6e7a0f4e9a276f058dbdafbdfbc7296a10a7eb7994992b88de0c544ec3b39505

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
135s
max time network
139s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/07/2026, 22:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VoidTools-Setup-v2.1.4-win64.exe
Size 17.8MB
Sample260726-11dnhasblf
SHA256 6e7a0f4e9a276f058dbdafbdfbc7296a10a7eb7994992b88de0c544ec3b39505
MD5 474123ea1aa7980e781f0d463a11c0eb
SHA1 25c865e980d2fff9456de8da1a75f906d39a0116
SHA512 21877a47ad49a8c25a800b3cf0e31174b294f6e1584481d376964edbb42a4e7137f9935ec705105a5dab8b0c3b9d09b490a090f2bd15016310585901b5514a99
SSDEEP 393216:7qh/CJ40hC/hOgJoiPVBMKIgazcaI6DD6iZfVXegour6owdNmTgI531:Wkyf/gUPYKqzYqdZtXR8t01
TLSH
T1DD17333FB24B753EE06E5A363AB7E650443B7B2164924C46D7E0C59DDF224702D3EA82
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery installer trojan

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
4212	VoidTools-Setup-v2.1.4-win64.tmp
1312	VoidTools.exe
1564	tor.exe

Loads dropped DLL 1 IoCs

pid	Process
1312	VoidTools.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	VoidTools.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping252_752292910\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping252_752292910\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping252_752292910\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping252_752292910\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping252_752292910\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping252_752292910\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping252_752292910\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping252_752292910\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping252_752292910\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping252_752292910\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping252_752292910\test.txt	msedgewebview2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VoidTools-Setup-v2.1.4-win64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VoidTools-Setup-v2.1.4-win64.tmp

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/3204-1-0x0000000000F40000-0x000000000101F000-memory.dmp	innosetup
behavioral1/memory/3204-55-0x0000000000F40000-0x000000000101F000-memory.dmp	innosetup
behavioral1/memory/3204-82-0x0000000000F40000-0x000000000101F000-memory.dmp	innosetup

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4212	VoidTools-Setup-v2.1.4-win64.tmp
4212	VoidTools-Setup-v2.1.4-win64.tmp
1152	msedgewebview2.exe
1152	msedgewebview2.exe

Suspicious behavior: LoadsDriver 5 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
252	msedgewebview2.exe
252	msedgewebview2.exe
252	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4212	VoidTools-Setup-v2.1.4-win64.tmp

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 3204 wrote to memory of 4212	3204	VoidTools-Setup-v2.1.4-win64.exe	88
PID 4212 wrote to memory of 1312	4212	VoidTools-Setup-v2.1.4-win64.tmp	89
PID 1312 wrote to memory of 1564	1312	VoidTools.exe	90
PID 1312 wrote to memory of 252	1312	VoidTools.exe	92
PID 252 wrote to memory of 1240	252	msedgewebview2.exe	93
PID 252 wrote to memory of 5920	252	msedgewebview2.exe	94
PID 252 wrote to memory of 5920	252	msedgewebview2.exe	94
PID 252 wrote to memory of 5920	252	msedgewebview2.exe	94
PID 252 wrote to memory of 5920	252	msedgewebview2.exe	94
PID 252 wrote to memory of 5560	252	msedgewebview2.exe	95
PID 252 wrote to memory of 2992	252	msedgewebview2.exe	96
PID 252 wrote to memory of 2992	252	msedgewebview2.exe	96
PID 252 wrote to memory of 2992	252	msedgewebview2.exe	96
PID 252 wrote to memory of 2288	252	msedgewebview2.exe	97
PID 252 wrote to memory of 2288	252	msedgewebview2.exe	97
PID 252 wrote to memory of 2288	252	msedgewebview2.exe	97
PID 252 wrote to memory of 2288	252	msedgewebview2.exe	97
PID 252 wrote to memory of 2288	252	msedgewebview2.exe	97
PID 252 wrote to memory of 5244	252	msedgewebview2.exe	99
PID 252 wrote to memory of 5244	252	msedgewebview2.exe	99
PID 252 wrote to memory of 5244	252	msedgewebview2.exe	99
PID 252 wrote to memory of 5244	252	msedgewebview2.exe	99
PID 252 wrote to memory of 5244	252	msedgewebview2.exe	99
PID 252 wrote to memory of 3432	252	msedgewebview2.exe	100
PID 252 wrote to memory of 3432	252	msedgewebview2.exe	100
PID 252 wrote to memory of 3432	252	msedgewebview2.exe	100
PID 252 wrote to memory of 3432	252	msedgewebview2.exe	100
PID 252 wrote to memory of 3432	252	msedgewebview2.exe	100
PID 252 wrote to memory of 1544	252	msedgewebview2.exe	103
PID 252 wrote to memory of 1544	252	msedgewebview2.exe	103
PID 252 wrote to memory of 1544	252	msedgewebview2.exe	103
PID 252 wrote to memory of 1152	252	msedgewebview2.exe	104

