77df6b611f35bd5d9b73d84e380ad56c8111e52ecd08d61d2c9cbd5aa50868bf

Analysis

user interaction
yes
max time kernel
900s
max time network
874s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/06/2026, 14:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ProjectLightningInstaller.exe
Size 77.2MB
Sample260608-repn7sft9x
SHA256 77df6b611f35bd5d9b73d84e380ad56c8111e52ecd08d61d2c9cbd5aa50868bf
MD5 405de6bee6abb363285ff96c3a319d50
SHA1 2d285f6e3c226c6326a548cf7e95750721d8d78e
SHA512 557c56529cfaaf7baf079fb8397b83c93313aa5ff36664a5e8d4115e9126a923e33c6d1b4777e5bb86f972d6da5394e5c702e6263488979cc3509e831dd44a85
SSDEEP 1572864:aWBK/ORVrLmk1VhcvW3dgYrJbwmTSdf05uEnysyFnGZPtBMHvdQ:NZ3rLmkVhcGFbB28ysyFnGaQ
TLSH
T1C60833336286A57FF5AE2A3706BAD9185937B860145ECC1786F40C0DCF384B12DBF65A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery installer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
900	ProjectLightningInstaller.tmp
6116	Project Lightning.exe

Loads dropped DLL 8 IoCs

pid	Process
6116	Project Lightning.exe
6116	Project Lightning.exe
6116	Project Lightning.exe
6116	Project Lightning.exe
6116	Project Lightning.exe
6116	Project Lightning.exe
6116	Project Lightning.exe
6116	Project Lightning.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
2	raw.githubusercontent.com

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	Project Lightning.exe
File opened (read-only)	\??\J:	Project Lightning.exe
File opened (read-only)	\??\M:	Project Lightning.exe
File opened (read-only)	\??\N:	Project Lightning.exe
File opened (read-only)	\??\S:	Project Lightning.exe
File opened (read-only)	\??\T:	Project Lightning.exe
File opened (read-only)	\??\V:	Project Lightning.exe
File opened (read-only)	\??\G:	Project Lightning.exe
File opened (read-only)	\??\H:	Project Lightning.exe
File opened (read-only)	\??\K:	Project Lightning.exe
File opened (read-only)	\??\L:	Project Lightning.exe
File opened (read-only)	\??\O:	Project Lightning.exe
File opened (read-only)	\??\P:	Project Lightning.exe
File opened (read-only)	\??\Q:	Project Lightning.exe
File opened (read-only)	\??\R:	Project Lightning.exe
File opened (read-only)	\??\E:	Project Lightning.exe
File opened (read-only)	\??\I:	Project Lightning.exe
File opened (read-only)	\??\W:	Project Lightning.exe
File opened (read-only)	\??\X:	Project Lightning.exe
File opened (read-only)	\??\Y:	Project Lightning.exe
File opened (read-only)	\??\Z:	Project Lightning.exe
File opened (read-only)	\??\B:	Project Lightning.exe
File opened (read-only)	\??\U:	Project Lightning.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ProjectLightningInstaller.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Project Lightning.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ProjectLightningInstaller.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5216	chrome.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/5528-0-0x0000000000FF0000-0x00000000010CD000-memory.dmp	innosetup
behavioral2/memory/5528-248-0x0000000000FF0000-0x00000000010CD000-memory.dmp	innosetup
behavioral2/memory/5528-252-0x0000000000FF0000-0x00000000010CD000-memory.dmp	innosetup

