df430e88e62b426b7c75ba29eb28eff3b77714999a28c6f9aa9172085f78cd3a

Analysis

max time kernel
301s
max time network
317s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04-03-2024 00:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

stremio.exe
Size

300KB
MD5

aa366c09bf262e172741c9be289fcca1
SHA1

165a122c2aaf882f5ed76b3132e61f96006910e6
SHA256

3fa56731a29f0d9d901b7a158c1b05b2bb1354fd2dfb0dcd999e69039b23e280
SHA512

7ae09a2d53c0e8d481ca475af78c2548ccc823c77c65ea761d94da830f28b553661f5d3ee95a245a2838d0885e206ac13efb9cda08977eeba9f50eb19e877b0e
SSDEEP

6144:qWPyIAD5PbpYuleI5czCteCwiKG8aYCNoJ2vb:FPyIAD5JleIiGx7NoJkb

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 27 IoCs

pid	pid_target	Process	procid_target
4016	4484	WerFault.exe	89
4192	3412	WerFault.exe	96
4464	4504	WerFault.exe	103
1488	2136	WerFault.exe	110
1992	2896	WerFault.exe	115
3640	4476	WerFault.exe	120
1156	3136	WerFault.exe	125
4948	544	WerFault.exe	130
3048	3068	WerFault.exe	135
4868	3164	WerFault.exe	140
5040	4628	WerFault.exe	145
4772	3908	WerFault.exe	150
2136	456	WerFault.exe	155
2392	2276	WerFault.exe	160
3884	1296	WerFault.exe	165
1660	3992	WerFault.exe	170
2608	3968	WerFault.exe	175
656	4808	WerFault.exe	180
2128	4388	WerFault.exe	185
2380	1840	WerFault.exe	190
4112	2784	WerFault.exe	195
4300	1188	WerFault.exe	200
2264	4660	WerFault.exe	205
1084	4444	WerFault.exe	210
516	976	WerFault.exe	215
1576	1512	WerFault.exe	220
808	1148	WerFault.exe	225

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
628	stremio.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
3100	QtWebEngineProcess.exe
3100	QtWebEngineProcess.exe
2996	QtWebEngineProcess.exe
628	stremio.exe
628	stremio.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
628	stremio.exe
628	stremio.exe
628	stremio.exe
628	stremio.exe
628	stremio.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
628	stremio.exe
628	stremio.exe
628	stremio.exe
628	stremio.exe
628	stremio.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
628	stremio.exe
628	stremio.exe
628	stremio.exe
628	stremio.exe
628	stremio.exe
628	stremio.exe
628	stremio.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 628 wrote to memory of 4484	628	stremio.exe	89
PID 628 wrote to memory of 4484	628	stremio.exe	89
PID 628 wrote to memory of 4484	628	stremio.exe	89
PID 628 wrote to memory of 3100	628	stremio.exe	91
PID 628 wrote to memory of 3100	628	stremio.exe	91
PID 628 wrote to memory of 3100	628	stremio.exe	91
PID 628 wrote to memory of 2996	628	stremio.exe	92
PID 628 wrote to memory of 2996	628	stremio.exe	92
PID 628 wrote to memory of 2996	628	stremio.exe	92
PID 628 wrote to memory of 2996	628	stremio.exe	92
PID 628 wrote to memory of 2996	628	stremio.exe	92
PID 628 wrote to memory of 2996	628	stremio.exe	92
PID 628 wrote to memory of 2996	628	stremio.exe	92
PID 628 wrote to memory of 2996	628	stremio.exe	92
PID 628 wrote to memory of 2996	628	stremio.exe	92
PID 628 wrote to memory of 2996	628	stremio.exe	92
PID 628 wrote to memory of 2996	628	stremio.exe	92
PID 628 wrote to memory of 2996	628	stremio.exe	92
PID 628 wrote to memory of 2996	628	stremio.exe	92
PID 628 wrote to memory of 2996	628	stremio.exe	92
PID 628 wrote to memory of 2996	628	stremio.exe	92
PID 628 wrote to memory of 2996	628	stremio.exe	92
PID 628 wrote to memory of 2996	628	stremio.exe	92
PID 628 wrote to memory of 2996	628	stremio.exe	92
PID 628 wrote to memory of 2996	628	stremio.exe	92
PID 628 wrote to memory of 2996	628	stremio.exe	92
PID 628 wrote to memory of 2996	628	stremio.exe	92
PID 628 wrote to memory of 2996	628	stremio.exe	92
PID 628 wrote to memory of 2996	628	stremio.exe	92
PID 628 wrote to memory of 2996	628	stremio.exe	92
PID 628 wrote to memory of 2996	628	stremio.exe	92
PID 628 wrote to memory of 2996	628	stremio.exe	92
PID 628 wrote to memory of 2996	628	stremio.exe	92
PID 628 wrote to memory of 2996	628	stremio.exe	92
PID 628 wrote to memory of 2996	628	stremio.exe	92
PID 628 wrote to memory of 2996	628	stremio.exe	92
PID 628 wrote to memory of 2996	628	stremio.exe	92
PID 628 wrote to memory of 2996	628	stremio.exe	92
PID 628 wrote to memory of 2996	628	stremio.exe	92
PID 628 wrote to memory of 2996	628	stremio.exe	92
PID 628 wrote to memory of 2996	628	stremio.exe	92
PID 628 wrote to memory of 2996	628	stremio.exe	92
PID 628 wrote to memory of 2996	628	stremio.exe	92
PID 628 wrote to memory of 2996	628	stremio.exe	92
PID 628 wrote to memory of 2996	628	stremio.exe	92
PID 628 wrote to memory of 2996	628	stremio.exe	92
PID 628 wrote to memory of 2996	628	stremio.exe	92
PID 628 wrote to memory of 2996	628	stremio.exe	92
PID 628 wrote to memory of 2996	628	stremio.exe	92
PID 4484 wrote to memory of 2608	4484	stremio-runtime.exe	93
PID 4484 wrote to memory of 2608	4484	stremio-runtime.exe	93
PID 628 wrote to memory of 3412	628	stremio.exe	96
PID 628 wrote to memory of 3412	628	stremio.exe	96
PID 628 wrote to memory of 3412	628	stremio.exe	96
PID 3412 wrote to memory of 3172	3412	stremio-runtime.exe	98
PID 3412 wrote to memory of 3172	3412	stremio-runtime.exe	98
PID 628 wrote to memory of 4504	628	stremio.exe	103
PID 628 wrote to memory of 4504	628	stremio.exe	103
PID 628 wrote to memory of 4504	628	stremio.exe	103
PID 4504 wrote to memory of 4476	4504	stremio-runtime.exe	105
PID 4504 wrote to memory of 4476	4504	stremio-runtime.exe	105
PID 628 wrote to memory of 2136	628	stremio.exe	110
PID 628 wrote to memory of 2136	628	stremio.exe	110
PID 628 wrote to memory of 2136	628	stremio.exe	110

