b2944871d54ff9bdd64a7d931a6e17e5546848d0ef0b7128515a207a8a0200ac

Analysis

user interaction
yes
max time kernel
195s
max time network
200s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
18/04/2026, 18:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ExecPolar.exe
Size 9.6MB
Sample260418-wpf72ad13n
SHA256 b2944871d54ff9bdd64a7d931a6e17e5546848d0ef0b7128515a207a8a0200ac
MD5 0fe857552dfcce7d913cb5a5d8d713ab
SHA1 3893df1fb012ee3177d32e66a0bbab58b41b61bd
SHA512 7a33c1da903e273ababf1c20e7ad2efd21bc83932a0b34602701f5b21473f005129eaa9cf95ea3d0502f43e6d17310e1f27981b5f4b3cb0b7d6c9fc7c020434b
SSDEEP 49152:EG4OBO09dO6PBPkdOdNdld/K2ylR0GZTx1mrKqf06jEN7TO/9F3iDe4mEhl5hXm2:s6PLzvFd9JxE5VNKlOSoD970GZh42
TLSH
T120A6FB17676A54D9C5BBC27892C75732BA3078994B392BF74980C2392E22FF4AD3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
49	2528	chrome.exe

Executes dropped EXE 2 IoCs

pid	Process
3580	ExecPolar.exe
2312	ExecPolar.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com
46	raw.githubusercontent.com
49	raw.githubusercontent.com

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\ExecPolar.exe:Zone.Identifier	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2528	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134210092232918505"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\ExecPolar.exe:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
3988	chrome.exe
3988	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 576	2316	chrome.exe	81
PID 2316 wrote to memory of 2204	2316	chrome.exe	82
PID 2316 wrote to memory of 2204	2316	chrome.exe	82
PID 2316 wrote to memory of 2528	2316	chrome.exe	83
PID 2316 wrote to memory of 3984	2316	chrome.exe	84
PID 2316 wrote to memory of 3984	2316	chrome.exe	84
PID 2316 wrote to memory of 2380	2316	chrome.exe	85
PID 2316 wrote to memory of 2380	2316	chrome.exe	85
PID 2316 wrote to memory of 2516	2316	chrome.exe	86
PID 2316 wrote to memory of 2516	2316	chrome.exe	86
PID 2316 wrote to memory of 1268	2316	chrome.exe	87
PID 2316 wrote to memory of 1268	2316	chrome.exe	87
PID 2316 wrote to memory of 1212	2316	chrome.exe	90
PID 2316 wrote to memory of 1212	2316	chrome.exe	90
PID 2316 wrote to memory of 4364	2316	chrome.exe	91
PID 2316 wrote to memory of 1880	2316	chrome.exe	93
PID 2316 wrote to memory of 1880	2316	chrome.exe	93
PID 2316 wrote to memory of 3956	2316	chrome.exe	94
PID 2316 wrote to memory of 3956	2316	chrome.exe	94
PID 2316 wrote to memory of 4204	2316	chrome.exe	95
PID 2316 wrote to memory of 4204	2316	chrome.exe	95
PID 2316 wrote to memory of 772	2316	chrome.exe	96
PID 2316 wrote to memory of 2424	2316	chrome.exe	97
PID 2316 wrote to memory of 3824	2316	chrome.exe	98
PID 2316 wrote to memory of 3892	2316	chrome.exe	99
PID 2316 wrote to memory of 3580	2316	chrome.exe	100
PID 2316 wrote to memory of 3988	2316	chrome.exe	104

C:\Users\Admin\AppData\Local\Temp\ExecPolar.exe
"C:\Users\Admin\AppData\Local\Temp\ExecPolar.exe"
1⤵
PID:5100

