b28d09951325afdf6d7e0a76d78668086a8336a50b65c9e98491574d33fee931

Analysis

max time kernel
150s
max time network
161s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/09/2026, 15:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VoidTools-Setup-v2.3.4-win64.exe
Size 83.9MB
Sample260926-s33fmsxtfv
SHA256 b28d09951325afdf6d7e0a76d78668086a8336a50b65c9e98491574d33fee931
MD5 b011060f2cb8a84b6804eecc301e1310
SHA1 a4287760bf421001cfb003f148b852a52b4effb1
SHA512 92e96979d5ae100e306506747ee3151355e6e72dace79ff7b62cce6f4e1ebb403714f399295e17eea476eab16414b448b4427e9e4a3769a384a8fac8c01b2b7f
SSDEEP 1572864:Hwgzds1GLg8p+uVzob819fvLUNWE9Luod5VkfFMNvOcI2vrKrt8gN8x9B/f6zUT+:Qos1GkWqgfjgWsLuK5Vk9OI2urt8mkBe
TLSH
T14C18333B724BA13CE51D9F3A7BB3D614583F666065664E0689E8C8DCDF260701E3E782
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery installer trojan

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
5116	VoidTools-Setup-v2.3.4-win64.tmp
5524	VoidTools.exe
3128	tor.exe

Loads dropped DLL 1 IoCs

pid	Process
5524	VoidTools.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	VoidTools.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4752_1878343499\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4752_1878343499\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4752_754342854\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4752_754342854\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4752_754342854\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4752_754342854\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4752_754342854\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4752_754342854\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4752_754342854\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4752_754342854\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4752_754342854\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4752_754342854\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4752_754342854\test.txt	msedgewebview2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VoidTools-Setup-v2.3.4-win64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VoidTools-Setup-v2.3.4-win64.tmp

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/3520-0-0x0000000001000000-0x00000000010DF000-memory.dmp	innosetup
behavioral2/memory/3520-8-0x0000000001000000-0x00000000010DF000-memory.dmp	innosetup
behavioral2/memory/3520-87-0x0000000001000000-0x00000000010DF000-memory.dmp	innosetup

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5116	VoidTools-Setup-v2.3.4-win64.tmp
5116	VoidTools-Setup-v2.3.4-win64.tmp

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4752	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5116	VoidTools-Setup-v2.3.4-win64.tmp

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 3520 wrote to memory of 5116	3520	VoidTools-Setup-v2.3.4-win64.exe	89
PID 5116 wrote to memory of 5524	5116	VoidTools-Setup-v2.3.4-win64.tmp	90
PID 5524 wrote to memory of 3128	5524	VoidTools.exe	91
PID 5524 wrote to memory of 4752	5524	VoidTools.exe	93
PID 4752 wrote to memory of 5704	4752	msedgewebview2.exe	94
PID 4752 wrote to memory of 2976	4752	msedgewebview2.exe	95
PID 4752 wrote to memory of 2976	4752	msedgewebview2.exe	95
PID 4752 wrote to memory of 2976	4752	msedgewebview2.exe	95
PID 4752 wrote to memory of 2976	4752	msedgewebview2.exe	95
PID 4752 wrote to memory of 2992	4752	msedgewebview2.exe	96
PID 4752 wrote to memory of 5372	4752	msedgewebview2.exe	97
PID 4752 wrote to memory of 5372	4752	msedgewebview2.exe	97
PID 4752 wrote to memory of 5372	4752	msedgewebview2.exe	97
PID 4752 wrote to memory of 3616	4752	msedgewebview2.exe	98
PID 4752 wrote to memory of 3616	4752	msedgewebview2.exe	98
PID 4752 wrote to memory of 3616	4752	msedgewebview2.exe	98
PID 4752 wrote to memory of 3616	4752	msedgewebview2.exe	98
PID 4752 wrote to memory of 3616	4752	msedgewebview2.exe	98
PID 4752 wrote to memory of 4964	4752	msedgewebview2.exe	103
PID 4752 wrote to memory of 4964	4752	msedgewebview2.exe	103
PID 4752 wrote to memory of 4964	4752	msedgewebview2.exe	103
PID 4752 wrote to memory of 5008	4752	msedgewebview2.exe	104
PID 4752 wrote to memory of 5008	4752	msedgewebview2.exe	104
PID 4752 wrote to memory of 5008	4752	msedgewebview2.exe	104

