58df5162c3dbd843b1d85e1289682d4b29a53566277343547b5d042e2c64230f

Analysis

max time kernel
150s
max time network
147s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/05/2026, 16:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Tomato-UI - Copy/Tomato UI.exe
Size 445KB
Sample260503-trbdfsds7x
SHA256 58df5162c3dbd843b1d85e1289682d4b29a53566277343547b5d042e2c64230f
MD5 f316a339f166ac7ad69824d896d8923e
SHA1 1a771a5673b60409871c335f5b766f06a694c029
SHA512 80d4e23b1b4e382d553e7d7136f8012e96aede19ab5b05ec921a43ff4c3bf4b5dda4b113cf1db46aeb99a17c1c9e6c63d51ea9a77d552e126cebda4b69bac71d
SSDEEP 6144:CXGje6hiPMiOlwX4J8pngzEg76u1Zbywk/IAAo1p4iAtdTcEwPG4rwGAw6j:qWBW4OxgzEE6u1Zfk/IG4jtxr4rHc
TLSH
T1B9A45A2961945E00D26C2E74C7A2D53007766EB93633DB092FEDFEBF3C722925961287
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Tomato UI.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 62 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1520_1610720881\hyph-lt.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1520_1610720881\hyph-mn-cyrl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1520_1610720881\hyph-nb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1520_1610720881\hyph-sk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1520_154847231\protocols.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1520_1610720881\hyph-pa.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1520_1610720881\hyph-el.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1520_1610720881\hyph-eu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1520_1610720881\hyph-fr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1520_1610720881\hyph-lv.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1520_1610720881\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1520_1610720881\hyph-cy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1520_1610720881\hyph-et.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1520_1610720881\hyph-ml.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1520_1610720881\hyph-nn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1520_1610720881\hyph-hu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1520_1610720881\hyph-kn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1520_1610720881\hyph-as.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1520_1610720881\hyph-hr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1520_1610720881\hyph-mul-ethi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1520_1610720881\hyph-sq.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1520_1610720881\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1520_1610720881\hyph-en-us.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1520_1610720881\hyph-da.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1520_1610720881\hyph-es.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1520_1610720881\hyph-sl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1520_1610720881\hyph-ta.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1520_87960676\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1520_1610720881\hyph-hi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1520_154847231\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1520_1610720881\hyph-de-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1520_1610720881\hyph-gl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1520_1610720881\hyph-it.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1520_1610720881\hyph-nl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1520_1610720881\hyph-pt.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1520_1610720881\hyph-te.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1520_154847231\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1520_1610720881\hyph-af.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1520_1610720881\hyph-cu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1520_1610720881\hyph-ka.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1520_1610720881\hyph-tk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1520_1610720881\hyph-und-ethi.hyb	msedgewebview2.exe
