hxxps://github[.]com/LightnigFast/Project-Lightning

Analysis

user interaction
yes
max time kernel
414s
max time network
416s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
30/05/2026, 04:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/LightnigFast/Project-Lightning
Sample260530-e717gsfz8m

Score

8^/10

defense_evasion discovery installer

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
29	4228	chrome.exe

Executes dropped EXE 3 IoCs

pid	Process
2652	ProjectLightningInstaller.exe
1072	ProjectLightningInstaller.tmp
1128	Project Lightning.exe

Loads dropped DLL 22 IoCs

pid	Process
1128	Project Lightning.exe
1128	Project Lightning.exe
1128	Project Lightning.exe
1128	Project Lightning.exe
1128	Project Lightning.exe
1128	Project Lightning.exe
1128	Project Lightning.exe
1128	Project Lightning.exe
1128	Project Lightning.exe
1128	Project Lightning.exe
1128	Project Lightning.exe
1128	Project Lightning.exe
1128	Project Lightning.exe
1128	Project Lightning.exe
1128	Project Lightning.exe
1128	Project Lightning.exe
1128	Project Lightning.exe
1128	Project Lightning.exe
1128	Project Lightning.exe
1128	Project Lightning.exe
1128	Project Lightning.exe
1128	Project Lightning.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 9 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
40	discord.com
41	discord.com
55	raw.githubusercontent.com
56	raw.githubusercontent.com
116	api.gofile.io
2	raw.githubusercontent.com
3	api.gofile.io
21	raw.githubusercontent.com
31	raw.githubusercontent.com

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	Project Lightning.exe
File opened (read-only)	\??\N:	Project Lightning.exe
File opened (read-only)	\??\O:	Project Lightning.exe
File opened (read-only)	\??\V:	Project Lightning.exe
File opened (read-only)	\??\B:	Project Lightning.exe
File opened (read-only)	\??\G:	Project Lightning.exe
File opened (read-only)	\??\Q:	Project Lightning.exe
File opened (read-only)	\??\R:	Project Lightning.exe
File opened (read-only)	\??\U:	Project Lightning.exe
File opened (read-only)	\??\H:	Project Lightning.exe
File opened (read-only)	\??\K:	Project Lightning.exe
File opened (read-only)	\??\M:	Project Lightning.exe
File opened (read-only)	\??\P:	Project Lightning.exe
File opened (read-only)	\??\S:	Project Lightning.exe
File opened (read-only)	\??\W:	Project Lightning.exe
File opened (read-only)	\??\Y:	Project Lightning.exe
File opened (read-only)	\??\A:	Project Lightning.exe
File opened (read-only)	\??\E:	Project Lightning.exe
File opened (read-only)	\??\I:	Project Lightning.exe
File opened (read-only)	\??\J:	Project Lightning.exe
File opened (read-only)	\??\L:	Project Lightning.exe
File opened (read-only)	\??\T:	Project Lightning.exe
File opened (read-only)	\??\X:	Project Lightning.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\ProjectLightningInstaller.exe:Zone.Identifier	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ProjectLightningInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ProjectLightningInstaller.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Project Lightning.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4228	chrome.exe
660	msedge.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/2652-634-0x00000000000B0000-0x000000000018D000-memory.dmp	innosetup
behavioral1/memory/2652-891-0x00000000000B0000-0x000000000018D000-memory.dmp	innosetup
behavioral1/memory/2652-917-0x00000000000B0000-0x000000000018D000-memory.dmp	innosetup

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134245893630084405"	chrome.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-125073035-2952146151-721812867-1000\{03CEBECE-A863-4484-BAA0-C8C920AA07A8}	Project Lightning.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\ProjectLightningInstaller.exe:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1352	chrome.exe
1352	chrome.exe
1072	ProjectLightningInstaller.tmp
1072	ProjectLightningInstaller.tmp
1352	chrome.exe
1352	chrome.exe
5348	chrome.exe
5348	chrome.exe
1128	Project Lightning.exe
1128	Project Lightning.exe
1128	Project Lightning.exe
1128	Project Lightning.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
588	msedge.exe
588	msedge.exe
588	msedge.exe
588	msedge.exe
588	msedge.exe
588	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe

Suspicious use of FindShellTrayWindow 47 IoCs

pid	Process
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1072	ProjectLightningInstaller.tmp
588	msedge.exe
588	msedge.exe
5432	sihost.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1072	ProjectLightningInstaller.tmp

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 1352 wrote to memory of 3728	1352	chrome.exe	81
PID 1352 wrote to memory of 3220	1352	chrome.exe	83
PID 1352 wrote to memory of 4228	1352	chrome.exe	84
PID 1352 wrote to memory of 3220	1352	chrome.exe	83
PID 1352 wrote to memory of 4668	1352	chrome.exe	87
PID 1352 wrote to memory of 3532	1352	chrome.exe	88
PID 1352 wrote to memory of 4668	1352	chrome.exe	87
PID 1352 wrote to memory of 3532	1352	chrome.exe	88
PID 1352 wrote to memory of 2224	1352	chrome.exe	86
PID 1352 wrote to memory of 2224	1352	chrome.exe	86
PID 1352 wrote to memory of 2316	1352	chrome.exe	89
PID 1352 wrote to memory of 2316	1352	chrome.exe	89
PID 1352 wrote to memory of 2696	1352	chrome.exe	92
PID 1352 wrote to memory of 4548	1352	chrome.exe	94
PID 1352 wrote to memory of 4556	1352	chrome.exe	95
PID 1352 wrote to memory of 5052	1352	chrome.exe	96
PID 1352 wrote to memory of 2948	1352	chrome.exe	97
PID 1352 wrote to memory of 2652	1352	chrome.exe	98
PID 2652 wrote to memory of 1072	2652	ProjectLightningInstaller.exe	99
PID 1072 wrote to memory of 1128	1072	ProjectLightningInstaller.tmp	101
PID 1128 wrote to memory of 588	1128	Project Lightning.exe	102
PID 588 wrote to memory of 4320	588	msedge.exe	103
PID 588 wrote to memory of 660	588	msedge.exe	104
PID 588 wrote to memory of 720	588	msedge.exe	106
PID 588 wrote to memory of 720	588	msedge.exe	106
PID 588 wrote to memory of 1756	588	msedge.exe	105
PID 588 wrote to memory of 1756	588	msedge.exe	105
PID 588 wrote to memory of 1756	588	msedge.exe	105
PID 588 wrote to memory of 3348	588	msedge.exe	107
PID 588 wrote to memory of 3348	588	msedge.exe	107
PID 588 wrote to memory of 3348	588	msedge.exe	107
PID 588 wrote to memory of 1004	588	msedge.exe	108
PID 588 wrote to memory of 1004	588	msedge.exe	108
PID 588 wrote to memory of 1004	588	msedge.exe	108
PID 588 wrote to memory of 4144	588	msedge.exe	112
PID 588 wrote to memory of 4144	588	msedge.exe	112
PID 588 wrote to memory of 4144	588	msedge.exe	112
PID 588 wrote to memory of 756	588	msedge.exe	110
PID 588 wrote to memory of 756	588	msedge.exe	110
PID 588 wrote to memory of 756	588	msedge.exe	110
PID 588 wrote to memory of 4284	588	msedge.exe	111
PID 588 wrote to memory of 4284	588	msedge.exe	111
PID 588 wrote to memory of 4284	588	msedge.exe	111
PID 588 wrote to memory of 2316	588	msedge.exe	113
PID 588 wrote to memory of 2316	588	msedge.exe	113
PID 588 wrote to memory of 2316	588	msedge.exe	113
PID 588 wrote to memory of 5368	588	msedge.exe	114
PID 588 wrote to memory of 5368	588	msedge.exe	114
PID 588 wrote to memory of 5376	588	msedge.exe	115
PID 588 wrote to memory of 5376	588	msedge.exe	115
PID 1352 wrote to memory of 5348	1352	chrome.exe	117
PID 1352 wrote to memory of 5604	1352	chrome.exe	118
PID 1352 wrote to memory of 5604	1352	chrome.exe	118
PID 5432 wrote to memory of 4412	5432	sihost.exe	123

