ce6aecdf2cf2214076e20fc0db689a58654b6e1b47642288b34751a7316c6735

Analysis

user interaction
yes
max time kernel
149s
max time network
63s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/04/2026, 16:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lovec.exe
Size 377KB
Sample260429-tkcb6sht5p
SHA256 ce6aecdf2cf2214076e20fc0db689a58654b6e1b47642288b34751a7316c6735
MD5 72aba6da5d5884ffa6e5b87078702f84
SHA1 d75a79aa65e228fe284124e81f9b93d144ba8540
SHA512 a7a708c0e45661477e885a78d625b86abd9b4ab79da1af8bfbbda97534f3663863d5588fb78e189eaeeb843225cc7edc28b274e86d11150981506e6339be4c06
SSDEEP 1536:m/nqL4yObE55kNep+0Ze0fgZwRgg/JMbw3/uTh/y0qsmM4ZdyNNnttBQxLfPKgoZ:mUPObtNghM42Uyh
TLSH
T1F3845604E9F9D38DED740671CB0396A148216D6FEA2672B32AC87FB9363FC115707296
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1072	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3692	chrome.exe
3692	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3692	chrome.exe
Token: SeCreatePagefilePrivilege	3692	chrome.exe
Token: SeShutdownPrivilege	3692	chrome.exe
Token: SeCreatePagefilePrivilege	3692	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3692 wrote to memory of 4876	3692	chrome.exe	89
PID 3692 wrote to memory of 2828	3692	chrome.exe	90
PID 3692 wrote to memory of 2828	3692	chrome.exe	90
PID 3692 wrote to memory of 1072	3692	chrome.exe	91
PID 3692 wrote to memory of 1860	3692	chrome.exe	93
PID 3692 wrote to memory of 1860	3692	chrome.exe	93
PID 3692 wrote to memory of 4244	3692	chrome.exe	94
PID 3692 wrote to memory of 1508	3692	chrome.exe	95
PID 3692 wrote to memory of 4244	3692	chrome.exe	94
PID 3692 wrote to memory of 1508	3692	chrome.exe	95
PID 3692 wrote to memory of 1544	3692	chrome.exe	96
PID 3692 wrote to memory of 1544	3692	chrome.exe	96
PID 3692 wrote to memory of 5652	3692	chrome.exe	97
PID 3692 wrote to memory of 5652	3692	chrome.exe	97

C:\Users\Admin\AppData\Local\Temp\lovec.exe
"C:\Users\Admin\AppData\Local\Temp\lovec.exe"
1⤵
PID:4656

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffc9dcbc728,0x7ffc9dcbc734,0x7ffc9dcbc740
  2⤵
  PID:4876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1700,i,15793752190183343425,8916604729607483136,262144 --field-trial-handle=1940,i,16782688016329588176,5540892139485006795,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1928 /prefetch:2
  2⤵
  PID:2828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,15829847631234257248,5845524854259788067,524288 --field-trial-handle=1940,i,16782688016329588176,5540892139485006795,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2096 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2420,i,1420986244817201022,17527972261395285965,524288 --field-trial-handle=1940,i,16782688016329588176,5540892139485006795,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2432 /prefetch:8
  2⤵
  PID:1860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3268,i,16476386043448083380,9921656631619731425,2097152 --field-trial-handle=1940,i,16782688016329588176,5540892139485006795,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:4244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3272,i,14434973712435536731,9263318412748926945,2097152 --field-trial-handle=1940,i,16782688016329588176,5540892139485006795,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:1508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4476,i,18250877227956038849,10845139133407647116,2097152 --field-trial-handle=1940,i,16782688016329588176,5540892139485006795,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4424 /prefetch:2
  2⤵
  PID:1544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4684,i,15731931440046481023,11035909885695494212,2097152 --field-trial-handle=1940,i,16782688016329588176,5540892139485006795,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:5652

