Analysis
- user interaction
yes - max time kernel
150s - max time network
152s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows - submitted
02/08/2026, 01:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
WebView2Loader.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
WebView2Loader.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
hzrecoil.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
13 signatures
150 seconds
Behavioral task
behavioral4
Sample
hzrecoil.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target hzrecoil.exe
- Size 15.6MB
- Sample260802-cdtt7sbf56
- SHA256 bf5e429194f5e9007bbc3cbfd8fd8293b9cd5364b7887de779871dce7839985d
- MD5 80649c4b77b7efc3db2e2fcf58d804c6
- SHA1 e782f4835c7b2ca369aeafffe56bfb81d6cfc617
- SHA512 953d0f7a1dab422fefd05e7b9decec18c247f3520888361e8287af598a120ff045ea092aa30b40589d0fcb895e8ddeab9b029d22987f791648f197abac5fe9d5
- SSDEEP 98304:FX8T8QUCm5nH+/sO6YwQAx6nilIg2+COtaFsk+Ar0j8Q0oY5ZFFXIINoNyoHtE9U:QhUCsxIsTiWEZH2yoNuAu9/X09B0p3Gr
- TLSH T132F69F02F55259E8D5A6C137811F3232FF787C1D4525A7E32BA48B312EAFBE4AE09744
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA hzrecoil.exe - Drops file in Windows directory 16 IoCs
description ioc Process File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4728_1502464109\manifest.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4728_1305245392\test.txt msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4728_1502464109\keys.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4728_1502464109\manifest.fingerprint msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4728_1305245392\model.markov msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4728_1305245392\manifest.fingerprint msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4728_1305245392\english_wikipedia.txt msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4728_1305245392\female_names.txt msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4728_1305245392\male_names.txt msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4728_1305245392\ranked_dicts msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4728_1305245392\surnames.txt msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4728_1305245392\us_tv_and_film.txt msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4728_1305245392\manifest.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4728_1305245392\passwords.txt msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4728_1502464109\_metadata\verified_contents.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4728_1502464109\LICENSE msedgewebview2.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedgewebview2.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedgewebview2.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301095459457390" msedgewebview2.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 6132 msedgewebview2.exe 6132 msedgewebview2.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
pid Process 4728 msedgewebview2.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4284 taskmgr.exe Token: SeSystemProfilePrivilege 4284 taskmgr.exe Token: SeCreateGlobalPrivilege 4284 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 5344 hzrecoil.exe 5344 hzrecoil.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 5344 hzrecoil.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe - Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 5344 wrote to memory of 4728 5344 hzrecoil.exe 83 PID 4728 wrote to memory of 3216 4728 msedgewebview2.exe 84 PID 4728 wrote to memory of 3708 4728 msedgewebview2.exe 85 PID 4728 wrote to memory of 3708 4728 msedgewebview2.exe 85 PID 4728 wrote to memory of 3708 4728 msedgewebview2.exe 85 PID 4728 wrote to memory of 5376 4728 msedgewebview2.exe 86 PID 4728 wrote to memory of 4104 4728 msedgewebview2.exe 87 PID 4728 wrote to memory of 4104 4728 msedgewebview2.exe 87 PID 4728 wrote to memory of 2184 4728 msedgewebview2.exe 88 PID 4728 wrote to memory of 2184 4728 msedgewebview2.exe 88 PID 4728 wrote to memory of 2184 4728 msedgewebview2.exe 88 PID 4728 wrote to memory of 396 4728 msedgewebview2.exe 100 PID 4728 wrote to memory of 396 4728 msedgewebview2.exe 100 PID 4728 wrote to memory of 1292 4728 msedgewebview2.exe 103 PID 4728 wrote to memory of 1292 4728 msedgewebview2.exe 103 PID 4728 wrote to memory of 6132 4728 msedgewebview2.