Analysis
- user interaction
yes - max time kernel
477s - max time network
554s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
23/08/2026, 23:22
General
- Target StemLab-Setup-0.9.9.exe
- Size 1674.9MB
- Sample260823-3czbeabe39
- SHA256 7801eb0cc3c9d59a1382be563ac79eaffae3aa98b1a8baea9897dbd7d36c35f4
- MD5 3713204ea076e7d9199cf2858e7afb35
- SHA1 fbb3d939fa50630345ae336883a0da388fde13ec
- SHA512 0f3c89b1f20fd291f00b769039710dacc889f79bd1b280bf848b4986e79423085bb7c1d1f2ac9615df42c7ed454d98e8d11bceeb289e7a3ae5f77e0fa6625e7a
- SSDEEP 50331648:2zUi3r+jS/E1EavgHkby5JpnGjWwbe7Cl9O3:ol3NE1EugH35JRGjWwbeoC
- TLSH T1210A333A2461E47EF91504754DF317349A192F02A386D773FBE92A1C9F334A81E2B1E6
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 3632 StemLab-Setup-0.9.9.tmp 1872 StemLab.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language StemLab-Setup-0.9.9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language StemLab-Setup-0.9.9.tmp - Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
resource yara_rule behavioral1/memory/5020-0-0x0000000000850000-0x0000000000948000-memory.dmp innosetup behavioral1/memory/5020-249-0x0000000000850000-0x0000000000948000-memory.dmp innosetup behavioral1/memory/5020-39563-0x0000000000850000-0x0000000000948000-memory.dmp innosetup - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe - Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 perfmon.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz perfmon.exe - Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchHost.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "6391" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "6391" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\www.bing.com\ = "0" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "39324" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "34936" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "2499" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "24469" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "25037" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "9649" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "5400" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "35173" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "39456" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "911" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "779" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "4611" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "72723" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "915" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "48395" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "18825" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "18825" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "41338" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "8727" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "6523" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "33573" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "23359" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "31620" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "4034" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23310" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23491" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "72591" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\NumberOfSubdomains = "1" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "33441" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "22431" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "951" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "25037" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "4611" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "9649" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "40174" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "23" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "23178" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "1009" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "6178" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "6046" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "8859" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "41206" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "2499" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "35305" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "34804" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "24601" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "2631" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "53502" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "877" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "1083" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "8727" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "24469" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "22431" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "4702" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "34804" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "40306" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\bing.com\ = "0" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "4166" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "4570" SearchHost.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3632 StemLab-Setup-0.9.9.tmp 3632 StemLab-Setup-0.9.9.tmp 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 4104 taskmgr.exe 4852 perfmon.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 4104 taskmgr.exe Token: SeSystemProfilePrivilege 4104 taskmgr.exe Token: SeCreateGlobalPrivilege 4104 taskmgr.exe Token: SeDebugPrivilege 4852 perfmon.exe Token: SeSystemProfilePrivilege 4852 perfmon.exe Token: SeCreateGlobalPrivilege 4852 perfmon.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3632 StemLab-Setup-0.9.9.tmp 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3632 StemLab-Setup-0.9.9.tmp 2792 SearchHost.exe 1872 StemLab.exe 2792 SearchHost.exe 2792 SearchHost.exe 2792 SearchHost.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 5020 wrote to memory of 3632 5020 StemLab-Setup-0.9.9.exe 91 PID 3632 wrote to memory of 1872 3632 StemLab-Setup-0.9.9.tmp 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\StemLab-Setup-0.9.9.exe"C:\Users\Admin\AppData\Local\Temp\StemLab-Setup-0.9.9.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\is-EMW76XJ3GX.tmp\StemLab-Setup-0.9.9.tmp"C:\Users\Admin\AppData\Local\Temp\is-EMW76XJ3GX.tmp\StemLab-Setup-0.9.9.tmp" /SL5="$502CA,1753665555,957440,C:\Users\Admin\AppData\Local\Temp\StemLab-Setup-0.9.9.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\Users\Admin\AppData\Local\Programs\StemLab\StemLab.exe"C:\Users\Admin\AppData\Local\Programs\StemLab\StemLab.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1872
-
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2792
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5588,i,5745994486316145103,18096483013800577271,524288 --field-trial-handle=1960,i,13088069629290216405,12336415750006792294,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5512 /prefetch:141⤵PID:3312
