Overview

overview

7

Static

static

3

meccha-cam....2.exe

windows10-2004-x64

7

meccha-cam....2.exe

windows11-ltsc_2024-x64

7

Analysis

  • geolocation tags

    asiadelhiinindia
  • user interaction
    yes
  • max time kernel
    51s
  • max time network
    54s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    02/08/2026, 18:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    meccha-camouflage-v1.7.2.exe
  • Size 54.4MB
  • Sample260802-xg2dnsec87
  • SHA256 2e3364b4a9d3557bfe9d53cdc080ec1d29777c7414d593ed1c8cd4f0567683f6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoverytrojan

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 38 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\meccha-camouflage-v1.7.2.exe
    "C:\Users\Admin\AppData\Local\Temp\meccha-camouflage-v1.7.2.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:5028
    • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JAB0AGEAcgBnAGUAdAAgAD0AIABbAEkATwAuAFAAYQB0AGgAXQA6ADoARwBlAHQARgB1AGwAbABQAGEAdABoACgAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwATQBlAGMAYwBoAGEAQwBhAG0AbwB1AGYAbABhAGcAZQAnACkALgBUAHIAaQBtAEUAbgBkACgAJwBcACcAKQA7ACAAJABwAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgAEcAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAdABvAHAAOwAgACQAYwBvAG4AZgBpAGcAdQByAGUAZAAgAD0AIABAACgAJABwAHIAZQBmAGUAcgBlAG4AYwBlAC4ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAApADsAIABmAG8AcgBlAGEAYwBoACAAKAAkAGMAYQBuAGQAaQBkAGEAdABlACAAaQBuACAAJABjAG8AbgBmAGkAZwB1AHIAZQBkACkAIAB7ACAAaQBmACAAKABbAHMAdAByAGkAbgBnAF0AOgA6AEkAcwBOAHUAbABsAE8AcgBXAGgAaQB0AGUAUwBwAGEAYwBlACgAJABjAGEAbgBkAGkAZABhAHQAZQApACkAIAB7ACAAYwBvAG4AdABpAG4AdQBlACAAfQA7ACAAdAByAHkAIAB7ACAAJABuAG8AcgBtAGEAbABpAHoAZQBkACAAPQAgAFsASQBPAC4AUABhAHQAaABdADoAOgBHAGUAdABGAHUAbABsAFAAYQB0AGgAKABbAEUAbgB2AGkAcgBvAG4AbQBlAG4AdABdADoAOgBFAHgAcABhAG4AZABFAG4AdgBpAHIAbwBuAG0AZQBuAHQAVgBhAHIAaQBhAGIAbABlAHMAKAAkAGMAYQBuAGQAaQBkAGEAdABlACkAKQAuAFQAcgBpAG0ARQBuAGQAKAAnAFwAJwApACAAfQAgAGMAYQB0AGMAaAAgAHsAIABjAG8AbgB0AGkAbgB1AGUAIAB9ADsAIABpAGYAIAAoAFsAUwB0AHIAaQBuAGcAQwBvAG0AcABhAHIAZQByAF0AOgA6AE8AcgBkAGkAbgBhAGwASQBnAG4AbwByAGUAQwBhAHMAZQAuAEUAcQB1AGEAbABzACgAJAB0AGEAcgBnAGUAdAAsACAAJABuAG8AcgBtAGEAbABpAHoAZQBkACkAKQAgAHsAIABlAHgAaQB0ACAAMAAgAH0AIAB9ADsAIABpAGYAIAAoACQAcAByAGUAZgBlAHIAZQBuAGMAZQAuAEgAaQBkAGUARQB4AGMAbAB1AHMAaQBvAG4AcwBGAHIAbwBtAEwAbwBjAGEAbABVAHMAZQByAHMAIAAtAGUAcQAgACQAdAByAHUAZQAgAC0AbwByACAAJABwAHIAZQBmAGUAcgBlAG4AYwBlAC4ASABpAGQAZQBFAHgAYwBsAHUAcwBpAG8AbgBzAEYAcgBvAG0ATABvAGMAYQBsAEEAZABtAGkAbgBzACAALQBlAHEAIAAkAHQAcgB1AGUAKQAgAHsAIABlAHgAaQB0ACAAMwAgAH0AOwAgAGUAeABpAHQAIAAyAA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2208
    • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAE0AZQBjAGMAaABhAEMAYQBtAG8AdQBmAGwAYQBnAGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAHQAbwBwADsAIABlAHgAaQB0ACAAMAA=
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2432
    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=meccha-camouflage-v1.7.2.exe --webview-exe-version=1.0.0+87de3fdcf83e4a39d9bc0f47ed5e45987ec62636 --user-data-dir="C:\Users\Admin\AppData\Local\MecchaCamouflage\webview2-user-data\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --mojo-named-platform-channel-pipe=5028.208.18240472600089685778
      2⤵
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of WriteProcessMemory
      PID:116
      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\MecchaCamouflage\webview2-user-data\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\MecchaCamouflage\webview2-user-data\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ff862f6b078,0x7ff862f6b084,0x7ff862f6b090
        3⤵
          PID:1636
        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\MecchaCamouflage\webview2-user-data\EBWebView" --webview-exe-name=meccha-camouflage-v1.7.2.exe --webview-exe-version=1.0.0+87de3fdcf83e4a39d9bc0f47ed5e45987ec62636 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1744,i,3702927091914961279,8922110462324409523,262144 --variations-seed-version --mojo-platform-channel-handle=1732 /prefetch:2
          3⤵
            PID:4584
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\MecchaCamouflage\webview2-user-data\EBWebView" --webview-exe-name=meccha-camouflage-v1.7.2.exe --webview-exe-version=1.0.0+87de3fdcf83e4a39d9bc0f47ed5e45987ec62636 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2052,i,3702927091914961279,8922110462324409523,262144 --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:3
            3⤵
              PID:836
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\MecchaCamouflage\webview2-user-data\EBWebView" --webview-exe-name=meccha-camouflage-v1.7.2.exe --webview-exe-version=1.0.0+87de3fdcf83e4a39d9bc0f47ed5e45987ec62636 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2388,i,3702927091914961279,8922110462324409523,262144 --variations-seed-version --mojo-platform-channel-handle=2404 /prefetch:8
              3⤵
                PID:3672
              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\MecchaCamouflage\webview2-user-data\EBWebView" --webview-exe-name=meccha-camouflage-v1.7.2.exe --webview-exe-version=1.0.0+87de3fdcf83e4a39d9bc0f47ed5e45987ec62636 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3676,i,3702927091914961279,8922110462324409523,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:1
                3⤵
                  PID:4436