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3696

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 f03631345795d70043ec2dfb366e21e9f80695996f9024c4f0c0ccd66f0d7a2d
MD5 7c4f743da3de6ed7eb1bcd69f74d7b9d
SHA1 9ee4d4cc32edd7ac8c0371162c9801abc5fcd938
SHA512 4258de5f4ceffe54fc95bf6176e24b7cc3ffde0946610146da683d5591227b5b17a09355f151126fc3452192252e3d49f9792d865c78a1a791ef8327999764bb
TLSH
T1B53168F72370A9BE8611E2E4DA14AE2FCEB90521135CB8B189D46D1743F29B3D10138F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 1456f79dfe4eaa587d56d8c6e5c4afc88dc28c28f70634ee215e563deba9e8e3
MD5 6e9b5e8eaa89c016ed86992178655ca1
SHA1 305f7a9d9f169587fd5cc93c8d25fcb178556ab3
SHA512 1d0c4ce7f6e0f6639050ef6f732f662bd895a2b2621c56527c2ae8181c9ca226f55f0a62b28a3a4caf23702e417160fd5c9371a0fb7046b78a7e04a9fe89b2bd
SSDEEP 192:sRMrnWEd0JPv7tYpAPRp2hm9CHsb+WNnF60VjoPyIsnAUge:sRMrW1HhYUXem4wI0Rye
TLSH
T17D32E51EBD18653B8CCBD22AFA627767D7F1002170D42E94EAFC9A2C15EB5CD2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 e3e85507733b74e650902d1645f4c8e2a47131f5f4d003efbf580d80d51d1e18
MD5 d25832a19ff9c1c57c95ef5ecf3d457d
SHA1 30d5ae73ddd9dfab1127bd841aef79ad540016fb
SHA512 680876039281bd13201af5a0d12b9eed3257e3547eb60a743076a4ef44ddf64d39464fedf9d363ec15f80fae0d8dd3610e3a09d4d4a9512ce92d01878e2ab95f
SSDEEP 384:S0jWV7KxkXqKf/pUZNCgVLH2Hfgslvy7pLuLcifcdXODW1+ErU3IQHGtHkr0:SYWV7KxkXqKf/pUZNCgVLH2Hfgshy7pd
TLSH
T15372D8676C4C99370F94C6CCDC167E4FADB6024B65DD886893FA582A03D5ACF120A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 e3291d3857ba5df8147a392aa6ea8ae37aa83f0181f407fc0d3b340880cc61e6
MD5 0b2d4131f81c635025a67b51b74b3a48
SHA1 04592e7e4aef7d7b8cc7a0f530d2edb357ac80c7
SHA512 4af0f9fe27fd6be9df5d887764913f7db06a37e883f910214418de5d1faf1aa387901bebb7dd6a207a32eca722d4d90c320bb3260ea832d1d27abcc0ad3d9f70
TLSH
T1B0B0125180019511C43302F4515204883904AF148608230353E06AF1D8671E14228251
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5897b7.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5897b7.TMP
Size 96B
SHA256 489c98fc832c3e2411b8dc592505177a280c43f6ccefc112d95f0a98faedff93
MD5 952d7d959d3006ff5289933e6bf54d67
SHA1 f100f5d0f1c2efd1b7757e7e6df3c2ec9f104df6
SHA512 38d38a0a5b7bb90c8da85f5a3d443e1aca5198bbf303e8d71adfe80aa99eddb3eb860e9d12c92b0c789c5910e695b983a8ac7469127d06062c6e92b4e9e32669
TLSH
T105B00275C1036213C14203B0A9A9A5D875A4DF35D7132656A2F01B6BEC367609A2A560
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 afc10c1885a09e06e8f48d072c50928ba7ddfa9704c3dfccc92999f574ba106d
MD5 e933287f371582d44a68290067e32c35
SHA1 5ba0e9de2d658a0b45bd649f39c83507efb8d6ee
SHA512 db938da91f16b5649c780e8db18f19009bf75e490a0254ac4133bbcee005084ab306ef8394b4135d9540b189969af90a924858e802e8d462e477d7588321ec5e
SSDEEP 1536:0NQcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEB:IQ3Qw/xLANk0mUW5GmRntSFCjEEN3
TLSH
T1689312BA4E1A46F7957E4AC176AD7808CE22130D70AFA9CC316C639C61941C92B73F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 971aa58991a655c82a4893381983eabd52b4c285cee9eb81e0cb36128dad0d76
MD5 4062131bc0db129e326219b0c5bdde9a
SHA1 fe317480ea71100e74f23919892966e0af256c98
SHA512 f0ffb7d5f59e2c5a6d11b7218647ecc4909cfaf4bd8d012337406b453fdc7e74e35a8e2c1860abdd8990cceda9750223a8910646b19cbb7d230a7934b946b666
SSDEEP 1536:oPcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YE3Y:s3Qw/xLANk0mUW5GmRntSFCjEEN+
TLSH
T1269312BA5E1A49F755BE4AD2769D780ACE12130D709FA9CC726C638C21D41C92B73E33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download