7a30ad5c504c42d0bd1f2dae0c58e72c74772dec9bf8eb4de240803b007cc11d

Resubmissions

17/04/2026, 04:32

260417-e5xraaft4q5

17/04/2026, 04:27

260417-e28dlsat915

Analysis

user interaction
yes
max time kernel
150s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
17/04/2026, 04:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ExecPolar.exe
Size 1.5MB
Sample260417-e5xraaft4q
SHA256 7a30ad5c504c42d0bd1f2dae0c58e72c74772dec9bf8eb4de240803b007cc11d
MD5 3f1e00b4918f09fa1424c7d56287551c
SHA1 38eb2c1af2ef8c48d465783a5025fb8447a49e84
SHA512 cc56886c5cca8c7f463fe9ce586162a4270073c9f7415ade4a114cb608aafccf857aa262a9d6b4c92d13c1c63b6fe4196ad79bfc7210c563db4a09f38e533881
SSDEEP 24576:d2wrBD+6nn5RYXrsL/6GWxzDyOkhAyZR31FlhVlo9E6uVZnSDqx3xxngqd6t73+x:drDPnPYbsLSP40KRFLhF68ZnZZng86Z
TLSH
T1457533DDB723D47EC15238FE8358C8FED6D4D548C4E56A18A4B22BB214FE7045B2970A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/5020-0-0x00007FF698430000-0x00007FF698AEA000-memory.dmp	upx
behavioral1/memory/1544-125-0x00007FF60E1F0000-0x00007FF60E8AA000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3364	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134208739616228964"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings	chrome.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\ExecPolar.zip:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
2192	chrome.exe
2192	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4056	chrome.exe
Token: SeCreatePagefilePrivilege	4056	chrome.exe
Token: SeShutdownPrivilege	4056	chrome.exe
Token: SeCreatePagefilePrivilege	4056	chrome.exe
Token: SeShutdownPrivilege	4056	chrome.exe
Token: SeCreatePagefilePrivilege	4056	chrome.exe
Token: SeShutdownPrivilege	4056	chrome.exe
Token: SeCreatePagefilePrivilege	4056	chrome.exe
Token: SeShutdownPrivilege	4056	chrome.exe
Token: SeCreatePagefilePrivilege	4056	chrome.exe
Token: SeShutdownPrivilege	4056	chrome.exe
Token: SeCreatePagefilePrivilege	4056	chrome.exe
Token: SeShutdownPrivilege	4056	chrome.exe
Token: SeCreatePagefilePrivilege	4056	chrome.exe
Token: SeShutdownPrivilege	4056	chrome.exe
Token: SeCreatePagefilePrivilege	4056	chrome.exe
Token: SeShutdownPrivilege	4056	chrome.exe
Token: SeCreatePagefilePrivilege	4056	chrome.exe
Token: SeShutdownPrivilege	4056	chrome.exe
Token: SeCreatePagefilePrivilege	4056	chrome.exe
Token: SeShutdownPrivilege	4056	chrome.exe
Token: SeCreatePagefilePrivilege	4056	chrome.exe
Token: SeShutdownPrivilege	4056	chrome.exe
Token: SeCreatePagefilePrivilege	4056	chrome.exe
Token: SeShutdownPrivilege	4056	chrome.exe
Token: SeCreatePagefilePrivilege	4056	chrome.exe
Token: SeShutdownPrivilege	4056	chrome.exe
Token: SeCreatePagefilePrivilege	4056	chrome.exe
Token: SeShutdownPrivilege	4056	chrome.exe
Token: SeCreatePagefilePrivilege	4056	chrome.exe
Token: SeShutdownPrivilege	4056	chrome.exe
Token: SeCreatePagefilePrivilege	4056	chrome.exe
Token: SeShutdownPrivilege	4056	chrome.exe
Token: SeCreatePagefilePrivilege	4056	chrome.exe
Token: SeShutdownPrivilege	4056	chrome.exe
Token: SeCreatePagefilePrivilege	4056	chrome.exe
Token: SeShutdownPrivilege	4056	chrome.exe
Token: SeCreatePagefilePrivilege	4056	chrome.exe
Token: SeShutdownPrivilege	4056	chrome.exe
Token: SeCreatePagefilePrivilege	4056	chrome.exe
Token: SeShutdownPrivilege	4056	chrome.exe
Token: SeCreatePagefilePrivilege	4056	chrome.exe
Token: SeShutdownPrivilege	4056	chrome.exe
Token: SeCreatePagefilePrivilege	4056	chrome.exe
Token: SeShutdownPrivilege	4056	chrome.exe
Token: SeCreatePagefilePrivilege	4056	chrome.exe
Token: SeShutdownPrivilege	4056	chrome.exe
Token: SeCreatePagefilePrivilege	4056	chrome.exe
Token: SeShutdownPrivilege	4056	chrome.exe
Token: SeCreatePagefilePrivilege	4056	chrome.exe
Token: SeShutdownPrivilege	4056	chrome.exe
Token: SeCreatePagefilePrivilege	4056	chrome.exe
Token: SeShutdownPrivilege	4056	chrome.exe
Token: SeCreatePagefilePrivilege	4056	chrome.exe
Token: SeShutdownPrivilege	4056	chrome.exe
Token: SeCreatePagefilePrivilege	4056	chrome.exe
Token: SeShutdownPrivilege	4056	chrome.exe
Token: SeCreatePagefilePrivilege	4056	chrome.exe
Token: SeShutdownPrivilege	4056	chrome.exe
Token: SeCreatePagefilePrivilege	4056	chrome.exe
Token: SeShutdownPrivilege	4056	chrome.exe
Token: SeCreatePagefilePrivilege	4056	chrome.exe
Token: SeShutdownPrivilege	4056	chrome.exe
Token: SeCreatePagefilePrivilege	4056	chrome.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4056 wrote to memory of 2956	4056	chrome.exe	81
PID 4056 wrote to memory of 3084	4056	chrome.exe	82
PID 4056 wrote to memory of 3084	4056	chrome.exe	82
PID 4056 wrote to memory of 3364	4056	chrome.exe	83
PID 4056 wrote to memory of 3864	4056	chrome.exe	84
PID 4056 wrote to memory of 3864	4056	chrome.exe	84
PID 4056 wrote to memory of 3944	4056	chrome.exe	85
PID 4056 wrote to memory of 4392	4056	chrome.exe	86
PID 4056 wrote to memory of 3944	4056	chrome.exe	85
PID 4056 wrote to memory of 4392	4056	chrome.exe	86
PID 4056 wrote to memory of 3536	4056	chrome.exe	87
PID 4056 wrote to memory of 3536	4056	chrome.exe	87
PID 4056 wrote to memory of 1432	4056	chrome.exe	90
PID 4056 wrote to memory of 1432	4056	chrome.exe	90
PID 4056 wrote to memory of 468	4056	chrome.exe	91
PID 4056 wrote to memory of 2560	4056	chrome.exe	93
PID 4056 wrote to memory of 2560	4056	chrome.exe	93
PID 4056 wrote to memory of 2584	4056	chrome.exe	94
PID 4056 wrote to memory of 2584	4056	chrome.exe	94
PID 4056 wrote to memory of 1504	4056	chrome.exe	95
PID 4056 wrote to memory of 4324	4056	chrome.exe	96
PID 4056 wrote to memory of 2248	4056	chrome.exe	97
PID 4056 wrote to memory of 4316	4056	chrome.exe	98
PID 4056 wrote to memory of 2192	4056	chrome.exe	101