            Network

                  MITRE ATT&CK Enterprise v16

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  crash-20260803-002316-364-5028-b7f494ada5614a54853f912f875387d3.json
                  • Path C:\Users\Admin\AppData\Local\MecchaCamouflage\versions\v1.7.2\diagnostics\crash-20260803-002316-364-5028-b7f494ada5614a54853f912f875387d3.json
                  • Size 1KB
                  • SHA256 dbbf124aef3023c06ef4ad57e363e95f6a468a78bfc71c94af59dc4e10f07c0a
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  crash-20260803-002325-159-5028-088d19c5d2fa4c239e2a0a3473f52835.json
                  • Path C:\Users\Admin\AppData\Local\MecchaCamouflage\versions\v1.7.2\diagnostics\crash-20260803-002325-159-5028-088d19c5d2fa4c239e2a0a3473f52835.json
                  • Size 1KB
                  • SHA256 6968b3f40bbee15b7d6c7987ff06876fc1c9eca02ee4959f815ccf953c8029f8
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  crash-20260803-002330-906-5028-00a7b612c2e243bd9447977fe398a16a.json
                  • Path C:\Users\Admin\AppData\Local\MecchaCamouflage\versions\v1.7.2\diagnostics\crash-20260803-002330-906-5028-00a7b612c2e243bd9447977fe398a16a.json
                  • Size 1KB
                  • SHA256 4f3714f8e0d06bc239829111d09cdd1a6ac2c6c9ade4f4237991998614841474
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  crash-20260803-002332-469-5028-c6b8c5290af7455f88c8028a87d88dd6.json
                  • Path C:\Users\Admin\AppData\Local\MecchaCamouflage\versions\v1.7.2\diagnostics\crash-20260803-002332-469-5028-c6b8c5290af7455f88c8028a87d88dd6.json
                  • Size 1KB
                  • SHA256 b7739ad4a85ba05a7c9de13e02e49d503b91978e231a754459f8f544b11cf17c
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  startup-20260803-002305-5028.log
                  • Path C:\Users\Admin\AppData\Local\MecchaCamouflage\versions\v1.7.2\diagnostics\startup-20260803-002305-5028.log
                  • Size 1KB
                  • SHA256 f0b39404a6784e764d8b6dfd77fe43082c9d6541e7128dc261b98ca87260facd
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  startup-20260803-002305-5028.log
                  • Path C:\Users\Admin\AppData\Local\MecchaCamouflage\versions\v1.7.2\diagnostics\startup-20260803-002305-5028.log
                  • Size 3KB
                  • SHA256 265fff1d33182af28020873f77344163c0bc0022ae1937408599906f758269e4
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  startup-20260803-002305-5028.log
                  • Path C:\Users\Admin\AppData\Local\MecchaCamouflage\versions\v1.7.2\diagnostics\startup-20260803-002305-5028.log
                  • Size 6KB
                  • SHA256 99979bb2fad0b1da44347536d2d71c6211fc295f1bb33b4731bd943193355b84
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  app.js
                  • Path C:\Users\Admin\AppData\Local\MecchaCamouflage\versions\v1.7.2\runtime\package-assets\892168d50000d22d\web\app.js
                  • Size 103KB
                  • SHA256 62ee49d7dc9e5c1b91f05c1c49e5a34f8008caee89ed80dbf2ab503095542168
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  D-DIN-Bold.otf
                  • Path C:\Users\Admin\AppData\Local\MecchaCamouflage\versions\v1.7.2\runtime\package-assets\892168d50000d22d\web\fonts\d-din\D-DIN-Bold.otf
                  • Size 58KB
                  • SHA256 b0f96a3730041605b139ca2d15e29a36c55e49058ba2b72ee4d09b5e4ca210c1
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  icon.ico
                  • Path C:\Users\Admin\AppData\Local\MecchaCamouflage\versions\v1.7.2\runtime\package-assets\892168d50000d22d\web\icon.ico
                  • Size 229KB
                  • SHA256 9b63a917b64449e1780b0271e8d2c54f56c5db9b853f14cb599cf23f978f3b1e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  index.html
                  • Path C:\Users\Admin\AppData\Local\MecchaCamouflage\versions\v1.7.2\runtime\package-assets\892168d50000d22d\web\index.html
                  • Size 28KB
                  • SHA256 fccf908e32f694133b9a0e1787aa1c5c079df5c9a7801f4883afbd8262121c15
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  paintman.image-profile-v2.json
                  • Path C:\Users\Admin\AppData\Local\MecchaCamouflage\versions\v1.7.2\runtime\package-assets\892168d50000d22d\web\mesh-profiles\paintman.image-profile-v2.json
                  • Size 5.4MB
                  • SHA256 2eb876f3df1f93ca373168a6df162d509d1808278a38249c1912eafee5c8d32b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  styles.css
                  • Path C:\Users\Admin\AppData\Local\MecchaCamouflage\versions\v1.7.2\runtime\package-assets\892168d50000d22d\web\styles.css
                  • Size 20KB
                  • SHA256 c4c5940f4a82fb75536172bd3a73208cba1b914eaa7719b1f5711b4b1e25ca45
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  settings.dat
                  • Path C:\Users\Admin\AppData\Local\MecchaCamouflage\webview2-user-data\EBWebView\Crashpad\settings.dat
                  • Size 280B
                  • SHA256 a2dc49f51d1403b0f06009423e58ee7884e7ad88ca2bffc60bd748e36f236cd0
                  • MD5 SHA1 SHA512
                  Submit Download

                  settings.dat
                  • Path C:\Users\Admin\AppData\Local\MecchaCamouflage\webview2-user-data\EBWebView\Crashpad\settings.dat
                  • Size 280B
                  • SHA256 7703608bac6b6163ff12a2e389e4ff2dd9f85801fc5880bfbec4b4c2fa3d5625
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  throttle_store.dat
                  • Path C:\Users\Admin\AppData\Local\MecchaCamouflage\webview2-user-data\EBWebView\Crashpad\throttle_store.dat
                  • Size 20B
                  • SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
                  • MD5 SHA1 SHA512
                  Submit Download

