HKCU\Software\MartinPrikryl\WinSCP2\Sessions

Posts referencing this indicator

• StealC and Amadey: Breaking down infostealers and the cybercrime services that deliver them

  MMicrosoft

  StealC reads saved WinSCP FTP/SFTP session credentials from this registry key, reversing WinSCP's custom password obfuscation.

  2026-07-01