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff909afc728,0x7ff909afc734,0x7ff909afc740
  2⤵
  PID:576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1592,i,7198450084243668557,12350439284230989073,262144 --field-trial-handle=1852,i,10287610185699422780,13218167443128301700,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1848 /prefetch:2
  2⤵
  PID:2204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1468,i,18156353237729438674,18099268020312896764,524288 --field-trial-handle=1852,i,10287610185699422780,13218167443128301700,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2132 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:2528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2356,i,6797087822103071275,15967932958293450707,524288 --field-trial-handle=1852,i,10287610185699422780,13218167443128301700,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2368 /prefetch:13
  2⤵
  PID:3984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3196,i,9148490101695927025,6686230578374192510,2097152 --field-trial-handle=1852,i,10287610185699422780,13218167443128301700,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:2380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3212,i,8443226085564722597,17221170260771022364,2097152 --field-trial-handle=1852,i,10287610185699422780,13218167443128301700,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:2516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4168,i,12885721621071524688,5580951967120054595,2097152 --field-trial-handle=1852,i,10287610185699422780,13218167443128301700,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4172 /prefetch:9
  2⤵
  PID:1268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4656,i,14077021451044263336,960380908502409533,2097152 --field-trial-handle=1852,i,10287610185699422780,13218167443128301700,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4568 /prefetch:1
  2⤵
  PID:1212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5464,i,13433212814758622988,9482916641787248442,524288 --field-trial-handle=1852,i,10287610185699422780,13218167443128301700,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5472 /prefetch:14
  2⤵
  PID:4364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5736,i,18098660030450824980,863001197130728087,2097152 --field-trial-handle=1852,i,10287610185699422780,13218167443128301700,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:1880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4668,i,631818897847565796,6453742988616839423,2097152 --field-trial-handle=1852,i,10287610185699422780,13218167443128301700,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:3956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3452,i,11212650127877007234,14996480404063406254,524288 --field-trial-handle=1852,i,10287610185699422780,13218167443128301700,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3664 /prefetch:14
  2⤵
  PID:4204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3564,i,16011495509362936951,16924157840932778136,524288 --field-trial-handle=1852,i,10287610185699422780,13218167443128301700,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4484 /prefetch:14
  2⤵
  PID:772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3644,i,11334028333896230461,10139896450638852763,524288 --field-trial-handle=1852,i,10287610185699422780,13218167443128301700,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4508 /prefetch:14
  2⤵
  PID:2424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4572,i,13600630052490128456,14412884377005090599,524288 --field-trial-handle=1852,i,10287610185699422780,13218167443128301700,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3316 /prefetch:14
  2⤵
  PID:3824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3292,i,13551774915024975413,6495505713960503523,524288 --field-trial-handle=1852,i,10287610185699422780,13218167443128301700,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3568 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:3892
- C:\Users\Admin\Downloads\ExecPolar.exe
  "C:\Users\Admin\Downloads\ExecPolar.exe"
  2⤵
  - Executes dropped EXE
  PID:3580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4220,i,4189261330700434531,1993851057914014062,262144 --field-trial-handle=1852,i,10287610185699422780,13218167443128301700,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4160 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3988

