MB

        MD5

        4e3c310c61bc4e4ad184a4e9153e47fc

        SHA1

        5d946e60e2fac3a18e06036b81015bb270957b03

        SHA256

        db5a06ec7479bd149356bf85adc03f4df12b1b81b40f2442c43798a6f79f002e

        SHA512

        0645d6c0495c4b509e28c8d103ab7eb451f1afff7caf70d1006bb10a206a47baad0d9eb5e0359a94ff98902ce9ee5d0b19265987795e75a87c06d73207ccfb0d

      • C:\Users\Admin\AppData\Local\Thorium\Application\128.0.6613.189\libEGL.dll

        Filesize

        479KB

        MD5

        e1c9d8c1a0b98a1bc3a43dab0adb58de

        SHA1

        5a0b2dcc25bfdab05b1373d59c758e46c067e30f

        SHA256

        b9513a8f9a0c4d8a3ea8eb6f95de557a3c73033134c31b34c4ac5b1799a3faa1

        SHA512

        cd46f02100d15fe12883215fba37eac2c44cf57c42ad582ec0861df6d6b0686e5055cdd1f706d470545ecfc9eced7006fd6656b246a1ca625e8708dddb5d56cb

      • C:\Users\Admin\AppData\Local\Thorium\Application\128.0.6613.189\libGLESv2.dll

        Filesize

        8.7MB

        MD5

        6e06b77accb7bd240374cd8d9aeef2d9

        SHA1

        5eeaac153edbb6a3fc9af7ac59fad7b5734669e9

        SHA256

        b5f02362237dc905486f7784bab82d46ff464e9f904d7262f64a1023cd7e82d0

        SHA512

        af019fddaa01a351960a2ce0546a6c3728de2a06f3020ad745362695a3248c724e6e8b23d01e1d958cb4943b4b4aa1ac19792fd1fd3be6f98648e00d95b57e41

      • C:\Users\Admin\AppData\Local\Thorium\Application\128.0.6613.189\vk_swiftshader.dll

        Filesize

        8.8MB

        MD5

        a8360e5680221698694760ca951d73ad

        SHA1

        265451b74d4bf2b176420767714072e62116dc99

        SHA256

        acd6fbc73ea469f8a0c371bb663d11fde9e8e618db0f037e4d829c58723e033d

        SHA512

        a6bad5b24e7c1166b8be985576b9f2ffa95cfdc215f34615cc602bd5ee738b643d41cab37ca924e0fc4c8e42795489a72d692d36aad8945f3411be00abd3354b

      • C:\Users\Admin\AppData\Local\Thorium\Application\SetupMetrics\2064_13379268092871428.pma

        Filesize

        520B

        MD5

        d7bdecbddac6262e516e22a4d6f24f0b

        SHA1

        1a633ee43641fa78fbe959d13fa18654fd4a90be

        SHA256

        db3be7c6d81b2387c39b32d15c096173022cccee1015571dd3e09f2a69b508a9

        SHA512

        1e72db18de776fe264db3052ce9a842c9766a720a9119fc6605f795c36d4c7bf8f77680c5564f36e591368ccd354104a7412f267c4157f04c4926bce51aeeaa1

      • C:\Users\Admin\AppData\Local\Thorium\Application\SetupMetrics\972_13379268092917661.pma

        Filesize

        1KB

        MD5

        59c9daec4cd55b170b03773df9d3e96d

        SHA1

        d3df0521716fceadb9badd781b0c0627b1f68010

        SHA256

        07ea5f850d4ef7cf6f34b74a7574bb6e02d4d835de7f4fc1a9c6658a3d49b15f

        SHA512

        d136a3a58ea4359c3e0b0769032a1d85cbc6770c6e39cb66aee427702005e27a82064b081c4391a314ad950d782c9f29235978d5d8603d1bf0ff8fed69d2dd43

      • C:\Users\Admin\AppData\Local\Thorium\Application\initial_preferences

        Filesize

        61B

        MD5

        d4c18606d046867b374ff75a7e6352be

        SHA1

        4632af00d01cb6997cc3951ff7896b71568136e6

        SHA256

        a05e1c55a316ef05d1e618d29295237687134ac6d3dd213cb8bbe3827fd1d951

        SHA512

        81d73061eb9e0dccd57ce2a5206135be380943036f3a0f7c8058828e9a8b7e885fa1ac2e981f7a29caf37d861eca10b83f8acfe2d4762c05fdffc08d7eb4275f

      • C:\Users\Admin\AppData\Local\Thorium\Application\thorium.exe

        Filesize

        2.7MB

        MD5

        9cb627410719e122ad43f5f8dba048a0

        SHA1

        32bf2a84c065b8456535279b6fb42394f5ff7b14

        SHA256

        a1d6c8cacac31e5b4568b677fdc7ebd24d887542be3280060a9e7b0d41cad97b

        SHA512

        e1143847e78b2f876e11feef3cf5d66f4a7d721021b7407c297db0c73f6c30720b236f69d8200c633f15fb32b4f40d783ae8a8541d31bbfbf88c4a9c73f18606

      • C:\Users\Admin\AppData\Local\Thorium\User Data\Crashpad\settings.dat

        Filesize

        40B

        MD5

        5f68d00b82c5628ba9f65dd7274a8635

        SHA1

        d738cca40935035a0d002d08e151f852112e7cb8

        SHA256

        36bd115548e61cb8ed9cc6166df5a71d5574017615ac80c452f473dd7f04a94c

        SHA512

        b7eacad4fa2509c853cdaa80b99b975e912494c8780e1342d906ea732d69714264340b3433194aea7691e855a11b303f33d991b7a7ba647c4f4a14eb9eb0ad4a

      • C:\Users\Admin\AppData\Local\Thorium\User Data\Default\Cache\Cache_Data\f_000014

        Filesize

        49KB

        MD5

        7ca090d5f0c1a9e7d42edb60ad4ec5e8

        SHA1

        7278dcacb472ec8a27af7fbc6f8212b21e191042

        SHA256

        4039fef5575ba88350a109b2c8d9aa107f583acb6cbe2ac8e609071567c4cc76

        SHA512

        c4f2d23eacf74f87de8dea6e4532b120253bb9ad356341532f5e1aaf2ce90d137f46b50df7de5250bce4eca1fbfb74da088accd7c626fa853dc524abad7bfe8b