C:\Users\Admin\AppData\Local\Temp\ExecPolar.exe
"C:\Users\Admin\AppData\Local\Temp\ExecPolar.exe"
1⤵
PID:5020

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ff87bf8c728,0x7ff87bf8c734,0x7ff87bf8c740
  2⤵
  PID:2956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1736,i,13450526755788134122,14920967741848163792,262144 --field-trial-handle=1888,i,18295658928371959002,5145216516944316092,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1876 /prefetch:2
  2⤵
  PID:3084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2200,i,13244346540310313139,5287614522764047426,524288 --field-trial-handle=1888,i,18295658928371959002,5145216516944316092,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2240 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2364,i,6062850601466681925,3143557530194259742,524288 --field-trial-handle=1888,i,18295658928371959002,5145216516944316092,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2548 /prefetch:13
  2⤵
  PID:3864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3260,i,1117781504847706615,406025516862518880,2097152 --field-trial-handle=1888,i,18295658928371959002,5145216516944316092,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:3944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3256,i,3909422498316255656,8441780865271730363,2097152 --field-trial-handle=1888,i,18295658928371959002,5145216516944316092,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:4392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4244,i,8355606595999642630,13688299180422660743,2097152 --field-trial-handle=1888,i,18295658928371959002,5145216516944316092,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4360 /prefetch:9
  2⤵
  PID:3536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4680,i,11987570439502254453,737573485489346196,2097152 --field-trial-handle=1888,i,18295658928371959002,5145216516944316092,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:1432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5472,i,7702522886611054513,10822552669784240126,524288 --field-trial-handle=1888,i,18295658928371959002,5145216516944316092,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5420 /prefetch:14
  2⤵
  PID:468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5748,i,16141652627037218678,9142019085651870557,2097152 --field-trial-handle=1888,i,18295658928371959002,5145216516944316092,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:2560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4700,i,2857801909359137130,14955253071573829181,2097152 --field-trial-handle=1888,i,18295658928371959002,5145216516944316092,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:2584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3708,i,16134509003889535162,4586777998978775914,524288 --field-trial-handle=1888,i,18295658928371959002,5145216516944316092,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3488 /prefetch:14
  2⤵
  PID:1504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3476,i,9763749026900017069,17759443765237750742,524288 --field-trial-handle=1888,i,18295658928371959002,5145216516944316092,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4808 /prefetch:14
  2⤵
  PID:4324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4712,i,13682796366578498274,12413505973885425030,524288 --field-trial-handle=1888,i,18295658928371959002,5145216516944316092,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3528 /prefetch:14
  2⤵
  PID:2248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4860,i,16330586093719268535,10577297606422143153,524288 --field-trial-handle=1888,i,18295658928371959002,5145216516944316092,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4464 /prefetch:14
  2⤵
  - NTFS ADS
  PID:4316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=876,i,12194472427888473628,7924282950005953023,262144 --field-trial-handle=1888,i,18295658928371959002,5145216516944316092,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=872 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2192

