7a30ad5c504c42d0bd1f2dae0c58e72c74772dec9bf8eb4de240803b007cc11d

Resubmissions

17/04/2026, 04:32

260417-e5xraaft4q5

17/04/2026, 04:27

260417-e28dlsat915

Analysis

user interaction
yes
max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/04/2026, 04:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ExecPolar.exe
Size 1.5MB
Sample260417-e28dlsat91
SHA256 7a30ad5c504c42d0bd1f2dae0c58e72c74772dec9bf8eb4de240803b007cc11d
MD5 3f1e00b4918f09fa1424c7d56287551c
SHA1 38eb2c1af2ef8c48d465783a5025fb8447a49e84
SHA512 cc56886c5cca8c7f463fe9ce586162a4270073c9f7415ade4a114cb608aafccf857aa262a9d6b4c92d13c1c63b6fe4196ad79bfc7210c563db4a09f38e533881
SSDEEP 24576:d2wrBD+6nn5RYXrsL/6GWxzDyOkhAyZR31FlhVlo9E6uVZnSDqx3xxngqd6t73+x:drDPnPYbsLSP40KRFLhF68ZnZZng86Z
TLSH
T1457533DDB723D47EC15238FE8358C8FED6D4D548C4E56A18A4B22BB214FE7045B2970A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4340-0-0x00007FF6B17F0000-0x00007FF6B1EAA000-memory.dmp	upx
behavioral1/memory/3400-136-0x00007FF6A75A0000-0x00007FF6A7C5A000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5104	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134208736777329292"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1876	chrome.exe
1876	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1344	chrome.exe
Token: SeCreatePagefilePrivilege	1344	chrome.exe
Token: SeShutdownPrivilege	1344	chrome.exe
Token: SeCreatePagefilePrivilege	1344	chrome.exe
Token: SeShutdownPrivilege	1344	chrome.exe
Token: SeCreatePagefilePrivilege	1344	chrome.exe
Token: SeShutdownPrivilege	1344	chrome.exe
Token: SeCreatePagefilePrivilege	1344	chrome.exe
Token: SeShutdownPrivilege	1344	chrome.exe
Token: SeCreatePagefilePrivilege	1344	chrome.exe
Token: SeShutdownPrivilege	1344	chrome.exe
Token: SeCreatePagefilePrivilege	1344	chrome.exe
Token: SeShutdownPrivilege	1344	chrome.exe
Token: SeCreatePagefilePrivilege	1344	chrome.exe
Token: SeShutdownPrivilege	1344	chrome.exe
Token: SeCreatePagefilePrivilege	1344	chrome.exe
Token: SeShutdownPrivilege	1344	chrome.exe
Token: SeCreatePagefilePrivilege	1344	chrome.exe
Token: SeShutdownPrivilege	1344	chrome.exe
Token: SeCreatePagefilePrivilege	1344	chrome.exe
Token: SeShutdownPrivilege	1344	chrome.exe
Token: SeCreatePagefilePrivilege	1344	chrome.exe
Token: SeShutdownPrivilege	1344	chrome.exe
Token: SeCreatePagefilePrivilege	1344	chrome.exe
Token: SeShutdownPrivilege	1344	chrome.exe
Token: SeCreatePagefilePrivilege	1344	chrome.exe
Token: SeShutdownPrivilege	1344	chrome.exe
Token: SeCreatePagefilePrivilege	1344	chrome.exe
Token: SeShutdownPrivilege	1344	chrome.exe
Token: SeCreatePagefilePrivilege	1344	chrome.exe
Token: SeShutdownPrivilege	1344	chrome.exe
Token: SeCreatePagefilePrivilege	1344	chrome.exe
Token: SeShutdownPrivilege	1344	chrome.exe
Token: SeCreatePagefilePrivilege	1344	chrome.exe
Token: SeShutdownPrivilege	1344	chrome.exe
Token: SeCreatePagefilePrivilege	1344	chrome.exe
Token: SeShutdownPrivilege	1344	chrome.exe
Token: SeCreatePagefilePrivilege	1344	chrome.exe
Token: SeShutdownPrivilege	1344	chrome.exe
Token: SeCreatePagefilePrivilege	1344	chrome.exe
Token: SeShutdownPrivilege	1344	chrome.exe
Token: SeCreatePagefilePrivilege	1344	chrome.exe
Token: SeShutdownPrivilege	1344	chrome.exe
Token: SeCreatePagefilePrivilege	1344	chrome.exe
Token: SeShutdownPrivilege	1344	chrome.exe
Token: SeCreatePagefilePrivilege	1344	chrome.exe
Token: SeShutdownPrivilege	1344	chrome.exe
Token: SeCreatePagefilePrivilege	1344	chrome.exe
Token: SeShutdownPrivilege	1344	chrome.exe
Token: SeCreatePagefilePrivilege	1344	chrome.exe
Token: SeShutdownPrivilege	1344	chrome.exe
Token: SeCreatePagefilePrivilege	1344	chrome.exe
Token: SeShutdownPrivilege	1344	chrome.exe
Token: SeCreatePagefilePrivilege	1344	chrome.exe
Token: SeShutdownPrivilege	1344	chrome.exe
Token: SeCreatePagefilePrivilege	1344	chrome.exe
Token: SeShutdownPrivilege	1344	chrome.exe
Token: SeCreatePagefilePrivilege	1344	chrome.exe
Token: SeShutdownPrivilege	1344	chrome.exe
Token: SeCreatePagefilePrivilege	1344	chrome.exe
Token: SeShutdownPrivilege	1344	chrome.exe
Token: SeCreatePagefilePrivilege	1344	chrome.exe
Token: SeShutdownPrivilege	1344	chrome.exe
Token: SeCreatePagefilePrivilege	1344	chrome.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe
1344	chrome.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1344 wrote to memory of 2308	1344	chrome.exe	94
PID 1344 wrote to memory of 5104	1344	chrome.exe	96
PID 1344 wrote to memory of 1092	1344	chrome.exe	97
PID 1344 wrote to memory of 1092	1344	chrome.exe	97
PID 1344 wrote to memory of 2036	1344	chrome.exe	98
PID 1344 wrote to memory of 2036	1344	chrome.exe	98
PID 1344 wrote to memory of 3996	1344	chrome.exe	99
PID 1344 wrote to memory of 3996	1344	chrome.exe	99
PID 1344 wrote to memory of 4800	1344	chrome.exe	100
PID 1344 wrote to memory of 4800	1344	chrome.exe	100
PID 1344 wrote to memory of 4476	1344	chrome.exe	101
PID 1344 wrote to memory of 4476	1344	chrome.exe	101
PID 1344 wrote to memory of 1544	1344	chrome.exe	102
PID 1344 wrote to memory of 1544	1344	chrome.exe	102
PID 1344 wrote to memory of 1020	1344	chrome.exe	104
PID 1344 wrote to memory of 4832	1344	chrome.exe	106
PID 1344 wrote to memory of 4832	1344	chrome.exe	106
PID 1344 wrote to memory of 4592	1344	chrome.exe	107
PID 1344 wrote to memory of 4592	1344	chrome.exe	107
PID 1344 wrote to memory of 3756	1344	chrome.exe	109
PID 1344 wrote to memory of 1160	1344	chrome.exe	110
PID 1344 wrote to memory of 540	1344	chrome.exe	111
PID 1344 wrote to memory of 1740	1344	chrome.exe	112
PID 1344 wrote to memory of 1876	1344	chrome.exe	119