      • C:\Users\Admin\AppData\Local\Thorium\User Data\Default\Cache\Cache_Data\f_000015

        Filesize

        635KB

        MD5

        b537ca5fec304dcf3ce3171edf1e8fa4

        SHA1

        52665eefc08697d21f82719269fbfef687a643d7

        SHA256

        50b93c8ccbf1304dde0b424bafadf2fb654597bf4a35def9f29356988dfeb2ca

        SHA512

        81ae8df536c60aa8eb9a687625a72de559d15018c5248e0bc12ce7ed45aa7b960e999b79a8e197c38ddde219aa942ba4534f154aa99386e5e242d18a7d76c805

      • C:\Users\Admin\AppData\Local\Thorium\User Data\Default\Cache\Cache_Data\f_000016

        Filesize

        34KB

        MD5

        e85ac71b59dadc1488a1c888db91c5ea

        SHA1

        a4aa7fc9226bd867a978945a27fd78a0a82cc994

        SHA256

        7441da6812af01a6eb9afa5d602986b233a57700cb721343b0aa9830a15def0d

        SHA512

        2b4d952a258f9001c2d8a42402c98788759138669750667524df2031d3926e21836b037974ded859bebf88fd9296791a6a2de65561b8098f066f9cbb8ae719ed

      • C:\Users\Admin\AppData\Local\Thorium\User Data\Default\Cache\Cache_Data\f_000017

        Filesize

        34KB

        MD5

        6242c13ec6b35fed918ab71eb096d097

        SHA1

        691e6865e78afb11d9070056ba6cd99bdad7b04e

        SHA256

        b1c7566622f40bad557a6c5b7bc5b8ae25b4da191ac716cc7923282eef96034c

        SHA512

        52914b4ca7362e9ebe326ea89006f5cc096fd4d1c360cae33ca768af92fe6fdb5078d0848fb6dc092848ba0e3d3f51bfb20a292250c35e8bd2e79fd5a19dd7b5

      • C:\Users\Admin\AppData\Local\Thorium\User Data\Default\Code Cache\js\index-dir\the-real-index

        Filesize

        1KB

        MD5

        ca507a573432fe5cbc99582ba218518f

        SHA1

        700bdb9b1a0e408177a2a0a03a280eee5a991354

        SHA256

        e71c14f32ea4e1e1f3cd471820f17932147ec2cb740aa17c6ea8ae872319eeaa

        SHA512

        8502aa33348675170c4308d0bc4e9814216b856c941b7edfe050c4ac152d8d83eb7807afdbbfa9c23d7f963aea2694d8abf8ca03de9c3c3da2f356ca6122443a

      • C:\Users\Admin\AppData\Local\Thorium\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5888a3.TMP

        Filesize

        48B

        MD5

        d3c4c995373a13a6e183f28f70f7fc29

        SHA1

        fcfd0f65cf32fb076c7a984ad94d74e7737360ee

        SHA256

        259e4abef2254787d18a2fefd79d8614ac00e2652a29af3dd86a42e2dcfc3a09

        SHA512

        e72477f2559ea1dab61c5f39968dbe1d4f7e249344490640b21ee20d2e2f890e5f7be48392ffa1b3506f9eb04beae15719db0bae1144127455c13221bdd1fbf7

      • C:\Users\Admin\AppData\Local\Thorium\User Data\Default\Download Service\Files\0324584c-3630-4924-9bd5-5cebe886af62

        Filesize

        862KB

        MD5

        a5b4bb3b21eca74859e45ecc4c892215

        SHA1

        8f461b83c28a6e2f5362b0d0171a3d1d2ee10bca

        SHA256

        807882f310ebf263f7b85b683add53970251d3cafb3b22ac3fce9923fb15ab35

        SHA512

        6761b71b836b4cffc8e05e3f4ee722cf8ce96c96f6d179025b4ee78ae7bc78a669569b74262cf709c58772e18c0f5b1b3d3b51fc4b483cca1dfa483827f7ee3b

      • C:\Users\Admin\AppData\Local\Thorium\User Data\Default\Download Service\Files\13dd8271-2124-4efa-b0b6-ebb8e9281a69

        Filesize

        258KB

        MD5

        5adf364735dcbe6bf26ebe3f705c9dbc

        SHA1

        a891521fea2f61a2fd16ea9f0a3fc3c2c5fb3a46

        SHA256

        8d21fe1bd251856bfaeaedd6a72ab78f153a047b6042e0fc614f57a32b56d340

        SHA512

        5f77f8923ab3800ab754f4c60095077b529c5f5f230c6a0b6803dc28597f42ed682921267ed344e190d0f08e0a23eceace7bccbc9d22432029a3e6f4838420e0

      • C:\Users\Admin\AppData\Local\Thorium\User Data\Default\Download Service\Files\2f2ced96-9b9e-4011-a2b0-2473f1676bba

        Filesize

        3KB

        MD5

        f3f99551cf4f1b4bbf8d1ec727c13b9e

        SHA1

        a1b0e4d77a9fe0a7b7d07087abe5a0394de371e7

        SHA256

        e10fa07346014922cc4bdc6106b694930a900f06663aecd60748c934d5fd4114

        SHA512

        487312236106efa50c75863b72266968f6d1a6b8cbe8112fe06b0ec658d77268c9f602e6b701f7970a73abb62768bc121971e34f53d8f747ba1ee088b8cbed13

      • C:\Users\Admin\AppData\Local\Thorium\User Data\Default\Download Service\Files\65679676-fb2c-4950-a7bb-74cecc98a777

        Filesize

        44KB

        MD5

        d031babf53ad6c076d9fd94014edcabd

        SHA1

        2db6265a4396e57556c033814f205693f919b713

        SHA256

        bbfdb0b576f2558c24b14b0811365b5d88c2e196a7635dba60c298226b0c2e40

        SHA512

        0e7da390b720028e4ef8c4552a8875fd9acc8ed5e2dede1071afafbd80d3f7c7a20fc1d20ac3abe8dee36fa072c390a2405a9c3e37887162aa53afaed68666a4