C:\Users\Admin\AppData\Local\Temp\stremio.exe
"C:\Users\Admin\AppData\Local\Temp\stremio.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:628
- C:\Users\Admin\AppData\Local\Temp\stremio-runtime.exe
  C:\Users\Admin\AppData\Local\Temp\stremio-runtime.exe C:/Users/Admin/AppData/Local/Temp/server.js
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4484
- - C:\Users\Admin\AppData\Local\Temp\ffprobe.exe
    C:\Users\Admin\AppData\Local\Temp\ffprobe.exe -show_entries "stream=index,bit_rate,max_bit_rate,codec_type,codec_name,start_time,start_pts,r_frame_rate,sample_rate,channels,channel_layout,time_base,has_b_frames,nb_frames,width,height,color_space,color_transfer,color_primaries,codec_tag_string : stream_tags=title,language,duration,bps,number_of_bytes : format=format_name,duration,bit_rate,max_bit_rate" -print_format json http://127.0.0.1:11470/samples/hevc.mkv
    3⤵
    PID:2608
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4484 -s 1104
    3⤵
    - Program crash
    PID:4016
- C:\Users\Admin\AppData\Local\Temp\QtWebEngineProcess.exe
  "C:\Users\Admin\AppData\Local\Temp\QtWebEngineProcess.exe" --type=utility --enable-features=AllowContentInitiatedDataUrlNavigations,TracingServiceInProcess --disable-features=BackgroundFetch,ConsolidatedMovementXY,DnsOverHttpsUpgrade,FormControlsRefresh,MojoVideoCapture,PictureInPicture,SmsReceiver,UseSkiaRenderer,WebPayments,WebUSB --lang=en-US --service-sandbox-type=network --application-name=Stremio --webengine-schemes=qrc:sLV --mojo-platform-channel-handle=3300 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3100
- C:\Users\Admin\AppData\Local\Temp\QtWebEngineProcess.exe
  "C:\Users\Admin\AppData\Local\Temp\QtWebEngineProcess.exe" --type=renderer --autoplay-policy=no-user-gesture-required --disable-speech-api --enable-threaded-compositing --enable-features=AllowContentInitiatedDataUrlNavigations,TracingServiceInProcess --disable-features=BackgroundFetch,ConsolidatedMovementXY,DnsOverHttpsUpgrade,FormControlsRefresh,MojoVideoCapture,PictureInPicture,SmsReceiver,UseSkiaRenderer,WebPayments,WebUSB --disable-gpu-compositing --lang=en-US --webengine-schemes=qrc:sLV --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2996
- C:\Users\Admin\AppData\Local\Temp\stremio-runtime.exe
  C:\Users\Admin\AppData\Local\Temp\stremio-runtime.exe C:/Users/Admin/AppData/Local/Temp/server.js
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3412
- - C:\Users\Admin\AppData\Local\Temp\ffprobe.exe
    C:\Users\Admin\AppData\Local\Temp\ffprobe.exe -show_entries "stream=index,bit_rate,max_bit_rate,codec_type,codec_name,start_time,start_pts,r_frame_rate,sample_rate,channels,channel_layout,time_base,has_b_frames,nb_frames,width,height,color_space,color_transfer,color_primaries,codec_tag_string : stream_tags=title,language,duration,bps,number_of_bytes : format=format_name,duration,bit_rate,max_bit_rate" -print_format json http://127.0.0.1:11470/samples/hevc.mkv
    3⤵
    PID:3172
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3412 -s 1100
    3⤵
    - Program crash
    PID:4192
- C:\Users\Admin\AppData\Local\Temp\stremio-runtime.exe
  C:\Users\Admin\AppData\Local\Temp\stremio-runtime.exe C:/Users/Admin/AppData/Local/Temp/server.js
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4504
- - C:\Users\Admin\AppData\Local\Temp\ffprobe.exe
    C:\Users\Admin\AppData\Local\Temp\ffprobe.exe -show_entries "stream=index,bit_rate,max_bit_rate,codec_type,codec_name,start_time,start_pts,r_frame_rate,sample_rate,channels,channel_layout,time_base,has_b_frames,nb_frames,width,height,color_space,color_transfer,color_primaries,codec_tag_string : stream_tags=title,language,duration,bps,number_of_bytes : format=format_name,duration,bit_rate,max_bit_rate" -print_format json http://127.0.0.1:11470/samples/hevc.mkv
    3⤵
    PID:4476
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 1092
    3⤵
    - Program crash
    PID:4464
- C:\Users\Admin\AppData\Local\Temp\stremio-runtime.exe
  C:\Users\Admin\AppData\Local\Temp\stremio-runtime.exe C:/Users/Admin/AppData/Local/Temp/server.js
  2⤵
  PID:2136
- - C:\Users\Admin\AppData\Local\Temp\ffprobe.exe
    C:\Users\Admin\AppData\Local\Temp\ffprobe.exe -show_entries "stream=index,bit_rate,max_bit_rate,codec_type,codec_name,start_time,start_pts,r_frame_rate,sample_rate,channels,channel_layout,time_base,has_b_frames,nb_frames,width,height,color_space,color_transfer,color_primaries,codec_tag_string : stream_tags=title,language,duration,bps,number_of_bytes : format=format_name,duration,bit_rate,max_bit_rate" -print_format json http://127.0.0.1:11470/samples/hevc.mkv
    3⤵
    PID:2156
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2136 -s 1096
    3⤵
    - Program crash
    PID:1488
- C:\Users\Admin\AppData\Local\Temp\stremio-runtime.exe
  C:\Users\Admin\AppData\Local\Temp\stremio-runtime.exe C:/Users/Admin/AppData/Local/Temp/server.js
  2⤵
  PID:2896
- - C:\Users\Admin\AppData\Local\Temp\ffprobe.exe