C:\Users\Admin\AppData\Local\Temp\VoidTools-Setup-v2.1.4-win64.exe
"C:\Users\Admin\AppData\Local\Temp\VoidTools-Setup-v2.1.4-win64.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3204
- C:\Users\Admin\AppData\Local\Temp\is-LN4EKUELAK.tmp\VoidTools-Setup-v2.1.4-win64.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-LN4EKUELAK.tmp\VoidTools-Setup-v2.1.4-win64.tmp" /SL5="$4018C,17478859,853504,C:\Users\Admin\AppData\Local\Temp\VoidTools-Setup-v2.1.4-win64.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4212
- - C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe
    "C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks whether UAC is enabled
    - Suspicious use of WriteProcessMemory
    PID:1312
  - - C:\Users\Admin\AppData\Local\Programs\VoidTools\tor-runtime\tor\tor.exe
      "C:\Users\Admin\AppData\Local\Programs\VoidTools\tor-runtime\tor\tor.exe" -f NUL --ignore-missing-torrc --ClientOnly 1 --AvoidDiskWrites 1 --SafeSocks 1 --SocksPort "127.0.0.1:9150" --DataDirectory "C:\Users\Admin\AppData\Local\VoidTools\Tor\Data" --SafeLogging 1 --Log "notice stdout" --GeoIPFile "C:\Users\Admin\AppData\Local\Programs\VoidTools\tor-runtime\data\geoip" --GeoIPv6File "C:\Users\Admin\AppData\Local\Programs\VoidTools\tor-runtime\data\geoip6"
      4⤵
      Executes dropped EXE
      PID:1564
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=VoidTools.exe --webview-exe-version=2.1.4 --user-data-dir="C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --disable-quic --dns-prefetch-disable --enable-features=MojoIpcz,msWebView2EnableDraggableRegions --force-webrtc-ip-handling-policy=disable_non_proxied_udp --proxy-bypass-list=<-loopback>;desktop.voidtools.software;accounts.voidtools.software;clerk.voidtools.software;accounts.google.com --proxy-server=socks5://127.0.0.1:9150 --mojo-named-platform-channel-pipe=1312.5740.15405496376301202863 /pfhostedapp:883a1e44c6e89cfeac157e48235313332773ec67
      4⤵
      Drops file in Windows directory
      Checks SCSI registry key(s)
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of WriteProcessMemory
      PID:252
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView /prefetch:4 /pfhostedapp:883a1e44c6e89cfeac157e48235313332773ec67 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x128,0x7ffde8e35fd8,0x7ffde8e35fe4,0x7ffde8e35ff0
        5⤵
        
        PID:1240
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView" --webview-exe-name=VoidTools.exe --webview-exe-version=2.1.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1744 --field-trial-handle=1748,i,980145107538839061,11069868564659038075,262144 --enable-features=MojoIpcz,msWebView2EnableDraggableRegions --variations-seed-version /prefetch:2 /pfhostedapp:883a1e44c6e89cfeac157e48235313332773ec67
        5⤵
        
        PID:5920
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --proxy-server=socks5://127.0.0.1:9150 --disable-quic --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView" --webview-exe-name=VoidTools.exe --webview-exe-version=2.1.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2404 --field-trial-handle=1748,i,980145107538839061,11069868564659038075,262144 --enable-features=MojoIpcz,msWebView2EnableDraggableRegions --variations-seed-version /prefetch:3 /pfhostedapp:883a1e44c6e89cfeac157e48235313332773ec67
        5⤵
        
        PID:5560
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --proxy-server=socks5://127.0.0.1:9150 --disable-quic --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView" --webview-exe-name=VoidTools.exe --webview-exe-version=2.1.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2508 --field-trial-handle=1748,i,980145107538839061,11069868564659038075,262144 --enable-features=MojoIpcz,msWebView2EnableDraggableRegions --variations-seed-version /prefetch:8 /pfhostedapp:883a1e44c6e89cfeac157e48235313332773ec67
        5⤵
        
        PID:2992
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView" --webview-exe-name=VoidTools.exe --webview-exe-version=2.1.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3240 --field-trial-handle=1748,i,980145107538839061,11069868564659038075,262144 --enable-features=MojoIpcz,msWebView2EnableDraggableRegions --variations-seed-version /pfhostedapp:883a1e44c6e89cfeac157e48235313332773ec67 /prefetch:1
        5⤵
        