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134254013243784273"	chrome.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1768642833-2142038154-4041560723-1000\{8F9CE74F-39F0-45FF-B58E-53DCDB6E9DDD}	Project Lightning.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
900	ProjectLightningInstaller.tmp
900	ProjectLightningInstaller.tmp
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
1708	chrome.exe
1708	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	6116	Project Lightning.exe
Token: SeShutdownPrivilege	6116	Project Lightning.exe
Token: SeCreatePagefilePrivilege	6116	Project Lightning.exe
Token: SeShutdownPrivilege	6116	Project Lightning.exe
Token: SeCreatePagefilePrivilege	6116	Project Lightning.exe
Token: SeShutdownPrivilege	6116	Project Lightning.exe
Token: SeCreatePagefilePrivilege	6116	Project Lightning.exe
Token: SeShutdownPrivilege	6116	Project Lightning.exe
Token: SeCreatePagefilePrivilege	6116	Project Lightning.exe
Token: SeShutdownPrivilege	5556	chrome.exe
Token: SeCreatePagefilePrivilege	5556	chrome.exe
Token: SeShutdownPrivilege	5556	chrome.exe
Token: SeCreatePagefilePrivilege	5556	chrome.exe
Token: SeShutdownPrivilege	5556	chrome.exe
Token: SeCreatePagefilePrivilege	5556	chrome.exe
Token: SeShutdownPrivilege	5556	chrome.exe
Token: SeCreatePagefilePrivilege	5556	chrome.exe
Token: SeShutdownPrivilege	5556	chrome.exe
Token: SeCreatePagefilePrivilege	5556	chrome.exe
Token: SeShutdownPrivilege	5556	chrome.exe
Token: SeCreatePagefilePrivilege	5556	chrome.exe
Token: SeShutdownPrivilege	5556	chrome.exe
Token: SeCreatePagefilePrivilege	5556	chrome.exe
Token: SeShutdownPrivilege	5556	chrome.exe
Token: SeCreatePagefilePrivilege	5556	chrome.exe
Token: SeShutdownPrivilege	5556	chrome.exe
Token: SeCreatePagefilePrivilege	5556	chrome.exe
Token: SeShutdownPrivilege	5556	chrome.exe
Token: SeCreatePagefilePrivilege	5556	chrome.exe
Token: SeShutdownPrivilege	5556	chrome.exe
Token: SeCreatePagefilePrivilege	5556	chrome.exe
Token: SeShutdownPrivilege	5556	chrome.exe
Token: SeCreatePagefilePrivilege	5556	chrome.exe
Token: SeShutdownPrivilege	5556	chrome.exe
Token: SeCreatePagefilePrivilege	5556	chrome.exe
Token: SeShutdownPrivilege	5556	chrome.exe
Token: SeCreatePagefilePrivilege	5556	chrome.exe
Token: SeShutdownPrivilege	5556	chrome.exe
Token: SeCreatePagefilePrivilege	5556	chrome.exe
Token: SeShutdownPrivilege	5556	chrome.exe
Token: SeCreatePagefilePrivilege	5556	chrome.exe
Token: SeShutdownPrivilege	5556	chrome.exe
Token: SeCreatePagefilePrivilege	5556	chrome.exe
Token: SeShutdownPrivilege	5556	chrome.exe
Token: SeCreatePagefilePrivilege	5556	chrome.exe
Token: SeShutdownPrivilege	5556	chrome.exe
Token: SeCreatePagefilePrivilege	5556	chrome.exe
Token: SeShutdownPrivilege	5556	chrome.exe
Token: SeCreatePagefilePrivilege	5556	chrome.exe
Token: SeShutdownPrivilege	5556	chrome.exe
Token: SeCreatePagefilePrivilege	5556	chrome.exe
Token: SeShutdownPrivilege	5556	chrome.exe
Token: SeCreatePagefilePrivilege	5556	chrome.exe
Token: SeShutdownPrivilege	5556	chrome.exe
Token: SeCreatePagefilePrivilege	5556	chrome.exe
Token: SeShutdownPrivilege	5556	chrome.exe
Token: SeCreatePagefilePrivilege	5556	chrome.exe
Token: SeShutdownPrivilege	5556	chrome.exe
Token: SeCreatePagefilePrivilege	5556	chrome.exe
Token: SeShutdownPrivilege	5556	chrome.exe
Token: SeCreatePagefilePrivilege	5556	chrome.exe
Token: SeShutdownPrivilege	5556	chrome.exe
Token: SeCreatePagefilePrivilege	5556	chrome.exe
Token: SeShutdownPrivilege	5556	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
900	ProjectLightningInstaller.tmp
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe
5556	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
900	ProjectLightningInstaller.tmp

