59374e72382a7ae14321a17f5f46e5793e7813c638ea93fb240f6f4046dce73c

Analysis

user interaction
yes
max time kernel
150s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20251231-en
resource tags

arch:x64arch:x86image:win10v2004-20251231-enlocale:en-usos:windows10-2004-x64system
submitted
18/01/2026, 03:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Panther-Stealer_1.1.zip
Size 1.3MB
Sample260118-egyzfaet2c
SHA256 59374e72382a7ae14321a17f5f46e5793e7813c638ea93fb240f6f4046dce73c
MD5 0f5afcb6523742996ac1a2a3658fde88
SHA1 21ce283a82027fe3881740c743fb87cd851d5d79
SHA512 74ff877c5c32a99bca53d1b6b6dd5b9fbeaaa0c92f3fbbb6b329884491bf557cfad4dc5ce6434490f2b39fc5eab30ff7b5d11fc68fd0514e3448aee1d206f21f
SSDEEP 24576:soZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaR3MU9Q:soZ9bq+MmMEL+hcjXHC/wnwd3MU6
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
125	raw.githubusercontent.com
129	raw.githubusercontent.com
130	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6088	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134131821903860826"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1017923329-3442370593-12565554-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1017923329-3442370593-12565554-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1992	chrome.exe
1992	chrome.exe
1992	chrome.exe
1992	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1992	chrome.exe
1992	chrome.exe
1992	chrome.exe
1992	chrome.exe
1992	chrome.exe
1992	chrome.exe
1992	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1992	chrome.exe
Token: SeCreatePagefilePrivilege	1992	chrome.exe
Token: SeShutdownPrivilege	1992	chrome.exe
Token: SeCreatePagefilePrivilege	1992	chrome.exe
Token: SeShutdownPrivilege	1992	chrome.exe
Token: SeCreatePagefilePrivilege	1992	chrome.exe
Token: SeShutdownPrivilege	1992	chrome.exe
Token: SeCreatePagefilePrivilege	1992	chrome.exe
Token: SeShutdownPrivilege	1992	chrome.exe
Token: SeCreatePagefilePrivilege	1992	chrome.exe
Token: SeShutdownPrivilege	1992	chrome.exe
Token: SeCreatePagefilePrivilege	1992	chrome.exe
Token: SeShutdownPrivilege	1992	chrome.exe
Token: SeCreatePagefilePrivilege	1992	chrome.exe
Token: SeShutdownPrivilege	1992	chrome.exe
Token: SeCreatePagefilePrivilege	1992	chrome.exe
Token: SeShutdownPrivilege	1992	chrome.exe
Token: SeCreatePagefilePrivilege	1992	chrome.exe
Token: SeShutdownPrivilege	1992	chrome.exe
Token: SeCreatePagefilePrivilege	1992	chrome.exe
Token: SeShutdownPrivilege	1992	chrome.exe
Token: SeCreatePagefilePrivilege	1992	chrome.exe
Token: SeShutdownPrivilege	1992	chrome.exe
Token: SeCreatePagefilePrivilege	1992	chrome.exe
Token: SeShutdownPrivilege	1992	chrome.exe
Token: SeCreatePagefilePrivilege	1992	chrome.exe
Token: SeShutdownPrivilege	1992	chrome.exe
Token: SeCreatePagefilePrivilege	1992	chrome.exe
Token: SeShutdownPrivilege	1992	chrome.exe
Token: SeCreatePagefilePrivilege	1992	chrome.exe
Token: SeShutdownPrivilege	1992	chrome.exe
Token: SeCreatePagefilePrivilege	1992	chrome.exe
Token: SeShutdownPrivilege	1992	chrome.exe
Token: SeCreatePagefilePrivilege	1992	chrome.exe
Token: SeShutdownPrivilege	1992	chrome.exe
Token: SeCreatePagefilePrivilege	1992	chrome.exe
Token: SeShutdownPrivilege	1992	chrome.exe