    C:\Users\Admin\AppData\Local\Temp\ffprobe.exe -show_entries "stream=index,bit_rate,max_bit_rate,codec_type,codec_name,start_time,start_pts,r_frame_rate,sample_rate,channels,channel_layout,time_base,has_b_frames,nb_frames,width,height,color_space,color_transfer,color_primaries,codec_tag_string : stream_tags=title,language,duration,bps,number_of_bytes : format=format_name,duration,bit_rate,max_bit_rate" -print_format json http://127.0.0.1:11470/samples/hevc.mkv
    3⤵
    PID:5012
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 1096
    3⤵
    - Program crash
    PID:1992
- C:\Users\Admin\AppData\Local\Temp\stremio-runtime.exe
  C:\Users\Admin\AppData\Local\Temp\stremio-runtime.exe C:/Users/Admin/AppData/Local/Temp/server.js
  2⤵
  PID:4476
- - C:\Users\Admin\AppData\Local\Temp\ffprobe.exe
    C:\Users\Admin\AppData\Local\Temp\ffprobe.exe -show_entries "stream=index,bit_rate,max_bit_rate,codec_type,codec_name,start_time,start_pts,r_frame_rate,sample_rate,channels,channel_layout,time_base,has_b_frames,nb_frames,width,height,color_space,color_transfer,color_primaries,codec_tag_string : stream_tags=title,language,duration,bps,number_of_bytes : format=format_name,duration,bit_rate,max_bit_rate" -print_format json http://127.0.0.1:11470/samples/hevc.mkv
    3⤵
    PID:1492
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4476 -s 1100
    3⤵
    - Program crash
    PID:3640
- C:\Users\Admin\AppData\Local\Temp\stremio-runtime.exe
  C:\Users\Admin\AppData\Local\Temp\stremio-runtime.exe C:/Users/Admin/AppData/Local/Temp/server.js
  2⤵
  PID:3136
- - C:\Users\Admin\AppData\Local\Temp\ffprobe.exe
    C:\Users\Admin\AppData\Local\Temp\ffprobe.exe -show_entries "stream=index,bit_rate,max_bit_rate,codec_type,codec_name,start_time,start_pts,r_frame_rate,sample_rate,channels,channel_layout,time_base,has_b_frames,nb_frames,width,height,color_space,color_transfer,color_primaries,codec_tag_string : stream_tags=title,language,duration,bps,number_of_bytes : format=format_name,duration,bit_rate,max_bit_rate" -print_format json http://127.0.0.1:11470/samples/hevc.mkv
    3⤵
    PID:4588
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3136 -s 1096
    3⤵
    - Program crash
    PID:1156
- C:\Users\Admin\AppData\Local\Temp\stremio-runtime.exe
  C:\Users\Admin\AppData\Local\Temp\stremio-runtime.exe C:/Users/Admin/AppData/Local/Temp/server.js
  2⤵
  PID:544
- - C:\Users\Admin\AppData\Local\Temp\ffprobe.exe
    C:\Users\Admin\AppData\Local\Temp\ffprobe.exe -show_entries "stream=index,bit_rate,max_bit_rate,codec_type,codec_name,start_time,start_pts,r_frame_rate,sample_rate,channels,channel_layout,time_base,has_b_frames,nb_frames,width,height,color_space,color_transfer,color_primaries,codec_tag_string : stream_tags=title,language,duration,bps,number_of_bytes : format=format_name,duration,bit_rate,max_bit_rate" -print_format json http://127.0.0.1:11470/samples/hevc.mkv
    3⤵
    PID:3228
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 544 -s 808
    3⤵
    - Program crash
    PID:4948
- C:\Users\Admin\AppData\Local\Temp\stremio-runtime.exe
  C:\Users\Admin\AppData\Local\Temp\stremio-runtime.exe C:/Users/Admin/AppData/Local/Temp/server.js
  2⤵
  PID:3068
- - C:\Users\Admin\AppData\Local\Temp\ffprobe.exe
    C:\Users\Admin\AppData\Local\Temp\ffprobe.exe -show_entries "stream=index,bit_rate,max_bit_rate,codec_type,codec_name,start_time,start_pts,r_frame_rate,sample_rate,channels,channel_layout,time_base,has_b_frames,nb_frames,width,height,color_space,color_transfer,color_primaries,codec_tag_string : stream_tags=title,language,duration,bps,number_of_bytes : format=format_name,duration,bit_rate,max_bit_rate" -print_format json http://127.0.0.1:11470/samples/hevc.mkv
    3⤵
    PID:2196
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3068 -s 1092
    3⤵
    - Program crash
    PID:3048
- C:\Users\Admin\AppData\Local\Temp\stremio-runtime.exe
  C:\Users\Admin\AppData\Local\Temp\stremio-runtime.exe C:/Users/Admin/AppData/Local/Temp/server.js
  2⤵
  PID:3164
- - C:\Users\Admin\AppData\Local\Temp\ffprobe.exe
    C:\Users\Admin\AppData\Local\Temp\ffprobe.exe -show_entries "stream=index,bit_rate,max_bit_rate,codec_type,codec_name,start_time,start_pts,r_frame_rate,sample_rate,channels,channel_layout,time_base,has_b_frames,nb_frames,width,height,color_space,color_transfer,color_primaries,codec_tag_string : stream_tags=title,language,duration,bps,number_of_bytes : format=format_name,duration,bit_rate,max_bit_rate" -print_format json http://127.0.0.1:11470/samples/hevc.mkv
    3⤵
    PID:4204
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3164 -s 1120
    3⤵
    - Program crash
    PID:4868
- C:\Users\Admin\AppData\Local\Temp\stremio-runtime.exe
  C:\Users\Admin\AppData\Local\Temp\stremio-runtime.exe C:/Users/Admin/AppData/Local/Temp/server.js
  2⤵
  PID:4628
- - C:\Users\Admin\AppData\Local\Temp\ffprobe.exe
    C:\Users\Admin\AppData\Local\Temp\ffprobe.exe -show_entries "stream=index,bit_rate,max_bit_rate,codec_type,codec_name,start_time,start_pts,r_frame_rate,sample_rate,channels,channel_layout,time_base,has_b_frames,nb_frames,width,height,color_space,color_transfer,color_primaries,codec_tag_string : stream_tags=title,language,duration,bps,number_of_bytes : format=format_name,duration,bit_rate,max_bit_rate" -print_format json http://127.0.0.1:11470/samples/hevc.mkv