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 5528 wrote to memory of 900	5528	ProjectLightningInstaller.exe	80
PID 5556 wrote to memory of 6052	5556	chrome.exe	84
PID 5556 wrote to memory of 5744	5556	chrome.exe	85
PID 5556 wrote to memory of 5744	5556	chrome.exe	85
PID 5556 wrote to memory of 5216	5556	chrome.exe	86
PID 5556 wrote to memory of 4840	5556	chrome.exe	87
PID 5556 wrote to memory of 4840	5556	chrome.exe	87
PID 5556 wrote to memory of 5636	5556	chrome.exe	89
PID 5556 wrote to memory of 572	5556	chrome.exe	90
PID 5556 wrote to memory of 5636	5556	chrome.exe	89
PID 5556 wrote to memory of 572	5556	chrome.exe	90
PID 5556 wrote to memory of 5108	5556	chrome.exe	92
PID 5556 wrote to memory of 5108	5556	chrome.exe	92
PID 5556 wrote to memory of 588	5556	chrome.exe	93
PID 5556 wrote to memory of 588	5556	chrome.exe	93
PID 5556 wrote to memory of 4384	5556	chrome.exe	94
PID 5556 wrote to memory of 3816	5556	chrome.exe	97
PID 5556 wrote to memory of 1796	5556	chrome.exe	98
PID 5556 wrote to memory of 1276	5556	chrome.exe	99
PID 5556 wrote to memory of 1708	5556	chrome.exe	100
PID 5556 wrote to memory of 5112	5556	chrome.exe	101
PID 5556 wrote to memory of 5112	5556	chrome.exe	101

C:\Users\Admin\AppData\Local\Temp\ProjectLightningInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\ProjectLightningInstaller.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5528
- C:\Users\Admin\AppData\Local\Temp\is-MN1NC5QKCQ.tmp\ProjectLightningInstaller.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-MN1NC5QKCQ.tmp\ProjectLightningInstaller.tmp" /SL5="$6006C,79461096,842240,C:\Users\Admin\AppData\Local\Temp\ProjectLightningInstaller.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:900

C:\Users\Admin\AppData\Roaming\ProjectLightning\Project Lightning.exe
"C:\Users\Admin\AppData\Roaming\ProjectLightning\Project Lightning.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:6116

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcbdfec728,0x7ffcbdfec734,0x7ffcbdfec740
  2⤵
  PID:6052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1588,i,16159344078109402820,3188176640077649465,262144 --field-trial-handle=1948,i,16945996829142142846,14684226464507839510,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1944 /prefetch:2
  2⤵
  PID:5744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2224,i,9008882002321767314,16530108399752281269,524288 --field-trial-handle=1948,i,16945996829142142846,14684226464507839510,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2216 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2344,i,2169957744773423176,13441819306360287712,524288 --field-trial-handle=1948,i,16945996829142142846,14684226464507839510,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2516 /prefetch:13
  2⤵
  PID:4840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3216,i,16497868789881890260,13299757969336774857,2097152 --field-trial-handle=1948,i,16945996829142142846,14684226464507839510,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:5636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3220,i,14250674195746678949,2990404777877998207,2097152 --field-trial-handle=1948,i,16945996829142142846,14684226464507839510,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4436,i,11560081315155137150,15399127891847714827,2097152 --field-trial-handle=1948,i,16945996829142142846,14684226464507839510,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4308 /prefetch:9
  2⤵
  PID:5108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4412,i,148063283205119782,15010495003539946355,2097152 --field-trial-handle=1948,i,16945996829142142846,14684226464507839510,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5496,i,1607781988738879217,8187658467196386498,524288 --field-trial-handle=1948,i,16945996829142142846,14684226464507839510,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5500 /prefetch:14
  2⤵
  PID:4384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5876,i,13453064672937268411,6768589102921818768,524288 --field-trial-handle=1948,i,16945996829142142846,14684226464507839510,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4692 /prefetch:14
  2⤵
  PID:3816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5880,i,12114432560980178797,17740031371955540096,524288 --field-trial-handle=1948,i,16945996829142142846,14684226464507839510,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5816 /prefetch:14
  2⤵
  PID:1796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5804,i,12773539679396446422,9747605956469660030,524288 --field-trial-handle=1948,i,16945996829142142846,14684226464507839510,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5808 /prefetch:14
  2⤵
  PID:1276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4484,i,15364748965983135744,14727460353484466426,262144 --field-trial-handle=1948,i,16945996829142142846,14684226464507839510,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4564 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4604,i,14452821665364115532,6958739679060080441,524288 --field-trial-handle=1948,i,16945996829142142846,14684226464507839510,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4564 /prefetch:14
  2⤵
  PID:5112