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/LightnigFast/Project-Lightning
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb4f86c728,0x7ffb4f86c734,0x7ffb4f86c740
  2⤵
  PID:3728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1576,i,17733661806383162463,13743408838698943550,262144 --field-trial-handle=1956,i,8830185299573112575,2958301841758441289,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1952 /prefetch:2
  2⤵
  PID:3220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2120,i,14246160745223133976,17837913502361089772,524288 --field-trial-handle=1956,i,8830185299573112575,2958301841758441289,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2096 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2380,i,1822270221428730951,18383291194338830128,524288 --field-trial-handle=1956,i,8830185299573112575,2958301841758441289,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2532 /prefetch:13
  2⤵
  PID:2224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3028,i,1013534158708955392,15811783306770352390,2097152 --field-trial-handle=1956,i,8830185299573112575,2958301841758441289,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3100 /prefetch:1
  2⤵
  PID:4668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3024,i,1718658015387768131,11323510289070243606,2097152 --field-trial-handle=1956,i,8830185299573112575,2958301841758441289,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3080 /prefetch:1
  2⤵
  PID:3532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4152,i,241212161415411804,6931020108627356421,2097152 --field-trial-handle=1956,i,8830185299573112575,2958301841758441289,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4172 /prefetch:9
  2⤵
  PID:2316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5208,i,12683891741931962596,11432933188762458408,524288 --field-trial-handle=1956,i,8830185299573112575,2958301841758441289,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5212 /prefetch:14
  2⤵
  PID:2696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5672,i,4105413590329790570,15389502660736973344,524288 --field-trial-handle=1956,i,8830185299573112575,2958301841758441289,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5636 /prefetch:14
  2⤵
  PID:4548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5640,i,481696003065568829,5439443401050612199,524288 --field-trial-handle=1956,i,8830185299573112575,2958301841758441289,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5712 /prefetch:14
  2⤵
  PID:4556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5664,i,5748044994563166975,4987971197589674337,524288 --field-trial-handle=1956,i,8830185299573112575,2958301841758441289,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5752 /prefetch:14
  2⤵
  PID:5052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4144,i,4760462152283651233,1760919620716637063,524288 --field-trial-handle=1956,i,8830185299573112575,2958301841758441289,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4164 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:2948
- C:\Users\Admin\Downloads\ProjectLightningInstaller.exe
  "C:\Users\Admin\Downloads\ProjectLightningInstaller.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2652
- - C:\Users\Admin\AppData\Local\Temp\is-83LSCJNOTR.tmp\ProjectLightningInstaller.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-83LSCJNOTR.tmp\ProjectLightningInstaller.tmp" /SL5="$F02D6,65967663,842240,C:\Users\Admin\Downloads\ProjectLightningInstaller.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1072
  - - C:\Users\Admin\AppData\Roaming\ProjectLightning\Project Lightning.exe
      "C:\Users\Admin\AppData\Roaming\ProjectLightning\Project Lightning.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1128
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.com/users/507878272072155148
        5⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:588
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7ffb4a96c188,0x7ffb4a96c194,0x7ffb4a96c1a0
        6⤵
        
        PID:4320
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1916,i,10391439462382234392,8970708166004641487,524288 --field-trial-handle=2412,i,11708601308583105444,12118195572002618577,262144 --variations-seed-version --mojo-platform-channel-handle=2440 /prefetch:11
        6⤵
        System Time Discovery
        
        PID:660
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1504,i,14437399202186288254,8900409535307384320,262144 --field-trial-handle=2412,i,11708601308583105444,12118195572002618577,262144 --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:2
        6⤵
        
        PID:1756
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2108,i,11082711407495443171,18023479590528288281,524288 --field-trial-handle=2412,i,11708601308583105444,12118195572002618577,262144 --variations-seed-version --mojo-platform-channel-handle=3004 /prefetch:13
        6⤵
        
        PID:720
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3504,i,2516763942436626629,9693922751739288420,2097152 --field-trial-handle=2412,i,11708601308583105444,12118195572002618577,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
        6⤵
        
        PID:3348
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3508,i,6414729059093644063,8578167379376783921,2097152 --field-trial-handle=2412,i,11708601308583105444,12118195572002618577,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
        6⤵
        
        PID:1004
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4072,i,7901205384677383155,3663930956376173044,2097152 --field-trial-handle=2412,i,11708601308583105444,12118195572002618577,262144 --variations-seed-version --mojo-platform-channel-handle=4608 /prefetch:1
        6⤵
        
        PID:756
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4068,i,15268684601697764983,6407903747444336344,2097152 --field-trial-handle=2412,i,11708601308583105444,12118195572002618577,262144 --variations-seed-version --mojo-platform-channel-handle=4612 /prefetch:9
        6⤵
        
        PID:4284
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4112,i,17936219109231822064,8636749310567290978,2097152 --field-trial-handle=2412,i,11708601308583105444,12118195572002618577,262144 --variations-seed-version --mojo-platform-channel-handle=4624 /prefetch:1
        6⤵
        
        PID:4144
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4124,i,9970294430729943639,1607907206481377958,2097152 --field-trial-handle=2412,i,11708601308583105444,12118195572002618577,262144 --variations-seed-version --mojo-platform-channel-handle=4636 /prefetch:9
        6⤵
        
        PID:2316
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4180,i,6994486594431981569,5999841120115355611,524288 --field-trial-handle=2412,i,11708601308583105444,12118195572002618577,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:14
        6⤵
        
        PID:5368
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4184,i,16276716958938379494,948604452302536782,524288 --field-trial-handle=2412,i,11708601308583105444,12118195572002618577,262144 --variations-seed-version --mojo-platform-channel-handle=2860 /prefetch:14
        6⤵
        
        PID:5376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5420,i,14548112348597135200,781207030544243172,262144 --field-trial-handle=1956,i,8830185299573112575,2958301841758441289,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=976 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5248,i,11151738667497777576,971313070554326630,524288 --field-trial-handle=1956,i,8830185299573112575,2958301841758441289,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5400 /prefetch:14
  2⤵
  PID:5604

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1776

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2236

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5432
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  PID:4412

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
PID:2324

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:5600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 e6460a0c651b9aa994dbb1edca47e132b39f48f484b79a59ccadd85cfd62d941
MD5 f10629f7e9f73edbafa442b93d741309
SHA1 eae9f0f7d9b857b26c894d23cbdb51b9a1932833
SHA512 3e8e2be4bc0362f537ee8e369a5ac01704241c6250cf548bc1d6e3624a39df5f92116d2f96a883cc3bfb1f351f67f862782a3cb98f89ee745799a402ff6ef97e
TLSH
T1DFF0D1A6C921EC2B18FD0B1820A4074BEB9013672B41895F3A3C92088FB5A3B459986C
MD5 SHA1 SHA512 TLSH

Submit Download

f_00000e

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000e
Size 84KB
SHA256 935a1ac520d47e4bac4264a4fb1a5fde04bc8845b291736efae66ecdfbef0f83
MD5 e16c655d848f2a6fed9d3dbd8c366a1c
SHA1 f1369f616cbb94b90624843f934a6dd55ce1cdb9
SHA512 a621a7af3b49b512aa8f05de6ddbf475d8281cd3a5121d6f14fa3b9df1a19b0c62b5889920137ec6e34f8beb2274387797f0e7f4aebeaa8984ef510d31cf82f3
SSDEEP 1536:VxC5/qlYy6STDPZ+cb/1tJqmxUswQ4SsC+YSE6RpuZ2wUxRIXE3cNIFGE6fY4QP5:xv6SHkcbPJqmxTwgd+YbSuZgxJ31FC/g
TLSH
T1B983122F0C5271A860F94DFAFDC922C26D86464199204901FFDE2C93C56B4F9DEEF684
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000f

