9d7fb5a716b92eb0584f9c27d26a3714445f8fc2701994e9747519d5ee06185d

Analysis

user interaction
yes
max time kernel
52s
max time network
52s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/08/2026, 11:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VoidTools-Setup-v2.1.8-win64.exe
Size 17.9MB
Sample260805-nbbrdsem5s
SHA256 9d7fb5a716b92eb0584f9c27d26a3714445f8fc2701994e9747519d5ee06185d
MD5 6b82acf49acb84b2cb0a3f7b78dcdc10
SHA1 3f2f39aeeed802c7e645848de6ae574402a2a8f6
SHA512 e42bb43210c86fc1965f9d37b97e8f4a6017157db42dc934ee5a303c54c14174fe9a1af9bf7acabc4a11bb973b1d574f87e622cfaa8cf1b821bc17eb96ff8ab3
SSDEEP 393216:72zb5kY3JjCII1+3suYiZcQCzy3GGViYOXOWxVyQM++szt+9W/2beSs:SzVkAJ+t1bjQC8KhQAwz/s
TLSH
T1FC17333F728B763EE02D6A367A72E210583FA76064424C0696E4C95DDF360B12D3F796
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery installer trojan

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
1076	VoidTools-Setup-v2.1.8-win64.tmp
2940	VoidTools.exe
3756	tor.exe

Loads dropped DLL 1 IoCs

pid	Process
2940	VoidTools.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	VoidTools.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VoidTools-Setup-v2.1.8-win64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VoidTools-Setup-v2.1.8-win64.tmp

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/5152-0-0x0000000000F50000-0x000000000102F000-memory.dmp	innosetup
behavioral1/memory/5152-38-0x0000000000F50000-0x000000000102F000-memory.dmp	innosetup
behavioral1/memory/5152-106-0x0000000000F50000-0x000000000102F000-memory.dmp	innosetup

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134304020165826157"	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1076	VoidTools-Setup-v2.1.8-win64.tmp
1076	VoidTools-Setup-v2.1.8-win64.tmp

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
1836	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1076	VoidTools-Setup-v2.1.8-win64.tmp

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 5152 wrote to memory of 1076	5152	VoidTools-Setup-v2.1.8-win64.exe	81
PID 1076 wrote to memory of 2940	1076	VoidTools-Setup-v2.1.8-win64.tmp	83
PID 2940 wrote to memory of 3756	2940	VoidTools.exe	84
PID 2940 wrote to memory of 1836	2940	VoidTools.exe	86
PID 1836 wrote to memory of 4872	1836	msedgewebview2.exe	87
PID 1836 wrote to memory of 2240	1836	msedgewebview2.exe	88
PID 1836 wrote to memory of 2240	1836	msedgewebview2.exe	88
PID 1836 wrote to memory of 2240	1836	msedgewebview2.exe	88
PID 1836 wrote to memory of 3724	1836	msedgewebview2.exe	89
PID 1836 wrote to memory of 3308	1836	msedgewebview2.exe	90
PID 1836 wrote to memory of 3308	1836	msedgewebview2.exe	90
PID 1836 wrote to memory of 5532	1836	msedgewebview2.exe	91
PID 1836 wrote to memory of 5532	1836	msedgewebview2.exe	91
PID 1836 wrote to memory of 5532	1836	msedgewebview2.exe	91

C:\Users\Admin\AppData\Local\Temp\VoidTools-Setup-v2.1.8-win64.exe
"C:\Users\Admin\AppData\Local\Temp\VoidTools-Setup-v2.1.8-win64.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5152
- C:\Users\Admin\AppData\Local\Temp\is-6WWK5LXY28.tmp\VoidTools-Setup-v2.1.8-win64.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-6WWK5LXY28.tmp\VoidTools-Setup-v2.1.8-win64.tmp" /SL5="$A0072,17622265,853504,C:\Users\Admin\AppData\Local\Temp\VoidTools-Setup-v2.1.8-win64.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1076
- - C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe
    "C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks whether UAC is enabled
    - Suspicious use of WriteProcessMemory
    PID:2940
  - - C:\Users\Admin\AppData\Local\Programs\VoidTools\tor-runtime\tor\tor.exe
      "C:\Users\Admin\AppData\Local\Programs\VoidTools\tor-runtime\tor\tor.exe" -f NUL --ignore-missing-torrc --ClientOnly 1 --AvoidDiskWrites 1 --SafeSocks 1 --SocksPort "127.0.0.1:9150" --DataDirectory "C:\Users\Admin\AppData\Local\VoidTools\Tor\Data" --SafeLogging 1 --Log "notice stdout" --GeoIPFile "C:\Users\Admin\AppData\Local\Programs\VoidTools\tor-runtime\data\geoip" --GeoIPv6File "C:\Users\Admin\AppData\Local\Programs\VoidTools\tor-runtime\data\geoip6"
      4⤵
      Executes dropped EXE
      PID:3756
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=VoidTools.exe --webview-exe-version=2.1.8 --user-data-dir="C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=msWebView2EnableDraggableRegions --mojo-named-platform-channel-pipe=2940.3956.15907854158592811557
      4⤵
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of WriteProcessMemory
      PID:1836
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x164,0x168,0x16c,0x140,0x178,0x7ff8406fb078,0x7ff8406fb084,0x7ff8406fb090
        5⤵
        