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5740

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 b5867930b9bfeecfe9de34cb1578b47cf2add99b1e296a82aa5739a4fdfb3a80
MD5 e11161d5fe42ce6c1ccb67092c8ba21e
SHA1 cdd714bcbb3cc639d67388814cce61a95b40a5a8
SHA512 58ab5edd4159edae98ec151d70361a3b710a651733af69d18af0327d206a32a42a8d2838dcef8e470c688a7c9e7dc04055ea5f7e9ec262c4ce473099050f96a7
TLSH
T122F0F4BAD921EC7B18FD4B2920544A4BE75413673B41889F3A3C920C4FB573B468AC2C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 073a3c395918bb1d972d14ecd9d8e1c9cf1253002a94876b863b3d21c9068007
MD5 588faaf281937280978a3134ea39f476
SHA1 17bddc6e5b50ee13164e6ba1c28a7b1f71dd06b2
SHA512 ba723d3ebfd53384ab76ba8f50e7105666ed0b6181c042d8a708066fdfad422a3ae3c18140e498c40197a00844a147b843dc70b4711804ad7a9a1fc2739f9a1d
TLSH
T153519CF7C7D8866DC81196F4AB216E2FCD2D0A18032C3C56C8D8AF4B57E2872D20178E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 1842806273c9af32eb9ce71a3e75180315496862c1a9ffef5c1385c4a3a3a476
MD5 6a733547ce305887c237e44ff06037f5
SHA1 db8d8806556c6c115b2e4128b0ec0abb809b4a9c
SHA512 3afa97c68ea9c726a155d7a925ef5ab85437694f353e9aefef84110dc3dcfd4e4902f9bface9c007e358fcd406ddfb3f8ee1372fefdb099c8de8ff6e85cc1255
TLSH
T17C619CF7C7D8866DC91196F4AB216E2FDD2D0A18432C3C56C8D4AF4F57E2872D24068E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 9b69b3cfcc8f585d11591d39b91ab9d3a80d73e76f588a5ab1c740d73624ac25
MD5 fb69f3735babdfef57330e3715ea40f0
SHA1 d7abf7916456bf4557a1a02f602bef362983494b
SHA512 4e1366371f88cc4093088e0e7f88fd0a891eec2a9cb5f0eae0c32d9b2fd1dcaa4b279d4b6cda1786858f22e09153c5ad3e84665a4e8607077f6190ae13ea0883
TLSH
T124F050DBE739F457607945AE5D14BD0D94B2A4310391A4F6DE6B432CD0D10E31B12053
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 f23e9cd87df549e656d22ecb1bd33943d0d845051715dd489bce6f434289d825
MD5 39874e8075ec418ce37e821837fb5fbd
SHA1 55ac2e8efc30a88e8b0d83bfbc007c530edff563
SHA512 ce8835d7371eab754bc9b0b567cd3547d186eab62d466e031167cc87d5bc574502e5b41eb5ebd7bd234c3a0b295c01d927d044c988b7ce1961c4dc1a92907b67
SSDEEP 192:nRtGTQjpYxOmIv7+pAPRp2O9wHsb+WNn5V0JFaiPUkwFUVyIsnAUgraJ:nRtc66OmU6UXpOwv06ie
TLSH
T10442E62EBA50693BACDBC71AFA217B57D7F5102131952F84D6FC8A1C05E76CC222742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 f97c2068a17d7f734b43504b19785b73fccb9d2012ca6d88878afdb008940601
MD5 2d2d145fe5218af6e27e8d668c667edf
SHA1 f76fab58205c284cc57e12d362d07ff98a4791c4
SHA512 81c8671fc7988a4bb0aabd85e66a44b1597b5d4f5bef6dcdf981f2b155cec28ff5298313dd66f58cbe6d4afb8006d88c3db3856a5fe7b4d65e9ec1e18de7a681