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1520_1610720881\hyph-be.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1520_1610720881\hyph-bg.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1520_1610720881\hyph-en-gb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1520_1610720881\hyph-hy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1520_1610720881\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1520_87960676\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1520_1610720881\hyph-bn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1520_1610720881\hyph-de-1996.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1520_1610720881\hyph-de-ch-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1520_1610720881\hyph-gu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1520_1610720881\hyph-la.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1520_1610720881\hyph-mr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1520_1610720881\hyph-uk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1520_87960676\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1520_1610720881\hyph-or.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1520_1610720881\hyph-ru.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1520_1610720881\hyph-sv.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1520_1610720881\hyph-cs.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1520_1610720881\hyph-ga.hyb	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134222986614895833"	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4808	Tomato UI.exe
4808	Tomato UI.exe
4808	Tomato UI.exe
4808	Tomato UI.exe
4808	Tomato UI.exe
4808	Tomato UI.exe
4808	Tomato UI.exe
4808	Tomato UI.exe
4808	Tomato UI.exe
4808	Tomato UI.exe
4808	Tomato UI.exe
4808	Tomato UI.exe
4808	Tomato UI.exe
4808	Tomato UI.exe
4808	Tomato UI.exe
4808	Tomato UI.exe
4808	Tomato UI.exe
4808	Tomato UI.exe
4808	Tomato UI.exe
4808	Tomato UI.exe
4808	Tomato UI.exe
4808	Tomato UI.exe
4808	Tomato UI.exe
4808	Tomato UI.exe
4808	Tomato UI.exe
4808	Tomato UI.exe
4808	Tomato UI.exe
4808	Tomato UI.exe
4808	Tomato UI.exe
4808	Tomato UI.exe
4808	Tomato UI.exe
4808	Tomato UI.exe
4808	Tomato UI.exe
4808	Tomato UI.exe
4808	Tomato UI.exe
4808	Tomato UI.exe
4808	Tomato UI.exe
4808	Tomato UI.exe
4808	Tomato UI.exe
4808	Tomato UI.exe
4808	Tomato UI.exe
4808	Tomato UI.exe
4808	Tomato UI.exe
4808	Tomato UI.exe
4808	Tomato UI.exe
4808	Tomato UI.exe
4808	Tomato UI.exe
4808	Tomato UI.exe
4808	Tomato UI.exe
4808	Tomato UI.exe
4808	Tomato UI.exe
4808	Tomato UI.exe
4808	Tomato UI.exe
4808	Tomato UI.exe
4808	Tomato UI.exe
4808	Tomato UI.exe
4808	Tomato UI.exe
4808	Tomato UI.exe
4808	Tomato UI.exe
4808	Tomato UI.exe
4808	Tomato UI.exe
4808	Tomato UI.exe
4808	Tomato UI.exe
4808	Tomato UI.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1520	msedgewebview2.exe
1520	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4808	Tomato UI.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4808 wrote to memory of 1520	4808	Tomato UI.exe	79
PID 1520 wrote to memory of 3664	1520	msedgewebview2.exe	80
PID 1520 wrote to memory of 1524	1520	msedgewebview2.exe	81
PID 1520 wrote to memory of 1524	1520	msedgewebview2.exe	81
PID 1520 wrote to memory of 1524	1520	msedgewebview2.exe	81
PID 1520 wrote to memory of 1188	1520	msedgewebview2.exe	82
PID 1520 wrote to memory of 1300	1520	msedgewebview2.exe	83
PID 1520 wrote to memory of 1300	1520	msedgewebview2.exe	83
PID 1520 wrote to memory of 1204	1520	msedgewebview2.exe	84
PID 1520 wrote to memory of 1204	1520	msedgewebview2.exe	84
PID 1520 wrote to memory of 1204	1520	msedgewebview2.exe	84
PID 1520 wrote to memory of 4572	1520	msedgewebview2.exe	85
PID 1520 wrote to memory of 4572	1520	msedgewebview2.exe	85
PID 1520 wrote to memory of 4572	1520	msedgewebview2.exe	85
PID 1520 wrote to memory of 3844	1520	msedgewebview2.exe	88
PID 1520 wrote to memory of 3844	1520	msedgewebview2.exe	88
PID 1520 wrote to memory of 2888	1520	msedgewebview2.exe	89
PID 1520 wrote to memory of 2888	1520	msedgewebview2.exe	89
PID 1520 wrote to memory of 2012	1520	msedgewebview2.exe	90
PID 1520 wrote to memory of 3244	1520	msedgewebview2.exe	91
PID 1520 wrote to memory of 3244	1520	msedgewebview2.exe	91

