Analysis

  • user interaction
    yes
  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    06/05/2026, 12:30

General

  • Target
    installer.exe
  • Size 2.6MB
  • Sample260506-ppwt6aay9x
  • SHA256 e3782fee3da51e158e41b1c569e0682666fa89741e9f04edfce6f3837b8e3d5a
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Downloads MZ/PE file 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies data under HKEY_USERS 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs
  • Views/modifies file attributes 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\installer.exe
    "C:\Users\Admin\AppData\Local\Temp\installer.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    PID:2748
  • C:\Users\Admin\AppData\Local\VoidClient\voidclient.exe
    "C:\Users\Admin\AppData\Local\VoidClient\voidclient.exe"
    1⤵
    • Downloads MZ/PE file
    • Executes dropped EXE
    • Checks whether UAC is enabled
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:4740
    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=voidclient.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.nuageux.voidclient\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=4740.808.9151166105741113040
      2⤵
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of WriteProcessMemory
      PID:4540
      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.nuageux.voidclient\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.nuageux.voidclient\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x178,0x17c,0x180,0x154,0x188,0x7fff05cdb078,0x7fff05cdb084,0x7fff05cdb090
        3⤵
          PID:1636
        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nuageux.voidclient\EBWebView" --webview-exe-name=voidclient.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1736,i,9699888559611302265,5061031018188458083,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1732 /prefetch:2
          3⤵
            PID:3952
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nuageux.voidclient\EBWebView" --webview-exe-name=voidclient.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2040,i,9699888559611302265,5061031018188458083,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2060 /prefetch:3
            3⤵
              PID:5920
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nuageux.voidclient\EBWebView" --webview-exe-name=voidclient.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2396,i,9699888559611302265,5061031018188458083,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:8
              3⤵
                PID:460
              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nuageux.voidclient\EBWebView" --webview-exe-name=voidclient.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3608,i,9699888559611302265,5061031018188458083,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
                3⤵
                  PID:4320
              • C:\Windows\system32\attrib.exe
                "attrib" +H C:\Users\Admin\AppData\Local\VoidClient\v
                2⤵
                • Views/modifies file attributes
                PID:2256
              • C:\Users\Admin\AppData\Local\VoidClient\ui.exe
                "C:\Users\Admin\AppData\Local\VoidClient\ui.exe"
                2⤵
                • Executes dropped EXE
                • Checks whether UAC is enabled
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of WriteProcessMemory
                PID:884
                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=ui.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.nuageux.voidclient\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=884.4460.5711641885004298899
                  3⤵
                  • Enumerates system info in registry
                  • Modifies data under HKEY_USERS
                  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                  • Suspicious use of WriteProcessMemory
                  PID:3836
                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.nuageux.voidclient\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.nuageux.voidclient\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x17c,0x180,0x184,0x158,0x18c,0x7fff05cdb078,0x7fff05cdb084,0x7fff05cdb090
                    4⤵
                      PID:4264
                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nuageux.voidclient\EBWebView" --webview-exe-name=ui.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1852,i,10084985213092121393,8530908209652128047,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1844 /prefetch:2
                      4⤵
                        PID:3772
                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nuageux.voidclient\EBWebView" --webview-exe-name=ui.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1972,i,10084985213092121393,8530908209652128047,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2100 /prefetch:3
                        4⤵
                          PID:5244
                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nuageux.voidclient\EBWebView" --webview-exe-name=ui.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2344,i,10084985213092121393,8530908209652128047,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:8
                          4⤵
                            PID:2120
                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nuageux.voidclient\EBWebView" --webview-exe-name=ui.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3536,i,10084985213092121393,8530908209652128047,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
                            4⤵
                              PID:1564
                          • C:\Windows\system32\attrib.exe
                            "attrib" +H C:\Users\Admin\AppData\Local\VoidClient\bin\lsp
                            3⤵
                            • Views/modifies file attributes
                            PID:2468

                      Network

                            MITRE ATT&CK Enterprise v16

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            System.dll

                            • Path C:\Users\Admin\AppData\Local\Temp\nsj1CEB.tmp\System.dll
                            • Size 12KB
                            • SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            modern-wizard.bmp

