556d44ab135692ef741d19ef920ac1f6a3d4beddb30f0f423c7b928c9c977d65

Analysis

max time kernel
150s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 22:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VoidTools-Setup-v2.1.9-win64.exe
Size 18.3MB
Sample260809-2p8j6swhmd
SHA256 556d44ab135692ef741d19ef920ac1f6a3d4beddb30f0f423c7b928c9c977d65
MD5 313edeb17258bedfb30f89820422fccb
SHA1 2280c27a44bec002b8b7655800a0b6d0c1390aea
SHA512 c0704395ec867da4812ca5383c1978fc1a73ba19a22db27a8e67ab886946df87159cc2bde1843fb83ec5fcb033c7cdb14751028dca618ff2f6e00fb4c8efe061
SSDEEP 393216:7WF2xuBgtTf4bJFTJcXteCHRw67H58CtH6H0/N/1i7U:dABgx4J1JcXIyw6NJK2N/1cU
TLSH
T1F117333FB24B663EE0291A757AB2E910943B7B6169534C0697F4C48DDF250B02E3E787
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery installer trojan

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
4572	VoidTools-Setup-v2.1.9-win64.tmp
4352	VoidTools.exe
3188	tor.exe

Loads dropped DLL 1 IoCs

pid	Process
4352	VoidTools.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	VoidTools.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping944_640489628\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping944_640489628\_platform_specific\win_x64\widevinecdm.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping944_640489628\_platform_specific\win_x64\widevinecdm.dll.sig	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping944_640489628\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping944_640489628\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping944_640489628\manifest.json	msedgewebview2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VoidTools-Setup-v2.1.9-win64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VoidTools-Setup-v2.1.9-win64.tmp

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/1940-1-0x00000000007A0000-0x000000000087F000-memory.dmp	innosetup
behavioral2/memory/1940-8-0x00000000007A0000-0x000000000087F000-memory.dmp	innosetup
behavioral2/memory/1940-70-0x00000000007A0000-0x000000000087F000-memory.dmp	innosetup

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4572	VoidTools-Setup-v2.1.9-win64.tmp
4572	VoidTools-Setup-v2.1.9-win64.tmp

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
944	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4572	VoidTools-Setup-v2.1.9-win64.tmp

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 4572	1940	VoidTools-Setup-v2.1.9-win64.exe	89
PID 4572 wrote to memory of 4352	4572	VoidTools-Setup-v2.1.9-win64.tmp	90
PID 4352 wrote to memory of 3188	4352	VoidTools.exe	91
PID 4352 wrote to memory of 944	4352	VoidTools.exe	93
PID 944 wrote to memory of 3548	944	msedgewebview2.exe	94
PID 944 wrote to memory of 2964	944	msedgewebview2.exe	95
PID 944 wrote to memory of 2964	944	msedgewebview2.exe	95
PID 944 wrote to memory of 2964	944	msedgewebview2.exe	95
PID 944 wrote to memory of 2964	944	msedgewebview2.exe	95
PID 944 wrote to memory of 1376	944	msedgewebview2.exe	96
PID 944 wrote to memory of 5416	944	msedgewebview2.exe	97
PID 944 wrote to memory of 5416	944	msedgewebview2.exe	97
PID 944 wrote to memory of 5416	944	msedgewebview2.exe	97
PID 944 wrote to memory of 5892	944	msedgewebview2.exe	98
PID 944 wrote to memory of 5892	944	msedgewebview2.exe	98
PID 944 wrote to memory of 5892	944	msedgewebview2.exe	98
PID 944 wrote to memory of 5892	944	msedgewebview2.exe	98
PID 944 wrote to memory of 5892	944	msedgewebview2.exe	98
PID 944 wrote to memory of 4708	944	msedgewebview2.exe	103
PID 944 wrote to memory of 4708	944	msedgewebview2.exe	103
PID 944 wrote to memory of 4708	944	msedgewebview2.exe	103

