b28d09951325afdf6d7e0a76d78668086a8336a50b65c9e98491574d33fee931

Analysis

max time kernel
151s
max time network
158s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/09/2026, 23:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VoidTools-Setup-v2.3.4-win64(1).exe
Size 83.9MB
Sample260926-3e2vbatena
SHA256 b28d09951325afdf6d7e0a76d78668086a8336a50b65c9e98491574d33fee931
MD5 b011060f2cb8a84b6804eecc301e1310
SHA1 a4287760bf421001cfb003f148b852a52b4effb1
SHA512 92e96979d5ae100e306506747ee3151355e6e72dace79ff7b62cce6f4e1ebb403714f399295e17eea476eab16414b448b4427e9e4a3769a384a8fac8c01b2b7f
SSDEEP 1572864:Hwgzds1GLg8p+uVzob819fvLUNWE9Luod5VkfFMNvOcI2vrKrt8gN8x9B/f6zUT+:Qos1GkWqgfjgWsLuK5Vk9OI2urt8mkBe
TLSH
T14C18333B724BA13CE51D9F3A7BB3D614583F666065664E0689E8C8DCDF260701E3E782
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery installer trojan

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
1356	VoidTools-Setup-v2.3.4-win64(1).tmp
3316	VoidTools.exe
1636	tor.exe

Loads dropped DLL 1 IoCs

pid	Process
3316	VoidTools.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	VoidTools.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 17 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4264_1739428581\Part-ES	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4264_1739428581\Part-IT	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4264_1739428581\Part-NL	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4264_1534300297\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4264_1739428581\Filtering Rules	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4264_1739428581\Filtering Rules-AA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4264_1739428581\Filtering Rules-CA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4264_1739428581\Part-DE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4264_1739428581\Part-FR	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4264_1739428581\adblock_snippet.js	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4264_1739428581\Part-RU	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4264_1534300297\protocols.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4264_1739428581\Part-ZH	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4264_1739428581\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4264_1534300297\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4264_1739428581\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4264_1739428581\manifest.json	msedgewebview2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VoidTools-Setup-v2.3.4-win64(1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VoidTools-Setup-v2.3.4-win64(1).tmp

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/4728-1-0x0000000000210000-0x00000000002EF000-memory.dmp	innosetup
behavioral2/memory/4728-9-0x0000000000210000-0x00000000002EF000-memory.dmp	innosetup
behavioral2/memory/4728-89-0x0000000000210000-0x00000000002EF000-memory.dmp	innosetup

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1356	VoidTools-Setup-v2.3.4-win64(1).tmp
1356	VoidTools-Setup-v2.3.4-win64(1).tmp

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4264	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1356	VoidTools-Setup-v2.3.4-win64(1).tmp

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4728 wrote to memory of 1356	4728	VoidTools-Setup-v2.3.4-win64(1).exe	89
PID 1356 wrote to memory of 3316	1356	VoidTools-Setup-v2.3.4-win64(1).tmp	91
PID 3316 wrote to memory of 1636	3316	VoidTools.exe	92
PID 3316 wrote to memory of 4264	3316	VoidTools.exe	94
PID 4264 wrote to memory of 5536	4264	msedgewebview2.exe	95
PID 4264 wrote to memory of 3528	4264	msedgewebview2.exe	96
PID 4264 wrote to memory of 3528	4264	msedgewebview2.exe	96
PID 4264 wrote to memory of 3528	4264	msedgewebview2.exe	96
PID 4264 wrote to memory of 3528	4264	msedgewebview2.exe	96
PID 4264 wrote to memory of 3768	4264	msedgewebview2.exe	97
PID 4264 wrote to memory of 4088	4264	msedgewebview2.exe	98
PID 4264 wrote to memory of 4088	4264	msedgewebview2.exe	98
PID 4264 wrote to memory of 4088	4264	msedgewebview2.exe	98
PID 4264 wrote to memory of 1388	4264	msedgewebview2.exe	99
PID 4264 wrote to memory of 1388	4264	msedgewebview2.exe	99
PID 4264 wrote to memory of 1388	4264	msedgewebview2.exe	99
PID 4264 wrote to memory of 1388	4264	msedgewebview2.exe	99
PID 4264 wrote to memory of 1388	4264	msedgewebview2.exe	99
PID 4264 wrote to memory of 1644	4264	msedgewebview2.exe	102
PID 4264 wrote to memory of 1644	4264	msedgewebview2.exe	102
PID 4264 wrote to memory of 1644	4264	msedgewebview2.exe	102
PID 4264 wrote to memory of 1924	4264	msedgewebview2.exe	103
PID 4264 wrote to memory of 1924	4264	msedgewebview2.exe	103
PID 4264 wrote to memory of 1924	4264	msedgewebview2.exe	103