    3⤵
    PID:2980
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4628 -s 1096
    3⤵
    - Program crash
    PID:5040
- C:\Users\Admin\AppData\Local\Temp\stremio-runtime.exe
  C:\Users\Admin\AppData\Local\Temp\stremio-runtime.exe C:/Users/Admin/AppData/Local/Temp/server.js
  2⤵
  PID:3908
- - C:\Users\Admin\AppData\Local\Temp\ffprobe.exe
    C:\Users\Admin\AppData\Local\Temp\ffprobe.exe -show_entries "stream=index,bit_rate,max_bit_rate,codec_type,codec_name,start_time,start_pts,r_frame_rate,sample_rate,channels,channel_layout,time_base,has_b_frames,nb_frames,width,height,color_space,color_transfer,color_primaries,codec_tag_string : stream_tags=title,language,duration,bps,number_of_bytes : format=format_name,duration,bit_rate,max_bit_rate" -print_format json http://127.0.0.1:11470/samples/hevc.mkv
    3⤵
    PID:5008
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 1120
    3⤵
    - Program crash
    PID:4772
- C:\Users\Admin\AppData\Local\Temp\stremio-runtime.exe
  C:\Users\Admin\AppData\Local\Temp\stremio-runtime.exe C:/Users/Admin/AppData/Local/Temp/server.js
  2⤵
  PID:456
- - C:\Users\Admin\AppData\Local\Temp\ffprobe.exe
    C:\Users\Admin\AppData\Local\Temp\ffprobe.exe -show_entries "stream=index,bit_rate,max_bit_rate,codec_type,codec_name,start_time,start_pts,r_frame_rate,sample_rate,channels,channel_layout,time_base,has_b_frames,nb_frames,width,height,color_space,color_transfer,color_primaries,codec_tag_string : stream_tags=title,language,duration,bps,number_of_bytes : format=format_name,duration,bit_rate,max_bit_rate" -print_format json http://127.0.0.1:11470/samples/hevc.mkv
    3⤵
    PID:2416
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 456 -s 1160
    3⤵
    - Program crash
    PID:2136
- C:\Users\Admin\AppData\Local\Temp\stremio-runtime.exe
  C:\Users\Admin\AppData\Local\Temp\stremio-runtime.exe C:/Users/Admin/AppData/Local/Temp/server.js
  2⤵
  PID:2276
- - C:\Users\Admin\AppData\Local\Temp\ffprobe.exe
    C:\Users\Admin\AppData\Local\Temp\ffprobe.exe -show_entries "stream=index,bit_rate,max_bit_rate,codec_type,codec_name,start_time,start_pts,r_frame_rate,sample_rate,channels,channel_layout,time_base,has_b_frames,nb_frames,width,height,color_space,color_transfer,color_primaries,codec_tag_string : stream_tags=title,language,duration,bps,number_of_bytes : format=format_name,duration,bit_rate,max_bit_rate" -print_format json http://127.0.0.1:11470/samples/hevc.mkv
    3⤵
    PID:5032
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 1092
    3⤵
    - Program crash
    PID:2392
- C:\Users\Admin\AppData\Local\Temp\stremio-runtime.exe
  C:\Users\Admin\AppData\Local\Temp\stremio-runtime.exe C:/Users/Admin/AppData/Local/Temp/server.js
  2⤵
  PID:1296
- - C:\Users\Admin\AppData\Local\Temp\ffprobe.exe
    C:\Users\Admin\AppData\Local\Temp\ffprobe.exe -show_entries "stream=index,bit_rate,max_bit_rate,codec_type,codec_name,start_time,start_pts,r_frame_rate,sample_rate,channels,channel_layout,time_base,has_b_frames,nb_frames,width,height,color_space,color_transfer,color_primaries,codec_tag_string : stream_tags=title,language,duration,bps,number_of_bytes : format=format_name,duration,bit_rate,max_bit_rate" -print_format json http://127.0.0.1:11470/samples/hevc.mkv
    3⤵
    PID:3068
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1296 -s 1092
    3⤵
    - Program crash
    PID:3884
- C:\Users\Admin\AppData\Local\Temp\stremio-runtime.exe
  C:\Users\Admin\AppData\Local\Temp\stremio-runtime.exe C:/Users/Admin/AppData/Local/Temp/server.js
  2⤵
  PID:3992
- - C:\Users\Admin\AppData\Local\Temp\ffprobe.exe
    C:\Users\Admin\AppData\Local\Temp\ffprobe.exe -show_entries "stream=index,bit_rate,max_bit_rate,codec_type,codec_name,start_time,start_pts,r_frame_rate,sample_rate,channels,channel_layout,time_base,has_b_frames,nb_frames,width,height,color_space,color_transfer,color_primaries,codec_tag_string : stream_tags=title,language,duration,bps,number_of_bytes : format=format_name,duration,bit_rate,max_bit_rate" -print_format json http://127.0.0.1:11470/samples/hevc.mkv
    3⤵
    PID:3164
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3992 -s 1108
    3⤵
    - Program crash
    PID:1660
- C:\Users\Admin\AppData\Local\Temp\stremio-runtime.exe
  C:\Users\Admin\AppData\Local\Temp\stremio-runtime.exe C:/Users/Admin/AppData/Local/Temp/server.js
  2⤵
  PID:3968
- - C:\Users\Admin\AppData\Local\Temp\ffprobe.exe
    C:\Users\Admin\AppData\Local\Temp\ffprobe.exe -show_entries "stream=index,bit_rate,max_bit_rate,codec_type,codec_name,start_time,start_pts,r_frame_rate,sample_rate,channels,channel_layout,time_base,has_b_frames,nb_frames,width,height,color_space,color_transfer,color_primaries,codec_tag_string : stream_tags=title,language,duration,bps,number_of_bytes : format=format_name,duration,bit_rate,max_bit_rate" -print_format json http://127.0.0.1:11470/samples/hevc.mkv
    3⤵
    PID:2064
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3968 -s 1084
    3⤵
    - Program crash
    PID:2608
- C:\Users\Admin\AppData\Local\Temp\stremio-runtime.exe
