meccha-camouflage-v1.7.2.exePE analysis report - Malicious
Run integrity
sample ranThe guest staged the sample and launched it, so what follows describes this file rather than an empty desktop.
51.3sto launch
2080telemetry events
516observed
75agent notes
Malicious
100/100
30 points past the malicious line at 70.
Clean0-34
Suspicious35-69
Malicious70-100
Why this verdict
+100
Runtime behavior
- 1 evasion behavior(s)
- Injected code into another process at runtime (+1 more runtime behavior)
- 1 living-off-the-land binary abuse(s)
- 4 Sigma rule match(es): Suspicious PowerShell Encoded Command Patterns, Suspicious Encoded PowerShell Command Line, Suspicious Execution of Powershell with Base64
+40
Static analysis
- 2 suspicious signature match(es)
- Anti-debug API name(s) IsDebuggerPresent, OutputDebugString: ONE observation read by two static sources, not two findings - signature Suspicious_Anti_Debug_API matched them in the file and the Anti-debugging capability bucket read the same names from the import table; both charges kept.
- 3 high-risk capability bucket(s): Privilege escalation, Process injection, Anti-debugging
- Malicious strings: injection / execution
+0
Persistence
- 1 persistence mechanism(s): .NET Startup Hook DLL
- 3 point(s) are not charged here: .NET Startup Hook DLL is named in this file's strings and not established at run time, so the reference is published and not scored.
+0
Model review
- findings review (advisory, not scored): suspicious - dropped executables, process injection, powershell spawn, self-extracting dotnet runtime
Model reading
Measured
MALICIOUS100 of 100
Evidence ledger above, row by row. Published verdict rests on this column and on nothing to its right.
Model reads it asadvisory, no points
NOT ASSESSEDnot shown on this page
Reads this report's derived findings, never the sample itself.
A model reading exists for this scan and is shown to the submitter and to staff only. It is a second opinion about evidence the score already priced, it is worth no points, and on a public page it would stand beside the verdict with no grounding a stranger could check.
Other high-severity findings
- HIGH APC injection primitive (QueueUserAPC)
- HIGH Early-bird / QueueUserAPC on suspended process
- HIGH Injected code into another process at runtime
- HIGH Injection/execution API strings
Analysis layers
Static
ran
moved the score
Dynamic
ran
moved the score
Threat intel
local feeds only
no points
AI
not included
Detection signatures
31 detected · 7 withheld as common| Severity | Detection | Evidence | Layer |
|---|---|---|---|
| HIGH |
AMSI tamper pattern (LoadLibrary amsi + GetProcAddress)
MITRE T1562.001
|
string
amsi
found in the sample's strings
import
kernel32.dll!GetProcAddress
requires getprocaddress
|
static |
| HIGH |
APC injection primitive (QueueUserAPC)
MITRE T1055.004
|
import
kernel32.dll!QueueUserAPC
|
static |
| HIGH |
Early-bird / QueueUserAPC on suspended process
MITRE T1055.004
|
import
kernel32.dll!QueueUserAPC
requires queueuserapc
import
kernel32.dll!ResumeThread
requires resumethread
|
static |
| HIGH |
Injected code into another process at runtime
MITRE T1055
|
process
C:\Users\user\Desktop\meccha-camouflage-v1.7.2.exe
C:\Users\user\Desktop\meccha-camouflage-v1.7.2.exe
process
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.65\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=meccha-camouflage-v1.7.2.exe --webview-exe-version=1.0.0+87d
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.65\msedgewebview2.exe
process
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.65\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\user\AppData\Local\MecchaCamouflage\webview2-user-data\EBWe
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.65\msedgewebview2.exe
process
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.65\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\MecchaCamouflage\webview2-use
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.65\msedgewebview2.exe
|
dynamic |
| HIGH |
Injection/execution API strings
MITRE T1055
|
string
amsi.dll
matched string
|
static |
| HIGH |
LOLBin abuse: powershell runs an encoded PowerShell command
MITRE T1059.001
|
command
powershell
observed command line
|
dynamic |
| HIGH |
Thread-context hijack injection (SetThreadContext)
MITRE T1055.003
|
import
kernel32.dll!SetThreadContext
requires setthreadcontext
import
kernel32.dll!GetThreadContext
requires getthreadcontext
|
static |
| MED |
Anti-debug: checks for a debugger
MITRE T1622
confirmed at runtime, seen in 60% of benign software statically
|
import
kernel32.dll!IsDebuggerPresent
|
static |
| MED |
Anti-debugging capability
MITRE T1622
confirmed at runtime, seen in 65% of benign software statically
|
capability
isdebuggerpresent
capability: anti_debug
capability
outputdebugstringa
capability: anti_debug
|
static |
| MED |
Creates a suspended process then resumes (hollowing/hijack)
MITRE T1055.012
|
import
kernel32.dll!CreateProcessW
requires createprocess
import
kernel32.dll!ResumeThread
requires resumethread
|
static |
| MED |
Dropped an executable to disk
MITRE T1105
|
file
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\runtimes\win-x64\native\WebView2Loader.dll
dropped
file
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\meccha-camouflage.dll
dropped
file
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\Microsoft.CSharp.dll
dropped
file
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\Microsoft.VisualBasic.Core.dll
dropped
|
dynamic |
| MED |
Dynamic API resolution (obfuscation)
MITRE T1027
confirmed at runtime, seen in 65% of benign software statically
|
capability
getprocaddress
capability: dynamic_api
capability
loadlibrarya
capability: dynamic_api
capability
loadlibraryexa
capability: dynamic_api
|
static |
| MED |
Evasion: anti debug
MITRE T1497
|
runtime
anti debug
evasion signal
|
dynamic |
| MED |
Exception-based anti-debug (SEH/VEH install)
MITRE T1622
|
import
kernel32.dll!AddVectoredExceptionHandler
|
static |
| MED |
Executes external code / commands
MITRE T1059
confirmed at runtime, seen in 30% of benign software statically
|
capability
createprocessw
capability: execution
capability
createthread
capability: execution
capability
shellexecutew
capability: execution
|
static |
| MED |
High file entropy (encrypted/compressed payload)
MITRE T1027
|
entropy
7.91
threshold 7.20, maximum 8.00
|
static |
| MED |
Opens/suspends remote threads
MITRE T1055
|
import
advapi32.dll!OpenThreadToken
requires openthread
import
kernel32.dll!SuspendThread
requires suspendthread
|
static |
| MED |
TLS callback (pre-main execution)
MITRE T1055
|
pe_header
IMAGE_DIRECTORY_ENTRY_TLS present
callbacks run before the entry point
|
static |
| LOW |
Adjusts token privileges (SeDebug / escalation)
MITRE T1134
seen in 8% of benign software
|
import
advapi32.dll!AdjustTokenPrivileges
|
static |
| LOW |
Checks for WOW64 (bitness/anti-analysis)
MITRE T1497
seen in 9% of benign software
|
string
iswow64process
found in the sample's strings
|
static |
| LOW |
Checks system uptime (sandbox age check)
MITRE T1497.001
seen in 12% of benign software
|
import
kernel32.dll!GetTickCount64
|
static |
| LOW |
Direct memory execution (VirtualProtect + memory copy)
MITRE T1055
seen in 9% of benign software
|
import
kernel32.dll!VirtualProtect
requires virtualprotect
import
kernel32.dll!VirtualAlloc
requires virtualalloc
|
static |
| LOW |
Drops + executes from temp (GetTempPath + CreateProcess)
MITRE T1204
seen in 7% of benign software
|
import
kernel32.dll!GetTempPathW
requires gettemppath
import
kernel32.dll!CreateProcessW
requires createprocess
|
static |
| LOW |
Duplicates a process handle (handle theft)
MITRE T1134
seen in 10% of benign software
|
import
kernel32.dll!DuplicateHandle
|
static |
| LOW |
Executes via ShellExecute
MITRE T1204
seen in 12% of benign software
|
import
shell32.dll!ShellExecuteW
|
static |
| LOW |
Opens a device via CreateFile (driver/raw IO)
MITRE T1106
seen in 6% of benign software
|
import
kernel32.dll!CreateFileA
requires createfile
string
\\.\
found in the sample's strings
|
static |
| LOW |
Process-injection capability
MITRE T1055
seen in 5% of benign software
|
capability
getthreadcontext
capability: injection
capability
queueuserapc
capability: injection
capability
setthreadcontext
capability: injection
|
static |
| LOW |
Reflective/manual DLL load pattern
MITRE T1620
seen in 8% of benign software
|
import
kernel32.dll!VirtualAlloc
requires virtualalloc
import
kernel32.dll!GetProcAddress
requires getprocaddress
import
kernel32.dll!LoadLibraryA
requires loadlibrary
import
kernel32.dll!CreateThread
requires createthread
|
static |
| LOW |
Sleep-based sandbox evasion
MITRE T1497.003
|
import
kernel32.dll!SleepEx
|
static |
| LOW |
Spawns child processes
MITRE T1106
seen in 16% of benign software
|
import
kernel32.dll!CreateProcessW
|
static |
| INFO |
Stages in the temp directory (GetTempPath)
MITRE T1074
seen in 15% of benign software
|
import
kernel32.dll!GetTempPathW
|
static |
Withheld: 7 rules fired and were not reported above
These rules matched this sample, and they also match this much of known-clean software (measured over 1145 signed Windows and third-party binaries). A rule that fires on most clean files cannot move a verdict, so it is held back unless the detonation confirms the behaviour. They are listed because a count that shrinks without saying so is not a count an analyst can check.
Timing-based anti-analysis (QueryPerformanceCounter/rdtsc)
fires on 92% of benign software
Anti-debugging capability
fires on 65% of benign software
Anti-debug: checks for a debugger
fires on 60% of benign software
Resolves APIs dynamically (LoadLibrary + GetProcAddress)
fires on 49% of benign software
Anti-debug via OutputDebugString probe
fires on 41% of benign software
Queries system information (host recon)
fires on 25% of benign software
Enumerates files recursively (staging/collection)
fires on 21% of benign software
Persistence
1 mechanism
LOW
.NET Startup Hook DLL static
DLL Load Order · MITRE T1574
Auto-start methods established during detonation or referenced statically. The Persistence tab lists these against every method checked.
What the tests returned
5 testsEach test this run performed and what it returned. A test that was not performed says so rather than reading as a negative result.
| Test | Result |
|---|---|
| Persistence mechanisms | none established at runtime |
| Network connections | not tested - this run had no route out, so an empty network section is a property of the run and not an observation about the sample |
| Known-malicious hash (reputation sources) | no source reported this file |
| Local anti-virus engine | reported no detection |
| Capability analysis of the file's code | not checked - the check ran past its time limit and was stopped |
Absence of an observation is not proof of absence - see Coverage for what this run could and could not test.
Arguing against malice
- The local anti-virus engine reported no detection.
- No reputation source reported this file as malicious.
How much weight this carries
Confirmed. Independent external evidence, or the same behaviour seen by more than one analysis layer. The one fact that decided it: several independent runtime observations.
Instrument coverage
3 of 4 measuredWhat this run was able to observe, as the run itself recorded it. A layer that did not run makes an empty result a fact about the sandbox rather than about the sample.
| Layer | Ran | What that means |
|---|---|---|
| Runtime anti-analysis watch | measured | Measured. The in-process hook group for debugger, timing and hypervisor checks armed on this run, so an empty signal list means something looked and saw nothing. |
| API call sequence | measured | Measured for the hooked anti-analysis calls. It is not a full API trace: the sequence carries interpreter spawns plus the hooked anti-analysis calls, and nothing else. |
| Explicit module loads | measured | Measured, with two limits. Only a module the sample asks for by hand is recorded, so one brought in by its own import table never appears, and the hooks arrive a few seconds after a process starts. |
| Network capture | not on this plan | Not included on this scan's plan. |
| Live kernel introspection | not measured | Not measured. This run did not ask for the memory-dump option, which is what starts the introspection loop. |
This lists the layers this run recorded for itself. A layer that is not listed was not recorded either way, so its absence here is not a result.
Structure
What the file is made of: headers, imports, how it was built and whether it was signed.
Sections & resources
How the file is laid out in memory, and what is embedded in it: section roles, access rights, entropy and every resource entry.
Signatures & packing
What matched and what is hidden: signature rules, detected capabilities, family attribution, packer detection, unpacked payloads and recovered configuration.
Strings
The readable content: embedded secrets, flagged strings and everything extraction recovered.
Code
What the sample would execute: the emulated API call sequence, and the disassembled entry point.
Signature
Microsoft Visual C/C++(19.36.35223)[LTCG/C++]
CompilerMicrosoft Visual C/C++(19.36.35223)[LTCG/C++]
LinkerMicrosoft Linker(14.36.35223)
Library.NET Core(Loader)
Identity
File
typeexecutable
size54.4 MB
file arch64-bit (x64)
subsystemGUI
entropy7.9052
date2026-06-26 19:24:27 UTC
version1.0.0.0
descriptionmeccha-camouflage
productmeccha-camouflage
original namemeccha-camouflage.dll
languageNEU
Antivirus engine
no signature matched signature set 28160 - 3.6M signaturesNothing in the signature set below matched this file. That is one engine's negative answer against one signature set on one day, and it is not a verdict. A signature engine only recognises what has already been named and published, so a file nobody has named yet scans exactly like a file that is harmless. What this file does when it runs is the stronger evidence; read the behaviour sections for that.
| Signature set | Value |
|---|---|
| Set version | 28160 |
| Signatures in the set | 3,642,883 |
| Set published | 21 Oct 2026 06:25 +0000 |
| Age when this file was scanned | same day |
A negative answer is only as good as the signature set that gave it, so the set is recorded with the result and the result can be reproduced against it.
Local ML assessment
no model scoreNo model score exists for this file: the file is larger than the 32 MB the local model is allowed to read in one scan, so it got a static heuristic instead. That is a gap in coverage and not a finding - the absence of a score here says nothing about the file.
Structural rules of thumb, not a model. 3 cheap static signals fired, for 45 of 100 on a rule-of-thumb scale that is deliberately left out of the verdict score: the packing, entropy and signing cards on this report already price the same facts, and counting them a second time under a machine-learning heading would charge one piece of evidence twice.
- high entropy 7.9052
- unsigned executable
- TLS callback
Packing
Not packed
This file's code is readable on disk - nothing is compressed or encrypted around it.
30/100
packer confidence
Static analysis reads this file directly
Nothing is hiding the code from a static pass, so what the file contains is what the report shows.
Indicators weighed 5 signals
- Non-standard section names: .CLR_UEF, Section
- High-entropy overlay (7.99, 46825808 bytes)
- High-entropy resource (possible packed payload)
- Embedded executable in resources
- TLS callback present
Family configuration search
Not attemptedThe sample is 54.4 MB and the config parser pass is bounded at 16.0 MB, so no family parser was run against it - a family configuration may exist in this file and was not looked for. The absence of an extracted configuration is therefore not evidence about this sample.
| Sample size | 54.4 MB |
|---|---|
| Bound | 16.0 MB |
| Limit reached | Sample size, before any parser was loaded. |
Secrets & malicious strings
1 flagged stringFlagged string categories
| Indicator | Found in | Evidence from the sample |
|---|---|---|
| amsi.dll | raw bytes | present in the file bytes only |
Capabilities
8 behaviour buckets · 3 high-risk| Severity | Capability | MITRE | APIs |
|---|---|---|---|
| high | Privilege escalation Adjusts tokens / privileges |
T1134, T1134.001 | adjusttokenprivileges, openprocesstoken, setthreadtoken |
| high | Process injection Writes and runs code inside another process |
T1055.004, T1055.012 | getthreadcontext, queueuserapc, setthreadcontext |
| high | Anti-debugging Detects or obstructs a debugger |
T1622 | isdebuggerpresent, outputdebugstringa |
| med | Evasion / stalling Sleeps, times, or otherwise stalls analysis |
T1497, T1497.003 | getsystemtimeasfiletime, gettickcount64, queryperformancecounter, sleep, sleepex |
| med | Code execution Creates processes / runs commands or shellcode |
T1106, T1203 | createprocessw, createthread, shellexecutew |
| med | Dynamic API resolution Resolves APIs at runtime (obfuscation) |
T1129 | getprocaddress, loadlibrarya, loadlibraryexa |
| med | Ransomware behaviour Enumerates + encrypts files, deletes backups |
T1083 | findnextfilew |
| low | Discovery Enumerates the host, users, processes or network |
T1082 | getsysteminfo |
Security mitigations
strong posture
ON
ASLR (DynamicBase)
ON
High-entropy ASLR (64-bit)
ON
DEP / NX (NxCompat)
ON
Control Flow Guard
OFF
SafeSEH
ON
Stack cookies (GS)
OFF
Force Integrity
OFF
AppContainer isolation
OFF
Authenticode signed
Rich header (toolchain)
richhash 1c6487ccac6d4929| Tool | Build | Uses |
|---|---|---|
| prodid_147 | 30729 | 22 |
| Utc1900 (VS2017) | 35207 | 11 |
| Cvtres 14.10 | 35207 | 19 |
| Cvtres 14.10 | 35223 | 68 |
| Export 14.10 | 35207 | 101 |
| Cvtres 14.10 | 33145 | 8 |
| Utc1900 (VS2017) | 33145 | 13 |
| Import (linker) | 0 | 509 |
| Utc1900 (VS2017) | 35223 | 22 |
| prodid_265 | 35223 | 571 |
| Alias | 35223 | 1 |
| Implib | 35223 | 1 |
| AliasObj 14.10 | 35223 | 1 |
Sections
9 sections · the file's memory layout| Section | Virtual addr | Raw size | Virtual size | Access | Entropy |
|---|---|---|---|---|---|
|
.textEP
Executable code
|
0x1000 |
6.4 MB
|
6.4 MB
|
EXECUTEREAD
|
6.463
|
|
.CLR_UEF
Non-standard section
|
0x667000 |
512.0 B
|
215.0 B
|
EXECUTEREAD
|
3.1001
|
|
.rdata
Read-only data
|
0x668000 |
1.6 MB
|
1.6 MB
|
READ
|
5.7091
|
|
.data
Initialised data
|
0x7f6000 |
20.5 KB
|
100.0 KB
expands
|
READWRITE
|
2.6787
|
|
.pdata
Exception unwind data
|
0x80f000 |
229.0 KB
|
228.7 KB
|
READ
|
6.4848
|
|
.didat
Delay-load imports
|
0x849000 |
512.0 B
|
56.0 B
|
READWRITE
|
0.4174
|
|
Section
Non-standard section
|
0x84a000 |
512.0 B
|
8.0 B
|
READWRITE
|
0.0
|
|
.rsrc
Resources
|
0x84b000 |
1.5 MB
|
1.5 MB
|
READ
|
6.4409
|
|
.reloc
Base relocations
|
0x9d1000 |
30.5 KB
|
30.2 KB
|
READ
|
5.4472
|
code
data
imports/exports
resources
metadata
packer
non-standard
Entropy above 7.0 means compressed or encrypted content.