C:\Users\Admin\AppData\Local\Temp\VoidTools-Setup-v2.3.4-win64(1).exe
"C:\Users\Admin\AppData\Local\Temp\VoidTools-Setup-v2.3.4-win64(1).exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4728
- C:\Users\Admin\AppData\Local\Temp\is-2IGEKVCV6H.tmp\VoidTools-Setup-v2.3.4-win64(1).tmp
  "C:\Users\Admin\AppData\Local\Temp\is-2IGEKVCV6H.tmp\VoidTools-Setup-v2.3.4-win64(1).tmp" /SL5="$501A6,86777420,853504,C:\Users\Admin\AppData\Local\Temp\VoidTools-Setup-v2.3.4-win64(1).exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1356
- - C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe
    "C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks whether UAC is enabled
    - Suspicious use of WriteProcessMemory
    PID:3316
  - - C:\Users\Admin\AppData\Local\Programs\VoidTools\tor-runtime\tor\tor.exe
      "C:\Users\Admin\AppData\Local\Programs\VoidTools\tor-runtime\tor\tor.exe" -f NUL --ignore-missing-torrc --ClientOnly 1 --AvoidDiskWrites 1 --SafeSocks 1 --SocksPort "127.0.0.1:9150" --DataDirectory "C:\Users\Admin\AppData\Local\VoidTools\Tor\Data" --SafeLogging 1 --Log "notice stdout" --GeoIPFile "C:\Users\Admin\AppData\Local\Programs\VoidTools\tor-runtime\data\geoip" --GeoIPv6File "C:\Users\Admin\AppData\Local\Programs\VoidTools\tor-runtime\data\geoip6"
      4⤵
      Executes dropped EXE
      PID:1636
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=VoidTools.exe --webview-exe-version=2.3.4 --user-data-dir="C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --enable-features=MojoIpcz,msWebView2EnableDraggableRegions --mojo-named-platform-channel-pipe=3316.6072.17687393796670198565 /pfhostedapp:883a1e44c6e89cfeac157e48235313332773ec67
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of WriteProcessMemory
      PID:4264
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView /prefetch:4 /pfhostedapp:883a1e44c6e89cfeac157e48235313332773ec67 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffeaf135fd8,0x7ffeaf135fe4,0x7ffeaf135ff0
        5⤵
        
        PID:5536
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView" --webview-exe-name=VoidTools.exe --webview-exe-version=2.3.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1700 --field-trial-handle=1708,i,5148287497758757912,1709046582724181321,262144 --enable-features=MojoIpcz,msWebView2EnableDraggableRegions --variations-seed-version /prefetch:2 /pfhostedapp:883a1e44c6e89cfeac157e48235313332773ec67
        5⤵
        
        PID:3528
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView" --webview-exe-name=VoidTools.exe --webview-exe-version=2.3.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2112 --field-trial-handle=1708,i,5148287497758757912,1709046582724181321,262144 --enable-features=MojoIpcz,msWebView2EnableDraggableRegions --variations-seed-version /prefetch:3 /pfhostedapp:883a1e44c6e89cfeac157e48235313332773ec67
        5⤵
        
        PID:3768
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView" --webview-exe-name=VoidTools.exe --webview-exe-version=2.3.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2388 --field-trial-handle=1708,i,5148287497758757912,1709046582724181321,262144 --enable-features=MojoIpcz,msWebView2EnableDraggableRegions --variations-seed-version /prefetch:8 /pfhostedapp:883a1e44c6e89cfeac157e48235313332773ec67
        5⤵
        
        PID:4088
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView" --webview-exe-name=VoidTools.exe --webview-exe-version=2.3.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3444 --field-trial-handle=1708,i,5148287497758757912,1709046582724181321,262144 --enable-features=MojoIpcz,msWebView2EnableDraggableRegions --variations-seed-version /pfhostedapp:883a1e44c6e89cfeac157e48235313332773ec67 /prefetch:1
        5⤵
        