C:\Users\Admin\AppData\Local\Temp\Tomato-UI - Copy\Tomato UI.exe
"C:\Users\Admin\AppData\Local\Temp\Tomato-UI - Copy\Tomato UI.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4808
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name="Tomato UI.exe" --webview-exe-version=1.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Tomato-UI - Copy\Tomato UI.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=4808.2064.13433392400403051711
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:1520
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Temp\Tomato-UI - Copy\Tomato UI.exe.WebView2\EBWebView" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Temp\Tomato-UI - Copy\Tomato UI.exe.WebView2\EBWebView\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x164,0x168,0x16c,0x140,0x11c,0x7ff9e1b8b078,0x7ff9e1b8b084,0x7ff9e1b8b090
    3⤵
    PID:3664
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Tomato-UI - Copy\Tomato UI.exe.WebView2\EBWebView" --webview-exe-name="Tomato UI.exe" --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1696,i,5981490801954055933,10209941075333941419,262144 --variations-seed-version --mojo-platform-channel-handle=1676 /prefetch:2
    3⤵
    PID:1524
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Tomato-UI - Copy\Tomato UI.exe.WebView2\EBWebView" --webview-exe-name="Tomato UI.exe" --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2012,i,5981490801954055933,10209941075333941419,262144 --variations-seed-version --mojo-platform-channel-handle=1892 /prefetch:11
    3⤵
    PID:1188
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Tomato-UI - Copy\Tomato UI.exe.WebView2\EBWebView" --webview-exe-name="Tomato UI.exe" --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2284,i,5981490801954055933,10209941075333941419,262144 --variations-seed-version --mojo-platform-channel-handle=1684 /prefetch:13
    3⤵
    PID:1300
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Tomato-UI - Copy\Tomato UI.exe.WebView2\EBWebView" --webview-exe-name="Tomato UI.exe" --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3500,i,5981490801954055933,10209941075333941419,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
    3⤵
    PID:1204
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Tomato-UI - Copy\Tomato UI.exe.WebView2\EBWebView" --webview-exe-name="Tomato UI.exe" --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3880,i,5981490801954055933,10209941075333941419,262144 --variations-seed-version --mojo-platform-channel-handle=3840 /prefetch:1
    3⤵
    PID:4572
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Tomato-UI - Copy\Tomato UI.exe.WebView2\EBWebView" --webview-exe-name="Tomato UI.exe" --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1036,i,5981490801954055933,10209941075333941419,262144 --variations-seed-version --mojo-platform-channel-handle=4708 /prefetch:14
    3⤵
    PID:3844
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Tomato-UI - Copy\Tomato UI.exe.WebView2\EBWebView" --webview-exe-name="Tomato UI.exe" --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4708,i,5981490801954055933,10209941075333941419,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:14
    3⤵
    PID:2888
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Tomato-UI - Copy\Tomato UI.exe.WebView2\EBWebView" --webview-exe-name="Tomato UI.exe" --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=756,i,5981490801954055933,10209941075333941419,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:10
    3⤵
    PID:2012
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Tomato-UI - Copy\Tomato UI.exe.WebView2\EBWebView" --webview-exe-name="Tomato UI.exe" --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4400,i,5981490801954055933,10209941075333941419,262144 --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:14
    3⤵
    PID:3244