Imports
441 funcs / 17 DLLs · 16 suspicious▸KERNEL32.dll196 funcs 12 suspicious
| Name | File RVA | Is undocumented | MITRE (tactic - technique) |
|---|---|---|---|
| ActivateActCtx | 0x006680a8 | - | - |
| FindResourceW | 0x006680b0 | - | - |
| GetWindowsDirectoryW | 0x006680b8 | - | - |
| GetModuleHandleW | 0x006680c0 | - | - |
| LoadLibraryExW | 0x006680c8 | - | - |
| LoadLibraryExA | 0x006680d0 | - | - |
| RtlCaptureContext | 0x006680d8 | yes | - |
| WideCharToMultiByte | 0x006680e0 | - | - |
| GetConsoleOutputCP | 0x006680e8 | - | - |
| MapViewOfFileEx | 0x006680f0 | - | - |
| SetLastError | 0x006680f8 | - | - |
| SetThreadErrorMode | 0x00668100 | - | - |
| RaiseException | 0x00668108 | - | - |
| SetConsoleCtrlHandler | 0x00668110 | - | - |
| DebugBreak | 0x00668118 | - | - |
| FlsAlloc | 0x00668120 | - | - |
| FlsSetValue | 0x00668128 | - | - |
| FlsGetValue | 0x00668130 | - | - |
| GetLocaleInfoEx | 0x00668138 | - | - |
| GetUserDefaultLocaleName | 0x00668140 | - | - |
| FlushProcessWriteBuffers | 0x00668148 | - | - |
| ReadFile | 0x00668150 | - | - |
| CreateNamedPipeA | 0x00668158 | - | - |
| GetCurrentProcess | 0x00668160 | - | - |
| WriteFile | 0x00668168 | - | - |
| WaitForMultipleObjects | 0x00668170 | - | - |
| WaitForSingleObject | 0x00668178 | - | - |
| DuplicateHandle | 0x00668180 | - | - |
| DisconnectNamedPipe | 0x00668188 | - | - |
| CreateEventW | 0x00668190 | - | - |
| CreateFileA | 0x00668198 | - | - |
| CancelIoEx | 0x006681a0 | - | - |
| GetOverlappedResult | 0x006681a8 | - | - |
| ConnectNamedPipe | 0x006681b0 | - | - |
| FlushFileBuffers | 0x006681b8 | - | - |
| SetEvent | 0x006681c0 | - | - |
| ResetEvent | 0x006681c8 | - | - |
| WaitForSingleObjectEx | 0x006681d0 | - | - |
| VirtualAlloc | 0x006681d8 | - | T1055 |
| VirtualFree | 0x006681e0 | - | - |
| VirtualQuery | 0x006681e8 | - | - |
| VirtualProtect | 0x006681f0 | - | T1055 |
| SleepEx | 0x006681f8 | - | - |
| SwitchToThread | 0x00668200 | - | - |
| MultiByteToWideChar | 0x00668208 | - | - |
| SuspendThread | 0x00668210 | - | - |
| ResumeThread | 0x00668218 | - | - |
| LCMapStringEx | 0x00668220 | - | - |
| FormatMessageW | 0x00668228 | - | - |
| LocalFree | 0x00668230 | - | - |
| GetModuleFileNameW | 0x00668238 | - | - |
| GetEnvironmentVariableW | 0x00668240 | - | - |
| CreateFileW | 0x00668248 | - | - |
| GetFullPathNameW | 0x00668250 | - | - |
| HeapAlloc | 0x00668258 | - | - |
| HeapFree | 0x00668260 | - | - |
| CreateFileMappingW | 0x00668268 | - | - |
| HeapCreate | 0x00668270 | - | - |
| GetProcessHeap | 0x00668278 | - | - |
| HeapDestroy | 0x00668280 | - | - |
| VerSetConditionMask | 0x00668288 | - | - |
| VerifyVersionInfoW | 0x00668290 | - | - |
| QueueUserAPC | 0x00668298 | - | T1055 |
| SetThreadPriority | 0x006682a0 | - | - |
| GetThreadPriority | 0x006682a8 | - | - |
| TlsSetValue | 0x006682b0 | - | - |
| TlsAlloc | 0x006682b8 | - | - |
| WaitForMultipleObjectsEx | 0x006682c0 | - | - |
| SignalObjectAndWait | 0x006682c8 | - | - |
| RtlLookupFunctionEntry | 0x006682d0 | yes | - |
| SetThreadStackGuarantee | 0x006682d8 | - | - |
| LocateXStateFeature | 0x006682e0 | - | - |
| SetErrorMode | 0x006682e8 | - | - |
| RaiseFailFastException | 0x006682f0 | - | - |
| GetExitCodeProcess | 0x006682f8 | - | - |
| TerminateProcess | 0x00668300 | - | - |
| UnhandledExceptionFilter | 0x00668308 | - | - |
| SetUnhandledExceptionFilter | 0x00668310 | - | - |
| AddVectoredExceptionHandler | 0x00668318 | - | - |
| GetThreadContext | 0x00668320 | - | - |
| SetThreadContext | 0x00668328 | - | T1055 |
| GetEnabledXStateFeatures | 0x00668330 | - | - |
| InitializeContext | 0x00668338 | - | - |
| RtlRestoreContext | 0x00668340 | yes | - |
| SetXStateFeaturesMask | 0x00668348 | - | - |
| CopyContext | 0x00668350 | - | - |
| GetModuleHandleExW | 0x00668358 | - | - |
| GetCommandLineW | 0x00668360 | - | - |
| CreateProcessW | 0x00668368 | - | T1106 |
| GetCPInfo | 0x00668370 | - | - |
| ExitProcess | 0x00668378 | - | - |
| OutputDebugStringW | 0x00668380 | - | T1622 |
| RtlInstallFunctionTableCallback | 0x00668388 | yes | - |
| GetLogicalProcessorInformationEx | 0x00668390 | - | - |
| SetThreadGroupAffinity | 0x00668398 | - | - |
| GetThreadGroupAffinity | 0x006683a0 | - | - |
| UnmapViewOfFile | 0x006683a8 | - | - |
| GetProcessAffinityMask | 0x006683b0 | - | - |
| QueryInformationJobObject | 0x006683b8 | - | - |
| FlushInstructionCache | 0x006683c0 | - | - |
| RtlDeleteFunctionTable | 0x006683c8 | yes | - |
| AcquireSRWLockExclusive | 0x006683d0 | - | - |
| ReleaseSRWLockExclusive | 0x006683d8 | - | - |
| InitializeSRWLock | 0x006683e0 | - | - |
| InitializeConditionVariable | 0x006683e8 | - | - |
| WakeAllConditionVariable | 0x006683f0 | - | - |
| AcquireSRWLockShared | 0x006683f8 | - | - |
| SleepConditionVariableSRW | 0x00668400 | - | - |
| ReleaseSRWLockShared | 0x00668408 | - | - |
| CreateMemoryResourceNotification | 0x00668410 | - | - |
| WerRegisterRuntimeExceptionModule | 0x00668418 | - | - |
| RtlUnwind | 0x00668420 | yes | - |
| CloseThreadpoolTimer | 0x00668428 | - | - |
| CreateThreadpoolTimer | 0x00668430 | - | - |
| SetThreadpoolTimer | 0x00668438 | - | - |
| OpenEventW | 0x00668440 | - | - |
| ExitThread | 0x00668448 | - | - |
| HeapReAlloc | 0x00668450 | - | - |
| TlsGetValue | 0x00668458 | - | - |
| GetFileSize | 0x00668460 | - | - |
| RtlAddFunctionTable | 0x00668468 | yes | - |
| CreateSemaphoreExW | 0x00668470 | - | - |
| ReleaseSemaphore | 0x00668478 | - | - |
| GetSystemDefaultLCID | 0x00668480 | - | - |
| GetUserDefaultLCID | 0x00668488 | - | - |
| OutputDebugStringA | 0x00668490 | - | T1622 |
| QueryThreadCycleTime | 0x00668498 | - | - |
| SetFilePointer | 0x006684a0 | - | - |
| MapViewOfFile | 0x006684a8 | - | - |
| Sleep | 0x006684b0 | - | - |
| RemoveDirectoryW | 0x006684b8 | - | - |
| CreateDirectoryW | 0x006684c0 | - | - |
| GetEnvironmentStringsW | 0x006684c8 | - | - |
| GetSystemTime | 0x006684d0 | - | - |
| GetSystemTimeAsFileTime | 0x006684d8 | - | - |
| FreeLibrary | 0x006684e0 | - | - |
| GetCurrentProcessId | 0x006684e8 | - | - |
| GetProcAddress | 0x006684f0 | - | T1129 |
| CreateThread | 0x006684f8 | - | - |
| GetSystemInfo | 0x00668500 | - | - |
| CloseHandle | 0x00668508 | - | - |
| GetActiveProcessorGroupCount | 0x00668510 | - | - |
| GetCurrentThread | 0x00668518 | - | - |
| GetLastError | 0x00668520 | - | - |
| FreeEnvironmentStringsW | 0x00668528 | - | - |
| GetCurrentThreadId | 0x00668530 | - | - |
| CreateActCtxW | 0x00668538 | - | - |
| GetStdHandle | 0x00668540 | - | - |
| FindNextFileW | 0x00668548 | - | T1083 |
| EnterCriticalSection | 0x00668550 | - | - |
| FindFirstFileExW | 0x00668558 | - | - |
| GetFileSizeEx | 0x00668560 | - | - |
| InitializeCriticalSection | 0x00668568 | - | - |
| GetTempPathW | 0x00668570 | - | - |
| FindClose | 0x00668578 | - | - |
| GetFileAttributesW | 0x00668580 | - | - |
| GetConsoleMode | 0x00668588 | - | - |
| GetFileAttributesExW | 0x00668590 | - | - |
| LoadLibraryA | 0x00668598 | - | T1129 |
| GetCurrentDirectoryW | 0x006685a0 | - | - |
| WriteConsoleW | 0x006685a8 | - | - |
| DeleteCriticalSection | 0x006685b0 | - | - |
| CreateFileMappingA | 0x006685b8 | - | - |
| LeaveCriticalSection | 0x006685c0 | - | - |
| GetTickCount64 | 0x006685c8 | - | - |
| QueryPerformanceFrequency | 0x006685d0 | - | - |
| QueryPerformanceCounter | 0x006685d8 | - | T1497 |
| IsDebuggerPresent | 0x006685e0 | - | T1622 |
| GetNumaHighestNodeNumber | 0x006685e8 | - | - |
| SetThreadAffinityMask | 0x006685f0 | - | - |
| SetThreadIdealProcessorEx | 0x006685f8 | - | - |
| GetThreadIdealProcessorEx | 0x00668600 | - | - |
| VirtualAllocExNuma | 0x00668608 | - | - |
| GetNumaProcessorNodeEx | 0x00668610 | - | - |
| VirtualUnlock | 0x00668618 | - | - |
| GetLargePageMinimum | 0x00668620 | - | - |
| IsProcessInJob | 0x00668628 | - | - |
| K32GetProcessMemoryInfo | 0x00668630 | - | - |
| GetLogicalProcessorInformation | 0x00668638 | - | - |
| GlobalMemoryStatusEx | 0x00668640 | - | - |
| RtlVirtualUnwind | 0x00668648 | yes | - |
| IsProcessorFeaturePresent | 0x00668650 | - | - |
| InitializeSListHead | 0x00668658 | - | - |
| RtlUnwindEx | 0x00668660 | yes | - |
| RtlPcToFileHeader | 0x00668668 | yes | - |
| EncodePointer | 0x00668670 | - | - |
| InitializeCriticalSectionAndSpinCount | 0x00668678 | - | - |
| TlsFree | 0x00668680 | - | - |
| TryAcquireSRWLockExclusive | 0x00668688 | - | - |
| GetExitCodeThread | 0x00668690 | - | - |
| GetStringTypeW | 0x00668698 | - | - |
| InitializeCriticalSectionEx | 0x006686a0 | - | - |
| DecodePointer | 0x006686a8 | - | - |
| SetEnvironmentVariableW | 0x006686b0 | - | - |
| GetProcessGroupAffinity | 0x006686b8 | - | - |
| GetCurrentProcessorNumberEx | 0x006686c0 | - | - |
▸ADVAPI32.dll20 funcs 3 suspicious
| Name | File RVA | Is undocumented | MITRE (tactic - technique) |
|---|---|---|---|
| LookupPrivilegeValueW | 0x00668000 | - | T1134 |
| RegGetValueW | 0x00668008 | - | - |
| SetKernelObjectSecurity | 0x00668010 | - | - |
| RegQueryValueExW | 0x00668018 | - | - |
| RegOpenKeyExW | 0x00668020 | - | - |
| GetSidSubAuthorityCount | 0x00668028 | - | - |
| GetSidSubAuthority | 0x00668030 | - | - |
| GetTokenInformation | 0x00668038 | - | - |
| OpenProcessToken | 0x00668040 | - | T1134 |
| RegCloseKey | 0x00668048 | - | - |
| SetThreadToken | 0x00668050 | - | - |
| RevertToSelf | 0x00668058 | - | - |
| OpenThreadToken | 0x00668060 | - | - |
| EventWrite | 0x00668068 | - | - |
| EventRegister | 0x00668070 | - | - |
| EventWriteTransfer | 0x00668078 | - | - |
| DeregisterEventSource | 0x00668080 | - | - |
| RegisterEventSourceW | 0x00668088 | - | - |
| ReportEventW | 0x00668090 | - | - |
| AdjustTokenPrivileges | 0x00668098 | - | T1134 |
▸ole32.dll17 funcs
| Name | File RVA | Is undocumented | MITRE (tactic - technique) |
|---|---|---|---|
| CLSIDFromProgID | 0x00668dc0 | - | - |
| CoCreateGuid | 0x00668dc8 | - | - |
| CoTaskMemAlloc | 0x00668dd0 | - | - |
| CoUnmarshalInterface | 0x00668dd8 | - | - |
| CoMarshalInterface | 0x00668de0 | - | - |
| CoGetMarshalSizeMax | 0x00668de8 | - | - |
| CoCreateFreeThreadedMarshaler | 0x00668df0 | - | - |
| CoGetClassObject | 0x00668df8 | - | - |
| CoGetContextToken | 0x00668e00 | - | - |
| CoGetObjectContext | 0x00668e08 | - | - |
| CoReleaseMarshalData | 0x00668e10 | - | - |
| CoInitializeEx | 0x00668e18 | - | - |
| CoRegisterInitializeSpy | 0x00668e20 | - | - |
| CoWaitForMultipleHandles | 0x00668e28 | - | - |
| CoUninitialize | 0x00668e30 | - | - |
| CoRevokeInitializeSpy | 0x00668e38 | - | - |
| CoTaskMemFree | 0x00668e40 | - | - |
▸OLEAUT32.dll27 funcs
| Name | File RVA | Is undocumented | MITRE (tactic - technique) |
|---|---|---|---|
| SetErrorInfo | 0x006686d0 | - | - |
| GetErrorInfo | 0x006686d8 | - | - |
| SysFreeString | 0x006686e0 | - | - |
| SysStringLen | 0x006686e8 | - | - |
| CreateErrorInfo | 0x006686f0 | - | - |
| QueryPathOfRegTypeLib | 0x006686f8 | - | - |
| LoadTypeLibEx | 0x00668700 | - | - |
| SafeArrayGetVartype | 0x00668708 | - | - |
| VariantChangeType | 0x00668710 | - | - |
| SysAllocString | 0x00668718 | - | - |
| LoadRegTypeLib | 0x00668720 | - | - |
| SysAllocStringLen | 0x00668728 | - | - |
| VariantClear | 0x00668730 | - | - |
| VariantInit | 0x00668738 | - | - |
| VarCyFromDec | 0x00668740 | - | - |
| SafeArrayDestroy | 0x00668748 | - | - |
| SafeArrayAllocDescriptorEx | 0x00668750 | - | - |
| GetRecordInfoFromTypeInfo | 0x00668758 | - | - |
| SafeArraySetRecordInfo | 0x00668760 | - | - |
| SafeArrayAllocData | 0x00668768 | - | - |
| SafeArrayGetElemsize | 0x00668770 | - | - |
| SysStringByteLen | 0x00668778 | - | - |
| SysAllocStringByteLen | 0x00668780 | - | - |
| SafeArrayCreateVector | 0x00668788 | - | - |
| SafeArrayPutElement | 0x00668790 | - | - |
| SafeArrayGetDim | 0x00668798 | - | - |
| SafeArrayGetLBound | 0x006687a0 | - | - |
▸USER32.dll2 funcs
| Name | File RVA | Is undocumented | MITRE (tactic - technique) |
|---|---|---|---|
| MessageBoxW | 0x006687c0 | - | - |
| LoadStringW | 0x006687c8 | - | - |
▸SHELL32.dll1 func 1 suspicious
| Name | File RVA | Is undocumented | MITRE (tactic - technique) |
|---|---|---|---|
| ShellExecuteW | 0x006687b0 | - | T1106 |
▸api-ms-win-crt-string-l1-1-0.dll31 funcs
| Name | File RVA | Is undocumented | MITRE (tactic - technique) |
|---|---|---|---|
| iswspace | 0x00668c90 | - | - |
| strncpy | 0x00668c98 | - | - |
| iswascii | 0x00668ca0 | - | - |
| _strnicmp | 0x00668ca8 | - | - |
| iswupper | 0x00668cb0 | - | - |
| strncmp | 0x00668cb8 | - | - |
| strncpy_s | 0x00668cc0 | - | - |
| towlower | 0x00668cc8 | - | - |
| wcscat_s | 0x00668cd0 | - | - |
| _wcsdup | 0x00668cd8 | - | - |
| wcscpy_s | 0x00668ce0 | - | - |
| wcsncpy_s | 0x00668ce8 | - | - |
| isalpha | 0x00668cf0 | - | - |
| strnlen | 0x00668cf8 | - | - |
| wcsncat_s | 0x00668d00 | - | - |
| strncat_s | 0x00668d08 | - | - |
| towupper | 0x00668d10 | - | - |
| strcpy_s | 0x00668d18 | - | - |
| strcmp | 0x00668d20 | - | - |
| _stricmp | 0x00668d28 | - | - |
| strcat_s | 0x00668d30 | - | - |
| isspace | 0x00668d38 | - | - |
| tolower | 0x00668d40 | - | - |
| wcsncmp | 0x00668d48 | - | - |
| _strdup | 0x00668d50 | - | - |
| strtok_s | 0x00668d58 | - | - |
| wcsnlen | 0x00668d60 | - | - |
| strlen | 0x00668d68 | - | - |
| _wcsnicmp | 0x00668d70 | - | - |
| _wcsicmp | 0x00668d78 | - | - |
| isdigit | 0x00668d80 | - | - |
▸api-ms-win-crt-heap-l1-1-0.dll8 funcs
| Name | File RVA | Is undocumented | MITRE (tactic - technique) |
|---|---|---|---|
| _callnewh | 0x00668858 | - | - |
| realloc | 0x00668860 | - | - |
| _aligned_malloc | 0x00668868 | - | - |
| malloc | 0x00668870 | - | - |
| _set_new_mode | 0x00668878 | - | - |
| free | 0x00668880 | - | - |
| calloc | 0x00668888 | - | - |
| _aligned_free | 0x00668890 | - | - |
▸api-ms-win-crt-convert-l1-1-0.dll10 funcs
| Name | File RVA | Is undocumented | MITRE (tactic - technique) |
|---|---|---|---|
| atoi | 0x006687d8 | - | - |
| atol | 0x006687e0 | - | - |
| _wcstoui64 | 0x006687e8 | - | - |
| strtol | 0x006687f0 | - | - |
| _wtoi | 0x006687f8 | - | - |
| _ltow_s | 0x00668800 | - | - |
| strtoull | 0x00668808 | - | - |
| strtoul | 0x00668810 | - | - |
| wcstoul | 0x00668818 | - | - |
| _atoi64 | 0x00668820 | - | - |
▸api-ms-win-crt-stdio-l1-1-0.dll28 funcs
| Name | File RVA | Is undocumented | MITRE (tactic - technique) |
|---|---|---|---|
| fputwc | 0x00668ba8 | - | - |
| __stdio_common_vsprintf_s | 0x00668bb0 | - | - |
| _set_fmode | 0x00668bb8 | - | - |
| __stdio_common_vfprintf | 0x00668bc0 | - | - |
| __acrt_iob_func | 0x00668bc8 | - | - |
| __p__commode | 0x00668bd0 | - | - |
| ftell | 0x00668bd8 | - | - |
| fseek | 0x00668be0 | - | - |
| __stdio_common_vsprintf | 0x00668be8 | - | - |
| fopen | 0x00668bf0 | - | - |
| __stdio_common_vfwprintf | 0x00668bf8 | - | - |
| setvbuf | 0x00668c00 | - | - |
| _setmode | 0x00668c08 | - | - |
| _dup | 0x00668c10 | - | - |
| _fileno | 0x00668c18 | - | - |
| fclose | 0x00668c20 | - | - |
| __stdio_common_vswprintf | 0x00668c28 | - | - |
| _flushall | 0x00668c30 | - | - |
| fwrite | 0x00668c38 | - | - |