                  8ba632e1-f704-4103-af6a-7f91f00ae038.tmp
                  • Path C:\Users\Admin\AppData\Local\MecchaCamouflage\webview2-user-data\EBWebView\Default\8ba632e1-f704-4103-af6a-7f91f00ae038.tmp
                  • Size 6KB
                  • SHA256 9555ff299ca8958cbe92aad217a13596f4ea5108dc9e5e04580e0aeec26f7448
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  the-real-index
                  • Path C:\Users\Admin\AppData\Local\MecchaCamouflage\webview2-user-data\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                  • Size 72B
                  • SHA256 aee5e8e60bb523863b417267effe6108f00225a5605d3cc4ac0c2319fca2a80c
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  the-real-index~RFe58e5c7.TMP
                  • Path C:\Users\Admin\AppData\Local\MecchaCamouflage\webview2-user-data\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe58e5c7.TMP
                  • Size 48B
                  • SHA256 78452dd8d53c4824a8a1e4556193c9a296b999b33f4b41268bfc00d334c0859b
                  • MD5 SHA1 SHA512
                  Submit Download

                  data_0
                  • Path C:\Users\Admin\AppData\Local\MecchaCamouflage\webview2-user-data\EBWebView\Default\DawnWebGPUCache\data_0
                  • Size 8KB
                  • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  data_1
                  • Path C:\Users\Admin\AppData\Local\MecchaCamouflage\webview2-user-data\EBWebView\Default\DawnWebGPUCache\data_1
                  • Size 264KB
                  • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  data_2
                  • Path C:\Users\Admin\AppData\Local\MecchaCamouflage\webview2-user-data\EBWebView\Default\DawnWebGPUCache\data_2
                  • Size 8KB
                  • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  data_3
                  • Path C:\Users\Admin\AppData\Local\MecchaCamouflage\webview2-user-data\EBWebView\Default\DawnWebGPUCache\data_3
                  • Size 8KB
                  • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  MANIFEST-000001
                  • Path C:\Users\Admin\AppData\Local\MecchaCamouflage\webview2-user-data\EBWebView\Default\Extension Rules\MANIFEST-000001
                  • Size 41B
                  • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                  • MD5 SHA1 SHA512
                  Submit Download

                  SCT Auditing Pending Reports
                  • Path C:\Users\Admin\AppData\Local\MecchaCamouflage\webview2-user-data\EBWebView\Default\Network\SCT Auditing Pending Reports
                  • Size 2B
                  • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                  • MD5 SHA1 SHA512
                  Submit Download

                  Preferences
                  • Path C:\Users\Admin\AppData\Local\MecchaCamouflage\webview2-user-data\EBWebView\Default\Preferences
                  • Size 6KB
                  • SHA256 f52972c189e95d1d08797c38983507d4c324b7beb857c96ed24c79f8e8f6246c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  CURRENT
                  • Path C:\Users\Admin\AppData\Local\MecchaCamouflage\webview2-user-data\EBWebView\Default\Site Characteristics Database\CURRENT
                  • Size 16B
                  • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                  • MD5 SHA1 SHA512
                  Submit Download