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000f
Size 87KB
SHA256 81f4c79c73887e3939a30e8deac19f23d5403e7a592545802c347233cef79c33
MD5 625bfc88e024d6a1a8716dfc92e08ec6
SHA1 d524fbffb22a349d3a1e8785f8f9a8f4510ab938
SHA512 90390b7f97e890de06b1bf5623d2c41bdc226bb6a62e235d0eb704aadff00c724a7a9769b73059b3043d798d7601c617974e3ae8da8f428528304d47fad7ff07
SSDEEP 1536:VVUeKXprd0SsIHai/ikbDUHJEYTlygx6/T/coqpcuiQEaWbnhXcloW2ivmMY/w/v:zsZrRd/DUaYTEgQ7/5qCXBbhUoyOT/w3
TLSH
T19A931253CEC1164D75C1FA8E78DA078DFA92F4127B2A5848DE14C2E8FA0D5F168EA13C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4551b9d762e4287327987d7799448b72de875ca9a35b74baec3b36ff5e6e5aed
MD5 f699e898454c93f7bede16c1f023f337
SHA1 376170c28b2f27a203046c088b00cf1c33fe8f0b
SHA512 c71e564351b043957758cf6c34973ec9ef91297c3aa7a9380c79d94b39031659ed2abe8f1bed08e3a9e81f62e06ee598c03fec85c4893a0e2934d07aa684cfc9
TLSH
T1D171C57899F05E12EB4449338EFDAEB63270687D3A03AE36739C4C78082B7925107C1B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 bbbed4bc5cb4fe866cb8816ed19672f2f9159a5ffd4e13e65fe1ea6867440625
MD5 4cc225135a1172b73d484ff12454559f
SHA1 96df9736ed2d5317cb05af9eddd74031895acc4c
SHA512 9cc1cf1230a19b045e6eee5cff60eaa9d468881cf3a520d2353344f784acbf7a6fa5f0a07bd07297e8c17e092e3ce6d569d37a3433ed69b3531aeb4b5fbd7dc8
SSDEEP 96:D7mcmwY/3AkPpNmD0mzmsHmTmQjhnmgmOZ:D7mcmwY/3AkPpNmD0mzmsHmTmQjhnmg5
TLSH
T1F3919EF7C7E4856D8A0195F4FB14AE1FCE290914532D3C6AC8E4AF0BA3E2971D24178E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cd3f24a4-5ec1-4b5e-b813-db1466615883.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\cd3f24a4-5ec1-4b5e-b813-db1466615883.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 77f94510ceef57cb1be3a156d0cb1d364a9b9038cb595c1413eb2ddf7c2235cd
MD5 2483cf404f3f4967244b093f2c49013f
SHA1 a093d818e552662c0d281dbc79717d30de8b97c1
SHA512 3a73b89520aa84050257c9c76c996ed35a8e76ba8843372e31b047fd85416f9a02fadb2007e7c7d8300b371230ad8caaad7b97f3aba1c6b3b39b768e4073a937
SSDEEP 192:4RCkZTELWrv2bVF7xy1CyoJ+v7dpAPRp26Zw99Hsb+WNnKaPFeyL8IkwGVyIsnAI:4RCkSkv2bVF7xy1CyoJ6ZUXYrwvPFZ+E
TLSH
T13442B52AAA106D3F9DDBC229FA657753EBF5106535C01E84E6FCCA1C14EB9CC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 4deb0de65054e74d48e181f25ff2c963f7f9b71f980e2107f1501c32c11439e8
MD5 c60358b2f9571dd658b4f2272e383258
SHA1 0d58bab01f585cbdaa824d2bf1fc4e549ff59095
SHA512 35c4cc04c5c28b789dbcca690157ee1fa520733ce1ec66b735ccf17454652d5f5755a9747e11a4985e54f9b7a8ed9da6b09eda69c4fc1a6ad554dcb192a9ef5f
SSDEEP 192:4RC0ZTELWrv2bVF7xy1CyoJ6v7dpAPRp2F99Hsb+WNnKaP4eyL8IkwkVyIsnAUge:4RC0Skv2bVF7xy1CyoJWZUXKrwvP4ZAe
TLSH
T1DE42C62EAA10693F5DDBC21AFA257753DBF9106536D01E84E6FCCA2C14EB9CC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 bf2ec870498698ddcc451c9e166134be27ae33ff80ff57dcbe1aeae8a33c02d4
MD5 c84d868d5e4a8644908a2428b6480f05
SHA1 c61bf5313671542ed678f74db5073bc0f9bbbd78
SHA512 edd4175faa41c8b9912c19fd52eb7973eb99d7c5d9f37151f0a618d96238a62a66f815e9073bf836af562d4eabecd16b4e13bfa8c81df198ef14d82823b7aacb
SSDEEP 384:4RCkKkv2bVF7xy1CyoJ6ZUXorwvg2gZ+E:XkXv2bVF7xy1CyoJOxrwnq
TLSH
T1D242C62AAA106D3F5DDBC219FA697753EBF5106535C01E84E6FCCA1C14EB9CC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 86a708718cf15f4439caa697f6058448e2b7016cb1cef9cd2e54315587d87208
MD5 c23047ed70b8fe98404f2d539506eb71
SHA1 777411f14fab3beefe67a6f475f14f7e6e56c013
SHA512 0a47725dfc0cd3a51a0c13fc01329dccf73a0e6fe775075f027ab629f4c8fde68db8b61d4cd2ce4269a02632bafb0dcbc043ec6377186b9c4b1d39ea91b3d0ec
SSDEEP 384:8mjoj7KxkXqKf/pUZNCgVLH2HfgslTg97pLuLcSjuvXODof+ErU3i4JHGtovIld:8Goj7KxkXqKf/pUZNCgVLH2HfgsZg97V
TLSH
T1C77208676C4C9E370F94CACCD8167B4F9DB5014B65EE886483FA982903D5BDB110A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 ee5348c5e0324657c3f87776fae5459004cc3a0408929978d486b71ebe12e941
MD5 ce1fbbc0da60c85931912c932e8d3dee
SHA1 5c15f828410e5d8b9695759b3568e343bafda829
SHA512 e68b5dd1dd479f47fa6d5b8f2d4bef2031f9043b8f0b8b7b44d3c7c64f50fd70d3a1cf2d1090797dec159cf3a927838e7d8b41909b56008293bffba8f1f4858f
TLSH
T1FFB0125080026102C08206B4118214CC7158DF10960B5B0243F06966CC265A18125456
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58bc85.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58bc85.TMP
Size 96B
SHA256 18cf25c881ae2151fe4ee007a9e6da867a7c56fa18a02895ce7c775181d0c45a
MD5 13ebd22b7dd9ad418d8ced373fa26ac8
SHA1 993f47cec85dcf192af65e30bbc3ee5bee3bbd70
SHA512 b434b6f2df46c399b114dc363d26697dceba1e1fd6b80637eb4a18c52d555bb1c31aa4031e6a7c4746886ec4a43b13400a5afce103a60e69cdcc80e1ccc67bdb
TLSH
T1F9B022C0C002A202C00203B030CCE0EA302CCF20C3032202C3E00A2ECC28AB00223320
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 cd37f2d76b06aa6fd105224deebf50cc6481753f228e085720869e9fbaa3c0e8
MD5 38a42bf0fea9818ac3ff0ae680ec8fce
SHA1 08b9dd75d6d1a476479dc0bab49694232756a305
SHA512 846d377e1844890492a04bac8e53d1c465d9da58050af8b5a9b023f5dffac1f7fd2ca274ae3a2e43de2a3aebaa94e579bb3f5b5a091eb4348be56a28e1bd03f7
SSDEEP 3072:3EGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMi:3nm7Rkm1tYpBeh2BAoi
TLSH
T1D4C312379D75E8365AB9BB1EB04E0A1F1EF14DA3C920DE92C8D85B0433EA7CC1A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 2cfc5e78f7ac5e6060a538a7c00a2e6cdc15217ce32ae32fe807f814bd953021
MD5 a045b779ff185f93628aaaa934bde91e
SHA1 3a2f7cee1bdd2c12700dd3589d24ae19a54530c9
SHA512 c040a19263667506573ed70c187893ce8a45ed4e8b0ca5910a20d8aa59e3bf3391ead6e5fb993e38b52be3272b0d433ab81d7869f6665a84fdd70518f6e3f9a9
SSDEEP 3072:tGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMi:km7Rkm1tYpBeh2BAoi
TLSH
T1E2C312375E70E9375979A70EB48E0B1F1EF149A6C930DE92C8D85A0437E97CC1A45E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 0d54dabba74f2734ff3faa306108d7ce1ee974105ab27f7f5b34535671fc5afa
MD5 f2d011cd9a36b217be563d7a9b8ff7e6
SHA1 6e6ae72bc77fd6e9ababb665781757465bbccd5a
SHA512 ef59d4cc4f6f0fac651b9a3b7cf0e4e2dbe9d8b54683e42062157697fa58d2db3bfe37f06c66994a8af17b210475fb8e7f92b26619808c1e3f6644a587d5c15b
SSDEEP 3072:UEGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMi:Unm7Rkm1tYpBeh2BAoi