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

protocols.json

Path C:\Users\Admin\AppData\Local\Temp\Tomato-UI - Copy\Tomato UI.exe.WebView2\EBWebView\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\Tomato-UI - Copy\Tomato UI.exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 0e432d5a03f87799e2d2451a8fff64951f28886a9493027c7032fd066b3d0ea9
MD5 d07d28da21c066953e77ba83998c7f84
SHA1 97c5e759ba2241ff795ee2be05c1f592166e3dc9
SHA512 b81f8716d074186117f4d154e489d16de8080775b7dfa3f7ab70cd8907a4fd3cba14ac828bf4362b8b54f1f7b58c59c966cd278fcc23a8a09ff51b062e495915
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\Tomato-UI - Copy\Tomato UI.exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 b1cb9484486ac17d6d941574f02f7cf822d6a8c36138b1d1247893472ea15f9f
MD5 ab9ffb5549c3cc14a906493eebf023fb
SHA1 5cb21a480167e0dac48da2667a4eb9c8d6adc3fb
SHA512 7fa18ee0b510940d50bd883d74699014bd8c4dfcd9a7f91a406b4cdd50954e3f696b524a4fab7061602998472d8946429e83b348554cbea2dc8005d3e2adcc91
TLSH
T15ED0122336621539C5142433450375480400C50B820AC0016528C51E1E540500903452
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\Tomato-UI - Copy\Tomato UI.exe.WebView2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\Tomato-UI - Copy\Tomato UI.exe.WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 2148ab74ec563533246f82ee2fb2d610816bc5a23f622c79eb1446595464b566
MD5 3e8cd5997a1df1409fcf350efd0932b1
SHA1 2a64c36759e8e9ef590b45693aee568e055c8da7
SHA512 42c91466a22b0b088148835cac3363b4d16935778c1136145ca49e69e7a186b9f29dd536ed495798541bb7cfda1b16c0f532b366425eaa4247a504eed5518b89
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\Tomato-UI - Copy\Tomato UI.exe.WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 696B
SHA256 d152e4ef5e8c9102b5dcf96f3997bca23e282d40cb0da33166452544e643ff9e
MD5 140444f6d0442d7e2075f3ebf712f15b
SHA1 36aff20bf94d0fb9afdcaf08534696c069aaeba8
SHA512 d5c976936bd7e9c6507c4f6d19cc779164edaa537d71afa83db33e9ace5ad0ff1173269f3e2d41021edb840047cc801301471ece0f5a63db0346cb1ad0d29962
TLSH
T195015500E9E51621CF46BFBC00020EC52E5E0824D2D283CB8B9FC08DD9C37E987169D1
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\Tomato-UI - Copy\Tomato UI.exe.WebView2\EBWebView\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\Tomato-UI - Copy\Tomato UI.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\Tomato-UI - Copy\Tomato UI.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\Tomato-UI - Copy\Tomato UI.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\Tomato-UI - Copy\Tomato UI.exe.WebView2\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\Tomato-UI - Copy\Tomato UI.exe.WebView2\EBWebView\Default\Network\Network Persistent State
Size 998B
SHA256 4cd123adf2a566fd32d2f98d8167ffd88998248d488e97e97c3ea961dec8f612
MD5 96f6db6bf7e01a6c3d52f883edba110f
SHA1 61188ebe03ab25a16f232c015658a7b2131871f3
SHA512 75c6b6425199cc582769d21dc48db47155606e38b0e5362b1d21d14adb1005775e8644b9c1b1c46772fc4ad54c860b379f2574efb647480666d3c81fb19b12d9
TLSH
T18B1178B7DBE4952DCA6209F42779B823CE6D0920065C6D9DCAD4BB4B8BD54B4D23021B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5925fd.TMP