  C:\Users\Admin\AppData\Local\Temp\stremio-runtime.exe C:/Users/Admin/AppData/Local/Temp/server.js
  2⤵
  PID:4808
- - C:\Users\Admin\AppData\Local\Temp\ffprobe.exe
    C:\Users\Admin\AppData\Local\Temp\ffprobe.exe -show_entries "stream=index,bit_rate,max_bit_rate,codec_type,codec_name,start_time,start_pts,r_frame_rate,sample_rate,channels,channel_layout,time_base,has_b_frames,nb_frames,width,height,color_space,color_transfer,color_primaries,codec_tag_string : stream_tags=title,language,duration,bps,number_of_bytes : format=format_name,duration,bit_rate,max_bit_rate" -print_format json http://127.0.0.1:11470/samples/hevc.mkv
    3⤵
    PID:5024
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4808 -s 1088
    3⤵
    - Program crash
    PID:656
- C:\Users\Admin\AppData\Local\Temp\stremio-runtime.exe
  C:\Users\Admin\AppData\Local\Temp\stremio-runtime.exe C:/Users/Admin/AppData/Local/Temp/server.js
  2⤵
  PID:4388
- - C:\Users\Admin\AppData\Local\Temp\ffprobe.exe
    C:\Users\Admin\AppData\Local\Temp\ffprobe.exe -show_entries "stream=index,bit_rate,max_bit_rate,codec_type,codec_name,start_time,start_pts,r_frame_rate,sample_rate,channels,channel_layout,time_base,has_b_frames,nb_frames,width,height,color_space,color_transfer,color_primaries,codec_tag_string : stream_tags=title,language,duration,bps,number_of_bytes : format=format_name,duration,bit_rate,max_bit_rate" -print_format json http://127.0.0.1:11470/samples/hevc.mkv
    3⤵
    PID:1420
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4388 -s 1084
    3⤵
    - Program crash
    PID:2128
- C:\Users\Admin\AppData\Local\Temp\stremio-runtime.exe
  C:\Users\Admin\AppData\Local\Temp\stremio-runtime.exe C:/Users/Admin/AppData/Local/Temp/server.js
  2⤵
  PID:1840
- - C:\Users\Admin\AppData\Local\Temp\ffprobe.exe
    C:\Users\Admin\AppData\Local\Temp\ffprobe.exe -show_entries "stream=index,bit_rate,max_bit_rate,codec_type,codec_name,start_time,start_pts,r_frame_rate,sample_rate,channels,channel_layout,time_base,has_b_frames,nb_frames,width,height,color_space,color_transfer,color_primaries,codec_tag_string : stream_tags=title,language,duration,bps,number_of_bytes : format=format_name,duration,bit_rate,max_bit_rate" -print_format json http://127.0.0.1:11470/samples/hevc.mkv
    3⤵
    PID:2364
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1840 -s 1084
    3⤵
    - Program crash
    PID:2380
- C:\Users\Admin\AppData\Local\Temp\stremio-runtime.exe
  C:\Users\Admin\AppData\Local\Temp\stremio-runtime.exe C:/Users/Admin/AppData/Local/Temp/server.js
  2⤵
  PID:2784
- - C:\Users\Admin\AppData\Local\Temp\ffprobe.exe
    C:\Users\Admin\AppData\Local\Temp\ffprobe.exe -show_entries "stream=index,bit_rate,max_bit_rate,codec_type,codec_name,start_time,start_pts,r_frame_rate,sample_rate,channels,channel_layout,time_base,has_b_frames,nb_frames,width,height,color_space,color_transfer,color_primaries,codec_tag_string : stream_tags=title,language,duration,bps,number_of_bytes : format=format_name,duration,bit_rate,max_bit_rate" -print_format json http://127.0.0.1:11470/samples/hevc.mkv
    3⤵
    PID:1616
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2784 -s 1096
    3⤵
    - Program crash
    PID:4112
- C:\Users\Admin\AppData\Local\Temp\stremio-runtime.exe
  C:\Users\Admin\AppData\Local\Temp\stremio-runtime.exe C:/Users/Admin/AppData/Local/Temp/server.js
  2⤵
  PID:1188
- - C:\Users\Admin\AppData\Local\Temp\ffprobe.exe
    C:\Users\Admin\AppData\Local\Temp\ffprobe.exe -show_entries "stream=index,bit_rate,max_bit_rate,codec_type,codec_name,start_time,start_pts,r_frame_rate,sample_rate,channels,channel_layout,time_base,has_b_frames,nb_frames,width,height,color_space,color_transfer,color_primaries,codec_tag_string : stream_tags=title,language,duration,bps,number_of_bytes : format=format_name,duration,bit_rate,max_bit_rate" -print_format json http://127.0.0.1:11470/samples/hevc.mkv
    3⤵
    PID:2564
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1188 -s 1092
    3⤵
    - Program crash
    PID:4300
- C:\Users\Admin\AppData\Local\Temp\stremio-runtime.exe
  C:\Users\Admin\AppData\Local\Temp\stremio-runtime.exe C:/Users/Admin/AppData/Local/Temp/server.js
  2⤵
  PID:4660
- - C:\Users\Admin\AppData\Local\Temp\ffprobe.exe
    C:\Users\Admin\AppData\Local\Temp\ffprobe.exe -show_entries "stream=index,bit_rate,max_bit_rate,codec_type,codec_name,start_time,start_pts,r_frame_rate,sample_rate,channels,channel_layout,time_base,has_b_frames,nb_frames,width,height,color_space,color_transfer,color_primaries,codec_tag_string : stream_tags=title,language,duration,bps,number_of_bytes : format=format_name,duration,bit_rate,max_bit_rate" -print_format json http://127.0.0.1:11470/samples/hevc.mkv
    3⤵
    PID:2460
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4660 -s 808
    3⤵
    - Program crash
    PID:2264
- C:\Users\Admin\AppData\Local\Temp\stremio-runtime.exe
  C:\Users\Admin\AppData\Local\Temp\stremio-runtime.exe C:/Users/Admin/AppData/Local/Temp/server.js
  2⤵
  PID:4444
- - C:\Users\Admin\AppData\Local\Temp\ffprobe.exe
