b28d09951325afdf6d7e0a76d78668086a8336a50b65c9e98491574d33fee931

Analysis

user interaction
yes
max time kernel
41s
max time network
47s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/09/2026, 15:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VoidTools-Setup-v2.3.4-win64.exe
Size 83.9MB
Sample260926-s33fmsxtfv
SHA256 b28d09951325afdf6d7e0a76d78668086a8336a50b65c9e98491574d33fee931
MD5 b011060f2cb8a84b6804eecc301e1310
SHA1 a4287760bf421001cfb003f148b852a52b4effb1
SHA512 92e96979d5ae100e306506747ee3151355e6e72dace79ff7b62cce6f4e1ebb403714f399295e17eea476eab16414b448b4427e9e4a3769a384a8fac8c01b2b7f
SSDEEP 1572864:Hwgzds1GLg8p+uVzob819fvLUNWE9Luod5VkfFMNvOcI2vrKrt8gN8x9B/f6zUT+:Qos1GkWqgfjgWsLuK5Vk9OI2urt8mkBe
TLSH
T14C18333B724BA13CE51D9F3A7BB3D614583F666065664E0689E8C8DCDF260701E3E782
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery installer trojan

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
4164	VoidTools-Setup-v2.3.4-win64.tmp
3980	VoidTools.exe
632	tor.exe

Loads dropped DLL 1 IoCs

pid	Process
3980	VoidTools.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	VoidTools.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VoidTools-Setup-v2.3.4-win64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VoidTools-Setup-v2.3.4-win64.tmp

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/4472-0-0x0000000000240000-0x000000000031F000-memory.dmp	innosetup
behavioral1/memory/4472-50-0x0000000000240000-0x000000000031F000-memory.dmp	innosetup
behavioral1/memory/4472-97-0x0000000000240000-0x000000000031F000-memory.dmp	innosetup

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4164	VoidTools-Setup-v2.3.4-win64.tmp
4164	VoidTools-Setup-v2.3.4-win64.tmp

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
944	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4164	VoidTools-Setup-v2.3.4-win64.tmp
944	msedgewebview2.exe
944	msedgewebview2.exe
3980	VoidTools.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
944	msedgewebview2.exe
944	msedgewebview2.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4472 wrote to memory of 4164	4472	VoidTools-Setup-v2.3.4-win64.exe	89
PID 4164 wrote to memory of 3980	4164	VoidTools-Setup-v2.3.4-win64.tmp	100
PID 3980 wrote to memory of 632	3980	VoidTools.exe	101
PID 3980 wrote to memory of 944	3980	VoidTools.exe	103
PID 944 wrote to memory of 4324	944	msedgewebview2.exe	104
PID 944 wrote to memory of 1684	944	msedgewebview2.exe	105
PID 944 wrote to memory of 1684	944	msedgewebview2.exe	105
PID 944 wrote to memory of 1684	944	msedgewebview2.exe	105
PID 944 wrote to memory of 2112	944	msedgewebview2.exe	106
PID 944 wrote to memory of 3036	944	msedgewebview2.exe	107
PID 944 wrote to memory of 3036	944	msedgewebview2.exe	107
PID 944 wrote to memory of 2556	944	msedgewebview2.exe	108
PID 944 wrote to memory of 2556	944	msedgewebview2.exe	108
PID 944 wrote to memory of 2556	944	msedgewebview2.exe	108