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\hzrecoil.exe"C:\Users\Admin\AppData\Local\Temp\hzrecoil.exe"1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5344 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=hzrecoil.exe --webview-exe-version=1.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.hzrecoil.app\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=5344.4176.44216001666279049012⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.hzrecoil.app\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.hzrecoil.app\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x184,0x188,0x18c,0x164,0x198,0x7ffbd92ab078,0x7ffbd92ab084,0x7ffbd92ab0903⤵PID:3216
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.hzrecoil.app\EBWebView" --webview-exe-name=hzrecoil.exe --webview-exe-version=1.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1788,i,8920239913716768397,40469130460038251,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1784 /prefetch:23⤵PID:3708
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.hzrecoil.app\EBWebView" --webview-exe-name=hzrecoil.exe --webview-exe-version=1.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1904,i,8920239913716768397,40469130460038251,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:33⤵PID:5376
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.hzrecoil.app\EBWebView" --webview-exe-name=hzrecoil.exe --webview-exe-version=1.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2376,i,8920239913716768397,40469130460038251,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:83⤵PID:4104
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.hzrecoil.app\EBWebView" --webview-exe-name=hzrecoil.exe --webview-exe-version=1.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3520,i,8920239913716768397,40469130460038251,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:13⤵PID:2184
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.hzrecoil.app\EBWebView" --webview-exe-name=hzrecoil.exe --webview-exe-version=1.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2084,i,8920239913716768397,40469130460038251,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:83⤵PID:396
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.hzrecoil.app\EBWebView" --webview-exe-name=hzrecoil.exe --webview-exe-version=1.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=3720,i,8920239913716768397,40469130460038251,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:83⤵PID:1292
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.hzrecoil.app\EBWebView" --webview-exe-name=hzrecoil.exe --webview-exe-version=1.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4616,i,8920239913716768397,40469130460038251,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4588 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:6132
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4284
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\com.hzrecoil.app\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 7ef213c5993dbe81e1fce1778696ddf83081abbf7f36dfb9d18ae89a722c6ec9
- MD5 3e0decb6486a4b9eb9f9fddc95bdced1
- SHA1 0c30bc8592d9b8a172f499df0df2ed1260560dc5
- SHA512 6e23a9ae5bd880f84d104e3d9bd7dcd31828fa74f070e1638f4192bee7a9ce8788ce0c81f0ebe672a11e8fc5c4a02a59ac16577f851114213ab20d280ad595d1
- TLSH T1D5D0121236225574C11075731102E1081C41C61FC1154040743CC61D6A449501D12491
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.hzrecoil.app\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 33407dc290fa41a5208239352617947f921b2f7cb04aabb866c040f7c5d71cba
- MD5 10407dd24040f6dd578bf546ae6fa879
- SHA1 818014e55e68ec9de4b69bb85a9f6b87b9fc50f6
- SHA512 d0d7a6e2467ffd32a5d0f498f550616bedd3f54b6e4f60b84cd3ef28ed490bfde43b91d5886933b5bdd381ba19014a5604f4ae2a0736fa890917fe3249606baa
- TLSH T139D0041075357450C300F5751114C1001D45CD1CC53101403034410C54C0F011411154
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.hzrecoil.app\EBWebView\Crashpad\throttle_store.dat
- Size 20B
- SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