      • C:\Users\Admin\AppData\Local\Thorium\User Data\Default\Download Service\Files\822d106c-4e44-437b-b271-df6ae2112a20

        Filesize

        2.6MB

        MD5

        d4bab3bebe5bb1525cf43cad7b14d259

        SHA1

        00b6d6e4a514b74822318ea0d6c087cf5b0b2df4

        SHA256

        16e6e77056e713ee5060b6d45768a153293e54eeca1a87b17504f51e668a6639

        SHA512

        e48f005aa63a5df9fb90b9dae72508a8716fd97f268730134b9d94959eaf28a0a89f199629906156bb6f7637d4508a439bdaedcf67dcc8ab893f26d7c677dbe3

      • C:\Users\Admin\AppData\Local\Thorium\User Data\Default\Download Service\Files\936a6880-7e65-4dd6-ac8c-93082aed0940

        Filesize

        4KB

        MD5

        6f2811fd938b362daea939bc0d51eedb

        SHA1

        75c04653c0806d71fe3387b19a07fa6c243b6c7a

        SHA256

        1117f8a5309894be72882a873ae0e0ac1aaf0658e374ffd20cecee56df1bfa19

        SHA512

        cf207ba18c658099dd0d089ac24a7b58991571ef9bab0fefccde6e26ef708a0a86f2f055ab2ff7250f0a669c95d1f6a95b31e493299ea51854e14d27af07aa36

      • C:\Users\Admin\AppData\Local\Thorium\User Data\Default\Download Service\Files\c0c2783d-32a5-4d59-bf57-02ffbb76356d

        Filesize

        115KB

        MD5

        f9049a00258e63877620e41614264230

        SHA1

        4375b622c1f374f07530b793c05e3357b0e582c6

        SHA256

        7648307a0ad082edc5095a571a45391e465adee5c13d4c9145724c34b64f81df

        SHA512

        82c8bc56fb6fca5858c5e99123ae166a129bb4e39dc286114ccff02aee48bcdb2c037f8acdbac19bb50d1b31ef902a3e39afc6e769d8b0a1d0996d19e331b67a

      • C:\Users\Admin\AppData\Local\Thorium\User Data\Default\Extension Rules\MANIFEST-000001

        Filesize

        41B

        MD5

        5af87dfd673ba2115e2fcf5cfdb727ab

        SHA1

        d5b5bbf396dc291274584ef71f444f420b6056f1

        SHA256

        f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

        SHA512

        de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

      • C:\Users\Admin\AppData\Local\Thorium\User Data\Default\Extensions\cgbcahbpdhpcegmbfconppldiemgcoii\1.61.3.9_0\_locales\en\messages.json

        Filesize

        49KB

        MD5

        6f6711486b2006031b234dee8c11f886

        SHA1

        3f4e6019e437764b7e6a0011de379c8bda6eb2f3

        SHA256

        3249e1dc4c034447d50b1881cd00fa76381892a7ffac3325000f07dcb237af84

        SHA512

        4076db790f6f75b21bf7e1e59c0688569f3deab36b8c591d6d136895fde31ad4ef12e1003fea8b2190184d4678215d265c4738eb499c3a2153d2e84aaec57e19

      • C:\Users\Admin\AppData\Local\Thorium\User Data\Default\Extensions\cgbcahbpdhpcegmbfconppldiemgcoii\1.61.3.9_0\img\icon_16.png

        Filesize

        577B

        MD5

        99ac70a2b60f99f59f0b00086bffb2eb

        SHA1

        6d0bcba94f37a05dc09785f65482b69dee3b19e6

        SHA256

        9dfd3a6e633d215d4ab901b3146c7f69f56603fec02dfc0fa5bcb81b27963979

        SHA512

        cea479b654b01cceea7a87032f578857a3e80e67b8b1aaac317252fbafcb460d7c52369ded4dd19d12f81da48cc5a22d7d25214f97463f20a76eddf4590c564a

      • C:\Users\Admin\AppData\Local\Thorium\User Data\Default\Extensions\cgbcahbpdhpcegmbfconppldiemgcoii\1.61.3.9_0\img\icon_32.png

        Filesize

        1KB

        MD5

        fb69353efe920d1ec49138f9ffdde1ba

        SHA1

        1c31d54d4384124377b80c738f7696f867d5f969

        SHA256

        c68a74e3bf6fd2287e24146fe85230d1da87ae3a9c40f9151da218b00c180294

        SHA512

        a5eeb78932d419cc9d3206b62b71b1ffdad263dec53380986c23f28d5404b1d15842403e40367512b063477d5eb704a076c245f6f3fa5ad3199d97690ec89365

      • C:\Users\Admin\AppData\Local\Thorium\User Data\Default\Extensions\cgbcahbpdhpcegmbfconppldiemgcoii\1.61.3.9_0\js\contentscript-extra.js

        Filesize

        21KB

        MD5

        1cb89e30f92cb1574c38c1b1189b40a1

        SHA1

        a3bab001a9edcf33196a3e03436033afc715a134

        SHA256

        1d606e13661d9e52f19c4842db9dcd67f6d29cf51e316b2c72c99aaeb34e3e40

        SHA512

        4ca710954b83c0698b586516f1bd9a0b37322ab60c03647a066548933d30597641b3df64ddbfb10e53c17eaa2b86220e0f93b3c54f4fd3be816eae7b6bc5f9e9

      • C:\Users\Admin\AppData\Local\Thorium\User Data\Default\Extensions\cgbcahbpdhpcegmbfconppldiemgcoii\1.61.3.9_0\js\contentscript.js

        Filesize

        44KB

        MD5

        a2ec700f1c4dc27b0dc58bf2a1f95b4d

        SHA1

        d5aaeefd2b7d1bf598b58e52ba18d9711a70a276

        SHA256

        ee34b2182c62cfed49e70f82dca74d5cc555a9ffb62981dec42acc411df4a058

        SHA512

        4c3e3c5f26ce2f1598fb72612d21bd3592c728f7d9a5e335d841d45ad01466d9f3673115742a1bf33b0da3c8fe5d10d52f1e456b52d5a00800e9096fbad94f4c

      • C:\Users\Admin\AppData\Local\Thorium\User Data\Default\Extensions\cgbcahbpdhpcegmbfconppldiemgcoii\1.61.3.9_0\js\s14e-serializer.js