TLSH
T174C312379D75E8365AB9BB1EB44E0A1F1EF14DA3C920DE52C8D85B0433EA7CC1A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 b179c34b5c3c10184356b64ac819e45663479d6d1de393693e3eec653bac93fb
MD5 447c818adeeeff1ebe6bc4c1ba6e50a2
SHA1 d206e1b857bbfa82b744a1421fcafb7c754913c9
SHA512 00d9ecef8e46f551935ff65f01360a7861067546703273507c63e65f9f9241a01890d28397ebbff06e4f6767231f8b03e2cb94e3d23ae4b3ba0467f2e40d8d54
SSDEEP 3072:W+Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMi:WZm7Rkm1tYpBeh2BAoi
TLSH
T12BC312379D74A83B5DB9B71EB04E0E1F1EF149A7D924EE92C8D85A0433E97CC0A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 cb8454e78c6b987cd5b6cf06839dd5f5d0f63560786796f4450fbd7d84f5de9a
MD5 47ac068428043f1b0f7c352d3654b8cf
SHA1 97045452f4b44a2c1bd55e89f04c39bd1a62c98a
SHA512 a2976c435d4a889da8cf172134d8a06ce5ef274d39da290107f3ba0f548700cc46ce1e6dbf2867640c665343eb39327c2b614e41c7b27d772cd1c89af7f21d35
SSDEEP 3072:L+Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMi:LZm7Rkm1tYpBeh2BAoi
TLSH
T1B0C312379D74A83B5DB9B71EB04E0E1F1EF109A7D924EE92C8D85A0433E97CC0A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 ee623f3e3e5fa37d8f6d4794e27151ab871bcd9f22fffa709f0631fe1928a303
MD5 6738449b8054b2766c9ac0425641d7f1
SHA1 4d0d3bd6b508805f68572ff74b47f9e1fb69d81b
SHA512 696eadbb95bb5681debbc612f21d4401e72747b784fb521f3f278fae5ce6d8918c67591da582d2f07ac0f677736764afee3bf746f627948f11bab2af0b0d2df7
SSDEEP 3072:K+Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMi:KZm7Rkm1tYpBeh2BAoi
TLSH
T14CC312379D74A83B5DB9B71EB04E0E1F1EF149A7D924EE92C8D85A0433E97CC0A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 940cbc9ecbe8080b4f78231e8ea559e5f25ba4586d9b9c7484580010ea141f8b
MD5 7b136c46d44a9c4f8f42a3893196bfa2
SHA1 65e92a8f631d018328a7c2cd1ea9b52d24fb05ed
SHA512 06b71e8d2ad9deb7c9ad47e7b7fc808b8513e4cd6ba4c5e561fab3aec9e937d3990c50625c22f7f7a281e06579a42d4a615f255576af4efa3a9daab503cc1a59
TLSH
T1E7D022233A8CA800D2A78130C016C30002A900E068178A01F2A4C82C442B0E063CD183
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3d6022b8b09d410224e6f49ce6c5693abe531fcaf66bb13ef03126afd2691fe0
MD5 57d5bda89a3ce0cec5e5ba7de9f0b14b
SHA1 f3acef3d86afcfd0b7d491c8c55dd0679342b314
SHA512 b3100104fdba74d8ec0cde3847c8629b3f4d7d2f4eb07a7e44b61ece266b201daf1b4c4f2922da6731aa7e1518a90a163383bcb9d2738a6f78d052f8141237c8
TLSH
T1D4D012237A9CA410D2A78131D017D71556A910E468575A45F2A4C86D556B0A467CD187
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 61B
SHA256 e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377
MD5 4df4574bfbb7e0b0bc56c2c9b12b6c47
SHA1 81efcbd3e3da8221444a21f45305af6fa4b71907
SHA512 78b14f60f2d80400fe50360cf303a961685396b7697775d078825a29b717081442d357c2039ad0984d4b622976b0314ede8f478cde320daec118da546cb0682a
TLSH
T139A00254944498FF4655836A05654463C7AA504780285E565B24115E42A25AD0450947
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 49abb62109b82961e4c8e0a8266186ac57b9d4fcb717c644163a9e824e388d9d
MD5 5777d4eba2e42d96c70eb58043f2b276
SHA1 5f3f130252898f715d7d300c90970b236d3afb99
SHA512 6b3b587113d627ce33fe7a858f218afe9bd3b01978053e44ffb4b1932c51b7ccd08b7f14f6a2a236fd16082924ec3759f7ac6030f5dbac133bee3c293c742d2d
SSDEEP 192:zZi/yM/jK1Ml8vr/fJs+WpVYcEdpM/W6+WNGY0Yc0r1IgEJ:zZi5yr/fJs+WvYDM/bG5s9I
TLSH
T12842D8126A34597BCCDBD21DFA557F53D6F91473A2940E44A9FC9A1C00E6AEC2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 aa5a98108e7c5062f6d4425805bc7c86b514b00b3f80a03113cdfd01409cc110
MD5 8c40bd17130e113465817c7ad2b1fe21
SHA1 c190bc22df1cd050642dbd97026646c2ff866507
SHA512 de55e4f829d457274e8d6f013ebcb310d06f6a9132ccef0b1d26b9029b9724c01c9044ca211b5a12b442477f055128c394e5ee7e13ad25fb4ca212f7855d6f32
SSDEEP 768:vkl1j83r2pmWRmeKQBC8F1+UoAYDCx9Tuqh0VfUC9xbog/OV33ALl/C80/ZNroci:vkl1j83r2pmWRmeKQBCu1jaK3ALpCN/o
TLSH
T148E22C2B640CC77E4F844E6CEC26AF966ED801CBAB684D5447FA494C03C73EB551A49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 057c9c851dc365dba57e87ff28fd1aa20cd914962db7aa14500b466269d602aa
MD5 e5f41a18aebfa5abc45092e3573b7686
SHA1 693e6ddea02feb39b1e763599fccbc00d1ff98d9
SHA512 77710af7d6dd2403cda268f5a884890a139120d3634fd23698d88268670708c765bbb3698d963de88b265f926254f34d1a108a8011404c8abe6830ac524e77a3
SSDEEP 192:6GNW6i5fQmiUypOdyO7X5zPr2EOAu8oUajY6QLU6:6GNW62h3YO7X532EO7H5ULU6
TLSH
T1D802D935B968AC778FA39E45B58637275FE8112BD9956F80DAF82B1C01CB68C1306837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e6340b343ef00193cd0930863c03f9ecfc045c1937f270256f0cb91f4519a275
MD5 c09c7c96ea15a61affef618586e3d3fe
SHA1 8eb4a63e549f0e3af35a6bbf1d665998086b59de
SHA512 95aa3c49fa77df0b5a8574f99868fedd1f8c4c0f414c9d7fce2285ca770f6803845ea0ca3358a92b217942a8b03251d2891455a1297175307b3ed4c5897c0eaa
SSDEEP 192:6GNG6i55QmiUypOyx7X5zPr2EOAu8oNu25M++gGQY2qfZU6:6GNG62XQx7X532EO7HNu2G++iCU6
TLSH
T11A12F831B869DC275EE7A555F4C732939FA81077DD886F94E5E86B1C00CB68C270E827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 17021b6ea9918e2ad55799f9159cfe6c312f06fadbb0bf8d2651311b6d36354e
MD5 3cfedbca55d869ff51f52c33b34d1e8a
SHA1 06823fe888c2cc3fa7959853b5a1a86201fba2e0
SHA512 cc12829231e513d118e8bc5261fac592ca8e509ecb0f778e1652a573393fe8d4ea2e96eaaf7cbb30852c1a12124083725e1288c5f195455cf9a3b0a63d4ebb9e
SSDEEP 384:zGO8Nzur/0R6OOgX532EO7HNu2G++7jWu/dyjqKkzIbU8:39/0F5tOzNHGx7p/IjqnIbU8
TLSH
T10372083CEC645C7F85EEBB0D628E29234E68113BD5781A98E7D80B0CC07755CF342866
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 640KB
SHA256 9eccd7667075e084fb3054f2ed398b02f87bcb3494b443ddf85feba7c041400c
MD5 2e85c26325440f0130be7b67d546ac15
SHA1 395e13ca38963611ddc31f147d131bb16f415e4e
SHA512 ed091ae7a8241c71759e805a6ab71d523389bca04e482036124f06873454c91dd5c2b9f17e4277c67a95bef9782f917562bb1cf2aae36442797c6a0595433884
SSDEEP 768:l0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr3UzfEwPRzitFrzAqUmNKX09oJImdc:jpZltjYpktMhKSohZC
TLSH
T154D44137D6A0A0C4DF2C31B1E1EC5F0CBE22B10712A052475F75A67A7A633CA9D175EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WMSDKNS.XML.bak

