f38b3161ec55dfb28f791ae4c999ab6a245f5f706a81e4a820050098c6fca43c

Analysis

max time kernel
300s
max time network
304s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/09/2026, 22:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Go Live.exe
Size 200.4MB
Sample260916-2xa9mstybt
SHA256 f38b3161ec55dfb28f791ae4c999ab6a245f5f706a81e4a820050098c6fca43c
MD5 0783ddd4a96dd0cbcd26d90a3026670c
SHA1 497667fe3b0488392308fa0325ef5f79c47b3a49
SHA512 1c0083afe2099b2810c9c73c6c9d562a31cd85a04d6f0ac9e1d51d1cf53f106f24751e214ed25b6d3378530dfeda9058ccd759a1e65c0aaf48acebc01dee89e8
SSDEEP 1572864:0ir3YkVksSEZWaMZDjL3r2sHCDTnq/jxOiuYSeh019IZQEKzVn7SfK4lJroH26Pq:VIAnVb+/jVSbxkg
TLSH
T1FCA88B13E29601D9E05DD1758B5A9633FEB2B80A4B24A3DF2B5407522F77EE42B3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	Go Live.exe
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	Go Live.exe
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	Go Live.exe
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	Go Live.exe

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\me.nemtudo.golive = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Go Live.exe\" --golive-hidden"	Go Live.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Go Live.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Go Live.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	Go Live.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	Go Live.exe

Modifies registry class 7 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\golive\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Go Live.exe\" \"%1\""	Go Live.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\golive	Go Live.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\golive\URL Protocol	Go Live.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\golive\ = "URL:golive"	Go Live.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\golive\shell\open\command	Go Live.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\golive\shell	Go Live.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\golive\shell\open	Go Live.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3568	Go Live.exe
3568	Go Live.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2368	Go Live.exe
Token: SeCreatePagefilePrivilege	2368	Go Live.exe
Token: SeShutdownPrivilege	2368	Go Live.exe
Token: SeCreatePagefilePrivilege	2368	Go Live.exe
Token: SeShutdownPrivilege	2368	Go Live.exe
Token: SeCreatePagefilePrivilege	2368	Go Live.exe
Token: SeShutdownPrivilege	2368	Go Live.exe
Token: SeCreatePagefilePrivilege	2368	Go Live.exe
Token: SeShutdownPrivilege	2368	Go Live.exe
Token: SeCreatePagefilePrivilege	2368	Go Live.exe
Token: SeShutdownPrivilege	2368	Go Live.exe
Token: SeCreatePagefilePrivilege	2368	Go Live.exe
Token: SeShutdownPrivilege	2368	Go Live.exe
Token: SeCreatePagefilePrivilege	2368	Go Live.exe
Token: SeShutdownPrivilege	2368	Go Live.exe
Token: SeCreatePagefilePrivilege	2368	Go Live.exe
Token: SeShutdownPrivilege	2368	Go Live.exe
Token: SeCreatePagefilePrivilege	2368	Go Live.exe
Token: SeShutdownPrivilege	2368	Go Live.exe
Token: SeCreatePagefilePrivilege	2368	Go Live.exe
Token: SeShutdownPrivilege	2368	Go Live.exe
Token: SeCreatePagefilePrivilege	2368	Go Live.exe
Token: SeShutdownPrivilege	2368	Go Live.exe
Token: SeCreatePagefilePrivilege	2368	Go Live.exe
Token: SeShutdownPrivilege	2368	Go Live.exe
Token: SeCreatePagefilePrivilege	2368	Go Live.exe
Token: SeShutdownPrivilege	2368	Go Live.exe
Token: SeCreatePagefilePrivilege	2368	Go Live.exe
Token: SeShutdownPrivilege	2368	Go Live.exe
Token: SeCreatePagefilePrivilege	2368	Go Live.exe
Token: SeShutdownPrivilege	2368	Go Live.exe
Token: SeCreatePagefilePrivilege	2368	Go Live.exe
Token: SeShutdownPrivilege	2368	Go Live.exe
Token: SeCreatePagefilePrivilege	2368	Go Live.exe
Token: SeShutdownPrivilege	2368	Go Live.exe
Token: SeCreatePagefilePrivilege	2368	Go Live.exe
Token: SeShutdownPrivilege	2368	Go Live.exe
Token: SeCreatePagefilePrivilege	2368	Go Live.exe
Token: SeShutdownPrivilege	2368	Go Live.exe
Token: SeCreatePagefilePrivilege	2368	Go Live.exe
Token: SeShutdownPrivilege	2368	Go Live.exe
Token: SeCreatePagefilePrivilege	2368	Go Live.exe
Token: SeShutdownPrivilege	2368	Go Live.exe
Token: SeCreatePagefilePrivilege	2368	Go Live.exe
Token: SeShutdownPrivilege	2368	Go Live.exe
Token: SeCreatePagefilePrivilege	2368	Go Live.exe
Token: SeShutdownPrivilege	2368	Go Live.exe
Token: SeCreatePagefilePrivilege	2368	Go Live.exe
Token: SeShutdownPrivilege	2368	Go Live.exe
Token: SeCreatePagefilePrivilege	2368	Go Live.exe
Token: SeShutdownPrivilege	2368	Go Live.exe
Token: SeCreatePagefilePrivilege	2368	Go Live.exe
Token: SeShutdownPrivilege	2368	Go Live.exe
Token: SeCreatePagefilePrivilege	2368	Go Live.exe
Token: SeShutdownPrivilege	2368	Go Live.exe
Token: SeCreatePagefilePrivilege	2368	Go Live.exe
Token: SeShutdownPrivilege	2368	Go Live.exe
Token: SeCreatePagefilePrivilege	2368	Go Live.exe
Token: SeShutdownPrivilege	2368	Go Live.exe
Token: SeCreatePagefilePrivilege	2368	Go Live.exe
Token: SeShutdownPrivilege	2368	Go Live.exe
Token: SeCreatePagefilePrivilege	2368	Go Live.exe
Token: SeShutdownPrivilege	2368	Go Live.exe
Token: SeCreatePagefilePrivilege	2368	Go Live.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
2368	Go Live.exe
2368	Go Live.exe
2368	Go Live.exe
2368	Go Live.exe
2368	Go Live.exe
2368	Go Live.exe
2368	Go Live.exe
2368	Go Live.exe