    C:\Users\Admin\AppData\Local\Temp\ffprobe.exe -show_entries "stream=index,bit_rate,max_bit_rate,codec_type,codec_name,start_time,start_pts,r_frame_rate,sample_rate,channels,channel_layout,time_base,has_b_frames,nb_frames,width,height,color_space,color_transfer,color_primaries,codec_tag_string : stream_tags=title,language,duration,bps,number_of_bytes : format=format_name,duration,bit_rate,max_bit_rate" -print_format json http://127.0.0.1:11470/samples/hevc.mkv
    3⤵
    PID:5044
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 1084
    3⤵
    - Program crash
    PID:1084
- C:\Users\Admin\AppData\Local\Temp\stremio-runtime.exe
  C:\Users\Admin\AppData\Local\Temp\stremio-runtime.exe C:/Users/Admin/AppData/Local/Temp/server.js
  2⤵
  PID:976
- - C:\Users\Admin\AppData\Local\Temp\ffprobe.exe
    C:\Users\Admin\AppData\Local\Temp\ffprobe.exe -show_entries "stream=index,bit_rate,max_bit_rate,codec_type,codec_name,start_time,start_pts,r_frame_rate,sample_rate,channels,channel_layout,time_base,has_b_frames,nb_frames,width,height,color_space,color_transfer,color_primaries,codec_tag_string : stream_tags=title,language,duration,bps,number_of_bytes : format=format_name,duration,bit_rate,max_bit_rate" -print_format json http://127.0.0.1:11470/samples/hevc.mkv
    3⤵
    PID:3500
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 976 -s 1128
    3⤵
    - Program crash
    PID:516
- C:\Users\Admin\AppData\Local\Temp\stremio-runtime.exe
  C:\Users\Admin\AppData\Local\Temp\stremio-runtime.exe C:/Users/Admin/AppData/Local/Temp/server.js
  2⤵
  PID:1512
- - C:\Users\Admin\AppData\Local\Temp\ffprobe.exe
    C:\Users\Admin\AppData\Local\Temp\ffprobe.exe -show_entries "stream=index,bit_rate,max_bit_rate,codec_type,codec_name,start_time,start_pts,r_frame_rate,sample_rate,channels,channel_layout,time_base,has_b_frames,nb_frames,width,height,color_space,color_transfer,color_primaries,codec_tag_string : stream_tags=title,language,duration,bps,number_of_bytes : format=format_name,duration,bit_rate,max_bit_rate" -print_format json http://127.0.0.1:11470/samples/hevc.mkv
    3⤵
    PID:3504
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1512 -s 1088
    3⤵
    - Program crash
    PID:1576
- C:\Users\Admin\AppData\Local\Temp\stremio-runtime.exe
  C:\Users\Admin\AppData\Local\Temp\stremio-runtime.exe C:/Users/Admin/AppData/Local/Temp/server.js
  2⤵
  PID:1148
- - C:\Users\Admin\AppData\Local\Temp\ffprobe.exe
    C:\Users\Admin\AppData\Local\Temp\ffprobe.exe -show_entries "stream=index,bit_rate,max_bit_rate,codec_type,codec_name,start_time,start_pts,r_frame_rate,sample_rate,channels,channel_layout,time_base,has_b_frames,nb_frames,width,height,color_space,color_transfer,color_primaries,codec_tag_string : stream_tags=title,language,duration,bps,number_of_bytes : format=format_name,duration,bit_rate,max_bit_rate" -print_format json http://127.0.0.1:11470/samples/hevc.mkv
    3⤵
    PID:3236
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1148 -s 1092
    3⤵
    - Program crash
    PID:808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4484 -ip 4484
1⤵
PID:4836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3412 -ip 3412
1⤵
PID:3396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4504 -ip 4504
1⤵
PID:100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 2136 -ip 2136
1⤵
PID:2988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2896 -ip 2896
1⤵
PID:1616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4476 -ip 4476
1⤵
PID:4992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3136 -ip 3136
1⤵
PID:2804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 544 -ip 544
1⤵
PID:2320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3068 -ip 3068
1⤵
PID:4552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3164 -ip 3164
1⤵
PID:420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4628 -ip 4628
1⤵
PID:3556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3908 -ip 3908
1⤵
PID:4396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 456 -ip 456
1⤵
PID:232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2276 -ip 2276
1⤵
PID:4276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1296 -ip 1296
1⤵
PID:3484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 3992 -ip 3992
1⤵
PID:4736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3968 -ip 3968
1⤵
PID:836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4808 -ip 4808
1⤵
PID:3424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4388 -ip 4388
1⤵
PID:4560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1840 -ip 1840
1⤵
PID:3588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2784 -ip 2784
1⤵
PID:2276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1188 -ip 1188
1⤵
PID:2616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 4660 -ip 4660
1⤵
PID:1980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 4444 -ip 4444
1⤵
PID:4788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 976 -ip 976
1⤵
PID:3596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1512 -ip 1512
1⤵
PID:876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 1148 -ip 1148
1⤵
PID:2056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Smart Code ltd\Stremio\QtWebEngine\Default\Local Storage\leveldb\000001.dbtmp