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1812

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2504

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3264

C:\Users\Admin\Downloads\ExecPolar\ExecPolar - Copy\ExecPolar.exe
"C:\Users\Admin\Downloads\ExecPolar\ExecPolar - Copy\ExecPolar.exe"
1⤵
PID:1544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 edb80eb19f0894488d0ca484f303b769a90dd78c3019325f2b2212f03c2771d4
MD5 641b2d5206ea5096da130e525985bfa3
SHA1 24719d448bb1c54ff8d3af4b2a73852f706f533e
SHA512 740d300bc253e0c5f792687944de7ae9bb66ded0e3c1cf789efb75269249b6adaac4454b69a56124feba546e915126649d75f908900cf0000e87c8fea6b5f7c6
TLSH
T151E02BAACC21AD370CFD2B2964648747F750136B2741495F3B3D930C8FB1637014186C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 02479beaf68cda3f109d6ff899f670a7294893e69230b8cf60398a1cb53de523
MD5 876e7c8372b002a1f8f2e100dabe29b3
SHA1 8f367666efd4454d3301880fff05d723364cc432
SHA512 b0a8881280198bc296ec0188eeaaa2f7e8cd89a6a252a961b912f3e3c8a4f6ccd345d47c964a67d7528c1ebe0a7a09b6ef9539574ea27d09773f3e50b5af96ef
TLSH
T19751BDF3D3E4967DC511A6F4EA146E2FCE790A28031C3C6689E4AE0B53F2872D24174E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 67629930bb183fd8979613e7ebd77dc1e29532bef2743c2cbe90f59dc7a10c18
MD5 56910c44c5eb6b750b7501f9ca542364
SHA1 f189e58f7a787a10d7c790ec07c83ba1f5db0377
SHA512 e12dc2cae847d452e3118432483070b2984ae38031c8061679b805ac7e50ff0f30ec4525421a29bfa193fc65cd87b5f481425beab792faf054f674f1d1c48efb
SSDEEP 192:NRg9Y7TXOCnl8v7shAPRp2HV9AHsb+WNngcEV5eJekO3PVyIsnAUgraJ:NRg9kLlog8XW2w74eJjwe
TLSH
T1F752D62DB914297B5CDBD22AFD657B57E7F1103260841E88E6FC8A1C29E7ACD3227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 c90026c844cccc33d7f1ba94a11c311867c5adb92794838598ce4f8300acd944
MD5 120bc1176c6cf152e559a59eef9ecc29
SHA1 c7ccfc0bdbd559caad8182c891516db4dcbb045a
SHA512 61a6aba39364754d94795c1cfe2f6ee4ea59cb78f54a9c38ce0bab2bc63385d1f07e4efdef9782af4f71afc22bcbd8ca54cd66f9aa6f3791079e9ebea1d2c5cd
SSDEEP 192:NRgRY7TXOCbav7spAPRp229AHsb+WNngc08ekO3IVyIsnAUgtaJ:NRgRk32gUX92w708jJ8
TLSH
T14642C42DB914297B5CDAC22AFD657B53E7F5103160942EC8E6FC8A1C29D7ACD312701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 670be45179ffc5719e34024df51468d9e531825fe41ebd93f406cdc92bff459f
MD5 811a9578a6fc8ef2d96594051f97d530
SHA1 cfa4484ebd8f05922f2012dcc5ddd3db061dfeb8
SHA512 8a4171aa72a677f09643b0aca4a354b297930c30610ff55160a8db48ed5f638358bd68c8e44994bc4c6bc2461fd622d3dee17e1ca09d0c399876cb4f2bc89708
SSDEEP 192:NRgRY7TXOCnav7shAPRp229AHsb+WNngc08ekO3IVyIsnAUgtaJ:NRgRkL2g8X92w708jJ8
TLSH
T19242C52DB914297B5CDAC22AFD657B53E7F1103160942EC8E6FC8A1C29D7ACD312701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 5ab444414a02d4891c7cbb4db3735bec720facb3265bdedc915a68f6beef1cd9
MD5 191a425abbe14997e55d6c34d96395de
SHA1 567b4a799716eb9b3db36abe7163a0aaec1148fd
SHA512 d0c7f690ea61add197a2dbd706250b5de93bf454a11e6e82e25faa2759a36b7158f1e02247d411bcd65234e3d4eb5605c539a97b277b15db18786f9fbc17ab4a
SSDEEP 384:UujAr7KxkXqKf/pUZNCgVLH2Hfgsl+m7pLuLcifmnXODAH+ErU3xWHGWmvhxVtfC:UeAr7KxkXqKf/pUZNCgVLH2Hfgsgm7p/