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5536,i,357797957735367581,3994694088769057107,524288 --field-trial-handle=1960,i,13088069629290216405,12336415750006792294,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5888 /prefetch:141⤵PID:2844
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5528,i,13435522703222226247,15265210074158685369,524288 --field-trial-handle=1960,i,13088069629290216405,12336415750006792294,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5928 /prefetch:141⤵PID:4428
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4104
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:700
-
C:\Windows\system32\perfmon.exe"C:\Windows\system32\perfmon.exe" /res1⤵
- Checks processor information in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4852
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\INetCache\RHAWU5XH\thPJQYNU66.jpg
- Size 626B
- SHA256 706d1812a041125ca3fbb6adc976181494f57d189df778eddb2aa4a0bb56d3db
- MD5 c119b0672a60d0b7783559a669d8b335
- SHA1 612802317e047624d7c349025dae8ea3c0cb80bf
- SHA512 84955f65aae44d7a853ef113e43f0dcdc7658c210aac34311283f3ad7ae1a47f6e1165c1a947f7c1c6caeb5a20947fa552b0a359cf9c8b925272320070edacaf
- TLSH T10EF0207B6BC23816CC4B43B19A2093962F05BA47BD11AE4D039E4414EC6C089CE18B6F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\IMEQ2EM9\www.bing[1].xml
- Size 73KB
- SHA256 0f18cfc75b87ede3021796992da744effc83033ff622247778ae953eb695e25f
- MD5 a4667fbd8c2e8eb1105e306f22df60e2
- SHA1 f28a570a4f15cca77a4a0fe02246554c08a5412e
- SHA512 88830f01ea99e321ca085cc60a4b3d2d078f981ed8d0e0535d0d5592fbcea7580f94b208867624a326832c1e79540733fd2c543f44460ab0dbe1b850c300bdef
- SSDEEP 384:Lq720y0tXFzmgf86iEw8wZbuxq934uplFWsTFyDe1r8uAhs48AqHSQ0U6rOQTEUy:Lq8vjsuVSQSYNo0UFilQLlfo
- TLSH T164738669D2F3427915AE7AAEE1206F7B16CBC71B27E537F65080099E0F8426DDD030AD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\IMEQ2EM9\www.bing[1].xml
- Size 44KB
- SHA256 79d383f3fbc6499378d72611d400c22c8d8ba79e4bd1aa4dbfba2b288fe1b46e
- MD5 663fd277e1b38a71488abfd5958bef58
- SHA1 815dbf1267448320b2a63433ac8bcd9898e6573d
- SHA512 6df72968e57e923045ec9a8ef04afefd84262aefc5c01cad049075f89ab23bfc8b5debb4bf39ff90f2db0883bcba2d05fb8441bf98160c88a92eca2dac976d44
- SSDEEP 384:Z/VXFzmgf86iEw8wZbuxq934uW/QTEUu4Bg7hQUoYJ+p7VfCqYIrTeR2PvSCwu+:UjINoSsPvSCwu+
- TLSH T12D13737AD2F3457955BE7AAAE1206F7B16C7C70B27E537FA0080498E1E8426DDD030AD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\IMEQ2EM9\www.bing[1].xml
- Size 88KB
- SHA256 7e3177889eabe917b5d73f8486ded98ae562dbc80e27acc6c173233f503cf359
- MD5 5afed8a0917e65b8557d27aa930cf6d2
- SHA1 a327a147469ce0f6429dd36d17110d6cec1ce304
- SHA512 7b80ccf69c576bc9cfd8b6268056ffedb6bf463b2e0fdf9e5678967d444e02e50f60b7c40d7f0386abdea285a21654751ec1107da32545847ed90245bc512093
- SSDEEP 768:S+yprQ58nEtPXMyBjoKyPK6J2m3oEEXfq4i4FRWzY4g4jiRX:S+yFQ54IaTj3DEXfq4i4uzY4g4+RX
- TLSH T129937369D2F3467A54AD3A6AE110BFBB16CBC70B67E537F640404A9E0F8426DDD030AD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\IMEQ2EM9\www.bing[1].xml
- Size 14KB
- SHA256 6afd59b709e12dd67a415782ce7e0966666bfcfdc0459c41e2c34a988b528349
- MD5 df4fe2d7d90550432d296f9014df2b92
- SHA1 5a650def63c64356c60c5fd4b862b29be8b5df8d
- SHA512 039c5264d61f29311a99347dd7441f94675c8e52b454bdbd387d014bbe578bb255c11b7fb43fde0d5c145697458c239b6a937a31e9d9a2dbdc0192e593489cf9
- SSDEEP 384:bndWn+FDOxxQOxxWKWFIWmHx8HxWKWFIW2BqAX:x6+E9WKWfkGWKWf2sm
- TLSH T10F62BB39E1F38F7E486C7525E680778917DBD70BA7EA3BFA841869941B5860E2D130CC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\StemLab\StemLab.exe