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ddbnhroy.newcfg

Path C:\Users\Admin\AppData\Local\Project_Lightning\Project_Lightning.exe_Url_jfllezjrfznmzxvloa32osn2guqj5mpr\4.0.3.0\ddbnhroy.newcfg
Size 498B
SHA256 be4f2acf3b39bed3ddfc82017b9172131caf1e11124065f771d5fb0a3a7edc38
MD5 25cf360d503cee36b16f402551037104
SHA1 cc78ad5d410aedd17b2cf5806624627065917d83
SHA512 0bd69dbe4bcfb10b53da6cac36ada8780d6fbf07194f5a178d491ce59283a0d487126eb7a7ef3f769f5510283ee800afa1d0294b01043f1fe6af4ea962632cfb
TLSH
T1E3F0654C61C0DE6A66725E35D669464AEFB02793403321F4B4AD25334B308A90AF33A5
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\Project_Lightning\Project_Lightning.exe_Url_jfllezjrfznmzxvloa32osn2guqj5mpr\4.0.3.0\user.config
Size 349B
SHA256 01d9068e5e1dc777c4f8e22ba5767c4380e505065b701c8baa3654d7da00fc15
MD5 aa384442323e99d28a739bc82db924c1
SHA1 bf4e9733825d025ade8ba26f2bc7f58d015282e4
SHA512 2273db04c3a06ad4351627004a9f494d0ddd7879a81a3fd6ecfdf8fbccb0107195c132350632abafa0cdf612394d7c7185117fa85f6607a52d9f5a6576eda1a7
TLSH
T1F2E0124C51C49D6BA6725E36C65D8A0AFFB03793403321B4B56D66374B754980AF33A1
MD5 SHA1 SHA512 TLSH

Submit Download

ProjectLightningInstaller.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-83LSCJNOTR.tmp\ProjectLightningInstaller.tmp
Size 4.2MB
SHA256 31d0a70f3475dc1fd526fd5d4066d68628eb8673c37505fd99e6c972e5ff7724
MD5 96e7701d4a1a007c862f8d699e892f4d
SHA1 31d8515c4ca10b37752d6439493f21dcb07cff9b
SHA512 2367f8f288fa1334e22e405d4c27938b3fd5b188f3f0119281bee9d22ee730f4025ccf7a32682703d41cdcfcfbeb6314c70379ae572a2ecb477e62ff2cacc7e4
SSDEEP 49152:d3yGw7V2h9z2lqSvM0/WtmueejA0JuDeT4q3ZCNW7Iu9ReR9nc4NDR5mo4333lwa:ds7Y8/7ueejA0JuDeT4eZyuaNHm1333d
TLSH
T11D267C13B389613FD06A2B3A7837A254993F76703916CDDB6BF41A4C8E351807D2AB47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Content.Area._3D.dll

Path C:\Users\Admin\AppData\Roaming\ProjectLightning\Microsoft.Content.Area._3D.dll
Size 5KB
SHA256 8d1be734dff2aea449c3536fc8d4f2a6561f7747b7d09fbd431e99338f77e452
MD5 e680ab50d4ab407fcdfd06444074ef05
SHA1 605678be2b29df4ed53ba60c3c78798090b201f8
SHA512 69819c9d44fc0b15fa795d87697c8fa777ed4e7c3a76439964822cb886d063648d4ee17f0503e7156c575bd3599739d7ccde51c0975d43f9c00059dd33d19d3d
SSDEEP 96:nFH5wHRbHRKnzQ5j71CHRRxh//HRVHR7HR2oBdEm5Q6Wd:FH5BnMt7m/SAVvW
TLSH
T112B17321A3F88336FAB38F7EA9B253451631FA21DD12CF5E0490214D2C2AB008E31F66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MySql.Data.dll

Path C:\Users\Admin\AppData\Roaming\ProjectLightning\MySql.Data.dll
Size 1.1MB
SHA256 6568624f775f2ec92611d4e7a524456fe1b7342982380f2f55cba2170e9430e0
MD5 9d18ea9872788ca7d415a4953206fefa
SHA1 223a4433d3dce892f50c773fb8cedc599f1ab5c7
SHA512 1df37c675c0d6363724dd58970eb752a8eeaa19730c6d2831a5afa9d7b34e795ff92a5e83d5a672176d37c75b7df20eb4030ca447da5a32e56edeb34c3951d96
SSDEEP 12288:jA1VGhSIDrwtpMioRm68eatoKLu4lnklOH3mF3eCx2C9xrS8A:MhIPwtAKLuxlOH3mF3H7rSj
TLSH
T172457B1077E89929D2EFA678A0A5965C8BF1ED17A253D71F1A0CE6DD2D327808F00377
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Newtonsoft.Json.dll

Path C:\Users\Admin\AppData\Roaming\ProjectLightning\Newtonsoft.Json.dll
Size 695KB
SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
MD5 195ffb7167db3219b217c4fd439eedd6
SHA1 1e76e6099570ede620b76ed47cf8d03a936d49f8
SHA512 56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
SSDEEP 12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
TLSH
T166E4394123F98F2BE1AF6B75B4704E1543F9F917A6B5E78F9A04D9A91C43B408E403A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Project Lightning.exe