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Smart Code ltd\Stremio\QtWebEngine\Default\Network Persistent State~RFe58e4cd.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Smart Code ltd\Stremio\QtWebEngine\Default\Service Worker\CacheStorage\88fcf258722d55f5951a2da9c15b52822bdffa79\8bc295b2-78c1-4e80-9d77-e24bc4709d3f\index-dir\temp-index

Filesize
72B

MD5
dfb11f52ba7a432847ec6707b075e825

SHA1
d0ddeee39c5f79b3d7b54e5310d8ca75f55b98bb

SHA256
a4c349cc92bca9ccb95d76e8860a6aafcb6d5998a2f00e6e9624aea8f9b3f906

SHA512
0ecf06ca882f0b27eea2bdec162c31742bab788cba33eca276b1d76fa5ac87eabaf2685e815563503a5388e76db8dbc5131d0302384df326b84064cdc4c6be30

Download Submit
C:\Users\Admin\AppData\Local\Smart Code ltd\Stremio\QtWebEngine\Default\Service Worker\CacheStorage\88fcf258722d55f5951a2da9c15b52822bdffa79\8bc295b2-78c1-4e80-9d77-e24bc4709d3f\index-dir\the-real-index~RFe5828e0.TMP

Filesize
48B

MD5
7896ae2c3cd188ee0b8121e3e0001423

SHA1
39fc0231f065d4f0a8fea5452f35dea241d21c90

SHA256
31cc5111b2f2aeeee328c247be90b3ee212971224c59e3020b87f3a291d2c155

SHA512
f44b146fc533c1bc6ef15550a1b4e4aeb27a6f29fac8294b3e374222e5c81c5e0d620be94d393e119d8c07bdd22f35ad575c0facc01bcccb56677a5c10a1ad5b

Download Submit
C:\Users\Admin\AppData\Local\Smart Code ltd\Stremio\QtWebEngine\Default\Service Worker\CacheStorage\88fcf258722d55f5951a2da9c15b52822bdffa79\index.txt

Filesize
106B

MD5
083b97c92b698ddd861716e9c682cab4

SHA1
e7d8c4543c5e23091ce5564ea2cb23f3cfc97035

SHA256
e82aca1b38439fc2a4e5ed51c3d150f60cd4f7d05d106d712aa6fc9a210ac513

SHA512
2d8b8a64966c7af1e0e350ef0203825bcb3fcd3ab154889071a444dc95f3c06a920ebb7d39a3d42dd25a586f2c8174b0e8f14398a99c2bb59e2d1ac9a1689c7c

Download Submit
C:\Users\Admin\AppData\Local\Smart Code ltd\Stremio\QtWebEngine\Default\Service Worker\CacheStorage\88fcf258722d55f5951a2da9c15b52822bdffa79\index.txt.tmp

Filesize
101B

MD5
1a73ca613c64c36174ddbb1ed46c5934

SHA1
6dabd5fbc6c4be33d8f8f3c545fcab52f71c0071

SHA256
b7ed9aa8f998a67fbe4531ecc7384c317050d9c0cf25f62657227e74fb5a9080

SHA512
9e5920a88dce53584594c9cf1d100ae249e0b3118c9fdb1976072d74f6adf8f5a1810cf0e03915b859881b2f10e5535c5a93413d92500a53359c211039a88be2

Download Submit
C:\Users\Admin\AppData\Local\Smart Code ltd\Stremio\QtWebEngine\Default\Service Worker\Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Smart Code ltd\Stremio\QtWebEngine\Default\Service Worker\ScriptCache\index-dir\temp-index

Filesize
72B

MD5
c1f23e90236001fe1495d5ecba533a6d

SHA1
f3edb1d1cccf5781735e6bc5e1a2dcdbabcd196f

SHA256
4a42f04f3a0ebf34bd942393c16b156048593d2cfd440377dc3c4cbe7a34e83c

SHA512
6e8c02559bd9c859958154b710ab65c8daa28f1cca0d8ebf8a4a2e59c863c7cdf59648455e7263b556e16d24c451b1e3f9ca5f8b7a5284fa642a95366a5aa90c

Download Submit
C:\Users\Admin\AppData\Local\Smart Code ltd\Stremio\QtWebEngine\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58240d.TMP

Filesize
48B

MD5
d2689d5c5ef1df2225dcc41817c0d928

SHA1
f3cb49e8760dd2c2406ce6cca081c73a3fca33e3

SHA256
c558c12411393b53f874e5c3879ef35a7ed4dbfafd895dd78cbe0699fb87c8b4

SHA512
643488e4e1202de965db08271a975a6de1b1843f7a68491920edc881b8266991c88bf99bf00c6ce2b50f15c209f3391a444fd17d2baae824347ad2e9b1b2b07d

Download Submit
C:\Users\Admin\AppData\Local\Smart Code ltd\Stremio\QtWebEngine\Default\e647af3c-58a7-400e-88d9-0360d6fe86d5.tmp

Filesize
328B

MD5
38581efbecfe3d00864bc4fb478a2ef2

SHA1
810a0cec01346b57e1f53581d975f56e15858f3e

SHA256
f7bc1c4f9ce0d5cfdc85590f34720a5cb4b2e4255916d55fdde0711a21de52b8

SHA512
f73ec1da0a65e68914d324d8c3edfe97b15863240f709ab6f9035ce955c50cc589d7987853d79d48cddd4a55bcad79e188338542ca83fde9d556a0cf7ca50883