                            • Path C:\Users\Admin\AppData\Local\Temp\nsj1CEB.tmp\modern-wizard.bmp
                            • Size 25KB
                            • SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            nsDialogs.dll

                            • Path C:\Users\Admin\AppData\Local\Temp\nsj1CEB.tmp\nsDialogs.dll
                            • Size 9KB
                            • SHA256 715a9b58de0995d1a08384c522ad9af210e2791aaf8e87a6c07bfe72ebfd2cb5
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            nsis_tauri_utils.dll

                            • Path C:\Users\Admin\AppData\Local\Temp\nsj1CEB.tmp\nsis_tauri_utils.dll
                            • Size 32KB
                            • SHA256 f3e9b0d43b66fa6b05d2fa4de4547517a3ec0bc0b14de3c349d817465bbf7ab4
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            ui.exe

                            • Path C:\Users\Admin\AppData\Local\VoidClient\ui.exe
                            • Size 17.0MB
                            • SHA256 76e47cc6961c848938ffb75ab35e9efd3d20d0be462766f0ff9975e42983b52f
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            v

                            • Path C:\Users\Admin\AppData\Local\VoidClient\v
                            • Size 22B
                            • SHA256 a5727a6ad5da9d3dbc22eec9249f0e12dba87939658a7633868125518e73d55a
                            • MD5 SHA1 SHA512

                            voidclient.exe

                            • Path C:\Users\Admin\AppData\Local\VoidClient\voidclient.exe
                            • Size 10.9MB
                            • SHA256 fe1ecf93ba392ce84330f5883cdce95c62376f3b320acfb18c865cc2fca3b7e8
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            settings.dat

                            • Path C:\Users\Admin\AppData\Local\com.nuageux.voidclient\EBWebView\Crashpad\settings.dat
                            • Size 280B
                            • SHA256 ba8cec50fd7f4a4c7b05715e61ced7aac07b49d322f78de4b4a961b3a1a36705
                            • MD5 SHA1 SHA512 TLSH

                            settings.dat

                            • Path C:\Users\Admin\AppData\Local\com.nuageux.voidclient\EBWebView\Crashpad\settings.dat
                            • Size 280B
                            • SHA256 6bc0c83253be30653a3f77159781c1108888d6050516ebc8db80ca1da5e56949
                            • MD5 SHA1 SHA512 TLSH

                            settings.dat

                            • Path C:\Users\Admin\AppData\Local\com.nuageux.voidclient\EBWebView\Crashpad\settings.dat
                            • Size 280B
                            • SHA256 507c5a2ed214472b27098ff1d23535369859e9eb6ea112a29a1e981b367ab9c3
                            • MD5 SHA1 SHA512 TLSH

                            settings.dat

                            • Path C:\Users\Admin\AppData\Local\com.nuageux.voidclient\EBWebView\Crashpad\settings.dat
                            • Size 280B
                            • SHA256 b44386c64352ad95794b961fb8787bcf465e43fa7687916d1ce0652996d1cd7d
                            • MD5 SHA1 SHA512 TLSH

                            settings.dat

                            • Path C:\Users\Admin\AppData\Local\com.nuageux.voidclient\EBWebView\Crashpad\settings.dat
                            • Size 280B
                            • SHA256 6b3eab3dacb7df0041d1f44b2612a974738fc41e4abea5c56d0d69b8a31c4206
                            • MD5 SHA1 SHA512

                            throttle_store.dat

                            • Path C:\Users\Admin\AppData\Local\com.nuageux.voidclient\EBWebView\Crashpad\throttle_store.dat
                            • Size 20B
                            • SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
                            • MD5 SHA1 SHA512

                            data_0

                            • Path C:\Users\Admin\AppData\Local\com.nuageux.voidclient\EBWebView\Default\Cache\Cache_Data\data_0
                            • Size 44KB
                            • SHA256 468456974fd86b33647942820dce7284879acfab9e9e6eca008e1fdcf9006fb5
                            • MD5 SHA1 SHA512 SSDEEP