Token: SeCreatePagefilePrivilege	1992	chrome.exe
Token: SeShutdownPrivilege	1992	chrome.exe
Token: SeCreatePagefilePrivilege	1992	chrome.exe
Token: SeShutdownPrivilege	1992	chrome.exe
Token: SeCreatePagefilePrivilege	1992	chrome.exe
Token: SeShutdownPrivilege	1992	chrome.exe
Token: SeCreatePagefilePrivilege	1992	chrome.exe
Token: SeShutdownPrivilege	1992	chrome.exe
Token: SeCreatePagefilePrivilege	1992	chrome.exe
Token: SeShutdownPrivilege	1992	chrome.exe
Token: SeCreatePagefilePrivilege	1992	chrome.exe
Token: SeShutdownPrivilege	1992	chrome.exe
Token: SeCreatePagefilePrivilege	1992	chrome.exe
Token: SeShutdownPrivilege	1992	chrome.exe
Token: SeCreatePagefilePrivilege	1992	chrome.exe
Token: SeShutdownPrivilege	1992	chrome.exe
Token: SeCreatePagefilePrivilege	1992	chrome.exe
Token: SeShutdownPrivilege	1992	chrome.exe
Token: SeCreatePagefilePrivilege	1992	chrome.exe
Token: SeShutdownPrivilege	1992	chrome.exe
Token: SeCreatePagefilePrivilege	1992	chrome.exe
Token: SeShutdownPrivilege	1992	chrome.exe
Token: SeCreatePagefilePrivilege	1992	chrome.exe
Token: SeShutdownPrivilege	1992	chrome.exe
Token: SeCreatePagefilePrivilege	1992	chrome.exe
Token: SeShutdownPrivilege	1992	chrome.exe
Token: SeCreatePagefilePrivilege	1992	chrome.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
1992	chrome.exe
1992	chrome.exe
1992	chrome.exe
1992	chrome.exe
1992	chrome.exe
1992	chrome.exe
1992	chrome.exe
1992	chrome.exe
1992	chrome.exe
1992	chrome.exe
1992	chrome.exe
1992	chrome.exe
1992	chrome.exe
1992	chrome.exe
1992	chrome.exe
1992	chrome.exe
1992	chrome.exe
1992	chrome.exe
1992	chrome.exe
1992	chrome.exe
1992	chrome.exe
1992	chrome.exe
1992	chrome.exe
1992	chrome.exe
1992	chrome.exe
1992	chrome.exe
1992	chrome.exe
1992	chrome.exe
1992	chrome.exe
1992	chrome.exe
1992	chrome.exe
1992	chrome.exe
1992	chrome.exe
1992	chrome.exe
1992	chrome.exe
1992	chrome.exe
1992	chrome.exe
1992	chrome.exe
1992	chrome.exe
1992	chrome.exe
1992	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1992	chrome.exe
1992	chrome.exe
1992	chrome.exe
1992	chrome.exe
1992	chrome.exe
1992	chrome.exe
1992	chrome.exe
1992	chrome.exe
1992	chrome.exe
1992	chrome.exe
1992	chrome.exe
1992	chrome.exe
1992	chrome.exe
1992	chrome.exe
1992	chrome.exe
1992	chrome.exe
1992	chrome.exe
1992	chrome.exe
1992	chrome.exe
1992	chrome.exe
1992	chrome.exe
1992	chrome.exe
1992	chrome.exe
1992	chrome.exe
1992	chrome.exe
1992	chrome.exe
1992	chrome.exe
1992	chrome.exe
1992	chrome.exe
1992	chrome.exe
1992	chrome.exe
1992	chrome.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 2340	1992	chrome.exe	110
PID 1992 wrote to memory of 2440	1992	chrome.exe	111
PID 1992 wrote to memory of 2440	1992	chrome.exe	111
PID 1992 wrote to memory of 6088	1992	chrome.exe	112
PID 1992 wrote to memory of 1804	1992	chrome.exe	113
PID 1992 wrote to memory of 1804	1992	chrome.exe	113
PID 1992 wrote to memory of 5004	1992	chrome.exe	115
PID 1992 wrote to memory of 5004	1992	chrome.exe	115
PID 1992 wrote to memory of 5092	1992	chrome.exe	116
PID 1992 wrote to memory of 5092	1992	chrome.exe	116
PID 1992 wrote to memory of 5724	1992	chrome.exe	117
PID 1992 wrote to memory of 5724	1992	chrome.exe	117
PID 1992 wrote to memory of 5776	1992	chrome.exe	118