                  Local State
                  • Path C:\Users\Admin\AppData\Local\MecchaCamouflage\webview2-user-data\EBWebView\Local State
                  • Size 1KB
                  • SHA256 f8c91ea859608e0a41ca2e62e05aa4409b31f8eae230f673d7d688d181e70e06
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  Local State
                  • Path C:\Users\Admin\AppData\Local\MecchaCamouflage\webview2-user-data\EBWebView\Local State
                  • Size 2KB
                  • SHA256 0aa90bf25ab43c3d578322e3ad3ef59af1846f034c1924fcca97c4ce1c49105a
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  Local State
                  • Path C:\Users\Admin\AppData\Local\MecchaCamouflage\webview2-user-data\EBWebView\Local State
                  • Size 3KB
                  • SHA256 21553a98ef26388029d9314f705b1b33a1fe424862069804432dd0cdecea10d0
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  Local State
                  • Path C:\Users\Admin\AppData\Local\MecchaCamouflage\webview2-user-data\EBWebView\Local State
                  • Size 16KB
                  • SHA256 92a8aa94ac2581b62d0f4941ab3e526005cbdf15ea4a72db5372a808e23a1741
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  Local State~RFe588c1e.TMP
                  • Path C:\Users\Admin\AppData\Local\MecchaCamouflage\webview2-user-data\EBWebView\Local State~RFe588c1e.TMP
                  • Size 1KB
                  • SHA256 db9d128ff38d7c88fbaafa0c1c6c7418d18acd000cde350a44d61496d486adbb
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  powershell.exe.log
                  • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                  • Size 4KB
                  • SHA256 e3274ce8296f2cd20e3189576fbadbfa0f1817cdf313487945c80e968589a495
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  StartupProfileData-NonInteractive
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  • Size 1KB
                  • SHA256 012f98b9e23d2729c6017b342732c20806d317817e02764573e348df1d1b9157
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  MecchaCamouflage.Controller.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\-xmDIZWNCiwN\MecchaCamouflage.Controller.dll
                  • Size 361KB
                  • SHA256 c69a6f35fa4a02281408b368c1d0b0c28ad0c86c4563b8a20b43f67c2472b6d8
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  MecchaCamouflage.Core.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\-xmDIZWNCiwN\MecchaCamouflage.Core.dll
                  • Size 239KB
                  • SHA256 e032290aaa733799e2c089a32ae0d3985467cafe520ac7da5ff07bdb26e930e3
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  Microsoft.Win32.SystemEvents.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\-xmDIZWNCiwN\Microsoft.Win32.SystemEvents.dll
                  • Size 113KB
                  • SHA256 e47266840881921f19fd26df39d23cfbc247f7c4f7f8799a91c96e68f6a08513
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  System.Collections.Concurrent.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\-xmDIZWNCiwN\System.Collections.Concurrent.dll
                  • Size 225KB
                  • SHA256 5a4b728246443eb3b4c0a16d9b3d04bc0bce60b7a1998fa4a75716358cc572ff
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  System.Collections.Immutable.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\-xmDIZWNCiwN\System.Collections.Immutable.dll
                  • Size 953KB
                  • SHA256 c1537a4f73a7d9fa028b127a5dd7d4f0e839c75c22c8e895722283a8aadf6028
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  System.Collections.NonGeneric.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\-xmDIZWNCiwN\System.Collections.NonGeneric.dll
                  • Size 101KB
                  • SHA256 b64b8f2acaf773bc08e20e3a43d562a15a98d9a8c19f3e5db292dfe4fe21cf38
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  System.Collections.Specialized.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\-xmDIZWNCiwN\System.Collections.Specialized.dll
                  • Size 101KB
                  • SHA256 8a1cf61a6cd079444ae790123ffc90bcd8d369ec5aed0f2f95d159a6479690b3
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  System.Collections.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\-xmDIZWNCiwN\System.Collections.dll