C:\Users\Admin\AppData\Local\Temp\ExecPolar.exe
"C:\Users\Admin\AppData\Local\Temp\ExecPolar.exe"
1⤵
PID:4340

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fffe9ebc728,0x7fffe9ebc734,0x7fffe9ebc740
  2⤵
  PID:2308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1600,i,13943458258734536378,7103923827204918381,524288 --field-trial-handle=2092,i,12869504805645153256,6711564138645232822,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1712,i,17952648561132969398,11886489588626108533,262144 --field-trial-handle=2092,i,12869504805645153256,6711564138645232822,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:1092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2352,i,11180715405718269328,2491646937039782540,524288 --field-trial-handle=2092,i,12869504805645153256,6711564138645232822,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2444 /prefetch:8
  2⤵
  PID:2036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3260,i,5506773170201991209,9024817860150896118,2097152 --field-trial-handle=2092,i,12869504805645153256,6711564138645232822,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:3996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3464,i,15657212603276341177,142071235696626483,2097152 --field-trial-handle=2092,i,12869504805645153256,6711564138645232822,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4152,i,4222083436637260571,6451937506397095664,2097152 --field-trial-handle=2092,i,12869504805645153256,6711564138645232822,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4168 /prefetch:2
  2⤵
  PID:4476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4760,i,4592198877357797330,9794837643247343991,2097152 --field-trial-handle=2092,i,12869504805645153256,6711564138645232822,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4644 /prefetch:1
  2⤵
  PID:1544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5656,i,15829540752401992753,15612715419211254672,524288 --field-trial-handle=2092,i,12869504805645153256,6711564138645232822,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5660 /prefetch:8
  2⤵
  PID:1020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5788,i,7231574403834429454,13166483493955657673,2097152 --field-trial-handle=2092,i,12869504805645153256,6711564138645232822,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4852,i,12213324584216445086,1809808624484589323,2097152 --field-trial-handle=2092,i,12869504805645153256,6711564138645232822,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5908 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3288,i,2839577637803860513,15217712394985583991,524288 --field-trial-handle=2092,i,12869504805645153256,6711564138645232822,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3588 /prefetch:8
  2⤵
  PID:3756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3388,i,13005223982593276140,1628554269125567228,524288 --field-trial-handle=2092,i,12869504805645153256,6711564138645232822,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3352 /prefetch:8
  2⤵
  PID:1160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3376,i,12836488360207975345,11483153577564975324,524288 --field-trial-handle=2092,i,12869504805645153256,6711564138645232822,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3332 /prefetch:8
  2⤵
  PID:540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4180,i,14651160441532244681,11172209737304472340,524288 --field-trial-handle=2092,i,12869504805645153256,6711564138645232822,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4204 /prefetch:8
  2⤵
  PID:1740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1148,i,15531352741394453204,4526915683152179574,262144 --field-trial-handle=2092,i,12869504805645153256,6711564138645232822,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3488 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1876

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1008

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4212

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3396

C:\Users\Admin\Downloads\ExecPolar\ExecPolar - Copy\ExecPolar.exe
"C:\Users\Admin\Downloads\ExecPolar\ExecPolar - Copy\ExecPolar.exe"
1⤵
PID:3400

C:\Users\Admin\Downloads\ExecPolar\ExecPolar - Copy\ExecPolar.exe
"C:\Users\Admin\Downloads\ExecPolar\ExecPolar - Copy\ExecPolar.exe"
1⤵
PID:1936

C:\Users\Admin\Downloads\ExecPolar\ExecPolar - Copy\ByfronBypass.exe
"C:\Users\Admin\Downloads\ExecPolar\ExecPolar - Copy\ByfronBypass.exe"
1⤵
PID:3244