SSDEEP 192:nRtGTQjpYxO9yIv7+pAPRp2O9wHsb+WNn5V0hFaiPUkwLUVyIsnAUgtaJ:nRtc66O9yU6UXpOwv0Ss8
TLSH
T1C042D52EBA54653BACDBC71AFA217B53D7F5102131951F84D6FC8A2C05E76CC222742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 6280a9ba2a9df28de3a99207d0d7ed674800bd42ed707ea9689cc88d3669f407
MD5 da762b85a88f761ad6f89a76ba3fe0db
SHA1 7ebed12d7813c56d4c4da4a519bcfaa66d377609
SHA512 af0821fb1a05a5b5ca19fdc69208e79896a86464a95dd01483a9f4eb6647aa37a6e59c928b8c945ab83277c23320d14d9d7e9295eb8024bb1c3132f8d945f47c
SSDEEP 192:nRtGTnjpYxOmIv7+pL0PRp2PO9wHsb+WNn5V0dFaiPUkwbUVyIsnAUgraJ:nRtcj6OmU6wXpOwv0e8e
TLSH
T16242C52EB950693BACDBC72AFA217B57D7F5102131952F48D6FC8A1C05E76CC222702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 31a5ce04ae67b5403f3453ceb77ece590798531384f472283d145995727d92f5
MD5 b28f8d2c357e9f30dbd5f6faec9be3a8
SHA1 7045d97913533ca8a4d3fd4bcccacb31200659fb
SHA512 0c3fd52647169605cd7ffcc7ff7895b9d1008ecd2a828bc0aac93f78a5c3515c5bf2ae9dd7335970687bfc199d7d6444d158da461151c200b0fb87c211b0d77f
SSDEEP 384:sejIb7KxkXqKf/pUZNCgVLH2HfgslHH7pLuLcSj2XXODIX+ErU38xHG6QDzXU:suIb7KxkXqKf/pUZNCgVLH2HfgshH7pZ
TLSH
T17072F8676C489A370F94CA8CDC267B4FADB5024B65EDC86483FA581903D5BCF114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 93355fdbdba8b6bea6530ea4bb5b78bff9bda0dc97896882a2f170ee6e70b558
MD5 9380da00ed56e5cb222387442afadd61
SHA1 3bf4e23d50f20f51f1be22133d85a60352dae266
SHA512 23cac2008904642cc4a374f77db52dc15036f4e73922c25a9296903a15fcf80f4ce88163e3abf6e1b137c518dd5ca8d4455a25ccf99e1d64f08cbc42365f15d4
TLSH
T1D0B0124580015203C54202F4154618DC7119AF14960E170143E06E629C251538415050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a4836.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a4836.TMP
Size 96B
SHA256 68168d1ddfb2c2b38dda5214253181445fdeb0850b6e8a34d32b28d407f4fbdf
MD5 c4590d41792e280fba7f068c70b4f909
SHA1 966e0ac76559fdebc471fd6e849474f7edf3c582
SHA512 13370df7b915a26364c342e5d324dc8da919150651de9ac85d10f36b553288b3394d11f094514d04a188497ff82c8dabf39aeb6b21f0152d6320aedf55855694
TLSH
T1BFB02222C0832203C2C203F22AC0C0E83030CF2CCA03230AA2E02EA2CC202A00822020
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 0f0a54e2248961e72dbd96e190272e4417f0bc7decba6baf363061bdf9862ce3
MD5 b2e194ed252f4160c1b903df75f8c70d
SHA1 50ca1829ec2b21f96c1ffc3a3f3707c3e122c88b
SHA512 f97e6ae6ed49aa0800bc1c124e51de665078f55106c8cdf5c9f3d78ff7ba32964e560233dee79d338f44ccb26c7f79f9cf1b45eccb5ed848fb431c95a87aa82e
SSDEEP 6144:OG2ByNlTQwO8ECmwWDfxA3OnjrYQ9EU0/hE3:OG2ByNer0ODfxjjs+C8
TLSH
T14A3412918D3EFCAE0899DB66740E6E08EFE419DBD65E0A93A3D62F0D05EE4CC054D670