C:\Users\Admin\AppData\Local\Temp\VoidTools-Setup-v2.1.9-win64.exe
"C:\Users\Admin\AppData\Local\Temp\VoidTools-Setup-v2.1.9-win64.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Users\Admin\AppData\Local\Temp\is-5AEPBXE9R8.tmp\VoidTools-Setup-v2.1.9-win64.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-5AEPBXE9R8.tmp\VoidTools-Setup-v2.1.9-win64.tmp" /SL5="$50222,18015875,853504,C:\Users\Admin\AppData\Local\Temp\VoidTools-Setup-v2.1.9-win64.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4572
- - C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe
    "C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks whether UAC is enabled
    - Suspicious use of WriteProcessMemory
    PID:4352
  - - C:\Users\Admin\AppData\Local\Programs\VoidTools\tor-runtime\tor\tor.exe
      "C:\Users\Admin\AppData\Local\Programs\VoidTools\tor-runtime\tor\tor.exe" -f NUL --ignore-missing-torrc --ClientOnly 1 --AvoidDiskWrites 1 --SafeSocks 1 --SocksPort "127.0.0.1:9150" --DataDirectory "C:\Users\Admin\AppData\Local\VoidTools\Tor\Data" --SafeLogging 1 --Log "notice stdout" --GeoIPFile "C:\Users\Admin\AppData\Local\Programs\VoidTools\tor-runtime\data\geoip" --GeoIPv6File "C:\Users\Admin\AppData\Local\Programs\VoidTools\tor-runtime\data\geoip6"
      4⤵
      Executes dropped EXE
      PID:3188
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=VoidTools.exe --webview-exe-version=2.1.9 --user-data-dir="C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --enable-features=MojoIpcz,msWebView2EnableDraggableRegions --mojo-named-platform-channel-pipe=4352.1240.3417540135762162702 /pfhostedapp:883a1e44c6e89cfeac157e48235313332773ec67
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of WriteProcessMemory
      PID:944
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView /prefetch:4 /pfhostedapp:883a1e44c6e89cfeac157e48235313332773ec67 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffab4d45fd8,0x7ffab4d45fe4,0x7ffab4d45ff0
        5⤵
        
        PID:3548
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView" --webview-exe-name=VoidTools.exe --webview-exe-version=2.1.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1772 --field-trial-handle=1776,i,4905228956607253364,9158752859543327020,262144 --enable-features=MojoIpcz,msWebView2EnableDraggableRegions --variations-seed-version /prefetch:2 /pfhostedapp:883a1e44c6e89cfeac157e48235313332773ec67
        5⤵
        
        PID:2964
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView" --webview-exe-name=VoidTools.exe --webview-exe-version=2.1.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2192 --field-trial-handle=1776,i,4905228956607253364,9158752859543327020,262144 --enable-features=MojoIpcz,msWebView2EnableDraggableRegions --variations-seed-version /prefetch:3 /pfhostedapp:883a1e44c6e89cfeac157e48235313332773ec67
        5⤵
        
        PID:1376
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView" --webview-exe-name=VoidTools.exe --webview-exe-version=2.1.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2316 --field-trial-handle=1776,i,4905228956607253364,9158752859543327020,262144 --enable-features=MojoIpcz,msWebView2EnableDraggableRegions --variations-seed-version /prefetch:8 /pfhostedapp:883a1e44c6e89cfeac157e48235313332773ec67
        5⤵
        
        PID:5416
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView" --webview-exe-name=VoidTools.exe --webview-exe-version=2.1.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3444 --field-trial-handle=1776,i,4905228956607253364,9158752859543327020,262144 --enable-features=MojoIpcz,msWebView2EnableDraggableRegions --variations-seed-version /pfhostedapp:883a1e44c6e89cfeac157e48235313332773ec67 /prefetch:1
        5⤵
        
        PID:5892
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView" --webview-exe-name=VoidTools.exe --webview-exe-version=2.1.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4476 --field-trial-handle=1776,i,4905228956607253364,9158752859543327020,262144 --enable-features=MojoIpcz,msWebView2EnableDraggableRegions --variations-seed-version /prefetch:8 /pfhostedapp:883a1e44c6e89cfeac157e48235313332773ec67
        5⤵
        