        PID:1388
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView" --webview-exe-name=VoidTools.exe --webview-exe-version=2.3.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4524 --field-trial-handle=1708,i,5148287497758757912,1709046582724181321,262144 --enable-features=MojoIpcz,msWebView2EnableDraggableRegions --variations-seed-version /prefetch:8 /pfhostedapp:883a1e44c6e89cfeac157e48235313332773ec67
        5⤵
        
        PID:1644
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView" --webview-exe-name=VoidTools.exe --webview-exe-version=2.3.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4540 --field-trial-handle=1708,i,5148287497758757912,1709046582724181321,262144 --enable-features=MojoIpcz,msWebView2EnableDraggableRegions --variations-seed-version /prefetch:8 /pfhostedapp:883a1e44c6e89cfeac157e48235313332773ec67
        5⤵
        
        PID:1924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VoidTools.exe

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe
Size 42.9MB
SHA256 ffee7be1016d6db3ed383832560c16aa1315bb7a643b7c6c7e2ae0b0646cad38
MD5 fbb718519e8edcc6b0a63fde5d1ca51b
SHA1 2e03fccc07a09abc934d16a1d05d3094921dc1a8
SHA512 c4f36dbdf5f522176090f7581f2b46cdc1050b5db51b5472862c1f0aee1db08591231d26f812e832e4e00124e71a6fbde3f7263545cde276dc3065a9c938de4e
SSDEEP 393216:zveb3ngVeCBNL7ivFUDIK+XXgB4IF0a3D9bV5JQTQSM4Ggam1z73iv1TgbUvnZJu:zvu3ngEQEe6M6D
TLSH
T178A77D2B212405AEC486D676D5072D179325311BE3286EEF649C0F6F2BAB7DE1B36703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 db9bb84e7986ec728afa96d61df53aa558950a5939cadb7edbb909b1c204b7c0
MD5 0462a38c9389f7d5b2a936d04f98a587
SHA1 b92746ddd8ea3f3f19d2d4993c31f8e006ee57f8
SHA512 08e154d0e9f973a2aad21d097755252b2a8f3acc989d56f3e7c4a6959f8891fe2c182a12c687093b5ce79ffdc9f67335dc24c720a8804d747d937e59bae0902d
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 8ac438b3a6261e9ea29fea8a207c565c90b77dad1afb7f744fe445db67abf2da
MD5 3fb7297418d829511f3e2450d80d67c0
SHA1 356c4dc694b2b0bfd84e480acb6a5039410adb77
SHA512 5c975fd8e54baf8de86a4241d7df92ebb3ae72256f60d7c6fdc769fb6aa0e700db7fceaae0c76365135f2b41069725c3a0b303d8f8b933baa165e919c87ef023
TLSH
T11ED01223F3414278C01030330063750D1901C50BC04541419428852D1E0C4501F2A881
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 288B
SHA256 44c19e2f66808d50e4ec9fb136dabd3b9eda3e01dc1ad73f2047bffb4fb57a84
MD5 f5e8cdff8a2e570645cb679ada8541c8
SHA1 b76f60c8b11b22570c4b7abc28070fa36fd9c9a3
SHA512 fabcc4d31a43d7e3aeb745da513961cf6a7f7bffc76c61ffeb3224679874eeda3713795cf755779db66531ca4ab282979bfb27a53d8fd029007e1a218ca64f89
TLSH
T176D01C60E0C23036EF3A2AB29A3C5CC0E328381A83368BA3128C059D7E83DD1C981310
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a3c3f.TMP

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5a3c3f.TMP
Size 48B
SHA256 0989ec127201c157bfb38084cb930eee90fbfcb7ad44cd146b2c873ebebad9ca
MD5 d5003750d8b8b53d89a105708ccdf7a2
SHA1 528e1862c5bcff661bb706dcb81258ee8075c2bd
SHA512 8faddc095928387e09a29af984099792977ceb455f414460b24f27db202bbf574cfcefa9dc8550a8d7d48fcdb41047a3d1d57026ac50b7933b5893a40f291d7f
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Default\Network\Network Persistent State
Size 856B
SHA256 1b57e570069d6a618f4955462c54c1de92cfc7a5b4235e56dc75b20ee577372e
MD5 d8e8eaa56e87766a4ed16a3f1ceb0696
SHA1 18d65e99f77699331816f8d0cbed5bb331bbb2a2
SHA512 9e86df8c4fe3fca6fa45bc57dd59341a06dc3e909490412398cb6a1c2aaa62d9f5e006517fd22930d9b9374416ed8751187ade3a12bb604a63bab8fc4834b2c5
TLSH
T19C1180A2E3B506ACD77112F42D682C17DFAC191913AC394AC5C8B79F67F0478D14054E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5afb59.TMP

