a1c5fa52f0e5938669c0b9c3d8a373f51492bb7eae8d3e93a46eb445cd30f6eb

Analysis

max time kernel
152s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 19:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-11_31f70ed9f5c12291b6f7e77d7899dbe1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
Size 124.6MB
Sample260811-x6fhhaw1ey
SHA256 a1c5fa52f0e5938669c0b9c3d8a373f51492bb7eae8d3e93a46eb445cd30f6eb
MD5 31f70ed9f5c12291b6f7e77d7899dbe1
SHA1 148f7a08e0464f95b0fa7b93a805595bd87b51a3
SHA512 0fcc3a80dfc74719d35641c1a56eece6308e7452745eea09c57779371fbc489636b633c7cdffacff952e5fce9c1cb2c845a847e7eb288ac68335c93d9529b018
SSDEEP 3145728:WPTH4EkJLGtZsM/HpOCvt9+bFIKr9qhE/aDoO7Dxapz7:WP0EyGDHQb5I6iDsF
TLSH
T15B5833AAD6681044E25BE4F6CAD0947F729F35737C4D8AED1CD1436218E92879B0EF0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 12 IoCs

pid	Process
4112	Update.exe
4076	Squirrel.exe
3716	MeuPDVOnline.exe
5444	Update.exe
5608	MeuPDVOnline.exe
1676	MeuPDVOnline.exe
5768	MeuPDVOnline.exe
2040	MeuPDVOnline.exe
6028	MeuPDVOnline.exe
4660	MeuPDVOnline.exe
5336	Update.exe
1984	MeuPDVOnline.exe

Loads dropped DLL 8 IoCs

pid	Process
6028	MeuPDVOnline.exe
6028	MeuPDVOnline.exe
6028	MeuPDVOnline.exe
6028	MeuPDVOnline.exe
5768	MeuPDVOnline.exe
4660	MeuPDVOnline.exe
5768	MeuPDVOnline.exe
1984	MeuPDVOnline.exe