        PID:4708

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VoidTools.exe

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe
Size 20.5MB
SHA256 2625f4810b6cb56fe495c7e439bf6b16966249a9386a0ad752b6836d629924ec
MD5 f60adc54be4f1a838f77d986c0196e5f
SHA1 e2903b2f44ae5098dc1d59390d30f32189007f1c
SHA512 8339c37888d41df591bb761857a5c9063e5f62eb5748b5b4318abd67d9a529c71bd07f9932787139df473be2f3e6d6623504d31b91866df2a5b22498645ce5cc
SSDEEP 393216:WbCbQTHsp91jrgqkn6aARSCWAydxpjMoRc6isw5YBVoasojQcx91XaA:WbCbQyyd0oRsq
TLSH
T14A27AE6AF37800E8D4A7C1B8C6465617D772744943B05BDF2A90AAF61F63AE01F7BB01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 6df2203f0200c4567ec652ee0b5a732a36c727807aac4567bc3f9ecc83f0eba4
MD5 84120e3e3c4506d9c840ad698ba2472f
SHA1 2f18ba166b9d17ba05d7c65e510bab6a04743c05
SHA512 a1ea6b3b01a470ccd783df6f6f66d2c408436c25a8818854f54b43ae6650a75d9e69be4919b670bc2606c737ef097e6713ec7c0e7bd88eb50f442d8c0d099b95
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 7f4aae48a2da2ad344cc7e5cf2cc0eea4d2a5b60cfe37ba37a0e3eabd893fc52
MD5 6708611e83f2e7ed35e203e4708520b2
SHA1 06ffc4b444712ec7fd1cbe284c8fd763d321fa82
SHA512 2784ebae0bd3742fdba0bdf3adfd92f5ec85ea95ee13eca9402eaad8c477944e163b521ab39d5686ea306c58bde3a2bcfcce367e24182ec608ba0ade2b11cf67
TLSH
T1FED012223F024538C0103133008371885440C20B400DC004F839891D2B140941D12481
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 288B
SHA256 e28e12c83f415b0f155c9f88d7f9f160dcc9c9c2f0605fbf57e1b11e97e4f6dd
MD5 7f5683389dbbdb607dd416911b95063e
SHA1 1c7b857e8d858c66fd495640fa1f9098de92a8aa
SHA512 4e739cdbc1f631004441bfbe5a2134562344c92de1fd257b6582fcf41e0b7eaf298869eda0e19669386e33c89bcbf748b9e9f096c35744221659e4a22fb643ef
TLSH
T16BD0120E50CA8D52DF7813F5A06E7C9931984B8771934F836190AFAB69432C94B468D1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a0dfb.TMP

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5a0dfb.TMP
Size 48B
SHA256 60a04249986d0e5636c47938fc66c8ba91054a4e0d717051df888d4c3fe0d342
MD5 69a3a075b080a6f1786122000d45e596
SHA1 2ff152dafe8a2c778da01fbdc712a86d8ee3f83f
SHA512 ce3903e69aeb1441c6b8dcd7ad088f3a09903919ee1810d2a127ecac4efc49d707ea63c517b2e415c9620a611ec1cc0deba89e940638c58b1cf0d0effcdde028
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Default\Network\Network Persistent State
Size 856B
SHA256 08198dbddb8bf0754bc130f9a57b899f18eb11019bcfead38b26a7e87e81ffb1
MD5 2b2870b2890d3ebeb87cfdb526d8918b
SHA1 9343939fc4944b543320865e727b8fbdb8fc987f
SHA512 bea213f9cb1fec7d2e5318931232cdd8c3d9ff9817d713bd5fa8c793af74cca3d29568b5ee315bf2135544ff24e80d6d5fdf474495afd794b095337aea8a7d51
TLSH
T153118CA2E3B106ACD77112F42D682D17DFAD195913AC3D4AC6C8B79F53F0874D24054E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5aac00.TMP

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Default\Network\Network Persistent State~RFe5aac00.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Default\Site Characteristics Database\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