| __stdio_common_vsnwprintf_s | 0x00668c40 | - | - |
| __stdio_common_vsnprintf_s | 0x00668c48 | - | - |
| _wfsopen | 0x00668c50 | - | - |
| _write | 0x00668c58 | - | - |
| __stdio_common_vsscanf | 0x00668c60 | - | - |
| fgets | 0x00668c68 | - | - |
| fflush | 0x00668c70 | - | - |
| fputs | 0x00668c78 | - | - |
| _wfopen | 0x00668c80 | - | - |
▸api-ms-win-crt-environment-l1-1-0.dll1 func
| Name | File RVA | Is undocumented | MITRE (tactic - technique) |
|---|---|---|---|
| getenv | 0x00668830 | - | - |
▸api-ms-win-crt-utility-l1-1-0.dll1 func
| Name | File RVA | Is undocumented | MITRE (tactic - technique) |
|---|---|---|---|
| qsort | 0x00668db0 | - | - |
▸api-ms-win-crt-runtime-l1-1-0.dll25 funcs
| Name | File RVA | Is undocumented | MITRE (tactic - technique) |
|---|---|---|---|
| _invoke_watson | 0x00668ad8 | - | - |
| _invalid_parameter_noinfo | 0x00668ae0 | - | - |
| _wcserror_s | 0x00668ae8 | - | - |
| _beginthreadex | 0x00668af0 | - | - |
| abort | 0x00668af8 | - | - |
| _register_thread_local_exe_atexit_callback | 0x00668b00 | - | - |
| _c_exit | 0x00668b08 | - | - |
| __p___wargv | 0x00668b10 | - | - |
| __p___argc | 0x00668b18 | - | - |
| _errno | 0x00668b20 | - | - |
| _exit | 0x00668b28 | - | - |
| exit | 0x00668b30 | - | - |
| _initterm_e | 0x00668b38 | - | - |
| _initterm | 0x00668b40 | - | - |
| _get_initial_wide_environment | 0x00668b48 | - | - |
| _initialize_wide_environment | 0x00668b50 | - | - |
| _configure_wide_argv | 0x00668b58 | - | - |
| _set_app_type | 0x00668b60 | - | - |
| _seh_filter_exe | 0x00668b68 | - | - |
| _cexit | 0x00668b70 | - | - |
| _crt_atexit | 0x00668b78 | - | - |
| _register_onexit_function | 0x00668b80 | - | - |
| _initialize_onexit_table | 0x00668b88 | - | - |
| terminate | 0x00668b90 | - | - |
| _controlfp_s | 0x00668b98 | - | - |
▸api-ms-win-crt-filesystem-l1-1-0.dll2 funcs
| Name | File RVA | Is undocumented | MITRE (tactic - technique) |
|---|---|---|---|
| _wremove | 0x00668840 | - | - |
| _wrename | 0x00668848 | - | - |
▸api-ms-win-crt-math-l1-1-0.dll59 funcs
| Name | File RVA | Is undocumented | MITRE (tactic - technique) |
|---|---|---|---|
| truncf | 0x006688f8 | - | - |
| ilogbf | 0x00668900 | - | - |
| copysignf | 0x00668908 | - | - |
| copysign | 0x00668910 | - | - |
| ceilf | 0x00668918 | - | - |
| round | 0x00668920 | - | - |
| asinh | 0x00668928 | - | - |
| cbrt | 0x00668930 | - | - |
| cos | 0x00668938 | - | - |
| acosh | 0x00668940 | - | - |
| atanh | 0x00668948 | - | - |
| modf | 0x00668950 | - | - |
| acoshf | 0x00668958 | - | - |
| cbrtf | 0x00668960 | - | - |
| atanhf | 0x00668968 | - | - |
| modff | 0x00668970 | - | - |
| asinhf | 0x00668978 | - | - |
| _fdopen | 0x00668980 | - | - |
| fmodf | 0x00668988 | - | - |
| fmod | 0x00668990 | - | - |
| tanhf | 0x00668998 | - | - |
| fmaf | 0x006689a0 | - | - |
| fma | 0x006689a8 | - | - |
| floorf | 0x006689b0 | - | - |
| __setusermatherr | 0x006689b8 | - | - |
| acos | 0x006689c0 | - | - |
| acosf | 0x006689c8 | - | - |
| asin | 0x006689d0 | - | - |
| asinf | 0x006689d8 | - | - |
| atan | 0x006689e0 | - | - |
| atan2 | 0x006689e8 | - | - |
| atan2f | 0x006689f0 | - | - |
| log10 | 0x006689f8 | - | - |
| log10f | 0x00668a00 | - | - |
| log2 | 0x00668a08 | - | - |
| log2f | 0x00668a10 | - | - |
| logf | 0x00668a18 | - | - |
| floor | 0x00668a20 | - | - |
| expf | 0x00668a28 | - | - |
| pow | 0x00668a30 | - | - |
| log | 0x00668a38 | - | - |
| powf | 0x00668a40 | - | - |
| exp | 0x00668a48 | - | - |
| coshf | 0x00668a50 | - | - |
| roundf | 0x00668a58 | - | - |
| cosh | 0x00668a60 | - | - |
| sin | 0x00668a68 | - | - |
| sinf | 0x00668a70 | - | - |
| cosf | 0x00668a78 | - | - |
| sinh | 0x00668a80 | - | - |
| sinhf | 0x00668a88 | - | - |
| trunc | 0x00668a90 | - | - |
| sqrt | 0x00668a98 | - | - |
| sqrtf | 0x00668aa0 | - | - |
| tan | 0x00668aa8 | - | - |
| tanf | 0x00668ab0 | - | - |
| tanh | 0x00668ab8 | - | - |
| atanf | 0x00668ac0 | - | - |
| ceil | 0x00668ac8 | - | - |
▸api-ms-win-crt-time-l1-1-0.dll3 funcs
| Name | File RVA | Is undocumented | MITRE (tactic - technique) |
|---|---|---|---|
| _gmtime64_s | 0x00668d90 | - | - |
| _time64 | 0x00668d98 | - | - |
| wcsftime | 0x00668da0 | - | - |
▸api-ms-win-crt-locale-l1-1-0.dll10 funcs
| Name | File RVA | Is undocumented | MITRE (tactic - technique) |
|---|---|---|---|
| _create_locale | 0x006688a0 | - | - |
| __pctype_func | 0x006688a8 | - | - |
| ___mb_cur_max_func | 0x006688b0 | - | - |
| ___lc_codepage_func | 0x006688b8 | - | - |
| _configthreadlocale | 0x006688c0 | - | - |
| setlocale | 0x006688c8 | - | - |
| _lock_locales | 0x006688d0 | - | - |
| _unlock_locales | 0x006688d8 | - | - |
| _free_locale | 0x006688e0 | - | - |
| ___lc_locale_name_func | 0x006688e8 | - | - |
Binary metadata
what the headers declare about this build| Resource langs | NEU |
|---|---|
| Debug info | yes |
| TLS callbacks | yes |
Code signing
UnsignedThis binary carries no Authenticode signature. Unsigned executables are a weak suspicious signal - most legitimate vendor software is signed.
Resources
Everything the binary carries inside it: icons, bitmaps, cursors, dialogs, string tables, the manifest and the version block. Select an entry to preview it and take a copy.
Resources
Resource Hacker view
Group Icon1Icon9Manifest1RCData3Version Info1
▸Group Icon1
32512NEU
▸Icon9
1NEU
2NEU
3NEU
4NEU
5NEU
6NEU
7NEU
8NEU
9NEU
▸Manifest1
1NEU
▸RCData3
CLRDEBUGINFONEU
CLRDEBUGINFOWINDOWSAMD64NEU
MINIDUMP_EMBEDDED_AUXILIARY_PROVIDERNEU
▸Version Info1
1NEU
Select a resource from the tree to inspect its language, size, RVA offset, MD5, entropy and detected content signature - like opening the binary in Resource Hacker.
Group Icon 32512
Download
| Type | Group Icon |
|---|---|
| Name / ID | 32512 |
| Language | NEU |
| Size | 132.0 B |
| RVA offset | 0x9cfc40 |
| Content signature | Icon |
| MD5 | 793ad3d446a54f5c50b42a1af48bdea9 |
| Entropy | 3.053 |
Icon 1
Download
| Type | Icon |
|---|---|
| Name / ID | 1 |
| Language | NEU |
| Size | 1.1 KB |
| RVA offset | 0x84b300 |
| Content signature | Icon |
| MD5 | 9291a2fdb394c2cc9d198bd6484b14ab |
| Entropy | 6.27 |
Icon 2
Download
| Type | Icon |
|---|---|
| Name / ID | 2 |
| Language | NEU |
| Size | 2.4 KB |
| RVA offset | 0x84b768 |
| Content signature | Icon |
| MD5 | 1685c3a2c232a734d6b5ecb3e492268e |
| Entropy | 5.99 |
Icon 3
Download
| Type | Icon |
|---|---|
| Name / ID | 3 |
| Language | NEU |
| Size | 4.2 KB |
| RVA offset | 0x84c0f0 |
| Content signature | Icon |
| MD5 | 6cfe6b73b0bf9d327944aa30a4c25657 |
| Entropy | 5.648 |
Icon 4
Download
| Type | Icon |
|---|---|
| Name / ID | 4 |
| Language | NEU |
| Size | 9.4 KB |
| RVA offset | 0x84d198 |
| Content signature | Icon |
| MD5 | 8446d170be2e681af65d78719717f16d |
| Entropy | 5.29 |
Icon 5
Download
| Type | Icon |
|---|---|
| Name / ID | 5 |
| Language | NEU |
| Size | 16.5 KB |
| RVA offset | 0x84f740 |
| Content signature | Icon |
| MD5 | 776cb9a7dfc5285689cdef7b7956a91c |
| Entropy | 5.101 |
Icon 6
Download
| Type | Icon |
|---|---|
| Name / ID | 6 |
| Language | NEU |
| Size | 21.1 KB |
| RVA offset | 0x853968 |
| Content signature | Icon |
| MD5 | 3bd146358ee0f9e1461a66f20323b2ae |
| Entropy | 5.005 |
Icon 7
Download
| Type | Icon |
|---|---|
| Name / ID | 7 |
| Language | NEU |
| Size | 37.2 KB |
| RVA offset | 0x858df0 |
| Content signature | Icon |
| MD5 | 0b5f55415881c520da625f57146206ea |
| Entropy | 4.9 |
Icon 8
Download
| Type | Icon |
|---|---|
| Name / ID | 8 |
| Language | NEU |
| Size | 66.0 KB |
| RVA offset | 0x862298 |
| Content signature | Icon |
| MD5 | 7bda91c20cdfa25267f57f2252690852 |
| Entropy | 4.797 |
Icon 9
Download
| Type | Icon |
|---|---|
| Name / ID | 9 |
| Language | NEU |
| Size | 71.5 KB |
| RVA offset | 0x872ac0 |
| Content signature | PNG |
| MD5 | 5bdc293f1085e5d81de20351c73c5cfd |
| Entropy | 7.978 |
Manifest 1
Download
| Type | Manifest |
|---|---|
| Name / ID | 1 |
| Language | NEU |
| Size | 490.0 B |
| RVA offset | 0x9d0028 |
| Content signature | XML manifest |
| MD5 | b7db84991f23a680df8e95af8946f9c9 |
| Entropy | 5.001 |
Application manifest
๏ปฟ<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
RCData CLRDEBUGINFO
Download
| Type | RCData |
|---|---|
| Name / ID | CLRDEBUGINFO |
| Language | NEU |
| Size | 36.0 B |
| RVA offset | 0x8848a0 |
| Content signature | RCData |
| MD5 | eff71a23b271d32ccb232492937526ff |
| Entropy | 4.26 |
RCData CLRDEBUGINFOWINDOWSAMD64
Download
| Type | RCData |
|---|---|
| Name / ID | CLRDEBUGINFOWINDOWSAMD64 |
| Language | NEU |
| Size | 36.0 B |
| RVA offset | 0x8848c4 |
| Content signature | RCData |
| MD5 | eff71a23b271d32ccb232492937526ff |
| Entropy | 4.26 |
RCData MINIDUMP_EMBEDDED_AUXILIARY_PROVIDER
Download
| Type | RCData |
|---|---|
| Name / ID | MINIDUMP_EMBEDDED_AUXILIARY_PROVIDER |
| Language | NEU |
| Size | 1.3 MB |
| RVA offset | 0x8848e8 |
| Content signature | PE executable |
| MD5 | 024bb8b4d8c125f13731bfbc92323cd6 |
| Entropy | 6.371 |
Version Info 1
Download
| Type | Version Info |
|---|---|
| Name / ID | 1 |
| Language | NEU |
| Size | 868.0 B |
| RVA offset | 0x9cfcc4 |
| Content signature | Version Info |
| MD5 | 290110504fb82d8f80aa1934f9f6cad2 |
| Entropy | 3.364 |
Parsed version info
| CompanyName | meccha-camouflage |
|---|---|
| FileVersion | 1.0.0.0 |
| ProductName | meccha-camouflage |
| InternalName | meccha-camouflage.dll |
| LegalCopyright | |
| ProductVersion | 1.0.0+87de3fdcf83e4a39d9bc0f47ed5e45987ec62636 |
| FileDescription | meccha-camouflage |
| Assembly Version | 1.0.0.0 |
| OriginalFilename | meccha-camouflage.dll |
Similar samples
3 related samplesRanked by fuzzy hash (TLSH distance - lower is closer) and ssdeep similarity, plus an identical import table. A near-identical neighbour is usually the same build; a variant is the same family rebuilt or repacked.
| Relation | Sample | Verdict | Why it matched |
|---|---|---|---|
| variant | SACGUI.exe | Suspicious | TLSH distance 56 |
| variant | slinky (4).exe | Suspicious | TLSH distance 68 |
| variant | EvoVisLauncher.exe | Malicious | TLSH distance 70 |
Threat classification
Signature family candidates| Family | Agreeing rules | Matched rules | Disposition |
|---|---|---|---|
| COD3NYM DOTNET Singlefilehost Bundled App | 1 | COD3NYM_DOTNET_Singlefilehost_Bundled_App | Not a classification: one rule cannot establish a family, so this named nothing and scored nothing. |
Capability detection
not completedThe capability analysis of this file's code did not finish, so what the file is able to do was not established from its instructions. This narrows what the run covered - read it alongside Coverage rather than as a finding about the file. Cause: the check ran past its time limit and was stopped.
Signature matches
4 findings · 6 file properties · 2 scored| Rule | What it matched | Corpus | Weight |
|---|---|---|---|
|
Suspicious_Anti_Debug_API
|
Anti-debugging API names referenced
2 of 4 strings matched
$a
IsDebuggerPresent
at 0x7f2ce8 · 2 hits
$d
OutputDebugString
at 0x7f1c6a · 2 hits
|
Built-in
ruleset this platform ships, and the only one the score reads
|
SCORED 5
Scored 5, sharing a 15 point cap with every other anti-vm, anti-debug, dropper or packer match.
|
|
Embedded_PE_In_Overlay
|
A second MZ/PE header appears inside the file body
1 of 1 string matched
$mz
MZ
at 0x0 · 726 hits
|
Built-in
ruleset this platform ships, and the only one the score reads
|
SCORED 5
Scored 5, sharing a 15 point cap with every other anti-vm, anti-debug, dropper or packer match.
|
|
COD3NYM_DOTNET_Singlefilehost_Bundled_App
FILE
rule dated 2024-01-02
|
Detects single file host .NET bundled apps.
1 of 2 strings matched
$
singlefilehost.exe
at 0x7effb0
$
singlefilehost.pdb
at 0x772765
|
Tier 2 - community rule feed
may confirm a family name, never establish one on its own
|
SCORED 0
Scored 0: the rule declares no category. No branch of the score model reads it.
Names COD3NYM DOTNET Singlefilehost Bundled App, but one rule cannot establish a family: two independent rules must agree, so this named nothing.
|
|
PoetRat_Python
|
No description
3 of 7 strings matched
$encrptionFunction
Affine
at 0x752c4b · 2 hits
$commands
cd
at 0x2b84 · 3294 hits
$grammer_massacre
at 0x0 · 1000000 hits
|
Tier 3 - community corpus
casts no family vote; every measured false family match came from here
|
SCORED 0
Scored 0: the rule declares no category. No branch of the score model reads it.
|
File properties - not findings
IsPE64IsWindowsGUIIsPackedHasOverlayHasDebugDataHasRichSignature
These say what the file IS or holds - bitness, subsystem, an overlay, an embedded macro stream, which compiler built it. Ordinary files match several, and none of them carry weight in the score.
Extracted strings
showing 200 of 1251- !This program cannot be run in DOS mode.
- .text
- `.CLR_UEF
- `.rdata
- @.data
- .pdata
- @.didat
- Section
- .rsrc
- @.reloc
- |$ ATAVAW3
- USVWH
- L$HIc
- @USVWATAUAVAWH
- @USVWATH
- USVWATAVAWH
- USVWATAUAVAWH
- @USVWATAVAWH
- tgeH
- SVATH
- USVWI
- taeH
- |$ ATAVAWH
- VWATAVAWH
- VATAVAWH
- USWI
- l$ AVH
- SUATAUAWH
- USAVI
- @UATAVH
- taSH
- @UATAUAWH
- tkL;A
- @UVATAVH
- uZ8]itUA8Y8tO
- k WATAWH
- ATAWH
- t$ WATAVH
- EH;Ehs
- %xOc
- t$ WATAWH
- |$ ATAVAWD
- t$ AVH
- @UVATAWH
- @SUVWATH
- @SWATAVH
- ET9GTt
- L$ USVWATAUAVAWH
- I9Shs
- QPIc
- @SATAVAWH
- i@tiH
- @SVWATH
- L9AHA
- @USVWATAUAVH
- EHH+E@H
- |$ ATAUAVAWH
- D8Art
- UWATAVAWH
- tCD9mot
- t$ AWH
- @USVH
- WATAUAVAW
- tafD
- { ATAVAWH
- t$ AWD
- USWH
- t$ UWATAVAWH
- @8q0uLH
- trSH
- l$ VWATAVAWH
- @SVWATAUH
- AH;Ahu
- @UWATAUAVH
- @UVATAVAWH
- @SUATAVH
- @USVWH
- .dll
- file
- KERNEL32.DLL
- api-ms-win-core-fibers-l1-1-1
- api-ms-win-core-synch-l1-2-0
- api-ms-
- cejl
- NULL
- Microsoft-Windows-DotNETRuntime
- System.Private.CoreLib.dll
- DefaultDomain
- Microsoft-Windows-DotNETRuntimeRundown
- Microsoft-Windows-DotNETRuntimeStress
- Microsoft-Windows-DotNETRuntimePrivate
- 0.NET EventPipe
- winmm.dll
- gApplication root path is empty. This shouldn't happen
- Using internal fxr
- Using internal hostpolicy
- host
- The managed DLL bound to this executable could not be retrieved from the executable image.
- The managed DLL bound to this executable is longer than the max allowed length (%d)
- This executable is not bound to a managed DLL to execute. The binding value is: '%s'
- The managed DLL bound to this executable is: '%s'
- You must install or update .NET to run this application.
- Failed to resolve full path of the current executable [%s]
- Detected Single-File app bundle
- The application to execute does not exist: '%s'.
- Invoking fx resolver [%s] hostfxr_main_bundle_startupinfo
- Host path: [%s]
- Dotnet path: [%s]
- App path: [%s]
- Bundle Header Offset: [%lld]
- Invoking fx resolver [%s] hostfxr_main_startupinfo
- apphost
- --- Invoked %s [version: %s] main = {
- .exe
- --additionalprobingpath
- <path>
- Path containing probing policy and assemblies to probe for.
- --depsfile
- Path to <application>.deps.json file.
- --runtimeconfig
- Path to <application>.runtimeconfig.json file.