TLSH
T15D720A677C4C9E770F94CACCD8167A4FADF6024B65E9889583FA982903C5ACF11061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 a91631cbdff00df99b0be0cb9f2fba5c01037fec76b00d727a8db98955adefee
MD5 daf62356da983f187e007218ba06f837
SHA1 df0a555e8432bce171118ab9b5fa33f7f6825056
SHA512 112d8902bebbf6374558b4dbd82121d0a492863812da76db95b14384a225895cb3c601dbd07d0cb25e88a1adfbb6a2df5fdb3193fc72990c5680be50f6d5424e
TLSH
T144B01250C001D601C01302F5258208C93124AF109B05230563F16B71BC365904115151
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d5ba.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58d5ba.TMP
Size 96B
SHA256 388e5de9bf53f0022f42eb16fa8a8711e3857ca5c3eb827a5228ef58f8797190
MD5 50df33060aabd3d24d9d486212e2bef4
SHA1 bb7befc13e55bff54a52a117d81ff613a86d584e
SHA512 d0655e0d42bc9144f156a94264643964a42d983165db98819c4a7ac76460333a0b283e5cd792a34235a0b150e034226ea1046471af3bcd670224e193c3ffa7e8
TLSH
T135B00295C202E713C09223B07AA5D6EDB168DF3BC603222A92F49F66EC25A614625560
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 193KB
SHA256 50a08da79a3de77d568d1e420e19747edb0d86325b3c2a09de8184ea5d3f4aa2
MD5 9d6ed0ec86b38173b1c6076464a08078
SHA1 bc091f311435a64adce05962a9260afbac4e17ac
SHA512 90f6fa6706155bfaa2c4d4d9b6eb22154a4ff563986db1cf56d5ab745b8f3fbf1074867f59e2dee0f46c1e5530538815b4cfd93aecd1d35da97c1082a3f1e070
SSDEEP 6144:me3lNQhX2a7zDwTLTRU++JjcMW2VcVLlI:mYlNQ4ggLTRmOMWjI
TLSH
T1A914123D8C1E746A624999EF12074C9A9DA7CDCF45183ABC11C4BF4D25FA707638BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 193KB
SHA256 6d33b6eb64c25706471713c28a0cd3de00504c91dc5363b7139b776808984683
MD5 ae9e2c97dd3a6dd887636305c7cff6fb
SHA1 99ef7bcdc81b770968e974f11133fedc15960de5
SHA512 c2e59d8d212256d4819734429fdfb0d15a36d81b6cc4b4f2c44965e2af81d4527143148fdd1c66f5af1b02aadc7911fe3cd98c1b006f649fdba3b5b0a78871b5
SSDEEP 6144:ze3lNQhX2a7zDwTLTRU++JjcMW2VcVLlI:zYlNQ4ggLTRmOMWjI
TLSH
T1D514123D8C1E746A624999EF22074C9A9DA7CDCF451829BC11C4BF4D15FA706638BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 194KB
SHA256 a066ff0caadff27366b60a74eec642760de81b2b641824acb08ec58117a261f7
MD5 a704274e51a9a951461cdf9e1e527473
SHA1 16537fedfb805600141df30ff79232b68ee1435c
SHA512 452fed4b6d25df71ecd9b4ac3228a7b8982353bfb1301becfa2964ec5a39be7a736713d97ec6660a0e3297625e7ce576f7a25bb1ccd78d8f983e286360159656
SSDEEP 6144:z/3lNQhX2a7zDwTLTRU++JjcMW2VcVLlI:z/lNQ4ggLTRmOMWjI
TLSH
T1D114123D9C1EB8AA525999DA22030C5ADDF7C9CF59183DBC11C47F4D11FA70AA78BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 6f36a9c16f84c14e0cc3b3a36add708bd64d1d99358f1b0b0441aff2f237a673
MD5 01ba639b842c532203fb13cbfd9032a1
SHA1 a84832ae7bb0b536f15ac778b70f463c82c53afe
SHA512 f9f6f64e6406600d642a20d3e64650b2b306e1836218efe04ba06c3bb8e699a77e77c47985deb4252e21ae7c840f5eda0482577638eb2c6d91390713fd937cc2
SSDEEP 1536:4LgP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNxZ:gG++J3qUQm08KMWF0bFTcVHr6zgZ
TLSH
T1A49302B9991E7D79636ED396A0079CAC8CD3DCCE1514517C30C76F0E14BA3A3A31B8A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExecPolar.zip