d68ad6ce-1e8b-4b41-9bf3-ab251289fe2d.tmp

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Default\d68ad6ce-1e8b-4b41-9bf3-ab251289fe2d.tmp
Size 6KB
SHA256 e90449258861ea7800de8a075fdb6db983cd54539fda8f0b1ac59a9523ed06e7
MD5 ec2f9d4c98550ee79cab0c6b76030b14
SHA1 d02084b037bc5574e87cea66fa53f6979eb30b13
SHA512 27245ba532243b6e543ca0a2f6109a7b3151f4353dc3a8c7f1917574d713f4ac46f2d326a7f566fe3bc589199f4eaea341f0280732ed03754f716e157aa96838
SSDEEP 96:st7/dzINDFb92kxo5h16ZHIs7/x+6MhmuecRO21eje/K+gY28XM1C7K:stDpI0socIsV+FdO2Qj9aG6K
TLSH
T176D1A8026E28797B4CCAE158BE36BA13E2F6543265D11E58EBF9461C04DB6DC6317C07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Local State
Size 3KB
SHA256 128e18d81cb656673efc67a0021823974f9ccb72cd3f6388a0bef017fdbd7704
MD5 2fada5c3cbfb88a0e677047f7bdcda10
SHA1 79bf11e0c5757a5a1c5f184cd3601e8bfaf868ee
SHA512 acd1fd487ff3dacc6f6d25995c4b758666a3d9a0e35d4d4989cca4401e8677502bad98e9514d8744d9373d3da78d6afa71220eb931f3affe6a60734b69967f2e
TLSH
T166718436A974A9374DF2DA45BC863B13A6649063EA817FA5D6EC0F0C02D72CC1342C2B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Local State
Size 2KB
SHA256 e6e7fc7f9607127825bce39ce709ad68f00887c1be4e101052bd0a16d466c5bd
MD5 289b7902d76c99cc751a79f6880b7c6b
SHA1 126eb3fdc3d97c4cb522cec68674f9c40b8a7a04
SHA512 77cb4b671ffb7c235cfa207ddf1cc3429376d069854648af6c02da30a667959384e9b9ef78c07570bbc81b485b5b915c4cefde0dd97351ee8990c845e612c6ce
TLSH
T11F5195736814AB3799F647487D473F23CA389052AB522F60A6DD1B0C01C765D2346C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Local State
Size 3KB
SHA256 0883a3e6ade827824bb521c77abfdb1c2c5ec1dccf624b161280f75c6188719f
MD5 a5fc140296f7a1d2ec8c476dea06ccc8
SHA1 9abed6fd21573605603f62d5a3fae16257940fc5
SHA512 e18dfb82002f068c35438e267357e479a015d5ef1dbfe8068c61d1dc3336cf0d4437ff3cc7f37753de30b046f02f66247898ff64f65bf9d585ec396490b03adf
TLSH
T16E6175776974A9374DF69A45BC862B17A7645023EA957FA4D6EC0F0C01D738C1342C1B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Local State
Size 15KB
SHA256 90cadb5c71c752bd8f72925890a7bd3e9b93da816c71750990ba615d8e65066b
MD5 d87c9aff0744375feb3afd8f16f7d3e8
SHA1 072299783873827e365cc3c01a2a2fd99b34f8f2
SHA512 aa50f4e4fe377c7489c08e12bea136517b6286a1be7222de5adcb613a6cd67d6c19f6f8592dd8723b9a07c22a3784b1320af7d84934233b9e6e5df96a1788b2f
SSDEEP 384:j+aQikB+z/xvxjg/qhEcNBSvUMpwAVdpPT9zX:C/UxvxjgC+QOwUPTFX
TLSH
T116729E2759397D23A5F7EA057D4E0B8BCAB894B351C16DB44ABD6F0D06C72D81302C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe599531.TMP

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Local State~RFe599531.TMP
Size 1KB
SHA256 9bd45313ae19bab49786e2c6c89b1b752ea628b68aa734a9068893b894f98243
MD5 2a649bc82ddf7d36821844a0f34d0061
SHA1 3fb5cf8df6084d997c49912a27a656ffe3408be2
SHA512 2e43956cc44ac33473921ce5558335abe744ec0bc8f1be57f700ef4b0c44e1611b0d9c47c0fca3ca66662df4a667c1628e3e2c6f7fd749b70aefb020c0d26b2c
TLSH
T1102192B3D4645B33ADA5578A35436B639E20806393918F5072DE4B1C07D718DA22BC3B
MD5 SHA1 SHA512 TLSH

