Overview

overview

6

Static

static

1

Stream-Doc...ws.exe

windows10-ltsc_2021-x64

6

Analysis

  • user interaction
    yes
  • max time kernel
    406s
  • max time network
    359s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20260130-ja
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20260130-jalocale:ja-jpos:windows10-ltsc_2021-x64systemwindows
  • submitted
    06/05/2026, 02:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Stream-Dock-Installer_Windows.exe
  • Size 129.5MB
  • Sample260506-cryejsdx2r
  • SHA256 d01cd96d5f1d86da8148ff4ea11fd7cda4fcea4d037c3855a259351f1beca43b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
defense_evasiondiscoverypersistenceransomwarespywarestealer

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 14 IoCs
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 11 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 25 IoCs
  • Suspicious behavior: AddClipboardFormatListener 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Views/modifies file attributes 1 TTPs 2 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\Stream-Dock-Installer_Windows.exe
    "C:\Users\Admin\AppData\Local\Temp\Stream-Dock-Installer_Windows.exe"
    1⤵
    • Enumerates connected drives
    • Checks computer location settings
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:4912
    • C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\HotSpot\StreamDock 2.9.177.122\install\Stream-Dock-Installer_Windows.msi" TRANSFORMS=:1041 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\Stream-Dock-Installer_Windows.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates "
      2⤵
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      PID:1608
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EXE75F4.tmp.bat" "
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5148
      • C:\Windows\SysWOW64\attrib.exe
        ATTRIB -r "C:\Users\Admin\AppData\Local\Temp\AIEC261.tmp"
        3⤵
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:1736
      • C:\Windows\SysWOW64\attrib.exe
        ATTRIB -r "C:\Users\Admin\AppData\Local\Temp\EXE75F4.tmp.bat"
        3⤵
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:1124
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /S /D /c" del "C:\Users\Admin\AppData\Local\Temp\EXE75F4.tmp.bat" "
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2884
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /S /D /c" cls"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4136
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:320
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 545D42E7E8D6856BC3F17F12C26D8FAD C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:1480
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding FBB3D3EBD435F18E6F5A6B844185CB2D C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:2748
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:5504
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding E7523576E1DE647C6C48BDE40B315C51
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:4872
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:3968
    • C:\Program Files (x86)\StreamDock\StreamDock.exe
      "C:\Program Files (x86)\StreamDock\StreamDock.exe"
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2564
      • C:\Program Files (x86)\StreamDock\SplashScreen.exe
        .\SplashScreen.exe ./CoreConfiguration/splash.gif 1 "Stream Dock" "Version: 2.9.177.122" Loading ""
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:2788
    • C:\Program Files (x86)\StreamDock\StreamDock.exe
      "C:\Program Files (x86)\StreamDock\StreamDock.exe"
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2652
      • C:\Program Files (x86)\StreamDock\SplashScreen.exe
        .\SplashScreen.exe ./CoreConfiguration/splash.gif 1 "Stream Dock" "Version: 2.9.177.122" Loading ""
        2⤵
        • Executes dropped EXE
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:748
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /4
      1⤵
      • Checks SCSI registry key(s)
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:5024
      • C:\Windows\system32\resmon.exe
        "C:\Windows\system32\resmon.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:5528
        • C:\Windows\System32\perfmon.exe
          "C:\Windows\System32\perfmon.exe" /res
          3⤵
          • Checks processor information in registry
          • Suspicious behavior: GetForegroundWindowSpam
          PID:3160
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /4
      1⤵
      • Checks SCSI registry key(s)
      • Checks processor information in registry
      PID:1828
    • C:\Program Files (x86)\StreamDock\StreamDock.exe
      "C:\Program Files (x86)\StreamDock\StreamDock.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:968
      • C:\Program Files (x86)\StreamDock\SplashScreen.exe
        .\SplashScreen.exe ./CoreConfiguration/splash.gif 1 "Stream Dock" "Version: 2.9.177.122" Loading ""
        2⤵
        • Executes dropped EXE
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of SetWindowsHookEx
        PID:5208

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Persistence

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Privilege Escalation

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Defense Evasion

          Hide Artifacts

          1
          T1564

          Hidden Files and Directories

          1
          T1564.001

          Modify Registry

          1
          T1112

          Credential Access

          Credentials from Password Stores

          1
          T1555

          Credentials from Web Browsers

          1
          T1555.003

          Unsecured Credentials

          1
          T1552

          Credentials In Files

          1
          T1552.001

          Discovery

          Peripheral Device Discovery

          2
          T1120

          Query Registry

          4
          T1012

          System Information Discovery

          5
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          Lateral Movement