Path C:\Users\Admin\AppData\Roaming\ProjectLightning\Project Lightning.exe
Size 10.7MB
SHA256 f866c1629c203b37219199c02c64d5e8b3cffad8eb841a3520e20b5c2a5ce701
MD5 d4639d3c7424d986e72e147e8a2554aa
SHA1 88375809568fcfe688ba41fdec97762f3dc12122
SHA512 4b189633ccf37f321f01bbbc284382165e1136470c3d4c74e3c7b3b9207bbfdef8e218d7a41dbc9631726ea87a9f524cafd251e75a11dc2dcc87b673acec4157
SSDEEP 196608:vEMkSSUZu/7V2Ua1iBjLzIVRFdMAbTr5Fjbv5Dzv0lzrgkp:vETSSsG7oU+4jvIVZMAFvhnWN
TLSH
T1D9B62391B7674714F12B463C2AD2C33C3A31B8016CAA971FB47B58F9A9493B5649B3C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Project Lightning.exe.config

Path C:\Users\Admin\AppData\Roaming\ProjectLightning\Project Lightning.exe.config
Size 3KB
SHA256 688db9917b527b298bccc9b957dc3a66a167e23adcfb131bf7c4f540d6ec2173
MD5 288d8a009af9a74262198b41a287836e
SHA1 a0a9b720622877f6f73400814c94bb24a0df7d1d
SHA512 e7f1f4b6cc92eea8d742457583d127739726e79a9d991e52add4872504ee62cbd1cacc8c5e09490c1fb086aeff90a0ff89ca58c0b2e90c005e49b74ae8ee9238
TLSH
T158618E1061C8BFE50B731A626E6B6418CFB903B7295D159CB0EE6B8B8F3598A0353177
MD5 SHA1 SHA512 TLSH

Submit Download

ReusableTasks.dll

Path C:\Users\Admin\AppData\Roaming\ProjectLightning\ReusableTasks.dll
Size 21KB
SHA256 d7073e7df4891fe6452b6c356b431fe9b59ee5687ca2cfe9a0f92b4d4abf3da2
MD5 d9bed98270f79cbd5320ceeb67be9695
SHA1 e30ff2a9629e84f0d55142169806bd4e61c6ed70
SHA512 c1f4d47999d297c84890be4491bfa89d514cbfe419575e2a6741b138812e24d647e82949a678f804e1753c55b043fd04cdf2efa98afe419d322ff797aa670071
SSDEEP 384:IHCFn8jL8jQlfW2Uw4mfAImKrDowVWFzA6W96S6/3usNViU5b:8CFn8jL8j2/fAIm2PVWF8l3q
TLSH
T131A2180AD7DC132BEB7F9B7AD5B5100187B1E54A3922E36E1C8CE2A83C433924577799
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Data.SQLite.dll

Path C:\Users\Admin\AppData\Roaming\ProjectLightning\System.Data.SQLite.dll
Size 439KB
SHA256 77dac4e1aa63161d6aff363030a801945d6b8d5b823a6b460b2c2be9ec38d3b7
MD5 0d56ea52b6da5eb637d5e207f241d35b
SHA1 5ba0c52d9d60b34ee74d013f8389804029e60f0e
SHA512 72037f3b8934bb43fb3a4c396dc7c82d3dba3f6a9979522f2f38bdabdfea29a73e4db3fa544b7d43de9314fb21a78f1e006c1fb18a58b75a7c0b83d7ea6d398c
SSDEEP 12288:iO69tgrf5V0KlhD2oU/+zFjhe+q9eJSMLprv3lRPhFrFckvUl7zFquovh1sSKQWk:iO69tgrf5V0KlhD2oU/+zFjhe+q9eJSW
TLSH
T17CA46BA027EC1109E6FF56B8E87164419B70F553AA77C34E74C4A1EE2C22B805E637B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Runtime.CompilerServices.Unsafe.dll

Path C:\Users\Admin\AppData\Roaming\ProjectLightning\System.Runtime.CompilerServices.Unsafe.dll
Size 17KB
SHA256 37768488e8ef45729bc7d9a2677633c6450042975bb96516e186da6cb9cd0dcf
MD5 c610e828b54001574d86dd2ed730e392
SHA1 180a7baafbc820a838bbaca434032d9d33cceebe
SHA512 441610d2b9f841d25494d7c82222d07e1d443b0da07f0cf735c25ec82f6cce99a3f3236872aec38cc4df779e615d22469666066ccefed7fe75982eefada46396
SSDEEP 384:EybU8ndrbbT9NWB2WL/uPHRN7bhlsQVryo:Ey5ndvWbMPVryo
TLSH
T1A8824A21CFD84503FE627B344568D183FE38E38A6806A36A2586F57A1CD63C57B31E38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WpfAnimatedGif.dll

Path C:\Users\Admin\AppData\Roaming\ProjectLightning\WpfAnimatedGif.dll
Size 41KB
SHA256 b4c69be213ba3dd40e6bc819b7bfc13ab03d06d5f3efa0e4643b1b55e5a529f9
MD5 47d729b6841f1e0e510bbc7d74454b73
SHA1 bb7a519a2bf2dbfa8aef238241d6dd5c62aeed77
SHA512 f5ecd0cca56306273685c12ccb5af8f540161e2cffe3f639a2fa1f9de29cfebb2f6d8f8ba4ad43e02a721da30dd8e3cc911e46e4237578e026a5ba8c059429af
SSDEEP 768:H0Gl7W1UiZTo1ooEqTh0sq/s/MnBOyvUPrYZbkch:UqQpZTsooEah0sqU/by4UZzh
TLSH
T135135C2403BD836AC75E06FBB4F0402442B6F3867512DBE96EA4E16FAD6739107147B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data-fix.json

Path C:\Users\Admin\AppData\Roaming\ProjectLightning\data-fix.json
Size 44KB
SHA256 ebaf7eca3da1342adf1970f20477609c7762baaf124dc09afdeb491cd9e065a0
MD5 b36b0060b72a1d9a61785d426e53acc8
SHA1 eebd8d16067adcc967c3a351850facb3089d39ef
SHA512 9bc6d1edc52f9feee36dcd7483d1e98be663e6f482115c6158f07a1b7ffd15f764f768bfba239185b300f8b23c7bf6c539b4187b3dfb622f0998f0164e902095
SSDEEP 768:aOSY6Z1ww7KD0Z+5uoBaQVLA8cVSRwDMKnlLipF7ATCkoXFT23UA1dPuNOfnRDyn:dskL
TLSH
T1BF23BDEF9461AD7E1E5CD1E0B62F118BF85992474C88BE8DB79F8B182F2415F203592C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

emerald_inferno.mp4

Path C:\Users\Admin\AppData\Roaming\ProjectLightning\res\media\backgrounds\emerald_inferno.mp4
Size 9.4MB
SHA256 8cdb335166913e3215dab31539c65d10e4f64a9f1913741ddb4c7edbd0f5762d
MD5 e46ed8af6c670dcfbe1976d849b4f53a
SHA1 4d6f53d8c6c64080d89ff485741414112fa8626b
SHA512 5de17fa564232acb85380a908180a73d3d09114d6c551496188e1af4f6e0f8ba6b220132ad33064bd7155816e8e446899cd775fe622eec80f0b97edcc087cd4b
SSDEEP 196608:qY7tRRq8NVpnl46knPipASM9HL4orf/is2HVNYC6/OIjoVrgfifr:qYBTpu68P1n9r4o7iLnYC6/iV0fwr
TLSH
T170A63314E3A60044CDDDD2715FF3E198BE70D1666023931365A1DEB9FA26B4A0CF2EB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