Download Submit
memory/628-59-0x000000000B990000-0x000000000B991000-memory.dmp

Filesize
4KB

Download
memory/628-54-0x000000000B990000-0x000000000B991000-memory.dmp

Filesize
4KB

Download
memory/628-15-0x0000000005A50000-0x0000000005A51000-memory.dmp

Filesize
4KB

Download
memory/628-17-0x0000000008560000-0x0000000008561000-memory.dmp

Filesize
4KB

Download
memory/628-35-0x000000000B970000-0x000000000B971000-memory.dmp

Filesize
4KB

Download
memory/628-34-0x000000000B970000-0x000000000B971000-memory.dmp

Filesize
4KB

Download
memory/628-33-0x000000000B970000-0x000000000B971000-memory.dmp

Filesize
4KB

Download
memory/628-31-0x0000000008560000-0x0000000008561000-memory.dmp

Filesize
4KB

Download
memory/628-30-0x0000000008560000-0x0000000008561000-memory.dmp

Filesize
4KB

Download
memory/628-29-0x0000000008560000-0x0000000008561000-memory.dmp

Filesize
4KB

Download
memory/628-28-0x0000000008560000-0x0000000008561000-memory.dmp

Filesize
4KB

Download
memory/628-27-0x0000000008560000-0x0000000008561000-memory.dmp

Filesize
4KB

Download
memory/628-26-0x0000000008560000-0x0000000008561000-memory.dmp

Filesize
4KB

Download
memory/628-25-0x0000000008560000-0x0000000008561000-memory.dmp

Filesize
4KB

Download
memory/628-62-0x000000000B990000-0x000000000B991000-memory.dmp

Filesize
4KB

Download
memory/628-68-0x000000000B9A0000-0x000000000B9A1000-memory.dmp

Filesize
4KB

Download
memory/628-67-0x000000000B9A0000-0x000000000B9A1000-memory.dmp

Filesize
4KB

Download
memory/628-69-0x000000000B9A0000-0x000000000B9A1000-memory.dmp

Filesize
4KB

Download
memory/628-70-0x000000000B9A0000-0x000000000B9A1000-memory.dmp

Filesize
4KB

Download
memory/628-66-0x000000000B9A0000-0x000000000B9A1000-memory.dmp

Filesize
4KB

Download
memory/628-65-0x000000000B9A0000-0x000000000B9A1000-memory.dmp

Filesize
4KB

Download
memory/628-63-0x000000000B990000-0x000000000B991000-memory.dmp

Filesize
4KB

Download
memory/628-61-0x000000000B990000-0x000000000B991000-memory.dmp

Filesize
4KB

Download
memory/628-60-0x000000000B990000-0x000000000B991000-memory.dmp

Filesize
4KB

Download
memory/628-13-0x0000000005A50000-0x0000000005A51000-memory.dmp

Filesize
4KB

Download
memory/628-58-0x000000000B990000-0x000000000B991000-memory.dmp

Filesize
4KB

Download
memory/628-57-0x000000000B970000-0x000000000B971000-memory.dmp

Filesize
4KB

Download
memory/628-56-0x000000000B990000-0x000000000B991000-memory.dmp

Filesize
4KB

Download
memory/628-55-0x000000000B970000-0x000000000B971000-memory.dmp

Filesize
4KB

Download
memory/628-14-0x0000000005A50000-0x0000000005A51000-memory.dmp

Filesize
4KB

Download
memory/628-53-0x000000000B970000-0x000000000B971000-memory.dmp

Filesize
4KB

Download
memory/628-52-0x000000000B990000-0x000000000B991000-memory.dmp

Filesize
4KB

Download
memory/628-50-0x000000000B970000-0x000000000B971000-memory.dmp

Filesize
4KB

Download
memory/628-49-0x000000000B970000-0x000000000B971000-memory.dmp

Filesize
4KB

Download
memory/628-48-0x000000000B970000-0x000000000B971000-memory.dmp

Filesize
4KB

Download
memory/628-47-0x000000000B970000-0x000000000B971000-memory.dmp

Filesize
4KB

Download
memory/628-46-0x000000000B970000-0x000000000B971000-memory.dmp

Filesize
4KB

Download
memory/628-45-0x000000000B970000-0x000000000B971000-memory.dmp

Filesize
4KB

Download
memory/628-44-0x000000000B970000-0x000000000B971000-memory.dmp

Filesize
4KB

Download
memory/628-43-0x000000000B970000-0x000000000B971000-memory.dmp

Filesize
4KB

Download
memory/628-42-0x000000000B970000-0x000000000B971000-memory.dmp

Filesize
4KB

Download
memory/628-41-0x000000000B970000-0x000000000B971000-memory.dmp

Filesize
4KB

Download
memory/628-40-0x000000000B970000-0x000000000B971000-memory.dmp

Filesize
4KB

Download
memory/628-39-0x000000000B970000-0x000000000B971000-memory.dmp

Filesize
4KB

Download
memory/628-38-0x000000000B970000-0x000000000B971000-memory.dmp

Filesize
4KB

Download
memory/628-37-0x000000000B970000-0x000000000B971000-memory.dmp

Filesize
4KB

Download
memory/628-36-0x0000000008560000-0x0000000008561000-memory.dmp

Filesize
4KB

Download
memory/628-24-0x0000000008560000-0x0000000008561000-memory.dmp

Filesize
4KB

Download
memory/628-23-0x0000000008560000-0x0000000008561000-memory.dmp

Filesize
4KB

Download
memory/628-12-0x0000000005A50000-0x0000000005A51000-memory.dmp

Filesize
4KB

Download
memory/628-11-0x0000000005A50000-0x0000000005A51000-memory.dmp

Filesize
4KB

Download
memory/628-3-0x0000000004850000-0x0000000004A50000-memory.dmp

Filesize
2.0MB

Download
memory/628-1-0x0000000004410000-0x0000000004850000-memory.dmp

Filesize
4.2MB

Download
memory/628-0-0x0000000002CC0000-0x0000000002CD0000-memory.dmp

Filesize
64KB

Download
memory/628-22-0x0000000008560000-0x0000000008561000-memory.dmp

Filesize
4KB

Download
memory/628-21-0x0000000008560000-0x0000000008561000-memory.dmp

Filesize
4KB

Download
memory/628-20-0x0000000008560000-0x0000000008561000-memory.dmp

Filesize
4KB

Download
memory/628-19-0x0000000008560000-0x0000000008561000-memory.dmp

Filesize
4KB

Download
memory/628-18-0x0000000008560000-0x0000000008561000-memory.dmp

Filesize
4KB

Download