Suspicious use of SendNotifyMessage 10 IoCs

pid	Process
2368	Go Live.exe
2368	Go Live.exe
2368	Go Live.exe
2368	Go Live.exe
2368	Go Live.exe
2368	Go Live.exe
2368	Go Live.exe
2368	Go Live.exe
2368	Go Live.exe
2368	Go Live.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 4488	2368	Go Live.exe	87
PID 2368 wrote to memory of 4488	2368	Go Live.exe	87
PID 2368 wrote to memory of 4860	2368	Go Live.exe	88
PID 2368 wrote to memory of 116	2368	Go Live.exe	89
PID 2368 wrote to memory of 116	2368	Go Live.exe	89
PID 972 wrote to memory of 1004	972	Go Live.exe	92
PID 972 wrote to memory of 1004	972	Go Live.exe	92
PID 972 wrote to memory of 1696	972	Go Live.exe	93
PID 2368 wrote to memory of 4964	2368	Go Live.exe	94
PID 2368 wrote to memory of 4964	2368	Go Live.exe	94
PID 2368 wrote to memory of 3140	2368	Go Live.exe	95
PID 2368 wrote to memory of 3140	2368	Go Live.exe	95
PID 2368 wrote to memory of 3568	2368	Go Live.exe	99

C:\Users\Admin\AppData\Local\Temp\Go Live.exe
"C:\Users\Admin\AppData\Local\Temp\Go Live.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Users\Admin\AppData\Local\Temp\Go Live.exe
  "C:\Users\Admin\AppData\Local\Temp\Go Live.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\sharescreen" --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1756,i,1915015863456357447,4576928540278452319,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=1752 /prefetch:2
  2⤵
  PID:4488
- C:\Users\Admin\AppData\Local\Temp\Go Live.exe
  "C:\Users\Admin\AppData\Local\Temp\Go Live.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\sharescreen" --field-trial-handle=1756,i,1915015863456357447,4576928540278452319,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2036 /prefetch:3
  2⤵
  PID:4860
- C:\Users\Admin\AppData\Local\Temp\Go Live.exe
  "C:\Users\Admin\AppData\Local\Temp\Go Live.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\sharescreen" --app-user-model-id=me.nemtudo.golive --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1789599092278853 --launch-time-ticks=576337401 --field-trial-handle=1756,i,1915015863456357447,4576928540278452319,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2584 --golive-version=1.0.2 --golive-system-audio-exclusion /prefetch:1
  2⤵
  - Checks computer location settings
  PID:116
- C:\Users\Admin\AppData\Local\Temp\Go Live.exe
  "C:\Users\Admin\AppData\Local\Temp\Go Live.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\sharescreen" --app-user-model-id=me.nemtudo.golive --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1789599092278853 --launch-time-ticks=578485660 --field-trial-handle=1756,i,1915015863456357447,4576928540278452319,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=3656 --golive-version=1.0.2 --golive-system-audio-exclusion /prefetch:1
  2⤵
  PID:4964
- C:\Users\Admin\AppData\Local\Temp\Go Live.exe
  "C:\Users\Admin\AppData\Local\Temp\Go Live.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\sharescreen" --app-user-model-id=me.nemtudo.golive --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1789599092278853 --launch-time-ticks=578594937 --field-trial-handle=1756,i,1915015863456357447,4576928540278452319,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=3768 --golive-version=1.0.2 --golive-system-audio-exclusion /prefetch:1
  2⤵
  - Checks computer location settings
  PID:3140
- C:\Users\Admin\AppData\Local\Temp\Go Live.exe
  "C:\Users\Admin\AppData\Local\Temp\Go Live.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\sharescreen" --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1756,i,1915015863456357447,4576928540278452319,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3568