promo1.png

Path C:\Users\Admin\AppData\Roaming\ProjectLightning\res\media\promos\promo1.png
Size 247KB
SHA256 8cc9f3ead14f25e8ac775a8bbbc4f5d0f145d190afd20bb9b6a78994b596d05a
MD5 efdc6a46b60ea920de6ffd4b5491bcc3
SHA1 d992e29025dd7febe170312de41429036359afa5
SHA512 cbd5b14297ca4e2c94c71be71b47bbff66aba03b5d5046f8eff236b3c371aa3db8814da5beb3ae68af19e8ae2b2bc40d26997b5c850b19c4f0df6ea2e876371e
SSDEEP 6144:EunLZPPmobRoYmWuqnLSp1F3CINXSbJ2vrI49s5Pxns41o:TVegRo7WuALQ1FVSbJ2vrP9s5PxnE
TLSH
T13B44230BC2C24BA2FD1E214E41C93CB95A4A73E9D4AE45B8085B7D767E14E34861BF1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

promo2.png

Path C:\Users\Admin\AppData\Roaming\ProjectLightning\res\media\promos\promo2.png
Size 185KB
SHA256 fa86c8c0886344998d7627dfcf2981c2536258968203942b8106e872ff121dc9
MD5 8bff4974ac4a2ed3e14106be302eda71
SHA1 7ac508d2f07f674db79f325e685291c295696202
SHA512 bc5095b09c32f6ef7bd2f1439fe9ebd2041b12da14f92565c2db0eb8a7057255e3870b18baa06d8dd345e158e33b05b0e4d829ff335ce30cecdecf243fa9a172
SSDEEP 3072:kM/j0TC/MK29YY6zwhy5CLMIA4P3r5rrcBRYtskdqF0VuF6Lfl0gHquGvIDzivv5:kM/oSgWY6zwhy5CQ0P3togikdu0TLd/K
TLSH
T1E01413D380E4628011BE542A8BF25FCBE5372153B9E88C52E239E7F5D5DA17C68930BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

promo3.png

Path C:\Users\Admin\AppData\Roaming\ProjectLightning\res\media\promos\promo3.png
Size 128KB
SHA256 e76e503e75da0bf427b8239e5cfc93c9a803c5b9d86d0c604ba73fcb67164d2a
MD5 7c00d601e09f06b27745e821c5184f0d
SHA1 167b8e498b6e48e05a8510085b3d29367f53e72a
SHA512 c21a664b2cbc08087c1d724160ab9f9b123b33661a4164ec5bac936e549473c568c4c851cc2cc06cf95569aed9f8ba0f29c96d8112aaee6f905b10ad2c078b45
SSDEEP 3072:I4tm2jWaHIx+cIhWV9JiWwJcTTsLtDaFvPEoBqrUe7O5Zf89hB:C2CUIIcia92cTMpmlQ/7+ZU9L
TLSH
T198D312480C700355C62BFB14BBC906B03246DB9D9BC26A976EABE536D9CDB10F5637D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

promo4.png

Path C:\Users\Admin\AppData\Roaming\ProjectLightning\res\media\promos\promo4.png
Size 209KB
SHA256 d87ca24fbc45fa3e1a9df815c3350d98583736e9057cf6060bf2befc37b8cd23
MD5 5f93ff47a464b8c1e16d41307008e835
SHA1 a17a5ac06fbf77577ac6b885165c7337d0fba546
SHA512 da12438a437e5f0ca6b80c3f71dc25bf94b204a40d7006b091ad230ba952717205f55b52d56f9d086927a709085b3b8e62731aa76deeb360276f4d848feb8078
SSDEEP 6144:rXZUXAWOshSOY4B2nEjxOzWzDrVhgof0e6I70KV:LZUXDVhShxc8of0ehrV
TLSH
T14C2423B59B8338B65F49E1D9ADE1CC964DB5A44F196B53CE3A810EC2B5F502B2F07043
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

promo5.png

Path C:\Users\Admin\AppData\Roaming\ProjectLightning\res\media\promos\promo5.png
Size 271KB
SHA256 99b7a4c7c210922da0014cc926c2ce2c2232b649cb71089c657c24d5eff39ba9
MD5 f3a126ff4acbbd3e8878b0e3620b8c11
SHA1 b9230930fd7e0401866eee52b9367c2a8ddeeb28
SHA512 5a8cd31c3c20d5e0156a62665b18b32d582cb667020dd855fc9fbcea2b250205d5b74b214a15a3314e83a4c7b4b7f69dfd7876413e7122bbba58be2906ed3992
SSDEEP 6144:1oPZfNWy0xazQYymvGoRLq1118xupggTKwwBgRD1:1QJr0xazQYymjhqlhgG5l
TLSH
T11D44233830636813F92AAA343CF1DC9040E915DDE2E95E4D7A59E6CBCB2F5A04B7C94D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

promo6.png

Path C:\Users\Admin\AppData\Roaming\ProjectLightning\res\media\promos\promo6.png
Size 143KB
SHA256 86e2fc61af3e38d55433295d79abdd53e09f91b33a1bede459a28bcb0bd7427d
MD5 457b4e195492aa6600d83faaf916c590
SHA1 2c51858e64ad056e57c6a46bef96a5ee9706341f
SHA512 76cd8dcdc4845aeaac29bc0ed81ea3a7a8ebb1e763e77b800fe477218c57124732f86ff507a031ac34dd74b7fe73e4b07acef0b2525f9ff9a63e99a52a4e2d75
SSDEEP 3072:JKUKtZlSe0KQsKlcQ66DI/I+VtNkg3PY2dYUTK+Arr:4Z4sKlJ64ItN53wfb+6
TLSH
T1A4E31353BE8578D195D22C73CFF71D96F08C7925905902C7CC63382BAB606A61B7EE88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

promo7.png

Path C:\Users\Admin\AppData\Roaming\ProjectLightning\res\media\promos\promo7.png
Size 207KB
SHA256 a1267fef3efd4af3c6bc5d775f52aec796c6c184982aae6f18386a298e5993e6
MD5 b6be4a4b94ea6fd8b46fb31b3a02783c
SHA1 4f30ad7c34bdac3be9ca728b1d29810fcab91ff8
SHA512 9c202734c4e7153692d2a28ee071d5011ce5a59e53485a4f9dfde167d0e36b8b672ceb93d95ec1bbd27604262df3c9a7dafb45e16bf80eea54aa2fc2dd927b51
SSDEEP 6144:tCmjd+t0DyoFiKIT7jmObr6vnDHcNS2eabOwYBCf2:tCgd2oYvj1br6vnDHcE2Ja
TLSH
T1E624224C3A88E3C6156FBD9CCC002795B4C8B0AAB1AEDC3794FF807206866A59595CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

promo8.png

Path C:\Users\Admin\AppData\Roaming\ProjectLightning\res\media\promos\promo8.png
Size 241KB
SHA256 246e182b36e69ddae97a791bcaba49946d46b425ef8c54a695cf89a8f4dc8cd1
MD5 8a8c8ba36eb585a443b5c32d4e33a015
SHA1 3925d07f204b2940f0468fd9260a12cc90ac9a49
SHA512 ed2fff1d9ee40069e46f6a82b199b35db9605222025bc03c5de1f5220d2dcf9208723da11a7744dcd70afdd327356dbe521f10b0ab1973f2cbc4073794d649b9
SSDEEP 6144:HG3lS3kfTo2AKE6+RycCdAOHtS1LlQMi67UBd5:QlS0WrFJCd01Lln6f
TLSH
T1F73422311300ED4B81B426A7D93C0DEA86FEA50A1C275C7E7272DA5D0C656FAE78F5B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

promo9.png

Path C:\Users\Admin\AppData\Roaming\ProjectLightning\res\media\promos\promo9.png
Size 184KB
SHA256 aa75bd6659377b468fbe02ab3e98085cde60215d72c484d314076e8d22d6e81f
MD5 77fd268503ae65248a8299dc3477d9cb
SHA1 ab5929a7e77769c8c09c6fb468bddeadcaf2d892
SHA512 ec9c3e873dba239ec72cca87d1d5b4a587319794c6e2f75eb696d069b0aeb94b1648b45ab6f13763bd342ced4c2c7ca707efd2acfd3e77010ff8150488c6b08f
SSDEEP 3072:iBMlymGTWphekLL3u8EvRBocd2guTqiO/ugQ4J4vIWsjifTbXMDkcgUtpupXNMuk:iBCGipk6e8Ere7O/ugl4vIWgSnXukPUr
TLSH
T1E1041367F28CAD25F4761E1324E2575D6280F0E3FA7B18224C7CFBD96065A8973A240D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sponsors.txt

