StealC (st.exe) process accessing browser credential store files

Ethan Andrews@eandrews

•updated Aug 4, 2026•1•0•3

Detects the process st.exe (identified as StealC / TrojanPSW:Win32/StealC) executing and subsequently accessing well-known browser credential store artifacts (Login Data, Cookies, key4.db, logins.json, Local State, Web Data) used to harvest stored passwords and session data from browsers.