C:\Users\Admin\AppData\Local\Temp\VoidTools-Setup-v2.3.4-win64.exe
"C:\Users\Admin\AppData\Local\Temp\VoidTools-Setup-v2.3.4-win64.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3520
- C:\Users\Admin\AppData\Local\Temp\is-3ULRDA1XN5.tmp\VoidTools-Setup-v2.3.4-win64.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-3ULRDA1XN5.tmp\VoidTools-Setup-v2.3.4-win64.tmp" /SL5="$401D8,86777420,853504,C:\Users\Admin\AppData\Local\Temp\VoidTools-Setup-v2.3.4-win64.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5116
- - C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe
    "C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks whether UAC is enabled
    - Suspicious use of WriteProcessMemory
    PID:5524
  - - C:\Users\Admin\AppData\Local\Programs\VoidTools\tor-runtime\tor\tor.exe
      "C:\Users\Admin\AppData\Local\Programs\VoidTools\tor-runtime\tor\tor.exe" -f NUL --ignore-missing-torrc --ClientOnly 1 --AvoidDiskWrites 1 --SafeSocks 1 --SocksPort "127.0.0.1:9150" --DataDirectory "C:\Users\Admin\AppData\Local\VoidTools\Tor\Data" --SafeLogging 1 --Log "notice stdout" --GeoIPFile "C:\Users\Admin\AppData\Local\Programs\VoidTools\tor-runtime\data\geoip" --GeoIPv6File "C:\Users\Admin\AppData\Local\Programs\VoidTools\tor-runtime\data\geoip6"
      4⤵
      Executes dropped EXE
      PID:3128
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=VoidTools.exe --webview-exe-version=2.3.4 --user-data-dir="C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --enable-features=MojoIpcz,msWebView2EnableDraggableRegions --mojo-named-platform-channel-pipe=5524.3284.18242301915251462677 /pfhostedapp:883a1e44c6e89cfeac157e48235313332773ec67
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of WriteProcessMemory
      PID:4752
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView /prefetch:4 /pfhostedapp:883a1e44c6e89cfeac157e48235313332773ec67 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ff8c1f85fd8,0x7ff8c1f85fe4,0x7ff8c1f85ff0
        5⤵
        
        PID:5704
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView" --webview-exe-name=VoidTools.exe --webview-exe-version=2.3.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1752 --field-trial-handle=1756,i,17729053021300173269,3562670101704195351,262144 --enable-features=MojoIpcz,msWebView2EnableDraggableRegions --variations-seed-version /prefetch:2 /pfhostedapp:883a1e44c6e89cfeac157e48235313332773ec67
        5⤵
        
        PID:2976
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView" --webview-exe-name=VoidTools.exe --webview-exe-version=2.3.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2132 --field-trial-handle=1756,i,17729053021300173269,3562670101704195351,262144 --enable-features=MojoIpcz,msWebView2EnableDraggableRegions --variations-seed-version /prefetch:3 /pfhostedapp:883a1e44c6e89cfeac157e48235313332773ec67
        5⤵
        
        PID:2992
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView" --webview-exe-name=VoidTools.exe --webview-exe-version=2.3.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2264 --field-trial-handle=1756,i,17729053021300173269,3562670101704195351,262144 --enable-features=MojoIpcz,msWebView2EnableDraggableRegions --variations-seed-version /prefetch:8 /pfhostedapp:883a1e44c6e89cfeac157e48235313332773ec67
        5⤵
        
        PID:5372
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView" --webview-exe-name=VoidTools.exe --webview-exe-version=2.3.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3420 --field-trial-handle=1756,i,17729053021300173269,3562670101704195351,262144 --enable-features=MojoIpcz,msWebView2EnableDraggableRegions --variations-seed-version /pfhostedapp:883a1e44c6e89cfeac157e48235313332773ec67 /prefetch:1
        5⤵
        
        PID:3616
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView" --webview-exe-name=VoidTools.exe --webview-exe-version=2.3.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4588 --field-trial-handle=1756,i,17729053021300173269,3562670101704195351,262144 --enable-features=MojoIpcz,msWebView2EnableDraggableRegions --variations-seed-version /prefetch:8 /pfhostedapp:883a1e44c6e89cfeac157e48235313332773ec67
        5⤵
        