Path C:\Users\Admin\Downloads\ExecPolar.zip
Size 2.3MB
SHA256 b742ffdc14c6f3ca4852b7c42d04ee337994458375da100a057e4a41ab27cae2
MD5 a675f5baeeb6af98f9cab331f5ece292
SHA1 24fbb60f02c1f7c592c9fb24bc2c49dc37ded8fc
SHA512 950bc0dfd0220ee19199bbf009fc8d9953f031b09e0fde80a89376e41c61be53400f1636594d5be723ff8a15a1ffc6f8d16f1b16b6f97490947d23879ae8af65
SSDEEP 49152:FsMyZwcFhjhoeeVjl59zt/1eBapoXQa2RP5jLCiZfHrZ0GuFvaD:yMyZwcFAhjljB/1pLa2RP5jZ5HrGg
TLSH
T121B5339CFF53951EC1A228DE5214DCFBCFD860488C64962CB9B13E6741FEA05A73AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExecPolar.zip:Zone.Identifier

Path C:\Users\Admin\Downloads\ExecPolar.zip:Zone.Identifier
Size 123B
SHA256 aed2532e59ab151a006cd2b431f1408a382f17163918e71e4bbea849e729ff3e
MD5 7bf8ea32cae95b3bfb9ef463adfccae7
SHA1 1c39dacd1713c764d50d8b22bf22af20ba5ff447
SHA512 46ed032d9e9c27f3f25281b7f551e1e0dd192fe6e1cd4a7b248708ca357cbfb78646bcf908aa1481041990a03138100133065efd22bfe7b40328ef77bb5c56bf
TLSH
T19BB09B5754C4741C411335DC189CE209750B51170A5C0158E70D1156B546375A0ADD15
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1544-125-0x00007FF60E1F0000-0x00007FF60E8AA000-memory.dmp

Download

memory/1812-15-0x000002AA16310000-0x000002AA1636D000-memory.dmp

Download

memory/3264-107-0x000001CC2C090000-0x000001CC2C0ED000-memory.dmp

Download

memory/5020-0-0x00007FF698430000-0x00007FF698AEA000-memory.dmp

Download

memory/5020-1-0x00007FF698430000-0x00007FF698AEA000-memory.dmp

Download