- Size 8.1MB
- SHA256 ffa9c6d4677f4ac49010b40643da2c56d38a843d548c00a4c7ac309973d4b006
- MD5 2fef842e49cacfd7b05056898ec2c40a
- SHA1 3806283927703ad42c3befcde556a071c8585ab3
- SHA512 de49b5949d569ad78cb0845221eb83f008dc5d30db1b736f3d5c4fdddec70a692d02750e4177b84d75f854a23d2e82a069a7914b813ded271cc9fc5749234e89
- SSDEEP 98304:W8NpdAIeLiu+HJFPNCBmUIU4BBBBlUMdwk:Wypydu7FCBmUIU4BBBBlUMWk
- TLSH T14686AE83B16914C9D2ABC13D8686A517E7717C1C4321DBDB199096AABF23EF14F7E320
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\StemLab\Engine\Lib\site-packages\beartype-0.22.9.dist-info\is-0KN5N1QM7H.tmp
- Size 4B
- SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
- MD5 365c9bfeb7d89244f2ce01c1de44cb85
- SHA1 d7a03141d5d6b1e88b6b59ef08b6681df212c599
- SHA512 d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\StemLab\Engine\Lib\site-packages\fsspec-2026.7.0.dist-info\is-N4Z4P50GTN.tmp
- Size 87B
- SHA256 942926c567d0b1273d09f20295879abd37507845f6b683eab9f87d808df91100
- MD5 6ee29c290e44c91f37458c68f987b3ca
- SHA1 5b1b2a4dba5bb0483679b9af5f9dd2e8107460fb
- SHA512 1a27a258f38659f5fd105203543b2924bc21a7921bb2152e0c3e83532d62407eb3bea4463f41fd7193ebd2666e23351bea5914d9c5b4d4530885e3abf49c0da8
- TLSH T10FB01224014004F41C10FF13402C64241620C245A4A52039D44601807907C0402EED6A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\StemLab\Engine\Lib\site-packages\julius-0.2.8.dist-info\is-5E5DVU8LG0.tmp
- Size 87B
- SHA256 aad0b0a12256807936d52d4a6f88a1773236ae527564a688bab4e3fe780e8724
- MD5 e2fcb0ad9ea59332c808928b4b439e7a
- SHA1 07311208d4849f821e8af25a89a9985c4503fbd8
- SHA512 d4cb3ca64d69678959c4f59b4d1cb992e8e2e046a6acb92341fd30b8ce862bd81a48cbfa09ec9ae2e735ffec5c12d246d1593a859615adee10984635a9ba8af9
- TLSH T19CB01224014004F41810FF13402C60241620C205A4A52039D44A01407506E1502EDC6B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\StemLab\Engine\Lib\site-packages\packaging-26.3.dist-info\is-IZOWW1Y32A.tmp
- Size 82B
- SHA256 1b68144734c4b66791f27add5d425f3620775585718a03d0f9b110ba3a4d88db
- MD5 eca1d2e32987c5c9fd85f21a0c92d672
- SHA1 918c96cf4b87d846161401284f9bf811c56b5fcf
- SHA512 c4256b480eefa97b455e5e0f716884b554edb99c7a3e4b116a46590c63acf14ea14ff52c5814f5c8bfca2b4a309bda65de07b72fe8731a235478eb7e5e7e2d7c
- TLSH T170A01218014004F80090FE034239A1281A308509646500B5948101445545D0802C8DBA
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\StemLab\Engine\Lib\site-packages\packaging-26.3.dist-info\licenses\is-MDNFXFYM67.tmp
- Size 9KB
- SHA256 0d542e0c8804e39aa7f37eb00da5a762149dc682d7829451287e11b938e94594
- MD5 2ee41112a44fe7014dce33e26468ba93
- SHA1 598f87f072f66e2269dd6919292b2934dbb20492
- SHA512 27b8c0252eae50ca3ce02ab7c5670664c0c824e03eb3da1089f3f0a00d23e648a956bcb9f53645c6d79674a87c4cc86d1085dc335911be0210d691336b121857
- SSDEEP 192:nU6G5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLhP:U9vlKM1zJlFvmNz5VrZ
- TLSH T18822512FBB48037B06C20162A79764CBF31E903F3B552568314CD1681F6B96593FB6AA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\StemLab\Engine\Lib\site-packages\pkg_resources\tests\data\my-test-package_unpacked-egg\my_test_package-1.0-py3.7.egg\EGG-INFO\is-8LLUSGCCMS.tmp
- Size 1B
- SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
- MD5 68b329da9893e34099c7d8ad5cb9c940
- SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
- SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\StemLab\Engine\Lib\site-packages\sphn-0.2.1.dist-info\licenses\is-MANYDBED3R.tmp
- Size 11KB
- SHA256 1eb85fc97224598dad1852b5d6483bbcf0aa8608790dcc657a5a2a761ae9c8c6
- MD5 d229da563da18fe5d58cd95a6467d584