        PID:2288
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView" --webview-exe-name=VoidTools.exe --webview-exe-version=2.1.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4636 --field-trial-handle=1748,i,980145107538839061,11069868564659038075,262144 --enable-features=MojoIpcz,msWebView2EnableDraggableRegions --variations-seed-version /pfhostedapp:883a1e44c6e89cfeac157e48235313332773ec67 /prefetch:1
        5⤵
        
        PID:5244
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView" --webview-exe-name=VoidTools.exe --webview-exe-version=2.1.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4880 --field-trial-handle=1748,i,980145107538839061,11069868564659038075,262144 --enable-features=MojoIpcz,msWebView2EnableDraggableRegions --variations-seed-version /pfhostedapp:883a1e44c6e89cfeac157e48235313332773ec67 /prefetch:1
        5⤵
        
        PID:3432
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --proxy-server=socks5://127.0.0.1:9150 --disable-quic --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView" --webview-exe-name=VoidTools.exe --webview-exe-version=2.1.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=5268 --field-trial-handle=1748,i,980145107538839061,11069868564659038075,262144 --enable-features=MojoIpcz,msWebView2EnableDraggableRegions --variations-seed-version /prefetch:8 /pfhostedapp:883a1e44c6e89cfeac157e48235313332773ec67
        5⤵
        
        PID:1544
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView" --webview-exe-name=VoidTools.exe --webview-exe-version=2.1.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4876 --field-trial-handle=1748,i,980145107538839061,11069868564659038075,262144 --enable-features=MojoIpcz,msWebView2EnableDraggableRegions --variations-seed-version /prefetch:8 /pfhostedapp:883a1e44c6e89cfeac157e48235313332773ec67
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VoidTools.exe

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe
Size 10.0MB
SHA256 be11b7dfc2c5107714dcf642e1e5db1a7c0a9a16524e42885e6f27c8ef146e15
MD5 14747b90321fb8b5490e9c7b7446f7f9
SHA1 3dfb318fcb9029b52acc6a577f8efd425eabff05
SHA512 fe06cb05eff3762d5c20599e9b858a94cf2bcee294432a68e990e85928bce39809be581dcc2d48bfe0d6f3e7c5af77b094bb1e53d334c5d69673a1051d2ecec3
SSDEEP 196608:WmQZq1c/fihwfpKNAC2BmLcxEn5vjSKfsaNYd0o:WbacShwfpKNArmIxEn5vjSKfsaNZo
TLSH
T113B6AE2AB6A801ECD477C1B8CA4B4617E772780947B056DF26A086F61F63BD05F7BB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 0e4dc1a92761cba49f1b640d74c62baef7aaf4760e4cba8c1c7cd929946d2188
MD5 8d36a1516a1417df3b7ebd21670e417a
SHA1 feb81e6077fa7ccbb43dd611eba84fd786793d6e
SHA512 0cedb6d8a5a36812d55720890dbb80f1b8f53cd4c018bc9a314ddb80a22c6c4aee857bdfeb96f8da5efcd38f4318b75533d188463086d8c7a5853a1878dbbd06
TLSH
T16DD0121372410174C01020730052A70C1D40D11B800D8041543D862E2F440501D0B581
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 30f930a31609d0b655990ec7d4fb1edb497ab3885d6bc2bbb289343416ec3ddf
MD5 77715928b534ea592b57d82f1b10aaac
SHA1 562bdaec23775d0d645fa6692165b4255cca8cb9
SHA512 66b01a266b184c0a4744426a2b88c74222a8740104e3196fba1f2b20f157448fc5bada464ae0fd187ad71ef63bfabc50d3454b39d46cfb8234ad9fc0ec9756a7
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