        PID:4964
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView" --webview-exe-name=VoidTools.exe --webview-exe-version=2.3.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4600 --field-trial-handle=1756,i,17729053021300173269,3562670101704195351,262144 --enable-features=MojoIpcz,msWebView2EnableDraggableRegions --variations-seed-version /prefetch:8 /pfhostedapp:883a1e44c6e89cfeac157e48235313332773ec67
        5⤵
        
        PID:5008

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VoidTools.exe

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe
Size 42.9MB
SHA256 ffee7be1016d6db3ed383832560c16aa1315bb7a643b7c6c7e2ae0b0646cad38
MD5 fbb718519e8edcc6b0a63fde5d1ca51b
SHA1 2e03fccc07a09abc934d16a1d05d3094921dc1a8
SHA512 c4f36dbdf5f522176090f7581f2b46cdc1050b5db51b5472862c1f0aee1db08591231d26f812e832e4e00124e71a6fbde3f7263545cde276dc3065a9c938de4e
SSDEEP 393216:zveb3ngVeCBNL7ivFUDIK+XXgB4IF0a3D9bV5JQTQSM4Ggam1z73iv1TgbUvnZJu:zvu3ngEQEe6M6D
TLSH
T178A77D2B212405AEC486D676D5072D179325311BE3286EEF649C0F6F2BAB7DE1B36703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 4f8e3f7b300c01d74a03e778edc862383b1665def731524ba1ce3dea6b4dd81e
MD5 79427274217f2ccf993285388f547b9d
SHA1 d53b35483eb80f0ec84bba23824d5f2adb038833
SHA512 10c3911db57caf2f39489286a8365fa79a50f94cbfa8574d4b438d6ec427567e8405f979f0d22c2f804818a251fa4cefa84704fd6aaf0d6e8c63b8b3e85306ff
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 87fd508a1a62d72c9345bb5b49b1e273b5762550da11d3a90bc0ec6f3b31d8c9
MD5 80f570f9e59ead8724455badf6a1c6fa
SHA1 a2e9e9c20c1889239602a72b09a88916c04250aa
SHA512 c4bc19dac6cba54320395a91b903c4c373776399be78bf6290537160a3b8992fef94d2b06dc428f68d4640c759e65a011598fefbf4e39a7479b67300fd118bc9
TLSH
T1FFD0121333510579C22025730403710D0440CA0F40894141547C851D5A584513902881
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 288B
SHA256 9766d3fe61bad4405c283e30b1e133b13f38aea0176cf9b08005396083a8c4cc
MD5 735cf93ba4fa102cb2c0d7434b4588ce
SHA1 2d37d4b623f68757947d54484ef961a6a875a87c
SHA512 2b87a7af40df13adc19866992b31df976d2c0d45e02a30fc3b81909c4eb2b0aab8b6acfd444575a149691525e2fa4903abf7940df8ce22a20fc3b02bbb332bb3
TLSH
T189D0A9AF40DE5C0BEF0CFB7030543D806EB4091E47029B57328B08A88A032E0D180F0F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a8500.TMP

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5a8500.TMP
Size 48B
SHA256 44aac1e3ae0eb68de2244a420b775bde1a07157528c4e422c7f4cf06cfd5d54d
MD5 573da56b2c6855f5755e5f3cc0b12cc0
SHA1 8759f1653b1eaa13e4a75acaf7220b0f8cf9560c
SHA512 3fbafc029510375e4d7ada16d62760aabf23d0293ea41d76530f717a27eabf72cbc74b9f9bf94d99a2590c462589af313797b1705f169e89cf40e0d2e5af95d8
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Default\Network\Network Persistent State
Size 383B
SHA256 803e18ea73d0e5e99b11aa6fa40e5a118edc4104db8be94c8f487f0565d1eab6
MD5 dac68b201c7d88f78435d202e73b2b33
SHA1 7b7960dd6ce359c70690e2e4964ed865133a0e45
SHA512 10c0fcb8a1ff4697543e6b635131fc15a87c6b3cacd69463e19bc7eee7f4a5dab27dd2cc6ef04dcad0028d6f853370b9af41fab796d33359c75292bb99535eb0
TLSH
T18CE068B3B3310AED977043F43D281C078FF9185713AC2A9BC29836AE42F54B8D15484B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5b4003.TMP