          Collection

          Data from Local System

          1
          T1005

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          e594667.rbs
          • Path C:\Config.Msi\e594667.rbs
          • Size 187KB
          • SHA256 fac320919814e9eabba097edac7aa029c3b06b279aef1e35ebae824afcf3a32e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Qt5Core.dll
          • Path C:\Program Files (x86)\StreamDock\Qt5Core.dll
          • Size 5.7MB
          • SHA256 8d2ff4ce9096ddccc4f4cd62c2e41fc854cfd1b0d6e8d296645a7f5fd4ae565a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Qt5Gui.dll
          • Path C:\Program Files (x86)\StreamDock\Qt5Gui.dll
          • Size 6.7MB
          • SHA256 5e7d2d41b8b92a880e83b8cc0ca173f5da61218604186196787ee1600956be1e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Qt5Multimedia.dll
          • Path C:\Program Files (x86)\StreamDock\Qt5Multimedia.dll
          • Size 728KB
          • SHA256 1a59ae2a9ff768ad6bfb888fe3dd2544e238f0b28da83cf375ebd803ce713dc4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Qt5MultimediaWidgets.dll
          • Path C:\Program Files (x86)\StreamDock\Qt5MultimediaWidgets.dll
          • Size 99KB
          • SHA256 16b8154863b3abfc94051e10feef5046b0d643e6d7de62d3271082a7b32f51bd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Qt5Network.dll
          • Path C:\Program Files (x86)\StreamDock\Qt5Network.dll
          • Size 1.3MB
          • SHA256 4ef341ae9302e793878020f0740b09b0f31cb380408a697f75c69fdbd20fc7a1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Qt5Quick.dll
          • Path C:\Program Files (x86)\StreamDock\Qt5Quick.dll
          • Size 4.0MB
          • SHA256 c81ad3c1111544064b1830c6f1aef3c1fd13b401546ab3b852d697c0f4d854b3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Qt5WebEngineWidgets.dll
          • Path C:\Program Files (x86)\StreamDock\Qt5WebEngineWidgets.dll
          • Size 244KB
          • SHA256 2bd29d50306ac49f1df65c22e736a873f3021a0fb65f950271161a2609056e1f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Qt5WebSockets.dll
          • Path C:\Program Files (x86)\StreamDock\Qt5WebSockets.dll
          • Size 145KB
          • SHA256 6b56f77da6f17880a42d2f9d2ec8b426248f7ab2196a0f55d37ade39e3878bc6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Qt5Widgets.dll
          • Path C:\Program Files (x86)\StreamDock\Qt5Widgets.dll
          • Size 5.2MB
          • SHA256 3788c669d4b645e5a576de9fc77fca776bf516d43c89143dc2ca28291ba14358
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Qt5WinExtras.dll
          • Path C:\Program Files (x86)\StreamDock\Qt5WinExtras.dll
          • Size 231KB
          • SHA256 9987b4bff62ef5c0c75dfcdbe50b1d02d0ae38a8123a816fbe4326ea8538069a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Qt5Xml.dll
          • Path C:\Program Files (x86)\StreamDock\Qt5Xml.dll
          • Size 208KB
          • SHA256 ebdf91f0310ab67a79abd2385fa428205856f81e3a753e6e47c31d5946ddd590
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StreamDock.exe
          • Path C:\Program Files (x86)\StreamDock\StreamDock.exe
          • Size 18.9MB
          • SHA256 df07428ce21aec5405a63588b96a40a5c110f0af79c0c717852315a3b9782ca4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          OBS-icon-126-05.jpg
          • Path C:\Program Files (x86)\StreamDock\icons\com.hotspot.obsstudio.sdIconPack\icons\OBS-icon-126-05.jpg
          • Size 51KB
          • SHA256 b7903f8e4feedf3afdf278deb75c62c72007e689d50306eff0ce0d9c9ff92558
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          OBS-icon-126-13.jpg
          • Path C:\Program Files (x86)\StreamDock\icons\com.hotspot.obsstudio.sdIconPack\icons\OBS-icon-126-13.jpg
          • Size 50KB
          • SHA256 bcca9febc3a7d6cf766030b97eba14a45faec689ef19ab03e60d75ac064e2e89
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libusb-1.0.dll
          • Path C:\Program Files (x86)\StreamDock\libusb-1.0.dll
          • Size 188KB
          • SHA256 8fc47d0394fb8c8359eff95c21ad8f46d22e707f009d0be3a67c6b82619803bd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libz.dll
          • Path C:\Program Files (x86)\StreamDock\libz.dll
          • Size 111KB
          • SHA256 6ed7a9693c75ff9505a16b515a494105ff3067053fd8c07306bec46836f745f0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msvcp140.dll