64c11cc6-43fd-4c14-b73a-1b967b1a7b3e.tmp

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Default\64c11cc6-43fd-4c14-b73a-1b967b1a7b3e.tmp
Size 6KB
SHA256 d321dcfd46cc265c33c6e830670ef0831768dc23200027e6d6cc6361d89679bb
MD5 369c6100977752cfc681b1acd046a94b
SHA1 0845e1e19b233bcff9fec0b7129f8cf3ef924af1
SHA512 8847e365ef2b3bd0dc8309abd162e48ff90e139be92df482e157789cc0d14c71031065a71b2717ef6ed8051112cb3462b7461d4137d6ac4e73d974e04af2c4dc
SSDEEP 96:stR4/dzwfah2Tb9PkHGo5h16ZHRks7/x+6MhmuecRRrWMFNjeY1K+gt9wL28XM75:stSpivocGsV+FdRW2jisG0K
TLSH
T1B8D195076E38697B4CC6E119FA39BF06E2F9642265D11E58EBF9861C08DA5DC3317C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 288B
SHA256 07a33156c2891399e872f99e7c860463f01c252985b4f817121de497153c6d18
MD5 4d2963e4a8c7b1a1e0d6e95ed2b416f7
SHA1 c21873b7d6a77b86950890c27828bfa778b45c8b
SHA512 caef76aa616174bfb38bde715db792a56b51670b7ac0a2ca4a8f6c7ca04eda38123f7e544661e51d50d4b90947287f48499b90f5b4326721a490ec27c4309ce2
TLSH
T164D0220008E5888DCF812330E0800E41A13333A7063FDF3300604C58D49FACF3AC4914
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 360B
SHA256 0078ef654e657f3b601ecfd00f9f23ea5433023437c4862ae1e40ef08db8a2d1
MD5 df9d10af7b91c058bf215dd1a911e952
SHA1 352c0ee7516bf3742f68c3d6bed3d3bbbf7ae52d
SHA512 d1c5d70fe0104faee5e6a9d2270c08d0a9f6eab799d4e162c67d84b1839c7ccb5a144492e25eafed2c5947f7a452cf3a5433851432dfb88c8a9426e79c17e786
TLSH
T1CCE05E0108D5898DCF51A2B0D8E42F51A0B277DB163FEFB31261DC64A17F6CE76C5928
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a326b.TMP

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5a326b.TMP
Size 48B
SHA256 0cc1c739bc41efff521305f925bf840371c04f106e35b98a2e8cc65f5a86f1f4
MD5 2c4a076ca866c10f3ae5c9e360382546
SHA1 5be92bd823adaef6f2452a2235e5576d0cf0e646
SHA512 e50cce0018d9248d85d0cb2b7377068d01c5d7b04fa8a9e03e0ec81ec12ff0dc399c0c3ae314baf5cdb449eba28838ced46e41de3aba614fd2d6b3204aa72c21
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State~RFe5aee88.TMP

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Default\Network\Network Persistent State~RFe5aee88.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Default\Network\TransportSecurity
Size 356B
SHA256 bc56819aa84af46c6728934e255b2f51dde9e371ba46819b9043fae7e3bc7457
MD5 112adbd82f54614ca58861ad43863fa7
SHA1 dc6e063f1a9f49d153d72e6157b5799aacd49a42
SHA512 d88d2fd0fdaf57e400a705b54143759de821003094974e5c848fed051e7f7a44577cf2d6c02a7c6a793d2e0ced2267799dd753b4779b564bae6e3864067c2c1e
TLSH
T18CE020A7527D746A106D466938C4F9047A3EE53071C354F4C755427CA0C58F67D03353
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Default\Network\TransportSecurity
Size 356B
SHA256 bcf4c3ddca9a68430832ffd1c48f1c52248ea8aad0fe39f3674881c0276cb3b5
MD5 e5bb8c73f4a37b125ad59c7a83afa2a2
SHA1 bf7e7ff611df126cca0ef2f94d4bc0d82341af09
SHA512 61a7891046c03b1b642ca99a62050a52d8c000a95747e36b5595e4d513cbc0e744c056f076cbe17f161ee28fd7297c641913fa988958e90a7f1af7f648967da9
TLSH
T146E02067817D742A1069467929C4F9059B3FE43041C394F4CB7543ACA0C19F6B903323
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Default\Network\TransportSecurity
Size 356B
SHA256 0d9b4e53e0a3b2b7b6e8dd725fc6dc458fd1e342ee5b1381fcc82dc81e1e187b
MD5 1332ac13797868a0b3e3e28e02c28a21
SHA1 9edc5991e183806baa1bb164094c4c8562e622ed
SHA512 7920d7c0fd414684ce69b0ecbe3aaf1571b4beadc2da2124123c09e449c9d693d2a104e5a0a32148f64d677c0c02760a2e9b60b7dfdb82ab3a8ab6dbb0345587
TLSH
T1E5E020A7417D75761069466938C4F9045B3EE47092C354F4C75642ADA0C19F79E03353
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Default\Network\TransportSecurity
Size 356B
SHA256 6713fe00bb77f8b1d4ea78c7805d26e9c42dba1eb4f2309545cf14278b99b016
MD5 6bd0550c199f4c73572c1d215e76c94f
SHA1 1936b2011b40e0337f4f6373e5822aa9ddde1b45
SHA512 949428a4f3484975c876f880e78c39ed79ae247532e9756c1e9ee60e521863959e666776bfbc0a93be2f224afa20d203aa2d0c22fb398ea437ec2d8f40cb19c0
TLSH
T1D7E0206B417D7426106E466929C4FA055A3EE53451D354F4DB5582BCA0C19F69E07312
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Default\Network\TransportSecurity
Size 356B
SHA256 b125a2069cbdea8e57c13c24b2eb430868e0891ec91546994ecc151163a8d53f
MD5 fb59a0bd29f9c8e24406aeb4555f9b9d
SHA1 08b5ae79c21ff7491e6d6a7e1df75af2a406bb37
SHA512 e22fc245b31814bc25af1c799c93672932bbce63d4e9904e2c0569fe3a300479fa53e0da6738abba54869c62904377eed96bc4fa549f3f60ad7788d92b127ca9
TLSH
T1DFE0206B403D7966102E077629C8F905597DEA3411D39CE4DE5582FCA0C29F69B17252
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe5a9859.TMP