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Default\Network\Network Persistent State~RFe5b4003.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

a09fbc38-b039-4a25-8c40-04ea7fd34d5d.tmp

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Default\a09fbc38-b039-4a25-8c40-04ea7fd34d5d.tmp
Size 6KB
SHA256 530ecd7091d6764acc5acaeb30376f79508625a157b866bab0c15010bd691c94
MD5 5dec42bc7467e1f2678411cfafb58ac0
SHA1 c689622231f4484bc5fc6a452c573c488d678ef0
SHA512 aa5649a9cdbdf567456fd859758399989524a4acb24004ce3815333df35b416d5acfe636deb2975447c063e62f25bcc0bdf8ba45b57068c5a531fc617f8e5b98
SSDEEP 96:stB/dzdi0b9akXo5h16ZHas7/x+6MhmuecRrn1ejeuK+gle28XM1C7K:st1p0yocasV+FdrnQjuPeG6K
TLSH
T1ABD1C8125E68797B4CC6F119BA39BA03E2F5A07274D12E58E7F9462C08EB5EC6307C07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Local State
Size 3KB
SHA256 9e95b88ac99524bd533438ca24ab744d29f7e931d6a4770f3f2a34576e992c47
MD5 9ab4fca0b51e51b7d38399b03944396b
SHA1 060e8eeda06f070a7feb3c868e672e39b2c95602
SHA512 788cb7b4f8e8ea40b4a587cea3e976dab43026568379a0ce9207ac27c3279b2efbf27d451c32862712be76a711dee9338d93cd9828db5601d8983e7a64b34459
TLSH
T10C71843B69A0E9374DE3DA0579852F06ABA58137E9927F58E9ED0F0C05D72A81343C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Local State
Size 16KB
SHA256 7eae029307b17d67f19e47abd2d02a9f8c36c3e369e69fcf2e2ccf1786fe9e43
MD5 4f1c331967d02d518450569baf779377
SHA1 e48477b3506f619e0196415c316dff7bc751505b
SHA512 8d007b32556cb9fefa85746dbe27d3c07ffa9e9c0b9d79c54caa10543e75b4c02355c510a363348c4e284aceb2d1996106c059ae5c1aa20f39f7efd08cf48bd1
SSDEEP 384:W+aQikB+z/xvxjg/qhEwNBSltR/GNID09zj:h/UxvxjgC+3FGDFj
TLSH
T1B3728E3B55A4792395F3E6157A490B4BCFB994B294C27EB84EAD4F0D1AC72E40343D13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Local State
Size 2KB
SHA256 707242040cefec2d14a06527cb9e6b1c004a40b7dfbbd5c34bb37dede9b33dc0
MD5 2890561daf579d38516ed6ebdc931927
SHA1 9706347e64c63901ad3fb3d142c90ac0b88003b7
SHA512 909ae3ff842d3bae1005823cffde06b46c0eceae767ce8e0a698cc9d7fdc4ecbb136cf324ff310433eb96059804e084af91321f44c14f0a6842eca15b2db26c4
TLSH
T1695185376960AA3789E3971A3A067F13DF7581B5AA623F14AACE4B0C05D756C1343C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5a1696.TMP

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\VoidTools.exe.WebView2\EBWebView\Local State~RFe5a1696.TMP
Size 1KB
SHA256 9b60d58006c08f15dfe41e742eafa71c9e26107f0a8e1349cbf4a6632d47f07a
MD5 564d99f52da08dfac1cc14555e980ac9
SHA1 18322cf140cb3a0e8b15cfb6855497e1e0b6ab7c
SHA512 5d6cf0cfc95d81c734c189e4c69b31b277e382272133a9b3f719b3115f51da93a2e49ffd54b7c7936c60507988753ec101eaa6af4c8c6d263f4d331918f0b745
TLSH
T14C317477A9A0AB339C97A7073211AF8B6F61407A96519F0475CE870D05EA0AC912BC33
MD5 SHA1 SHA512 TLSH