- MD5 9e4e94633b73f4a7680240a0ffd6cd2c
- SHA1 e68e02453ce22736169a56fdb59043d33668368f
- SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\com.hzrecoil.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index
- Size 48B
- SHA256 8d1ce62df959530ab98c405fde11df21fe8e87ad5b74e7e9a5d8adc947edcb44
- MD5 0b68f2bffad97114b28e0740b8a49cdf
- SHA1 1498e352b39c8a6d17ae5ad750e3d96b3a94a7d5
- SHA512 3e5adcbf4be4b72923f0e9701a3c2c086f6659c9540e57044713786b20d0375e9e29d73d7147c9e7d4a6921e34587b79fb31e08f6776b76a808b01578766037a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\com.hzrecoil.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index
- Size 72B
- SHA256 10e0b00ccbb9ec8a9de8e7a68219e0601c488d214ebd7a1859041e0415e76e4c
- MD5 071c1eaca48ddc9a5a98fc5863792615
- SHA1 b30be3efcf8f752072893d97b7a872d9ec629c64
- SHA512 b5849695164c2bbbdc45fde01c6e81d9daa4f8df50cc8e4fd1913c725f80464d088e16c1c952da92db732a1a1fff76205e0d4a02435b370b92f656bee4e98c58
- TLSH T18FA0026421402A06C674637411D681E076309D290297565340DD226C8C50BC89541450
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.hzrecoil.app\EBWebView\Default\Network\Network Persistent State
- Size 821B
- SHA256 49f6caa333404a0a165e8c6dbd24b21449210ca9bf1fe51e5b2a9ad0af72c1ad
- MD5 b471239ce822982f904d906f48c2fa0c
- SHA1 4b671390ec505aad880ebe91150f561362c84d0a
- SHA512 35d88b418af2d32f3eaa4ea80073fee05131add5f10325358e2ef254847047ce3f49f89c23a13bd0d52227001062d2cac78dc6259965ffd2b63dff9c7924ba63
- TLSH T117018EA2C3D4C67E8A5117E076347813CD2E081A92683D27CDE9EBEA97E2471D21064F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.hzrecoil.app\EBWebView\Default\Network\Network Persistent State~RFe591bcb.TMP
- Size 59B
- SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
- MD5 2800881c775077e1c4b6e06bf4676de4
- SHA1 2873631068c8b3b9495638c865915be822442c8b
- SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
- TLSH T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.hzrecoil.app\EBWebView\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\com.hzrecoil.app\EBWebView\Default\Preferences
- Size 6KB
- SHA256 23ef58901e2b67e26f18d05e7e8cd20fc61e84ad0562602d2b7262f80d9932be
- MD5 146a4e8091eac11f60fa4f93d900ac07
- SHA1 bd32f96d2dc54801d74b31ac6e2a0de3e481b69a
- SHA512 cfe090ade43a3e6f4aec2b56fe820648cc776aaba07989aec8a8f707319d2ac59f1d9d3b183a977b4f88d67b12ef4cab057b5dc012a465c827f8f95618fcb6e0
- SSDEEP 192:stM0JSf8Z8paQo/S+WiTZOwYTTAjRX+MC:stNJS7Q/VAwEktvC
- TLSH T19DE1A8126E287D778CC7E619BE35BB12E2F6206265D50E54EBFC861C04EA6DC630790B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\com.hzrecoil.app\EBWebView\Default\Preferences~RFe58a1aa.TMP
- Size 6KB
- SHA256 9a7ffaa013a9f96e1f8668e936ed0a96769e4bb5952d4d7041a35d79b961a2bb
- MD5 30a6ef77e0de0cc5801bc05a4f3fc9a6
- SHA1 d795dd6628ff73c0a8e77199cbedf775bf2e4650
- SHA512 0e5aec305e66c831a2afcc7c05179f9d5fdeddb1a0cb8201e6869b4d6f4b134d70bedc7e028f59efd6e371759a468e8b7b5a41cdd89c9e81ae98a283d67bf3e7
- SSDEEP 192:stM0JQf8Z8paQo/S+WiTZOwYTTAjuX+M8:stNJQ7Q/VAwEkIv8
- TLSH T18FD1CA126E2879778CC7E619BE35FB02D2F6206265D54D58FBFC851C08DA6DC630790B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\com.hzrecoil.app\EBWebView\Default\Sync Data\LevelDB\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\com.hzrecoil.app\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
- Size 41B
- SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
- MD5 5af87dfd673ba2115e2fcf5cfdb727ab
- SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
- SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\com.hzrecoil.app\EBWebView\GrShaderCache\data_0
- Size 8KB
- SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
- MD5 cf89d16bb9107c631daabf0c0ee58efb
- SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
- SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
- SSDEEP 3:MsFl:/F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\com.hzrecoil.app\EBWebView\GrShaderCache\data_1
- Size 264KB
- SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
- MD5 d0d388f3865d0523e451d6ba0be34cc4
- SHA1 8571c6a52aacc2747c048e3419e5657b74612995
- SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
- SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\com.hzrecoil.app\EBWebView\GrShaderCache\data_2
