44ecc6a7624b2fdf03cb9b419f111892515fb036fe23f88e51456dce69066046

Analysis

max time kernel
143s
max time network
155s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
12/10/2024, 16:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Stremio+4.4.168.exe
Size

112.9MB
MD5

763b10b7a9293ccc9307b650a01db702
SHA1

b033764307a4df6cc81c654467630f2df67297ef
SHA256

44ecc6a7624b2fdf03cb9b419f111892515fb036fe23f88e51456dce69066046
SHA512

f6f8d0a78cfaa2c440567fc0e636ab6129c495991f679c93ae0b7e211d9e290e7d4628891fef35f0383662bc2237e21410dd849f1d6074a8994dfd8deeee5e0c
SSDEEP

3145728:XddpqKUfzM8/I/6Uj2jDxXz8sGd1TiDlSugSbc+cYOsNCO1JTN:tdoK18wiucDZxG7TOlS/SI+JNCO19N

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 14 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Control Panel\International\Geo\Nation	QtWebEngineProcess.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Control Panel\International\Geo\Nation	stremio-runtime.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Control Panel\International\Geo\Nation	stremio-runtime.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Control Panel\International\Geo\Nation	stremio-runtime.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Control Panel\International\Geo\Nation	stremio-runtime.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Control Panel\International\Geo\Nation	stremio-runtime.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Control Panel\International\Geo\Nation	stremio-runtime.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Control Panel\International\Geo\Nation	stremio-runtime.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Control Panel\International\Geo\Nation	stremio-runtime.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Control Panel\International\Geo\Nation	stremio-runtime.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Control Panel\International\Geo\Nation	stremio-runtime.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Control Panel\International\Geo\Nation	stremio-runtime.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Control Panel\International\Geo\Nation	stremio-runtime.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Control Panel\International\Geo\Nation	stremio-runtime.exe

Executes dropped EXE 29 IoCs

pid	Process
2296	stremio.exe
3452	stremio-runtime.exe
2508	QtWebEngineProcess.exe
3972	QtWebEngineProcess.exe
1320	ffprobe.exe
3836	stremio-runtime.exe
4132	ffprobe.exe
2068	stremio-runtime.exe
356	ffprobe.exe
2216	stremio-runtime.exe
4348	ffprobe.exe
412	stremio-runtime.exe
2952	ffprobe.exe
1088	stremio-runtime.exe
3432	ffprobe.exe
4936	stremio-runtime.exe
4412	ffprobe.exe
3340	stremio-runtime.exe
4396	ffprobe.exe
2832	stremio-runtime.exe
1148	ffprobe.exe
3440	stremio-runtime.exe
4224	ffprobe.exe
2724	stremio-runtime.exe
4476	ffprobe.exe
4464	stremio-runtime.exe
1780	ffprobe.exe
2648	stremio-runtime.exe
2836	ffprobe.exe

Loads dropped DLL 64 IoCs

pid	Process
3984	Stremio+4.4.168.exe
3984	Stremio+4.4.168.exe
3984	Stremio+4.4.168.exe
3984	Stremio+4.4.168.exe
3984	Stremio+4.4.168.exe
3984	Stremio+4.4.168.exe
3984	Stremio+4.4.168.exe
3984	Stremio+4.4.168.exe
3984	Stremio+4.4.168.exe
3984	Stremio+4.4.168.exe
3984	Stremio+4.4.168.exe
3984	Stremio+4.4.168.exe
3984	Stremio+4.4.168.exe
3984	Stremio+4.4.168.exe
3984	Stremio+4.4.168.exe
3984	Stremio+4.4.168.exe
3984	Stremio+4.4.168.exe
3984	Stremio+4.4.168.exe
3984	Stremio+4.4.168.exe
3984	Stremio+4.4.168.exe
3984	Stremio+4.4.168.exe
3984	Stremio+4.4.168.exe
3984	Stremio+4.4.168.exe
3984	Stremio+4.4.168.exe
3984	Stremio+4.4.168.exe
3984	Stremio+4.4.168.exe
3984	Stremio+4.4.168.exe
3984	Stremio+4.4.168.exe
3984	Stremio+4.4.168.exe
3984	Stremio+4.4.168.exe
3984	Stremio+4.4.168.exe
3984	Stremio+4.4.168.exe
3984	Stremio+4.4.168.exe
3984	Stremio+4.4.168.exe
3984	Stremio+4.4.168.exe
3984	Stremio+4.4.168.exe
3984	Stremio+4.4.168.exe
3984	Stremio+4.4.168.exe
3984	Stremio+4.4.168.exe
3984	Stremio+4.4.168.exe
3984	Stremio+4.4.168.exe
3984	Stremio+4.4.168.exe
3984	Stremio+4.4.168.exe
3984	Stremio+4.4.168.exe
3984	Stremio+4.4.168.exe
3984	Stremio+4.4.168.exe
3984	Stremio+4.4.168.exe
3984	Stremio+4.4.168.exe
3984	Stremio+4.4.168.exe
3984	Stremio+4.4.168.exe
3984	Stremio+4.4.168.exe
3984	Stremio+4.4.168.exe
3984	Stremio+4.4.168.exe
3984	Stremio+4.4.168.exe
3984	Stremio+4.4.168.exe
3984	Stremio+4.4.168.exe
3984	Stremio+4.4.168.exe
3984	Stremio+4.4.168.exe
3984	Stremio+4.4.168.exe
3984	Stremio+4.4.168.exe
3984	Stremio+4.4.168.exe
3984	Stremio+4.4.168.exe
3984	Stremio+4.4.168.exe
3984	Stremio+4.4.168.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 13 IoCs

pid	pid_target	Process	procid_target
2196	3452	WerFault.exe	76
3432	3836	WerFault.exe	84
4608	2068	WerFault.exe	88
2832	2216	WerFault.exe	92
4224	412	WerFault.exe	96
3836	1088	WerFault.exe	100
2108	4936	WerFault.exe	104
512	3340	WerFault.exe	108
500	2832	WerFault.exe	112
4624	3440	WerFault.exe	116
3900	2724	WerFault.exe	120
3576	4464	WerFault.exe	124
2916	2648	WerFault.exe	128