        Filesize

        46KB

        MD5

        737f7b1870006dcfbdf276a740e660a5

        SHA1

        c601e63603e8effc208d1ad557268bd0aad39903

        SHA256

        ba7281c65f74e95e29b46c870d49ae4fb5889945ce5b243c707e8eb8ce46ad25

        SHA512

        f12098aef3160e4b455055a6782ae116c0103cdbe7157cd77e3ef9af70532900edcf889912b2832896fa01cc2bbdbaa22fda2def6ff71789b095861aff684fd4

      • C:\Users\Admin\AppData\Local\Thorium\User Data\Default\Extensions\cgbcahbpdhpcegmbfconppldiemgcoii\1.61.3.9_0\js\scriptlets\subscriber.js

        Filesize

        3KB

        MD5

        0b135e77296c6b70a0b54451cd136e09

        SHA1

        b5bd5bf9e718c68364e1fd04f29b79e36ea9186f

        SHA256

        6cbfc36497c6c93b21973a69181828c90d2679a93a896bd2a10d4ce2bd1c00ca

        SHA512

        6adbf2c762be9fccc1ebfcd53eb1f67a3f67c259e6cf1f816b5fc643d834db063eaf5bda245942e8ee4dd828f8f52fc2c7e865e6c9601f0862ad3720a2f2aca6

      • C:\Users\Admin\AppData\Local\Thorium\User Data\Default\Extensions\cgbcahbpdhpcegmbfconppldiemgcoii\1.61.3.9_0\js\scriptlets\updater.js

        Filesize

        3KB

        MD5

        41c0dcd58154221038c0a7c227adf816

        SHA1

        264f14633f719433ab2d01dc390c2ad23f07aaaa

        SHA256

        3f07ead6d8fb2e684eb9e19b60a1fcdee160b3e695f744ef54ba19ebe3005b21

        SHA512

        8f57df59051bf00e1fb1adec1dfb311f960f30ccb495aadfdc34ffae42a15f72e9b22c1b063349bb2f356a1942ecf9667adcb1a703ce39dffef1fa8e9027c0d6

      • C:\Users\Admin\AppData\Local\Thorium\User Data\Default\Extensions\cgbcahbpdhpcegmbfconppldiemgcoii\1.61.3.9_0\js\vapi-client.js

        Filesize

        7KB

        MD5

        ad3940c6be89d0144e26c76a78779486

        SHA1

        99331f60bbe8181517fb81f0e51e8327719e171e

        SHA256

        30ea26df3ec1227d7426eff3c4d1ca13d8ad98295f50c5ac9b3292f3a99bfaa3

        SHA512

        f07b3c793cba25850714029b0bcf737744c0cc8e94070c3242e8dcd52f65bf3adf5750fb0963750331f8f6cbd9706582f501b6cf764e3f8b6aac1b1f91512130

      • C:\Users\Admin\AppData\Local\Thorium\User Data\Default\Extensions\cgbcahbpdhpcegmbfconppldiemgcoii\1.61.3.9_0\js\vapi.js

        Filesize

        2KB

        MD5

        84421b0122e2d19a0d91c27db88a9bef

        SHA1

        4fa7f3add09053be3eb4193dd379cc03d86d3d2d

        SHA256

        31e664456e8d53aa89a49830f48d44afc124ba8cb81323fe3a0e876f0ba4de0f

        SHA512

        2308419a1062cec6d4046db4cdebeec3cfd0415d242f54a65951c032bf9c1441d51bfd1bda90d2cb89bbc3621d738c09b6876aab7d59ffab4dc2fec9ea49a255

      • C:\Users\Admin\AppData\Local\Thorium\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000003.log

        Filesize

        196KB

        MD5

        59092e028810cbe325917e3232dda945

        SHA1

        9541dc5ab7468c8d29f6a7d5418d4439b8ea0769

        SHA256

        b41122d60d50dcda28569461c684cc6664ccc3f771a6588fb825fcae21a3a2a3

        SHA512

        fa0ca6969692c40e3dc0279023dacea267b73f7c5a9ce1494abe44748023a43d0a45f0df1f506b386b553458214fc674803c985308ecd65a80db30ad4b69377e

      • C:\Users\Admin\AppData\Local\Thorium\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000011.ldb

        Filesize

        16KB

        MD5

        152b3d3bec9a16db642d43809eb2b063

        SHA1

        8638aac4657155a2e9e2c11e681b0d23de5d1a6b

        SHA256

        4d1b873ec86b1cd7b3320569f308fcbc3039ab141e1b1c01fcf55301535c13f7

        SHA512

        bd3a0d4aab7fa199bae03ff5d32d59be1035e9d2bc87267ca309ddecb8f5c8a7e5c2d790044953cb214c7a730b6238a506a53d7f00f797f9d0b7d8132eaafdc9

      • C:\Users\Admin\AppData\Local\Thorium\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000012.log

        Filesize

        24KB

        MD5

        63592d7cdbc8143603eddef6066e2b1a

        SHA1

        0190a343b75feedcbc6e80f30435be4da041c058

        SHA256

        d368be30fb458d9169025d4cd169cdc45bb7daa42f74c3213e03ba4c9269fbb4

        SHA512

        4d8799bd599bf17ffef33e00c1ac9fd638f5edaf1acf5c55e0f91caa4eadcc99b7afbe6e2cd41928f59130b10091582de0f2692785a3acc6cb9d05c2777822dd

      • C:\Users\Admin\AppData\Local\Thorium\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000014.ldb

        Filesize

        12KB

        MD5

        56e68c62ca36af6fabbadac79bf4d0da

        SHA1

        57fa6fa0938879777442eb16f64fdfad3bd81ace

        SHA256

        313efbeede22d1a878fac506841f2833447f22755d78406ddcd63be06cb89b0b

        SHA512

        d7517bcca5b237bc4876e06f5d2d4ca55a1a9b0d7883a728c56704e8622126af5326ae84ce2fbfc77e83a6b60f4b20614d00df803a5feb9f6a2162eff6513726

      • C:\Users\Admin\AppData\Local\Thorium\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\LOG