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
8	raw.githubusercontent.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-11_31f70ed9f5c12291b6f7e77d7899dbe1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MeuPDVOnline.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MeuPDVOnline.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MeuPDVOnline.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MeuPDVOnline.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MeuPDVOnline.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MeuPDVOnline.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MeuPDVOnline.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MeuPDVOnline.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MeuPDVOnline.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MeuPDVOnline.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MeuPDVOnline.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MeuPDVOnline.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\meupdvonline\shell\open\command	MeuPDVOnline.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\meupdvonline\shell	MeuPDVOnline.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\meupdvonline\shell\open	MeuPDVOnline.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\meupdvonline\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\MeuPDVOnline\\app-1.0.0\\MeuPDVOnline.exe\" \"%1\""	MeuPDVOnline.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\meupdvonline	MeuPDVOnline.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\meupdvonline\URL Protocol	MeuPDVOnline.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\meupdvonline\ = "URL:meupdvonline"	MeuPDVOnline.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4112	Update.exe
4112	Update.exe
1984	MeuPDVOnline.exe
1984	MeuPDVOnline.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4112	Update.exe
Token: SeShutdownPrivilege	5768	MeuPDVOnline.exe
Token: SeCreatePagefilePrivilege	5768	MeuPDVOnline.exe
Token: SeShutdownPrivilege	5768	MeuPDVOnline.exe
Token: SeCreatePagefilePrivilege	5768	MeuPDVOnline.exe
Token: SeShutdownPrivilege	5768	MeuPDVOnline.exe
Token: SeCreatePagefilePrivilege	5768	MeuPDVOnline.exe
Token: SeShutdownPrivilege	5768	MeuPDVOnline.exe
Token: SeCreatePagefilePrivilege	5768	MeuPDVOnline.exe
Token: SeShutdownPrivilege	5768	MeuPDVOnline.exe
Token: SeCreatePagefilePrivilege	5768	MeuPDVOnline.exe
Token: SeShutdownPrivilege	5768	MeuPDVOnline.exe
Token: SeCreatePagefilePrivilege	5768	MeuPDVOnline.exe
Token: SeShutdownPrivilege	5768	MeuPDVOnline.exe
Token: SeCreatePagefilePrivilege	5768	MeuPDVOnline.exe
Token: SeShutdownPrivilege	5768	MeuPDVOnline.exe
Token: SeCreatePagefilePrivilege	5768	MeuPDVOnline.exe
Token: SeShutdownPrivilege	5768	MeuPDVOnline.exe
Token: SeCreatePagefilePrivilege	5768	MeuPDVOnline.exe
Token: SeShutdownPrivilege	5768	MeuPDVOnline.exe
Token: SeCreatePagefilePrivilege	5768	MeuPDVOnline.exe
Token: SeShutdownPrivilege	5768	MeuPDVOnline.exe
Token: SeCreatePagefilePrivilege	5768	MeuPDVOnline.exe
Token: SeShutdownPrivilege	5768	MeuPDVOnline.exe
Token: SeCreatePagefilePrivilege	5768	MeuPDVOnline.exe
Token: SeShutdownPrivilege	5768	MeuPDVOnline.exe
Token: SeCreatePagefilePrivilege	5768	MeuPDVOnline.exe
Token: SeShutdownPrivilege	5768	MeuPDVOnline.exe
Token: SeCreatePagefilePrivilege	5768	MeuPDVOnline.exe
Token: SeShutdownPrivilege	5768	MeuPDVOnline.exe
Token: SeCreatePagefilePrivilege	5768	MeuPDVOnline.exe
Token: SeShutdownPrivilege	5768	MeuPDVOnline.exe
Token: SeCreatePagefilePrivilege	5768	MeuPDVOnline.exe
Token: SeShutdownPrivilege	5768	MeuPDVOnline.exe
Token: SeCreatePagefilePrivilege	5768	MeuPDVOnline.exe
Token: SeShutdownPrivilege	5768	MeuPDVOnline.exe
Token: SeCreatePagefilePrivilege	5768	MeuPDVOnline.exe
Token: SeShutdownPrivilege	5768	MeuPDVOnline.exe
Token: SeCreatePagefilePrivilege	5768	MeuPDVOnline.exe
Token: SeShutdownPrivilege	5768	MeuPDVOnline.exe
Token: SeCreatePagefilePrivilege	5768	MeuPDVOnline.exe
Token: SeShutdownPrivilege	5768	MeuPDVOnline.exe
Token: SeCreatePagefilePrivilege	5768	MeuPDVOnline.exe
Token: SeShutdownPrivilege	5768	MeuPDVOnline.exe
Token: SeCreatePagefilePrivilege	5768	MeuPDVOnline.exe
Token: SeShutdownPrivilege	5768	MeuPDVOnline.exe
Token: SeCreatePagefilePrivilege	5768	MeuPDVOnline.exe
Token: SeShutdownPrivilege	5768	MeuPDVOnline.exe
Token: SeCreatePagefilePrivilege	5768	MeuPDVOnline.exe
Token: SeShutdownPrivilege	5768	MeuPDVOnline.exe
Token: SeCreatePagefilePrivilege	5768	MeuPDVOnline.exe
Token: SeShutdownPrivilege	5768	MeuPDVOnline.exe
Token: SeCreatePagefilePrivilege	5768	MeuPDVOnline.exe
Token: SeShutdownPrivilege	5768	MeuPDVOnline.exe
Token: SeCreatePagefilePrivilege	5768	MeuPDVOnline.exe
Token: SeShutdownPrivilege	5768	MeuPDVOnline.exe
Token: SeCreatePagefilePrivilege	5768	MeuPDVOnline.exe
Token: SeShutdownPrivilege	5768	MeuPDVOnline.exe
Token: SeCreatePagefilePrivilege	5768	MeuPDVOnline.exe
Token: SeShutdownPrivilege	5768	MeuPDVOnline.exe
Token: SeCreatePagefilePrivilege	5768	MeuPDVOnline.exe
Token: SeShutdownPrivilege	5768	MeuPDVOnline.exe
Token: SeCreatePagefilePrivilege	5768	MeuPDVOnline.exe
Token: SeShutdownPrivilege	5768	MeuPDVOnline.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4112	Update.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1528 wrote to memory of 4112	1528	2026-08-11_31f70ed9f5c12291b6f7e77d7899dbe1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe	89
PID 4112 wrote to memory of 4076	4112	Update.exe	90
PID 4112 wrote to memory of 3716	4112	Update.exe	91
PID 3716 wrote to memory of 5444	3716	MeuPDVOnline.exe	92
PID 3716 wrote to memory of 5608	3716	MeuPDVOnline.exe	93
PID 3716 wrote to memory of 1676	3716	MeuPDVOnline.exe	94
PID 4112 wrote to memory of 5768	4112	Update.exe	95
PID 5768 wrote to memory of 6028	5768	MeuPDVOnline.exe	97