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QtWebEngineProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stremio-runtime.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stremio-runtime.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stremio-runtime.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stremio-runtime.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stremio-runtime.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QtWebEngineProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stremio-runtime.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stremio-runtime.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stremio-runtime.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Stremio+4.4.168.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stremio-runtime.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stremio-runtime.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stremio-runtime.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stremio-runtime.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stremio-runtime.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stremio.exe

Modifies registry class 27 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\magnet\shell\open\command	Stremio+4.4.168.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\magnet\shell\open	Stremio+4.4.168.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\stremio\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Programs\\LNV\\Stremio-4\\stremio.exe,1"	Stremio+4.4.168.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\magnet\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Programs\\LNV\\Stremio-4\\stremio.exe,1"	Stremio+4.4.168.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\stremio\shell\open\ = "Play with Stremio"	Stremio+4.4.168.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\stremio\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Programs\\LNV\\Stremio-4\\stremio.exe \"%1\""	Stremio+4.4.168.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\stremio	Stremio+4.4.168.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\stremio\shell\open	Stremio+4.4.168.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\magnet\ = "URL:BitTorrent magnet"	Stremio+4.4.168.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\stremio\ = "BitTorrent file"	Stremio+4.4.168.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\stremio\ = "URL:Stremio Protocol"	Stremio+4.4.168.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\magnet\shell\ = "open"	Stremio+4.4.168.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\.torrent\stremio_backup	Stremio+4.4.168.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\.torrent	Stremio+4.4.168.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\stremio\shell	Stremio+4.4.168.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\stremio\shell\open\command	Stremio+4.4.168.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\magnet	Stremio+4.4.168.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\magnet\shell	Stremio+4.4.168.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\stremio\shell\ = "open"	Stremio+4.4.168.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\magnet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\LNV\\Stremio-4\\stremio.exe\" \"%1\""	Stremio+4.4.168.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\stremio\URL Protocol	Stremio+4.4.168.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\stremio\DefaultIcon	Stremio+4.4.168.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\magnet\DefaultIcon	Stremio+4.4.168.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\stremio\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\LNV\\Stremio-4\\stremio.exe\" \"%1\""	Stremio+4.4.168.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\magnet\URL Protocol	Stremio+4.4.168.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\.torrent\ = "stremio"	Stremio+4.4.168.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\stremio\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Programs\\LNV\\Stremio-4\\stremio.exe,0"	Stremio+4.4.168.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2296	stremio.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
3984	Stremio+4.4.168.exe
3984	Stremio+4.4.168.exe
3984	Stremio+4.4.168.exe
3984	Stremio+4.4.168.exe
2508	QtWebEngineProcess.exe
3972	QtWebEngineProcess.exe
3972	QtWebEngineProcess.exe
2296	stremio.exe
2296	stremio.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
2296	stremio.exe
2296	stremio.exe
2296	stremio.exe
2296	stremio.exe
2296	stremio.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
2296	stremio.exe
2296	stremio.exe
2296	stremio.exe
2296	stremio.exe
2296	stremio.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2296	stremio.exe
2296	stremio.exe
2296	stremio.exe
2296	stremio.exe
2296	stremio.exe
2296	stremio.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3984 wrote to memory of 2296	3984	Stremio+4.4.168.exe	74
PID 3984 wrote to memory of 2296	3984	Stremio+4.4.168.exe	74
PID 3984 wrote to memory of 2296	3984	Stremio+4.4.168.exe	74
PID 2296 wrote to memory of 3452	2296	stremio.exe	76
PID 2296 wrote to memory of 3452	2296	stremio.exe	76
PID 2296 wrote to memory of 3452	2296	stremio.exe	76
PID 2296 wrote to memory of 2508	2296	stremio.exe	77
PID 2296 wrote to memory of 2508	2296	stremio.exe	77
PID 2296 wrote to memory of 2508	2296	stremio.exe	77
PID 2296 wrote to memory of 2508	2296	stremio.exe	77
PID 2296 wrote to memory of 2508	2296	stremio.exe	77
PID 2296 wrote to memory of 2508	2296	stremio.exe	77
PID 2296 wrote to memory of 2508	2296	stremio.exe	77
PID 2296 wrote to memory of 2508	2296	stremio.exe	77
PID 2296 wrote to memory of 2508	2296	stremio.exe	77
PID 2296 wrote to memory of 2508	2296	stremio.exe	77
PID 2296 wrote to memory of 2508	2296	stremio.exe	77
PID 2296 wrote to memory of 2508	2296	stremio.exe	77
PID 2296 wrote to memory of 2508	2296	stremio.exe	77
PID 2296 wrote to memory of 2508	2296	stremio.exe	77
PID 2296 wrote to memory of 2508	2296	stremio.exe	77
PID 2296 wrote to memory of 2508	2296	stremio.exe	77
PID 2296 wrote to memory of 2508	2296	stremio.exe	77
PID 2296 wrote to memory of 2508	2296	stremio.exe	77
PID 2296 wrote to memory of 2508	2296	stremio.exe	77
PID 2296 wrote to memory of 2508	2296	stremio.exe	77
PID 2296 wrote to memory of 2508	2296	stremio.exe	77
PID 2296 wrote to memory of 2508	2296	stremio.exe	77
PID 2296 wrote to memory of 2508	2296	stremio.exe	77
PID 2296 wrote to memory of 2508	2296	stremio.exe	77
PID 2296 wrote to memory of 2508	2296	stremio.exe	77
PID 2296 wrote to memory of 2508	2296	stremio.exe	77
PID 2296 wrote to memory of 2508	2296	stremio.exe	77
PID 2296 wrote to memory of 2508	2296	stremio.exe	77
PID 2296 wrote to memory of 2508	2296	stremio.exe	77
PID 2296 wrote to memory of 2508	2296	stremio.exe	77
PID 2296 wrote to memory of 2508	2296	stremio.exe	77
PID 2296 wrote to memory of 2508	2296	stremio.exe	77
PID 2296 wrote to memory of 2508	2296	stremio.exe	77
PID 2296 wrote to memory of 2508	2296	stremio.exe	77
PID 2296 wrote to memory of 2508	2296	stremio.exe	77
PID 2296 wrote to memory of 2508	2296	stremio.exe	77
PID 2296 wrote to memory of 2508	2296	stremio.exe	77
PID 2296 wrote to memory of 2508	2296	stremio.exe	77
PID 2296 wrote to memory of 2508	2296	stremio.exe	77
PID 2296 wrote to memory of 2508	2296	stremio.exe	77
PID 2296 wrote to memory of 2508	2296	stremio.exe	77
PID 2296 wrote to memory of 2508	2296	stremio.exe	77
PID 2296 wrote to memory of 2508	2296	stremio.exe	77
PID 2296 wrote to memory of 3972	2296	stremio.exe	79
PID 2296 wrote to memory of 3972	2296	stremio.exe	79
PID 2296 wrote to memory of 3972	2296	stremio.exe	79
PID 3452 wrote to memory of 1320	3452	stremio-runtime.exe	80
PID 3452 wrote to memory of 1320	3452	stremio-runtime.exe	80
PID 2296 wrote to memory of 3836	2296	stremio.exe	84
PID 2296 wrote to memory of 3836	2296	stremio.exe	84
PID 2296 wrote to memory of 3836	2296	stremio.exe	84
PID 3836 wrote to memory of 4132	3836	stremio-runtime.exe	86
PID 3836 wrote to memory of 4132	3836	stremio-runtime.exe	86
PID 2296 wrote to memory of 2068	2296	stremio.exe	88
PID 2296 wrote to memory of 2068	2296	stremio.exe	88
PID 2296 wrote to memory of 2068	2296	stremio.exe	88
PID 2068 wrote to memory of 356	2068	stremio-runtime.exe	90
PID 2068 wrote to memory of 356	2068	stremio-runtime.exe	90