- --fx-version
- <version>
- Version of the installed Shared Framework to use to run the application.
- --roll-forward
- <value>
- Roll forward to framework version (LatestPatch, Minor, LatestMinor, Major, LatestMajor, Disable)
- --additional-deps
- Path to additional deps.json file.
- --roll-forward-on-no-candidate-fx
- <obsolete>
- Parsed known arg %s = %s
- Failed to parse supported options or their values:
- %s %-*s %s
- Using the provided arguments to determine the application to execute.
- Application '%s' is not a managed executable.
- Application '%s' does not exist.
- dotnet exec needs a managed .dll or .exe extension. The application specified was '%s'
- The application to execute does not exist: '%s'
- --- Executing in split/FX mode...
- --- Executing in a native executable mode...
- --- Executing in muxer mode...
- exec
- static
- Host:
- Architecture: x64
- Commit: %s
- RID: %s
- .NET SDKs installed:
- No SDKs were found.
- .NET runtimes installed:
- No runtimes were found.
- Other architectures found:
- None
- Environment variables:
- Not set
- global.json file:
- Not found
- %s
- Invalid [%s]
- %s
- Invalid global.json is ignored for SDK resolution.
- Learn more:
- https://aka.ms/dotnet/info
- Download .NET:
- https://aka.ms/dotnet/download
- Usage: dotnet [host-options] [path-to-application]
- Usage: dotnet [host-commands]
- path-to-application:
- The path to an application .dll file to execute.
- host-options:
- host-commands:
- --info Display .NET information.
- --list-runtimes [--arch <arch>] Display the installed runtimes matching the host or specified architecture. Example architectures: arm64, x64, x86.
- --list-sdks [--arch <arch>] Display the installed SDKs matching the host or specified architecture. Example architectures: arm64, x64, x86.
- --- Invoked %s [version: %s]
- hostfxr_main_bundle_startupinfo
- A fatal error occurred while processing application bundle
- Invalid startup info: host_path, dotnet_root, and app_path should not be null.
- hostfxr_main_startupinfo
- get-native-search-directories
- The specified runtimeconfig.json [%s] does not exist
- hostpolicy.dll
- Hosting components are already initialized. Re-initialization to execute an app is not allowed.
- .json
- .dev.json
- Runtime config is cfg=%s dev=%s
- Ignoring host interpreted additional probing path %s as it does not exist.
- Ignoring additional probing path %s as it does not exist.
- App runtimeconfig.json from [%s]
- Specified runtimeconfig.json from [%s]
- Invalid runtimeconfig.json [%s] [%s]
- .deps.json
- Detecting mode... CoreCLR present in dotnet root [%s] and checking if [%s] file present=[%d]
- .runtimeconfig.json
- The specified deps.json [%s] does not exist
- Invalid value for command line argument '%s'
- It's invalid to use both '%s' and '%s' command line options.
- DOTNET_ADDITIONAL_DEPS
- HOSTFXR_PATH
No strings match this filter.
Stack and decoded strings were not recovered: this file format is not eligible for string emulation. Only literal strings present in the file are listed above.
Disassembly
entry point · x64 · 60 insns (listing capped)AddressBytesMnemonicOperands
0x1405c7ab04883ec28subrsp, 0x28
0x1405c7ab4e8ab050000call0x1405c8064
0x1405c7ab94883c428addrsp, 0x28
0x1405c7abde96afeffffjmp0x1405c792c
0x1405c7ac2ccint3
0x1405c7ac3ccint3
0x1405c7ac4e98a740500jmp0x14061ef53
0x1405c7ac9ccint3
0x1405c7acaccint3
0x1405c7acbccint3
0x1405c7acc4883ec28subrsp, 0x28
0x1405c7ad04d8b4138movr8, qword ptr [r9 + 0x38]
0x1405c7ad4488bcamovrcx, rdx
0x1405c7ad7498bd1movrdx, r9
0x1405c7adae80d000000call0x1405c7aec
0x1405c7adfb801000000moveax, 1
0x1405c7ae44883c428addrsp, 0x28
0x1405c7ae8c3ret
0x1405c7ae9ccint3
0x1405c7aeaccint3
0x1405c7aebccint3
0x1405c7aec4053pushrbx
0x1405c7aee458b18movr11d, dword ptr [r8]
0x1405c7af1488bdamovrbx, rdx
0x1405c7af44183e3f8andr11d, 0xfffffff8
0x1405c7af84c8bc9movr9, rcx
0x1405c7afb41f60004testbyte ptr [r8], 4
0x1405c7aff4c8bd1movr10, rcx
0x1405c7b027413je0x1405c7b17
0x1405c7b04418b4008moveax, dword ptr [r8 + 8]
0x1405c7b084d635004movsxdr10, dword ptr [r8 + 4]
0x1405c7b0cf7d8negeax
0x1405c7b0e4c03d1addr10, rcx
0x1405c7b114863c8movsxdrcx, eax
0x1405c7b144c23d1andr10, rcx
0x1405c7b174963c3movsxdrax, r11d
0x1405c7b1a4a8b1410movrdx, qword ptr [rax + r10]
0x1405c7b1e488b4310movrax, qword ptr [rbx + 0x10]
0x1405c7b228b4808movecx, dword ptr [rax + 8]
0x1405c7b25488b4308movrax, qword ptr [rbx + 8]
0x1405c7b29f64401030ftestbyte ptr [rcx + rax + 3], 0xf
0x1405c7b2e7410je0x1405c7b40
0x1405c7b300fb6440103movzxeax, byte ptr [rcx + rax + 3]
0x1405c7b35b9f0ffffffmovecx, 0xfffffff0
0x1405c7b3a4823c1andrax, rcx
0x1405c7b3d4c03c8addr9, rax
0x1405c7b404c33caxorr9, rdx
0x1405c7b43498bc9movrcx, r9
0x1405c7b465bpoprbx
0x1405c7b47e924f3ffffjmp0x1405c6e70
0x1405c7b4c488d051dcf0a00learax, [rip + 0xacf1d]
0x1405c7b5348c7411000000000movqword ptr [rcx + 0x10], 0
0x1405c7b5b48894108movqword ptr [rcx + 8], rax
0x1405c7b5f488d05face0a00learax, [rip + 0xacefa]
0x1405c7b66488901movqword ptr [rcx], rax
0x1405c7b69488bc1movrax, rcx
0x1405c7b6cc3ret
0x1405c7b6dccint3
0x1405c7b6eccint3
0x1405c7b6fccint3
callbranchretstackarithregisterimmediatememory
Nothing in this view
This sample produced no results for this part of the static analysis.
Import fingerprint
no related sample| Fingerprint | 192:dJrF7v26WGb8WrWI/mU1RMjaaygVlGUuGQYEhAyL69:3h79QGHfjGQYqL69 |
|---|---|
| Imports read | 441 functions from 17 libraries (441 distinct) |
| Comparable | yes |
| Compared against | 83 stored samples |
Samples built on the same import table
No stored sample you can see shares this import table.
Screen recording
18 frames · screen recording · 166s1 / 18
Download this recording
Download video (.mp4)
Download GIF (.gif)
Building the file runs an encode on this platform, so it is kept to signed-in accounts. Signing in brings you back to this report.
Behavior summary
ran 165s9 process(es) observed; malicious behavior: dropped_executable, process_injection; 262 dropped executable(s)
LaunchedC:\Users\user\Desktop\meccha-camouflage-v1.7.2.exe
Privilegestandard
Defense Evasion::Process Injection [T1055]Execution::Suspicious PowerShell Encoded Command Patterns [T1059.001]Execution::Suspicious Encoded PowerShell Command Line [T1059.001]Execution::Suspicious Execution of Powershell with Base64 [T1059.001]Execution::Change PowerShell Policies to an Insecure Level [T1059.001]
dropped_executableprocess_injection
Telemetry sources:
Kernel ETW (0 events)
agent poll: 106Process audit: 9In-process monitor: 1030
Evasion / anti-analysis checks
3 checks
MED
Anti-debug API imports static-api
MITRE T1622 · getthreadcontext, isdebuggerpresent
MED
YARA: Suspicious_Anti_Debug_API Signature
MITRE T1497
MED
Anti-debug check dynamic
MITRE T1622 · anti_debug
Statically visible checks (RDTSC/CPUID/red-pill instructions, anti-debug APIs) plus runtime evasion signals. Instruction-level interception at runtime requires hypervisor introspection (VMI).
Anti-analysis API trace
4 APIs · 4 processes hookedCalls counted inside the running sample by in-process hooks. Scored means the call crossed the threshold that separates a deliberate check from what ordinary software does; a call that scored nothing is still listed, with the reason.
| API | Signal | Calls | Sleep | Scored |
|---|---|---|---|---|
| GetTickCount | timing | 100 | - | no corroborates, never convicts on its own - ordinary software calls this |
| GetTickCount64 | timing | 10000 | - | no corroborates, never convicts on its own - ordinary software calls this |
| IsDebuggerPresent | anti_debug | 100 | - | yes |
| Sleep | sleep | 10 | 5000 ms total · 500 ms max | no under the floor a stall has to cross (30s in total or 10s at once) |
Call order 31 events sampled
SleepGetTickCount64GetTickCount64GetTickCountGetTickCount64GetTickCountGetTickCountSleepIsDebuggerPresentGetTickCountSleepIsDebuggerPresentGetTickCount64SleepGetTickCount64IsDebuggerPresentGetTickCountGetTickCountIsDebuggerPresentGetTickCount64GetTickCountGetTickCount64GetTickCount64IsDebuggerPresentGetTickCount64GetTickCountGetTickCountGetTickCount64IsDebuggerPresentGetTickCount64spawn:powershell.exe
How to read the numbers: a repeated call is sampled at 1, 10, 100 and so on while the run is live and made exact when the process exits, so a count is a floor and not a total. The count kept for a name is the highest a single process reported, not a sum across the process tree. The hooks are placed a few seconds after a process starts, so a check made in the first moments of a launch is missed - and a sample that exits in those first seconds is never watched at all.
Module loads
37 notable · 88 from system directoriesModules the sample asked for by name while it ran, recorded inside its own process. Loads from system and installed-program directories are counted but not listed - what is listed is a module from somewhere else, a load that failed, or one whose loader is the question.
| Process | Module | Loaded | Why listed |
|---|---|---|---|
| meccha-camouflage-v1.7.2.exe 4176 | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\-xmDIZWNโฆ | no | the load failed |
| meccha-camouflage-v1.7.2.exe 4176 | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\-xmDIZWNโฆ | no | the load failed |
| meccha-camouflage-v1.7.2.exe 4176 | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\-xmDIZWNโฆ | yes | outside the system and installed-program directories |
| meccha-camouflage-v1.7.2.exe 4176 | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\-xmDIZWNโฆ | yes | outside the system and installed-program directories |
| meccha-camouflage-v1.7.2.exe 4176 | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\-xmDIZWNโฆ | yes | outside the system and installed-program directories |
| meccha-camouflage-v1.7.2.exe 4176 | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\-xmDIZWNโฆ | yes | outside the system and installed-program directories |
| meccha-camouflage-v1.7.2.exe 4176 | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\-xmDIZWNโฆ | yes | a module whose loader is the question |
| meccha-camouflage-v1.7.2.exe 4176 | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\-xmDIZWNโฆ | no | the load failed |
| meccha-camouflage-v1.7.2.exe 4176 | C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccfโฆ asked for comctl32.dll | yes | resolved by search order, not by a full path |
| meccha-camouflage-v1.7.2.exe 4176 | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\-xmDIZWNโฆ | yes | outside the system and installed-program directories |
| meccha-camouflage-v1.7.2.exe 4176 | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\-xmDIZWNโฆ | no | the load failed |
| meccha-camouflage-v1.7.2.exe 4176 | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\-xmDIZWNโฆ | yes | outside the system and installed-program directories |
| meccha-camouflage-v1.7.2.exe 4176 | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\-xmDIZWNโฆ | no | the load failed |
| meccha-camouflage-v1.7.2.exe 4176 | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\-xmDIZWNโฆ | yes | outside the system and installed-program directories |
| meccha-camouflage-v1.7.2.exe 4176 | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\-xmDIZWNโฆ | yes | outside the system and installed-program directories |
| meccha-camouflage-v1.7.2.exe 4176 | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\-xmDIZWNโฆ | yes | outside the system and installed-program directories |
| meccha-camouflage-v1.7.2.exe 4176 | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\-xmDIZWNโฆ | no | the load failed |
| meccha-camouflage-v1.7.2.exe 4176 | C:\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.โฆ asked for gdiplus.dll | yes | resolved by search order, not by a full path |
| meccha-camouflage-v1.7.2.exe 4176 | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\-xmDIZWNโฆ | yes | outside the system and installed-program directories |
| meccha-camouflage-v1.7.2.exe 4176 | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\-xmDIZWNโฆ | yes | outside the system and installed-program directories |
| meccha-camouflage-v1.7.2.exe 4176 | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\-xmDIZWNโฆ | no | the load failed |
| meccha-camouflage-v1.7.2.exe 4176 | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\-xmDIZWNโฆ | no | the load failed |
| meccha-camouflage-v1.7.2.exe 4176 | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\-xmDIZWNโฆ | yes | outside the system and installed-program directories |
| meccha-camouflage-v1.7.2.exe 4176 | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\-xmDIZWNโฆ | yes | outside the system and installed-program directories |
| meccha-camouflage-v1.7.2.exe 4176 | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\-xmDIZWNโฆ | yes | outside the system and installed-program directories |
| meccha-camouflage-v1.7.2.exe 4176 | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\-xmDIZWNโฆ | yes | outside the system and installed-program directories |
| meccha-camouflage-v1.7.2.exe 4176 | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\-xmDIZWNโฆ | yes | outside the system and installed-program directories |
| meccha-camouflage-v1.7.2.exe 4176 | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\-xmDIZWNโฆ | yes | outside the system and installed-program directories |
| meccha-camouflage-v1.7.2.exe 4176 | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\-xmDIZWNโฆ | yes | outside the system and installed-program directories |
| meccha-camouflage-v1.7.2.exe 4176 | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\-xmDIZWNโฆ | yes | outside the system and installed-program directories |
| meccha-camouflage-v1.7.2.exe 4176 | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\-xmDIZWNโฆ | yes | outside the system and installed-program directories |
| meccha-camouflage-v1.7.2.exe 4176 | C:\Windows\system32\dbghelp.dll | yes | a module whose loader is the question |
| meccha-camouflage-v1.7.2.exe 4176 | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\-xmDIZWNโฆ | no | the load failed |
| msedgewebview2.exe 3612 | C:\Windows\SYSTEM32\SSPICLI.DLL asked for sspicli.dll | yes | a module whose loader is the question |
| msedgewebview2.exe 3612 | C:\Windows\System32\vaultcli.dll | yes | a module whose loader is the question |
| msedgewebview2.exe 3612 | C:\Windows\system32\hevcdecoder.dll | no | the load failed |
| msedgewebview2.exe 3612 | C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.65\โฆ | no | the load failed |
What this list cannot say: only an explicit LoadLibrary call is recorded, so a module the sample brought in through its own import table never appears here - absence from this list is not absence from the process. There is no signature check behind these rows, so an unlisted module is not a module that was verified. The hooks are placed a few seconds after a process starts, so the first loads of a launch are missed.
WMI activity
1 classWMI classes the sample queried, captured from the WMI-Activity trace and attributed to the sample process tree. Hardware/identity classes also surface as VM-detection checks above.
MSFT_MpPreference
Cross-process injection
6 callsSeen from inside the calling process, so it names which process reached into which - something a dump of the result cannot show. Only calls whose target is another process are listed.
write_memory pid 3612 → pid 1736
344 bytes
alloc_rwx pid 3612 → pid 1736
4096 bytes prot=0x40
write_memory pid 3612 → pid 3936
8 bytes
alloc_rwx pid 3612 → pid 3936
4096 bytes prot=0x40
write_memory pid 3612 → pid 1172
8 bytes
alloc_rwx pid 3612 → pid 1172
4096 bytes prot=0x40
File timestamp writes
9 filesCaptured in the calling process, so the values are the ones the sample asked for rather than what the file ended up with. Setting file times is ordinary - installers and archivers do it - so only a write that moves a file's history backwards is marked as timestomping.
C:\Users\user\AppData\Local\MecchaCamouflage\webview2-user-data\EBWebView\Edge-Local-State-Tmp-ef7a551f-360e-4a42-a9b2-8a16a6ea98e4.tmp pid 3612
created=2026-10-22T08:28:45Z modified=unchanged accessed=unchanged
was created=2026-10-22T08:28:46Z modified=2026-10-22T08:28:46Z
C:\Users\user\AppData\Local\MecchaCamouflage\webview2-user-data\EBWebView\Edge-Local-State-Tmp-db4a0696-88b0-4b88-bdc9-807cb61c3f9f.tmp pid 3612
created=2026-10-22T08:28:45Z modified=unchanged accessed=unchanged
was created=2026-10-22T08:28:46Z modified=2026-10-22T08:28:46Z
C:\Users\user\AppData\Local\MecchaCamouflage\webview2-user-data\EBWebView\Edge-Local-State-Tmp-c6d5834e-bdb4-4215-a975-b0c9b86775f6.tmp pid 3612
created=2026-10-22T08:28:45Z modified=unchanged accessed=unchanged
was created=2026-10-22T08:28:56Z modified=2026-10-22T08:28:56Z
C:\Users\user\AppData\Local\MecchaCamouflage\webview2-user-data\EBWebView\Default\f27f25ae-2216-4f4a-9404-20dded79610b.tmp pid 3612
created=2026-10-22T08:28:56Z modified=unchanged accessed=unchanged
was created=2026-10-22T08:29:06Z modified=2026-10-22T08:29:06Z
C:\Users\user\AppData\Local\MecchaCamouflage\webview2-user-data\EBWebView\Default\Code Cache\js\index-dir\temp-index pid 3612
created=2026-10-22T08:28:46Z modified=unchanged accessed=unchanged
was created=2026-10-22T08:29:14Z modified=2026-10-22T08:29:14Z
C:\Users\user\AppData\Local\MecchaCamouflage\webview2-user-data\EBWebView\Default\5c5dbd54-660b-47b7-974f-707731aa591a.tmp pid 3612
created=2026-10-22T08:28:56Z modified=unchanged accessed=unchanged
was created=2026-10-22T08:29:26Z modified=2026-10-22T08:29:26Z
C:\Users\user\AppData\Local\MecchaCamouflage\webview2-user-data\EBWebView\extensions_crx_cache\638ce2d2-a9f8-4fcd-992f-3460ba086eba.tmp pid 3612
created=2026-10-22T08:29:26Z modified=unchanged accessed=unchanged
was created=2026-10-22T08:29:26Z modified=2026-10-22T08:29:26Z
C:\Users\user\AppData\Local\MecchaCamouflage\webview2-user-data\EBWebView\Edge-Local-State-Tmp-59125863-95ee-4058-abfb-92e2923d2997.tmp pid 3612
created=2026-10-22T08:28:45Z modified=unchanged accessed=unchanged
was created=2026-10-22T08:29:55Z modified=2026-10-22T08:29:55Z
C:\Users\user\AppData\Local\MecchaCamouflage\webview2-user-data\EBWebView\Default\492a6c8c-6857-490f-8e20-3cde1d15a804.tmp pid 3612
created=2026-10-22T08:28:56Z modified=unchanged accessed=unchanged
was created=2026-10-22T08:29:56Z modified=2026-10-22T08:29:56Z
WMI method invocations
1 callMethods the sample invoked through WMI, with their arguments. A process created this way is spawned by the WMI provider host, so the operating system records no parent link back to the sample - the caller is named by the WMI-Activity trace and the argument is captured in the calling process itself.