PID 5768 wrote to memory of 2040	5768	MeuPDVOnline.exe	98
PID 5768 wrote to memory of 4660	5768	MeuPDVOnline.exe	99
PID 5768 wrote to memory of 5336	5768	MeuPDVOnline.exe	100
PID 5768 wrote to memory of 1984	5768	MeuPDVOnline.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-11_31f70ed9f5c12291b6f7e77d7899dbe1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_31f70ed9f5c12291b6f7e77d7899dbe1_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1528
- C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
  "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4112
- - C:\Users\Admin\AppData\Local\MeuPDVOnline\app-1.0.0\Squirrel.exe
    "C:\Users\Admin\AppData\Local\MeuPDVOnline\app-1.0.0\Squirrel.exe" --updateSelf=C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
    3⤵
    - Executes dropped EXE
    PID:4076
- - C:\Users\Admin\AppData\Local\MeuPDVOnline\app-1.0.0\MeuPDVOnline.exe
    "C:\Users\Admin\AppData\Local\MeuPDVOnline\app-1.0.0\MeuPDVOnline.exe" --squirrel-install 1.0.0
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious use of WriteProcessMemory
    PID:3716
  - - C:\Users\Admin\AppData\Local\MeuPDVOnline\Update.exe
      C:\Users\Admin\AppData\Local\MeuPDVOnline\Update.exe --createShortcut=MeuPDVOnline.exe
      4⤵
      Executes dropped EXE
      PID:5444
  - - C:\Users\Admin\AppData\Local\MeuPDVOnline\app-1.0.0\MeuPDVOnline.exe
      "C:\Users\Admin\AppData\Local\MeuPDVOnline\app-1.0.0\MeuPDVOnline.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\MeuPDVOnline" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1736,i,12737316559417189263,4258280911844103687,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1740,i,16078728762789367580,814844689941530896,4 --trace-process-track-uuid=1653604857 --mojo-platform-channel-handle=1732 /prefetch:2
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5608
  - - C:\Users\Admin\AppData\Local\MeuPDVOnline\app-1.0.0\MeuPDVOnline.exe
      "C:\Users\Admin\AppData\Local\MeuPDVOnline\app-1.0.0\MeuPDVOnline.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\MeuPDVOnline" --standard-schemes=meupdv-image --secure-schemes=meupdv-image --cors-schemes=meupdv-image --fetch-schemes=meupdv-image --streaming-schemes=meupdv-image --field-trial-handle=1736,i,12737316559417189263,4258280911844103687,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1740,i,16078728762789367580,814844689941530896,4 --trace-process-track-uuid=521694016 --mojo-platform-channel-handle=1204 /prefetch:11
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1676
- - C:\Users\Admin\AppData\Local\MeuPDVOnline\app-1.0.0\MeuPDVOnline.exe
    "C:\Users\Admin\AppData\Local\MeuPDVOnline\app-1.0.0\MeuPDVOnline.exe" --squirrel-firstrun
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5768
  - - C:\Users\Admin\AppData\Local\MeuPDVOnline\app-1.0.0\MeuPDVOnline.exe
      "C:\Users\Admin\AppData\Local\MeuPDVOnline\app-1.0.0\MeuPDVOnline.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\MeuPDVOnline" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1732,i,7877703826092051399,10265414614808294062,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1736,i,8404848864199503125,7031563289225903725,4 --trace-process-track-uuid=1653604857 --mojo-platform-channel-handle=1728 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:6028
  - - C:\Users\Admin\AppData\Local\MeuPDVOnline\app-1.0.0\MeuPDVOnline.exe
      "C:\Users\Admin\AppData\Local\MeuPDVOnline\app-1.0.0\MeuPDVOnline.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\MeuPDVOnline" --standard-schemes=meupdv-image --secure-schemes=meupdv-image --cors-schemes=meupdv-image --fetch-schemes=meupdv-image --streaming-schemes=meupdv-image --field-trial-handle=1732,i,7877703826092051399,10265414614808294062,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1736,i,8404848864199503125,7031563289225903725,4 --trace-process-track-uuid=521694016 --mojo-platform-channel-handle=1824 /prefetch:11
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2040
  - - C:\Users\Admin\AppData\Local\MeuPDVOnline\app-1.0.0\MeuPDVOnline.exe
      "C:\Users\Admin\AppData\Local\MeuPDVOnline\app-1.0.0\MeuPDVOnline.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\MeuPDVOnline" --standard-schemes=meupdv-image --secure-schemes=meupdv-image --cors-schemes=meupdv-image --fetch-schemes=meupdv-image --streaming-schemes=meupdv-image --app-user-model-id=com.squirrel.MeuPDVOnline.MeuPDVOnline --app-path="C:\Users\Admin\AppData\Local\MeuPDVOnline\app-1.0.0\resources\app.asar" --no-sandbox --no-zygote --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1732,i,7877703826092051399,10265414614808294062,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1736,i,8404848864199503125,7031563289225903725,4 --trace-process-track-uuid=3684750470 --mojo-platform-channel-handle=3140 /prefetch:1
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:4660
  - - C:\Users\Admin\AppData\Local\MeuPDVOnline\Update.exe
      C:\Users\Admin\AppData\Local\MeuPDVOnline\Update.exe --createShortcut=MeuPDVOnline.exe
      4⤵
      Executes dropped EXE
      PID:5336
  - - C:\Users\Admin\AppData\Local\MeuPDVOnline\app-1.0.0\MeuPDVOnline.exe
      "C:\Users\Admin\AppData\Local\MeuPDVOnline\app-1.0.0\MeuPDVOnline.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --user-data-dir="C:\Users\Admin\AppData\Roaming\MeuPDVOnline" --gpu-preferences=SAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAEIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1732,i,7877703826092051399,10265414614808294062,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1736,i,8404848864199503125,7031563289225903725,4 --trace-process-track-uuid=2552839629 --mojo-platform-channel-handle=3504 /prefetch:10
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MeuPDVOnline.exe