C:\Users\Admin\AppData\Local\Temp\Stremio+4.4.168.exe
"C:\Users\Admin\AppData\Local\Temp\Stremio+4.4.168.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3984
- C:\Users\Admin\AppData\Local\Programs\LNV\Stremio-4\stremio.exe
  "C:\Users\Admin\AppData\Local\Programs\LNV\Stremio-4\stremio.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2296
- - C:\Users\Admin\AppData\Local\Programs\LNV\Stremio-4\stremio-runtime.exe
    C:\Users\Admin\AppData\Local\Programs\LNV\Stremio-4\stremio-runtime.exe C:/Users/Admin/AppData/Local/Programs/LNV/Stremio-4/server.js
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3452
  - - C:\Users\Admin\AppData\Local\Programs\LNV\Stremio-4\ffprobe.exe
      C:\Users\Admin\AppData\Local\Programs\LNV\Stremio-4\ffprobe.exe -show_entries "stream=index,bit_rate,max_bit_rate,codec_type,codec_name,start_time,start_pts,r_frame_rate,sample_rate,channels,channel_layout,time_base,has_b_frames,nb_frames,width,height,color_space,color_transfer,color_primaries,codec_tag_string : stream_tags=title,language,duration,bps,number_of_bytes : format=format_name,duration,bit_rate,max_bit_rate" -print_format json http://127.0.0.1:11470/samples/hevc.mkv
      4⤵
      Executes dropped EXE
      PID:1320
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3452 -s 1004
      4⤵
      Program crash
      PID:2196
- - C:\Users\Admin\AppData\Local\Programs\LNV\Stremio-4\QtWebEngineProcess.exe
    "C:\Users\Admin\AppData\Local\Programs\LNV\Stremio-4\QtWebEngineProcess.exe" --type=renderer --autoplay-policy=no-user-gesture-required --disable-speech-api --enable-threaded-compositing --enable-features=AllowContentInitiatedDataUrlNavigations,TracingServiceInProcess --disable-features=BackgroundFetch,ConsolidatedMovementXY,DnsOverHttpsUpgrade,FormControlsRefresh,MojoVideoCapture,PictureInPicture,SmsReceiver,UseSkiaRenderer,WebPayments,WebUSB --disable-gpu-compositing --lang=en-US --webengine-schemes=qrc:sLV --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=2 --mojo-platform-channel-handle=2976 /prefetch:1
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2508
- - C:\Users\Admin\AppData\Local\Programs\LNV\Stremio-4\QtWebEngineProcess.exe
    "C:\Users\Admin\AppData\Local\Programs\LNV\Stremio-4\QtWebEngineProcess.exe" --type=utility --enable-features=AllowContentInitiatedDataUrlNavigations,TracingServiceInProcess --disable-features=BackgroundFetch,ConsolidatedMovementXY,DnsOverHttpsUpgrade,FormControlsRefresh,MojoVideoCapture,PictureInPicture,SmsReceiver,UseSkiaRenderer,WebPayments,WebUSB --lang=en-US --service-sandbox-type=network --application-name=Stremio --webengine-schemes=qrc:sLV --mojo-platform-channel-handle=3040 /prefetch:8
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3972
- - C:\Users\Admin\AppData\Local\Programs\LNV\Stremio-4\stremio-runtime.exe
    C:\Users\Admin\AppData\Local\Programs\LNV\Stremio-4\stremio-runtime.exe C:/Users/Admin/AppData/Local/Programs/LNV/Stremio-4/server.js
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3836
  - - C:\Users\Admin\AppData\Local\Programs\LNV\Stremio-4\ffprobe.exe
      C:\Users\Admin\AppData\Local\Programs\LNV\Stremio-4\ffprobe.exe -show_entries "stream=index,bit_rate,max_bit_rate,codec_type,codec_name,start_time,start_pts,r_frame_rate,sample_rate,channels,channel_layout,time_base,has_b_frames,nb_frames,width,height,color_space,color_transfer,color_primaries,codec_tag_string : stream_tags=title,language,duration,bps,number_of_bytes : format=format_name,duration,bit_rate,max_bit_rate" -print_format json http://127.0.0.1:11470/samples/hevc.mkv
      4⤵
      Executes dropped EXE
      PID:4132
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3836 -s 988
      4⤵
      Program crash
      PID:3432
- - C:\Users\Admin\AppData\Local\Programs\LNV\Stremio-4\stremio-runtime.exe
    C:\Users\Admin\AppData\Local\Programs\LNV\Stremio-4\stremio-runtime.exe C:/Users/Admin/AppData/Local/Programs/LNV/Stremio-4/server.js
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2068
  - - C:\Users\Admin\AppData\Local\Programs\LNV\Stremio-4\ffprobe.exe
      C:\Users\Admin\AppData\Local\Programs\LNV\Stremio-4\ffprobe.exe -show_entries "stream=index,bit_rate,max_bit_rate,codec_type,codec_name,start_time,start_pts,r_frame_rate,sample_rate,channels,channel_layout,time_base,has_b_frames,nb_frames,width,height,color_space,color_transfer,color_primaries,codec_tag_string : stream_tags=title,language,duration,bps,number_of_bytes : format=format_name,duration,bit_rate,max_bit_rate" -print_format json http://127.0.0.1:11470/samples/hevc.mkv
      4⤵
      Executes dropped EXE
      PID:356
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2068 -s 1064
      4⤵
      Program crash
      PID:4608
- - C:\Users\Admin\AppData\Local\Programs\LNV\Stremio-4\stremio-runtime.exe
    C:\Users\Admin\AppData\Local\Programs\LNV\Stremio-4\stremio-runtime.exe C:/Users/Admin/AppData/Local/Programs/LNV/Stremio-4/server.js