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3040

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3888

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4152

C:\Users\Admin\Downloads\ExecPolar.exe
"C:\Users\Admin\Downloads\ExecPolar.exe"
1⤵
- Executes dropped EXE
PID:2312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 66fe4e79925a2cf54d7aba1d5aed140b64bfd80b481de6b5049b29d014ad5f2a
MD5 1ba1cc6be85ae2fca8215e4d159bb566
SHA1 9897f6c83fe70cdce47ac85092463284f216bc6d
SHA512 5a2daac7080895f016b096eb7da5bc17ac6c19f301200ad2a931aaf3080a9cf9de4c85c6415905f4685af9b5d1ee15e19d41cbcf0d0af5b3392246786d10b021
TLSH
T1FFE022AACD21AC370DFD1B2960A486C7F780139B2B408C5B3B3D820D8FB127B058586C
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 4KB
SHA256 f4ca1d196653c67348e26caff0b530ad4ea500ebea878198ec3598d643cfa359
MD5 305cb8bf76c6aad1c3a1ae10e7272a52
SHA1 ba2c02f4952bd909fed7bfe218b3cfc26ce47ceb
SHA512 cb78fb9e7dfdeb3387abb8f8ef11a132af5f0d28065ec37c553491b84df3ccb313d8cf0a0d26a480834af28c333f53598ab89fcd8b6ce3a4d2f97607c2d3787e
SSDEEP 48:mv6qoO2E/LkvUShnWgHy03mr9u0HHA6U/2yBqcyD3vmD4L9SUvEu7M:Gh2ECUSBpHF3u/HHDUjyD3vq4LU
TLSH
T1BB8184069D57C2D2FB3C27B25DC0795036364888C51F5EC1DDEB71BEE99AB980E02525
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a3053f7af5fb8115c2fa30ebd107c9c1320925ef8f289cf1bbba8dc7be2e3629
MD5 d3434c1c6c26c85ab3d39d138347a1ec
SHA1 7330032b7d5fc3e9e6a2cea4866c7d3fd7f5e67d
SHA512 5f53096058c40547ffd3fc558de621a6eaf8d713b8f6eb18a6fdbc26c16d65fb9352704c323a04891279f3a6f5cb1abc5403758b5202e90b10326efd5d8e8863
TLSH
T1B0612D09D543C2D2FB3C25F72DC00A503A7A9998C52F1ED6DDC774BCE9DA7C80642925
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 8c707b9e2c8f65036945d22bc4fbf602c74ccc20fe6cc58f86036f5655426ec7
MD5 aea5b0db52d4371bafca3fcb4548bc5d
SHA1 f69abe63006c9402cb7192d0d21f9a454878c82b
SHA512 9718cfc37d50619292eab91bfb83325b19102405be3b56ff7130bc089d0527c400ae7cc9552ee138fba5acb9e898041fce25343590c7413f1384c0f2382e3b44
SSDEEP 96:DSCmWKmuaIa04A2a/v/HmO+mbmmmgmDm7mMT:DSCmWKmuaIa04A2a/v/HmzmbmmmgmDmR
TLSH
T13B91ADF783E48A6D8A1196F0AB14BE1FCE6D0524431D3C66C9E4BE4B93E2972D21135F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 95f8ea60126da14f45cd3b35af6d3b0ecbfbb083449230eede050d7aa1daa504
MD5 69daeebc29b534ad523a6e54375fec1b
SHA1 282bf545c87745fccf447744e78cf4683541a454
SHA512 3dbb99c927fd931443939fa32b8a256fb164a7d3e23002c48bacc41d7e93ca495de41ffb89c468167cb36a21723300cfc8fc39eecbc71bccf71402235c431d21
SSDEEP 192:yRG919NuHBXK8lv7spAPRp2NTm9AHsb+WNnvsvbAYXLeC276G7/VyIsnAUgraJ:yRG9BuH48VgUXJ2wkEYf2+SZe
TLSH
T19A52D52EF924297B6CDAD21AF9657B57E3F1103165C12E84FAFC8A1C24E76CD2217007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 1e64f3fbd9bfb159c8c1e034baa957ef0f423277f07a503082977e4dce47da62
MD5 e374aa2c3657c87e0f43c66b5abde8f5
SHA1 28ba77303f9988bf86e0fdf2ca2d984f2d8044b0
SHA512 f3d4b671d94cb81a61b353359491dd1c648b87e92ab53a964650d65b34597da3e3581bf9f651f79076363bf8d5603641f47733ecb85d85f3f93ca3adb6fff60d
SSDEEP 192:yRGR19NuHBXK8Qv7spzPRpHNTm9AHsb+WNnvsvKIEFPLeC276G7lVyIsnAUgraJ:yRGRBuH48MgxXY2wkhEFX2+STe
TLSH