Path C:\Users\Admin\AppData\Local\MeuPDVOnline\MeuPDVOnline.exe
Size 318KB
SHA256 f58c244bf9f9237c433d87159ef8656c1ba746260f42ce42d8715419d75704db
MD5 0a60291fe6540af218f3ad567f844e70
SHA1 da7a8a30014b6d22a6c8c73ae9eb07690aa98042
SHA512 ff5d38b046c757f0957bbbce93acc3dc9dc49032e0e2aa64665f80cdd22a3de3b2319d9ea9bc8ce2d651f40d4c3cf4f2e659e6f63d7c01db00303411970cbbba
SSDEEP 6144:sZzvhs2Z4n1E7g34XtVYAOfTdLVZSESoWsSU:sJ+2Z4nShVY5JSAWsSU
TLSH
T1F8648C21B9D2C4B2D1B2063409F8E7B5566DFD200F628E7B67D4372E1F741C29632AA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Squirrel-Shortcut.log

Path C:\Users\Admin\AppData\Local\MeuPDVOnline\Squirrel-Shortcut.log
Size 1KB
SHA256 ade2b3129c8d576dca2064679184a9e1d9111edfe9df976b26cd28b81a19e449
MD5 ebffd96f525cf87e9665ebc05a8eed7a
SHA1 c26b2caa4b4163bdd71f69777aabdd368e4db3dc
SHA512 6f6e6d013a408422e32758b4190e41931cfcc78e7b9052614aa0b70286f69041cbd19c454c602701198c8c6ac59f7a02616f0ca5b5dadceb1a747edbc3351d82
TLSH
T1A8218B2183E9851EE003D89397B2B54CC1DA454A2F8F7EB0CBC0844CAAD603DF9D6452
MD5 SHA1 SHA512 TLSH

Submit Download

D3DCompiler_47.dll

Path C:\Users\Admin\AppData\Local\MeuPDVOnline\app-1.0.0\D3DCompiler_47.dll
Size 4.0MB
SHA256 af8934f48cdb8bb173cea698f2f098081e20f7651b6cde2727413d44263e8bb3
MD5 f620e01181acb5cd313aeea81e6cda65
SHA1 fbcf1b4ac1b3b5a1311e72ec6c52b66ca6b3dfc9
SHA512 ee98ab79e3a043fdbed7dfe300b388394aec6e1e6834e66740360e00c8ad61feb402556bf3d958976d9256095c7bca8bc87c34f52d3bd980c7d11b4af82c64db
SSDEEP 49152:xlEaLLznrGiwdkHdA/UMo2h5XttSdY8f2W0z0oP0Qi0Cd5Y3zH4En8++DrBxDjP5:xW8WL9cdBRkCAzhngDrBxfqHGH
TLSH
T138169E31FA428172C8CA05F066AEB76A957D9B30173844D352D0AD79EC702D36F3AB97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\MeuPDVOnline\app-1.0.0\chrome_100_percent.pak
Size 113KB
SHA256 34433fa04ddf5eb78b3b4e9c64a3af626e28641907ad7a6086614eb6a8f00a07
MD5 a8d9be85b9a9c2a1be1815b29cfde9ce
SHA1 9b8df5aebf541d063311ad4c2be1d23398f13a33
SHA512 37ad60e74c7e439f83b87ce61018619568914ee491289e3fb34234a0c4e3258c4986cd56e6e58652134058ab1f824a90499d4aed46e611937ec946d9a3b680ec
SSDEEP 3072:fnk4PisCv+/P9NebGz8LI1TwILjQBHe7YAP18RVC2I:fnZYWFUbGz8LI1TdjQBQCrC
TLSH
T1F8B3E0D773B0AD7DD6870BB783660070FCB31B2D06C2160A4A99E479652AF88D8D93D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\MeuPDVOnline\app-1.0.0\chrome_200_percent.pak
Size 183KB
SHA256 581c8d53199c10512d31a340699f9ad269f8eea5fe6bc49e05c1bde98ee612aa
MD5 e0d4001307e8e8554810b27796ad636f
SHA1 be92e88b55ae85cc5118009af0fe32c9470c0dca
SHA512 762324239832fa1a531cc3da546df8627610a164c13d83f12b64c28e207273989fa7da0c4e96787ab0a5d09f5202ebc31895f09ad2fdbea4e6e70c0d2b4f51d1
SSDEEP 3072:jgJ8LahaY7d6iN6uSwxohPQDQYaEjrvy/IwXJPpLjQBHe7YAP10uxR/TbIM0:jxGQ+N6uSZQDQYakvyAk9jQBQNd4
TLSH
T1C704F2D723B8AE3DD9570B73926610E0FE7A20291EB3110E469F98397925F8CD9C9343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\MeuPDVOnline\app-1.0.0\ffmpeg.dll
Size 2.7MB
SHA256 bf0775839f93d92aae32b7cdccbc210106cd19113d51d466505c21884f85ba66
MD5 2ed9c6375a18aac161356bc334129e93
SHA1 cb77d730f2adf7697c6c9901d9dd15019d3c0948
SHA512 2869b5f3fac397d8c6760ad70ce0c594f1eab65ca4b64d838ac7b2c58aa80c8c41329337f81ce8d21307e4285d65d19db968b6f9d800e0cb4c5bb31594179537
SSDEEP 49152:Y+JUY51+m4d0dUw7unI7vQSjpyLAGBl2:Y+iY54mw0yw6qjpyLAs
TLSH
T12CD5AF52265063EED4AE3631354EB73F5A742A6487118CE7E7842DAC6BBCBC045FB306
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\MeuPDVOnline\app-1.0.0\icudtl.dat
Size 10.3MB
SHA256 1cf67874b5a87a8363a86fb3f81e3cbbed54d389062dab8fb52308d5cf8c8612
MD5 5bfd3eefca4b5ef2d1a869396390a7de
SHA1 c58567f7fe308ccd43f406b70aa8bf6fdbea4f3a
SHA512 4489a55fa0b47c8d1e9679032e036c7998f82efb4191b98900ae40cfc30a26b65290867527161c594c42fe7999b2314f8928a5d717d65d4eeedd4fdb0ed0f427
SSDEEP 196608:A6akBhOR8LE/dUHiXUxa/iJ53IWhls2E91Z0G:AqwKLBHiXUxa/iJ53IWhls2E6G
TLSH
T118B63903A2EB4EC6F9FB5F7498F562779527BD49AE32804A51043F3B1C333908664B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libegl.dll