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Default\Network\Network Persistent State~RFe5afb59.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 fa5037a69f0eab0b65d8d1ee5e82e57d5a608a2a4e50741cff1696bd37c53fc7
MD5 f7d0181aaedbb33060ba4d8bbae047e0
SHA1 81aed9ed1c877442fa70b8b9327002567a4d800a
SHA512 70898ca0f57bcbc62761c9c2eb3a33235f754a604b5bff13242059e60020a85c566a7164b109618ae782d8ec913089f803a3846fff307e6938f88d08e5922a56
SSDEEP 96:stp/dzIw1b9sGkeo5h16ZHRs7/x+6MhmuecRV71ejeYK+gr28XM1C7K:stNpCGrocRsV+FdV7QjY9G6K
TLSH
T172D1A6066E64797B4CC6E519BA29BA52E2F99433B0D11D48FBF9462C14DB5DC2307C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Local State
Size 15KB
SHA256 ac41090c8ae214ebd54d75f99ace79b4faa7954b476f3d9bbb986415f93f9d02
MD5 ece49e12ca6ffa91721f3dc071f5b1dd
SHA1 7fba2cd2b9d3a9027ed50e9e5e7d7cf4d4343a4a
SHA512 1f24099302b877eaa54b9be4236eb94ef6f333d02e5120d4d109948e90f37d2f2b2976e209f92e3ceab8de4dbea695b77da1698e8b3c90de24607e4c57152166
SSDEEP 384:K+aQikB+z/xvxjg/qhEwNBSgiNWVpxEh8CWV9zV:V/UxvxjgC+oiYVHM6FV
TLSH
T12A729E2F94797E37A6F3E615795D1B9BDFBC947390C26EB849BA4F0906C72980301C12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Local State
Size 2KB
SHA256 682fddf021d88e1860f9c7284caf3c0f62dbc8e8dfabc55cca16ab4aa1602f9c
MD5 e99b237205427a65ecefb5e1720b9f86
SHA1 e879c3e4e48fe6cde48d6314cc25428f67524bf4
SHA512 b8b755d7c584e93da0c7e8217336d1ba1f8bb454731bd891b57df2a47eb5799cbb3b6aed1a4c43337e265cb2689bff78231cee8644380650b7e0f3449775f76d
TLSH
T1B6519373B9106A378AB29759394A7F23DE7A90B3EA522F50E6DE0B1801CB64C1301C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Local State
Size 3KB
SHA256 8f2b649b528eec997d0f92233206f9184499080d6bd0695bb2a9f74c5996f784
MD5 b978ca45fe46c7eb43637fde5a84ac08
SHA1 4b769eac692cd3c00a875f22ebb3ee7de76d4bb9
SHA512 054b8dfaf454ce46b442ad5921e408470640070539dfda4b9c74e07e588cf93ac6159801907c20179c6b4eebff761e16151eef3acc7b318b5713cdaa2449ff8f
TLSH
T12461A47BA964A9374EF29B0578863F16BBA59033E5913F98E6ED0F1D01D728C1341C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe59df3b.TMP

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Local State~RFe59df3b.TMP
Size 1KB
SHA256 daee7b9510974e9be9487e129bbbd198a4364a8f1173626861af57c792a1237e
MD5 4b65c08147c32ea7ab6d8a3a864ff173
SHA1 045a329269c78e958a00f1c8bd813bad082ff989
SHA512 97f9ea7c5a720f3ce27ed359cfcda0a14156f4212960de51ae2749262ac63d86f443b216bd715e1e43ab694b8b4161842f1c09ab43e8ffbf39bd9e6304d9b477
TLSH
T1C52165F2F5905B336D91334A2642BF676E61917BD2110F04B2DE4B2D16D754C5629C33
MD5 SHA1 SHA512 TLSH