                            data_1

                            • Path C:\Users\Admin\AppData\Local\com.nuageux.voidclient\EBWebView\Default\Cache\Cache_Data\data_1
                            • Size 264KB
                            • SHA256 0ff81bfe8be0518d8f0d6ac60e1782d0c04745701c9ec549404fddf3e0604f8f
                            • MD5 SHA1 SHA512 SSDEEP

                            index

                            • Path C:\Users\Admin\AppData\Local\com.nuageux.voidclient\EBWebView\Default\Cache\Cache_Data\index
                            • Size 256KB
                            • SHA256 1b07816e74916cf97d5a09c1121a5af36ae31a0da9b6b395fcf37cf00d1abad6
                            • MD5 SHA1 SHA512 SSDEEP

                            11a494e3ab7f3d5b_0

                            • Path C:\Users\Admin\AppData\Local\com.nuageux.voidclient\EBWebView\Default\Code Cache\js\11a494e3ab7f3d5b_0
                            • Size 265B
                            • SHA256 1610f39a80ea37ec4d0679c447a2916de2d9fdbfbd01b0cbed3094d1d05f089c
                            • MD5 SHA1 SHA512 TLSH

                            21172255df3a4029_0

                            • Path C:\Users\Admin\AppData\Local\com.nuageux.voidclient\EBWebView\Default\Code Cache\js\21172255df3a4029_0
                            • Size 268B
                            • SHA256 f0476bbe63a126f0b493b8bcb51915d022e530760f85896de17b7e095c13c411
                            • MD5 SHA1 SHA512 TLSH

                            the-real-index

                            • Path C:\Users\Admin\AppData\Local\com.nuageux.voidclient\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                            • Size 48B
                            • SHA256 ad2a05d5d19e8afbef6e89f1ca1f0ad9bb20bad242d720de41928456c11cab1b
                            • MD5 SHA1 SHA512

                            the-real-index

                            • Path C:\Users\Admin\AppData\Local\com.nuageux.voidclient\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                            • Size 240B
                            • SHA256 a15f6763c8806e8bcc596b9ceaa2f9e6d5a1bb5f4eac38ccd54f209baa7dd8bf
                            • MD5 SHA1 SHA512 TLSH

                            the-real-index

                            • Path C:\Users\Admin\AppData\Local\com.nuageux.voidclient\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                            • Size 576B
                            • SHA256 912247e727c7f0a290d0f0ab6e985ff1103a1f3de078ceb71c0770f4fb0b0039
                            • MD5 SHA1 SHA512 TLSH

                            index

                            • Path C:\Users\Admin\AppData\Local\com.nuageux.voidclient\EBWebView\Default\Code Cache\wasm\index
                            • Size 24B
                            • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
                            • MD5 SHA1 SHA512

                            data_0

                            • Path C:\Users\Admin\AppData\Local\com.nuageux.voidclient\EBWebView\Default\DawnWebGPUCache\data_0
                            • Size 8KB
                            • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                            • MD5 SHA1 SHA512 SSDEEP

                            data_1

                            • Path C:\Users\Admin\AppData\Local\com.nuageux.voidclient\EBWebView\Default\DawnWebGPUCache\data_1
                            • Size 264KB
                            • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                            • MD5 SHA1 SHA512 SSDEEP

                            data_2

                            • Path C:\Users\Admin\AppData\Local\com.nuageux.voidclient\EBWebView\Default\DawnWebGPUCache\data_2
                            • Size 8KB
                            • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                            • MD5 SHA1 SHA512 SSDEEP

                            data_3

                            • Path C:\Users\Admin\AppData\Local\com.nuageux.voidclient\EBWebView\Default\DawnWebGPUCache\data_3
                            • Size 8KB
                            • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                            • MD5 SHA1 SHA512 SSDEEP

                            MANIFEST-000001

                            • Path C:\Users\Admin\AppData\Local\com.nuageux.voidclient\EBWebView\Default\Extension Rules\MANIFEST-000001
                            • Size 41B
                            • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                            • MD5 SHA1 SHA512