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Default\Network\TransportSecurity~RFe5a9859.TMP
Size 356B
SHA256 bde18d58af84e956537c7cefbc9a3f90da47bb2e0b4cbd46a9188b1835efc91d
MD5 2d0bd9851a95758f8d36e2a6e5132a44
SHA1 6d5e154e8efe04b3fdfcc2e0c04653970f23a263
SHA512 fa562bec05199445e0b360f5bca2337407bf1354e95c35292553dcffa7cefd43b8a898293df7af1fdd6bc5320a1e738c7188ef9ef3e6cc3ae28fb94b88b58318
TLSH
T159E026BB907DB87A102D86B638C4B904BA3AF53071C358F4DA56467CA0C98F67A03353
MD5 SHA1 SHA512 TLSH

Submit Download

d8cf1e6e-7cdb-40dd-a547-c18d5f41edbb.tmp

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Default\Network\d8cf1e6e-7cdb-40dd-a547-c18d5f41edbb.tmp
Size 1KB
SHA256 42e7bcc7070fa5483d28c0a64151254374005fc41ac1ec36884396cd8cdfe117
MD5 6d312458cd429a6d6567dd12a429138c
SHA1 a0b22b92c1094d0646de59638449ba05cd779c42
SHA512 4e6f7587410f378e5bbd6f3597639f371fa9b6923a145bd335919c4470626fe05dd5097bc95a4fb34155890bc4ef53bf181f88552c6b643f072fa126e0c9769a
TLSH
T12D11C0F2E3F04B6D976043F83E181D179FF9255417AC3D9686C9A70E66F0479D24084E
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 356dd591b1c2f8c5320d2313b54ccf0d57ef3c74ec13c911f1939884417b70ab
MD5 3dc22484a23548776c20747235109538
SHA1 782ce5b3311c0886400dfd0113f05cefbaae5af3
SHA512 85acb806929daaf640d5364aa84bcb340a1dfab192b45489ab363f47639354ccda84338b17f58d45edb1fcbfa29982df70ffd6d25e30a1d71d7f711ba30b5c8b
SSDEEP 96:stR4/dzwfah2Tb9PkHGo5h16ZHRksDROr8/x+6MhmuecRRTyXIjeY1K+gtlTL28i:stSpivocGsDn+Fdly4jiBG0K
TLSH
T1BBD195076E34697B4CC6E11DFA39BB42E2F9642266D11E48EBF9861C04EA5DC7317C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

00000000

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Default\WebStorage\2\FileSystem\t\00\00000000
Size 1B
SHA256 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
MD5 93b885adfe0da089cdf634904fd59f71
SHA1 5ba93c9db0cff93f52b521d7420e43f6eda2784f
SHA512 b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Local State
Size 2KB
SHA256 f1e6ad799b63c8ba2c25f8a20eba1d63f07e6d874fe4fea8343073c5fe404978
MD5 2d56ab7aad9a0ed578ecb4da70e42413
SHA1 804c16f6d45631b04be5e1c1cc2e6f100bd7b3c1
SHA512 1b6b2e16561064930d5ab2b4d0ebbe03635779081e4848ce1388c1cfe8aeef66e693750afd98308ba114c2316db1634239a8ddbc0bd07e9daf54ff51d859810b
TLSH
T1DE51943378209B7B8AE34A0ABD973F138A395062DB523F4896DD0B1C11C754D2741C77
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Local State
Size 3KB
SHA256 665196652936d33926320c531dfb5569d77f77b95bfe23e56443dc95f22cba07
MD5 4900bb188bb6518b58d126f32d9be2b6
SHA1 652bbe679a588aa865f4b8b62149f192a5d86dcf
SHA512 154e782cd2a18b94d7e3638fdc628b0d4601f1ec912c24860968f6c4e172273935a709634994be3fda28b65e01826785fdb2a11fa8d11c139b0845b57f8afae2
TLSH
T13661753B78749A3B4EF39A06B9873B06A7655023D6813F99D6EC0F0C11D728C2341C67
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Local State
Size 3KB
SHA256 6e5eea81dcc30b9eb08c6652401e16656182cb773dd5e63cda59896ffcc3ade4
MD5 1886f65e734f187f3f898abe8e737fb9
SHA1 ae27f850521dad9f16aed7506657126bff4ec32d
SHA512 4c103729f3ae3d54d10039eda8bb3ee1461f77844a851d3dadbefda7a6854a6b2085172d87682069f7cf45235372baedff0c16e283d9cb944c885ae5235fb96f
TLSH
T18571752B7474AA7B4DF3DA06B9863F07A7A85063D6913F99D6EC0F0C11D72892342927
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Local State
Size 15KB
SHA256 a9f2d33099d59f4e8e8bf003bc8ee23ee59de8386c9d86761b3f56a9e46f7b75
MD5 06def8d53902bb37cef8483cef5d6530
SHA1 1a1af8a59f3ef2471cf2485a042539cc00a5423a
SHA512 737290e7520f185f5ecfc040a537b12f8dccfda83090669f01854682cbd5e2944b0343e12313d35d3d35ba793657199a7f76d5bc9c499da7d58ec32c52fa0904
SSDEEP 384:6+aQikB+z/xvxjg/qhEwNBS/dF2lxCZ856:F/UxvxjgC+tAEZv
TLSH
T133729E3F60797E2396F3E905BD8A1B4BD6B894B2D1C279AC4AEC5F0E06C72881341D56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe59ce14.TMP