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 1d0c789064c41ccfa324e9a537b0c7d5da2c7f7eb7ff717f951f36593e6e947b
MD5 44063232df8d3478cb6c799c2995524b
SHA1 f9023e5d73911c5c7b5a8e3586866192d235b14b
SHA512 5b7db4d966f9bb28075e56fcf6939752971be54cf79a4e5bdcb10e3cd9ddc576f1fbf6bb8a4b4ae5e67d8bb3a978db8eae9a010883c2b03207788d117f4dc023
TLSH
T12BE02BBAC921DD3B08FD476860554747FB40231A2BC0844F3A3D820D8FF0636068695C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 6e55f100dbdb554451425d174639c983c6696788b4298a257cd825b5ea4fd4b0
MD5 b96f6c226b1bdbbc8616416c0306ff94
SHA1 4d55dca439b9987372bf3bf5691b94904245841c
SHA512 c3d5cf4a0fa5ae63d30d6af2acd39b1ff1d589981dfe4ff42fd3834d52890d2cdc0e4ab1662299b5c3df6fead273cc40f14a8b74d344659c3a472e2d783de6e6
TLSH
T16751BEF383E49A7EC51156F4EA147E1FCE690A24031C3C6A89E4EE0B53E6972D20174E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 c0c8b66ea71255bac0c3e042d63744e95930b307b9757257a476d29b80c0440d
MD5 6e788c6cef6ff30b24e548db4dd47800
SHA1 c589c61008a9778ff8c555bef103a470ca40cbc5
SHA512 8aff98576b8468c0a882562764ae57c412a8503a28d184909d17bc9b82febe279fbe521c756ef6ccde7875204f286fada1e84b1960463912020f7afadbe63a80
SSDEEP 192:RRf2Y7qPUR+v7CMpAPRp2u93Hsb+WNnbzd5k/eOVJ1xvae++VyIsnAUgtaJ:RRf2Q6xUXZxwXd8aV28
TLSH
T17C42F82DAD10793B4CEBD31AFA653B17DBF5102161892D84E6FCCA2C15EB6CD2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 d4daadd08dfe19174b8901e424c9b55948e23c51f2529915afe112b4d50ab999
MD5 096cd676e4b176fdd6435172e9bf8910
SHA1 8d6e5148c19e16a56c63071b8887bceddc972077
SHA512 52e692c68b330bf835a6dc0b4492d3807ddd06fb5e2bfc1413c0170a1415de081e61fd7a0d482aa6297e6caca2a492882481355028d2c7363d81d4423d7795fe
SSDEEP 192:RRf2Y7qPUU+v7CMpAPRp2/X93Hsb+WNnbzpjD2dk/eOVJ1xvae++VyIsnAUgtaJ:RRf2x6xUXYxwXl2YaV28
TLSH
T11152E86DAD14793B4CFBD31AFA65371BDBF5102161892D84E6FC8A2C14EB6CD222B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 ba6241629c2e571dc4ab536b32e11ad8971523beb1bca2b62d648c639fdac092
MD5 bb0b456e2436874e29ebf02af04f3781
SHA1 886e4bdd6cee2af4d62d31704226723e696001e6
SHA512 196c4cf74cad297bb63804521f638ff6048accfe69da032c79f5f8eb71747201dcd9462f6fd0a5dec8722a62669d09987e077f6e455f50ae1abd021dc02fe371
SSDEEP 192:RRfyY7qPUU7v7CMplPRp9/X93Hsb+WNnbzpRtYSk/eOVJ1xvae7+VyIsnAUgraJ:RRfyxDxDXVxwX5YPaO2e
TLSH
T1D452E76EAD107D3B8CEBD31AF9557B2BDBF1102161892D88E6FC8A2C15E76CD2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 9c430f8c17feb865c008f25efcb04058f5ca91ec3e589c4f1ad8c3f157cbd990
MD5 d8cfe36a6891342c51bc518f22217e71
SHA1 73290bff0114201260216b0cb931cd9bda0228c8
SHA512 7e9778e0fd6323fceb05d3cc91303d1d284a486f525d995ef288db3363d58c76ff756e8e5e9add87e5a95e7ffd83adb3cf949ed5b7444a047d33f0fd1fa9184a
SSDEEP 384:AmjUj7KxkXqKf/pUZNCgVLH2Hfgsl5x7pLuLcifuvXODUf+ErU3xeHGHHe7omBcw:AGUj7KxkXqKf/pUZNCgVLH2Hfgsfx7pH
TLSH
T15772EA677C4C9D3B0F94C68CD816BF4FADB6024B55ED886443FA982903D5ACB110A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 b09769f29393e638191c31ca43757ccd3e856d5ff8dfe609af5a72859d68b6ae