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2216
  - - C:\Users\Admin\AppData\Local\Programs\LNV\Stremio-4\ffprobe.exe
      C:\Users\Admin\AppData\Local\Programs\LNV\Stremio-4\ffprobe.exe -show_entries "stream=index,bit_rate,max_bit_rate,codec_type,codec_name,start_time,start_pts,r_frame_rate,sample_rate,channels,channel_layout,time_base,has_b_frames,nb_frames,width,height,color_space,color_transfer,color_primaries,codec_tag_string : stream_tags=title,language,duration,bps,number_of_bytes : format=format_name,duration,bit_rate,max_bit_rate" -print_format json http://127.0.0.1:11470/samples/hevc.mkv
      4⤵
      Executes dropped EXE
      PID:4348
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2216 -s 1000
      4⤵
      Program crash
      PID:2832
- - C:\Users\Admin\AppData\Local\Programs\LNV\Stremio-4\stremio-runtime.exe
    C:\Users\Admin\AppData\Local\Programs\LNV\Stremio-4\stremio-runtime.exe C:/Users/Admin/AppData/Local/Programs/LNV/Stremio-4/server.js
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:412
  - - C:\Users\Admin\AppData\Local\Programs\LNV\Stremio-4\ffprobe.exe
      C:\Users\Admin\AppData\Local\Programs\LNV\Stremio-4\ffprobe.exe -show_entries "stream=index,bit_rate,max_bit_rate,codec_type,codec_name,start_time,start_pts,r_frame_rate,sample_rate,channels,channel_layout,time_base,has_b_frames,nb_frames,width,height,color_space,color_transfer,color_primaries,codec_tag_string : stream_tags=title,language,duration,bps,number_of_bytes : format=format_name,duration,bit_rate,max_bit_rate" -print_format json http://127.0.0.1:11470/samples/hevc.mkv
      4⤵
      Executes dropped EXE
      PID:2952
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 412 -s 1012
      4⤵
      Program crash
      PID:4224
- - C:\Users\Admin\AppData\Local\Programs\LNV\Stremio-4\stremio-runtime.exe
    C:\Users\Admin\AppData\Local\Programs\LNV\Stremio-4\stremio-runtime.exe C:/Users/Admin/AppData/Local/Programs/LNV/Stremio-4/server.js
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1088
  - - C:\Users\Admin\AppData\Local\Programs\LNV\Stremio-4\ffprobe.exe
      C:\Users\Admin\AppData\Local\Programs\LNV\Stremio-4\ffprobe.exe -show_entries "stream=index,bit_rate,max_bit_rate,codec_type,codec_name,start_time,start_pts,r_frame_rate,sample_rate,channels,channel_layout,time_base,has_b_frames,nb_frames,width,height,color_space,color_transfer,color_primaries,codec_tag_string : stream_tags=title,language,duration,bps,number_of_bytes : format=format_name,duration,bit_rate,max_bit_rate" -print_format json http://127.0.0.1:11470/samples/hevc.mkv
      4⤵
      Executes dropped EXE
      PID:3432
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 1000
      4⤵
      Program crash
      PID:3836
- - C:\Users\Admin\AppData\Local\Programs\LNV\Stremio-4\stremio-runtime.exe
    C:\Users\Admin\AppData\Local\Programs\LNV\Stremio-4\stremio-runtime.exe C:/Users/Admin/AppData/Local/Programs/LNV/Stremio-4/server.js
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4936
  - - C:\Users\Admin\AppData\Local\Programs\LNV\Stremio-4\ffprobe.exe
      C:\Users\Admin\AppData\Local\Programs\LNV\Stremio-4\ffprobe.exe -show_entries "stream=index,bit_rate,max_bit_rate,codec_type,codec_name,start_time,start_pts,r_frame_rate,sample_rate,channels,channel_layout,time_base,has_b_frames,nb_frames,width,height,color_space,color_transfer,color_primaries,codec_tag_string : stream_tags=title,language,duration,bps,number_of_bytes : format=format_name,duration,bit_rate,max_bit_rate" -print_format json http://127.0.0.1:11470/samples/hevc.mkv
      4⤵
      Executes dropped EXE
      PID:4412
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4936 -s 1008
      4⤵
      Program crash
      PID:2108
- - C:\Users\Admin\AppData\Local\Programs\LNV\Stremio-4\stremio-runtime.exe
    C:\Users\Admin\AppData\Local\Programs\LNV\Stremio-4\stremio-runtime.exe C:/Users/Admin/AppData/Local/Programs/LNV/Stremio-4/server.js
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3340
  - - C:\Users\Admin\AppData\Local\Programs\LNV\Stremio-4\ffprobe.exe
      C:\Users\Admin\AppData\Local\Programs\LNV\Stremio-4\ffprobe.exe -show_entries "stream=index,bit_rate,max_bit_rate,codec_type,codec_name,start_time,start_pts,r_frame_rate,sample_rate,channels,channel_layout,time_base,has_b_frames,nb_frames,width,height,color_space,color_transfer,color_primaries,codec_tag_string : stream_tags=title,language,duration,bps,number_of_bytes : format=format_name,duration,bit_rate,max_bit_rate" -print_format json http://127.0.0.1:11470/samples/hevc.mkv
      4⤵
      Executes dropped EXE
      PID:4396
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3340 -s 992
      4⤵
      Program crash
      PID:512
- - C:\Users\Admin\AppData\Local\Programs\LNV\Stremio-4\stremio-runtime.exe