C:\Users\Admin\AppData\Local\Temp\VoidTools-Setup-v2.3.4-win64.exe
"C:\Users\Admin\AppData\Local\Temp\VoidTools-Setup-v2.3.4-win64.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4472
- C:\Users\Admin\AppData\Local\Temp\is-I2Q9NC22MV.tmp\VoidTools-Setup-v2.3.4-win64.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-I2Q9NC22MV.tmp\VoidTools-Setup-v2.3.4-win64.tmp" /SL5="$60096,86777420,853504,C:\Users\Admin\AppData\Local\Temp\VoidTools-Setup-v2.3.4-win64.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4164
- - C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe
    "C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks whether UAC is enabled
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3980
  - - C:\Users\Admin\AppData\Local\Programs\VoidTools\tor-runtime\tor\tor.exe
      "C:\Users\Admin\AppData\Local\Programs\VoidTools\tor-runtime\tor\tor.exe" -f NUL --ignore-missing-torrc --ClientOnly 1 --AvoidDiskWrites 1 --SafeSocks 1 --SocksPort "127.0.0.1:9150" --DataDirectory "C:\Users\Admin\AppData\Local\VoidTools\Tor\Data" --SafeLogging 1 --Log "notice stdout" --GeoIPFile "C:\Users\Admin\AppData\Local\Programs\VoidTools\tor-runtime\data\geoip" --GeoIPv6File "C:\Users\Admin\AppData\Local\Programs\VoidTools\tor-runtime\data\geoip6"
      4⤵
      Executes dropped EXE
      PID:632
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=VoidTools.exe --webview-exe-version=2.3.4 --user-data-dir="C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=msWebView2EnableDraggableRegions --mojo-named-platform-channel-pipe=3980.4396.6408117475718536137
      4⤵
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:944
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7fff24edb078,0x7fff24edb084,0x7fff24edb090
        5⤵
        
        PID:4324
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView" --webview-exe-name=VoidTools.exe --webview-exe-version=2.3.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1592,i,2953047819775687784,7437433054924937653,262144 --enable-features=msWebView2EnableDraggableRegions --variations-seed-version --mojo-platform-channel-handle=1696 /prefetch:2
        5⤵
        
        PID:1684
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView" --webview-exe-name=VoidTools.exe --webview-exe-version=2.3.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2000,i,2953047819775687784,7437433054924937653,262144 --enable-features=msWebView2EnableDraggableRegions --variations-seed-version --mojo-platform-channel-handle=2008 /prefetch:3
        5⤵
        
        PID:2112
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView" --webview-exe-name=VoidTools.exe --webview-exe-version=2.3.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2316,i,2953047819775687784,7437433054924937653,262144 --enable-features=msWebView2EnableDraggableRegions --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:8
        5⤵
        
        PID:3036
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView" --webview-exe-name=VoidTools.exe --webview-exe-version=2.3.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3692,i,2953047819775687784,7437433054924937653,262144 --enable-features=msWebView2EnableDraggableRegions --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:1
        5⤵
        