- Size 8KB
- SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
- MD5 0962291d6d367570bee5454721c17e11
- SHA1 59d10a893ef321a706a9255176761366115bedcb
- SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
- SSDEEP 3:MsHlDll:/H
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\com.hzrecoil.app\EBWebView\GrShaderCache\data_3
- Size 8KB
- SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
- MD5 41876349cb12d6db992f1309f22df3f0
- SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
- SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
- SSDEEP 3:MsGl3ll:/y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\com.hzrecoil.app\EBWebView\Local State
- Size 17KB
- SHA256 e599b5a7d39e7596daccf9d0149a5cbcb65c958fc11011c8a53cee3becaeccf3
- MD5 4e3d4e7df66080b51ef5fab114592180
- SHA1 d7ff7c09812a189d97c60523cd0b985529b8cd6e
- SHA512 6be3bdfa70a51c9467ea7e0f32812b2a1a314c3cf010a7c473a852553b2f6d9bcd348743cd5746d07da6a4210b4cbb0139f251ea05e44d3aeabba8958c122a08
- SSDEEP 384:z9X+aQikB+z/xvxjg/qhEBNgruo9BUcUmo9zN:o/UxvxjgC+s91UmoFN
- TLSH T108829E36A469BE2798F3E6417A192B8BDBF4557285C56EE88DED1F0D06CB2DC0307C12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\com.hzrecoil.app\EBWebView\Local State
- Size 17KB
- SHA256 31d6adc7125bca37f84506ba4d2c79a1246e35be6fbf5e1f543efc3e0f79c958
- MD5 2ce332e2b37ad70cb1995d586139228a
- SHA1 effa92d5ab2fe253d2695d85ee73b14b2558ee5e
- SHA512 72828e74e1ec4cd0b816833f9f15bedcf2a1ab5066ad5baced30db0dbf4f2c421ad09e1486f8916fa1a3012f186bd69eefae4dfcacf94a5794cb931b33b5ea09
- SSDEEP 384:z9j+aQikB+z/xvxjg/qhEBNgrro9BUgaUmo9zN:A/UxvxjgC+995aUmoFN
- TLSH T1BD829E36A465BE2398F3E6417A1D2BCBDAF4516285C56EE88DED1F0D06CB2DC0307C12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\com.hzrecoil.app\EBWebView\Local State
- Size 1KB
- SHA256 15814576a78b12428fd066de11355769507668dcc6cee7a6fd9c386c3b09d173
- MD5 689eaaf7ce28098ac077af97c4a31b1d
- SHA1 307e2f6d805d9b472e107ef6db5994e76c9413ce
- SHA512 06adb591fa8bc351ba7ec4ea8e5c6a98040bc3b813ba184ef302a0369c03114cea7141545f2bbed9a6fac894fa507917728ebe32141a9ec75f08d119ae2c4188
- TLSH T16C316072B0803B369DE2B996732A6E97AD61103686624E48B4ED570C02DA09C622AD33
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.hzrecoil.app\EBWebView\Local State
- Size 2KB
- SHA256 103fae8a49dde982d688c19781d0df40c40a2e13866de16b3591019d980fc978
- MD5 f8f341210395e0353aa75a94fa1aaefa
- SHA1 c568e57ba694a762ecd88f249c42c5af71b88a79
- SHA512 00bcccf62cff96e9cdc7151378470606e7779891dd2d1e67ed9149d116470285264c9ae2954596c680051bd8ebfa13d197e3d79836ea551a8d9dc47006eb1b9a
- TLSH T1B85197337440BA368AF369957E1A3F53ED7551628A632F50A9ED1B0C01DE55C2306C33
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.hzrecoil.app\EBWebView\Local State
- Size 3KB
- SHA256 11b75d21e8cc99b708d79dae59c392f6bbb0d605ed9215a32026d1182ec0ccb2
- MD5 1cd424fd5f6691c7ced29d5e1b7fdec7
- SHA1 33f5dc0a730c133cf263cdc911a580799c06af1e
- SHA512 189ba1111cb5a5cb781d37c461af8c248799c6894749b2f54672698992b1a9e59883e5691ea443784310f3865787c898feb8591f909cfe315ec5d6f2f5c3b32c
- TLSH T1FB71A83274A4B5374EF3A945BD992F12BAA55133D9D63FA4E9ED1F0C01DB2981302C13
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.hzrecoil.app\EBWebView\Local State
- Size 16KB
- SHA256 73b8278ea73a065f9d793ee18b22f3b87a120c9ec1a479302e7cce1712419151
- MD5 c2c656930c7a784489c56c4f73eea388
- SHA1 319602faf860d36c318d0fa7c3eae9e7c9eaf666
- SHA512 db58f6b5b4badbe0affc5d037f31d5eaa4e7fb743449c7d10634b036269177f85a874953703d81bcadf23876e44cbac568143f13b2744108391f61770f941b92
- SSDEEP 384:z9u+aQikB+z/xvxjg/qhEwNbouo9Bmmo9zN://UxvxjgC+h9smoFN
- TLSH T13A729F3761687E2799F3F5057A5C0B8BDBB494B284C16EB85DEE5F0D02DB2980307D12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\com.hzrecoil.app\EBWebView\Local State~RFe58048f.TMP
- Size 1KB
- SHA256 69e9dd9f5820fa75f1be01566b5015a3edd981633b230e67f79a9be8de2df8e1
- MD5 61f3ed44fbed4536b3b823cd5b432eef
- SHA1 6fd411b1bf845be7d1e3156a619c180d887b9825
- SHA512 787d670a3cd973c1b888bcbc4845e04bf0f6c8d23bb33b2564ba439d54fe26a3fd49068932ef511f7fbedaf9549f20c78c7039efaaa63f1a9d0513bdada252bc
- TLSH T113214033E0807A369AE26896B226BF877D90503686665E08F4DD530D02DF49C522BC33
- MD5 SHA1 SHA512 TLSH