                            Favicons

                            • Path C:\Users\Admin\AppData\Local\com.nuageux.voidclient\EBWebView\Default\Favicons
                            • Size 20KB
                            • SHA256 46b5ecada4edb2585f87953f7847aefc938be2404b9d9455c772b97295b7b1cb
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            History

                            • Path C:\Users\Admin\AppData\Local\com.nuageux.voidclient\EBWebView\Default\History
                            • Size 184KB
                            • SHA256 b781e4be823528cd02faa91eb6cffe64683b0ff977023898b23732bdc01d2c45
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            Network Persistent State

                            • Path C:\Users\Admin\AppData\Local\com.nuageux.voidclient\EBWebView\Default\Network\Network Persistent State
                            • Size 111B
                            • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                            • MD5 SHA1 SHA512 TLSH

                            Network Persistent State~RFe59faf0.TMP

                            • Path C:\Users\Admin\AppData\Local\com.nuageux.voidclient\EBWebView\Default\Network\Network Persistent State~RFe59faf0.TMP
                            • Size 59B
                            • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                            • MD5 SHA1 SHA512 TLSH

                            Reporting and NEL

                            • Path C:\Users\Admin\AppData\Local\com.nuageux.voidclient\EBWebView\Default\Network\Reporting and NEL
                            • Size 36KB
                            • SHA256 951ea521116baf347ce89b628eabc22479fb8e3edfb7597659db2174fbb59804
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            SCT Auditing Pending Reports

                            • Path C:\Users\Admin\AppData\Local\com.nuageux.voidclient\EBWebView\Default\Network\SCT Auditing Pending Reports
                            • Size 2B
                            • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                            • MD5 SHA1 SHA512

                            Sdch Dictionaries

                            • Path C:\Users\Admin\AppData\Local\com.nuageux.voidclient\EBWebView\Default\Network\Sdch Dictionaries
                            • Size 40B
                            • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                            • MD5 SHA1 SHA512

                            TransportSecurity

                            • Path C:\Users\Admin\AppData\Local\com.nuageux.voidclient\EBWebView\Default\Network\TransportSecurity
                            • Size 356B
                            • SHA256 1fb711e11493c774027b416dd7454e8c58266254b4d33286f58fc8c9fed7388c
                            • MD5 SHA1 SHA512 TLSH

                            TransportSecurity

                            • Path C:\Users\Admin\AppData\Local\com.nuageux.voidclient\EBWebView\Default\Network\TransportSecurity
                            • Size 188B
                            • SHA256 f19adc9403ba8ed1e20ad3799a27530b06f0a096fe14461474cbdb82a0deb0fb
                            • MD5 SHA1 SHA512 TLSH

                            Trust Tokens

                            • Path C:\Users\Admin\AppData\Local\com.nuageux.voidclient\EBWebView\Default\Network\Trust Tokens
                            • Size 36KB
                            • SHA256 19e1e0d60dc0a70455014fec98b5e4b73e93a80651600368745ab0d4a49c9529
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            Preferences

                            • Path C:\Users\Admin\AppData\Local\com.nuageux.voidclient\EBWebView\Default\Preferences
                            • Size 6KB
                            • SHA256 d094fbc9061bc6009c8b46486b3df163f0fd09d2241faaca5acfebf0d51fb66b
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            Preferences

                            • Path C:\Users\Admin\AppData\Local\com.nuageux.voidclient\EBWebView\Default\Preferences
                            • Size 6KB
                            • SHA256 ee7c871d547efbf7f8c3adacc44386790bc082b44b4e1d1fd1485dd70d7d5d04
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            Preferences~RFe59f91c.TMP

                            • Path C:\Users\Admin\AppData\Local\com.nuageux.voidclient\EBWebView\Default\Preferences~RFe59f91c.TMP
                            • Size 6KB
                            • SHA256 1bb8cffed0e3344f4386362cf3acbf801597f395661da986f018c1f3b18cc066
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            Safe Browsing Cookies