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Local State~RFe59ce14.TMP
Size 1KB
SHA256 cb65f33305a9b9f6b41636accf01744d65faa1c67626d156bf35055c7d173359
MD5 5df7e566aee1a36722d6216e9efb0384
SHA1 67c66333b9e144220433b30126881996b0e045ce
SHA512 886d2e162e6fa2fe0b1219bfcd93d7337aa6dc14f38dd5e33a6a0d160ae111e4b8779905f831423121387bde85673e368b9a624ef3a230cb643a950ec05cdb1a
TLSH
T1992192B3B8649B329DD36B4B75537B0B5E241033C3405E0861CE4B1C22E708EAB6AD33
MD5 SHA1 SHA512 TLSH

Submit Download

WebView2Loader.dll

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\WebView2Loader.dll
Size 161KB
SHA256 9468470d6a4d11179ec179183d130465a380e0dedfdbe1fc2ab404c86c45a85e
MD5 61f430f292f85b18b57f06ea6d3d8b82
SHA1 03e31a690fa32364fea5ce73498f234adc544cd0
SHA512 73dfd28a27c10984abb382b7d868b3812aa8d0c89435a45b5b242fa82cc7890b91b2e89bc86cdee039b721befaaf0d14506b6c9c86ecbce6ba6d97824eb22dfb
SSDEEP 3072:dX1/Z3TlTRTFOYfThTNTvDbS2bT4wdovPEKdIMsb1Z5AalipTkYEtJ5+POFEv:dDTlTRTFOYfThTNTvDhvZkPEKdI7pUEQ
TLSH
T12CF36C5772E5007BE16B8274C9A34A11E777B4510B60ABEF03A4477A1F237D4AE3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geoip

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\tor-runtime\data\geoip
Size 9.0MB
SHA256 af9ccd060a712d090ee07d5678b5d45b0038ec1573116fae724a6695a8485703
MD5 e9e0ee27f75255c81ee0d5352a0478aa
SHA1 b08bfe286dc8f11f29aaceafb6f7ef0f5c771042
SHA512 5547bc13552320720a132af6d9b122b75896f908ebeddb24d8218ef5075c38d21c7ef0ef6d5dd855b783c891c3aadd5fc362793e62974185e7eedeae47322413
SSDEEP 49152:j2qmvmL+vpS0uWjaD2X4wH2I58Ydqkztz9HkBo0podsEKopmzPrAMZARLhQIKL9Q:A
TLSH
T105A6F8A05271E9DAF3EA8797C9671C1D412BE01A222616B4F4C7F59E8D0FBC0D0B1E97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geoip6

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\tor-runtime\data\geoip6
Size 15.3MB
SHA256 2393124667ba2ccb4c806f226a33b2ef7a8188d1ba55831c1a5d3dca2b062514
MD5 4d1662e438f08fe4c913789c3f56d925
SHA1 9d85004fba941079cfe018f0599e6a337c4e45a1
SHA512 3fb3f440bc206a3645eb684b37606855c3d1d1d976463e45b96e7e069975aa18f4ca31ab9ed351533d56ee7e50bd7fd627b43d21d274133c5393a9b1b41905ec
SSDEEP 24576:eRqHqAVglkDRj8wHjVCpYcbwlihndEtmKco4MkQHLPTtshizhtBsNvubuw0oDL8l:Q
TLSH
T1BAF6DD7005BED7C5ABC8E1FF5690E86F4AA6F2DC361918D425B6DCB817E64074AEC203
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tor.exe