C:\Users\Admin\AppData\Local\Temp\Go Live.exe
"C:\Users\Admin\AppData\Local\Temp\Go Live.exe" --golive-hidden
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:972
- C:\Users\Admin\AppData\Local\Temp\Go Live.exe
  "C:\Users\Admin\AppData\Local\Temp\Go Live.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\sharescreen" --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1752,i,10589325767396879996,10512521253096026623,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=1748 /prefetch:2
  2⤵
  PID:1004
- C:\Users\Admin\AppData\Local\Temp\Go Live.exe
  "C:\Users\Admin\AppData\Local\Temp\Go Live.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\sharescreen" --field-trial-handle=1752,i,10589325767396879996,10512521253096026623,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=1984 /prefetch:3
  2⤵
  PID:1696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\sharescreen\Code Cache\js\index-dir\the-real-index
Size 816B
SHA256 039930f3a0b68853bc801e02c174c6d54c0489d18857cc97001aed61e7e03a73
MD5 18006c4f2845a5c3caa146f7dd8a7e69
SHA1 25d1fcbc0a1eedb67d80a7503bc7e766364b1e47
SHA512 0b39a5be95ff30075763a7dc25d7aaaa2b8051c803f6bf20718ff0d2dea8814f9261d64e42fe1d216a259f4f51816322f5750e60cde80a0c143b7a26d8e9825b
TLSH
T1B601240584F62051DFB1327084697C862EBC0CDC4A899B1771C22F68F58FAC98B4EE34
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe597862.TMP

Path C:\Users\Admin\AppData\Roaming\sharescreen\Code Cache\js\index-dir\the-real-index~RFe597862.TMP
Size 48B
SHA256 9b6ce0eda7ca0a02336653e4f574c88c4eb073eef8206482e9ae45dad06f82db
MD5 fba1990f064e74f2ee70a5512fa56c42
SHA1 58910bf0c6e2a268c8b87c67e3e84fe6b8d4e52f
SHA512 42811277d0cd6e2662aab14da21c6a679196379bca1e453c0b044e74db791937114416ac77fef64ab5c4fc29fe71c69e0f1ea3f9da9f3108ea8b2ec2db239cbe
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\sharescreen\Local State
Size 434B
SHA256 34b2a306c222b7925ba8f4604459c3adc46e37a298d056051a27a2fc6ec4aefe
MD5 3cae76665944e3fe877ecc4da48b04c6
SHA1 96369536cd380bb0b25322727cddb31ee2b27358
SHA512 25dda6d99aa630e588bc738d2d482e56a55ae74dcb25fcb2a50d4b94e93c46116e8d0a84bc8a4b6c488679f89d4373479d51dd2c3d5eea78628637e42c3839a6
TLSH
T154E0AB356BE42D7BB7336F54492972964E202737C0A937B83D6C032296D2C46C71ADF8
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\sharescreen\Local State
Size 434B
SHA256 0536ca8aeccdaad96d76b97a074e6d079e6118a2672ecc13c4c8468c99e7c3e7
MD5 2bf83298bb5c02eea3fe010cfe97d4e5
SHA1 9c269d55719c3e89cb7c8ed1f6fdf2cb3eb0e3a9
SHA512 96e9770339fbadf578e88045227d6bd777ca24545c91b109b8574674dea381338c1796fa752089a22961f277f515439c98a4c19758b4a5e249eae0267122c09e
TLSH
T106E0A37264B17D9A75D4A1A81646B7265E505C734E409344D64C120141FB081C804D73
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\sharescreen\Network\Network Persistent State
Size 2KB
SHA256 e47e14428b2cd0038b7aac47fcdcfde13c95f074f5305e5711498415e4091927
MD5 bc621f9d35c37a9f7accc0b8d5c8b938
SHA1 15e989b2fff610de154af3d73db97cfb75acf715
SHA512 b102dc27411b1aa43494b2d0bd7873a5af8245d3e1810d9d7b575ff8efc9971f51698b82799e78676476371c1af63fb19e53a900f58bfd127237f47bbb87555d
TLSH
T117418D8AC7EC4A7DC45223F52B747E22C1BD1A1C52183D0689C9DF4FA7E1871925164E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a31cf.TMP