T10452E56EF924297B6CDAD61AF865BB57E3F1103165C02E84EAFC8A1C14E76CD3217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 73452e72c5ab07cdc76b023f1bd9a56abc35edff0cc4cc36ec5d5d914aa1f743
MD5 47d4cba870f81eea44e0dcad82d42102
SHA1 ee88f7d3069abeaf4e93331addcdebca309805bf
SHA512 974b7dbd941b4e338e700c0792570c21091ccce7105b80e8425ef873ab9726064b57d7469544d9f5d6bde236964260436c558c59b640b1ce420ac2a354283b62
SSDEEP 192:yRG919NuHBXK8lv7spAPRp2NT5m9AHsb+WNnvsv5slv2HYLeC276G7xVyIsnAUg8:yRG9BuH48VgUXQm2wkRqv2HS2+SX8
TLSH
T1EC52B36EB924297B5CDAD22AF9657B57E3F2103165C12E84FAFC8A1C14D7ACD3217007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 be13bad0d6d0a0695008f17682c7b2daae52a8f02287dd7710766744557392d4
MD5 d896764f9eae6040a524254fbafab20e
SHA1 6f02019fdf778caf871cce3bbf5cd252d1d9a779
SHA512 fb48a63472ebdce272820016c62cc39cb0ce12abb3f9501efe8e18cb700f38dc070c77fe76ce2aa3b14d2d00eeded6e0ee24e58dea77413299f87b76d254081b
SSDEEP 192:yRGR19NuHBXK8Jv7spzPRpHNTm9AHsb+WNnvsvKIEFPLeC276G7lVyIsnAUgraJ:yRGRBuH48JgxXY2wkhEFX2+STe
TLSH
T1C852D56EB924297B6CDAD61AF865BB57E3F1103165C02E84EAFC8A1C14E76CD3217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 7a02f06ddd7fb14f21d68ac1b00ccb7ecdd185d987e2b1305d65d0de8e05f0c2
MD5 df95912f2d3ff54dff944d4ad9ac546f
SHA1 459a340891a2f8827570172f7ae6ede70f54160c
SHA512 c05ae1c5bc0f3ea1050911acf13bd6cd25d555492d2409dede43a8b7bc36e0129b8e6bce0677466e9a38eeebc89940ce3b1536934ff15ba2b842ed872b94543a
SSDEEP 192:yRG919NuHBXK8sv7spAPRp2NT69AHsb+WNnvsv5slv2HQLeC276G7xVyIsnAUgtK:yRG9BuH484gUX92wkRqv2Hq2+SX8
TLSH
T1C052C46EB924297B5CDAD22AF9657B57E3F2103165C11E84FAFC8A1C14E7ACD3217007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 5ab444414a02d4891c7cbb4db3735bec720facb3265bdedc915a68f6beef1cd9
MD5 191a425abbe14997e55d6c34d96395de
SHA1 567b4a799716eb9b3db36abe7163a0aaec1148fd
SHA512 d0c7f690ea61add197a2dbd706250b5de93bf454a11e6e82e25faa2759a36b7158f1e02247d411bcd65234e3d4eb5605c539a97b277b15db18786f9fbc17ab4a
SSDEEP 384:UujAr7KxkXqKf/pUZNCgVLH2Hfgsl+m7pLuLcifmnXODAH+ErU3xWHGWmvhxVtfC:UeAr7KxkXqKf/pUZNCgVLH2Hfgsgm7p/
TLSH
T15D720A677C4C9E770F94CACCD8167A4FADF6024B65E9889583FA982903C5ACF11061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 20ef59863d76f58f9f528f3ff6404bc5afb4f75c08b50a03019828d31d8fc299
MD5 25b39ba17883d921e2dfe3f77fbdcdc6
SHA1 4b4aed0d190b699a12ea5b2f0c21c054f4efb076
SHA512 38415984c438856a6d7b086e4b4376eec1b98e0fbfc1d3c56b0eded36711c7d57442c0f8ecf8344dc272fe10fb3a60af52a5b5fbb272f4613922cc514321671d
TLSH
T1F2B012608001D501C44303F01193049875145F10E705130153E06A72D8365F14114191
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5991a7.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5991a7.TMP
Size 96B
SHA256 b9c29a93d20db51d02834de3baffa43f6a6fbff2b2ab4b6e4f80ebd9e2cc67a6
MD5 9aea5a098a4df45661cf0eb65b2b09e2
SHA1 3a3635fc770083a1b3843c8f4770cae73a6517e6
SHA512 c72ce7266b5ea4f373fa49a573e63f250acda24644627e0cfa7d6b91bccbcec1130ba375aecaaae116ed61c6f37600d4dbf5745a68c0e019b624e84a6794b978
TLSH
T11BB02200C002E203C00A03F030C88AEC3030CF20C303232282E00A22CC222B08022020
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 195KB
SHA256 5e5526db797a1d45dfd3c835514dbad2ce58a719f4084745a450475446a884cc