Submit Download

WebView2Loader.dll

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\WebView2Loader.dll
Size 161KB
SHA256 9468470d6a4d11179ec179183d130465a380e0dedfdbe1fc2ab404c86c45a85e
MD5 61f430f292f85b18b57f06ea6d3d8b82
SHA1 03e31a690fa32364fea5ce73498f234adc544cd0
SHA512 73dfd28a27c10984abb382b7d868b3812aa8d0c89435a45b5b242fa82cc7890b91b2e89bc86cdee039b721befaaf0d14506b6c9c86ecbce6ba6d97824eb22dfb
SSDEEP 3072:dX1/Z3TlTRTFOYfThTNTvDbS2bT4wdovPEKdIMsb1Z5AalipTkYEtJ5+POFEv:dDTlTRTFOYfThTNTvDhvZkPEKdI7pUEQ
TLSH
T12CF36C5772E5007BE16B8274C9A34A11E777B4510B60ABEF03A4477A1F237D4AE3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geoip

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\tor-runtime\data\geoip
Size 9.0MB
SHA256 af9ccd060a712d090ee07d5678b5d45b0038ec1573116fae724a6695a8485703
MD5 e9e0ee27f75255c81ee0d5352a0478aa
SHA1 b08bfe286dc8f11f29aaceafb6f7ef0f5c771042
SHA512 5547bc13552320720a132af6d9b122b75896f908ebeddb24d8218ef5075c38d21c7ef0ef6d5dd855b783c891c3aadd5fc362793e62974185e7eedeae47322413
SSDEEP 49152:j2qmvmL+vpS0uWjaD2X4wH2I58Ydqkztz9HkBo0podsEKopmzPrAMZARLhQIKL9Q:A
TLSH
T105A6F8A05271E9DAF3EA8797C9671C1D412BE01A222616B4F4C7F59E8D0FBC0D0B1E97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geoip6

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\tor-runtime\data\geoip6
Size 15.3MB
SHA256 2393124667ba2ccb4c806f226a33b2ef7a8188d1ba55831c1a5d3dca2b062514
MD5 4d1662e438f08fe4c913789c3f56d925
SHA1 9d85004fba941079cfe018f0599e6a337c4e45a1
SHA512 3fb3f440bc206a3645eb684b37606855c3d1d1d976463e45b96e7e069975aa18f4ca31ab9ed351533d56ee7e50bd7fd627b43d21d274133c5393a9b1b41905ec
SSDEEP 24576:eRqHqAVglkDRj8wHjVCpYcbwlihndEtmKco4MkQHLPTtshizhtBsNvubuw0oDL8l:Q
TLSH
T1BAF6DD7005BED7C5ABC8E1FF5690E86F4AA6F2DC361918D425B6DCB817E64074AEC203
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tor.exe

Path C:\Users\Admin\AppData\Local\Programs\VoidTools\tor-runtime\tor\tor.exe
Size 9.7MB
SHA256 ec7708e0b43e0e00b1533d11ed3ca244e6f11cb2a7b62d319ad73a7b13123033
MD5 93110c343a740fca8e64cfe00472c527
SHA1 bb6abd60cfa979506bfc2c3b14c725a79cd5ddee
SHA512 d8510b0466104d02fc939806e1713d614c56488a0ded258e7bb8c1490b0839f7be054e5e56f3984012ec145049c7dbbcc0adf912dada78e4363201cd808baf75
SSDEEP 98304:+igyt48AHd7ERbHgshQKnRqNAtLnLisS1Km1mLg9wrHjzsZaUHaa+b:dgyt4hdcnLs1z1mL+ia
TLSH
T142A62947F27710DDC5BAC07892177223F9A13C8C81346B6B599097A62B70B68AF7EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VoidTools-Setup-v2.3.4-win64.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-3ULRDA1XN5.tmp\VoidTools-Setup-v2.3.4-win64.tmp
Size 4.2MB
SHA256 0356d412585d4a982b2e6d57129b87ccfbc7ccf978247b54b73473effbc67c7b
MD5 7a46b3f6b33c7861f1c8f848c02fc86a
SHA1 69dffb821994d6ddabb692d2f75c878b0ae40262
SHA512 ffdc9485bec0dfa304aa3acacf74fb0ae2b0dd4c70ef7d5ac23288c0ba12ee9c1787f9b7aa61e4277a7c3866f8537d8543dc48a4118736b273daf970ff58b053
SSDEEP 98304:h9SZUvl30aj90ZFcvdQ0hdgvminQLMj+Jb333c:+ItJj90Z6RgKwz
TLSH
T131168E03B388753EE4B71E3A883FA654583F7A213A16CD4B6BF4099C4F396416D2A747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cached-microdesc-consensus