PID 1992 wrote to memory of 5776	1992	chrome.exe	118
PID 1992 wrote to memory of 3352	1992	chrome.exe	122
PID 1992 wrote to memory of 4416	1992	chrome.exe	126
PID 1992 wrote to memory of 4416	1992	chrome.exe	126
PID 1992 wrote to memory of 5336	1992	chrome.exe	127
PID 1992 wrote to memory of 5336	1992	chrome.exe	127
PID 1992 wrote to memory of 3664	1992	chrome.exe	128
PID 1992 wrote to memory of 3664	1992	chrome.exe	128
PID 1992 wrote to memory of 1536	1992	chrome.exe	130
PID 1992 wrote to memory of 716	1992	chrome.exe	131
PID 1992 wrote to memory of 1700	1992	chrome.exe	132
PID 1992 wrote to memory of 3344	1992	chrome.exe	134
PID 1992 wrote to memory of 3344	1992	chrome.exe	134
PID 1992 wrote to memory of 4960	1992	chrome.exe	135

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Panther-Stealer_1.1.zip
1⤵
PID:5204

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1700

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffd1f56c728,0x7ffd1f56c734,0x7ffd1f56c740
  2⤵
  PID:2340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1768,i,12075696098693409397,7310272603991370823,262144 --field-trial-handle=2056,i,7323035985083633680,13806983119835147040,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=2052 /prefetch:2
  2⤵
  PID:2440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2184,i,17502082717298393162,13715717657182836102,524288 --field-trial-handle=2056,i,7323035985083633680,13806983119835147040,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=2336 /prefetch:3
  2⤵
  - System Time Discovery
  PID:6088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2448,i,17292811034883469686,16728143849971394499,524288 --field-trial-handle=2056,i,7323035985083633680,13806983119835147040,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=2616 /prefetch:8
  2⤵
  PID:1804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3272,i,6192482035962796811,17311637498550224570,2097152 --field-trial-handle=2056,i,7323035985083633680,13806983119835147040,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3292,i,8142469299312755992,9571807202206142960,2097152 --field-trial-handle=2056,i,7323035985083633680,13806983119835147040,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4132,i,13753659622037673203,8285017796351275402,2097152 --field-trial-handle=2056,i,7323035985083633680,13806983119835147040,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=4148 /prefetch:2
  2⤵
  PID:5724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4764,i,1128039461317742862,9890187863039957282,2097152 --field-trial-handle=2056,i,7323035985083633680,13806983119835147040,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:5776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5508,i,1659217476967284508,15960106621607484986,524288 --field-trial-handle=2056,i,7323035985083633680,13806983119835147040,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=5484 /prefetch:8
  2⤵