        Filesize

        4KB

        MD5

        37e303a385129027528720b0d2b1805a

        SHA1

        968b3e5843392c7dd73c69984a934456a2756384

        SHA256

        2972df447e8790066ec9cc2df16526e92e0744969d86305f726c805af18c0586

        SHA512

        9d95eeeba85456aabd461454f7d34782ea6ba50c9fe23fc517d9d55b0c2ca59570754c06bf006ddbdcf6ae30d2c0ad801398259f736bd4981fa4d10c10b00993

      • C:\Users\Admin\AppData\Local\Thorium\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001

        Filesize

        23B

        MD5

        3fd11ff447c1ee23538dc4d9724427a3

        SHA1

        1335e6f71cc4e3cf7025233523b4760f8893e9c9

        SHA256

        720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

        SHA512

        10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

      • C:\Users\Admin\AppData\Local\Thorium\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001

        Filesize

        751B

        MD5

        bb87d6e4829239310b711e7a0ca2bba6

        SHA1

        73db7f39132fb7d41ab4df4cf5724dc3d116aae4

        SHA256

        cc1985042ff435ccc2a50898cc5e8f07f4174b0f9f7e60179045640e34776c4c

        SHA512

        ee8a96653678f33b7785e074bd58f5e57f4ba23934bbeb10c7ef9b653f2f692996e8bc8a19cbce2fd0e01209e88f6ecdaac8f0bbb238732d61db14b8ca313152

      • C:\Users\Admin\AppData\Local\Thorium\User Data\Default\Network\Network Persistent State

        Filesize

        3KB

        MD5

        aec3e110c42534fc78fe19709799bbf3

        SHA1

        36af707b6f6e7853de7eda1d083873d909af31cc

        SHA256

        c7456ef011d68988568436d0df8ccb78d78cb965a9cc0a96d5168bfc3ebc7f26

        SHA512

        81155f386bcb1ba2b5db79995711268edefe13ca22ae0f7a27ca79b2488d7c079cac6dea23c0a2273b74a09b1174a208bb88b96df9026e9499ddfcdf0500adf8

      • C:\Users\Admin\AppData\Local\Thorium\User Data\Default\Network\Network Persistent State~RFe59231e.TMP

        Filesize

        59B

        MD5

        2800881c775077e1c4b6e06bf4676de4

        SHA1

        2873631068c8b3b9495638c865915be822442c8b

        SHA256

        226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

        SHA512

        e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

      • C:\Users\Admin\AppData\Local\Thorium\User Data\Default\Network\SCT Auditing Pending Reports

        Filesize

        2B

        MD5

        d751713988987e9331980363e24189ce

        SHA1

        97d170e1550eee4afc0af065b78cda302a97674c

        SHA256

        4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

        SHA512

        b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

      • C:\Users\Admin\AppData\Local\Thorium\User Data\Default\Network\TransportSecurity

        Filesize

        1KB

        MD5

        be10d89630ee40c2d822920b4ee0b17e

        SHA1

        23eb754f95ed2cf3affede10af0761960ace540c

        SHA256

        5fcc8f3f0357b8fdeddb5a14cb77df49490199ecd303408751f384d8e242e21b

        SHA512

        52aad6f10caa702ed27fb5eea7233a2c7d15ec3059aaef8c8cada54f77659cf05506060e234ed527be31df58122c2d9a3e4e7dffafa2fd04fd1cbb075afda5b0

      • C:\Users\Admin\AppData\Local\Thorium\User Data\Default\Network\TransportSecurity

        Filesize

        858B

        MD5

        1af51362eea71fabbd267d313bf6ae18

        SHA1

        7d19b1c5cd3a7ed4dd71397f2728bb40d3a71677

        SHA256

        7f47e7b95d8019704d244914613ef6e5dd23e12aa48d6314e39aad15a2446747

        SHA512

        87f80995bc330ba38a211bc01f525326cd4179c7ca2249dc6d6e52e1505058a3ca03295e3cae8abb00c1e0b092f58be713c31134814fd873e6c4b4a46e501f96

      • C:\Users\Admin\AppData\Local\Thorium\User Data\Default\Network\TransportSecurity~RFe586b77.TMP

        Filesize

        355B

        MD5

        3578c12553d2ae4c9eda3915bd63271a

        SHA1

        747a6138bc32ad0acc4a0bb61b9b72b918e768ab

        SHA256

        8e1a82fc80cb9bff1657d14117a7543dfa24b2e22740360910893a109a98c5a9

        SHA512

        8983a5424e9753894e9772ccfc94556b55858f829e8bce7429f0e1d9c46afc5cd3818c24b02e0037bdfae51415f8ce790a7fd7f26707684bf6d0d06fb95598c0

      • C:\Users\Admin\AppData\Local\Thorium\User Data\Default\Preferences

        Filesize

        13KB

        MD5

        df0a180a5cc675aabf09507615cbe52a

        SHA1

        7aa8f60450ae14d230777f175f2a853a3d707fd5

        SHA256

        8dfba616aafa2b488d24b32f1ffc76c92b2f7b0b05ddb1ff089f9ed698fe149f

        SHA512

        71658fdcd08ababedc921ab71e1768e00279f9a43266df28812d023b8206b4df92e1c4903fcd616d06f546b156c0d43095652d3886181d33cd8f78cf2b50a9d5

      • C:\Users\Admin\AppData\Local\Thorium\User Data\Default\Preferences

        Filesize

        13KB

        MD5

        41766ba57e1c5db83d28b8993de736de

        SHA1

        78d03297fcd7c50a25d88fa19f45c7d56af357fc

        SHA256

        6f407ef815264247b6994b6993f8941799026ef86b0539d95482d92dc8d1d257

        SHA512

        41ae5932d67d3a00faf794af867ac641fc151b3337ef5d309c38cbd6d88bbe00a3534b021f88c85a6c72d211688fef1c7c7a4b441556ea276596fa36aeba4c59

      • C:\Users\Admin\AppData\Local\Thorium\User Data\Default\Preferences

        Filesize

        9KB

        MD5

        1a7300035c1d6ff134f612b74d39d1e0

        SHA1

        ab915704505589a05741f1a347342ad971ed53fe

        SHA256

        f197b053d3ea47360ee22ed096a42276d3dff91644451dd038f82acc45808875

        SHA512

        afa3d2f29314553c3f6d99f39e12fee16b1b6cdeb726342481ae47b5582a12fa20ae7ca4794ad5da5544afa42ed1ece41ce8d5d33a1a558d70ce88ba3eb0dc31