Path C:\Users\Admin\AppData\Roaming\ProjectLightning\res\media\sponsors\sponsors.txt
Size 53B
SHA256 b06c6a114d65b916a660b73df53ced8c00749055bfb1da959d487f4ec707407b
MD5 f678eac6ad3640b8229fb02c0805206b
SHA1 dd8e9376f19222c21445c9a08c6afa1a060fa12b
SHA512 e0df82c18b634cbf4a095b860292449fa010265f59f874aeaff375e5b0009126406b01d0d020b99307b5279e2e69a7df89d05990b9cf784a64f1582fe51f251e
TLSH
T11B9002A71A040C6D570C2569838725194203C45B564E5865980B085C85442529344595
MD5 SHA1 SHA512 TLSH

Submit Download

steam-force-sponsor.png

Path C:\Users\Admin\AppData\Roaming\ProjectLightning\res\media\sponsors\steam-force-sponsor.png
Size 42KB
SHA256 2e6bd9f01fae043133f839b732f69422bbc3e66bbc3ef94dc3467eb0ad706fc4
MD5 df3d80a3cbea9ffd3143e9eb734c19d2
SHA1 fbf99797c7ae014add720b34046c7947d1cf1253
SHA512 c2fd1110236f783c606dedae5dd763f4cfa164e7d9ce106e3e63af803a0eac7b274b58c984a71fa90bc957424ccbd8864da0f76611577b5e401b1bfc4539e2f7
SSDEEP 768:9Z+ZWXPKk8nmiXQ9c4vgm3GEXsVyXNjWQzmWoBlYTnqeX1AAgEadItOk:9IZWyk8m8yvgnEXsVuWQ6Wo4nvRed+Ok
TLSH
T10713F16A0D8F94FE7191A1085ADF3865CB4B95C4E4BD15CAA0E1D4C3C14C8C7EEA53AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Project Lightning.lnk

Path C:\Users\Admin\Desktop\Project Lightning.lnk
Size 1KB
SHA256 969caf85549d7d164d4d0ff3459306b60161db9d78cd1e91e041d40384085f3f
MD5 60610766cef6b91e2cd805b7f039304c
SHA1 29733c2b7d37e2e1baf5179a3bd0e6e9d2ffe27d
SHA512 396fe46520007cd835fb7c069845d02a905d9a2466aaa34363c412b5861abe57ef4f4947b58042d63783e57036d670bb32d748a0385eb5f7ce67869107c4f25f
TLSH
T13511904015DA271EF1D9537D417B0B34E735FEB16302DE1D4520924D5D32B125C1973A
MD5 SHA1 SHA512 TLSH

Submit Download

ProjectLightningInstaller.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\ProjectLightningInstaller.exe:Zone.Identifier
Size 26B
SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
MD5 fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1 d59fc84cdd5217c6cf74785703655f78da6b582b
SHA512 aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
MD5 SHA1 SHA512

Submit Download

memory/1072-639-0x00000000035B0000-0x00000000035B1000-memory.dmp

Download

memory/1072-893-0x00000000035B0000-0x00000000035B1000-memory.dmp

Download

memory/1072-892-0x0000000000A60000-0x0000000000ECA000-memory.dmp

Download

memory/1072-916-0x0000000000A60000-0x0000000000ECA000-memory.dmp

Download

memory/1128-911-0x0000000006460000-0x000000000647A000-memory.dmp

Download

memory/1128-1127-0x0000000007520000-0x0000000007528000-memory.dmp

Download

memory/1128-962-0x0000000018490000-0x00000000184AE000-memory.dmp

Download

memory/1128-960-0x000000000F390000-0x000000000F39E000-memory.dmp

Download

memory/1128-961-0x00000000193E0000-0x0000000019402000-memory.dmp

Download

memory/1128-959-0x000000000F3B0000-0x000000000F3E8000-memory.dmp

Download

memory/1128-958-0x000000000F310000-0x000000000F318000-memory.dmp

Download

memory/1128-937-0x000000000A990000-0x000000000A9A0000-memory.dmp

Download

memory/1128-938-0x000000000A990000-0x000000000A9A0000-memory.dmp

Download

memory/1128-941-0x000000000AC40000-0x000000000AC50000-memory.dmp

Download

memory/1128-943-0x000000000A990000-0x000000000A9A0000-memory.dmp

Download

memory/1128-944-0x000000000A990000-0x000000000A9A0000-memory.dmp

Download

memory/1128-945-0x000000000AC40000-0x000000000AC50000-memory.dmp

Download

memory/1128-942-0x000000000AC40000-0x000000000AC50000-memory.dmp

Download

memory/1128-939-0x000000000A990000-0x000000000A9A0000-memory.dmp

Download

memory/1128-940-0x000000000A990000-0x000000000A9A0000-memory.dmp

Download

memory/1128-935-0x000000000AA70000-0x000000000AAE6000-memory.dmp

Download

memory/1128-1134-0x00000000075B0000-0x00000000075B8000-memory.dmp

Download

memory/1128-1132-0x000000001B8F0000-0x000000001BC47000-memory.dmp

Download

memory/1128-1133-0x000000000D2B0000-0x000000000D2FC000-memory.dmp

Download

memory/1128-1131-0x000000000D320000-0x000000000D38E000-memory.dmp

Download

memory/1128-976-0x0000000017F90000-0x0000000017FA0000-memory.dmp

Download

memory/1128-934-0x000000000A9B0000-0x000000000AA62000-memory.dmp

Download

memory/1128-928-0x000000000A660000-0x000000000A7E8000-memory.dmp

Download

memory/1128-918-0x00000000081B0000-0x00000000081CC000-memory.dmp

Download

memory/1128-1246-0x0000000017200000-0x0000000017290000-memory.dmp

Download

memory/1128-915-0x0000000007130000-0x0000000007138000-memory.dmp

Download

memory/1128-910-0x00000000062A0000-0x00000000062AC000-memory.dmp

Download

memory/1128-906-0x0000000000D30000-0x00000000017E0000-memory.dmp

Download

memory/1128-1248-0x0000000006630000-0x0000000006656000-memory.dmp

Download

memory/1128-1212-0x0000000017090000-0x00000000171B6000-memory.dmp

Download

memory/1128-1247-0x0000000006420000-0x000000000643C000-memory.dmp

Download

memory/1128-1214-0x0000000001FD0000-0x0000000001FF1000-memory.dmp

Download

memory/1128-1213-0x0000000002090000-0x00000000020CC000-memory.dmp

Download

memory/1128-1235-0x000000000F280000-0x000000000F2B0000-memory.dmp

Download

memory/2324-1277-0x000001EDD1240000-0x000001EDD1340000-memory.dmp

Download

memory/2324-1335-0x000001EDF4800000-0x000001EDF4820000-memory.dmp

Download

memory/2324-1338-0x000001EDF49D0000-0x000001EDF49F0000-memory.dmp

Download

memory/2324-1336-0x000001EEF5340000-0x000001EEF5360000-memory.dmp

Download

memory/2324-1352-0x000001EEF6200000-0x000001EEF6220000-memory.dmp

Download

memory/2324-1353-0x000001E5D0E70000-0x000001E5D0F70000-memory.dmp

Download

memory/2652-634-0x00000000000B0000-0x000000000018D000-memory.dmp

Download

memory/2652-891-0x00000000000B0000-0x000000000018D000-memory.dmp

Download

memory/2652-917-0x00000000000B0000-0x000000000018D000-memory.dmp

Download