Connect pid 4968
Living-off-the-land binaries
1 LOLBin abuse
HIGH
powershell runs an encoded PowerShell command MITRE T1059.001
"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JAB0AGEAcgBnAGUAdAAgAD0AIABbAEkATwAuAFAAYQB0AGgAXQA6ADoARwBlAHQARgB1AGwAbABQAGEAdABoACgAJwBDADoAXABVAHMAZQByAHMAXABqAHMAbQBpAHQAaABcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABNA
Deobfuscated scripts
6 blocksPowerShell script blocks the sample executed, as PowerShell itself logged them (event 4104) - so an encoded or Invoke-Expression-decoded payload is captured in its final, deobfuscated form, the way it actually ran.
$global:?
{ Set-StrictMode -Version 1; $_.OriginInfo }{ Set-StrictMode -Version 1; $_.ErrorCategory_Message }{ Set-StrictMode -Version 1; $this.Exception.InnerException.PSMessageDetails }{ Set-StrictMode -Version 1; $_.PSMessageDetails }$target = [IO.Path]::GetFullPath('C:\Users\user\AppData\Local\MecchaCamouflage').TrimEnd('\'); $preference = Get-MpPreference -ErrorAction Stop; $configured = @($preference.ExclusionPath); foreach ($candidate in $configured) { if ([string]::IsNullOrWhiteSpace($candidate)) { continue }; try { $normalized = [IO.Path]::GetFullPath([Environment]::ExpandEnvironmentVariables($candidate)).TrimEnd('\') } catch { continue }; if ([StringComparer]::OrdinalIgnoreCase.Equals($target, $normalized)) { exit 0 } }; if ($preference.HideExclusionsFromLocalUsers -eq $true -or $preference.HideExclusionsFromLocalAdmins -eq $true) { exit 3 }; exit 2
Command lines, unwrapped
15 read · 1 with something in15 captured texts were unwrapped locally; 1 yielded something. An address below is text found in a command line: recovering one is not evidence that the sample reached it, and a well-formed hostname here may be a file path or a type name.
| Came from | Hidden | Looks like an address |
|---|---|---|
| pid 4968 | 1 layer | none |
|
Unwrapped in order1. encoded_command_base64
As captured
"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JAB0AGEAcgBnAGUAdAAgAD0AIABbAEkATwAuAFAAYQB0AGgAXQA6ADoARwBlAHQARgB1AGwAbABQAGEAdABoACgAJwBDADoAXABVAHMAZQByAHMAXABqAHMAbQBpAHQAaABcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABNAGUAYwBjAGgAYQBDAGEAbQBvAHUAZgBsAGEAZwBlACcAKQAuAFQAcgBpAG0ARQBuAGQAKAAnAFwAJwApADsAIAAkAHAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAARwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwB0AG8AcAA7ACAAJABjAG8AbgBmAGkAZwB1AHIAZQBkACAAPQAgAEAAKAAkAHAAcgBlAGYAZQByAGUAbgBjAGUALgBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACkAOwAgAGYAbwByAGUAYQBjAGgAIAAoACQAYwBhAG4AZABpAGQAYQB0AGUAIABpAG4AIAAkAGMAbwBuAGYAaQBnAHUAcgBlAGQAKQAgAHsAIABpAGYAIAAoAFsAcwB0AHIAaQBuAGcAXQA6ADoASQBzAE4AdQBsAGwATwByAFcAaABpAHQAZQBTAHAAYQBjAGUAKAAkAGMAYQBuAGQAaQBkAGEAdABlACkAKQAgAHsAIABjAG8AbgB0AGkAbgB1AGUAIAB9ADsAIAB0AHIAeQAgAHsAIAAkAG4AbwByAG0AYQBsAGkAegBlAGQAIAA9ACAAWwBJAE8ALgBQAGEAdABoAF0AOgA6AEcAZQB0AEYAdQBsAGwAUABhAHQAaAAoAFsARQBuAHYAaQByAG8AbgBtAGUAbgB0AF0AOgA6AEUAeABwAGEAbgBkAEUAbgB2AGkAcgBvAG4AbQBlAG4AdABWAGEAcgBpAGEAYgBsAGUAcwAoACQAYwBhAG4AZABpAGQAYQB0AGUAKQApAC4AVAByAGkAbQBFAG4AZAAoACcAXAAnACkAIAB9ACAAYwBhAHQAYwBoACAAewAgAGMAbwBuAHQAaQBuAHUAZQAgAH0AOwAgAGkAZgAgACgAWwBTAHQAcgBpAG4AZwBDAG8AbQBwAGEAcgBlAHIAXQA6ADoATwByAGQAaQBuAGEAbABJAGcAbgBvAHIAZQBDAGEAcwBlAC4ARQBxAHUAYQBsAHMAKAAkAHQAYQByAGcAZQB0ACwAIAAkAG4AbwByAG0AYQBsAGkAegBlAGQAKQApACAAewAgAGUAeABpAHQAIAAwACAAfQAgAH0AOwAgAGkAZgAgACgAJABwAHIAZQBmAGUAcgBlAG4AYwBlAC4ASABpAGQAZQBFAHgAYwBsAHUAcwBpAG8AbgBzAEYAcgBvAG0ATABvAGMAYQBsAFUAcwBlAHIAcwAgAC0AZQBxACAAJAB0AHIAdQBlACAALQBvAHIAIAAkAHAAcgBlAGYAZQByAGUAbgBjAGUALgBIAGkAZABlAEUAeABjAGwAdQBzAGkAbwBuAHMARgByAG8AbQBMAG8AYwBhAGwAQQBkAG0AaQBuAHMAIAAtAGUAcQAgACQAdAByAHUAZQApACAAewAgAGUAeABpAHQAIAAzACAAfQA7ACAAZQB4AGkAdAAgADIAUnwrapped "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass $target = [IO.Path]::GetFullPath('C:\Users\user\AppData\Local\MecchaCamouflage').TrimEnd('\'); $preference = Get-MpPreference -ErrorAction Stop; $configured = @($preference.ExclusionPath); foreach ($candidate in $configured) { if ([string]::IsNullOrWhiteSpace($candidate)) { continue }; try { $normalized = [IO.Path]::GetFullPath([Environment]::ExpandEnvironmentVariables($candidate)).TrimEnd('\') } catch { continue }; if ([StringComparer]::OrdinalIgnoreCase.Equals($target, $normalized)) { exit 0 } }; if ($preference.HideExclusionsFromLocalUsers -eq $true -or $preference.HideExclusionsFromLocalAdmins -eq $true) { exit 3 }; exit 2
|
||
Network activity
The network section is a paid-plan layer: the DNS the sample resolved, the connections it opened, the TLS it negotiated, and the rule engine's reading of the capture.
This run was captured, and what it captured is on a paid plan rather than absent. An internet-connected detonation is the same plan, so a paid run also shows what the sample reached rather than only what it tried.
Process tree
What ran during the detonation, and what each process did. Select a node to see the activity attributed to it.
9processes
259file operations
58registry operations
100dropped files
meccha-camouflage-v1.7.2.exe
9 processes
9 processes
Attributed activity
meccha-camouflage-v1.7.2.exe
PID 4176
Image
C:\Users\user\Desktop\meccha-camouflage-v1.7.2.exe
Command
C:\Users\user\Desktop\meccha-camouflage-v1.7.2.exe
Parent
not captured - its parent is outside the sample's tree
Children
2
File operations252
createC:\Users\user\AppData\Local\Temp\.net
createC:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2
createC:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050
createC:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\runtimes
createC:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\runtimes\win-x64
createC:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\runtimes\win-x64\native
createC:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\runtimes\win-x64\native\WebView2Loader.dll
createC:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\meccha-camouflage.dll
createC:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\meccha-camouflage.runtimeconfig.json
createC:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\Microsoft.CSharp.dll
createC:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\Microsoft.VisualBasic.Core.dll
createC:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\Microsoft.Win32.Primitives.dll
createC:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\Microsoft.Win32.Registry.dll
createC:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.AppContext.dll
createC:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Buffers.dll
createC:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Collections.Concurrent.dll
createC:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Collections.Immutable.dll
createC:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Collections.NonGeneric.dll
createC:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Collections.Specialized.dll
createC:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Collections.dll
createC:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.ComponentModel.Annotations.dll
createC:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.ComponentModel.DataAnnotations.dll
createC:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.ComponentModel.EventBasedAsync.dll
createC:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.ComponentModel.Primitives.dll
createC:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.ComponentModel.TypeConverter.dll
createC:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.ComponentModel.dll
createC:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Configuration.dll
createC:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Console.dll
createC:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Core.dll
createC:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Data.Common.dll
createC:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Data.DataSetExtensions.dll
createC:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Data.dll
createC:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Diagnostics.Contracts.dll
createC:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Diagnostics.Debug.dll
createC:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Diagnostics.DiagnosticSource.dll
createC:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Diagnostics.FileVersionInfo.dll
createC:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Diagnostics.Process.dll
createC:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Diagnostics.StackTrace.dll
createC:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Diagnostics.TextWriterTraceListener.dll
createC:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Diagnostics.Tools.dll
Showing the first 40 of 252. The full list is on the File & registry section.
Dropped files100
dropC:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\runtimes\win-x64\native\WebView2Loader.dll
dropC:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\meccha-camouflage.dll
dropC:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\Microsoft.CSharp.dll
dropC:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\Microsoft.VisualBasic.Core.dll
dropC:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\Microsoft.Win32.Primitives.dll
dropC:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\Microsoft.Win32.Registry.dll
dropC:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.AppContext.dll
dropC:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Buffers.dll
dropC:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Collections.Concurrent.dll
dropC:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Collections.Immutable.dll
dropC:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Collections.NonGeneric.dll
dropC:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Collections.Specialized.dll
dropC:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Collections.dll
dropC:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.ComponentModel.Annotations.dll
dropC:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.ComponentModel.DataAnnotations.dll
dropC:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.ComponentModel.EventBasedAsync.dll
dropC:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.ComponentModel.Primitives.dll
dropC:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.ComponentModel.TypeConverter.dll
dropC:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.ComponentModel.dll
dropC:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Configuration.dll
dropC:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Console.dll
dropC:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Core.dll
dropC:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Data.Common.dll
dropC:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Data.DataSetExtensions.dll
dropC:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Data.dll
dropC:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Diagnostics.Contracts.dll
dropC:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Diagnostics.Debug.dll
dropC:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Diagnostics.DiagnosticSource.dll
dropC:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Diagnostics.FileVersionInfo.dll
dropC:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Diagnostics.Process.dll
dropC:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Diagnostics.StackTrace.dll
dropC:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Diagnostics.TextWriterTraceListener.dll
dropC:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Diagnostics.Tools.dll
dropC:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Diagnostics.TraceSource.dll
dropC:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Diagnostics.Tracing.dll
dropC:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Drawing.Primitives.dll
dropC:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Dynamic.Runtime.dll
dropC:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Formats.Asn1.dll
dropC:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Formats.Tar.dll
dropC:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Globalization.Calendars.dll
Showing the first 40 of 100. The full list is on the Behavior section.
msedgewebview2.exe
PID 3612
Image
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.65\msedgewebview2.exe
Command
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.65\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=meccha-camouflage-v1.7.2.exe --webview-exe-version=1.0.0+87de3fdcf83e4a39d9bc0f47ed5e45987ec62636 --user-data-dir="C:\Users\user\AppData\Local\MecchaCamouflage\webview2-user-data\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --mojo-named-platform-channel-pipe=4176.1116.5068810477454340761
Parent
PID 4176 · meccha-camouflage-v1.7.2.exe
Chain
meccha-camouflage-v1.7.2.exe -> msedgewebview2.exe
Children
5
File operations7
createC:\Users\user\AppData\Local\MecchaCamouflage\webview2-user-data\EBWebView\Last Version
createC:\Users\user\AppData\Local\MecchaCamouflage\webview2-user-data\EBWebView\Default\README
createC:\Users\user\AppData\Local\MecchaCamouflage\webview2-user-data\EBWebView\GPUPersistentCache\DawnGraphiteCache\MNIWWJ6LYBXKQS7RZ2KZNUZ3QHFNW4K3\cache.db
createC:\Users\user\AppData\Local\MecchaCamouflage\webview2-user-data\EBWebView\GPUPersistentCache\DawnGraphiteCache\MNIWWJ6LYBXKQS7RZ2KZNUZ3QHFNW4K3\cache.journal
create\\.\pipe\LOCAL\mojo.3612.4968.9996819310255039690
createC:\Users\user\AppData\Local\MecchaCamouflage\webview2-user-data\EBWebView\Default\Web Data
createC:\Users\user\AppData\Local\MecchaCamouflage\webview2-user-data\EBWebView\Default\ServerCertificate
Registry operations55
createSOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
createSOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
create\REGISTRY\USER\S-1-5-21-3020052414-521178761-3546482252-1000
createSOFTWARE
createSOFTWARE\Microsoft
createSOFTWARE\Microsoft\EdgeWebView
setvalueSOFTWARE\Microsoft\EdgeWebViewUsageStatsInSample = 1
createSOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
createSYSTEM\ControlSet001\Control\Class\{4d36e96e-e325-11ce-bfc1-08002be10318}
createSYSTEM\ControlSet001\Control\Class\{4d36e96e-e325-11ce-bfc1-08002be10318}\0001
createSOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}
setvalueSOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}usagestats = 0
setvalueSOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}urlstats = 0
createSOFTWARE\Microsoft\EdgeWebView\PreferenceMACs
createSOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default
setvalueSOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Defaultsearch_provider_overrides = 4DBA0FFF65C6D80FA7420958E74EAAC97DB9D9C8DF92E6519670208C0BEB9EB7
setvalueSOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Defaultextensions.install.initialprovidername = E9126C04B6BB4CA1EB91C2D144895024EDB9486A2AD3A51F59FAC2423B76DE88
setvalueSOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Defaultenterprise_signin.policy_recovery_token = 2717EF4E079CBD315D33B69DF1B615A372FBCF8E2C268640AA339231E288E2F9
setvalueSOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Defaultsession.restore_on_startup = CC5419551D541F870BB8CE9D642B542A82E6C0C9A326946A00574898C5CFBEF9
setvalueSOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Defaultgoogle.services.last_signed_in_username = B15A13F7AC455714881C73CB3884C56606B741748D5FDB755F3722EB529F139C
setvalueSOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Defaultsafebrowsing.incidents_sent = 56A3D52FAE006499851EE9E8B8C3889410541FF011C3C50743CD5DBAD8DCC7EE
setvalueSOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Defaultedge.services.last_username = 27AA721EA9132D48F13228C3D36ECF14DBE1564D5E394AEE5F0502A56C83105C
setvalueSOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Defaulthomepage = 18A10383273D5FB5CB467CC32957B91B32E1678AB69C2EE37484DCD494CAA0B0
setvalueSOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Defaultbrowser.show_home_button = B254E0E18DDBE15FC86BF2088B5A8DA8AE0A6550FD5C127A624CB92F1F02B3A2
setvalueSOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Defaulthomepage_is_newtabpage = 830D9587BC170D78A3A73DC220E352C34DEB6CFFCE744F2226FE3D17DC90F2D4
setvalueSOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Defaultsession.startup_urls = C51BAFA29B43E0CAC8A0162EE5BC5F43A02FFA05A10546048158A14A3FA86017
setvalueSOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Defaultmedia.cdm.origin_data = 1E532462AA1CB37A0E91458991948EAFEBC742B67B6FB3A5D5C28F19E7EA26E6
setvalueSOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Defaultschedule_to_flush_to_disk = EB159B655C04B95EC718A55AE792DDE019D6E8B70B4CC89B1DAEB17A16D3FD28
setvalueSOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Defaultpinned_tabs = 2A0B29F76FE3459929325B49AE5CB3B1DF7108109F8075EFED4964B98CC8C535
setvalueSOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Defaultdefault_search_provider_data.template_url_data = 5308D9322E52610EBC403C1414995A881C75086EE13984CE5641595521ADD7E3
setvalueSOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Defaultextensions.install.initiallist = 1D101087C6AD534849102B4ECA7E5612B6A410DF1F35ADC173A8FF6379676B4A
setvalueSOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Defaultprefs.preference_reset_time = E4F6997EFE87BFDCAA8E581C7CF161955E9421804C1317284FC6CF96E0443275
setvalueSOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Defaultedge.services.account_id = 91DE212BA2C9479842C49132D48F7A142EBD9437B3D080888843785BEFEBF20B
setvalueSOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Defaultmedia.storage_id_salt = BF4B9CB2B49AC5BC25E1F81CCA62A4B6AA0A27C48FC554CD775C591DEFA72A0D
setvalueSOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Defaultextensions.ui.developer_mode = D72CDC424D084A6C9AA1FE8AF4701060EA433690E1A3F96E06B94DF2367D34A1
createSOFTWARE\Microsoft\Edge
createSOFTWARE\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}
setvalueSOFTWARE\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}lastrun = 13437131326250578
createSOFTWARE\Microsoft\EdgeWebView\BLBeacon
setvalueSOFTWARE\Microsoft\EdgeWebView\BLBeaconversion = 150.0.4078.65
Showing the first 40 of 55. The full list is on the File & registry section.
msedgewebview2.exe
PID 3424
Image
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.65\msedgewebview2.exe
Command
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.65\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\user\AppData\Local\MecchaCamouflage\webview2-user-data\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\user\AppData\Local\MecchaCamouflage\webview2-user-data\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=150.0.7871.115 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.65\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=150.0.4078.65 --initial-client-data=0x16c,0x170,0x174,0x148,0x124,0x7ffbbc9edcf0,0x7ffbbc9edcfc,0x7ffbbc9edd08
Parent
PID 3612 · msedgewebview2.exe
Chain
meccha-camouflage-v1.7.2.exe -> msedgewebview2.exe
Registry operations1
createSoftware\Microsoft\WBEM\CIMOM
msedgewebview2.exe
PID 1736
Image
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.65\msedgewebview2.exe
Command
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.65\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\MecchaCamouflage\webview2-user-data\EBWebView" --webview-exe-name=meccha-camouflage-v1.7.2.exe --webview-exe-version=1.0.0+87de3fdcf83e4a39d9bc0f47ed5e45987ec62636 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAOAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --startup-read-main-dll --metrics-shmem-handle=1760,i,5377341973747292128,2100637902330107367,262144 --field-trial-handle=2132,i,5563888653860876346,2998305516391199298,262144 --variations-seed-version --pseudonymization-salt-handle=2128,i,4430815839611758465,2714051824248795719,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1740 /prefetch:2
Parent
PID 3612 · msedgewebview2.exe
Chain
meccha-camouflage-v1.7.2.exe -> msedgewebview2.exe
Nothing in this run was attributed to this process. That is not the same as "it did nothing" - it means no captured operation carried its pid.
msedgewebview2.exe
PID 1112
Image
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.65\msedgewebview2.exe
Command
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.65\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\MecchaCamouflage\webview2-user-data\EBWebView" --webview-exe-name=meccha-camouflage-v1.7.2.exe --webview-exe-version=1.0.0+87de3fdcf83e4a39d9bc0f47ed5e45987ec62636 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --startup-read-main-dll --metrics-shmem-handle=1908,i,5468443592896318150,12647367843367205049,524288 --field-trial-handle=2132,i,5563888653860876346,2998305516391199298,262144 --variations-seed-version --pseudonymization-salt-handle=2128,i,4430815839611758465,2714051824248795719,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=3208 /prefetch:3
Parent
PID 3612 · msedgewebview2.exe
Chain
meccha-camouflage-v1.7.2.exe -> msedgewebview2.exe
Registry operations2
createSOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\Location Awareness
create\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters
msedgewebview2.exe
PID 3936
Image
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.65\msedgewebview2.exe
Command
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.65\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\MecchaCamouflage\webview2-user-data\EBWebView" --webview-exe-name=meccha-camouflage-v1.7.2.exe --webview-exe-version=1.0.0+87de3fdcf83e4a39d9bc0f47ed5e45987ec62636 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --startup-read-main-dll --metrics-shmem-handle=2344,i,17706824819149158890,10977547547167371670,524288 --field-trial-handle=2132,i,5563888653860876346,2998305516391199298,262144 --variations-seed-version --pseudonymization-salt-handle=2128,i,4430815839611758465,2714051824248795719,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=3216 /prefetch:8
Parent
PID 3612 · msedgewebview2.exe
Chain
meccha-camouflage-v1.7.2.exe -> msedgewebview2.exe
Nothing in this run was attributed to this process. That is not the same as "it did nothing" - it means no captured operation carried its pid.