    C:\Users\Admin\AppData\Local\Programs\LNV\Stremio-4\stremio-runtime.exe C:/Users/Admin/AppData/Local/Programs/LNV/Stremio-4/server.js
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2832
  - - C:\Users\Admin\AppData\Local\Programs\LNV\Stremio-4\ffprobe.exe
      C:\Users\Admin\AppData\Local\Programs\LNV\Stremio-4\ffprobe.exe -show_entries "stream=index,bit_rate,max_bit_rate,codec_type,codec_name,start_time,start_pts,r_frame_rate,sample_rate,channels,channel_layout,time_base,has_b_frames,nb_frames,width,height,color_space,color_transfer,color_primaries,codec_tag_string : stream_tags=title,language,duration,bps,number_of_bytes : format=format_name,duration,bit_rate,max_bit_rate" -print_format json http://127.0.0.1:11470/samples/hevc.mkv
      4⤵
      Executes dropped EXE
      PID:1148
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2832 -s 1068
      4⤵
      Program crash
      PID:500
- - C:\Users\Admin\AppData\Local\Programs\LNV\Stremio-4\stremio-runtime.exe
    C:\Users\Admin\AppData\Local\Programs\LNV\Stremio-4\stremio-runtime.exe C:/Users/Admin/AppData/Local/Programs/LNV/Stremio-4/server.js
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3440
  - - C:\Users\Admin\AppData\Local\Programs\LNV\Stremio-4\ffprobe.exe
      C:\Users\Admin\AppData\Local\Programs\LNV\Stremio-4\ffprobe.exe -show_entries "stream=index,bit_rate,max_bit_rate,codec_type,codec_name,start_time,start_pts,r_frame_rate,sample_rate,channels,channel_layout,time_base,has_b_frames,nb_frames,width,height,color_space,color_transfer,color_primaries,codec_tag_string : stream_tags=title,language,duration,bps,number_of_bytes : format=format_name,duration,bit_rate,max_bit_rate" -print_format json http://127.0.0.1:11470/samples/hevc.mkv
      4⤵
      Executes dropped EXE
      PID:4224
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3440 -s 996
      4⤵
      Program crash
      PID:4624
- - C:\Users\Admin\AppData\Local\Programs\LNV\Stremio-4\stremio-runtime.exe
    C:\Users\Admin\AppData\Local\Programs\LNV\Stremio-4\stremio-runtime.exe C:/Users/Admin/AppData/Local/Programs/LNV/Stremio-4/server.js
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2724
  - - C:\Users\Admin\AppData\Local\Programs\LNV\Stremio-4\ffprobe.exe
      C:\Users\Admin\AppData\Local\Programs\LNV\Stremio-4\ffprobe.exe -show_entries "stream=index,bit_rate,max_bit_rate,codec_type,codec_name,start_time,start_pts,r_frame_rate,sample_rate,channels,channel_layout,time_base,has_b_frames,nb_frames,width,height,color_space,color_transfer,color_primaries,codec_tag_string : stream_tags=title,language,duration,bps,number_of_bytes : format=format_name,duration,bit_rate,max_bit_rate" -print_format json http://127.0.0.1:11470/samples/hevc.mkv
      4⤵
      Executes dropped EXE
      PID:4476
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2724 -s 1000
      4⤵
      Program crash
      PID:3900
- - C:\Users\Admin\AppData\Local\Programs\LNV\Stremio-4\stremio-runtime.exe
    C:\Users\Admin\AppData\Local\Programs\LNV\Stremio-4\stremio-runtime.exe C:/Users/Admin/AppData/Local/Programs/LNV/Stremio-4/server.js
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4464
  - - C:\Users\Admin\AppData\Local\Programs\LNV\Stremio-4\ffprobe.exe
      C:\Users\Admin\AppData\Local\Programs\LNV\Stremio-4\ffprobe.exe -show_entries "stream=index,bit_rate,max_bit_rate,codec_type,codec_name,start_time,start_pts,r_frame_rate,sample_rate,channels,channel_layout,time_base,has_b_frames,nb_frames,width,height,color_space,color_transfer,color_primaries,codec_tag_string : stream_tags=title,language,duration,bps,number_of_bytes : format=format_name,duration,bit_rate,max_bit_rate" -print_format json http://127.0.0.1:11470/samples/hevc.mkv
      4⤵
      Executes dropped EXE
      PID:1780
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4464 -s 1012
      4⤵
      Program crash
      PID:3576
- - C:\Users\Admin\AppData\Local\Programs\LNV\Stremio-4\stremio-runtime.exe
    C:\Users\Admin\AppData\Local\Programs\LNV\Stremio-4\stremio-runtime.exe C:/Users/Admin/AppData/Local/Programs/LNV/Stremio-4/server.js
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2648
  - - C:\Users\Admin\AppData\Local\Programs\LNV\Stremio-4\ffprobe.exe
      C:\Users\Admin\AppData\Local\Programs\LNV\Stremio-4\ffprobe.exe -show_entries "stream=index,bit_rate,max_bit_rate,codec_type,codec_name,start_time,start_pts,r_frame_rate,sample_rate,channels,channel_layout,time_base,has_b_frames,nb_frames,width,height,color_space,color_transfer,color_primaries,codec_tag_string : stream_tags=title,language,duration,bps,number_of_bytes : format=format_name,duration,bit_rate,max_bit_rate" -print_format json http://127.0.0.1:11470/samples/hevc.mkv
      4⤵
      Executes dropped EXE
      PID:2836
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2648 -s 1008
      4⤵
      Program crash
      PID:2916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Programs\LNV\Stremio-4\stremio-runtime.exe