Submit Download

WebView2Loader.dll

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\WebView2Loader.dll
Size 161KB
SHA256 9468470d6a4d11179ec179183d130465a380e0dedfdbe1fc2ab404c86c45a85e
MD5 61f430f292f85b18b57f06ea6d3d8b82
SHA1 03e31a690fa32364fea5ce73498f234adc544cd0
SHA512 73dfd28a27c10984abb382b7d868b3812aa8d0c89435a45b5b242fa82cc7890b91b2e89bc86cdee039b721befaaf0d14506b6c9c86ecbce6ba6d97824eb22dfb
SSDEEP 3072:dX1/Z3TlTRTFOYfThTNTvDbS2bT4wdovPEKdIMsb1Z5AalipTkYEtJ5+POFEv:dDTlTRTFOYfThTNTvDhvZkPEKdI7pUEQ
TLSH
T12CF36C5772E5007BE16B8274C9A34A11E777B4510B60ABEF03A4477A1F237D4AE3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geoip

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\tor-runtime\data\geoip
Size 9.0MB
SHA256 af9ccd060a712d090ee07d5678b5d45b0038ec1573116fae724a6695a8485703
MD5 e9e0ee27f75255c81ee0d5352a0478aa
SHA1 b08bfe286dc8f11f29aaceafb6f7ef0f5c771042
SHA512 5547bc13552320720a132af6d9b122b75896f908ebeddb24d8218ef5075c38d21c7ef0ef6d5dd855b783c891c3aadd5fc362793e62974185e7eedeae47322413
SSDEEP 49152:j2qmvmL+vpS0uWjaD2X4wH2I58Ydqkztz9HkBo0podsEKopmzPrAMZARLhQIKL9Q:A
TLSH
T105A6F8A05271E9DAF3EA8797C9671C1D412BE01A222616B4F4C7F59E8D0FBC0D0B1E97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geoip6

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\tor-runtime\data\geoip6
Size 15.3MB
SHA256 2393124667ba2ccb4c806f226a33b2ef7a8188d1ba55831c1a5d3dca2b062514
MD5 4d1662e438f08fe4c913789c3f56d925
SHA1 9d85004fba941079cfe018f0599e6a337c4e45a1
SHA512 3fb3f440bc206a3645eb684b37606855c3d1d1d976463e45b96e7e069975aa18f4ca31ab9ed351533d56ee7e50bd7fd627b43d21d274133c5393a9b1b41905ec
SSDEEP 24576:eRqHqAVglkDRj8wHjVCpYcbwlihndEtmKco4MkQHLPTtshizhtBsNvubuw0oDL8l:Q
TLSH
T1BAF6DD7005BED7C5ABC8E1FF5690E86F4AA6F2DC361918D425B6DCB817E64074AEC203
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tor.exe

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\tor-runtime\tor\tor.exe
Size 9.7MB
SHA256 ec7708e0b43e0e00b1533d11ed3ca244e6f11cb2a7b62d319ad73a7b13123033
MD5 93110c343a740fca8e64cfe00472c527
SHA1 bb6abd60cfa979506bfc2c3b14c725a79cd5ddee
SHA512 d8510b0466104d02fc939806e1713d614c56488a0ded258e7bb8c1490b0839f7be054e5e56f3984012ec145049c7dbbcc0adf912dada78e4363201cd808baf75
SSDEEP 98304:+igyt48AHd7ERbHgshQKnRqNAtLnLisS1Km1mLg9wrHjzsZaUHaa+b:dgyt4hdcnLs1z1mL+ia
TLSH
T142A62947F27710DDC5BAC07892177223F9A13C8C81346B6B599097A62B70B68AF7EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VoidTools-Setup-v2.1.9-win64.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-5AEPBXE9R8.tmp\VoidTools-Setup-v2.1.9-win64.tmp
Size 4.2MB
SHA256 3759134163c61d3c53a4a84b742ed097dfd9c1c72a2e19d992da145eb46cd57c
MD5 4e8f7c0672cce60b955b6696cc3f401d
SHA1 f656387203c4b98fedafd2e708b8744c58329dcb
SHA512 8d1b21d147027098d31b5bee869095e527bbdc7bce1fa15f8db22fc7a0c0ab824faca6eb0c5a2528b36d1adfc33afbe11e57f00b69ae7b8bab22fcc33029eb50
SSDEEP 98304:h9SZUvl30aj90ZFcvdQ0hdgvminQLMj+Jb333s:+ItJj90Z6RgKwD
TLSH
T16B168E03B388753EE4B71E3A883FA654583F7A213A16CD4B6BF4099C4F396416D2A747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cached-microdesc-consensus