  PID:3352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5756,i,4375151145252042298,5553035581443800152,2097152 --field-trial-handle=2056,i,7323035985083633680,13806983119835147040,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:4416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3512,i,15359983544237013545,13513258661013482566,2097152 --field-trial-handle=2056,i,7323035985083633680,13806983119835147040,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:5336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5848,i,7449798470673842891,5614466949716923349,524288 --field-trial-handle=2056,i,7323035985083633680,13806983119835147040,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:3664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4080,i,10307308381564122966,6009553140000971117,524288 --field-trial-handle=2056,i,7323035985083633680,13806983119835147040,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  PID:1536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5940,i,11630946896863932945,3472541280673003778,524288 --field-trial-handle=2056,i,7323035985083633680,13806983119835147040,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=3276 /prefetch:8
  2⤵
  PID:716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3320,i,6556711258608919874,5876213505592010502,524288 --field-trial-handle=2056,i,7323035985083633680,13806983119835147040,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=3348 /prefetch:8
  2⤵
  PID:1700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=4164,i,10779206681679839236,1057126825296354085,2097152 --field-trial-handle=2056,i,7323035985083633680,13806983119835147040,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=4172 /prefetch:1
  2⤵
  PID:3344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4488,i,12242952195412558842,11738273459341958320,524288 --field-trial-handle=2056,i,7323035985083633680,13806983119835147040,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=3988 /prefetch:8
  2⤵
  PID:4960

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1904

C:\Users\Admin\Downloads\Panther-Stealer_1.1\luajit.exe
"C:\Users\Admin\Downloads\Panther-Stealer_1.1\luajit.exe"
1⤵
PID:912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 a0fa44dad0870eee11255659799775c8b62652b7a69737ff48c079fc523811d2
MD5 0dd984502a6d7962df425faa9c2d9d2f
SHA1 2bccdc6021f37d54f0dff2d1bb0be54405461964
SHA512 fe40ae6c081357a325e770b06f9eea0bafc5c942bf812f3ff12f3e8b244b2033e4c0c8211b098581df5bfc4911579c9304cdb7a93449ee67f2d7fbd1a6b2526c
TLSH
T183F0F4A6C921AC2B18FD1B2960981A4AEB91173B3B51595F3B3C810C8FB063B8695C1C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 0488694bc5a9da83840c09757f0ec18c6c19ee1a83001843a443b4decbebad69
MD5 bfd9c40cc4e0e2bda32d6728739cd5ca
SHA1 66189bb0c1fb3afbedc7060846f56f8a79584fc4
SHA512 fd0f703ebde22e8b486b85c169c5320690bf7a60c21f1be5114c0e399c8e255d81f0ecd37758be189d43083af1151dafcfb7d5252e69e6941e0dd95f81c1b3cd
SSDEEP 96:0nCnvdC+MHSu0IRPUPklKQiCCSZB3krvZipRkdT+3pMDekHx5ybeM2vGx:0nR4ImUC1QaHxNGx
TLSH
T1FF81823392708214DB4D11F828C6B970BEF0E6E51F6B2E7F02D76AF858423A62739711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 39cb33247f7270ecd90b8b5cfea1a3ffe033d67edb07efce5556d2e0117bea05
MD5 3a8c0537cc968c496fa5f9d08e7bb338
SHA1 ce542c1b5ade8e4d558ec79a64ef6425faaa7061
SHA512 8e2107504a5aefd76dd4e8fcac4dc679afba63f31b2729f534ba24cb9bc94c2a6d012fff827f5073511ff7d2f097300dbfed9d3f3e817130a4a93995b734ba3f
SSDEEP 192:Db4+oSL/krfUmr7tt5bHmtmDmgmDDmNsmqluBiv:Db4+oSL/krfUmr7n5bHmtmDmgmDDmNsn