        PID:4872
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView" --webview-exe-name=VoidTools.exe --webview-exe-version=2.1.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1668,i,6073001515991005911,979816244470818419,262144 --enable-features=msWebView2EnableDraggableRegions --variations-seed-version --mojo-platform-channel-handle=1664 /prefetch:2
        5⤵
        
        PID:2240
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView" --webview-exe-name=VoidTools.exe --webview-exe-version=2.1.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1968,i,6073001515991005911,979816244470818419,262144 --enable-features=msWebView2EnableDraggableRegions --variations-seed-version --mojo-platform-channel-handle=1980 /prefetch:11
        5⤵
        
        PID:3724
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView" --webview-exe-name=VoidTools.exe --webview-exe-version=2.1.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1972,i,6073001515991005911,979816244470818419,262144 --enable-features=msWebView2EnableDraggableRegions --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:13
        5⤵
        
        PID:3308
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView" --webview-exe-name=VoidTools.exe --webview-exe-version=2.1.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3652,i,6073001515991005911,979816244470818419,262144 --enable-features=msWebView2EnableDraggableRegions --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
        5⤵
        
        PID:5532

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VoidTools.exe

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe
Size 10.8MB
SHA256 b4c5769d0346aeab5de106492cdb89eec5e5b4ac30a27a58aa1d88ae05f6248e
MD5 dabae0f69a1d8f337fdf11f077ea8e45
SHA1 65f941225268b15f55a0f15f3761ec4ac94989e9
SHA512 a26e4d1998d28823f88fd2a8baee4a096d1ebc2a628a09101d41c382b51e836c26515db7db800f85397e0327c351740c066c73cf5172de960a86dbd337174cbe
SSDEEP 196608:9p3JHIHzkud6/4zXakoLGdcCIycBmqsM/0MxZKIzC:9P+kud6QzqkoLuTIycBmqsM/0Mxxu
TLSH
T1E3B6BF6AB2A801ECE077C1B8C65A461BF772740943B057EF2AA055F61F57AE05F3BB01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 dc7383e8b7f0ee8a0c587e11d5e2231f760318a88a6bd80423924557e485b1bb
MD5 b77c40122e2df71285c1079544752ec7
SHA1 58400126992c0923828ed91e6ba7a9d9605022aa
SHA512 b0bb9acc153c8c269a9cdcd188594be896556ecc1f68f0f88d79977b9a85bb34c4c74715e9eba2a2f468e5aecfa40aa873d93e3742e99002820f013a2c9d8bcf
TLSH
T164D0122272410134C0103433184266084801C20F814544455428CD6F9E154550A034D5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 66418be77e44edc37e2c08e88c9fe73fa99493c313343132d8cd1efef88ce8a9
MD5 4eb3002b211a430ad29b7c54e0697f2e
SHA1 6e7ddbaf4145d0d2e68fa5f17fc568633706675b
SHA512 cb787091661d7e2dfe44a103b1a92fe4fb317740e9989bee991bd39a79d695eade89437a25dda2257ae57b09d0d5aeca1231ccd3a58e6992183751f461e7d18a
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 288B
SHA256 5144e75bbb0f45d9628a80e3e12b5d538048baff17e3db71b6f934d9f32ab528
MD5 1cfb46814f4a1879f18495785f34e268
SHA1 0ff2bc050924ef6bb958042d54473643411b91e8
SHA512 186ee4fa0ae16a2c2898168ed5204e588b97e4b2d408cb0cae6f7fa706bf98b807c2131be20971694e571a47b1cdf650c413bd82eda98ccd9bd3ecfa5b5d00b3
TLSH
T1BAD012E951CA5E95EF1C12B7906D4C0D32B44745714A0B838170F8991D9FFC84542895
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58ba14.TMP