MD5 8087fcf3ebf7f2a9f4309e51c8e1d8b3
SHA1 090b7d2be0e5f97bfc182b0e4fb00b398ffca41c
SHA512 526d9a0d6f09a8167ad5959a04c2368f8ae5d037e53fbd8907d8d324a335f4751a24e5b0d8aef65e0c08ba4d2e5ed6e592118eb14a3f8a59d40e00af08310162
SSDEEP 6144:XM5io1AxQlDYjyDlP29++JjcMW2VcVLlV:XyimBQyDhKOMWjV
TLSH
T1A11412F9591CB9AF2169C586F1035DA94CA3CDCB3526567E30D6EF4B02BE3C5C24AC24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 308aec5b67c7a98607632d0fd82e6b1d125278867adbcbb416d7652e3e625e76
MD5 a6c6edaad0c62a0a04fb50a3dd9ad7f8
SHA1 fc7fe2eb9512fce09d9b465cf4a6b18979774f17
SHA512 eae1ac000fa4600d8bf74c4b0e7f6ae0310b4899ce35575d07ada7708f4a4ce8b364eb6af662abdfe404f2ab175777b84c7bba1c9fc8b77bcb653667dd66a76f
SSDEEP 1536:4LVP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNxZ:gN++J3qUQm08KMWF0bFTcVHr6zgZ
TLSH
T1AF9312B9991E7D39636ED396A0179CAC8CD3DCCE1510517C30C76F0E14BA3A3A31B8A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 194KB
SHA256 5a16bacac46cfa977dabae7340eb40e96e188e9d9727277326c3e7148e474b68
MD5 2d478509c593abc7efc1ab4a9f88f266
SHA1 c1a71ea84b411967da92feb925d0a632deb95560
SHA512 46b60ea38c9633f9a974c1f67d683927a757d119753392aad455378184913fd6f5ee0f6f2afe218e5bf2ca379dfdf682df53e8db4d31eac6c3ee35d44c799022
SSDEEP 6144:EVs5io1AxQlDYjyDlP29++JjcMW2VcVLlV:EVSimBQyDhKOMWjV
TLSH
T1331412B95D1C76AB2298D596F1079DE94C93CDCB3126067E30D7EF4B06BF7828246C24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 194KB
SHA256 4f4879d0f5d32b5b2164485305d514a55eefd977efb6af4bb1a0dfe61f43afa6
MD5 456a8093f97b79e59373196382406a79
SHA1 f1c401bd283068df92c84a03978fb7fb0984042d
SHA512 91112b4ade4838703bfd3330e3b9d9c25af8bc7efccf09825afdcbef7f29d302cba6ef3e8ec18fa10c3b4ec1f56965fdecd5817c9aa72777b32d425f40ee7e01
SSDEEP 6144:XVs5io1AxQlDYjyDlP29++JjcMW2VcVLlV:XVSimBQyDhKOMWjV
TLSH
T1141412B95D1C7AAB2298D596F1079DE94C93CDCB3126067E30D7EF4B06BF7828246C24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExecPolar.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\ExecPolar.exe:Zone.Identifier
Size 209B
SHA256 e7c724777f8f2a1056ff7aba70fa1f8cc926f0c8cc7ec790a2a54b51462368b5
MD5 dae1e2f25efee03b0feff4a8fe90a367
SHA1 049b907e02ef2d24d059fb3f4601fa6dcde53c61
SHA512 b13e8a4f1f5fea78e881d221a6a908871c44dc57f333af750f151764cd19ea244992954b7bd01a73b741d1c3066e4f0bccaf3c568b90d36e197577a3814d6756
TLSH
T1C7D022CAC2C8392C0B2134E42AEC8698AC8F0015886556ACCD2489C7FCE43320395FCE
MD5 SHA1 SHA512 TLSH

Submit Download

Unconfirmed 617394.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 617394.crdownload
Size 9.6MB
SHA256 b2944871d54ff9bdd64a7d931a6e17e5546848d0ef0b7128515a207a8a0200ac
MD5 0fe857552dfcce7d913cb5a5d8d713ab
SHA1 3893df1fb012ee3177d32e66a0bbab58b41b61bd
SHA512 7a33c1da903e273ababf1c20e7ad2efd21bc83932a0b34602701f5b21473f005129eaa9cf95ea3d0502f43e6d17310e1f27981b5f4b3cb0b7d6c9fc7c020434b
SSDEEP 49152:EG4OBO09dO6PBPkdOdNdld/K2ylR0GZTx1mrKqf06jEN7TO/9F3iDe4mEhl5hXm2:s6PLzvFd9JxE5VNKlOSoD970GZh42
TLSH
T120A6FB17676A54D9C5BBC27892C75732BA3078994B392BF74980C2392E22FF4AD3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3040-13-0x0000020A62CB0000-0x0000020A62D5F000-memory.dmp

Download