Path C:\Users\Admin\AppData\Local\VoidTools\Tor\Data\cached-microdesc-consensus
Size 3.4MB
SHA256 e5fd774a3b867c2a5a7dae07bb8c16e5187c77152839da29a9588d833d27e375
MD5 14ae54c0333f63f26393f5b210a7b78b
SHA1 4817057d14f2cd3085735715203be0ec6739f0d9
SHA512 d3af28cb876fcfe8577d01ab7b75bfa0fb8fb9ae289d3d830bbc20e9784cd81325ad7cf221f8d269d0ff7193003d5119e17cb1f70fa39368c39e7a5c5c627e98
SSDEEP 24576:A1EnlM8qP1rejFQ4PYGqF8Z4UYs0Ckz6+31t1YW4:AaeDFT4P90nq
TLSH
T1FBF543EA97124EEAD32A09DBE510FF7BF33F5725C2486B94286F48FA7205091752093D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cached-microdescs.new

Path C:\Users\Admin\AppData\Local\VoidTools\Tor\Data\cached-microdescs.new
Size 19.3MB
SHA256 cc3662a615ad700986ba61ee61ed10951454f4b6b8f1ddc7670c70a3564e84c1
MD5 15c14793fdd020dba3e4c6f1cff5c094
SHA1 8930c2ab96a67d875146be961bab413bc19e9572
SHA512 6c95d163b72044bb5dea9167151241e417537866a28ceb7937fcbb1b71ab4eb52f7747929fd0fe0ea60fc6923ad40ee6b3cdccf96e4886cc91ce74b708a2e03c
SSDEEP 24576:g7VwLnfrSB1eVMMIV1i8V0IkxVr7VNR7K1VdVzVau2VuVXV8PMWTEVhVIVZFVg3D:SBw6E/igUyoxweBft
TLSH
T15517AEDA899B04C14E09E7CDEC2607C3DF144B3E0A5441A162ABB56B7F7329EC15EE39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.html

Path C:\Users\Admin\AppData\Local\VoidTools\WebUI\index.html
Size 1.1MB
SHA256 cd8fb8dfe4068539554441f74fd520f432321375abdcc60b2b880d0727f7a669
MD5 82cada1080eeecef3b51746daab1d2d7
SHA1 1c466bcd4707c4eb194494b2ca3cd26b45303173
SHA512 7ee2c37ec1f1345b9270ac15a68957e5f5e433ce799a123652713b88600f8b01656dc275c44b296792aa3c807fb9079b970dabbaf998d1e45ec7dd98b4508e4b
SSDEEP 12288:mRDalGiquzata9/LzzsCVDEjAJEdk+xZK7ElG2rkV5LFar0/wHV:aGlkuy3cJEe8G2rgFPY1
TLSH
T112353956F1567AF9BA3708E9602FD20CB22F9488CE0B48B8F4B4B45911858C4BB77FD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1940-70-0x00000000007A0000-0x000000000087F000-memory.dmp

Download

memory/1940-1-0x00000000007A0000-0x000000000087F000-memory.dmp

Download

memory/1940-8-0x00000000007A0000-0x000000000087F000-memory.dmp

Download

memory/2964-169-0x00007FFAD6990000-0x00007FFAD6991000-memory.dmp

Download

memory/4572-69-0x0000000000730000-0x0000000000B6A000-memory.dmp

Download

memory/4572-68-0x0000000000730000-0x0000000000B6A000-memory.dmp

Download

memory/4572-12-0x0000000000730000-0x0000000000B6A000-memory.dmp

Download

memory/4572-10-0x00000000012D0000-0x00000000012D1000-memory.dmp

Download

memory/4572-9-0x0000000000730000-0x0000000000B6A000-memory.dmp

Download

memory/4572-6-0x00000000012D0000-0x00000000012D1000-memory.dmp

Download

memory/4708-367-0x00007FFAD57C0000-0x00007FFAD57C1000-memory.dmp

Download

memory/4708-366-0x00007FFAD6B80000-0x00007FFAD6B81000-memory.dmp

Download

memory/5892-187-0x00007FFAD6990000-0x00007FFAD6991000-memory.dmp

Download