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\tor-runtime\tor\tor.exe
Size 9.7MB
SHA256 ec7708e0b43e0e00b1533d11ed3ca244e6f11cb2a7b62d319ad73a7b13123033
MD5 93110c343a740fca8e64cfe00472c527
SHA1 bb6abd60cfa979506bfc2c3b14c725a79cd5ddee
SHA512 d8510b0466104d02fc939806e1713d614c56488a0ded258e7bb8c1490b0839f7be054e5e56f3984012ec145049c7dbbcc0adf912dada78e4363201cd808baf75
SSDEEP 98304:+igyt48AHd7ERbHgshQKnRqNAtLnLisS1Km1mLg9wrHjzsZaUHaa+b:dgyt4hdcnLs1z1mL+ia
TLSH
T142A62947F27710DDC5BAC07892177223F9A13C8C81346B6B599097A62B70B68AF7EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VoidTools-Setup-v2.1.4-win64.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-LN4EKUELAK.tmp\VoidTools-Setup-v2.1.4-win64.tmp
Size 4.2MB
SHA256 b7c2cce1bd7da0823abedd756d201a2a2d86994f0521fe29c01f81973cf5f769
MD5 1a5d04f2b17607fb335268b829164233
SHA1 70eaed3859d407c0da1f53c4a1ea28464c46ba44
SHA512 40d2f2e77b472cf161e2022a23c6800c9e12ed2b873d56366bd96f22b279868794dac7e8f6a416adfadcb78d53499e12aca23a3492a656b15451e6e24ec5ad5b
SSDEEP 98304:h9SZUvl30aj90ZFcvdQ0hdgvminQLMj+Jb333M:+ItJj90Z6RgKwT
TLSH
T189168E03B388753EE4B71E3A883FA654583F7A213A16CD4B6BF4099C4F396416D2A747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cached-microdesc-consensus

Path C:\Users\Admin\AppData\Local\VoidTools\Tor\Data\cached-microdesc-consensus
Size 3.4MB
SHA256 7f01c97ff4922e7b1d3c49373313b3d574824a09c8e3dd1b288206796e79ad42
MD5 c8011d5bfa228d29247d478631fd8d6b
SHA1 1cd8cad9e8cd74b6f878353c34b42a66b6c26cd7
SHA512 2465a2af2ad6a643ecd1bf0186dcc30ca978b6dc3b51bdce377317ab3d3c67771af61d0021c9763e7b26cb2f6b6c4482d7d9d394f5266a04fd77b008370f5b61
SSDEEP 24576:j7G4wvxNQG4loelM8t7hOvProjukDJXv3MlsP:jSrMloeBYyfzP
TLSH
T127F554EA97124EEAD32609DBE510FF7BF33F1725C2486B94296F48FA7205091762093D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cached-microdescs.new

Path C:\Users\Admin\AppData\Local\VoidTools\Tor\Data\cached-microdescs.new
Size 13.6MB
SHA256 74ab75d24f80757637a5fe7f50f79cfdecd0e3faa8e989b7d98e3d1d8259f5b2
MD5 5a996db5fbb6d6e7df036bebea5bd6ab
SHA1 082fed98e384323ad993afacba23ca76c7c6e888
SHA512 010d5885cd85438092da4b8b07a2f186f3e7472539fd363a5de4cf7b5b12269411e52de72e176bacbdfe0515cabb543d3e53da13f3e546738a7bbe81683f8e86
SSDEEP 24576:vQVhVhVYmW8YVVI7VfFFVFVoVUMlVMDlOUVEVXsg+/1VgYpVib4kVxiQVrtSeVth:j1Zc4
TLSH
T112E6AFDA49AB14C14D05E7CDDC1607C3DF148A3A4B6001A176AAF96B7F332AFC15EA78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.html

Path C:\Users\Admin\AppData\Local\VoidTools\WebUI\index.html
Size 915KB
SHA256 a4b00d8679da37d1b8e6dad5cde59edf59d6d64a62b53fef27426eacde4b6dd8
MD5 b57e11205da63973a1ac3ab19e928b59
SHA1 f0de050ca09e90c82ea1dfe8d0024aef95aa5380
SHA512 fd84db053ff2e02e084dd0730da27065f132d4a568dbabe0c1c4b447cb8fb7d231c6b59197171fffc5ed8de15182545af583b37b670a2a095974f0c6fe0d6e89
SSDEEP 12288:gFoOhMKA4bHH9/hzzoNw0ahWHB7nqcuwR45VwbZSb6Zd8xY:gFlMmbwNwVWh7nqW45Vwb7d8q
TLSH
T16A156B14F152BB7DAF7348E6A82F9018712E1F88DA1E84B0F07CA47516A81867677FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/1152-595-0x00000120BFD00000-0x00000120BFD01000-memory.dmp