msedgewebview2.exe
PID 1172
Image
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.65\msedgewebview2.exe
Command
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.65\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\MecchaCamouflage\webview2-user-data\EBWebView" --webview-exe-name=meccha-camouflage-v1.7.2.exe --webview-exe-version=1.0.0+87de3fdcf83e4a39d9bc0f47ed5e45987ec62636 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--expose-gc --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --ram-no-pressure-read-main-dll --metrics-shmem-handle=3808,i,4677193937944408219,11308599690810867413,2097152 --field-trial-handle=2132,i,5563888653860876346,2998305516391199298,262144 --variations-seed-version --pseudonymization-salt-handle=2128,i,4430815839611758465,2714051824248795719,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3752 /prefetch:1
Parent
PID 3612 · msedgewebview2.exe
Chain
meccha-camouflage-v1.7.2.exe -> msedgewebview2.exe
Nothing in this run was attributed to this process. That is not the same as "it did nothing" - it means no captured operation carried its pid.
powershell.exe
PID 4968
Image
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Command
"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JAB0AGEAcgBnAGUAdAAgAD0AIABbAEkATwAuAFAAYQB0AGgAXQA6ADoARwBlAHQARgB1AGwAbABQAGEAdABoACgAJwBDADoAXABVAHMAZQByAHMAXABqAHMAbQBpAHQAaABcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABNAGUAYwBjAGgAYQBDAGEAbQBvAHUAZgBsAGEAZwBlACcAKQAuAFQAcgBpAG0ARQBuAGQAKAAnAFwAJwApADsAIAAkAHAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAARwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwB0AG8AcAA7ACAAJABjAG8AbgBmAGkAZwB1AHIAZQBkACAAPQAgAEAAKAAkAHAAcgBlAGYAZQByAGUAbgBjAGUALgBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACkAOwAgAGYAbwByAGUAYQBjAGgAIAAoACQAYwBhAG4AZABpAGQAYQB0AGUAIABpAG4AIAAkAGMAbwBuAGYAaQBnAHUAcgBlAGQAKQAgAHsAIABpAGYAIAAoAFsAcwB0AHIAaQBuAGcAXQA6ADoASQBzAE4AdQBsAGwATwByAFcAaABpAHQAZQBTAHAAYQBjAGUAKAAkAGMAYQBuAGQAaQBkAGEAdABlACkAKQAgAHsAIABjAG8AbgB0AGkAbgB1AGUAIAB9ADsAIAB0AHIAeQAgAHsAIAAkAG4AbwByAG0AYQBsAGkAegBlAGQAIAA9ACAAWwBJAE8ALgBQAGEAdABoAF0AOgA6AEcAZQB0AEYAdQBsAGwAUABhAHQAaAAoAFsARQBuAHYAaQByAG8AbgBtAGUAbgB0AF0AOgA6AEUAeABwAGEAbgBkAEUAbgB2AGkAcgBvAG4AbQBlAG4AdABWAGEAcgBpAGEAYgBsAGUAcwAoACQAYwBhAG4AZABpAGQAYQB0AGUAKQApAC4AVAByAGkAbQBFAG4AZAAoACcAXAAnACkAIAB9ACAAYwBhAHQAYwBoACAAewAgAGMAbwBuAHQAaQBuAHUAZQAgAH0AOwAgAGkAZgAgACgAWwBTAHQAcgBpAG4AZwBDAG8AbQBwAGEAcgBlAHIAXQA6ADoATwByAGQAaQBuAGEAbABJAGcAbgBvAHIAZQBDAGEAcwBlAC4ARQBxAHUAYQBsAHMAKAAkAHQAYQByAGcAZQB0ACwAIAAkAG4AbwByAG0AYQBsAGkAegBlAGQAKQApACAAewAgAGUAeABpAHQAIAAwACAAfQAgAH0AOwAgAGkAZgAgACgAJABwAHIAZQBmAGUAcgBlAG4AYwBlAC4ASABpAGQAZQBFAHgAYwBsAHUAcwBpAG8AbgBzAEYAcgBvAG0ATABvAGMAYQBsAFUAcwBlAHIAcwAgAC0AZQBxACAAJAB0AHIAdQBlACAALQBvAHIAIAAkAHAAcgBlAGYAZQByAGUAbgBjAGUALgBIAGkAZABlAEUAeABjAGwAdQBzAGkAbwBuAHMARgByAG8AbQBMAG8AYwBhAGwAQQBkAG0AaQBuAHMAIAAtAGUAcQAgACQAdAByAHUAZQApACAAewAgAGUAeABpAHQAIAAzACAAfQA7ACAAZQB4AGkAdAAgADIA
Parent
PID 4176 · meccha-camouflage-v1.7.2.exe
Chain
meccha-camouflage-v1.7.2.exe -> powershell.exe
Children
1
Nothing in this run was attributed to this process. That is not the same as "it did nothing" - it means no captured operation carried its pid.
conhost.exe
PID 1952
Image
C:\Windows\System32\conhost.exe
Command
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Parent
PID 4968 · powershell.exe
Chain
meccha-camouflage-v1.7.2.exe -> powershell.exe
Nothing in this run was attributed to this process. That is not the same as "it did nothing" - it means no captured operation carried its pid.
Not attributed to any process
1 kindThese operations were captured but carry no pid this tree could match, so they are not shown against any node above.
File operations14
1Mechanisms found
90Methods checked
1ATT&CK techniques
LOWHighest severity
Persistence mechanisms
1 found| Method | Family | ATT&CK | Evidence | Severity |
|---|---|---|---|---|
| .NET Startup Hook DLL | DLL Load Order | T1574 | Static hint | LOW |
Runtime evidence means the mechanism was established during detonation. A static hint means the sample only references the technique.
Detection coverage
1 / 90Every auto-start method checked on this sample, grouped by family. A method with no result is reported clean, and one the sample only names in its own strings reads "named" rather than "detected".
Logon & Startup
22 clean
- Active Setup Installed Component T1547.014 clean
- Explorer Delay-Load Object T1547.001 clean
- Explorer Run Key T1547.001 clean
- Explorer SharedTaskScheduler T1547.001 clean
- Group Policy Extension DLL T1547.004 clean
- Group Policy Run Key T1547.001 clean
- Logon Script T1037.001 clean
- RDP WDS Startup Program T1547.001 clean
- Registry Run Key T1547.001 clean
- Registry RunEx Key T1547.001 clean
- Registry RunOnce Key T1547.001 clean
- Registry RunOnceEx Key T1547.001 clean
- Registry RunServices Key T1547.001 clean
- Startup Folder Item T1547.001 clean
- Startup Folder Redirection T1547.001 clean
- Terminal Services Initial Program T1547.001 clean
- Winlogon GINA DLL T1547.004 clean
- Winlogon MPNotify Value T1547.004 clean
- Winlogon Notify Package T1547.004 clean
- Winlogon Shell Value T1547.004 clean
- Winlogon Taskman Value T1547.004 clean
- Winlogon Userinit Value T1547.004 clean
Services & Tasks
9 clean
- BITS Job T1197 clean
- Print Monitor DLL T1547.010 clean
- Print Processor DLL T1547.012 clean
- Scheduled Task T1053.005 clean
- Scheduled Task Registry Implant T1053.005 clean
- Service Control Manager Security Descriptor T1574.011 clean
- Service DLL Hijack T1543.003 clean
- Time Provider DLL T1547.003 clean
- Windows Service Creation T1543.003 clean
Execution Hijack
17 clean
- .NET Managed Debugger T1546.012 clean
- Accessibility Tool Hijack T1546.008 clean
- AeDebug Postmortem Debugger T1546.012 clean
- App Paths Hijack T1546.012 clean
- Application Shim Database T1546.011 clean
- Boot Verification Program T1547.002 clean
- Command Processor AutoRun T1546.011 clean
- Explorer Load Value T1547.001 clean
- Explorer MyComputer Tool Hijack T1546.001 clean
- Registry Image File Execution Options T1546.012 clean
- Screensaver Hijack T1546.002 clean
- Setup ErrorHandler Script T1546 clean
- Shell Open Command Hijack T1546.001 clean
- SilentProcessExit Monitor T1546.012 clean
- Telemetry Controller Command T1546.015 clean
- WER ReflectDebugger T1546.012 clean
- Windows Error Reporting Debugger T1546.012 clean
DLL Load Order
1 / 12
- .NET CLR Profiler DLL T1574.012 clean
- .NET Startup Hook DLL T1574 named
- AppCert DLLs T1546.009 clean
- AppInit DLLs T1546.010 clean
- AutodialDLL Winsock Injection T1546.006 clean
- DLL Search-Order Hijack T1574.001 T1574.002 clean
- DNS Server Plugin DLL T1574.001 clean
- HTML Help Helper DLL T1546 clean
- KnownDLLs Manipulation T1574.001 clean
- Natural Language Platform DLL Override T1546 clean
- Netsh Helper DLL T1546.007 clean
- Winsock Layered Service Provider T1546.006 clean
COM & Browser
6 clean
- Browser Extension T1176 clean
- Browser Helper Object T1176 clean
- COM Server Hijack T1546.015 clean
- HTML Help COM Object Hijack T1546.015 clean
- Shell Context Menu Handler T1546.001 clean
- Shell Extension Handler T1546.001 clean
Security Providers & Accounts
11 clean
- Account RID Hijack T1098 clean
- AMSI Provider T1562.001 clean
- Credential Provider T1547.014 clean
- DSRM Admin Logon Backdoor T1556 clean
- Hidden Local Account T1136.001 clean
- LSA Authentication Package T1547.002 clean
- LSA Extension DLL T1547.005 clean
- LSA Notification Package T1547.005 clean
- LSA Security Package T1547.005 clean
- Network Provider DLL T1556.008 clean
- Security Support Provider T1547.005 clean
Scripting & Applications
9 clean
- Netsh Port Proxy T1090.001 clean
- Office Add-in T1137.006 clean
- Office Executable Sideload T1574.002 clean
- Office Startup Template T1137.001 clean
- Office Test Key T1137.002 clean
- Power Automate Flow T1546 clean
- PowerShell Profile T1546.013 clean
- Windows Terminal Startup Action T1546 clean
- WMI Event Subscription T1546.003 clean
Boot & Firmware
4 clean
- BootExecute Native Image T1547.002 clean
- PlatformExecute Native Image T1547.002 clean
- SetupExecute Native Image T1547.002 clean
- UEFI / Bootkit Artifact T1542.003 T1542.001 clean
File activity summary
create 285
write 0
modify 14
delete 0
rename 1
Dropped files
100 payloadsDownloadable copies were kept for 0 distinct payloads. 237 more distinct payloads exceeded the per-scan capture limit and are listed below without bytes.
| Path | SHA-256 | Size | Process | Time | Download |
|---|---|---|---|---|---|
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\runtimes\win-x64\native\WebView2Loader.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\meccha-camouflage.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\Microsoft.CSharp.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\Microsoft.VisualBasic.Core.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\Microsoft.Win32.Primitives.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\Microsoft.Win32.Registry.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.AppContext.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Buffers.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Collections.Concurrent.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Collections.Immutable.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Collections.NonGeneric.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Collections.Specialized.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Collections.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.ComponentModel.Annotations.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.ComponentModel.DataAnnotations.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.ComponentModel.EventBasedAsync.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.ComponentModel.Primitives.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.ComponentModel.TypeConverter.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.ComponentModel.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Configuration.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Console.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Core.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Data.Common.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Data.DataSetExtensions.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Data.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Diagnostics.Contracts.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Diagnostics.Debug.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Diagnostics.DiagnosticSource.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Diagnostics.FileVersionInfo.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Diagnostics.Process.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Diagnostics.StackTrace.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Diagnostics.TextWriterTraceListener.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Diagnostics.Tools.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Diagnostics.TraceSource.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Diagnostics.Tracing.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Drawing.Primitives.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Dynamic.Runtime.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Formats.Asn1.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Formats.Tar.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Globalization.Calendars.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Globalization.Extensions.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Globalization.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.IO.Compression.Brotli.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.IO.Compression.FileSystem.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.IO.Compression.ZipFile.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.IO.Compression.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.IO.FileSystem.AccessControl.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.IO.FileSystem.DriveInfo.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.IO.FileSystem.Primitives.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.IO.FileSystem.Watcher.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.IO.FileSystem.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.IO.IsolatedStorage.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.IO.MemoryMappedFiles.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.IO.Pipelines.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.IO.Pipes.AccessControl.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.IO.Pipes.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.IO.UnmanagedMemoryStream.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.IO.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Linq.AsyncEnumerable.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Linq.Expressions.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Linq.Parallel.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Linq.Queryable.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Linq.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Memory.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Net.Http.Json.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Net.Http.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Net.HttpListener.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Net.Mail.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Net.NameResolution.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Net.NetworkInformation.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Net.Ping.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Net.Primitives.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Net.Quic.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Net.Requests.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Net.Security.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Net.ServerSentEvents.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Net.ServicePoint.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Net.Sockets.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Net.WebClient.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Net.WebHeaderCollection.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Net.WebProxy.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Net.WebSockets.Client.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Net.WebSockets.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Net.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Numerics.Vectors.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Numerics.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.ObjectModel.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Private.CoreLib.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | - | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Private.DataContractSerialization.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | 2026-10-22T08:28:19.260Z | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Private.Uri.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | 2026-10-22T08:28:19.275Z | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Private.Xml.Linq.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | 2026-10-22T08:28:19.275Z | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Private.Xml.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | 2026-10-22T08:28:19.275Z | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Reflection.DispatchProxy.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | 2026-10-22T08:28:19.275Z | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Reflection.Emit.ILGeneration.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | 2026-10-22T08:28:19.275Z | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Reflection.Emit.Lightweight.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | 2026-10-22T08:28:19.275Z | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Reflection.Emit.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | 2026-10-22T08:28:19.275Z | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Reflection.Extensions.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | 2026-10-22T08:28:19.275Z | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Reflection.Metadata.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | 2026-10-22T08:28:19.275Z | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Reflection.Primitives.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | 2026-10-22T08:28:19.275Z | - |
| C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Reflection.TypeExtensions.dll | - | - | meccha-camouflage-v1.7.2.exe pid 4176 | 2026-10-22T08:28:19.275Z | - |
Dropped payload analysis
not examinedThe capture of dropped payloads did not complete, so no payload was examined on this run. What the sample wrote is listed above by path; what those files are was not established.