Path C:\Users\Admin\AppData\Local\MeuPDVOnline\app-1.0.0\libegl.dll
Size 429KB
SHA256 af81cf11719ae51a8686caf8ec061552721c8e8c445e2c1e818797128fbe63e7
MD5 8a20a3695bbd1723f5a7dd0f0eab13a3
SHA1 88a5c68dae6f675ff1123dbd3174592fff8f6fe5
SHA512 476b730a76f105e797de69f44ab01bbd14c4d5941142dfa9edefea9f03e368488ccde46ba8963f5f8be6fc780684d6c08349177304d59bb1dc8ab0ae55fc35a2
SSDEEP 6144:jKH8wPInTQyUOQ5mhP/t+9JRWHsAqDbbfF06IkI28QZ8Y2p2hPfd+4R:2cwPInZUXCMsHufI/HYhdf
TLSH
T1E8948F027560D4FEC86F207038E4E7795B7DA8701B2569C763841EFAAEF06C24635B6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libglesv2.dll

Path C:\Users\Admin\AppData\Local\MeuPDVOnline\app-1.0.0\libglesv2.dll
Size 6.9MB
SHA256 245db19d7aaa3ffaf32cf129b67bbb61e2db57a5c6bb6aa2953ea3ef2505ea44
MD5 4d148c65ec106df8fbe6ad1b6bb3b239
SHA1 5faa06ffa1f016cdb755f8168b2daabea4d873d2
SHA512 e2206ec07273437ffcf72621e3698f8d3f428cf59c2d565eca66c340080a57bb7b0b6d1f32f79b13eae75758f91ed1d0523348390d5cb58a40b2a570c282ffad
SSDEEP 98304:e6doRjj+BCMA9hZgecwOdIXx6UlNniIWdabcM2ElcF3D:PdoRjj+BCMyTgeP6IB6UlNnis92nF
TLSH
T19176AE026590A074C80B31713419E7BDAD344B5657148BC7FF896EA87FA4AC362BB36F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\MeuPDVOnline\app-1.0.0\locales\en-US.pak
Size 549KB
SHA256 446a0f711467b162cced38128932f712e4a53fe344a165110196c366fd3d87ea
MD5 0555742b1e5f91449a199b9c42c1eb3e
SHA1 2f7ecfa75faca014c06e435fc6d449072d47ac41
SHA512 6d5f20741c97933d7c2d7011b696632e056db182941483e6c5675ecaf2b18132abbc0397b2c703e79a878838db806766aab69b2c90f6fd1dce377623d5501af6
SSDEEP 6144:LOvSsWLA2zb+H4HfYOMg/jScMP9sQqblfaYQhp1B1OjRng98//Bwf:MAxJHfdZM6Qqbg0jBwf
TLSH
T1C7C44D1FF744112A05A352A2BF0995A2FF32D06CA35112563CBD812C33B6B6693B77F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\MeuPDVOnline\app-1.0.0\resources.pak
Size 6.5MB
SHA256 d3b5b0c43701dbac52e07085f152efa7418bc95b13a4a3667c6439b51d680e1e
MD5 384bda03edb522b886298606ef6d58ae
SHA1 1da930340547ff069579a86673483c31f4bfa354
SHA512 41517f83c03ca69be542bff4d2bac645dd0819b20b8483416b459d530f4d674418d43019d3b44606c752f8004d779ead0c3bcbe1bd22eec596378492e95383c7
SSDEEP 196608:PmNCBRtfTL5QoCmkrB0QMguFBgt3m06Rw+K6:PmoTtC9mkr4jFWBm0iw+/
TLSH
T1FD6633DB71342C1BC6C443BE4518463EA89C6F707E86D2E2145C7268DCAE64A6EC877F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.asar