Filesize
49.1MB

MD5
58a451f04d8da2f547edf753fbe03fdf

SHA1
dfe60e0de8f4f892fdd5719d7b9657ad232f7414

SHA256
2a9d34c190c8c639c2817a371cd8ab6e5d8c8f5d0c45b8c72fbb1d9d4c1e9227

SHA512
0580068222d415ac6cb1f48a236ce425a57cf860cd802bfd31e76a296d269b8d4b9dd174d5d88552616ed7c99c1e758b23c4f69fa5f23c522f1f312f1a8d3ca6

Download Submit
C:\Users\Admin\AppData\Local\Programs\LNV\Stremio-4\stremio.exe

Filesize
300KB

MD5
c0fbaeea5372c54a2f39716fcbc6afec

SHA1
e54790d82d0abdc75607fa0384bb886fc9b8027b

SHA256
cc7b6317d48368cb5791a1e95de5306b6152777b09758d14666d82f4b315dabd

SHA512
002aa47f5223eb113d3b2bfe1c88eb0ba588b1fc79465340b06c69dde1b897fef73c1f2540712ff22a658a6fe7b8bca4d2b6d4ec9c3d643838ff70275ebd8816

Download Submit
C:\Users\Admin\AppData\Local\Smart Code ltd\Stremio\QtWebEngine\Default\Local Storage\leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Smart Code ltd\Stremio\QtWebEngine\Default\Network Persistent State~RFe58c5db.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Smart Code ltd\Stremio\QtWebEngine\Default\Service Worker\CacheStorage\88fcf258722d55f5951a2da9c15b52822bdffa79\09153ed4-5a86-4a9d-ab3f-1ddf1790ba60\index-dir\temp-index

Filesize
72B

MD5
23bba603e6565394a0c10ba1a22d51c3

SHA1
14439468fc6d92a9ea8a9e4044ce3ba0cb9f995e

SHA256
582aea5c68a146413cc9a56e8680874227ddddc76fd47bec1185047966f56f52

SHA512
a58b842ce85e71623a38490952eddc5663d26318cd4a697e62c5793419707afbf402f6b118a4a3cae741df6eb48f5f6aeccdea7217d5b844afef62e1383ec247

Download Submit
C:\Users\Admin\AppData\Local\Smart Code ltd\Stremio\QtWebEngine\Default\Service Worker\CacheStorage\88fcf258722d55f5951a2da9c15b52822bdffa79\09153ed4-5a86-4a9d-ab3f-1ddf1790ba60\index-dir\the-real-index~RFe580a6b.TMP

Filesize
48B

MD5
5db60a6fddece4bf5610d12a22798907

SHA1
688163872109090400b3ca095165828836720dca

SHA256
29e1964f010653271090369627edd4d69d2a22ec8ca3743e90928dcf7f2d8881

SHA512
093fe9d41fc46774a67660ba3d517c1e584fa59d4c2a1fd477b23705866519c7fe3f36a4a88f6876f002add35ceef053dfcade19cccf77f2f880258cc1c1afad