TLSH
T1EAD18EF3C3E8957D8A0155F4AB19AF1FCE690A14536D3C6AC4D4AE4B93E2C71E24068F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 14b484775b5b9e5109619ca35aaf36a439d89f91ce26a6c5e75acfe294c753d1
MD5 779030a022330d743a4bcae07895bf11
SHA1 bcb84f9a155819d291cc76476fcd6688bc8e95df
SHA512 e06ae890fc95a9804ca2d5acbff216cb903b1bda1472bbbf446e68a47effe245dcd0e4785271982ef8a58e35e813fe9f7dfc125f5d80217b3b133314fe6d8b41
SSDEEP 192:hRFcBzeeurAV96MQv75h3PRpXRkitw9mfdHsb+WNWL1LTXIkc+gw2Spec2OvxVyr:hRFmzeedDMlZX8kfNwI3cm2422Xe
TLSH
T15C52C72ABD14793B5CCBC229F9657B27E7F5102160D42E88EAFC891C15E76CD721701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 e027838eb3833875423dcd26881cc41567a1fc773b3e97f6baaa1cb229fa135a
MD5 bfe8fb330e636665f4887b20b7e8b7dd
SHA1 ce000d60bb3d7dd661c6c1a7b9183a679bdbdcd3
SHA512 2dc99cb50eccd116b93b2fc05233e0a0149ab8c7711b5b4b6169d2a98754c6fb3b10b391713baf435561669c1516d57114411b6ffe0f440d43a9a81434302671
SSDEEP 192:hRZieurAV96GQv75hAPRp2K9mfdHsb+WNnTXdipec2OsxVyIsnAUgtaJ:hRZied7Ml8XJkfNwbdI27X8
TLSH
T1FC42A52DAE14753B5CCBC22AE9663B53E7F5102131952E88EEFC892C15EB9CD721701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 c1b53efa756550f4db0f155f4d659d0e3b31ab4e8330cd02c1aa3cb59d9963f3
MD5 ce4b4678fb5635255d54ef0d73c0b363
SHA1 62911aa18aaba63769fb26f010ded8146bbaefb1
SHA512 f183aa0f8c31dfa813a94e2907ecc2a107fe532c1c2a00358aadce2be24021c67144058785d4ef5facc85220c1d25aa2edeca5a221726a36242cd0a1730b36a7
SSDEEP 192:hRFcBzieurAV96MQv75hAPRp2riLtw9mfdHsb+WNWL1LTX7gw2bpec2OsxVyIsnH:hRFmziedDMl8XkkfNwI3H2v27X8
TLSH
T1F252B32AAA24753B5CCBC22AF9657B27E7F5102170D42E88EAFC891C15E79CD721701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 789cfcc9da9fc57056986fbb9a3c7c829e94e1054c2cee08b515e33059583a58
MD5 eb6da5040a7b9ae42c13a2c739e7cb6c
SHA1 f5febd6cc3f80b6b0d384eb0ae7e70348d241a4d
SHA512 4f82be23b5458ddd8842b7b2120cef17487b7a357c2f881d37fb038cc63d4dc5b03d0bfb67a2b3bbac80ed4e4d6f81619d4fe22aef65c8c1319db570f554437f
SSDEEP 384:RPjFk7KxkXqKf/pUZNCgVLH2Hfgsla17pLuLci872XODFM+ErU3FhHGNApLOZhZ:R7Fk7KxkXqKf/pUZNCgVLH2HfgsY17p6
TLSH
T1AF720977B84C9A3B0F94C6CCD817BA4FADB5024B61DD88A847FA582903D5ADF110A1F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 e4dec19b62a5ea9ac1d5dd5e156e2b436b5d8b95a58275de4783b8e37707dee4
MD5 458f2a728ced7827c0f4de72989090fe
SHA1 417f846697047b52a2cddd14cbdc006d29b5926c
SHA512 6d0532a4298dbec9eb53fb1b5b6d1d518695465b2027fa8b18b29c52e36bbdc0229064861001be807c162b09a641fe8bb0dd99223b5e81718d4f37769c9c9eeb
TLSH
T1D9B02440C40351CDC04703F4154434FC311CDF31C705030151F15D35DC35D704355050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe584dbd.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe584dbd.TMP
Size 96B
SHA256 73b08eed913840234b84a5001f2b5344953374657e63d75519c31a02e2f2736b
MD5 687a2fa75051fed64d7bd150cdea6286
SHA1 6d0325de9414de47430cfdc1c7d721299252e910
SHA512 a8d330d6a585fa9a573a9526192512c8ae1c1de9572a853d509242d7d56474bfa6cca2912928238b332dad17fe6cfbe347dd5dc0dce77f278613da272323ab55
TLSH
T19CB0220AC0022203C00A03B02A8AA2E83020CF20C203038382E00AB2EC28AF00022C30
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 6fcd6a90f9f74c89303389f66f1364d5e43bb31621b36f5caf2dc4804dc3d339