MD5 0d3708f9082ffea419cccd6fbb5e646d
SHA1 0015daa12474cd1b0b5141b4dde32506310eb9a9
SHA512 0b229a9f20596247d172b509c811bd698cdb8b39c6dccabb6bf36ac79701f23f531534979bf763c9cb6fd1fb4326eae746b06e2e805daf5356f4a7c9a76b1951
TLSH
T124B0121080429642C04302B011A2049C31245F18C7061301A3E0EAB1D82A1E1401C960
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a330.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58a330.TMP
Size 96B
SHA256 41169ef1e1a12bb673aa3362ae9774ff79b1b42877d1f74487b3160c169a9925
MD5 60a1892b5528f349e351b61c6ef922c7
SHA1 126ef2b18ec30ccdf772d56cb2d73700e0e29d8a
SHA512 2212f5cae3b91d1f4809dbf78006d4d97c79996f1944bac18f38d5e041fe3eb8f6dc80c4422e5a3353f9bac54a4caf097be18623c273b641427e5a1fda723130
TLSH
T14BB00255C242A327C54707B025B6D5E87564DF25C607731293E02AA7DD26671452536C
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 194KB
SHA256 4684266f7a5febb006c33e19556d980d36c7d330550821a01d1bfc64c0338ece
MD5 9a1c12e2892648ae5e4a2548cdd7495c
SHA1 2ff2e610f966d46fb030e2a893bf384935cd8283
SHA512 b57d3b97456974de245bec5e489241b144a4db479e5caaf0a9e5baf3403c3f33769f8d39872a28f31c1f6929338d7f6d63427cf4091a1a29ec6a934170e6283c
SSDEEP 6144:lc3lNQhX2a7zDwTLTRYrOk0HOGm/SFyEE3:klNQ4ggLTRYrOjuGdF23
TLSH
T10414123E8C1654E795684D9E37993807CE2693CFA19E3DCC55987A8C61EA20D2FD3C23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 878350828cd2a142f582589d19690819eda27076e46c94c17bb47625fc7d8a92
MD5 0027527691841473741a93297c73e1cc
SHA1 79bc09f4fa27329fad2a3fb5a2893e65621d3aa3
SHA512 1defd4a24b811d75b97a1ccc85ffa7531bca0103075fc2dfa890a0bbc5cd9f8dd431834b9dd879bb675d3f0eecf33ffbd7980d7886d969b7b8b98e776a6aa439
SSDEEP 1536:ip/WcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YW:aW3Qw/xLANk0mUW5GmRntSFCjEENL
TLSH
T1739302BA4E2646F7997D4A8176AE7909CE12534D705FA9CC325CA38C61D02C82F72F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 193KB
SHA256 36ab47628a8f0aa6d943afa6b558751c219c02ed5af57820d911a48b956edd2d
MD5 2f46faced5232b241a0e7a25dbbf6c2d
SHA1 746985701cfbb43b9eb53fe7d7ed2f75c33e35a3
SHA512 300f8ae35ce6ad7389feb609f1357b96764cebfef5873160c33ad091fc3cf71da9f45e770de393b3b981c638686139b91c191e6729855307553d5aadef250b18
SSDEEP 6144:63lNQhX2a7zDwTLTRYrOk0HOGm/SFyEE3:8lNQ4ggLTRYrOjuGdF23
TLSH
T10B14133D8D1651E7946C4DDA37992807CE2693CBA09F3DDC05987B8C61E524D2BD3D23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 193KB
SHA256 ba743c59ed71441184cedb465a8bb67127ae6ae2770d5bdf10e89736df94e63c
MD5 cfa855ccefa0629ced9a42d2ada28c29
SHA1 2c42e7620aea66402012b8085bd8cf4315596e72
SHA512 3eaadfd2d8c2f3b86e910de4e69c4e9d5056ba45fd84a09eca60ff3773404268a612550ac08963902550911126844e387b52dd80b5c3b7bd296085fdab1352e3
SSDEEP 6144:l3lNQhX2a7zDwTLTRYrOk0HOGm/SFyEE3:5lNQ4ggLTRYrOjuGdF23
TLSH
T1FB14123D8D1651E7946C4DDA37992807CE2693CFA09F3DDC0698AB8C61E524D2BD3D23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExecPolar.zip