                  • Size 289KB
                  • SHA256 fc52be0abceac360478ffffce876c99997b4af56fc36fbf07cfc38ac5b7fdd7f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  System.ComponentModel.EventBasedAsync.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\-xmDIZWNCiwN\System.ComponentModel.EventBasedAsync.dll
                  • Size 45KB
                  • SHA256 d0e3554dc311c75014a9c7e9cf8137d5881d6f7a8c3b739fd9e85fec2be13164
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  System.ComponentModel.Primitives.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\-xmDIZWNCiwN\System.ComponentModel.Primitives.dll
                  • Size 77KB
                  • SHA256 52e0988e01955d09170339429cede1d578690418b8851e19ddbba7d22a6490f7
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  System.ComponentModel.TypeConverter.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\-xmDIZWNCiwN\System.ComponentModel.TypeConverter.dll
                  • Size 749KB
                  • SHA256 f41fb0c7373b94e082d41a49a02f95ac6da92114aa712dcd8eddcfd27fbfd592
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  System.ComponentModel.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\-xmDIZWNCiwN\System.ComponentModel.dll
                  • Size 29KB
                  • SHA256 23c6a24f67244c647a614af3249181dc68ad02acc3ebd3cdedf62b2df8da503a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  System.Diagnostics.Process.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\-xmDIZWNCiwN\System.Diagnostics.Process.dll
                  • Size 321KB
                  • SHA256 f2ad68f64541926edb0ea5f040775a49991ac0f24baf98b2de62ab038b69c895
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  System.Diagnostics.StackTrace.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\-xmDIZWNCiwN\System.Diagnostics.StackTrace.dll
                  • Size 45KB
                  • SHA256 2436e12f3c710100f38b9404fb3893c3da3ee295641f5b4be442a4aa0deea8fa
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  System.Drawing.Common.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\-xmDIZWNCiwN\System.Drawing.Common.dll
                  • Size 901KB
                  • SHA256 50efa359aab4998e57dd91575829d4f473abc99c3eec1b432ad751a6d780969c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  System.Drawing.Primitives.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\-xmDIZWNCiwN\System.Drawing.Primitives.dll
                  • Size 129KB
                  • SHA256 d55e07078df7e78a52992e8123f27ad01e632d6ed0ae12c08f099af33b36dbdb
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  System.IO.Pipelines.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\-xmDIZWNCiwN\System.IO.Pipelines.dll
                  • Size 185KB
                  • SHA256 427b8641bbcce1e355c8b72415bd8ef10c91eb4171c77fae001674df495cb5f8
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  System.Linq.Parallel.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\-xmDIZWNCiwN\System.Linq.Parallel.dll
                  • Size 757KB
                  • SHA256 ce2d359ab186c59558967d3442e705558e0d13f814ec39f40c16b9076385652f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  System.Linq.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\-xmDIZWNCiwN\System.Linq.dll
                  • Size 681KB
                  • SHA256 4a5d41332ed37f7e195503ebd3f478da2ad0008cb8a9f85739b53d2df7d33d46
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  System.Memory.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\-xmDIZWNCiwN\System.Memory.dll
                  • Size 157KB
                  • SHA256 03c2fe17dbd4e1cd709f6da1ff221eafaf3f076d23f8fc62ddff5302c152e97d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  System.Private.CoreLib.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\-xmDIZWNCiwN\System.Private.CoreLib.dll
                  • Size 15.3MB
                  • SHA256 76a49f17e83f613bc8a5b55fc98830b764e7838265aacbdbcc8f46707f80a3c9
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  System.Private.Uri.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\-xmDIZWNCiwN\System.Private.Uri.dll
                  • Size 249KB