                            • Path C:\Users\Admin\AppData\Local\com.nuageux.voidclient\EBWebView\Default\Safe Browsing Network\Safe Browsing Cookies
                            • Size 20KB
                            • SHA256 e87b3d155c7582d4c1d889308b58f84e8fe90a1581014b21b785d6694bd156cc
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            Secure Preferences

                            • Path C:\Users\Admin\AppData\Local\com.nuageux.voidclient\EBWebView\Default\Secure Preferences
                            • Size 6KB
                            • SHA256 a8181cbaea807f9ce428e83adb756aac8e92a5773d1f8ccab0ec3cab2112f996
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            the-real-index

                            • Path C:\Users\Admin\AppData\Local\com.nuageux.voidclient\EBWebView\Default\Shared Dictionary\cache\index-dir\the-real-index
                            • Size 48B
                            • SHA256 44387d3a26c69db3716bab79c90e77e4d0f6d7dffbc1145afbdb8018de278e2c
                            • MD5 SHA1 SHA512

                            db

                            • Path C:\Users\Admin\AppData\Local\com.nuageux.voidclient\EBWebView\Default\Shared Dictionary\db
                            • Size 44KB
                            • SHA256 f8e7cd835195e4eff7855d20676484ca75f7e7e4fe5b13164fc926b365e1dea0
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            000003.log

                            • Path C:\Users\Admin\AppData\Local\com.nuageux.voidclient\EBWebView\Default\Site Characteristics Database\000003.log
                            • Size 112B
                            • SHA256 f36eb6ddf6cf6fdc4ccff4f555f8d6a560fbb48cab014bd806faa0eb8807be5e
                            • MD5 SHA1 SHA512 TLSH

                            CURRENT

                            • Path C:\Users\Admin\AppData\Local\com.nuageux.voidclient\EBWebView\Default\Site Characteristics Database\CURRENT
                            • Size 16B
                            • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                            • MD5 SHA1 SHA512

                            LOG

                            • Path C:\Users\Admin\AppData\Local\com.nuageux.voidclient\EBWebView\Default\Site Characteristics Database\LOG
                            • Size 325B
                            • SHA256 10e702f17606240c12a007aeb07b8ffb909542112f79be3754617fdaad02bc69
                            • MD5 SHA1 SHA512 TLSH

                            000003.log

                            • Path C:\Users\Admin\AppData\Local\com.nuageux.voidclient\EBWebView\Default\Sync Data\LevelDB\000003.log
                            • Size 46B
                            • SHA256 a2ca52e34b6138624ac2dd20349cde28482143b837db40a7f0fbda023077c26a
                            • MD5 SHA1 SHA512

                            LOG

                            • Path C:\Users\Admin\AppData\Local\com.nuageux.voidclient\EBWebView\Default\Sync Data\LevelDB\LOG
                            • Size 301B
                            • SHA256 ff7986d1bddf734dbedfd8a7f8db978b82785cde8df0d605a11ff3a6912c0812
                            • MD5 SHA1 SHA512 TLSH

                            Visited Links

                            • Path C:\Users\Admin\AppData\Local\com.nuageux.voidclient\EBWebView\Default\Visited Links
                            • Size 128KB
                            • SHA256 f6b0a0ee8920c4ca07b101435bc5074a1b7610638dc63527aae19dd9a94242c3
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            Web Data

                            • Path C:\Users\Admin\AppData\Local\com.nuageux.voidclient\EBWebView\Default\Web Data
                            • Size 216KB
                            • SHA256 2a7b3bb5ac287c4d5fd81c76626b1e8e15f32f34d2b37738fdc98fa6ad43baaf
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            Last Version

                            • Path C:\Users\Admin\AppData\Local\com.nuageux.voidclient\EBWebView\Last Version
                            • Size 14B
                            • SHA256 06205ebe5acf3073d12a4ac419377a3449e6d6b5fa7fa2b1c4201f007c4ddd91
                            • MD5 SHA1 SHA512

                            Local State

                            • Path C:\Users\Admin\AppData\Local\com.nuageux.voidclient\EBWebView\Local State
                            • Size 1KB
                            • SHA256 4006ad24e2efaae5adf6d71e6d5cf40bea195973b6fd34792b735844ded17e5f
                            • MD5 SHA1 SHA512 TLSH