Download Submit
C:\Users\Admin\AppData\Local\Smart Code ltd\Stremio\QtWebEngine\Default\Service Worker\CacheStorage\88fcf258722d55f5951a2da9c15b52822bdffa79\index.txt

Filesize
106B

MD5
e506a6c9cb1d802e350de68e5c9439f2

SHA1
7421810fda703ef8e58d398bb34c633cf39d889c

SHA256
27584dc6559413ca7a8bfda94b53c7a3372fc6c514067bbf616eddddd78ca0ff

SHA512
913d270a1f6bea8e0da707a74ecba54df07ee3c98ec72b090033f56d3688dd5e04054ab9122d592d893a9db1c9f51610dc695cf76b8160ec55e5c41611313810

Download Submit
C:\Users\Admin\AppData\Local\Smart Code ltd\Stremio\QtWebEngine\Default\Service Worker\CacheStorage\88fcf258722d55f5951a2da9c15b52822bdffa79\index.txt.tmp

Filesize
101B

MD5
518eded998053fc07faa5cd80dcdd346

SHA1
06bf7c99df75d5fefa6b0a543b71bf64103c966b

SHA256
b9d3a095d86f2639400b26eb4feabaf1355d2d5303e5e2bd2b4c0104d683c4de

SHA512
413e97f3019b32136e495939ce41c1c1cc1eb8efab24291fb98c8255be392c7e70b435883991e496a01b0099b2ff79a7b518c19e7c929f8beaad91eea6728891

Download Submit
C:\Users\Admin\AppData\Local\Smart Code ltd\Stremio\QtWebEngine\Default\Service Worker\Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Smart Code ltd\Stremio\QtWebEngine\Default\Service Worker\ScriptCache\index-dir\temp-index

Filesize
72B

MD5
b7c943c19e3144d09084c28f73729ab7

SHA1
229aa5388072b27bc8208f7c919ab70bb17227bd

SHA256
8d14ff344d7f60caef1d206fe8e0b32dfa703d0b8ac55f61ee1381a35baaef2e

SHA512
c10a63a6d8e4f0163c4b635720dd31fb07d7efb4e6e383b74f779e9783f6fc58ccabcf5e4c5f281c43c01f246affb73dd19a329665cda6f518c4457313beb100

Download Submit
C:\Users\Admin\AppData\Local\Smart Code ltd\Stremio\QtWebEngine\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe580625.TMP

Filesize
48B

MD5
4ad8118bf302484761068260b59474b9

SHA1
01e0542cee8d39695170ba4857e34def98c51f0b

SHA256
f47c19336aabc90fa6123991fc9b877e14a749136967219954d01199ddcdb968

SHA512
50b0caa56b11da94f89ec2cd5ab7c1d56c5d3dc0d283d1a2d53632e807a82285c9969d74a0537dd38fb319a82466b7b29320a7235a5c4b2a1eca8e387a1260ea

Download Submit
C:\Users\Admin\AppData\Local\Smart Code ltd\Stremio\QtWebEngine\Default\bf85b214-a21f-42d6-b19b-c7c86cdbd44c.tmp

Filesize
401B

MD5
cec770f6573c5da8ac8ce759d1439687

SHA1
7765f7083293c73f1e5e6fdae507eb3259059cbb

SHA256
9d51850ba920145b69aed1760a963bc78a2638b830e2f1e79dcc5fc985b5fd40

SHA512
bfb41c22524185b2905f371f04fb4b95667d8c258c4c628444fcff349b1960109ff11139e7479d1ac5e9965668503e2d49d14978de41d818e3f9d1ba67cb9c32

Download Submit
\Users\Admin\AppData\Local\Temp\nsz6AF0.tmp\System.dll

Filesize
12KB

MD5
cff85c549d536f651d4fb8387f1976f2

SHA1
d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

SHA256
8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

SHA512
531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

Download Submit
\Users\Admin\AppData\Local\Temp\nsz6AF0.tmp\nsProcess.dll

Filesize
4KB

MD5
f0438a894f3a7e01a4aae8d1b5dd0289

SHA1
b058e3fcfb7b550041da16bf10d8837024c38bf6

SHA256
30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

SHA512
f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

Download Submit
memory/2296-4041-0x00000000097E0000-0x00000000097E1000-memory.dmp