                  • SHA256 27b93d6e754d7d2e538333e3c1d520c64d7eb012dde1705e776177b273662b7d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  System.Private.Windows.Core.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\-xmDIZWNCiwN\System.Private.Windows.Core.dll
                  • Size 1.8MB
                  • SHA256 2f715608f2a3d8cf7ed8e65cae1bbebd7a038fe3701d6e017af5e06a8be6c811
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  System.Private.Windows.GdiPlus.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\-xmDIZWNCiwN\System.Private.Windows.GdiPlus.dll
                  • Size 417KB
                  • SHA256 c4d00284a5c9bc4f3dffdc94873fe2ba538a264fac96229dec4fadf490ee1b87
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  System.Reflection.Metadata.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\-xmDIZWNCiwN\System.Reflection.Metadata.dll
                  • Size 1.1MB
                  • SHA256 5e745d60bc682671b9a0813f515eca84b61710e1f84136b69fc09ec8821f92b2
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  System.Runtime.InteropServices.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\-xmDIZWNCiwN\System.Runtime.InteropServices.dll
                  • Size 109KB
                  • SHA256 627a86a918f6669f94cf8db6ce064a4b2207b852ba6a4fecaccad7bb07859b4f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  System.Security.Cryptography.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\-xmDIZWNCiwN\System.Security.Cryptography.dll
                  • Size 2.4MB
                  • SHA256 637104ff4a89fa341aad178fa4c6c85f247889d8d544f62411cc3febed9679b0
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  System.Text.Encodings.Web.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\-xmDIZWNCiwN\System.Text.Encodings.Web.dll
                  • Size 121KB
                  • SHA256 775eab42196bf9466a69e9fc86e47b8da620b7652aa4b8a62245449131ce885d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  System.Text.Json.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\-xmDIZWNCiwN\System.Text.Json.dll
                  • Size 1.8MB
                  • SHA256 6945c5fc52f811e32b13597b0d2a14d365227245e21bf7daebc6986f729b25fa
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  System.Threading.Tasks.Parallel.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\-xmDIZWNCiwN\System.Threading.Tasks.Parallel.dll
                  • Size 129KB
                  • SHA256 ec95052ee31ac8bc4a08241939c3d3177ac671470caf898b8218245523ce4b21
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  System.Threading.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\-xmDIZWNCiwN\System.Threading.dll
                  • Size 81KB
                  • SHA256 96ef32e315217f24b6b701fc182cac464966cad1da94dd25a3609fe2d9f5a6ca
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  System.Windows.Forms.Primitives.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\-xmDIZWNCiwN\System.Windows.Forms.Primitives.dll
                  • Size 3.5MB
                  • SHA256 370e416f04f342c04a989878f530820f6f6664eef153dbd02aa58c274339081a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  System.Windows.Forms.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\-xmDIZWNCiwN\System.Windows.Forms.dll
                  • Size 13.1MB
                  • SHA256 3161c84f8d0d255e3adff0687fd8eb6055eee41ca9d2ed69b5ccadc128474fcb
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  WebView2Loader.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\-xmDIZWNCiwN\WebView2Loader.dll
                  • Size 159KB
                  • SHA256 12f7708910e1aac5cc9ac43603d122f1d2e770ae2651830a07ef8b3117f28c55
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  meccha-camouflage.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\.net\meccha-camouflage-v1.7.2\-xmDIZWNCiwN\meccha-camouflage.dll
                  • Size 21.8MB
                  • SHA256 7e7ff1461e5db79997b8f01fd93abf064277c7b6defd5c9a5bcab32939cc1eb5
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  __PSScriptPolicyTest_ep23mjj4.n5l.ps1
                  • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ep23mjj4.n5l.ps1
                  • Size 60B
                  • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  memory/2208-351-0x000001FE7D260000-0x000001FE7D315000-memory.dmp
                  Download