      • C:\Users\Admin\AppData\Local\Thorium\User Data\Default\Preferences

        Filesize

        12KB

        MD5

        82465b083e227466e468db57ea26ae39

        SHA1

        426f2cb1c87c86646e3787d50a536811631cad71

        SHA256

        33ade36a06b402d17260a905f3e5e2ea3b0dcbc83d35c947d5c29ff9dd4abd2b

        SHA512

        2292fea4bd2e090f314c2984139c22e09fc73649647670a0da60d18b8d7a9246e780bcbea16429fc3d1a8fe5ff5160f1e04020d099924a5c7061a97b275e0558

      • C:\Users\Admin\AppData\Local\Thorium\User Data\Default\Preferences

        Filesize

        11KB

        MD5

        9526668f7fe8e771a72c346d7326d373

        SHA1

        cdf158f0e56a42058d64b05ca4e5e9e06a8e8cbd

        SHA256

        8a04cdc258d10b5929905a9a3da4ae689b558bafe71488bf58219dd7106cf3b7

        SHA512

        5ea07d3c482e6caf5bfc27e2e3357d0fe51f2872b71946984b4de395a0ad711e86ce24dac65700f487835a8685bdc6e1d12d7d8fc18c4fb21ce8a19ddb899384

      • C:\Users\Admin\AppData\Local\Thorium\User Data\Default\Preferences~RFe58340b.TMP

        Filesize

        2KB

        MD5

        12e9236b87c2bb7f8f4876c9050864b9

        SHA1

        e85f2818a5867c223c08c7ee6764cc0ae2d822cb

        SHA256

        3112edf577294dd855ba3acabb389da8a46cc4bbbd2f5983e1be29015e1e9b6b

        SHA512

        82e059fd6533a195189fb321e4707db7726800d617b70902135945c7ed293052799a715118f9c9578663e095cae96678938006f7f9b6b297b3f40bee2a75c747

      • C:\Users\Admin\AppData\Local\Thorium\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\6c928260-60ab-4cf1-a1c3-e9dcedb16b40\23f39acc884671c2_0

        Filesize

        2KB

        MD5

        9b5e17199a26148f20e5b201b8f21b8c

        SHA1

        9a63f54c7445a3eba6cdf213eb175b9115ed1d3d

        SHA256

        6925745f8d24354d03a9e762dd5ac25c06275a68af576b9cea24002cef27f803

        SHA512

        b37e3ec72a0efc269f3b66086ec129e55ce4ded37c29b8e920feca33b2afcf18682d6542a8fcdf902dadc492714bbb0e2665c10acab3b565e44d698d1910f99b

      • C:\Users\Admin\AppData\Local\Thorium\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\8975c10b-a052-4b2d-8dad-4976fff6a456\index

        Filesize

        24B

        MD5

        54cb446f628b2ea4a5bce5769910512e

        SHA1

        c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

        SHA256

        fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

        SHA512

        8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

      • C:\Users\Admin\AppData\Local\Thorium\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\8975c10b-a052-4b2d-8dad-4976fff6a456\index-dir\the-real-index

        Filesize

        2KB

        MD5

        8cdddb3b0381ca8e14fc4818bd9d9fc1

        SHA1

        3ffb681ae833f33b0ee04aaf766fab278647c29c

        SHA256

        e0753a5cff60fa00de024f6a24dd3e75c73fca32e997c3bd179d4a18b6c2b6d4

        SHA512

        2e068430b9e3036c38ca2cb4511ace2d2c6391f5f79c6fd2b45463290cd28ce456be46962e7a5c36805bae4ef8f484d309401fa582e669e7df696062d2f3c06d

      • C:\Users\Admin\AppData\Local\Thorium\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\8975c10b-a052-4b2d-8dad-4976fff6a456\index-dir\the-real-index~RFe59140b.TMP

        Filesize

        48B

        MD5

        3c31fa623513534826d3c52ed561eb26

        SHA1

        b456c24837dca93ee4792c2354ae2d8729d2fa18

        SHA256

        5f2ae3a8a510838cd37218b43e9f1f4bd141a6b0e5c3b54ea8161141a4b18700

        SHA512

        30606383de4d69bf023be5555375ea99edf78e8d09d715dba99587b1018c1fe828b097bf7042c83907ceaa4f731ed1c17565686786aa320bdabef09b8242fc4c

      • C:\Users\Admin\AppData\Local\Thorium\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

        Filesize

        176B

        MD5

        c8d0b73ee53e6f6ab8e9412eb2bbe726

        SHA1

        b994ebf3582172bc1e539b93669ae67d47ba4f27

        SHA256

        85beefc68a14cc8f3d00bd6c9683abe9c04da6ff38054cef166d7e8377ea08e6

        SHA512

        a36103aa0a9d05bf77f13b46c9b3c05c7a16bb44b62ea0686cefc1f1fefedad5b4ccd47ec66d4b99f219a7b46ca462f13e73453ef0096285b90865aa39f0da7b

      • C:\Users\Admin\AppData\Local\Thorium\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

        Filesize

        178B

        MD5

        6688ce878636527900fd7d120afc02cc

        SHA1

        4ecfe77808d5d8bf74894a8189140d92776127b3

        SHA256

        75a220d9aeee566b116361f97c57f9dcdc7be0a9c10690fcac096e0c49c1c2e2

        SHA512

        35d7be88d8c769e935ee6ef6b0d166f4bdbe0b06a34c50841dba3ce946eb650e3d2b708d1b163dc77324eeeb34b4ea2698c78a5f0fe615ff3f48ba8d5683faad

      • C:\Users\Admin\AppData\Local\Thorium\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

        Filesize

        114B

        MD5

        1793a556af258a7196f2ed5f30040ebb

        SHA1

        2d708fda95cea385c7765dfca51310a2c4b059f3

        SHA256

        80d53dd075dc467e0449af8ee205b67ce6b52992a8bcf3c145271318e422e01a

        SHA512

        040ee70cd56f9f9ad14ad9a4bf1360b7d311a03cf3d68e36504f9948e92807951c527a71ce75c03308befb8ef1a6054edb9b4547da4d23a5683ed7e673f0e52b