Path C:\Users\Admin\AppData\Local\MeuPDVOnline\app-1.0.0\resources\app.asar
Size 46.4MB
SHA256 4c201a4c41f077ed645de2bf12925fe9c63bcb8b3c2b5be7c1855db6b90953a8
MD5 99010697105c062735988ff5c2eac875
SHA1 aeee016b55f016e8e2d48823a070ba5e93de684f
SHA512 aadb3474082313de92a4c27325d9512215d311f6646ff918ed94df44053ad6df793ab6aa82ab9869f4710c927be02f002456ba467f4ac5dbecea38c3ddd2468d
SSDEEP 196608:vCd8tKtP6uFOd90T2tBuBqLO/zBqnGBHBY86OaE:vCd8tKtP6uFOdRnjOaE
TLSH
T12CB77D637786223F0AA350F7931F6C85B529F1273509D890BD5EC2280F585AD42BBFE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

@serialport+bindings-cpp.node

Path C:\Users\Admin\AppData\Local\MeuPDVOnline\app-1.0.0\resources\app.asar.unpacked\node_modules\@serialport\bindings-cpp\prebuilds\win32-ia32\@serialport+bindings-cpp.node
Size 180KB
SHA256 411c9635a15b34281a5f6cb0de9d61cc2e3b8cc4c9cae6fb541fadc34e28cd90
MD5 9cc22b6b84f928f8ede1dd2882e05c3c
SHA1 27d72c3fa63b3d3734c2e47ea2215581c487554c
SHA512 2bf3b07fe732cff4c8c608aa466923bfa654292a4e62326caa2f0b8443370a9037fe6e574d8cac7ee3145612d3237fe68300f0a3d9de764ae6aaf800e76e90ba
SSDEEP 3072:XtxG6o2onGfTPLQMt3zHnLLa2/sh46jHtUdGPOX:dxGz2pLQM17LW2aHmFX
TLSH
T196048D21B180D03BE56F0530153D9BB79A2CB9310FA099DF9BD81E6A9E341C2973DB67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

better_sqlite3.node

Path C:\Users\Admin\AppData\Local\MeuPDVOnline\app-1.0.0\resources\app.asar.unpacked\node_modules\better-sqlite3\build\Release\better_sqlite3.node
Size 1.5MB
SHA256 8906c2120f68249aafbc7bb181831fd9fcc26e1b617e11201770d3043f5ae391
MD5 b2d400d63e1125a01fae8646cb807e27
SHA1 b409d32b325555de306640b4c70890e2c4195007
SHA512 f1df0f7a20aea6700b7adf3c9b5a55caa18b871e195ddfa0dddd792822f84c6b49677e27aecbd07f237f7d10c44b3548d86924e194e85e2b9ef1acd4026487fc
SSDEEP 24576:vjIZoeTjoq8pt1UFSxS5L3GQ8FCvArBbC4B6hpxQvAjcZsAqaYm61V74S/JQ3o7z:8iah80LqQ+gQvAIsAqFVMY7mdEp
TLSH
T178757C82EB86A0F1EFC911B111BBABFB1D35B205871588DBC1A02CD559352D37A3F789
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources-integrity.json

Path C:\Users\Admin\AppData\Local\MeuPDVOnline\app-1.0.0\resources\resources-integrity.json
Size 360B
SHA256 cecd8942bf39ba54daf932ebf0a3ae7be7571b11e16e13013a199324a4a37448
MD5 c1bf696b1c2fdc517f28ede24a3f1041
SHA1 29fc3c418ee20ba9597dfd97b38b433de93f7ad5
SHA512 762b9db11746db05376471039a02e68dd827c995369d256467e91a04c3d7b38d4bda021e9753219d5167cc7c3bc6093a0cc58c2536ee739e7c59af0de5e41b96
TLSH
T17EE0C0548235356324D5452D00D9058254504F3B0C207E1D539BD38C8BBDC7B3176E7D
MD5 SHA1 SHA512 TLSH