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe58ba14.TMP
Size 48B
SHA256 77dc5540b95fd659b95eec612cae1779cdc7f587129bb163d17abedd01ac9cb4
MD5 53dd03415bcabcbf43de6bc3681307f1
SHA1 5f13321f4cd1d136f281dacbbb3f60c5c4192c7b
SHA512 d6115fd8f67f03542e651d68bd9d8c7c55144a320a9449d8d554f7b7f1f906001274ef44ceeb2ed6d528bc839c56bec8387d028810ac099bd7ca35be697784f9
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Local State
Size 2KB
SHA256 4ff5c6e28669c351fd8d9ca239f48140f5ccd94387f213b2329efb890c7c21e0
MD5 32c8addcc14301b9b88ccfec73ddccae
SHA1 34bbe7f18d872c625a417833408b6e5b674bb2fd
SHA512 87b5c871fe3dfd4394ffcf1d3192ccc68be958ef4eb0527ee0f93f04facbeacde75fa3e905ebf2bd66db31a137438d6be6373a9340454259c34c383810f83c6f
TLSH
T1F751B7737858AF7789E34544BE863F17EA3552768A612FA0A9EE0B1C03D725C3352C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Local State
Size 3KB
SHA256 656d8607e8b709a93f87955743b707671a5f569ad8fba59bcbb47f637780adcc
MD5 a92a451588b2a89cfcbb721703ab726a
SHA1 1dbb2d9d18c2677ce864d2ef564d383364550955
SHA512 38e33b7a08480d8757a628071383c416dfa1963d157b2ec31c07a08ca351b52365541674984a73ad4d1c013beda07d2177f973a923b21c1983bc61782211c913
TLSH
T13571B43268A8EA374DE39904B9C63B06B6655237D9903FA9D9FD0F0C02D73883352C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Local State
Size 16KB
SHA256 40e04173fc825961a6e2c78fabe4b5c26c66871fa52caee5939893e9fc20be69
MD5 57f6c40fb6b36de3b11db10c0e62eb11
SHA1 663d2b32e3827e2bc8e2d129b8d4800387eb2575
SHA512 abda7a50e57170b9285af5d300cb83f11ee83211a2c91cd08fe648500e5df71392f58d651ef6bab254d10ab67d8da8d15381a0d8cc69b828cb9964dfbed11490
SSDEEP 384:zL+aQikB+z/xvxjg/qhE2NbwcncqdJV89ze:e/UxvxjgC+yDdJWFe
TLSH
T14D729E3654697F2798B3F9057A890B5FDBB948B280816EB859FE5F0907C73D82342D06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Local State
Size 1KB
SHA256 08276d090801cbecdc48310428539f7e1e3aa765abde5dc99b663c05b8623ef3
MD5 7dd48f6b83e6730683ea20ec33a656cc
SHA1 73d374ba38ba9b7e23a4f33287e9f0ccd352a9a7
SHA512 30fa4cea165ef5f9b653f035a3d3ba9acec408e2a1d58cd01b7f7dc37834318eaa334d34020be7a81be5fd5de8c4946e4aa35eac5bab3a60c814d8bf81085241
TLSH
T18E3185B2A4942F735C925109B6437F5B6E30163BC1214F9875EF4B1803E328CF67AC26
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5848eb.TMP

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Local State~RFe5848eb.TMP
Size 1KB
SHA256 12e2261c7ebfb4ad28858fc186718a2cd40e069ca5b64fc2a06f7250c1a3b23b
MD5 a50e42e091a82e614dde0c387be6afc3
SHA1 e7c89470ed8c12535ab6a101566808c2cbb0d9f0
SHA512 e3e48850d21ebfd4671b7891d29c86243020ca143ccec5a58060246cd79fff5bddefbb1630a4de54038e21ffcd2fb8ac1b1a5d534571a625bc51383b1c605371
TLSH
T1222132B2D4986FB798524009B643BB8B2E205A6B81214F59B5EF471803E71DCB67BC36
MD5 SHA1 SHA512 TLSH