Path C:\Users\Admin\AppData\Local\Temp\Tomato-UI - Copy\Tomato UI.exe.WebView2\EBWebView\Default\Network\Network Persistent State~RFe5925fd.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\Tomato-UI - Copy\Tomato UI.exe.WebView2\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\Tomato-UI - Copy\Tomato UI.exe.WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 0c99d4c263d18c254308f41e1da352003005e3430ab46c6639e47219fb0bb23a
MD5 37b7f6896713f4d4056f6a08cf8d0060
SHA1 8764009becb44dc6be4d62feb650c67f670ea830
SHA512 1897796e2f735d113b43c308cad1becaf615b81593db9fc9aa216d4e3ce3f3fe98bbfd8b7381e03e11d5d6c76452d8b21261e6a7af028347c0dfcf1b58a8057e
SSDEEP 96:st705je5/b9gOff5Z8i0vhE+kFlm/7qx+WVHMSm+uecIt6Mk8xgTQjh+grio+MOB:st70BAfBZ8paNI/S+WiCt6QxgTcAo+MC
TLSH
T1A9E1B9039E386D7B4CC7F219BA35BB12E6F5106266C54E94ABFC874C05E66DC220790F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe58ad81.TMP

Path C:\Users\Admin\AppData\Local\Temp\Tomato-UI - Copy\Tomato UI.exe.WebView2\EBWebView\Default\Preferences~RFe58ad81.TMP
Size 6KB
SHA256 9a2bea6b51856699ae04c01f3accac25750ca1948efa38aee5ca5942874641e8
MD5 9d65ca58f5e4c3ceee5f7a4db370a020
SHA1 43978a96a0d0aa9945aa15210f1c8be6ab45c2df
SHA512 4c0d727872eb1ca6a1762742379e5c1647f54cf863c1af9eabc47c5e9f06ed86a71414274f40c039a1194495a4492d628384386eb13bd2d145764dae569af46c
SSDEEP 96:st705je5/b98Off5Z8i0vhE+kFlm/7qx+WVHMSm+uecIt6Mk8xgTQjh+g6o+MEB:st70BAfBZ8paNI/S+WiCt6QxgTcgo+M8
TLSH
T143D1B9035E386D7B4CC7E219BA35BB16E5F6102166D54E98EBFC865C08E66DC230B90F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\Tomato-UI - Copy\Tomato UI.exe.WebView2\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\Tomato-UI - Copy\Tomato UI.exe.WebView2\EBWebView\Local State
Size 1KB
SHA256 8a68ab9e6602138cc679c2a54fc555ef2b412156fd60d0a1f9a5fd7246fa35f9
MD5 0126d213d908f57750569ef7d2243eef
SHA1 529370d1d4ed51713a0f256d9b6f6843e397c5e0
SHA512 581c4038d9e6066051c6010890c9ce7629870ed879c7c2a04f007fced44e4b413b84623a13b73913baf97a784f66d48242e62b29393cd74141c7349d67877d9d
TLSH
T127316773D5E46B7299D2558270556A972D20211BC2928E48F1EE871C02D7BDC6236C36
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\Tomato-UI - Copy\Tomato UI.exe.WebView2\EBWebView\Local State
Size 2KB
SHA256 1b3b1207c815c293bf01d45f2ee2e25a4651e87e9273598f77fdaf9da3d90758
MD5 5949a23abd123e0cfd91d4112bf5be84
SHA1 f4f7568640461ac4831ff6f9a600a7282f412aec
SHA512 e4b46fa6932cedb5d312489c4faee9d9e83cc4177dbb82f2d35086a1a0e02a2c258dce8f1b968cf48cd96e99094f038924b051ef702809e4dd7b58e20eb09866
TLSH
T1F251A733A854AB7785F38A4578492F23AD35616692936F54E6FD0B1C01DBBAC3312C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\Tomato-UI - Copy\Tomato UI.exe.WebView2\EBWebView\Local State
Size 3KB
SHA256 91af77079672b5725827c85b347c5ce4be25f9edbce5fea455f9b5c7bccd0052
MD5 69bc785e7327f94694a1db16fd8950ac
SHA1 2a09b977bdb64f8931f19f1ee84d4e25cd9e4e49
SHA512 e9ed63fba3eb0c907bdd93a07f5a6188f9a8a2599c1c74bd26a311c39df5d6856b77c501c803f29915b47c4e6a6166dccd7c41318ac35789e77b0629f4c00996
TLSH
T11371D633A9A4AA274DF39A41B8852B167A651127D1C67FA8D6FD0F0C01DB7D82352C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\Tomato-UI - Copy\Tomato UI.exe.WebView2\EBWebView\Local State
Size 16KB
SHA256 36f47a2ed77db2525651e351df874feee565d7d30548817f8ab60dc8b5cef84a