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 e9a611980e38a1f09c5f6312ba4cc1a32e5341288e3bbd81736af244ca44054a
MD5 02162c05bd76d73bcf5678e7dc7a45cc
SHA1 e025ebf8dc059e9206df210e68c6400ca53b7d29
SHA512 8104a07624f6c6f4d6eb19e58df5de4a7a965016ceede879de6cc1ea3f6236c45ede27898460f3f504ad179c48aa01f4af205becca3232879c7ffd6daca1c6d5
SSDEEP 6144:En2ByNlTQwO8ECmwWDfxA3OnjrYQ9EU0/hE3:m2ByNer0ODfxjjs+C8
TLSH
T1113423718D2EFCAE08A4DBA5740E7E08EEE459DBDA5E1E83A3D52F0D05AE4CC054D630
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 85ffa5affbc543e1cc4d5e7c6385f81ae4b6ece4e1497bc5bdd603a486587371
MD5 d096ff972a31e1d8d6156d0d7b4d5c6d
SHA1 c01c8f3b523ab8c174c979b7e1de922d6ed6ef5f
SHA512 abbce84c5967831b6e7c20f072b59a38df41e0b775d9f5f57b2b6aa6b4852b39a91842bf959e2f739b66ab0be328247d9a2253d7587ad6726454e2b59a69caee
SSDEEP 3072:uzWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAITog:MWDfxA3OnjrYQ9EU0/hEg
TLSH
T1A1C302A15C35BD660CB8EE99744C3F60BFF4AD9A91879DC362ED1B0C24FA5C81139970
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 d091dc2dc37537f53cb938d170e30ee6492ecbc7648d872185a6980732d2299b
MD5 eb86b23aefc53f2673ee1374098d622d
SHA1 da34c4e708bd7f740d897e9de5dd695025c25c8d
SHA512 4003b0ecb94b205c58c7a8b7d67b31e1893732074eb00d1cf663e099b46a6d83f1c902588f4ad7d1c41ca0468f1785eb42d0d39887ea444f160809ddce91adae
SSDEEP 6144:En2ByNlTQwO8ECmwWDfxA3OnjrYQ9EU0/hE3:m2ByNer0ODfxjjs+C8
TLSH
T11D3423718D2EFCAE08A5DBA5740E7E08EEE459DBDA5E1E83A3D52F0D05AE4CC054D630
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 b5e2252e1bda196ba8923c99dfd93de0f93221550f1575db7e7a46947cfaa7fc
MD5 507b8e346a0d8d189ec3dfdff910f0fb
SHA1 c1c8eca694c2747e3d9c4ee90d8ea0c639041c90
SHA512 2684254ce153810833fd0b78480b98cd6e3897daeaada2aa318563b58ae107ae683e5e4b7f90e7f6615502bbcd7cb552117cabe63edd9025424f3ac82540b4de
SSDEEP 6144:NG2ByNlTQwO8ECmwWDfxA3OnjrYQ9EU0/hE3:NG2ByNer0ODfxjjs+C8
TLSH
T1A83412918D3EFCAE0899DB66740E6E08EFE419DBD65E0A93A3D62F0D05EE4CC054D670
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 896KB
SHA256 949cc703bf8b36f050f5b781f120ff8915dd0136df3b1b8b121e127e571cd72b
MD5 cc922adab612b280f4535148b2af8754
SHA1 b7fc24cc9541fa6dc99366cdf9c57101ad3188e9
SHA512 6b5bf6d22b8f9fa59dbbe0fd9ce0f12bb6e356ebe81b8ebfd3868b9ed4b8df045081dc1a777e6105274c18351cbbc00ff2c7160a4b0929193e468ae9dd137498
SSDEEP 768:sH0aleDxcg7KGVp3zT13VuI61HOdrrA9abhrXfEwPRzitFrzAqUmNKX08oJImdba:sAZP/tMiP2NnY4UmqEMioTaBacg
TLSH
T1B5153137D150A089CF2C71B2E5ED5F0CBD23A10B12E052465FB4A67BBA633C99D1B1E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WMSDKNS.XML.bak