Submit Download

WebView2Loader.dll

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\WebView2Loader.dll
Size 161KB
SHA256 9468470d6a4d11179ec179183d130465a380e0dedfdbe1fc2ab404c86c45a85e
MD5 61f430f292f85b18b57f06ea6d3d8b82
SHA1 03e31a690fa32364fea5ce73498f234adc544cd0
SHA512 73dfd28a27c10984abb382b7d868b3812aa8d0c89435a45b5b242fa82cc7890b91b2e89bc86cdee039b721befaaf0d14506b6c9c86ecbce6ba6d97824eb22dfb
SSDEEP 3072:dX1/Z3TlTRTFOYfThTNTvDbS2bT4wdovPEKdIMsb1Z5AalipTkYEtJ5+POFEv:dDTlTRTFOYfThTNTvDhvZkPEKdI7pUEQ
TLSH
T12CF36C5772E5007BE16B8274C9A34A11E777B4510B60ABEF03A4477A1F237D4AE3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geoip

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\tor-runtime\data\geoip
Size 9.0MB
SHA256 af9ccd060a712d090ee07d5678b5d45b0038ec1573116fae724a6695a8485703
MD5 e9e0ee27f75255c81ee0d5352a0478aa
SHA1 b08bfe286dc8f11f29aaceafb6f7ef0f5c771042
SHA512 5547bc13552320720a132af6d9b122b75896f908ebeddb24d8218ef5075c38d21c7ef0ef6d5dd855b783c891c3aadd5fc362793e62974185e7eedeae47322413
SSDEEP 49152:j2qmvmL+vpS0uWjaD2X4wH2I58Ydqkztz9HkBo0podsEKopmzPrAMZARLhQIKL9Q:A
TLSH
T105A6F8A05271E9DAF3EA8797C9671C1D412BE01A222616B4F4C7F59E8D0FBC0D0B1E97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geoip6

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\tor-runtime\data\geoip6
Size 15.3MB
SHA256 2393124667ba2ccb4c806f226a33b2ef7a8188d1ba55831c1a5d3dca2b062514
MD5 4d1662e438f08fe4c913789c3f56d925
SHA1 9d85004fba941079cfe018f0599e6a337c4e45a1
SHA512 3fb3f440bc206a3645eb684b37606855c3d1d1d976463e45b96e7e069975aa18f4ca31ab9ed351533d56ee7e50bd7fd627b43d21d274133c5393a9b1b41905ec
SSDEEP 24576:eRqHqAVglkDRj8wHjVCpYcbwlihndEtmKco4MkQHLPTtshizhtBsNvubuw0oDL8l:Q
TLSH
T1BAF6DD7005BED7C5ABC8E1FF5690E86F4AA6F2DC361918D425B6DCB817E64074AEC203
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tor.exe

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\tor-runtime\tor\tor.exe
Size 9.7MB
SHA256 ec7708e0b43e0e00b1533d11ed3ca244e6f11cb2a7b62d319ad73a7b13123033
MD5 93110c343a740fca8e64cfe00472c527
SHA1 bb6abd60cfa979506bfc2c3b14c725a79cd5ddee
SHA512 d8510b0466104d02fc939806e1713d614c56488a0ded258e7bb8c1490b0839f7be054e5e56f3984012ec145049c7dbbcc0adf912dada78e4363201cd808baf75
SSDEEP 98304:+igyt48AHd7ERbHgshQKnRqNAtLnLisS1Km1mLg9wrHjzsZaUHaa+b:dgyt4hdcnLs1z1mL+ia
TLSH
T142A62947F27710DDC5BAC07892177223F9A13C8C81346B6B599097A62B70B68AF7EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VoidTools-Setup-v2.3.4-win64(1).tmp

Path C:\Users\Admin\AppData\Local\Temp\is-2IGEKVCV6H.tmp\VoidTools-Setup-v2.3.4-win64(1).tmp
Size 4.2MB
SHA256 0356d412585d4a982b2e6d57129b87ccfbc7ccf978247b54b73473effbc67c7b
MD5 7a46b3f6b33c7861f1c8f848c02fc86a
SHA1 69dffb821994d6ddabb692d2f75c878b0ae40262
SHA512 ffdc9485bec0dfa304aa3acacf74fb0ae2b0dd4c70ef7d5ac23288c0ba12ee9c1787f9b7aa61e4277a7c3866f8537d8543dc48a4118736b273daf970ff58b053
SSDEEP 98304:h9SZUvl30aj90ZFcvdQ0hdgvminQLMj+Jb333c:+ItJj90Z6RgKwz
TLSH
T131168E03B388753EE4B71E3A883FA654583F7A213A16CD4B6BF4099C4F396416D2A747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cached-microdesc-consensus