          • Path C:\Program Files (x86)\StreamDock\msvcp140.dll
          • Size 553KB
          • SHA256 9fee6f36547d6f6ea7ca0338655555dba6bb0f798bc60334d29b94d1547da4da
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          off.jpg
          • Path C:\Program Files (x86)\StreamDock\plugins\com.hotspot.streamdock.obsstudio.sdPlugin\Images\actions\scene.item.visibility\off.jpg
          • Size 55KB
          • SHA256 68b165612d1a0dddf9a6060900b57d0965185bd77eec13185bd2161a888bc0b9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          off.jpg
          • Path C:\Program Files (x86)\StreamDock\plugins\com.hotspot.streamdock.obsstudio.sdPlugin\Images\actions\source.audio.mute\off.jpg
          • Size 54KB
          • SHA256 50a0721382315bc0989b7ffd8bf7969170f0f7720923c433eedcd71ed09f59c3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vcruntime140.dll
          • Path C:\Program Files (x86)\StreamDock\vcruntime140.dll
          • Size 95KB
          • SHA256 9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vcruntime140_1.dll
          • Path C:\Program Files (x86)\StreamDock\vcruntime140_1.dll
          • Size 36KB
          • SHA256 34048abaa070ecc13b318cea31425f4ca3edd133d350318ac65259e6058c8b32
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          EXE75F4.tmp.bat
          • Path C:\Users\Admin\AppData\Local\Temp\EXE75F4.tmp.bat
          • Size 325B
          • SHA256 bc7de7fb4951f90f94c0d887b7468ba3600a7ec0773bada2d52dcb67e5fcd376
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          MSIC3CA.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\MSIC3CA.tmp
          • Size 260KB
          • SHA256 15fb0bda4e4644d5769b90108c87a469cc75f74113d03240236f272396aa49fb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          1041.dll
          • Path C:\Users\Admin\AppData\Roaming\HotSpot\StreamDock 2.9.177.122\install\1041.dll
          • Size 100KB
          • SHA256 198b42c0ca2dfc2b1e7a312dfd36ec6bfc48c7372c4abc401f1c97f27b9de644
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Stream-Dock-Installer_Windows.msi
          • Path C:\Users\Admin\AppData\Roaming\HotSpot\StreamDock 2.9.177.122\install\Stream-Dock-Installer_Windows.msi
          • Size 2.5MB
          • SHA256 844c3939e5011e01b6b949bcb3f77abbb3dadbce6798647899c52248a3994bf3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StreamDockConfig.ini.lock
          • Path C:\Users\Admin\AppData\Roaming\HotSpot\StreamDock\config\StreamDockConfig.ini.lock
          • Size 63B
          • SHA256 37045f6e0c2a0eeb88605242af831b1d491a6c9fbd4d5a8818ad0c9d1793cdab
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          manifest.json
          • Path C:\Users\Admin\AppData\Roaming\HotSpot\StreamDock\profiles\00I4RR80-0C83-2UGO-VGE0-51QZWZG0VX4M.sdProfile\manifest.json
          • Size 6KB
          • SHA256 37f70dbb9274e70bc78a67316c1fbfe2629f79c54560c7b08e8ca97b55220647
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          GGCXGY389J1H0800U52FJ6Z4QK7.png
          • Path C:\Users\Admin\AppData\Roaming\HotSpot\StreamDock\profiles\2QRJ1E0R-1S13-80LE-M995-26J514G0DUYE.sdProfile\Images\GGCXGY389J1H0800U52FJ6Z4QK7.png
          • Size 256KB
          • SHA256 52b60078c9dd4743af03e150c86f9279b40096ff2fe9d18318c5e73ff110d54d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          K8R2920AAXJ3BJ4H25HG7F810L6.png
          • Path C:\Users\Admin\AppData\Roaming\HotSpot\StreamDock\profiles\32SP3F7B-CWIU-0ZFJ-5DO4-C94YI06FH1Y7.sdProfile\Images\K8R2920AAXJ3BJ4H25HG7F810L6.png
          • Size 310KB
          • SHA256 9a748caab35264bd34b6ccbaad8b282232c2000662cafec896f130426d0f0dfc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          1M556ST9BT2QN4T6310J1DG31F5.png.png
          • Path C:\Users\Admin\AppData\Roaming\HotSpot\StreamDock\profiles\7QIH446Q-3Y5X-X92S-V05Y-Z9K7550497E8.sdProfile\Images\1M556ST9BT2QN4T6310J1DG31F5.png.png
          • Size 135KB
          • SHA256 31ea8d0c2130adcf49ff03e403069c1de8103c1ef7ce16c248766dcc691fe177
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          K4JXNH7KZL8K433D145O18P3371.png
          • Path C:\Users\Admin\AppData\Roaming\HotSpot\StreamDock\profiles\7QIH446Q-3Y5X-X92S-V05Y-Z9K7550497E8.sdProfile\Images\K4JXNH7KZL8K433D145O18P3371.png