File & registry ops
300 file · 58 registry · sample scope
File operation times: 63 timed237 not observed
| Operation | Target | Process | |
|---|---|---|---|
| create |
C:\Users\user\AppData\Local\Temp\.net
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\runtimes
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\runtimes\win-x64
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\runtimes\win-x64\native
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\runtimes\win-x64\native\WebView2Loader.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\meccha-camouflage.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\meccha-camouflage.runtimeconfig.json
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\Microsoft.CSharp.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\Microsoft.VisualBasic.Core.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\Microsoft.Win32.Primitives.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\Microsoft.Win32.Registry.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.AppContext.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Buffers.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Collections.Concurrent.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Collections.Immutable.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Collections.NonGeneric.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Collections.Specialized.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Collections.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.ComponentModel.Annotations.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.ComponentModel.DataAnnotations.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.ComponentModel.EventBasedAsync.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.ComponentModel.Primitives.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.ComponentModel.TypeConverter.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.ComponentModel.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Configuration.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Console.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Core.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Data.Common.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Data.DataSetExtensions.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Data.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Diagnostics.Contracts.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Diagnostics.Debug.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Diagnostics.DiagnosticSource.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Diagnostics.FileVersionInfo.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Diagnostics.Process.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Diagnostics.StackTrace.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Diagnostics.TextWriterTraceListener.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Diagnostics.Tools.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Diagnostics.TraceSource.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Diagnostics.Tracing.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Drawing.Primitives.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Dynamic.Runtime.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Formats.Asn1.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Formats.Tar.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Globalization.Calendars.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Globalization.Extensions.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Globalization.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.IO.Compression.Brotli.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.IO.Compression.FileSystem.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\MecchaCamouflage\versions\v1.7.2\runtime\package-assets\892168d50000d22d.964020e0a83b44428656e6a109841e94.staging\native\runtime-bridge.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\MecchaCamouflage\versions\v1.7.2\runtime\package-assets\892168d50000d22d.964020e0a83b44428656e6a109841e94.staging\native\runtime-bridge.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.IO.Compression.ZipFile.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\MecchaCamouflage\versions\v1.7.2\runtime\package-assets\892168d50000d22d.964020e0a83b44428656e6a109841e94.staging\web\fonts\d-din\SIL Open Font License.txt
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\MecchaCamouflage\versions\v1.7.2\runtime\package-assets\892168d50000d22d.964020e0a83b44428656e6a109841e94.staging\web\fonts\d-din\SIL Open Font License.txt
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.IO.Compression.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.IO.FileSystem.AccessControl.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\MecchaCamouflage\versions\v1.7.2\runtime\package-assets\892168d50000d22d.964020e0a83b44428656e6a109841e94.staging\web\icon.ico
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\MecchaCamouflage\versions\v1.7.2\runtime\package-assets\892168d50000d22d.964020e0a83b44428656e6a109841e94.staging\web\icon.ico
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.IO.FileSystem.DriveInfo.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\MecchaCamouflage\versions\v1.7.2\runtime\package-assets\892168d50000d22d.964020e0a83b44428656e6a109841e94.staging\web\index.html
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\MecchaCamouflage\versions\v1.7.2\runtime\package-assets\892168d50000d22d.964020e0a83b44428656e6a109841e94.staging\web\index.html
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\MecchaCamouflage\versions\v1.7.2\runtime\package-assets\892168d50000d22d.964020e0a83b44428656e6a109841e94.staging\web\mesh-profiles\paintman.image-profile-v2.json
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\MecchaCamouflage\versions\v1.7.2\runtime\package-assets\892168d50000d22d.964020e0a83b44428656e6a109841e94.staging\web\mesh-profiles\paintman.image-profile-v2.json
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.IO.FileSystem.Primitives.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\MecchaCamouflage\versions\v1.7.2\runtime\package-assets\892168d50000d22d.964020e0a83b44428656e6a109841e94.staging\web\mesh-profiles\paintman.mesh-profile-v2.json
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\MecchaCamouflage\versions\v1.7.2\runtime\package-assets\892168d50000d22d.964020e0a83b44428656e6a109841e94.staging\web\mesh-profiles\paintman.mesh-profile-v2.json
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.IO.FileSystem.Watcher.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.IO.FileSystem.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\MecchaCamouflage\versions\v1.7.2\runtime\package-assets\892168d50000d22d.964020e0a83b44428656e6a109841e94.staging\native\runtime-injector.exe
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\MecchaCamouflage\versions\v1.7.2\runtime\package-assets\892168d50000d22d.964020e0a83b44428656e6a109841e94.staging\native\runtime-injector.exe
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.IO.IsolatedStorage.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.IO.MemoryMappedFiles.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\MecchaCamouflage\versions\v1.7.2\runtime\package-assets\892168d50000d22d.964020e0a83b44428656e6a109841e94.staging\web\app.js
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\MecchaCamouflage\versions\v1.7.2\runtime\package-assets\892168d50000d22d.964020e0a83b44428656e6a109841e94.staging\web\app.js
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.IO.Pipelines.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\MecchaCamouflage\versions\v1.7.2\runtime\package-assets\892168d50000d22d.964020e0a83b44428656e6a109841e94.staging\web\mesh-profiles\paintman_cube.image-profile-v2.json
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\MecchaCamouflage\versions\v1.7.2\runtime\package-assets\892168d50000d22d.964020e0a83b44428656e6a109841e94.staging\web\mesh-profiles\paintman_cube.image-profile-v2.json
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\MecchaCamouflage\versions\v1.7.2\runtime\package-assets\892168d50000d22d.964020e0a83b44428656e6a109841e94.staging\web\fonts\d-din\D-DIN-Bold.otf
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\MecchaCamouflage\versions\v1.7.2\runtime\package-assets\892168d50000d22d.964020e0a83b44428656e6a109841e94.staging\web\fonts\d-din\D-DIN-Bold.otf
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.IO.Pipes.AccessControl.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.IO.Pipes.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\MecchaCamouflage\versions\v1.7.2\runtime\package-assets\892168d50000d22d.964020e0a83b44428656e6a109841e94.staging\web\mesh-profiles\paintman_cube.mesh-profile-v2.json
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\MecchaCamouflage\versions\v1.7.2\runtime\package-assets\892168d50000d22d.964020e0a83b44428656e6a109841e94.staging\web\mesh-profiles\paintman_cube.mesh-profile-v2.json
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.IO.UnmanagedMemoryStream.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\MecchaCamouflage\versions\v1.7.2\runtime\package-assets\892168d50000d22d.964020e0a83b44428656e6a109841e94.staging\web\fonts\d-din\D-DIN-Italic.otf
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\MecchaCamouflage\versions\v1.7.2\runtime\package-assets\892168d50000d22d.964020e0a83b44428656e6a109841e94.staging\web\fonts\d-din\D-DIN-Italic.otf
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.IO.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Linq.AsyncEnumerable.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\MecchaCamouflage\versions\v1.7.2\runtime\package-assets\892168d50000d22d.964020e0a83b44428656e6a109841e94.staging\web\mesh-profiles\paintman_hukuyoka.image-profile-v2.json
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\MecchaCamouflage\versions\v1.7.2\runtime\package-assets\892168d50000d22d.964020e0a83b44428656e6a109841e94.staging\web\mesh-profiles\paintman_hukuyoka.image-profile-v2.json
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\MecchaCamouflage\versions\v1.7.2\runtime\package-assets\892168d50000d22d.964020e0a83b44428656e6a109841e94.staging\web\fonts\d-din\D-DIN.otf
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\MecchaCamouflage\versions\v1.7.2\runtime\package-assets\892168d50000d22d.964020e0a83b44428656e6a109841e94.staging\web\fonts\d-din\D-DIN.otf
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Linq.Expressions.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\MecchaCamouflage\versions\v1.7.2\runtime\package-assets\892168d50000d22d.964020e0a83b44428656e6a109841e94.staging\web\fonts\d-din\D-DINCondensed-Bold.otf
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\MecchaCamouflage\versions\v1.7.2\runtime\package-assets\892168d50000d22d.964020e0a83b44428656e6a109841e94.staging\web\fonts\d-din\D-DINCondensed-Bold.otf
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Linq.Parallel.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Linq.Queryable.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\MecchaCamouflage\versions\v1.7.2\runtime\package-assets\892168d50000d22d.964020e0a83b44428656e6a109841e94.staging\web\fonts\d-din\D-DINCondensed.otf
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\MecchaCamouflage\versions\v1.7.2\runtime\package-assets\892168d50000d22d.964020e0a83b44428656e6a109841e94.staging\web\fonts\d-din\D-DINCondensed.otf
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Linq.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Memory.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\MecchaCamouflage\versions\v1.7.2\runtime\package-assets\892168d50000d22d.964020e0a83b44428656e6a109841e94.staging\web\fonts\d-din\D-DINExp-Bold.otf
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\MecchaCamouflage\versions\v1.7.2\runtime\package-assets\892168d50000d22d.964020e0a83b44428656e6a109841e94.staging\web\fonts\d-din\D-DINExp-Bold.otf
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\MecchaCamouflage\versions\v1.7.2\runtime\package-assets\892168d50000d22d.964020e0a83b44428656e6a109841e94.staging\web\fonts\d-din\D-DINExp-Italic.otf
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\MecchaCamouflage\versions\v1.7.2\runtime\package-assets\892168d50000d22d.964020e0a83b44428656e6a109841e94.staging\web\fonts\d-din\D-DINExp-Italic.otf
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Net.Http.Json.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\MecchaCamouflage\versions\v1.7.2\runtime\package-assets\892168d50000d22d.964020e0a83b44428656e6a109841e94.staging\web\fonts\d-din\D-DINExp.otf
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\MecchaCamouflage\versions\v1.7.2\runtime\package-assets\892168d50000d22d.964020e0a83b44428656e6a109841e94.staging\web\fonts\d-din\D-DINExp.otf
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Net.Http.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\MecchaCamouflage\versions\v1.7.2\runtime\package-assets\892168d50000d22d.964020e0a83b44428656e6a109841e94.staging\web\mesh-profiles\paintman_hukuyoka.mesh-profile-v2.json
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\MecchaCamouflage\versions\v1.7.2\runtime\package-assets\892168d50000d22d.964020e0a83b44428656e6a109841e94.staging\web\mesh-profiles\paintman_hukuyoka.mesh-profile-v2.json
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Net.HttpListener.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\MecchaCamouflage\versions\v1.7.2\runtime\package-assets\892168d50000d22d.964020e0a83b44428656e6a109841e94.staging\web\styles.css
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\MecchaCamouflage\versions\v1.7.2\runtime\package-assets\892168d50000d22d.964020e0a83b44428656e6a109841e94.staging\web\styles.css
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Net.Mail.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Net.NameResolution.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\MecchaCamouflage\versions\v1.7.2\runtime\package-assets\892168d50000d22d.964020e0a83b44428656e6a109841e94.staging\webview2-bootstrapper\MicrosoftEdgeWebview2Setup.exe
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\MecchaCamouflage\versions\v1.7.2\runtime\package-assets\892168d50000d22d.964020e0a83b44428656e6a109841e94.staging\webview2-bootstrapper\MicrosoftEdgeWebview2Setup.exe
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Net.NetworkInformation.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\MecchaCamouflage\versions\v1.7.2\runtime\package-assets\892168d50000d22d.964020e0a83b44428656e6a109841e94.staging\ready.json
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\MecchaCamouflage\versions\v1.7.2\runtime\package-assets\892168d50000d22d.964020e0a83b44428656e6a109841e94.staging\ready.json
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Net.Ping.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Net.Primitives.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Net.Quic.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Net.Requests.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Net.Security.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Net.ServerSentEvents.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Net.ServicePoint.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Net.Sockets.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Net.WebClient.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Net.WebHeaderCollection.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Net.WebProxy.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Net.WebSockets.Client.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Net.WebSockets.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Net.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Numerics.Vectors.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Numerics.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.ObjectModel.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Private.CoreLib.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Private.DataContractSerialization.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | 2026-10-22 11:28:19.260 |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Private.Uri.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | 2026-10-22 11:28:19.275 |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Private.Xml.Linq.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | 2026-10-22 11:28:19.275 |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Private.Xml.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | 2026-10-22 11:28:19.275 |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Reflection.DispatchProxy.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | 2026-10-22 11:28:19.275 |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Reflection.Emit.ILGeneration.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | 2026-10-22 11:28:19.275 |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Reflection.Emit.Lightweight.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | 2026-10-22 11:28:19.275 |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Reflection.Emit.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | 2026-10-22 11:28:19.275 |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Reflection.Extensions.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | 2026-10-22 11:28:19.275 |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Reflection.Metadata.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | 2026-10-22 11:28:19.275 |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Reflection.Primitives.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | 2026-10-22 11:28:19.275 |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Reflection.TypeExtensions.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | 2026-10-22 11:28:19.275 |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Reflection.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | 2026-10-22 11:28:19.275 |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Resources.Reader.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | 2026-10-22 11:28:19.275 |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Resources.ResourceManager.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | 2026-10-22 11:28:19.387 |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Resources.Writer.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | 2026-10-22 11:28:19.387 |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Runtime.CompilerServices.Unsafe.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | 2026-10-22 11:28:19.387 |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Runtime.CompilerServices.VisualC.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | 2026-10-22 11:28:19.387 |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Runtime.Extensions.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | 2026-10-22 11:28:19.387 |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Runtime.Handles.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | 2026-10-22 11:28:19.387 |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Runtime.InteropServices.JavaScript.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | 2026-10-22 11:28:19.387 |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Runtime.InteropServices.RuntimeInformation.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | 2026-10-22 11:28:19.387 |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Runtime.InteropServices.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | 2026-10-22 11:28:19.387 |
| create |
C:\Users\user\AppData\Local\MecchaCamouflage\webview2-user-data\EBWebView\Last Version
|
msedgewebview2.exe pid 3612 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Runtime.Intrinsics.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | 2026-10-22 11:28:19.406 |
| create |
C:\Users\user\AppData\Local\MecchaCamouflage\webview2-user-data\EBWebView\Default\README
|
msedgewebview2.exe pid 3612 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Runtime.Loader.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | 2026-10-22 11:28:19.419 |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Runtime.Numerics.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | 2026-10-22 11:28:19.419 |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Runtime.Serialization.Formatters.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | 2026-10-22 11:28:19.419 |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Runtime.Serialization.Json.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | 2026-10-22 11:28:19.419 |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Runtime.Serialization.Primitives.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | 2026-10-22 11:28:19.419 |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Runtime.Serialization.Xml.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | 2026-10-22 11:28:19.419 |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Runtime.Serialization.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | 2026-10-22 11:28:19.557 |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Runtime.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | 2026-10-22 11:28:19.557 |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Security.AccessControl.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | 2026-10-22 11:28:19.557 |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Security.Claims.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | 2026-10-22 11:28:19.557 |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Security.Cryptography.Algorithms.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | 2026-10-22 11:28:19.557 |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Security.Cryptography.Cng.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | 2026-10-22 11:28:19.557 |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Security.Cryptography.Csp.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | 2026-10-22 11:28:19.557 |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Security.Cryptography.Encoding.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | 2026-10-22 11:28:19.557 |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Security.Cryptography.OpenSsl.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | 2026-10-22 11:28:19.557 |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Security.Cryptography.Primitives.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | 2026-10-22 11:28:19.557 |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Security.Cryptography.X509Certificates.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | 2026-10-22 11:28:19.557 |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Security.Cryptography.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | 2026-10-22 11:28:19.557 |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Security.Principal.Windows.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | 2026-10-22 11:28:19.557 |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Security.Principal.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | 2026-10-22 11:28:19.557 |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Security.SecureString.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | 2026-10-22 11:28:19.557 |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Security.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | 2026-10-22 11:28:19.557 |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.ServiceModel.Web.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | 2026-10-22 11:28:19.557 |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.ServiceProcess.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | 2026-10-22 11:28:19.557 |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Text.Encoding.CodePages.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | 2026-10-22 11:28:19.557 |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Text.Encoding.Extensions.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\MecchaCamouflage\webview2-user-data\EBWebView\GPUPersistentCache\DawnGraphiteCache\MNIWWJ6LYBXKQS7RZ2KZNUZ3QHFNW4K3\cache.db
|
msedgewebview2.exe pid 3612 | not observed |
| create |
C:\Users\user\AppData\Local\MecchaCamouflage\webview2-user-data\EBWebView\GPUPersistentCache\DawnGraphiteCache\MNIWWJ6LYBXKQS7RZ2KZNUZ3QHFNW4K3\cache.db
|
msedgewebview2.exe pid 3612 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Text.Encoding.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\MecchaCamouflage\webview2-user-data\EBWebView\GPUPersistentCache\DawnGraphiteCache\MNIWWJ6LYBXKQS7RZ2KZNUZ3QHFNW4K3\cache.journal
|
msedgewebview2.exe pid 3612 | not observed |
| create |
C:\Users\user\AppData\Local\MecchaCamouflage\webview2-user-data\EBWebView\GPUPersistentCache\DawnGraphiteCache\MNIWWJ6LYBXKQS7RZ2KZNUZ3QHFNW4K3\cache.journal
|
msedgewebview2.exe pid 3612 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Text.Encodings.Web.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Text.Json.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Text.RegularExpressions.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Threading.AccessControl.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Threading.Channels.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Threading.Overlapped.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Threading.Tasks.Dataflow.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Threading.Tasks.Extensions.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Threading.Tasks.Parallel.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Threading.Tasks.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Threading.Thread.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Threading.ThreadPool.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Threading.Timer.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Threading.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Transactions.Local.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Transactions.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.ValueTuple.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Web.HttpUtility.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Web.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Windows.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Xml.Linq.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Xml.ReaderWriter.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Xml.Serialization.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
\\.\pipe\LOCAL\mojo.3612.4968.9996819310255039690
|
msedgewebview2.exe pid 3612 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Xml.XDocument.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Xml.XPath.XDocument.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Xml.XPath.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Xml.XmlDocument.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Xml.XmlSerializer.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Xml.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\WindowsBase.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\mscorlib.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\netstandard.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\Accessibility.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\Microsoft.VisualBasic.Forms.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\Microsoft.VisualBasic.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\Microsoft.Win32.Registry.AccessControl.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\Microsoft.Win32.SystemEvents.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.CodeDom.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Configuration.ConfigurationManager.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Design.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Diagnostics.EventLog.Messages.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Diagnostics.EventLog.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Diagnostics.PerformanceCounter.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.DirectoryServices.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Drawing.Common.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Drawing.Design.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Drawing.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Formats.Nrbf.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.IO.Packaging.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Private.Windows.Core.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Private.Windows.GdiPlus.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| modify |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Private.DataContractSerialization.dll
|
- | 2026-10-22 11:28:19.275 |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Resources.Extensions.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Security.Cryptography.Pkcs.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| modify |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Private.Uri.dll
|
- | 2026-10-22 11:28:19.275 |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Security.Cryptography.ProtectedData.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Security.Cryptography.Xml.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Security.Permissions.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| modify |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Private.Xml.Linq.dll
|
- | 2026-10-22 11:28:19.275 |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Windows.Extensions.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Windows.Forms.Design.Editors.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| modify |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Private.Xml.dll
|
- | 2026-10-22 11:28:19.275 |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Windows.Forms.Design.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Windows.Forms.Primitives.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| modify |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Reflection.DispatchProxy.dll
|
- | 2026-10-22 11:28:19.275 |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Windows.Forms.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\cs
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\MecchaCamouflage\versions\v1.7.2\diagnostics
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| modify |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Reflection.Emit.ILGeneration.dll
|