MD5 b77e80c3b8873231b0bdb9bfe71a4752
SHA1 0f62e768f5483a5e12b47aad26b710bc2050acf2
SHA512 59bccdc7f4b22bd423df6cbc136ed7d5fa49cb5b84321d23be40a05f23779d9cff42fa2f739b102d3311ff06475daaca4df21cef36035d9642d589cce08c3bba
SSDEEP 384:zifTPLdSWCUkEaV8DNYi0qnSXaqZvjNbwT3O0XrOuO:GTRMUVai1SKqvM7G
TLSH
T12672BF72AC74EA5B08BA9959F517364A58B8D055C1D62F4DEDFE5F0D06C27D80312C23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\Tomato-UI - Copy\Tomato UI.exe.WebView2\EBWebView\Local State
Size 17KB
SHA256 6b7c7a2c14f36b6bbabe98fc092e3f5aeea55e953d7391bfd05788a95c6468c6
MD5 ff817706e24ea292ec584bac8cde6dd4
SHA1 601611ebb1fae023746dcc94c51470fff6e34ab6
SHA512 13553ba9eee7389963c9c187b8edc4abed51ec6eb2c7e062e4950f91485488c616bac0c0d4cba4d65abaf0ac0f2c4735a78d0598229a5d24397e8a0c7325a83e
SSDEEP 384:zFfTPLdSWCUkEaV8DNYi0qnSXaqZvgNbPp3O0XIuElOuO:FTRMUVai1SKqvapElG
TLSH
T1C7829E72EC75EB1718BA8685F617368AA9B49141C2CA1F8CDCED5F0D06C27DC0716C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\Tomato-UI - Copy\Tomato UI.exe.WebView2\EBWebView\Local State
Size 16KB
SHA256 d45adbb2d72cd88b1f8f9592f11997ce78b836f0267547df6b45d9cb39b9a0c6
MD5 13700bc010ade1f55f13ca7318ce5dea
SHA1 f3007c5612402db9b92da81931634f60271472af
SHA512 a39c4652b25b3444a07d75cc106b798959bbb47717acb46150241a2e6d8cb34b285b159b13546375bbc0f318dba3fd7da27b2fae52129204ff6c70adde92210a
SSDEEP 384:zSfTPLdSWCUkEaV8DNYi0qnSXaqZvfNbw73O0XrOuO:WTRMUVai1SKqvs7G
TLSH
T1D772BF73AC78EA5B08BA9919F517364A98B8D045C2D62F4DEDFE5F0D06D67D80312C23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\Tomato-UI - Copy\Tomato UI.exe.WebView2\EBWebView\Local State
Size 16KB
SHA256 7ee9223fa9ba3754638e5c5339a2f5c76f6ef3125eeb1a06aab2f99a5e474560
MD5 174aa6a3c953dbc5e9295267513f0bbd
SHA1 ba6faf99ffbfa6d9d26dfc1e7689bcaf6eff4a14
SHA512 4ac708a131266a42630b425b1134c1d4bb7292e3133b6c7b9929d249b5b661b663aff51b6e461b7ec82ecb243e1f33e5752ba0cd21578b2a7cb17ae048ad70fa
SSDEEP 384:zpfTPLdSWCUkEaV8DNYi0qnSXaqZvfNbPf3O0XrOuO:pTRMUVai1SKqvF7G
TLSH
T1C572BE62AC79EA5B08BA9959F517364AA8B8D045C1DA2F4DEDFE5F0D06C279C0312C23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\Tomato-UI - Copy\Tomato UI.exe.WebView2\EBWebView\Local State
Size 17KB
SHA256 713bfcfa9eb9f7f746f00b144a8a84cbfad2c8b8b6a58308d1946e8cc7cae421
MD5 d4c5f0c97f86a7c9a945fdf4907f2fa3
SHA1 ce15e2a7aaea919ff68a0c14322c94cd9e29ddbc
SHA512 af1df0f78292f231ea05b17b7c5f322c7b56747bf627ab3d96f1dd14ed57234c8360da013e671dd375f9b3b74ef38703e48f9f9bd51a95c282b5e88ab90199c2
SSDEEP 384:zXfTPLdSWCUkEaV8DNYi0qnSXaqZvfNbPP3O0XIgElOuO:7TRMUVai1SKqvlJElG
TLSH
T130829E72EC75EA1718BA8A86F617368AA9B49141C2CA1F8CDCED5F0D06C37DC0716C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\Tomato-UI - Copy\Tomato UI.exe.WebView2\EBWebView\Local State
Size 17KB
SHA256 5bf73db0e6d2a4a02cbb8ebfc2ddfc84f2240839fe58e315a8c3457811131a53
MD5 d75b7ac82f603de7e62449d691bf86f3
SHA1 c7f3655d45ec4a3359414b1922b8b67e595b78a7
SHA512 8344a261bbb0b961cefe2e5a94d9e335261b9c407835cf81a7ffae5937bc1be737e1d165b039815ea92b4a8435f9ab2c85a4ab81ab71279e390ecdec5d8b3f86
SSDEEP 384:z5fTPLdSWCUkEaV8DNYi0qnSXaqZvzNgP33O0XIgDlOuO:5TRMUVai1SKqvUJDlG
TLSH
T19C829E72EC75EA1718BA8A86F617368AA9F49141C2CA1F8CDCED1F0D06C77DC1716C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe581102.TMP