MD5 e4a48f14d2d5a73479799a60cbb8c00e
SHA1 0ee4f26ab32c42e8b35a058634d055705984a47d
SHA512 9752c23a58d9320b9a60ae069724bb0f2094d6df1b23b7b931d79e6c2e67b7e8533b2bea18671f57029e1a54533ffec2a2746d3ca570456bcf49f599d4813bff
TLSH
T13DA0023381628012C4580274608F425027D048988317521188D401A4A874E949545402
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 164KB
SHA256 eea22d51b25d058c5e3fce4ed9b7e480196184f8e24e9ab7b168bdcacac8d0e2
MD5 1784bcbd78eca38339b96c67276f9366
SHA1 981eec8cf8e6339b96f331cbafea5e3f0cf89b02
SHA512 6483c06341c7c42e7e7afcb85b68ca5741725488b2fc750c8b1b50e10dd0e1eab730b07d63ec047f509b14c46240db79ffd9a43a9fe925358086ad517766ad1e
SSDEEP 3072:5K3TB6o7wd07G45mzmDItNJUJtPgGd8AkcsxHwL54VOF7pUiw9OTvwqh0wi:5spiFQwNJi55kcsxHwL5CE09PYi
TLSH
T165F312315C187E9EB9B3BB6E071B4E9FDAA186E3D40C9F4C43650FAD044556C0BE6A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 84KB
SHA256 4f5e99606aa8d2dcc195d20be98b55b475779ed41c88902a5b725cb3b4752fb3
MD5 e53b7cdfb7303316e8a09142e2438377
SHA1 d6f52413a3be4bacb01d1821191b0b6a316271ea
SHA512 a68ca7755b6916fe390d4b83df358f905f3c4932131e44f06e3070a05cf74fc135c5678cd56278f3b552b0e296661a631f9c90b021099383c06de477d6d7ba03
SSDEEP 1536:myexC6wySzlcl92uqWCh1AOTFzXE8ICAiFziTiw9OEYc4VRi+I/Ymqq0l:lexHwL54VOF7pUiw9OTvwqhl
TLSH
T1658301136E05BEAF597BABEF5B4D0FAFC5B1829350096B4C479E4EB8468206953F4308
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 163KB
SHA256 c44b1d583758b120e4e36f1e1dadc507ad6088ba4a3728ca4ff981215e4c15b8
MD5 d88fea9db6d89afc04f06b5ea1b5d735
SHA1 bb4613a191176185f5db3a8e252227af71e9e466
SHA512 b3685ae28fb032b9e1d8c8ec9e740d10f604191095f95057c8038e4b9ac2f3a214aaab10283406573d19aba24a927d5e973434c8b8bc82244d1f85144ab08dd0
SSDEEP 3072:93TB6o7wd07G45mzmDItNJUJtPgGd8AkcsxHwL54VOF7pUiw9OTvwqh0wi:tpiFQwNJi55kcsxHwL5CE09PYi
TLSH
T15CF312215C197F5EB9B3E77E071B499FD67186E2D00C8B8C03A54FBD048556C0BE6A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 163KB
SHA256 9e9efa5fde5731cf531008c3946dede0c754d70e1cd5149403bc615840f5b8a4
MD5 9c2a99dcb67b44694840ff88b459884c
SHA1 c7d5bfad6dde806ec670cc5010ff3a7c15bd09b4
SHA512 ba44e20c2d23e67155678fda391c735aff6d509763b522d0c56444becaf8473808827304bf7f24f47a18c832109caad401c8376edd43ec2632dfcf7403c50f75
SSDEEP 3072:S3TB6o7wd07G45mzmDItNJUJtPgGd8AkcsxHwL54VOF7pUiw9OTvwqh0wi:kpiFQwNJi55kcsxHwL5CE09PYi
TLSH
T1F2F312215C197F5EB9B3EB7E071B499FD67186E2D00C8B8C43A54FBD04855AC0BE6A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Panther-Stealer_1.1.zip.crdownload

Path C:\Users\Admin\Downloads\Panther-Stealer_1.1.zip.crdownload
Size 1.3MB
SHA256 59374e72382a7ae14321a17f5f46e5793e7813c638ea93fb240f6f4046dce73c
MD5 0f5afcb6523742996ac1a2a3658fde88
SHA1 21ce283a82027fe3881740c743fb87cd851d5d79
SHA512 74ff877c5c32a99bca53d1b6b6dd5b9fbeaaa0c92f3fbbb6b329884491bf557cfad4dc5ce6434490f2b39fc5eab30ff7b5d11fc68fd0514e3448aee1d206f21f
SSDEEP 24576:soZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaR3MU9Q:soZ9bq+MmMEL+hcjXHC/wnwd3MU6
TLSH
T129553387413C18C44F3D066767AF996CA2259AFC20070C776776446B353F3AF8AB998E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/912-648-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/912-649-0x0000000066D80000-0x00000000670D1000-memory.dmp

Download