Path C:\Users\Admin\AppData\Local\VoidTools\Tor\Data\cached-microdesc-consensus
Size 3.2MB
SHA256 5cbc9ad3a446a2d166f37cfe9e9c4dae355edff6172cc277498e7055a97fb6d0
MD5 c15d18e08cbc60dd6b8497dd9000676e
SHA1 b8145e96e4d7bdf2ce42089a29f4b87697ca681e
SHA512 6cfeeb8fadc15db707a53689061b7c3feb3cb014c00e59fe44b9f1794979080bd01229f1fc1b710ef803eff221bf03ebbe2ff07e00568ced828ff74ce71ddc90
SSDEEP 24576:NGFN8lOlJENupdi5bqNhx8i8axyPMajL7MW:8COz1qxyzyUW
TLSH
T11BF533EA97124DFAD32A09DBE510FB7BF33F5725C2486B94286F48FA7205091762093D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cached-microdescs.new

Path C:\Users\Admin\AppData\Local\VoidTools\Tor\Data\cached-microdescs.new
Size 20.6MB
SHA256 359ea2532bee7643d859a277a98a7026940a14b50f9c839828feb47c90ab427f
MD5 4fcd0112ab6258b3654a87de286be995
SHA1 343b61045ecbed543442f2766513ecfb894029e4
SHA512 8a681a0da2e14daaae2e5708e787457b4df033fa3f92e700381e5f2b0c1ba398603f6d3d179593b1542623f641136830e0734425c2443975c3146fbf238bdc3a
SSDEEP 24576:BcXzAMVE/0V/1VqQV5VuDVRiVem+qmVlW5zet2VbDVAcJVO0jTVNV2VnaDpBVioS:lQ+dW57mn8KPzPtqc
TLSH
T14027AEEA89AB00C15E05E7CDEC2607C3DF144B3A0A6041A176AAB5677F3329FC55EE35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.html

Path C:\Users\Admin\AppData\Local\VoidTools\WebUI\index.html
Size 3.2MB
SHA256 eb6e79b52703737043eabdb6632a69d2b07078c146f88907afa23cc2736c8b34
MD5 38c97f6c8cccb231580a07300b526d5e
SHA1 ae247732a837aac82c83215dca5fe3338d994c93
SHA512 35b764f23a8b7a3cb8bc07b9a75302061eae5a80838fe1f875628de46c66a52c29346eb671ed4633bca0be68d2d18c1bb6c41f9acafd94716c123c97167d5464
SSDEEP 49152:9pg8GTJQH3JgtSu2aeS5BbzUZY5hw9Usv:atI
TLSH
T1DEE53AEB3211EAFE2F5E18F4F127149FF65B511BC84B58D9F0F5A6082480592632BF68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1356-88-0x00000000000C0000-0x00000000004FA000-memory.dmp

Download

memory/1356-12-0x00000000000C0000-0x00000000004FA000-memory.dmp

Download

memory/1356-81-0x00000000000C0000-0x00000000004FA000-memory.dmp

Download

memory/1356-6-0x00000000035D0000-0x00000000035D1000-memory.dmp

Download

memory/1356-8-0x00000000035D0000-0x00000000035D1000-memory.dmp

Download

memory/1356-10-0x00000000000C0000-0x00000000004FA000-memory.dmp

Download

memory/1356-73-0x00000000000C0000-0x00000000004FA000-memory.dmp

Download

memory/1388-330-0x000001C13B630000-0x000001C13B706000-memory.dmp

Download

memory/1388-195-0x00007FFED1180000-0x00007FFED1181000-memory.dmp

Download

memory/1644-373-0x00007FFED0D10000-0x00007FFED0D11000-memory.dmp

Download

memory/1644-372-0x00007FFED05E0000-0x00007FFED05E1000-memory.dmp

Download

memory/3528-329-0x000002285EC90000-0x000002285ED66000-memory.dmp

Download

memory/3528-180-0x00007FFED1180000-0x00007FFED1181000-memory.dmp

Download

memory/4728-9-0x0000000000210000-0x00000000002EF000-memory.dmp

Download

memory/4728-1-0x0000000000210000-0x00000000002EF000-memory.dmp

Download

memory/4728-89-0x0000000000210000-0x00000000002EF000-memory.dmp

Download