      • C:\Users\Admin\AppData\Local\Thorium\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

        Filesize

        187B

        MD5

        192966fa3a74ac8c3beb41b66804d181

        SHA1

        57a6608c51539d8f2515a58c4cd5a5db47676d3a

        SHA256

        73e0ec16c5d646aed48da910faa12d42d159bf4763f7622f2c7fe4338ee53ca3

        SHA512

        cbb9704410d58534e6c2afbcbb0c9c514ab69827edbc2da4f48b2c033e759aa2b1df1d3a3056b5e7d04b5e47071593b5c894af1c621832988aebb924231d648c

      • C:\Users\Admin\AppData\Local\Thorium\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

        Filesize

        112B

        MD5

        e4bfda4d35f9f2d5b73a0bbdb0ae364f

        SHA1

        4b4c6c5789e7330288af80d3dcfb2af88f8d5cff

        SHA256

        51e4bba84be5dd565addf7a9570822ea7967aab9d50f2f309200327b90129390

        SHA512

        b68f62dcc99d333f98deb438ecd0ae1593698fc4ed561fad8a86929d7fe1e63db8c78eec5ea78667432806921e04495d34beea5d173797f40327b23b590df04d

      • C:\Users\Admin\AppData\Local\Thorium\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe59090e.TMP

        Filesize

        119B

        MD5

        98192ba817f3870a0e49da3b26a5516f

        SHA1

        83264eb2eed984f61b5804bc3756d3f53ed6756b

        SHA256

        eaa97162afb3dc64d27718c5296e2161d109ab0ac262b43ec4c687cf0e384cc9

        SHA512

        b0347d41e44f2f1d8b0d60837ea3251687bfb9448a27bb97dad4fc1f0a104552ec7ddc1efeddfbe0cfb403d0d792662ee1f10030076040bbdf5a35b51fad3078

      • C:\Users\Admin\AppData\Local\Thorium\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

        Filesize

        72B

        MD5

        4e09d0f52fd46b36655958b2507bf42e

        SHA1

        c28fdc8201119c8bc2b2f23d3a579232f1414bfe

        SHA256

        9e7d6aad0f25208541e3c9700d67696929484bb81d3bb11059b8df1c619ab35c

        SHA512

        94453f1f36e95bfa75eb2ec2dec58e071d70a5fc0cd603f4c9199121a9439edf925e0e41f560596bb06ad238a670d978b99cde35e739b53098f4c9cd82637cb9

      • C:\Users\Admin\AppData\Local\Thorium\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe587923.TMP

        Filesize

        72B

        MD5

        71e5062def18cbb9db54edfbbb3003f9

        SHA1

        6e2d296414a9482933ead1099697068a109d0b2a

        SHA256

        ee54dea18498f920bb47f358ce86ef692ddb101322b80801c21b6209d330d827

        SHA512

        13bc668c0f64432381d407b0e10aa52352a386f115a3c58b97b7dee9a742eae6c6047163101cf09ef50e0f8aa102618d4f0e6ba6d8ee40e10b1b63d72edb29de

      • C:\Users\Admin\AppData\Local\Thorium\User Data\Default\Site Characteristics Database\CURRENT

        Filesize

        16B

        MD5

        46295cac801e5d4857d09837238a6394

        SHA1

        44e0fa1b517dbf802b18faf0785eeea6ac51594b

        SHA256

        0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

        SHA512

        8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

      • C:\Users\Admin\AppData\Local\Thorium\User Data\Default\f597849a-0c6f-41e0-b872-04173f6771f0.tmp

        Filesize

        158KB

        MD5

        68617219d18c1f02e962aeae0d0ea4e8

        SHA1

        499654df36c1bfbf7c5db5bc0196b0273fe869dc

        SHA256

        7ca3442d79b0ba16631cde203715d781ae9820296980e922ca90ecfb6a9b49c9

        SHA512

        092d31c9b5bbaf9a97d6bb90e941e2e096c4573e458eec7223748a03322c8ab89305eccc54c9ee7a7d0c6430b8301039a81a7d07ce91fb61c0d832568d80bb29

      • C:\Users\Admin\AppData\Local\Thorium\User Data\GrShaderCache\data_0

        Filesize

        8KB

        MD5

        cf89d16bb9107c631daabf0c0ee58efb

        SHA1

        3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

        SHA256

        d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

        SHA512

        8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

      • C:\Users\Admin\AppData\Local\Thorium\User Data\GrShaderCache\data_2

        Filesize

        8KB

        MD5

        0962291d6d367570bee5454721c17e11

        SHA1

        59d10a893ef321a706a9255176761366115bedcb

        SHA256

        ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

        SHA512

        f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

      • C:\Users\Admin\AppData\Local\Thorium\User Data\GrShaderCache\data_3

        Filesize

        8KB

        MD5

        41876349cb12d6db992f1309f22df3f0

        SHA1

        5cf26b3420fc0302cd0a71e8d029739b8765be27

        SHA256

        e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

        SHA512

        e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

      • C:\Users\Admin\AppData\Local\Thorium\User Data\GraphiteDawnCache\data_1

        Filesize

        264KB

        MD5

        d0d388f3865d0523e451d6ba0be34cc4

        SHA1

        8571c6a52aacc2747c048e3419e5657b74612995

        SHA256

        902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

        SHA512

        376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

      • C:\Users\Admin\AppData\Local\Thorium\User Data\Local State

        Filesize

        4KB

        MD5

        3c7ed3980d0f26f05c28cb2a4cbe746c

        SHA1

        7433ff1ba5671382065d168134beb4f1f98ed379

        SHA256

        5ffded97b2e0a3a4e550b29e8a98db5f99b633f87d8f31271923d2695992f708

        SHA512

        5c3e21d8d685767236a8058b66364f1afe469fd9c6536658a81b83ffeed63c28ca22ed31ae3d6e283e1314a93f8f46bf29b8e91b2d921e7d10d9ecb7cc5bcf91