                  memory/2208-332-0x000001FE641C0000-0x000001FE641D0000-memory.dmp
                  Download

                  memory/2208-350-0x000001FE641C0000-0x000001FE641D0000-memory.dmp
                  Download

                  memory/2208-349-0x00007FF492D00000-0x00007FF492D10000-memory.dmp
                  Download

                  memory/2208-331-0x000001FE641C0000-0x000001FE641D0000-memory.dmp
                  Download

                  memory/2208-352-0x000001FE641B0000-0x000001FE641BA000-memory.dmp
                  Download

                  memory/2208-340-0x000001FE640E0000-0x000001FE64102000-memory.dmp
                  Download

                  memory/2208-357-0x000001FE7D4A0000-0x000001FE7D4A6000-memory.dmp
                  Download

                  memory/2208-348-0x000001FE64190000-0x000001FE641AC000-memory.dmp
                  Download

                  memory/2208-356-0x000001FE7D470000-0x000001FE7D478000-memory.dmp
                  Download

                  memory/2208-359-0x000001FE641C0000-0x000001FE641D0000-memory.dmp
                  Download

                  memory/2208-353-0x000001FE7D480000-0x000001FE7D49C000-memory.dmp
                  Download

                  memory/2208-354-0x000001FE7D460000-0x000001FE7D46A000-memory.dmp
                  Download

                  memory/2208-358-0x000001FE7D4B0000-0x000001FE7D4BA000-memory.dmp
                  Download

                  memory/2208-355-0x000001FE7D4C0000-0x000001FE7D4DA000-memory.dmp
                  Download

                  memory/2432-378-0x00000272F2180000-0x00000272F2235000-memory.dmp
                  Download

                  memory/3672-593-0x00007FF880320000-0x00007FF880321000-memory.dmp
                  Download

                  memory/3672-594-0x00007FF8817F0000-0x00007FF8817F1000-memory.dmp
                  Download

                  memory/4436-630-0x00007FF87FD80000-0x00007FF87FD81000-memory.dmp
                  Download

                  memory/4584-522-0x00007FF87FD80000-0x00007FF87FD81000-memory.dmp
                  Download