Submit Download

squirrel.exe

Path C:\Users\Admin\AppData\Local\MeuPDVOnline\app-1.0.0\squirrel.exe
Size 1.9MB
SHA256 1f2644d3b67e4633ef4690d277e9dc7b130f0fde5ac14df67733ac7d73d649eb
MD5 6180c7d8074e292b593291a116dba67e
SHA1 3b3cdca3e97146bbc41547dc6b36746c9a093eef
SHA512 0497013ffe32bec46bb7d11362b925485c8a2d5bb9209f1006d6cab1d9903cbe7d319c9e599743568bd95c258f5a2ebf53dd97254e487207437e6cf65d978cbc
SSDEEP 24576:YWltPuAnUCiag6CKM2zCy9sQuOjj1VgZej6GeS4lNrCze5qhYp4t9myW:lt3UCiag6CKM2zCyZuOjJaxSS5qh
TLSH
T1C2957C01E7E89F2BE56F6B76E030055813F3E9867376F78B2A4871792A937504E053A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\MeuPDVOnline\app-1.0.0\v8_context_snapshot.bin
Size 709KB
SHA256 b7236631f4721dc19a5c3454f34f4832dc4817cd0b4a5f3d729578e4d2b3f4d6
MD5 df6a09f21db79899e452bd7588f1842f
SHA1 3f1bfb432998b6a628b2501d00dd80870e3d60b4
SHA512 b5c1f357ce6378ef1dbf1b7618dabea9cf71dddcbe8ce08d3c7b0b88f920a754017de878a41be8a68c76e34a850a9f5066465494dc785a05dc23e1f22f4bb1ad
SSDEEP 6144:F2nRgkVqtUvIF/vlqxTN1+hDtZnFCEYcOyALq8ur0zW5VD6UoxZC6F:FYRgwqnAsJtDEqRQKHDZKZ/F
TLSH
T1E8F45264FA02DF9AC6192AB88ED74BCA3AB0B54E4992C20F3355C73CFD7D3A51D25118
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\MeuPDVOnline\app-1.0.0\vk_swiftshader.dll
Size 4.8MB
SHA256 434269008611abe2c4e839f09e9f4d0da1229cbb24acfa4bdfa3d11a453b0eba
MD5 731baf795606f48b5c5f4a8f710a6d32
SHA1 3a7b637a9f2b43ef1283d3fea27607eef0968e53
SHA512 3aa63004ad2bebcb00daf56ba5436d3f6fe981e929586f7695f4117234094bfc757fe24cf4b9597900597bc415e5eb049d29581c50861c68b4de8565aca59bd9
SSDEEP 98304:OYUFkI8/uXM2YnsBfSCmINbj9VSDk8dQU:OYUm/uXMfnPl+bj6D/QU
TLSH
T128367E02B111A074F80720B639186779DE70C7206B528ACBEA846DDDAFB85E3563F75F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RELEASES

Path C:\Users\Admin\AppData\Local\SquirrelTemp\RELEASES
Size 83B
SHA256 cf7f15d92d7c4397d5cdc80d3ba622d1338a4a68524662afa18c0a49ad98eea8
MD5 1dfe4fcc35e41efe23d8c05141808de2
SHA1 d4cec511e417a6b12fcda4b4650a1c990d3438f1
SHA512 7ae330194316f9f82474f739d50e6a209b951cbe1a6bc17e49f62133f8ab40e7ec4b446367e8b380d912f7bede157654205868a2af46a24dc8637ed574d1d388
TLSH
T1C2A0124486003498D482442436013E089C0100110BD1A0719CC0C185113D219E53050C
MD5 SHA1 SHA512 TLSH

Submit Download

Update.exe

Path C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
Size 1.8MB
SHA256 76359cd4b0349a83337b941332ad042c90351c2bb0a4628307740324c97984cc
MD5 a560bad9e373ea5223792d60bede2b13
SHA1 82a0da9b52741d8994f28ad9ed6cbd3e6d3538fa
SHA512 58a1b4e1580273e1e5021dd2309b1841767d2a4be76ab4a7d4ff11b53fa9de068f6da67bf0dccfb19b4c91351387c0e6e200a2a864ec3fa737a1cb0970c8242c
SSDEEP 24576:pWltPuAnUCiag6CKM2zCy9sQuOjj1VgZej6GeS4lNrCze5qhYp4t9m2:0t3UCiag6CKM2zCyZuOjJaxSS5qh
TLSH
T15A956C01E7E89F2BE56F6B76E030055813F3E9867376F78B2A4871792A937504E053A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

background.gif

Path C:\Users\Admin\AppData\Local\SquirrelTemp\background.gif
Size 11KB
SHA256 8f4f90c601743c95b3a2fcbc5279dcd52df1aa3aed33d00ea5b7378c1722f437
MD5 4193c45d7c046d8b9adcf1920b67f88e
SHA1 21ac15ec5735d71d8d287545e1ebb78de566757d
SHA512 664db0db102e1e1415a2a8da578af183c0876d00e9452cb3f7206a744b0b83ec03a43abdee51bbc6e09c3813aaafab5b9f1e2b3a8acf5ca8af53c33e2a3d745c
SSDEEP 192:y7yGmE1UlHXzv6txdDaSRXCZ6BGcQHE0l2AH2rGiN3UJtOyZohR7FfqiFw:imE6Xzv6HFaSR06BGcf0lrH2rGw3UHyG
TLSH
T11542AF2D05B9C08BC6592436C06F1CFB607C2D74F57DB2BB66E16EF00B05E2396567A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setupIcon.ico