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ProjectLightningInstaller.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-MN1NC5QKCQ.tmp\ProjectLightningInstaller.tmp
Size 4.2MB
SHA256 31d0a70f3475dc1fd526fd5d4066d68628eb8673c37505fd99e6c972e5ff7724
MD5 96e7701d4a1a007c862f8d699e892f4d
SHA1 31d8515c4ca10b37752d6439493f21dcb07cff9b
SHA512 2367f8f288fa1334e22e405d4c27938b3fd5b188f3f0119281bee9d22ee730f4025ccf7a32682703d41cdcfcfbeb6314c70379ae572a2ecb477e62ff2cacc7e4
SSDEEP 49152:d3yGw7V2h9z2lqSvM0/WtmueejA0JuDeT4q3ZCNW7Iu9ReR9nc4NDR5mo4333lwa:ds7Y8/7ueejA0JuDeT4eZyuaNHm1333d
TLSH
T11D267C13B389613FD06A2B3A7837A254993F76703916CDDB6BF41A4C8E351807D2AB47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Newtonsoft.Json.dll

Path C:\Users\Admin\AppData\Roaming\ProjectLightning\Newtonsoft.Json.dll
Size 695KB
SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
MD5 195ffb7167db3219b217c4fd439eedd6
SHA1 1e76e6099570ede620b76ed47cf8d03a936d49f8
SHA512 56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
SSDEEP 12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
TLSH
T166E4394123F98F2BE1AF6B75B4704E1543F9F917A6B5E78F9A04D9A91C43B408E403A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Project Lightning.exe

Path C:\Users\Admin\AppData\Roaming\ProjectLightning\Project Lightning.exe
Size 10.7MB
SHA256 bae1b4631d75edd472cbd73548a9a9deec27aca987f9cbaa138d83215b4ea91c
MD5 8406cedcefeb0bcdf556f35902c74aa3
SHA1 2e32c4329bc3c3e015b619457f5193ce3bddd75e
SHA512 e7d41c41a63f7a5043e9f882931d78a9ad8e0fb0ff2b736e82a60b0dfe9b87e8221b5a60077eb3b018c1b80e7317ab11ae5879459464245341728869052a68de
SSDEEP 196608:MEMkSSUZu/7V2Ua1iBjLzIVRFdMAbTr5Fjbv5Dzv0lzrgkp:METSSsG7oU+4jvIVZMAFvhnWN
TLSH
T1A5B62391B76B4714F12B463C2AD3C33C3A357801ACAAD70E747758B9A9493B5689B3C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Project Lightning.exe.config

Path C:\Users\Admin\AppData\Roaming\ProjectLightning\Project Lightning.exe.config
Size 3KB
SHA256 688db9917b527b298bccc9b957dc3a66a167e23adcfb131bf7c4f540d6ec2173
MD5 288d8a009af9a74262198b41a287836e
SHA1 a0a9b720622877f6f73400814c94bb24a0df7d1d
SHA512 e7f1f4b6cc92eea8d742457583d127739726e79a9d991e52add4872504ee62cbd1cacc8c5e09490c1fb086aeff90a0ff89ca58c0b2e90c005e49b74ae8ee9238
TLSH
T158618E1061C8BFE50B731A626E6B6418CFB903B7295D159CB0EE6B8B8F3598A0353177
MD5 SHA1 SHA512 TLSH

Submit Download

ReusableTasks.dll

Path C:\Users\Admin\AppData\Roaming\ProjectLightning\ReusableTasks.dll
Size 21KB
SHA256 d7073e7df4891fe6452b6c356b431fe9b59ee5687ca2cfe9a0f92b4d4abf3da2
MD5 d9bed98270f79cbd5320ceeb67be9695
SHA1 e30ff2a9629e84f0d55142169806bd4e61c6ed70
SHA512 c1f4d47999d297c84890be4491bfa89d514cbfe419575e2a6741b138812e24d647e82949a678f804e1753c55b043fd04cdf2efa98afe419d322ff797aa670071
SSDEEP 384:IHCFn8jL8jQlfW2Uw4mfAImKrDowVWFzA6W96S6/3usNViU5b:8CFn8jL8j2/fAIm2PVWF8l3q
TLSH
T131A2180AD7DC132BEB7F9B7AD5B5100187B1E54A3922E36E1C8CE2A83C433924577799
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Runtime.CompilerServices.Unsafe.dll

Path C:\Users\Admin\AppData\Roaming\ProjectLightning\System.Runtime.CompilerServices.Unsafe.dll
Size 17KB
SHA256 37768488e8ef45729bc7d9a2677633c6450042975bb96516e186da6cb9cd0dcf
MD5 c610e828b54001574d86dd2ed730e392
SHA1 180a7baafbc820a838bbaca434032d9d33cceebe
SHA512 441610d2b9f841d25494d7c82222d07e1d443b0da07f0cf735c25ec82f6cce99a3f3236872aec38cc4df779e615d22469666066ccefed7fe75982eefada46396
SSDEEP 384:EybU8ndrbbT9NWB2WL/uPHRN7bhlsQVryo:Ey5ndvWbMPVryo
TLSH
T1A8824A21CFD84503FE627B344568D183FE38E38A6806A36A2586F57A1CD63C57B31E38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WpfAnimatedGif.dll