Download

memory/1152-586-0x00000120BFD00000-0x00000120BFD01000-memory.dmp

Download

memory/1152-584-0x00000120BFD00000-0x00000120BFD01000-memory.dmp

Download

memory/1152-592-0x00000120BFD00000-0x00000120BFD01000-memory.dmp

Download

memory/1152-593-0x00000120BFD00000-0x00000120BFD01000-memory.dmp

Download

memory/1152-591-0x00000120BFD00000-0x00000120BFD01000-memory.dmp

Download

memory/1152-590-0x00000120BFD00000-0x00000120BFD01000-memory.dmp

Download

memory/1152-594-0x00000120BFD00000-0x00000120BFD01000-memory.dmp

Download

memory/1544-489-0x00007FFE0AB60000-0x00007FFE0AB61000-memory.dmp

Download

memory/1544-524-0x000001D4E7FC0000-0x000001D4E7FEF000-memory.dmp

Download

memory/1544-488-0x00007FFE0B7E0000-0x00007FFE0B7E1000-memory.dmp

Download

memory/2288-177-0x00007FFE09930000-0x00007FFE09931000-memory.dmp

Download

memory/3204-1-0x0000000000F40000-0x000000000101F000-memory.dmp

Download

memory/3204-55-0x0000000000F40000-0x000000000101F000-memory.dmp

Download

memory/3204-82-0x0000000000F40000-0x000000000101F000-memory.dmp

Download

memory/4212-6-0x0000000001100000-0x0000000001101000-memory.dmp

Download

memory/4212-57-0x0000000001100000-0x0000000001101000-memory.dmp

Download

memory/4212-56-0x0000000000160000-0x000000000059A000-memory.dmp

Download

memory/4212-67-0x0000000000160000-0x000000000059A000-memory.dmp

Download

memory/5920-534-0x000001CC99C50000-0x000001CC99C52000-memory.dmp

Download

memory/5920-541-0x000001CC99E30000-0x000001CC99E33000-memory.dmp

Download

memory/5920-467-0x000001CC9A150000-0x000001CC9A155000-memory.dmp

Download

memory/5920-464-0x000001CC9A180000-0x000001CC9A182000-memory.dmp

Download

memory/5920-411-0x000001CC99BF0000-0x000001CC99BF1000-memory.dmp

Download

memory/5920-471-0x000001CC9A1B0000-0x000001CC9A1B3000-memory.dmp

Download

memory/5920-472-0x000001CC9A190000-0x000001CC9A196000-memory.dmp

Download

memory/5920-468-0x000001CC9A190000-0x000001CC9A191000-memory.dmp

Download

memory/5920-407-0x000001CC99BA0000-0x000001CC99BA2000-memory.dmp

Download

memory/5920-537-0x000001CC99B40000-0x000001CC99B45000-memory.dmp

Download

memory/5920-536-0x000001CC99C60000-0x000001CC99C63000-memory.dmp

Download

memory/5920-533-0x000001CC99B40000-0x000001CC99B41000-memory.dmp

Download

memory/5920-542-0x000001CC99C60000-0x000001CC99C66000-memory.dmp

Download

memory/5920-469-0x000001CC9A1A0000-0x000001CC9A1A2000-memory.dmp

Download

memory/5920-539-0x000001CC99E20000-0x000001CC99E22000-memory.dmp

Download

memory/5920-538-0x000001CC99C60000-0x000001CC99C61000-memory.dmp

Download

memory/5920-415-0x000001CC99BF0000-0x000001CC99BF6000-memory.dmp

Download

memory/5920-405-0x000001CC99B00000-0x000001CC99B02000-memory.dmp

Download

memory/5920-404-0x000001CC99AA0000-0x000001CC99AA1000-memory.dmp

Download

memory/5920-184-0x00007FFE09930000-0x00007FFE09931000-memory.dmp

Download

memory/5920-463-0x000001CC9A150000-0x000001CC9A151000-memory.dmp

Download

memory/5920-466-0x000001CC9A190000-0x000001CC9A193000-memory.dmp

Download

memory/5920-410-0x000001CC99AA0000-0x000001CC99AA5000-memory.dmp

Download

memory/5920-409-0x000001CC99BF0000-0x000001CC99BF3000-memory.dmp

Download

memory/5920-412-0x000001CC99C00000-0x000001CC99C02000-memory.dmp

Download

memory/5920-414-0x000001CC99C10000-0x000001CC99C13000-memory.dmp

Download

memory/5920-406-0x000001CC99AA0000-0x000001CC99AA1000-memory.dmp

Download