Submit Download

WebView2Loader.dll

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\WebView2Loader.dll
Size 161KB
SHA256 9468470d6a4d11179ec179183d130465a380e0dedfdbe1fc2ab404c86c45a85e
MD5 61f430f292f85b18b57f06ea6d3d8b82
SHA1 03e31a690fa32364fea5ce73498f234adc544cd0
SHA512 73dfd28a27c10984abb382b7d868b3812aa8d0c89435a45b5b242fa82cc7890b91b2e89bc86cdee039b721befaaf0d14506b6c9c86ecbce6ba6d97824eb22dfb
SSDEEP 3072:dX1/Z3TlTRTFOYfThTNTvDbS2bT4wdovPEKdIMsb1Z5AalipTkYEtJ5+POFEv:dDTlTRTFOYfThTNTvDhvZkPEKdI7pUEQ
TLSH
T12CF36C5772E5007BE16B8274C9A34A11E777B4510B60ABEF03A4477A1F237D4AE3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geoip

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\tor-runtime\data\geoip
Size 9.0MB
SHA256 af9ccd060a712d090ee07d5678b5d45b0038ec1573116fae724a6695a8485703
MD5 e9e0ee27f75255c81ee0d5352a0478aa
SHA1 b08bfe286dc8f11f29aaceafb6f7ef0f5c771042
SHA512 5547bc13552320720a132af6d9b122b75896f908ebeddb24d8218ef5075c38d21c7ef0ef6d5dd855b783c891c3aadd5fc362793e62974185e7eedeae47322413
SSDEEP 49152:j2qmvmL+vpS0uWjaD2X4wH2I58Ydqkztz9HkBo0podsEKopmzPrAMZARLhQIKL9Q:A
TLSH
T105A6F8A05271E9DAF3EA8797C9671C1D412BE01A222616B4F4C7F59E8D0FBC0D0B1E97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geoip6

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\tor-runtime\data\geoip6
Size 15.3MB
SHA256 2393124667ba2ccb4c806f226a33b2ef7a8188d1ba55831c1a5d3dca2b062514
MD5 4d1662e438f08fe4c913789c3f56d925
SHA1 9d85004fba941079cfe018f0599e6a337c4e45a1
SHA512 3fb3f440bc206a3645eb684b37606855c3d1d1d976463e45b96e7e069975aa18f4ca31ab9ed351533d56ee7e50bd7fd627b43d21d274133c5393a9b1b41905ec
SSDEEP 24576:eRqHqAVglkDRj8wHjVCpYcbwlihndEtmKco4MkQHLPTtshizhtBsNvubuw0oDL8l:Q
TLSH
T1BAF6DD7005BED7C5ABC8E1FF5690E86F4AA6F2DC361918D425B6DCB817E64074AEC203
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tor.exe

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\tor-runtime\tor\tor.exe
Size 9.7MB
SHA256 ec7708e0b43e0e00b1533d11ed3ca244e6f11cb2a7b62d319ad73a7b13123033
MD5 93110c343a740fca8e64cfe00472c527
SHA1 bb6abd60cfa979506bfc2c3b14c725a79cd5ddee
SHA512 d8510b0466104d02fc939806e1713d614c56488a0ded258e7bb8c1490b0839f7be054e5e56f3984012ec145049c7dbbcc0adf912dada78e4363201cd808baf75
SSDEEP 98304:+igyt48AHd7ERbHgshQKnRqNAtLnLisS1Km1mLg9wrHjzsZaUHaa+b:dgyt4hdcnLs1z1mL+ia
TLSH
T142A62947F27710DDC5BAC07892177223F9A13C8C81346B6B599097A62B70B68AF7EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VoidTools-Setup-v2.1.8-win64.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-6WWK5LXY28.tmp\VoidTools-Setup-v2.1.8-win64.tmp
Size 4.2MB
SHA256 7e00bb3e5b59d66f072fad99723343d31ba2a68723fbe6d45d9c8363664417fd
MD5 4c7071763b9a5e84c78d7220504cda74
SHA1 d09106f2bd27da56dcd994543c0b2b92d24901c7
SHA512 885128d1c019cb2e562f17ad4c789aed715d0817e2275d27d714cb79652178d697643c43d431eca4a462fad55cb1eb3f0f3df7215c9b08c3d981460567285ad8
SSDEEP 98304:h9SZUvl30aj90ZFcvdQ0hdgvminQLMj+Jb3338:+ItJj90Z6RgKwT
TLSH
T161168E03B388753EE4B71E3A883FA654583F7A213A16CD4B6BF4099C4F396416D2A747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cached-microdesc-consensus