Filesize
4KB

Download
memory/2296-4044-0x00000000097E0000-0x00000000097E1000-memory.dmp

Filesize
4KB

Download
memory/2296-4000-0x0000000006270000-0x0000000006271000-memory.dmp

Filesize
4KB

Download
memory/2296-4005-0x0000000006270000-0x0000000006271000-memory.dmp

Filesize
4KB

Download
memory/2296-4010-0x00000000097B0000-0x00000000097B1000-memory.dmp

Filesize
4KB

Download
memory/2296-4009-0x00000000097B0000-0x00000000097B1000-memory.dmp

Filesize
4KB

Download
memory/2296-4008-0x00000000097B0000-0x00000000097B1000-memory.dmp

Filesize
4KB

Download
memory/2296-4006-0x0000000006270000-0x0000000006271000-memory.dmp

Filesize
4KB

Download
memory/2296-4004-0x0000000006270000-0x0000000006271000-memory.dmp

Filesize
4KB

Download
memory/2296-4003-0x0000000006270000-0x0000000006271000-memory.dmp

Filesize
4KB

Download
memory/2296-4002-0x0000000006270000-0x0000000006271000-memory.dmp

Filesize
4KB

Download
memory/2296-3999-0x0000000006270000-0x0000000006271000-memory.dmp

Filesize
4KB

Download
memory/2296-3998-0x0000000006270000-0x0000000006271000-memory.dmp

Filesize
4KB

Download
memory/2296-3997-0x0000000006270000-0x0000000006271000-memory.dmp

Filesize
4KB

Download
memory/2296-3995-0x0000000006270000-0x0000000006271000-memory.dmp

Filesize
4KB

Download
memory/2296-3994-0x0000000006270000-0x0000000006271000-memory.dmp

Filesize
4KB

Download
memory/2296-4015-0x00000000097B0000-0x00000000097B1000-memory.dmp

Filesize
4KB

Download
memory/2296-4021-0x00000000097B0000-0x00000000097B1000-memory.dmp

Filesize
4KB

Download
memory/2296-4025-0x00000000097B0000-0x00000000097B1000-memory.dmp

Filesize
4KB

Download
memory/2296-4036-0x00000000097D0000-0x00000000097D1000-memory.dmp

Filesize
4KB

Download
memory/2296-4043-0x00000000097E0000-0x00000000097E1000-memory.dmp

Filesize
4KB

Download
memory/2296-4042-0x00000000097E0000-0x00000000097E1000-memory.dmp

Filesize
4KB

Download
memory/2296-3996-0x0000000006270000-0x0000000006271000-memory.dmp

Filesize
4KB

Download
memory/2296-4040-0x00000000097E0000-0x00000000097E1000-memory.dmp

Filesize
4KB

Download
memory/2296-4038-0x00000000097D0000-0x00000000097D1000-memory.dmp

Filesize
4KB

Download
memory/2296-4037-0x00000000097D0000-0x00000000097D1000-memory.dmp

Filesize
4KB

Download
memory/2296-4035-0x00000000097D0000-0x00000000097D1000-memory.dmp

Filesize
4KB

Download
memory/2296-4034-0x00000000097D0000-0x00000000097D1000-memory.dmp

Filesize
4KB

Download
memory/2296-4033-0x00000000097D0000-0x00000000097D1000-memory.dmp

Filesize
4KB

Download
memory/2296-4001-0x0000000006270000-0x0000000006271000-memory.dmp

Filesize
4KB

Download
memory/2296-4045-0x00000000097E0000-0x00000000097E1000-memory.dmp

Filesize
4KB

Download
memory/2296-4032-0x00000000097B0000-0x00000000097B1000-memory.dmp

Filesize
4KB

Download
memory/2296-4031-0x00000000097D0000-0x00000000097D1000-memory.dmp

Filesize
4KB

Download
memory/2296-4030-0x00000000097B0000-0x00000000097B1000-memory.dmp

Filesize
4KB

Download
memory/2296-4029-0x00000000097D0000-0x00000000097D1000-memory.dmp

Filesize
4KB

Download
memory/2296-4028-0x00000000097B0000-0x00000000097B1000-memory.dmp

Filesize
4KB

Download
memory/2296-4027-0x00000000097D0000-0x00000000097D1000-memory.dmp

Filesize
4KB

Download
memory/2296-4024-0x00000000097B0000-0x00000000097B1000-memory.dmp

Filesize
4KB

Download
memory/2296-4023-0x00000000097B0000-0x00000000097B1000-memory.dmp

Filesize
4KB

Download
memory/2296-4022-0x00000000097B0000-0x00000000097B1000-memory.dmp

Filesize
4KB

Download
memory/2296-4020-0x00000000097B0000-0x00000000097B1000-memory.dmp

Filesize
4KB

Download
memory/2296-4019-0x00000000097B0000-0x00000000097B1000-memory.dmp

Filesize
4KB

Download
memory/2296-4018-0x00000000097B0000-0x00000000097B1000-memory.dmp

Filesize
4KB

Download
memory/2296-4017-0x00000000097B0000-0x00000000097B1000-memory.dmp

Filesize
4KB

Download
memory/2296-4016-0x00000000097B0000-0x00000000097B1000-memory.dmp

Filesize
4KB

Download
memory/2296-4014-0x00000000097B0000-0x00000000097B1000-memory.dmp

Filesize
4KB

Download
memory/2296-4013-0x00000000097B0000-0x00000000097B1000-memory.dmp

Filesize
4KB

Download
memory/2296-3992-0x0000000006270000-0x0000000006271000-memory.dmp

Filesize
4KB

Download
memory/2296-3990-0x0000000005680000-0x0000000005681000-memory.dmp

Filesize
4KB

Download
memory/2296-3989-0x0000000005680000-0x0000000005681000-memory.dmp

Filesize
4KB

Download
memory/2296-3986-0x0000000005680000-0x0000000005681000-memory.dmp

Filesize
4KB

Download
memory/2296-3988-0x0000000005680000-0x0000000005681000-memory.dmp

Filesize
4KB

Download
memory/2296-3987-0x0000000005680000-0x0000000005681000-memory.dmp

Filesize
4KB

Download
memory/2296-3976-0x0000000003FD0000-0x0000000004410000-memory.dmp

Filesize
4.2MB

Download
memory/2296-3978-0x0000000004410000-0x0000000004610000-memory.dmp

Filesize
2.0MB

Download
memory/2296-4012-0x00000000097B0000-0x00000000097B1000-memory.dmp

Filesize
4KB

Download
memory/2296-4011-0x0000000006270000-0x0000000006271000-memory.dmp

Filesize
4KB

Download
memory/2296-3993-0x0000000006270000-0x0000000006271000-memory.dmp

Filesize
4KB

Download