Path C:\Users\Admin\AppData\Local\Temp\Tomato-UI - Copy\Tomato UI.exe.WebView2\EBWebView\Local State~RFe581102.TMP
Size 1KB
SHA256 3745e6e2b88f152f8bcf58b32fcd4c3d7a85586540f512d03f6048cee7a1a9f8
MD5 581cfb7021c1c45b72ce23aabed89c41
SHA1 81806494671350d1d024b0cb9f4eb88bf4b6222a
SHA512 b2f1c411adcb53e583d892c07b6432af015de9a502f39c96ac03ab0425aad821c36a5619ff50a63b7cc8201f424288104be1c633b044b7044829536d18cbe15d
TLSH
T1EA213533D4E4AA7295955982B055AA8A2D20616B82559F0CF1EE832C03DBEDCA277C32
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.fingerprint

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1520_154847231\manifest.fingerprint
Size 66B
SHA256 c236a2ac7741d48e1c56980652331cb3f1f12baf937baf0b280600fbafb143e3
MD5 c28ffa45708f10e3a35143ed2708782f
SHA1 84a03f2615333c9311dbf79d6f58f56b5c009163
SHA512 beac0eacff45a152eb2a50f4d72db2933b8f8ba97e6f0a9f6811abe866fef5c7c83068151915dbdffaccaee5d0cd335d182671f44dbab6da2222266ff8a28ff0
TLSH
T169A022F3F000F02030022F8A80203C00C8A23BA80C8020808000BEE0200322A3A0C820
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1520_154847231\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-as.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1520_1610720881\hyph-as.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-hi.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1520_1610720881\hyph-hi.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nb.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1520_1610720881\hyph-nb.hyb
Size 141KB
SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
MD5 677edd1a17d50f0bd11783f58725d0e7
SHA1 98fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA512 c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgk:p73HEUP8dsiinTThjy90VKk
TLSH
T1CCE319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1520_1610720881\manifest.json
Size 82B
SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
MD5 2617c38bed67a4190fc499142b6f2867
SHA1 a37f0251cd6be0a6983d9a04193b773f86d31da1
SHA512 b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0
TLSH
T137A022A0BC0880333E8803A8023E83E3C3BE3E0A20003C0002A33C8022EC33B3038E2C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1520_87960676\manifest.json
Size 76B
SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
MD5 ba25fcf816a017558d3434583e9746b8
SHA1 be05c87f7adf6b21273a4e94b3592618b6a4a624
SHA512 3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f
TLSH
T170A022833A0EC03B008283B0202383C08BBCAA28380E080E082338C0CAC2BB80000B28
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1204-150-0x00007FFA05A30000-0x00007FFA05A31000-memory.dmp

Download

memory/1524-36-0x00007FFA05A30000-0x00007FFA05A31000-memory.dmp

Download

memory/2012-639-0x000001D8A05D0000-0x000001D8A05D1000-memory.dmp

Download

memory/2012-647-0x000001D8A05D0000-0x000001D8A05D1000-memory.dmp

Download

memory/2012-644-0x000001D8A05D0000-0x000001D8A05D1000-memory.dmp

Download

memory/2012-645-0x000001D8A05D0000-0x000001D8A05D1000-memory.dmp

Download

memory/2012-646-0x000001D8A05D0000-0x000001D8A05D1000-memory.dmp

Download

memory/2012-650-0x000001D8A05D0000-0x000001D8A05D1000-memory.dmp

Download

memory/2012-648-0x000001D8A05D0000-0x000001D8A05D1000-memory.dmp

Download

memory/2012-649-0x000001D8A05D0000-0x000001D8A05D1000-memory.dmp

Download

memory/2012-640-0x000001D8A05D0000-0x000001D8A05D1000-memory.dmp

Download

memory/2012-638-0x000001D8A05D0000-0x000001D8A05D1000-memory.dmp

Download

memory/4808-256-0x000001A2E9430000-0x000001A2E943C000-memory.dmp

Download

memory/4808-257-0x000001A2EB620000-0x000001A2EB630000-memory.dmp

Download

memory/4808-227-0x000001A2EB620000-0x000001A2EB630000-memory.dmp

Download

memory/4808-8-0x000001A2EB7A0000-0x000001A2EB7BE000-memory.dmp

Download

memory/4808-220-0x000001A2EB620000-0x000001A2EB630000-memory.dmp

Download

memory/4808-3-0x000001A2EB7C0000-0x000001A2EB84E000-memory.dmp

Download

memory/4808-1-0x000001A2EB620000-0x000001A2EB630000-memory.dmp

Download

memory/4808-9-0x000001A2EE4A0000-0x000001A2EE554000-memory.dmp

Download

memory/4808-10-0x000001A2EB620000-0x000001A2EB630000-memory.dmp

Download

memory/4808-7-0x000001A2EB620000-0x000001A2EB630000-memory.dmp

Download

memory/4808-6-0x000001A2EB620000-0x000001A2EB630000-memory.dmp

Download

memory/4808-0-0x000001A2E8F80000-0x000001A2E8FF2000-memory.dmp

Download

memory/4808-255-0x000001A2EB620000-0x000001A2EB630000-memory.dmp

Download

memory/4808-5-0x000001A2EB900000-0x000001A2EB9A2000-memory.dmp

Download

memory/4808-4-0x000001A2EB770000-0x000001A2EB77E000-memory.dmp

Download

memory/4808-225-0x000001A2EB620000-0x000001A2EB630000-memory.dmp

Download

memory/4808-226-0x000001A2EB620000-0x000001A2EB630000-memory.dmp

Download

memory/4808-2-0x000001A2E9410000-0x000001A2E9411000-memory.dmp

Download