- SHA1 b314c7ebb7d599944981908b7f3ed33a30e78f3a
- SHA512 e2f81cb44129e1bc58941e7b3db1ffba40357889bace4fd65fd254d0be1bb757625bdf36bf46d555eb3ca4b130dcd1c05225caec28d8472dccf52a63dbd6e185
- SSDEEP 192:ff9qG4QSAVOSbwF1wOFXuFJyQtxmG3ep/7rlzKfHbxc+Xq0rhlkT8SHfH2:9Ou9b01DY/rGBt+dc+aclkT8SH+
- TLSH T1A832832BBA4903771AF20122AB4764CEF31EA03F37591525315CC1682F7B96583FB69E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\StemLab\Engine\Lib\site-packages\torch\_functorch\_activation_checkpointing\is-AL9K92L5WK.tmp
- Size 211B
- SHA256 2503152d1a0508aa3adbd290ff5beee22d74466930c3c1163326670cb1065da8
- MD5 052b9d2e09396eb0697c050c8bf41139
- SHA1 16049b3ca4f50c398196d268535e6157a534a7c8
- SHA512 9f85a48ae69d89509e13c99a65143749c85c5fafe055a1af77810cb29638c0e3fa1356d3b5d69b97c732bbd35c61e74a894cd43f61d0df051947397410e0f5ad
- TLSH T137D0223E238CA2330230C413630EA2CEAB0C2894A33F306BA9248308223283E43A4C90
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\StemLab\Engine\Lib\site-packages\torch\ao\nn\qat\is-736P9FRGW2.tmp
- Size 38B
- SHA256 b04fb4aaf5e74d8e629432aec768d9ba4371ce4791f86da6941a79b2cd9be329
- MD5 54a7946252f28e14598915be3050508e
- SHA1 8c456681871f607004826b8b1fc9588aba0bc337
- SHA512 01e264aa91128e202dd2505e5b55f359c1082056b41ce2c85470b368b14475db7b3fea3391a0aeda56dcc218489de8a33fd0a36cca4507399fc8ae7978e0c792
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\StemLab\Engine\Lib\site-packages\torch\include\ATen\ops\is-7V0Q18DYEG.tmp
- Size 701B
- SHA256 617ece9df35bfec1f4b2139e84ae4889c52c980faaa907203ec579977995c667
- MD5 a9f3d0826262b1e81744ad027afc1d7e
- SHA1 241d78a3c5e8693993d2e7e0d453e010e5936931
- SHA512 a5627db11b837afc0419bfb2ef1a6fb56547afaffdd10981456af9dab87e9f4705f456489bc90d21200c4300bad58c1fcf7a070a3f61c9febfbde82752f2f951
- TLSH T149014CB5B5EF221984B391E33387F451521DB1A6D7827BB16C50B1DAF8002C927CFA9B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\StemLab\Engine\Lib\site-packages\tqdm-4.70.0.dist-info\is-AMTSDDSO1W.tmp
- Size 91B
- SHA256 2b6eb4118ce7cd7b09601406aa623c553c4476265836f0d9c16f5c061f7efcc0
- MD5 d8484b2712d6275b37660ce7c74212ff
- SHA1 e28579fb4ecc8d36e494d12789590d234e656931
- SHA512 750688b867d714e8f1894966b2f117b453aef8e8a69eaaf904e40ce183d5a0d8a092cce7cc713b1ba5a66779edf87ecca86eb869122ba08b5018550069cefbc7
- TLSH T108B01215094014FC54A0EE134074A1201B6085455895707DF04A03446549D4406CDC5E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\StemLab\Engine\Scripts\is-0INKAZJ0XT.tmp
- Size 105KB
- SHA256 3f300c8e0c2ca0a83456eebeaebf310f0a31a3fe5e0dd25fdbb754d5177e2c4f
- MD5 aeb52ce6d8a5d3611592b8e5a673a47f
- SHA1 6f83e1e16f6ba628374cc3e60f38ec0f3a83994a
- SHA512 78181034aa6a7c04288b8ea9c6a64f3a1dcd3a693d8d79e1bdeb8dcd256be3fc4fc0ff5ca87e24ae548a7331b41258fcfe4a18b687583084013a322f9e9da6d7
- SSDEEP 1536:1966Spw1RSGXwStXQR1mTqZh52bAGXHnDtCdGgYluexaNSxFfHYTo+GtC:j8wDSRUT0kbAYn2GgYlBYN2fHYTo+kC
- TLSH T1FCB36A0A33D420FDD0675274CDB68A15D3B2BC2A4274934F27A47B6A1F733926D2E722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-EMW76XJ3GX.tmp\StemLab-Setup-0.9.9.tmp
- Size 5.0MB
- SHA256 d0ecb1daa8c480bc1fc8b6eb2fa535e10ae69ed2d7f6aa3c6a1c1fdbb7f0fcb5
- MD5 0e285b6eaadc267b5107b4109bc65710
- SHA1 5c6da9adaf7f70d6771dac01978ac18cfd1303f0
- SHA512 812f733dfcea73efacd9742cc2066a404b709cd4723a064e81f9e79e184167bcf4bdb41819c6ace2fbe92e3032a7962c8b928ec3e64feb7d052d21632e820328
- SSDEEP 98304:hvdHRh7Vhv2Wn+FYGa7xP2gRQJhu0dgmC333p333+t+:LHLn+eHNt0u0d3w
- TLSH T145369E23B384A53ED4671E3A687FA649583FBA203A16CD476BF40D5C4F396402D3A787
- MD5 SHA1 SHA512 SSDEEP TLSH