        PID:2556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VoidTools.exe

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe
Size 42.9MB
SHA256 ffee7be1016d6db3ed383832560c16aa1315bb7a643b7c6c7e2ae0b0646cad38
MD5 fbb718519e8edcc6b0a63fde5d1ca51b
SHA1 2e03fccc07a09abc934d16a1d05d3094921dc1a8
SHA512 c4f36dbdf5f522176090f7581f2b46cdc1050b5db51b5472862c1f0aee1db08591231d26f812e832e4e00124e71a6fbde3f7263545cde276dc3065a9c938de4e
SSDEEP 393216:zveb3ngVeCBNL7ivFUDIK+XXgB4IF0a3D9bV5JQTQSM4Ggam1z73iv1TgbUvnZJu:zvu3ngEQEe6M6D
TLSH
T178A77D2B212405AEC486D676D5072D179325311BE3286EEF649C0F6F2BAB7DE1B36703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 d35f09051b98a442043e04650c5bf3c9e5cc8a0084c0d8588ac853c8ffe165f2
MD5 181ffc55e84c83ebb8fd86dbc0bae3b1
SHA1 add650dff339ffff06e9c20002eb31e56564fef0
SHA512 a04cb3bc63fa2738d2bc81e6c5157b5350ebdb494cccd3d514c6e98b14a39bad0fd3116cd0be868804a3fdc94b4946eaaccf5c7691f1d0448f20ebc1fa5b3e11
TLSH
T110D0122636090534C8203473004676491500D10B41C6C1009838852E1A840540902943
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 ca32a02af74ddaca7450131b525d1c088874da8e15d2cb8400536b95f3858c14
MD5 5b8564043b7cbb9a3472f6a3c61de1a0
SHA1 184ce69b7488f42767cf1c69f019d9133111f997
SHA512 a183d07f58affe3ec251e2f81f85816c30ae36d1cdf3b3f2a7e07436296f36e0419b0cf7ff3f34d5a0549922629ba8f20460928a92d4d4aa84e7e8d4be7e30cb
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Local State
Size 1KB
SHA256 541ee6b3b407520ea7a69e69a976ea24c892bc4cd8f812d2076457ff89d3a773
MD5 86120442c88caa3424f49bdfaca429c5
SHA1 298672886dc734bc6dcc07b10f72342ce83a114a
SHA512 97d7d17e1918cc8cb8416fea32424fac32641193dbc83c8eb3642c6e4c0250aeb8d4cc74ac5710238164264cce123b5ce8ed927fc04db0a7e9f8895bd44c48a6
TLSH
T1F931A7BBE0E03733AC51944371026E176F31507AD1186E08A6DF0F2E02F75ECA66AE32
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Local State
Size 2KB
SHA256 ec88d516715b52bdf39dee8c077be7acc469a5784c042411285ea75fb6cd1577
MD5 697dccd4866840355ca6ca32c4377c97
SHA1 e7cde9d236741e6a84728f623cfd6d056cf437af
SHA512 a555309d0bc4dd828af2d06cdeca95fb3b95775c6487fb9ad47f445793429e3491da0d5f7ca8e98f0e5cdd6793bd040a722519313143272cfa42b44dab4cae7d
TLSH
T16651C677B8D4663789E2850579063F13AF3690A59A583F549ADE0F1D01E71AC2342C26
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Local State
Size 3KB
SHA256 f0744aa44f9c67a4491fd9a64c33025df8a5941ba9aa598b9d96de1481c1101c
MD5 851404e6ce47ff2fb6705940f60b1fa2
SHA1 2fef310afc31aaf5a7908b838b67a9a7ea86f4a2
SHA512 fbd13e367613a0d6ef3bb8913ea7c99415a49acdd8c3712b1a8030fda8ebc6291991ee768846d7535cb37143df5b5517d19a2c3bbd3c5784871e0b27bc1d180e
TLSH
T11271C87AA4E4A5374DF29901B8852F07BBB54137E5983F58D9EE0F1D01D72E82342C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Local State
Size 16KB
SHA256 8ab987ae5bb60ca5f713758212a8bdedf2ca8eeef05f51fbc42ce84c1fb96a38
MD5 e7a285674cc48c8e393eec9660c847ae
SHA1 453fb4873feb32762db96ba329299a56ea771798
SHA512 da5d2f12423d3b27975c6846e4d40edbd7495aa22f6acfc0ac74147836fd199b98a30aa37c7f6010f16c687ad763fa4304c08e0f96bd4aa5527eccb6f605619e
SSDEEP 384:zk+aQikB+z/xvxjg/qhEwNb+/MdlwB9zx9:3/UxvxjgC+xkaBFx9
TLSH
T156728F2BA5A8793759F3E50579080B4BDBB584B2D0C57EB84DEE5F0E06D72E81342D06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe58dd5b.TMP

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Local State~RFe58dd5b.TMP
Size 1KB
SHA256 994bd5e41e472935d76778848899914dc564f11fd11b561253c43af8f02e0fa8
MD5 ca4afd7d08dfc54b199fc87c55a5c12f
SHA1 fc2ac27f50306a5e9b8ac5c9e4475a5c5a99c131
SHA512 15f9ce43db2d6205746ffed4facd2209611811333c5e76d49d678e723234f5f0f26915494f91480376497ced4194ea17848c1158e7e2a3a65e815282bd261978
TLSH
T16B2195BFD0D43733B9518402B2026E072F71907A921C6E08E6CF0B2E02E74E89276D33
MD5 SHA1 SHA512 TLSH