Path C:\Users\Admin\AppData\Local\VoidTools\Tor\Data\cached-microdesc-consensus
Size 3.2MB
SHA256 88d803436e7faa57b46271ba55dcacbd1dfcacb59b9297c4397764206ff0d7d7
MD5 f262b1ce2be094a6444bf8cce33ee9a0
SHA1 f5bfd1ed9ddb75bdbddfcc62621509a96a31cfd3
SHA512 12122238a6a4c1ad50a8254ee9c59fbc194f5f4f5a3575a0dd90e6665c69aead6ae5a7413844f76c1b0a3fa9a1a6a5da889133c702909efeba5587607a371584
SSDEEP 24576:Ag16hHwrInseI891sWVR6UgEuYUqem54k3e:A/HoR4HFD9Ne
TLSH
T12BF534EA97124DFAD32A09DBE510FB7BF33F5725C2486B94286F48FA7205091762093D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cached-microdescs.new

Path C:\Users\Admin\AppData\Local\VoidTools\Tor\Data\cached-microdescs.new
Size 22.3MB
SHA256 004ddcd06815f235c27d25741d43fb315090a05ff687a5e650a1536978ad0a98
MD5 3ef99f76b530c8961c74b2608d840ea2
SHA1 76b967bdb4288bf9a5189ded1b8a291cab0965da
SHA512 cb7099b980e850ec5eab937cad122d4064cad33257423e8098d8daac67470c5b2bf0508241cd6db766a431b6b35c1f98e244625d734d1d7b3c2db5f1c105a60c
SSDEEP 24576:iQzVZVvKVDVHjiVCxnVOa+VtHjRAoV5DUV60VmPV5V00V1Vd/AVvAwVWCkcV+Per:pNn7PzHMoTDGCGfJ
TLSH
T10037AEEA899B00C14E05E7C9ED2607C7DF144B3E0A6041A176AAF5677F3329FC15EA39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.html

Path C:\Users\Admin\AppData\Local\VoidTools\WebUI\index.html
Size 3.2MB
SHA256 eb6e79b52703737043eabdb6632a69d2b07078c146f88907afa23cc2736c8b34
MD5 38c97f6c8cccb231580a07300b526d5e
SHA1 ae247732a837aac82c83215dca5fe3338d994c93
SHA512 35b764f23a8b7a3cb8bc07b9a75302061eae5a80838fe1f875628de46c66a52c29346eb671ed4633bca0be68d2d18c1bb6c41f9acafd94716c123c97167d5464
SSDEEP 49152:9pg8GTJQH3JgtSu2aeS5BbzUZY5hw9Usv:atI
TLSH
T1DEE53AEB3211EAFE2F5E18F4F127149FF65B511BC84B58D9F0F5A6082480592632BF68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2976-128-0x00007FF8E3220000-0x00007FF8E3221000-memory.dmp

Download

memory/3520-87-0x0000000001000000-0x00000000010DF000-memory.dmp

Download

memory/3520-8-0x0000000001000000-0x00000000010DF000-memory.dmp

Download

memory/3520-0-0x0000000001000000-0x00000000010DF000-memory.dmp

Download

memory/3616-202-0x00007FF8E3220000-0x00007FF8E3221000-memory.dmp

Download

memory/4964-383-0x00007FF8E2EE0000-0x00007FF8E2EE1000-memory.dmp

Download

memory/4964-384-0x00007FF8E4240000-0x00007FF8E4241000-memory.dmp

Download

memory/5116-73-0x00000000007E0000-0x0000000000C1A000-memory.dmp

Download

memory/5116-9-0x00000000007E0000-0x0000000000C1A000-memory.dmp

Download

memory/5116-6-0x0000000001790000-0x0000000001791000-memory.dmp

Download

memory/5116-10-0x0000000001790000-0x0000000001791000-memory.dmp

Download

memory/5116-12-0x00000000007E0000-0x0000000000C1A000-memory.dmp

Download

memory/5116-86-0x00000000007E0000-0x0000000000C1A000-memory.dmp

Download