          • Size 255KB
          • SHA256 fb31e07841eb4048be56fadd94d665b98f7e37385af55a55cd5378fa60d012d3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          V6B422BO24YYGWB0G2PXIG0T1CU.png.png
          • Path C:\Users\Admin\AppData\Roaming\HotSpot\StreamDock\profiles\7QIH446Q-3Y5X-X92S-V05Y-Z9K7550497E8.sdProfile\Images\V6B422BO24YYGWB0G2PXIG0T1CU.png.png
          • Size 612KB
          • SHA256 304ae700e290b04f83d22a0ea75699e296e3c378af1d3786b27545076a38b0bd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          manifest.json
          • Path C:\Users\Admin\AppData\Roaming\HotSpot\StreamDock\profiles\A44D17H2-7KQ2-OQOE-09I7-DKF7282ZB4C6.sdProfile\profiles\LLLZQ549-3FRQ-12UW-YT3A-8A49IGA3TD6U.sdProfile\manifest.json
          • Size 135B
          • SHA256 caaa4e2e8315e08d395b96e37b132492538109b4b59ca72c28e6229ae6eccc07
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          7R9YJHBS020Z9189UYE0ALW3YK8.png
          • Path C:\Users\Admin\AppData\Roaming\HotSpot\StreamDock\profiles\BUJ3K1TM-797G-LJ70-L5SX-VU1BE7BN4047.sdProfile\Images\7R9YJHBS020Z9189UYE0ALW3YK8.png
          • Size 62KB
          • SHA256 6eecdaa062e4853aa3d706e4134b7431fc758883707636b3ed6306f8a2eccad9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          NG78AIA54O111M1Q1990F24SG24.png
          • Path C:\Users\Admin\AppData\Roaming\HotSpot\StreamDock\profiles\BUJ3K1TM-797G-LJ70-L5SX-VU1BE7BN4047.sdProfile\Images\NG78AIA54O111M1Q1990F24SG24.png
          • Size 64KB
          • SHA256 a042706c21b50cf28e8e9d0353eccb69701e793bf43603b9357366c39af6841e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          manifest.json
          • Path C:\Users\Admin\AppData\Roaming\HotSpot\StreamDock\profiles\J5LBP2L4-591T-JJ27-A3EM-458EKZI0121G.sdProfile\manifest.json
          • Size 31KB
          • SHA256 3f1b4fd797494b3657b9161a7c1777efc9cdc810b3a3ff22c5c5432e0f2264b9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          state0.png
          • Path C:\Users\Admin\AppData\Roaming\HotSpot\StreamDock\profiles\N0968L6V-1C52-378N-CHE7-O460A27H0737.sdProfile\4,0\CustomImages\state0.png
          • Size 61KB
          • SHA256 81b19581e354853c7417e9450e4a210ad4a7d3b3b31d8c86d0a81dd2070cfb40
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          B0M3W0O9B1Z0445T1374Z476EF1.png
          • Path C:\Users\Admin\AppData\Roaming\HotSpot\StreamDock\profiles\P01N2I3Z-4X2L-AL0K-E756-7CT933TBTK68.sdProfile\Images\B0M3W0O9B1Z0445T1374Z476EF1.png
          • Size 28KB
          • SHA256 82bde5d7d1188ae3ffc9b78d6a81c1117dbcb6b9f8c062b48f67d9c9f5e36001
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          J74L01WI1Y54KF53D79VAN45687.png
          • Path C:\Users\Admin\AppData\Roaming\HotSpot\StreamDock\profiles\P01N2I3Z-4X2L-AL0K-E756-7CT933TBTK68.sdProfile\Images\J74L01WI1Y54KF53D79VAN45687.png
          • Size 38KB
          • SHA256 cd261d429d98cb8a6b4f54ae5e0eaa1f51a620f02b7db37f1699d1455d4d6e63
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          manifest.json
          • Path C:\Users\Admin\AppData\Roaming\HotSpot\StreamDock\profiles\P01N2I3Z-4X2L-AL0K-E756-7CT933TBTK68.sdProfile\manifest.json
          • Size 10KB
          • SHA256 b038588cbe53dfa03ed5384d4c5068a94cc0175b9bfebd6146bcf70bcaaa208a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSI49B4.tmp
          • Path C:\Windows\Installer\MSI49B4.tmp
          • Size 381KB
          • SHA256 8b190f2dd956572773f4c9927e3137227e46f5907651d00103bcea09e50c3bef
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          metadata-2
          • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
          • Size 24.0MB
          • SHA256 874f43a010a7ca7706fb531c0a16e5c0d94e72507664be0eb9f25755f3cc07e6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          {6e89e4ee-8191-4fb4-814e-be3db74855e2}_OnDiskSnapshotProp
          • Path \??\Volume{b11be897-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{6e89e4ee-8191-4fb4-814e-be3db74855e2}_OnDiskSnapshotProp
          • Size 6KB
          • SHA256 249154b015f9dc39d39947b0261a689fc7b369e6b678d86d5f203a2ea41a75f1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/320-1891-0x00000160C67C0000-0x00000160C6B13000-memory.dmp
          Download