      • C:\Users\Admin\AppData\Local\Thorium\User Data\Local State

        Filesize

        1KB

        MD5

        0d2bd187b42348bc9e5ad62148e03d4b

        SHA1

        08e53d06b105be471e98d6f277a77cf030dd75e5

        SHA256

        cc1abbe462d97984fb18185f0e5649067d5e03e1c2b13b010e61d689317edee5

        SHA512

        fe877a3795fc8d15683d4fbb41b2bc1df84ea3c094349759c8475b044096498aa6d389931c0ad6ba9760e02ba605b8004b2eea76b82da2b2a10679274dbec48b

      • C:\Users\Admin\AppData\Local\Thorium\User Data\Local State

        Filesize

        2KB

        MD5

        f15ce836d8eab9777ee9d2768f888f3c

        SHA1

        ab88b7667a4386fab41036811dd1f9a5b7b2898f

        SHA256

        3ef4ba648e1cfbf81328ca442338b02e6beb51543fe370e83b979c1ac4f89fd5

        SHA512

        3cca56410d0f9f9502d8acc680e962ae81bbb73010d0ab9c40ee2d45343461acc0500f79cdbc2ba15a8638f3ebee75b62b1e0ecf97a92a8e250433de84547185

      • C:\Users\Admin\AppData\Local\Thorium\User Data\Local State

        Filesize

        4KB

        MD5

        6995a3fc34884328abb61076264a8a88

        SHA1

        fb9c43de5b22c6cb2a49ca89ddec95635a219e58

        SHA256

        da53d74299c80ae49f6b273ee81cba544a8f58ec2567ef6ac5e018cf62a4f5a3

        SHA512

        7c87a79d0b9c0f3e6d15caa9eed023e996123d6e6fe6b7963fc10411464e131c8cf91361adb740e27ba5dbc4b2e9b5ab8dfe658c125f26c7d2c09bfb1c08f6df

      • C:\Users\Admin\AppData\Local\Thorium\User Data\Local State

        Filesize

        4KB

        MD5

        79aef86bdbd1fa1f1a83ff784fc34d17

        SHA1

        6f83a47323621227bd7efd4fa4d37e24f4aabd94

        SHA256

        c13ff9eaa45975997b1b73be6c303cb0f90facced7d97c5490d545c84986cdc7

        SHA512

        f6ece39c5f01039375c27aad21a47a540589e7b26bde714f62de1ab22de8ed736bb8abd601afa838a36b3c54fc4e10498969a9eb94f967d7c70cabd79aaddd5b

      • C:\Users\Admin\AppData\Local\Thorium\User Data\Local State~RFe580cec.TMP

        Filesize

        870B

        MD5

        ed67cf540aacd7d65cf8988e33f7d1ac

        SHA1

        b4bb67716b97502fe0eda21f4a86f97a1c7510c7

        SHA256

        8e9fd902c4c7d9ad2e596cd42c146c6a8bb90df03054f51445ed789291fb46d3

        SHA512

        b470797eb5e7c933234bd1a32a3f46155b894194266ccd2eef5db450e026359258cc4a57513d5b93c2ee6dc072048e9cf21ae915e666b0560fc26ac7078da351

      • C:\Users\Admin\AppData\Local\Thorium\User Data\PrivacySandboxAttestationsPreloaded\2024.12.20.0\privacy-sandbox-attestations.dat

        Filesize

        7KB

        MD5

        fd41098f561dc933ee27e2d0cf436f6c

        SHA1

        91d0d3dec4289b93249c0b68dcb5299d248d0099

        SHA256

        cc1f27259a4a91d85741adb24f9302ebeb2d01b0efe49263b1c5f95e91072047

        SHA512

        36b1c2e28fc8be1bd373156fe0d0e5bb0c5d9eb8885bb7b227f5b3817387e26c7deb75775ba6eb198770e926e79c048932ae133e13f47acebe92faf31377a36e

      • C:\Users\Admin\AppData\Local\Thorium\User Data\optimization_guide_model_store\13\E6DC4029A1E4B4C1\F277A06C46251EE4\model.tflite

        Filesize

        1.2MB

        MD5

        94a1aa50ea81fa01a3518eb822b40e1a

        SHA1

        ce1645c2c0db634a69d8ba7287a069529ea8a3cb

        SHA256

        3c88fd9805746be38b8d567b81dccee7c790ed17ca58902e69506b1e4c41fd3f

        SHA512

        a8a9573b666d94a260f8e29b8b5e0408ddd030b50546eba7b079ef2e0d96009adcaf17bdda2b3593e83f4164571a9ef9d470ba3502c46861c1053bacb0eea211

      • C:\Users\Admin\AppData\Local\Thorium\User Data\optimization_guide_model_store\2\E6DC4029A1E4B4C1\B2B58F2728E8569C\model.tflite

        Filesize

        382KB

        MD5

        6d7c2f9e94664539dec99b3233301b01

        SHA1

        85812b004742cc1c211c92911131ce270f8ba769

        SHA256

        a0956386dc64fd9f4883c8741f950cd60a56859616b159c9e4251c9eb0ac5534

        SHA512

        4d06917f30651c3bf13c509aae79793b3f1ec93de12179464b18fd9fd16c7bf466884b1c70e425d7e937adde341cf24bd08f19a132bbb9683e804f29b4ed0c33

      • C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

        Filesize

        2B

        MD5

        f3b25701fe362ec84616a93a45ce9998

        SHA1

        d62636d8caec13f04e28442a0a6fa1afeb024bbb

        SHA256

        b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

        SHA512

        98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Thorium.lnk

        Filesize

        2KB

        MD5

        588edc9d9f80ff2a1bef86474d3f1e86

        SHA1

        bd7f3005953bfea4ea1d58b8934372083bfe51ac

        SHA256

        8677243dbbafb63d02cace3d271f0743a99aad9046b31b9aaac070b9583e08ea

        SHA512

        f9c82668f5d8ab41ea814afaa4ad85f59ccfeacf9f0d33e40d652238569d6207b1e5716ce4fad2885b7c07b061804ceacc5519a579b9227137401308179a15a1

      • memory/4672-118-0x00007FFDB90C0000-0x00007FFDB90C1000-memory.dmp

        Filesize

        4KB

      • memory/4672-117-0x00007FFDBA730000-0x00007FFDBA731000-memory.dmp

        Filesize

        4KB