Path C:\Users\Admin\AppData\Local\VoidTools\Tor\Data\cached-microdesc-consensus
Size 3.5MB
SHA256 10242e71383e62972b65dd290a44ead89aac3dbdc9d0dfb73c9c2521107c95d7
MD5 8dab64c97a3497bc93bafa5143f9472f
SHA1 605c2e1dd5ffabfb244ce2f3f971bb25feafb6e7
SHA512 5c52043a0d5284445eaf6bbd0a9d42226e373d70d2ab5941811e0223c7e1175796666238a6d2021568a1e08f33ec71fdd5ae5b19fc332561d52313682ba358a2
SSDEEP 24576:hiuOHjhSSDwU5Ted62slc/8bmBSuFH7+HHGZaoxIaj:43g9PdvO0HIk
TLSH
T17CF554EA97124EEAD32A09DBE510FF7BF33F5725C2486B94286F48FA7205091752093D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cached-microdescs.new

Path C:\Users\Admin\AppData\Local\VoidTools\Tor\Data\cached-microdescs.new
Size 16.1MB
SHA256 c0aea03d686b373cb02e48ebb12db45de302496736795852f7b52efe26055d43
MD5 ed2c2599d9d3c2ca1f5af8f7f6e1af1a
SHA1 d2344f37d881e73e1c0345c248869918120bf0d2
SHA512 ab349bf6fb032343c282907da361598069fef28ee9d443340a4e59f4ebdb725f5cddc12fbe63c344bc8e4361e0de5bdd796da2ffce173bedd995e33725935a16
SSDEEP 24576:JbVnCmV3jImxiVR3VZsNV1G/iVtwV4vY3VdoYV1VzbN3VTVbVwmXWVrVhVnaGlDW:7Ht0zjwVf7Pzbu
TLSH
T1A307AEDA899B00C14E05E7CDEC2207C3DB144A3E4B5041A176AAB66B7F7329FC55EE39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.html

Path C:\Users\Admin\AppData\Local\VoidTools\WebUI\index.html
Size 1.0MB
SHA256 3857fe09a9e636f6da427f39a4757eaea1a2a6889639bd398e36bbe29fe1af7c
MD5 136c33e1f5b14538854b171466ee3108
SHA1 26d315f32056066b953da80c44452b7129b4a55d
SHA512 305bf67424822d96e045a58293ef4f9ceed17da79199533ad352b2829bf6956411592aa5c2bb20b7ebd1a8a2cccdaa27db68c1c6141ead5561c8fd3f8c052965
SSDEEP 12288:S8ns2/x9RaUa9/vzzQfzice9cS5Ynk+xZKkKKzCDiIUaEGSBH6:Xd/x9L6Z5YHKKzCLEGOa
TLSH
T15C352857F15777B9BA3308A9603F810CB22F9498CA0E48B8F4B4749921998C4BB77FD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1076-42-0x0000000000F70000-0x0000000000F71000-memory.dmp

Download

memory/1076-39-0x0000000000AC0000-0x0000000000EFA000-memory.dmp

Download

memory/1076-82-0x0000000000AC0000-0x0000000000EFA000-memory.dmp

Download

memory/1076-5-0x0000000000F70000-0x0000000000F71000-memory.dmp

Download

memory/1076-86-0x0000000000AC0000-0x0000000000EFA000-memory.dmp

Download

memory/2240-107-0x00007FF85F4A0000-0x00007FF85F4A1000-memory.dmp

Download

memory/2240-355-0x000001EDC9450000-0x000001EDC94FE000-memory.dmp

Download

memory/2240-382-0x000001EDC9450000-0x000001EDC94FE000-memory.dmp

Download

memory/5152-38-0x0000000000F50000-0x000000000102F000-memory.dmp

Download

memory/5152-0-0x0000000000F50000-0x000000000102F000-memory.dmp

Download

memory/5152-106-0x0000000000F50000-0x000000000102F000-memory.dmp

Download

memory/5532-196-0x00007FF85F4A0000-0x00007FF85F4A1000-memory.dmp

Download

memory/5532-367-0x0000014F31F40000-0x0000014F31FEE000-memory.dmp

Download