          memory/320-1905-0x00000160C67C0000-0x00000160C6B13000-memory.dmp
          Download

          memory/320-1854-0x00000160C67C0000-0x00000160C6B13000-memory.dmp
          Download

          memory/320-1864-0x00000160C67C0000-0x00000160C6B13000-memory.dmp
          Download

          memory/320-1870-0x00000160C67C0000-0x00000160C6B13000-memory.dmp
          Download

          memory/320-1887-0x00000160C67C0000-0x00000160C6B13000-memory.dmp
          Download

          memory/320-1788-0x00000160C67C0000-0x00000160C6B13000-memory.dmp
          Download

          memory/320-54-0x00000160C67C0000-0x00000160C6B13000-memory.dmp
          Download

          memory/320-36-0x00000160C67C0000-0x00000160C6B13000-memory.dmp
          Download

          memory/320-1915-0x00000160C67C0000-0x00000160C6B13000-memory.dmp
          Download

          memory/320-1942-0x00000160C67C0000-0x00000160C6B13000-memory.dmp
          Download

          memory/320-1330-0x00000160C67C0000-0x00000160C6B13000-memory.dmp
          Download

          memory/320-998-0x00000160C67C0000-0x00000160C6B13000-memory.dmp
          Download

          memory/320-1791-0x00000160C67C0000-0x00000160C6B13000-memory.dmp
          Download

          memory/320-1769-0x00000160C67C0000-0x00000160C6B13000-memory.dmp
          Download

          memory/748-1805-0x00007FFCD8CC0000-0x00007FFCD9201000-memory.dmp
          Download

          memory/748-1843-0x000002ED613E0000-0x000002ED61733000-memory.dmp
          Download

          memory/1480-37-0x0000000000A20000-0x0000000000A39000-memory.dmp
          Download

          memory/1480-38-0x0000000000C20000-0x0000000000D03000-memory.dmp
          Download

          memory/1480-1316-0x0000000000A20000-0x0000000000A39000-memory.dmp
          Download

          memory/1480-1317-0x0000000000C20000-0x0000000000D03000-memory.dmp
          Download

          memory/1608-1315-0x0000000001230000-0x0000000001313000-memory.dmp
          Download

          memory/1608-40-0x0000000001230000-0x0000000001313000-memory.dmp
          Download