Submit Download

WebView2Loader.dll

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\WebView2Loader.dll
Size 161KB
SHA256 9468470d6a4d11179ec179183d130465a380e0dedfdbe1fc2ab404c86c45a85e
MD5 61f430f292f85b18b57f06ea6d3d8b82
SHA1 03e31a690fa32364fea5ce73498f234adc544cd0
SHA512 73dfd28a27c10984abb382b7d868b3812aa8d0c89435a45b5b242fa82cc7890b91b2e89bc86cdee039b721befaaf0d14506b6c9c86ecbce6ba6d97824eb22dfb
SSDEEP 3072:dX1/Z3TlTRTFOYfThTNTvDbS2bT4wdovPEKdIMsb1Z5AalipTkYEtJ5+POFEv:dDTlTRTFOYfThTNTvDhvZkPEKdI7pUEQ
TLSH
T12CF36C5772E5007BE16B8274C9A34A11E777B4510B60ABEF03A4477A1F237D4AE3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geoip

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\tor-runtime\data\geoip
Size 9.0MB
SHA256 af9ccd060a712d090ee07d5678b5d45b0038ec1573116fae724a6695a8485703
MD5 e9e0ee27f75255c81ee0d5352a0478aa
SHA1 b08bfe286dc8f11f29aaceafb6f7ef0f5c771042
SHA512 5547bc13552320720a132af6d9b122b75896f908ebeddb24d8218ef5075c38d21c7ef0ef6d5dd855b783c891c3aadd5fc362793e62974185e7eedeae47322413
SSDEEP 49152:j2qmvmL+vpS0uWjaD2X4wH2I58Ydqkztz9HkBo0podsEKopmzPrAMZARLhQIKL9Q:A
TLSH
T105A6F8A05271E9DAF3EA8797C9671C1D412BE01A222616B4F4C7F59E8D0FBC0D0B1E97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geoip6

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\tor-runtime\data\geoip6
Size 15.3MB
SHA256 2393124667ba2ccb4c806f226a33b2ef7a8188d1ba55831c1a5d3dca2b062514
MD5 4d1662e438f08fe4c913789c3f56d925
SHA1 9d85004fba941079cfe018f0599e6a337c4e45a1
SHA512 3fb3f440bc206a3645eb684b37606855c3d1d1d976463e45b96e7e069975aa18f4ca31ab9ed351533d56ee7e50bd7fd627b43d21d274133c5393a9b1b41905ec
SSDEEP 24576:eRqHqAVglkDRj8wHjVCpYcbwlihndEtmKco4MkQHLPTtshizhtBsNvubuw0oDL8l:Q
TLSH
T1BAF6DD7005BED7C5ABC8E1FF5690E86F4AA6F2DC361918D425B6DCB817E64074AEC203
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tor.exe

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\tor-runtime\tor\tor.exe
Size 9.7MB
SHA256 ec7708e0b43e0e00b1533d11ed3ca244e6f11cb2a7b62d319ad73a7b13123033
MD5 93110c343a740fca8e64cfe00472c527
SHA1 bb6abd60cfa979506bfc2c3b14c725a79cd5ddee
SHA512 d8510b0466104d02fc939806e1713d614c56488a0ded258e7bb8c1490b0839f7be054e5e56f3984012ec145049c7dbbcc0adf912dada78e4363201cd808baf75
SSDEEP 98304:+igyt48AHd7ERbHgshQKnRqNAtLnLisS1Km1mLg9wrHjzsZaUHaa+b:dgyt4hdcnLs1z1mL+ia
TLSH
T142A62947F27710DDC5BAC07892177223F9A13C8C81346B6B599097A62B70B68AF7EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VoidTools-Setup-v2.3.4-win64.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-I2Q9NC22MV.tmp\VoidTools-Setup-v2.3.4-win64.tmp
Size 4.2MB
SHA256 0356d412585d4a982b2e6d57129b87ccfbc7ccf978247b54b73473effbc67c7b
MD5 7a46b3f6b33c7861f1c8f848c02fc86a
SHA1 69dffb821994d6ddabb692d2f75c878b0ae40262
SHA512 ffdc9485bec0dfa304aa3acacf74fb0ae2b0dd4c70ef7d5ac23288c0ba12ee9c1787f9b7aa61e4277a7c3866f8537d8543dc48a4118736b273daf970ff58b053
SSDEEP 98304:h9SZUvl30aj90ZFcvdQ0hdgvminQLMj+Jb333c:+ItJj90Z6RgKwz
TLSH
T131168E03B388753EE4B71E3A883FA654583F7A213A16CD4B6BF4099C4F396416D2A747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cached-microdesc-consensus.tmp