- | 2026-10-22 11:28:19.275 |
| create |
C:\Users\user\AppData\Local\MecchaCamouflage\bridge-state\progress
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\MecchaCamouflage\bridge-state
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| modify |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Reflection.Emit.Lightweight.dll
|
- | 2026-10-22 11:28:19.275 |
| create |
C:\Users\user\AppData\Local\MecchaCamouflage\bridge-instances
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\MecchaCamouflage\versions\v1.7.2\logs
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| modify |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Reflection.Emit.dll
|
- | 2026-10-22 11:28:19.275 |
| create |
C:\Users\user\AppData\Local\MecchaCamouflage\versions\v1.7.2\image-presets
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\MecchaCamouflage\versions\v1.7.2\config
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\MecchaCamouflage\versions\v1.7.2
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| modify |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Reflection.Extensions.dll
|
- | 2026-10-22 11:28:19.275 |
| create |
C:\Users\user\AppData\Local\MecchaCamouflage\versions
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\MecchaCamouflage
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| modify |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Reflection.Metadata.dll
|
- | 2026-10-22 11:28:19.275 |
| rename |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\-xmDIZWNCiwN
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\meccha-camouflage.deps.json
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\MecchaCamouflage\webview2-user-data\EBWebView\Default\Web Data
|
msedgewebview2.exe pid 3612 | not observed |
| create |
C:\Users\user\AppData\Local\MecchaCamouflage\webview2-user-data\EBWebView\Default\Web Data
|
msedgewebview2.exe pid 3612 | not observed |
| modify |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Reflection.Primitives.dll
|
- | 2026-10-22 11:28:19.275 |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\Microsoft.Web.WebView2.WinForms.xml
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\Microsoft.Web.WebView2.Core.xml
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| modify |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Reflection.TypeExtensions.dll
|
- | 2026-10-22 11:28:19.275 |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\Microsoft.Web.WebView2.WinForms.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\Microsoft.Web.WebView2.Core.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| modify |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Reflection.dll
|
- | 2026-10-22 11:28:19.275 |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\MecchaCamouflage.Core.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\MecchaCamouflage.Controller.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\MecchaCamouflage\webview2-user-data\EBWebView\Default\ServerCertificate
|
msedgewebview2.exe pid 3612 | not observed |
| create |
C:\Users\user\AppData\Local\MecchaCamouflage\webview2-user-data\EBWebView\Default\ServerCertificate
|
msedgewebview2.exe pid 3612 | not observed |
| modify |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Resources.Reader.dll
|
- | 2026-10-22 11:28:19.387 |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\WebView2Loader.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\zh-Hant\System.Windows.Forms.resources.dll
|
meccha-camouflage-v1.7.2.exe pid 4176 | not observed |
| create |
SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
|
msedgewebview2.exe pid 3612 | not timed |
| create |
SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
|
msedgewebview2.exe pid 3612 | not timed |
| create |
\REGISTRY\USER\S-1-5-21-3020052414-521178761-3546482252-1000
|
msedgewebview2.exe pid 3612 | not timed |
| create |
SOFTWARE
|
msedgewebview2.exe pid 3612 | not timed |
| create |
SOFTWARE\Microsoft
|
msedgewebview2.exe pid 3612 | not timed |
| create |
SOFTWARE\Microsoft\EdgeWebView
|
msedgewebview2.exe pid 3612 | not timed |
| setvalue |
SOFTWARE\Microsoft\EdgeWebView
UsageStatsInSample = 1
|
msedgewebview2.exe pid 3612 | not timed |
| create |
SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
|
msedgewebview2.exe pid 3612 | not timed |
| create |
SYSTEM\ControlSet001\Control\Class\{4d36e96e-e325-11ce-bfc1-08002be10318}
|
msedgewebview2.exe pid 3612 | not timed |
| create |
SYSTEM\ControlSet001\Control\Class\{4d36e96e-e325-11ce-bfc1-08002be10318}\0001
|
msedgewebview2.exe pid 3612 | not timed |
| create |
SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}
|
msedgewebview2.exe pid 3612 | not timed |
| setvalue |
SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}
usagestats = 0
|
msedgewebview2.exe pid 3612 | not timed |
| setvalue |
SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}
urlstats = 0
|
msedgewebview2.exe pid 3612 | not timed |
| create |
SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs
|
msedgewebview2.exe pid 3612 | not timed |
| create |
SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default
|
msedgewebview2.exe pid 3612 | not timed |
| setvalue |
SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default
search_provider_overrides = 4DBA0FFF65C6D80FA7420958E74EAAC97DB9D9C8DF92E6519670208C0BEB9EB7
|
msedgewebview2.exe pid 3612 | not timed |
| setvalue |
SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default
extensions.install.initialprovidername = E9126C04B6BB4CA1EB91C2D144895024EDB9486A2AD3A51F59FAC2423B76DE88
|
msedgewebview2.exe pid 3612 | not timed |
| setvalue |
SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default
enterprise_signin.policy_recovery_token = 2717EF4E079CBD315D33B69DF1B615A372FBCF8E2C268640AA339231E288E2F9
|
msedgewebview2.exe pid 3612 | not timed |
| setvalue |
SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default
session.restore_on_startup = CC5419551D541F870BB8CE9D642B542A82E6C0C9A326946A00574898C5CFBEF9
|
msedgewebview2.exe pid 3612 | not timed |
| setvalue |
SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default
google.services.last_signed_in_username = B15A13F7AC455714881C73CB3884C56606B741748D5FDB755F3722EB529F139C
|
msedgewebview2.exe pid 3612 | not timed |
| setvalue |
SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default
safebrowsing.incidents_sent = 56A3D52FAE006499851EE9E8B8C3889410541FF011C3C50743CD5DBAD8DCC7EE
|
msedgewebview2.exe pid 3612 | not timed |
| setvalue |
SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default
edge.services.last_username = 27AA721EA9132D48F13228C3D36ECF14DBE1564D5E394AEE5F0502A56C83105C
|
msedgewebview2.exe pid 3612 | not timed |
| setvalue |
SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default
homepage = 18A10383273D5FB5CB467CC32957B91B32E1678AB69C2EE37484DCD494CAA0B0
|
msedgewebview2.exe pid 3612 | not timed |
| setvalue |
SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default
browser.show_home_button = B254E0E18DDBE15FC86BF2088B5A8DA8AE0A6550FD5C127A624CB92F1F02B3A2
|
msedgewebview2.exe pid 3612 | not timed |
| setvalue |
SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default
homepage_is_newtabpage = 830D9587BC170D78A3A73DC220E352C34DEB6CFFCE744F2226FE3D17DC90F2D4
|
msedgewebview2.exe pid 3612 | not timed |
| setvalue |
SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default
session.startup_urls = C51BAFA29B43E0CAC8A0162EE5BC5F43A02FFA05A10546048158A14A3FA86017
|
msedgewebview2.exe pid 3612 | not timed |
| setvalue |
SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default
media.cdm.origin_data = 1E532462AA1CB37A0E91458991948EAFEBC742B67B6FB3A5D5C28F19E7EA26E6
|
msedgewebview2.exe pid 3612 | not timed |
| setvalue |
SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default
schedule_to_flush_to_disk = EB159B655C04B95EC718A55AE792DDE019D6E8B70B4CC89B1DAEB17A16D3FD28
|
msedgewebview2.exe pid 3612 | not timed |
| setvalue |
SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default
pinned_tabs = 2A0B29F76FE3459929325B49AE5CB3B1DF7108109F8075EFED4964B98CC8C535
|
msedgewebview2.exe pid 3612 | not timed |
| setvalue |
SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default
default_search_provider_data.template_url_data = 5308D9322E52610EBC403C1414995A881C75086EE13984CE5641595521ADD7E3
|
msedgewebview2.exe pid 3612 | not timed |
| setvalue |
SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default
extensions.install.initiallist = 1D101087C6AD534849102B4ECA7E5612B6A410DF1F35ADC173A8FF6379676B4A
|
msedgewebview2.exe pid 3612 | not timed |
| setvalue |
SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default
prefs.preference_reset_time = E4F6997EFE87BFDCAA8E581C7CF161955E9421804C1317284FC6CF96E0443275
|
msedgewebview2.exe pid 3612 | not timed |
| setvalue |
SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default
edge.services.account_id = 91DE212BA2C9479842C49132D48F7A142EBD9437B3D080888843785BEFEBF20B
|
msedgewebview2.exe pid 3612 | not timed |
| setvalue |
SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default
media.storage_id_salt = BF4B9CB2B49AC5BC25E1F81CCA62A4B6AA0A27C48FC554CD775C591DEFA72A0D
|
msedgewebview2.exe pid 3612 | not timed |
| setvalue |
SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default
extensions.ui.developer_mode = D72CDC424D084A6C9AA1FE8AF4701060EA433690E1A3F96E06B94DF2367D34A1
|
msedgewebview2.exe pid 3612 | not timed |
| create |
SOFTWARE\Microsoft\Edge
|
msedgewebview2.exe pid 3612 | not timed |
| create |
SOFTWARE\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}
|
msedgewebview2.exe pid 3612 | not timed |
| setvalue |
SOFTWARE\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}
lastrun = 13437131326250578
|
msedgewebview2.exe pid 3612 | not timed |
| create |
SOFTWARE\Microsoft\EdgeWebView\BLBeacon
|
msedgewebview2.exe pid 3612 | not timed |
| setvalue |
SOFTWARE\Microsoft\EdgeWebView\BLBeacon
version = 150.0.4078.65
|
msedgewebview2.exe pid 3612 | not timed |
| setvalue |
SOFTWARE\Microsoft\EdgeWebView\BLBeacon
state = 1
|
msedgewebview2.exe pid 3612 | not timed |
| setvalue |
SOFTWARE\Microsoft\EdgeWebView\BLBeacon
failed_count = 0
|
msedgewebview2.exe pid 3612 | not timed |
| create |
\REGISTRY\MACHINE
|
msedgewebview2.exe pid 3612 | not timed |
| create |
Software\Microsoft\WBEM\CIMOM
|
msedgewebview2.exe pid 3424 | not timed |
| create |
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96E-E325-11CE-BFC1-08002BE10318}
|
msedgewebview2.exe pid 3612 | not timed |
| create |
\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}
|
msedgewebview2.exe pid 3612 | not timed |
| create |
Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection
|
msedgewebview2.exe pid 3612 | not timed |
| create |
Software\Policies\Microsoft\Windows\DataCollection
|
msedgewebview2.exe pid 3612 | not timed |
| create |
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\Location Awareness
|
msedgewebview2.exe pid 1112 | not timed |
| create |
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters
|
msedgewebview2.exe pid 1112 | not timed |
| create |
Software\Microsoft\EdgeWebView\PreferenceMACs\Default\extensions.settings
|
msedgewebview2.exe pid 3612 | not timed |
| create |
S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry
|
msedgewebview2.exe pid 3612 | not timed |
| deletevalue |
SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default
extensions.settings
|
msedgewebview2.exe pid 3612 | not timed |
| deletevalue |
SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default
schedule_to_flush_to_disk
|
msedgewebview2.exe pid 3612 | not timed |
| setvalue |
SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\extensions.settings
dgiklkfkllikcanfonkcabmbdfmgleag = 25C0EADDD2B294EA5C1892CF4BF38E248A44156AB32432CD4FCABFABE9C667A0
|
msedgewebview2.exe pid 3612 | not timed |
| setvalue |
SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\extensions.settings
mhjfbmdgcfjbbpaeojofohoefgiehjai = 4349FDF63C89071F9627B7E12DC1FC10F6D40822D6156568BBD85BC5A44566C0
|
msedgewebview2.exe pid 3612 | not timed |
| setvalue |
SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default
schedule_to_flush_to_disk = C0D551C2F4D0B9C5B7FE0FE6901D619C21EB791FA9FB118434295A790FF2A9BC
|
msedgewebview2.exe pid 3612 | not timed |
| setvalue |
SOFTWARE\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}
dr = 1
|
msedgewebview2.exe pid 3612 | not timed |
| create |
Software\Microsoft\SystemCertificates\CA
|
powershell.exe pid 4968 | not timed |
| create |
Software\Policies\Microsoft\SystemCertificates\CA
|
powershell.exe pid 4968 | not timed |
| create |
Software\Microsoft\EnterpriseCertificates\CA
|
powershell.exe pid 4968 | not timed |
| create |
Software\Microsoft\SystemCertificates\Disallowed
|
powershell.exe pid 4968 | not timed |
| create |
Software\Policies\Microsoft\SystemCertificates\Disallowed
|
powershell.exe pid 4968 | not timed |
| create |
Software\Microsoft\EnterpriseCertificates\Disallowed
|
powershell.exe pid 4968 | not timed |
| create |
Software\Microsoft\SystemCertificates\Root
|
powershell.exe pid 4968 | not timed |
| create |
Software\Microsoft\SystemCertificates\AuthRoot
|
powershell.exe pid 4968 | not timed |
| create |
Software\Policies\Microsoft\SystemCertificates\Root
|
powershell.exe pid 4968 | not timed |
| create |
Software\Microsoft\EnterpriseCertificates\Root
|
powershell.exe pid 4968 | not timed |
| create |
Software\Microsoft\SystemCertificates\SmartCardRoot
|
powershell.exe pid 4968 | not timed |
| create |
Software\Microsoft\SystemCertificates\TrustedPeople
|
powershell.exe pid 4968 | not timed |
| create |
Software\Policies\Microsoft\SystemCertificates\TrustedPeople
|
powershell.exe pid 4968 | not timed |
| create |
Software\Microsoft\EnterpriseCertificates\TrustedPeople
|
powershell.exe pid 4968 | not timed |
| create |
Software\Microsoft\SystemCertificates\trust
|
powershell.exe pid 4968 | not timed |
| create |
Software\Policies\Microsoft\SystemCertificates\trust
|
powershell.exe pid 4968 | not timed |
| create |
Software\Microsoft\EnterpriseCertificates\trust
|
powershell.exe pid 4968 | not timed |
| create |
Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing
|
powershell.exe pid 4968 | not timed |
No operations match your filter.
External reputation was not produced for this scan. Threat intelligence enrichment is a paid-plan layer: every extracted indicator - hashes, addresses, hostnames - is checked against the external reputation services. Our own ingested feeds ran on this scan and every result below is theirs. Adding the paid layer adds an external reputation verdict on each indicator, so VirusTotal, MalwareBazaar and filescan.io are listed below as not checked. See plans.
2Sources with a hit
18Sources queriedof 23 available
470.3kFeed records
1Could not answer
File reputation
4 clear · 3 not checked| Source | Checks | Result | Detail | Feed |
|---|---|---|---|---|
| MalwareBazaar hash feed | File hash | clean | not in feed | 2,745 records 46ย minutes ago |
| MalwareBazaar ransomware feed | File hash | clean | not in feed | 3,348 records 4ย minutes ago |
| ThreatFox hash IOCs | File hash | clean | not in feed | 1,158 records 46ย minutes ago |
| URLhaus payload hashes | File hash | clean | not in feed | 1,642 records 46ย minutes ago |
| filescan.io | File hash | not checked | no hash lookup ran for this scan | live lookup |
| MalwareBazaar | File hash | not checked | no hash lookup ran for this scan | live lookup |
| VirusTotal | File hash | not checked | no hash lookup ran for this scan | live lookup |
Hash lookups only - the sample itself is never uploaded to any third party.
Network indicators
7 clear · 1 could not answer| Source | Checks | Result | Detail | Feed |
|---|---|---|---|---|
| URLhaus | IP / domain / URL | feed unavailable | 5 observed indicators, none listed | no records ingested |
| blocklist.de | IP / domain / URL | clean | 5 observed indicators, none listed | 27.6k records 46ย minutes ago |
| CINS Army | IP / domain / URL | clean | 5 observed indicators, none listed | 15k records 46ย minutes ago |
| Emerging Threats | IP / domain / URL | clean | 5 observed indicators, none listed | 482 records 46ย minutes ago |
| Feodo Tracker | IP / domain / URL | clean | 5 observed indicators, none listed | 5 records 46ย minutes ago |
| IPsum | IP / domain / URL | clean | 5 observed indicators, none listed | 19.7k records 46ย minutes ago |
| Phishing.Database | IP / domain / URL | clean | 5 observed indicators, none listed | 391.5k records 6ย minutes ago |
| ThreatFox | IP / domain / URL | clean | 5 observed indicators, none listed | 1,158 records 46ย minutes ago |
TLS fingerprints
nothing of this kind to check| Source | Checks | Result | Detail | Feed |
|---|---|---|---|---|
| JA3 / JA4 fingerprint blocklists | JA3 / JA4 | not checked | no TLS client fingerprint observed | 97 records 12ย hours ago |
| SSL blocklist | Server certificate | not checked | no server certificate fingerprint is extracted to check | live lookup |
Detection rules
2 of 2 listed| Source | Checks | Result | Detail | Feed |
|---|---|---|---|---|
| Sigma rules | Behavior log | 4 matches | Suspicious PowerShell Encoded Command Patterns, Suspicious Encoded Poโฆ | 2,275 records 7ย hours ago |
| Signature rules | Sample content | 4 matches | Suspicious_Anti_Debug_API, Embedded_PE_In_Overlay, COD3NYM_DOTNET_Sinโฆ | 110 records 47ย minutes ago |
Tooling catalogs
4 clear| Source | Checks | Result | Detail | Feed |
|---|---|---|---|---|
| LOLBAS | Process image paths | clean | 9 process image paths, none masqueraded | 245 records 47ย minutes ago |
| LOLBootloaders | File hash | clean | not a known vulnerable bootloader | 520 records 46ย minutes ago |
| LOLDrivers | File hash | clean | not a known vulnerable driver | 2,333 records 46ย minutes ago |
| LOLRMM | Names and domains | clean | 10 name/domain indicators checked, no remote-management tooling | 360 records 46ย minutes ago |
AI analysis
The AI layer is a paid-plan feature. It reads what the other layers produced - the behaviour summary, the call sequence, the indicator list - and writes the narrative and the kill-chain walkthrough.
Nothing is being withheld. This layer did not run for this scan, so there is no result stored behind the lock.
3 malicious
101 suspicious
0 info
File indicators
103| Severity | Type | Indicator | Description |
|---|---|---|---|
| malicious | sample_sha256 | 2e3364b4a9d3557bfe9d53cdc080ec1d29777c7414d593ed1c8cd4f0567683f6 | Submitted sample (SHA256) |
| malicious | sample_md5 | 5f87f5096af635f2b9ad45f61f74a633 | Submitted sample (MD5) |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\runtimes\win-x64\native\WebView2Loader.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\meccha-camouflage.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\Microsoft.CSharp.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\Microsoft.VisualBasic.Core.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\Microsoft.Win32.Primitives.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\Microsoft.Win32.Registry.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.AppContext.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Buffers.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Collections.Concurrent.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Collections.Immutable.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Collections.NonGeneric.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Collections.Specialized.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Collections.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.ComponentModel.Annotations.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.ComponentModel.DataAnnotations.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.ComponentModel.EventBasedAsync.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.ComponentModel.Primitives.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.ComponentModel.TypeConverter.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.ComponentModel.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Configuration.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Console.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Core.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Data.Common.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Data.DataSetExtensions.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Data.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Diagnostics.Contracts.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Diagnostics.Debug.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Diagnostics.DiagnosticSource.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Diagnostics.FileVersionInfo.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Diagnostics.Process.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Diagnostics.StackTrace.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Diagnostics.TextWriterTraceListener.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Diagnostics.Tools.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Diagnostics.TraceSource.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Diagnostics.Tracing.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Drawing.Primitives.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Dynamic.Runtime.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Formats.Asn1.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Formats.Tar.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Globalization.Calendars.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Globalization.Extensions.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Globalization.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.IO.Compression.Brotli.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.IO.Compression.FileSystem.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.IO.Compression.ZipFile.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.IO.Compression.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.IO.FileSystem.AccessControl.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.IO.FileSystem.DriveInfo.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.IO.FileSystem.Primitives.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.IO.FileSystem.Watcher.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.IO.FileSystem.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.IO.IsolatedStorage.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.IO.MemoryMappedFiles.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.IO.Pipelines.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.IO.Pipes.AccessControl.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.IO.Pipes.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.IO.UnmanagedMemoryStream.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.IO.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Linq.AsyncEnumerable.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Linq.Expressions.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Linq.Parallel.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Linq.Queryable.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Linq.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Memory.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Net.Http.Json.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Net.Http.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Net.HttpListener.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Net.Mail.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Net.NameResolution.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Net.NetworkInformation.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Net.Ping.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Net.Primitives.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Net.Quic.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Net.Requests.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Net.Security.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Net.ServerSentEvents.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Net.ServicePoint.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Net.Sockets.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Net.WebClient.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Net.WebHeaderCollection.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Net.WebProxy.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Net.WebSockets.Client.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Net.WebSockets.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Net.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Numerics.Vectors.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Numerics.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.ObjectModel.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Private.CoreLib.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Private.DataContractSerialization.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Private.Uri.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Private.Xml.Linq.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Private.Xml.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Reflection.DispatchProxy.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Reflection.Emit.ILGeneration.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Reflection.Emit.Lightweight.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Reflection.Emit.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Reflection.Extensions.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Reflection.Metadata.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Reflection.Primitives.dll | Executable written to disk during execution |
| suspicious | dropped_file | C:\Users\user\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\1050\System.Reflection.TypeExtensions.dll | Executable written to disk during execution |
| malicious | imphash | a604b4697f94922aff3add61321029b3 | Import table hash (imphash) |
Registry indicators
1| Severity | Type | Indicator | Description |
|---|---|---|---|
| suspicious | registry_key | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters | Autostart / persistence key |
MITRE ATT&CK
5 techniquesDefense Evasion
Process Injection
T1055Execution
Suspicious PowerShell Encoded Command Patterns
T1059.001Execution
Suspicious Encoded PowerShell Command Line
T1059.001Execution
Suspicious Execution of Powershell with Base64
T1059.001Execution
Change PowerShell Policies to an Insecure Level
T1059.001Sigma detections
4 matches of 2275 rules| Level | Detection | Log source | ATT&CK | Evidence |
|---|---|---|---|---|
| High | Suspicious PowerShell Encoded Command Patterns Detects PowerShell command line patterns in combincation with encoded commands that often appear in malware infection chains |
process_creation | T1059.001 | process pid=4968 |
| High | Suspicious Encoded PowerShell Command Line Detects suspicious powershell process starts with base64 encoded commands (e.g. Emotet) |
process_creation | T1059.001 | process pid=4968 |
| Medium | Suspicious Execution of Powershell with Base64 Commandline to launch powershell with a base64 payload |
process_creation | T1059.001 | process pid=4968 |
| Medium | Change PowerShell Policies to an Insecure Level Detects changing the PowerShell script execution policy to a potentially insecure level using the "-ExecutionPolicy" flag. |
process_creation | T1059.001 | process pid=4968 |
Generated rules
Sigma: auto_file_2887_sigma_reg
Auto-generatedtitle: Auto-generated registry behavior rule (sandbox scan 2887)
id: sandbox-auto-2887-reg
status: experimental
description: Auto-generated from sandbox scan 2887
logsource:
category: registry_event
product: windows
detection:
selection:
TargetObject|contains:
- 'SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings'
- 'SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings'
- '\REGISTRY\USER\S-1-5-21-3020052414-521178761-3546482252-1000'
- 'SOFTWARE\Microsoft'
- 'SOFTWARE\Microsoft\EdgeWebView'
- 'SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections'
- 'SYSTEM\ControlSet001\Control\Class\{4d36e96e-e325-11ce-bfc1-08002be10318}'
- 'SYSTEM\ControlSet001\Control\Class\{4d36e96e-e325-11ce-bfc1-08002be10318}\0001'
condition: selection
level: mediumExtracted files
What came out of the sample: unpacked payloads, carved objects and captured memory. Each one is stored by content hash, so the same object extracted twice is the same row.
Artifacts
1 file| Type | Name | Size | What it is | SHA-256 | Download | |
|---|---|---|---|---|---|---|
| Extracted file | embedded_pe_34a7555e498e | 1.3 MB | PEno detection | 34a7555e498e683691086ce7054eab294ebf17e8bcbef5a5b6698c2dc991fbd9 | ZIP |
Export & download
/s/2887Structured exports for your SIEM/TIP - ATT&CK Navigator layer, STIX 2.1 bundle, MISP event and a defanged IOC list - are free on every report. The packet capture follows this scan's plan, because a capture is the rawest network output this platform produces.
AI analysis report
An enterprise report with an AI-written executive summary, threat assessment, kill chain, and recommendations, plus the derived evidence (verdict, MITRE ATT&CK, network, file modifications, dropped files, IOCs) and screenshots. The AI narrative is built from derived analysis data only, so the raw sample never leaves the host (no-upload and AI-boundary preserved).
Generating AI report
Building your report...Compiling the AI narrative and derived evidence. This can take a moment.
Report readyYour report has been generated.
Download
Could not generate the reportPlease try again.
Not available for this scanIt was submitted under ultra privacy, so no derived data from it is sent to the model - and this document is written from that data. Every other section of this report is unaffected.
Headers
Body
Headers
Body
Download live malware sample
You are about to download the raw, live sample. It is real, potentially destructive malware and can harm your machine if opened or run. Only handle it inside an isolated analysis environment.
Delivered as a ZIP encrypted with the password infected so the bytes are never handled unprotected.
Report this analysis
Analysis reports are produced automatically from files, addresses and text submitted by visitors. If this one publishes your material, identifies you, or should not be public for any other reason, tell us why and an administrator will review it.
Public analyses of this file
1 run| Submitted | Environment | Verdict | Score |
|---|---|---|---|
| 2026-10-22 11:27 Shown below | Windows 10 22H2 | Malicious | 100/100 |