                            Local State

                            • Path C:\Users\Admin\AppData\Local\com.nuageux.voidclient\EBWebView\Local State
                            • Size 3KB
                            • SHA256 1c76a1fc85dddad75a4706d0c9a578db516ff332c9c1c0099ecf58b4af08c4b7
                            • MD5 SHA1 SHA512 TLSH

                            Local State

                            • Path C:\Users\Admin\AppData\Local\com.nuageux.voidclient\EBWebView\Local State
                            • Size 3KB
                            • SHA256 6312b4c863feb1c19e10aecf35d993bbb2cc276ed0d8c7b57e2c2bb79697c16d
                            • MD5 SHA1 SHA512 TLSH

                            Local State

                            • Path C:\Users\Admin\AppData\Local\com.nuageux.voidclient\EBWebView\Local State
                            • Size 2KB
                            • SHA256 7eadeddc7072a197776e7e66bfb7260225395145d7c6f8b700d541fceb3b0a65
                            • MD5 SHA1 SHA512 TLSH

                            Local State

                            • Path C:\Users\Admin\AppData\Local\com.nuageux.voidclient\EBWebView\Local State
                            • Size 16KB
                            • SHA256 c9d39818350fb12837bbecf34e78f22c37fc288596b095a64a499a8fdfe048fe
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            Local State

                            • Path C:\Users\Admin\AppData\Local\com.nuageux.voidclient\EBWebView\Local State
                            • Size 16KB
                            • SHA256 975571ba377c7680189145a6a429320aa9ae96c83edbd86d7c6f6679b91750a6
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            Local State~RFe5995fd.TMP

                            • Path C:\Users\Admin\AppData\Local\com.nuageux.voidclient\EBWebView\Local State~RFe5995fd.TMP
                            • Size 1KB
                            • SHA256 0d2b4343912b5185f5e96bb7086a8ce6cb1a5c78ceae27297b9d3270d1b37d3e
                            • MD5 SHA1 SHA512 TLSH

                            data_1

                            • Path C:\Users\Admin\AppData\Local\com.nuageux.voidclient\EBWebView\ShaderCache\data_1
                            • Size 264KB
                            • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                            • MD5 SHA1 SHA512 SSDEEP

                            index

                            • Path C:\Users\Admin\AppData\Local\com.nuageux.voidclient\EBWebView\ShaderCache\index
                            • Size 256KB
                            • SHA256 6b6ea3473fc703ddacdf91bfd1099357565e25173c15940f61487ba0efb8e94f
                            • MD5 SHA1 SHA512 SSDEEP

                            Variations

                            • Path C:\Users\Admin\AppData\Local\com.nuageux.voidclient\EBWebView\Variations
                            • Size 86B
                            • SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
                            • MD5 SHA1 SHA512 TLSH

                            default.dic

                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
                            • Size 2B
                            • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
                            • MD5 SHA1 SHA512

                            memory/460-98-0x00007FFF21D00000-0x00007FFF21D01000-memory.dmp

                            memory/460-99-0x00007FFF210E0000-0x00007FFF210E1000-memory.dmp

                            memory/3836-562-0x000001F937580000-0x000001F9375BB000-memory.dmp

                            memory/3836-560-0x000001F9345B0000-0x000001F9345DC000-memory.dmp

                            memory/3836-561-0x000001F937550000-0x000001F937577000-memory.dmp

                            memory/3952-76-0x00007FFF22310000-0x00007FFF22311000-memory.dmp

                            memory/4320-197-0x00007FFF22310000-0x00007FFF22311000-memory.dmp

                            memory/4540-440-0x000002ADE4320000-0x000002ADE435B000-memory.dmp

                            memory/4540-246-0x000002ADE19C0000-0x000002ADE19EC000-memory.dmp

                            memory/4540-439-0x000002ADE42F0000-0x000002ADE4317000-memory.dmp

                            memory/4540-438-0x000002ADE19C0000-0x000002ADE19EC000-memory.dmp