Path C:\Users\Admin\AppData\Local\VoidTools\Tor\Data\cached-microdesc-consensus.tmp
Size 3.2MB
SHA256 88d803436e7faa57b46271ba55dcacbd1dfcacb59b9297c4397764206ff0d7d7
MD5 f262b1ce2be094a6444bf8cce33ee9a0
SHA1 f5bfd1ed9ddb75bdbddfcc62621509a96a31cfd3
SHA512 12122238a6a4c1ad50a8254ee9c59fbc194f5f4f5a3575a0dd90e6665c69aead6ae5a7413844f76c1b0a3fa9a1a6a5da889133c702909efeba5587607a371584
SSDEEP 24576:Ag16hHwrInseI891sWVR6UgEuYUqem54k3e:A/HoR4HFD9Ne
TLSH
T12BF534EA97124DFAD32A09DBE510FB7BF33F5725C2486B94286F48FA7205091762093D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cached-microdescs.new

Path C:\Users\Admin\AppData\Local\VoidTools\Tor\Data\cached-microdescs.new
Size 11.2MB
SHA256 d6288fb74bc394d24e124f052e0e03d434cbc71aa3f719763f66b1dbd3eab4a5
MD5 16c65b73affad8c80695d3f2db1e4195
SHA1 84b87fc3e51d145707092504e2660e93626bd45d
SHA512 42bd44b646aa41c57b3d05ed9282ec37fab8790340845e6bb86265184ccec367beed17f60881b8ba33f48d8d29ba8557783cca9e218e76db5f0e09c0554c72ef
SSDEEP 24576:sBT9AVVCgpVdNVeIVBVpCV8SVUeHW6VtOcgVGVdYKVlOsNV6JarVtVtVcbOoVukT:ZlaROzLMUXr
TLSH
T13BC6AEEA89AB04C14E05E7CDEC1607C7DF144B3E0A6041A176AAB5677F3329FC15EA39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.html

Path C:\Users\Admin\AppData\Local\VoidTools\WebUI\index.html
Size 3.2MB
SHA256 eb6e79b52703737043eabdb6632a69d2b07078c146f88907afa23cc2736c8b34
MD5 38c97f6c8cccb231580a07300b526d5e
SHA1 ae247732a837aac82c83215dca5fe3338d994c93
SHA512 35b764f23a8b7a3cb8bc07b9a75302061eae5a80838fe1f875628de46c66a52c29346eb671ed4633bca0be68d2d18c1bb6c41f9acafd94716c123c97167d5464
SSDEEP 49152:9pg8GTJQH3JgtSu2aeS5BbzUZY5hw9Usv:atI
TLSH
T1DEE53AEB3211EAFE2F5E18F4F127149FF65B511BC84B58D9F0F5A6082480592632BF68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1684-119-0x00007FFF41470000-0x00007FFF41471000-memory.dmp

Download

memory/2556-225-0x00007FFF41470000-0x00007FFF41471000-memory.dmp

Download

memory/3036-194-0x00007FFF42D10000-0x00007FFF42D11000-memory.dmp

Download

memory/3036-195-0x00007FFF42490000-0x00007FFF42491000-memory.dmp

Download

memory/4164-52-0x0000000000930000-0x0000000000931000-memory.dmp

Download

memory/4164-51-0x0000000000B30000-0x0000000000F6A000-memory.dmp

Download

memory/4164-5-0x0000000000930000-0x0000000000931000-memory.dmp

Download

memory/4164-93-0x0000000000B30000-0x0000000000F6A000-memory.dmp

Download

memory/4472-50-0x0000000000240000-0x000000000031F000-memory.dmp

Download

memory/4472-0-0x0000000000240000-0x000000000031F000-memory.dmp

Download

memory/4472-97-0x0000000000240000-0x000000000031F000-memory.dmp

Download