          memory/1608-39-0x0000000001130000-0x0000000001149000-memory.dmp
          Download

          memory/1608-1314-0x0000000001130000-0x0000000001149000-memory.dmp
          Download

          memory/2564-1309-0x00007FFCD8CC0000-0x00007FFCD9201000-memory.dmp
          Download

          memory/2564-1312-0x00007FFCD80C0000-0x00007FFCD84B8000-memory.dmp
          Download

          memory/2564-1311-0x00007FF7D3480000-0x00007FF7D475D000-memory.dmp
          Download

          memory/2564-1763-0x000001E3DCC90000-0x000001E3DCD5D000-memory.dmp
          Download

          memory/2564-1313-0x00007FF7D3480000-0x00007FF7D475D000-memory.dmp
          Download

          memory/2564-1310-0x00007FFCD80C0000-0x00007FFCD84B8000-memory.dmp
          Download

          memory/2652-1797-0x00007FFCD8CC0000-0x00007FFCD9201000-memory.dmp
          Download

          memory/2652-1799-0x00007FF7D3480000-0x00007FF7D475D000-memory.dmp
          Download

          memory/2652-1798-0x00007FFCDC120000-0x00007FFCDC518000-memory.dmp
          Download

          memory/2748-1329-0x0000000002C60000-0x0000000002D43000-memory.dmp
          Download

          memory/2748-1328-0x0000000000F90000-0x0000000000FA9000-memory.dmp
          Download

          memory/2748-42-0x0000000002C60000-0x0000000002D43000-memory.dmp
          Download

          memory/2748-41-0x0000000000F90000-0x0000000000FA9000-memory.dmp
          Download

          memory/2788-1768-0x000001B960900000-0x000001B960C53000-memory.dmp
          Download

          memory/2788-1338-0x00007FFCD8CC0000-0x00007FFCD9201000-memory.dmp
          Download

          memory/3160-1936-0x0000012FB7960000-0x0000012FB7CB3000-memory.dmp
          Download

          memory/3160-1901-0x0000012FB7960000-0x0000012FB7CB3000-memory.dmp
          Download

          memory/3968-1869-0x0000020CAEBE0000-0x0000020CAF04E000-memory.dmp
          Download

          memory/3968-64-0x0000020CAEBE0000-0x0000020CAF04E000-memory.dmp
          Download

          memory/4872-1267-0x00000000009B0000-0x00000000009C9000-memory.dmp
          Download

          memory/4872-1268-0x00000000026C0000-0x00000000027A3000-memory.dmp
          Download

          memory/4912-1327-0x0000000002E70000-0x0000000002F53000-memory.dmp
          Download

          memory/4912-34-0x0000000001300000-0x0000000001319000-memory.dmp
          Download

          memory/4912-35-0x0000000002E70000-0x0000000002F53000-memory.dmp
          Download

          memory/4912-1326-0x0000000001300000-0x0000000001319000-memory.dmp
          Download

          memory/5024-1836-0x00000293E3480000-0x00000293E3481000-memory.dmp
          Download

          memory/5024-1838-0x00000293E3480000-0x00000293E3481000-memory.dmp
          Download

          memory/5024-1830-0x00000293E3480000-0x00000293E3481000-memory.dmp
          Download

          memory/5024-1847-0x00000293DB0A0000-0x00000293DB140000-memory.dmp
          Download

          memory/5024-1831-0x00000293E3480000-0x00000293E3481000-memory.dmp
          Download

          memory/5024-1832-0x00000293E3480000-0x00000293E3481000-memory.dmp
          Download

          memory/5024-1841-0x00000293E3480000-0x00000293E3481000-memory.dmp
          Download

          memory/5024-1840-0x00000293E3480000-0x00000293E3481000-memory.dmp
          Download

          memory/5024-1941-0x00000293DB0A0000-0x00000293DB140000-memory.dmp
          Download

          memory/5024-1837-0x00000293E3480000-0x00000293E3481000-memory.dmp
          Download

          memory/5024-1842-0x00000293E3480000-0x00000293E3481000-memory.dmp
          Download

          memory/5024-1839-0x00000293E3480000-0x00000293E3481000-memory.dmp
          Download

          memory/5504-1016-0x00000251CCCC0000-0x00000251CD013000-memory.dmp
          Download

          memory/5528-1896-0x0000012D42620000-0x0000012D42973000-memory.dmp
          Download