Path C:\Users\Admin\AppData\Roaming\sharescreen\Network\Network Persistent State~RFe5a31cf.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\sharescreen\Preferences
Size 93B
SHA256 529b6595a4727a6b2d6cc154ae51f426216c01fc7fda02de2460abfb3de118a4
MD5 322f01bb491180333c338526d93f115a
SHA1 554d5e43d5e46774b8f2a6b3682243a289927754
SHA512 69f8e980f44b1465cee8c0485598fa00be163db0fe88598e45ab2f817f9bea36a2b70dbb9d25d5214174ea9c198b9641bb3d5a86c18b1a4ea4493c00e2e95eb2
TLSH
T103B01253B810A0324B1B09E5000BC94F2CBE00340E475A0510D4F39D492DD4D088702B
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\sharescreen\Service Worker\Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\sharescreen\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 b79419f8c5a18265736bd8b7420dfda27e28ab9be68c7cf2995dbcda093d8a01
MD5 4ee9f75a600ea7481b0623eaf1dd6214
SHA1 a7987a7a87224ebdeac568895c9b1d423be12829
SHA512 eacd7c3aa8013a510af448e0e5d6415bd0c2ede2b9dfc89c69391fc065ff9944910c8aa717482cf515fab48e30f6dda6ee45987fbc1ef302fb037ec82573bddb
TLSH
T18FA0021D12400153C8601BB0185602D6276999A99703930246D003D5CE662545112151
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe597584.TMP

Path C:\Users\Admin\AppData\Roaming\sharescreen\Service Worker\ScriptCache\index-dir\the-real-index~RFe597584.TMP
Size 48B
SHA256 91825c345765562eef09ac71b23bb778dd0e4968b44955683cd6267d574c5033
MD5 94887443ef70ac02ec47f54c0fcc4184
SHA1 b450df1c77e4651f19e45ee9426565d7723e1748
SHA512 2d004c7e4f6ed194908de39aa32be7f32954a0d3cb5fded7aa9f204d0dd45f6b32d2b21c6aabb5c0d5e4aa965f9179de9a663b14b3fcd81def7696045153f81a
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\sharescreen\Session Storage\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

memory/116-25-0x00007FF92B7E0000-0x00007FF92B7E1000-memory.dmp

Download

memory/116-26-0x00007FF92B7F0000-0x00007FF92B7F1000-memory.dmp

Download

memory/3568-261-0x000001F1E1BC0000-0x000001F1E1BC1000-memory.dmp

Download

memory/3568-262-0x000001F1E1BC0000-0x000001F1E1BC1000-memory.dmp

Download

memory/3568-268-0x000001F1E1BC0000-0x000001F1E1BC1000-memory.dmp

Download

memory/3568-270-0x000001F1E1BC0000-0x000001F1E1BC1000-memory.dmp

Download

memory/3568-271-0x000001F1E1BC0000-0x000001F1E1BC1000-memory.dmp

Download

memory/3568-272-0x000001F1E1BC0000-0x000001F1E1BC1000-memory.dmp

Download

memory/3568-273-0x000001F1E1BC0000-0x000001F1E1BC1000-memory.dmp

Download

memory/3568-269-0x000001F1E1BC0000-0x000001F1E1BC1000-memory.dmp

Download

memory/3568-267-0x000001F1E1BC0000-0x000001F1E1BC1000-memory.dmp

Download

memory/3568-263-0x000001F1E1BC0000-0x000001F1E1BC1000-memory.dmp

Download

memory/4488-183-0x0000028D6A780000-0x0000028D6A782000-memory.dmp

Download

memory/4488-182-0x0000028D65210000-0x0000028D65211000-memory.dmp

Download

memory/4488-188-0x0000028D65210000-0x0000028D65215000-memory.dmp

Download

memory/4488-187-0x0000028D6ABE0000-0x0000028D6ABE3000-memory.dmp

Download

memory/4488-185-0x0000028D6A790000-0x0000028D6A792000-memory.dmp

Download

memory/4488-184-0x0000028D65210000-0x0000028D65211000-memory.dmp

Download

memory/4488-189-0x0000028D6A230000-0x0000028D6A231000-memory.dmp

Download

memory/4488-190-0x0000028D6A680000-0x0000028D6A682000-memory.dmp

Download

memory/4488-193-0x0000028D6A230000-0x0000028D6A236000-memory.dmp

Download

memory/4488-192-0x0000028D6A690000-0x0000028D6A693000-memory.dmp

Download