Path C:\Users\Admin\Downloads\ExecPolar.zip
Size 2.3MB
SHA256 b742ffdc14c6f3ca4852b7c42d04ee337994458375da100a057e4a41ab27cae2
MD5 a675f5baeeb6af98f9cab331f5ece292
SHA1 24fbb60f02c1f7c592c9fb24bc2c49dc37ded8fc
SHA512 950bc0dfd0220ee19199bbf009fc8d9953f031b09e0fde80a89376e41c61be53400f1636594d5be723ff8a15a1ffc6f8d16f1b16b6f97490947d23879ae8af65
SSDEEP 49152:FsMyZwcFhjhoeeVjl59zt/1eBapoXQa2RP5jLCiZfHrZ0GuFvaD:yMyZwcFAhjljB/1pLa2RP5jZ5HrGg
TLSH
T121B5339CFF53951EC1A228DE5214DCFBCFD860488C64962CB9B13E6741FEA05A73AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3244-140-0x00007FF64A5E0000-0x00007FF64A763000-memory.dmp

Download

memory/3244-141-0x0000022727620000-0x00000227276ED000-memory.dmp

Download

memory/3396-105-0x0000023CD3340000-0x0000023CD340D000-memory.dmp

Download

memory/3400-136-0x00007FF6A75A0000-0x00007FF6A7C5A000-memory.dmp

Download

memory/4340-1-0x00007FF6B17F0000-0x00007FF6B1EAA000-memory.dmp

Download

memory/4340-0-0x00007FF6B17F0000-0x00007FF6B1EAA000-memory.dmp

Download