Path C:\Users\Admin\AppData\Local\SquirrelTemp\setupIcon.ico
Size 67KB
SHA256 1b57b23d38e281cd7a39cdb0709cb45c4d4fe5acbdfee5f77603828b3069e0a6
MD5 f978c86df095271bb3736f0a97e3e222
SHA1 6a49966c14535f34daa87b45efc1c92f808fe865
SHA512 107a23bd1ba34be4950c62a7bea17d48da2ccab48e83586c1cded98bf26295ad599130461e9e7e4f7a8a3b63a137da2ba124a36e8472674fdc665e7246574f8f
SSDEEP 1536:jgSEmF7j1hbLjVszhMlSISPgf4zIldUUXr7jitXMcAHEfSaWQ:j7Fj3b9SwDSowkjitXMc7h
TLSH
T15B6302E27955F24CB1F0057BC9DC21FDC2CD9F2606880D6A8C149B3F836E6412A45ABF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\MeuPDVOnline\DawnWebGPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\MeuPDVOnline\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\MeuPDVOnline\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\MeuPDVOnline\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\MeuPDVOnline\Local State
Size 490B
SHA256 948c4c714740398c692c2fe0437464e58e59fdfdda72763151fe0bb99b620339
MD5 b7e7e6ecd2d61748be8aeced181a2f31
SHA1 ab98e55db424826bb8786b10609de6059298e3a0
SHA512 45f7cc7633e4ca379417b8a7e71146af7391df4de9adbc7ea753e962cffc5963f1d7eb19ceb1367a5b055c43ac01dd4e5eea0b41324f5fa3f1f884aad53ed299
TLSH
T159F054B12C213F76AE2D4BC8590751131DBF309741826250F84E86010167FA4670BC32
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\MeuPDVOnline\Session Storage\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

auto-update.log

Path C:\Users\Admin\AppData\Roaming\MeuPDVOnline\auto-update.log
Size 248B
SHA256 13043832349190d3497085369a02cd6f04a0fac352184dc9e5fa318116ed53a7
MD5 eb4ed2b13d9ba7986ba1cf8d2fb4177d
SHA1 d9f594359d8a58753d77b6c8f4136f01e13ef994
SHA512 f2308e622f9e3040e8d2b58e0c859fc2acaa9c41b6eed0ee5b2679228607083ed2af367c6eaa40251416eb7ab224e0a4ec185d7270cb4ceba166c8ed60ea8c2f
TLSH
T191D05B544DD65216CC45CD0F847DBB4EA91214197F55BA418770C6E521EB114BDC6506
MD5 SHA1 SHA512 TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

MeuPDVOnline.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MARCOSALCANTARA\MeuPDVOnline.lnk
Size 2KB
SHA256 e123d159d7bbaacc340627720b575f75528ac1a20b27c0ba5561ee04e086ed31
MD5 36db31a2894cabbb3cf3382d35b1dfac
SHA1 86307d3d79249e2f6e957fb3dff49f98f1a5588f
SHA512 a27637913b703efd60f8d7e004e5bf78d2830a59f2448a44800b8d0ddb347875f16a4cd5049547cda9d4a40bbc8d9404e7d5d02c59a791f1e341f4a907012f78
TLSH
T19A51F20994C92300C3BB6B796AF7435ACBB7BC23D747470E08D0C2841C25A134448F7E
MD5 SHA1 SHA512 TLSH

Submit Download

MeuPDVOnline.lnk

Path C:\Users\Admin\Desktop\MeuPDVOnline.lnk
Size 2KB
SHA256 455c7ce9c1769bddc395f4da5abb42d535152a5917193e199f1daa0b84db34d9
MD5 f848c729af1935306f1a4e6f31b215bb
SHA1 488dd03a91f6b56c4e7bf1adcba21a78b361f266
SHA512 9da33d11b5af79769023c00903d2311d07a715e999f74e8a094169c3d2c5342a533eafd59ff2d042e64f7fd2b27a2fab3eb81df7d3034566d8194afa76909d5c
TLSH
T1E251C00595C92200C3BB6B796AF7534ACFB7BC23DB474A0E08D0C2442C25A139948F7E
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1984-288-0x0000000011590000-0x0000000011591000-memory.dmp

Download

memory/1984-289-0x0000000011590000-0x0000000011591000-memory.dmp

Download

memory/1984-290-0x0000000011590000-0x0000000011591000-memory.dmp

Download

memory/1984-291-0x0000000011590000-0x0000000011591000-memory.dmp

Download

memory/1984-284-0x0000000011590000-0x0000000011591000-memory.dmp

Download

memory/1984-282-0x0000000011590000-0x0000000011591000-memory.dmp

Download

memory/1984-293-0x0000000011590000-0x0000000011591000-memory.dmp

Download

memory/1984-292-0x0000000011590000-0x0000000011591000-memory.dmp

Download

memory/4076-99-0x0000000000B70000-0x0000000000D56000-memory.dmp

Download

memory/4112-105-0x0000000021E20000-0x0000000021E2E000-memory.dmp

Download

memory/4112-10-0x0000000000DE0000-0x0000000000FB6000-memory.dmp

Download

memory/4112-104-0x0000000021E60000-0x0000000021E9E000-memory.dmp

Download

memory/5444-125-0x0000000000DA0000-0x0000000000DC0000-memory.dmp

Download