Path C:\Users\Admin\AppData\Roaming\ProjectLightning\WpfAnimatedGif.dll
Size 41KB
SHA256 b4c69be213ba3dd40e6bc819b7bfc13ab03d06d5f3efa0e4643b1b55e5a529f9
MD5 47d729b6841f1e0e510bbc7d74454b73
SHA1 bb7a519a2bf2dbfa8aef238241d6dd5c62aeed77
SHA512 f5ecd0cca56306273685c12ccb5af8f540161e2cffe3f639a2fa1f9de29cfebb2f6d8f8ba4ad43e02a721da30dd8e3cc911e46e4237578e026a5ba8c059429af
SSDEEP 768:H0Gl7W1UiZTo1ooEqTh0sq/s/MnBOyvUPrYZbkch:UqQpZTsooEah0sqU/by4UZzh
TLSH
T135135C2403BD836AC75E06FBB4F0402442B6F3867512DBE96EA4E16FAD6739107147B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

emerald_inferno.mp4

Path C:\Users\Admin\AppData\Roaming\ProjectLightning\res\media\backgrounds\emerald_inferno.mp4
Size 9.4MB
SHA256 8cdb335166913e3215dab31539c65d10e4f64a9f1913741ddb4c7edbd0f5762d
MD5 e46ed8af6c670dcfbe1976d849b4f53a
SHA1 4d6f53d8c6c64080d89ff485741414112fa8626b
SHA512 5de17fa564232acb85380a908180a73d3d09114d6c551496188e1af4f6e0f8ba6b220132ad33064bd7155816e8e446899cd775fe622eec80f0b97edcc087cd4b
SSDEEP 196608:qY7tRRq8NVpnl46knPipASM9HL4orf/is2HVNYC6/OIjoVrgfifr:qYBTpu68P1n9r4o7iLnYC6/iV0fwr
TLSH
T170A63314E3A60044CDDDD2715FF3E198BE70D1666023931365A1DEB9FA26B4A0CF2EB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

promo1.png

Path C:\Users\Admin\AppData\Roaming\ProjectLightning\res\media\promos\promo1.png
Size 247KB
SHA256 8cc9f3ead14f25e8ac775a8bbbc4f5d0f145d190afd20bb9b6a78994b596d05a
MD5 efdc6a46b60ea920de6ffd4b5491bcc3
SHA1 d992e29025dd7febe170312de41429036359afa5
SHA512 cbd5b14297ca4e2c94c71be71b47bbff66aba03b5d5046f8eff236b3c371aa3db8814da5beb3ae68af19e8ae2b2bc40d26997b5c850b19c4f0df6ea2e876371e
SSDEEP 6144:EunLZPPmobRoYmWuqnLSp1F3CINXSbJ2vrI49s5Pxns41o:TVegRo7WuALQ1FVSbJ2vrP9s5PxnE
TLSH
T13B44230BC2C24BA2FD1E214E41C93CB95A4A73E9D4AE45B8085B7D767E14E34861BF1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

promo2.png

Path C:\Users\Admin\AppData\Roaming\ProjectLightning\res\media\promos\promo2.png
Size 185KB
SHA256 fa86c8c0886344998d7627dfcf2981c2536258968203942b8106e872ff121dc9
MD5 8bff4974ac4a2ed3e14106be302eda71
SHA1 7ac508d2f07f674db79f325e685291c295696202
SHA512 bc5095b09c32f6ef7bd2f1439fe9ebd2041b12da14f92565c2db0eb8a7057255e3870b18baa06d8dd345e158e33b05b0e4d829ff335ce30cecdecf243fa9a172
SSDEEP 3072:kM/j0TC/MK29YY6zwhy5CLMIA4P3r5rrcBRYtskdqF0VuF6Lfl0gHquGvIDzivv5:kM/oSgWY6zwhy5CQ0P3togikdu0TLd/K
TLSH
T1E01413D380E4628011BE542A8BF25FCBE5372153B9E88C52E239E7F5D5DA17C68930BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

promo3.png

Path C:\Users\Admin\AppData\Roaming\ProjectLightning\res\media\promos\promo3.png
Size 128KB
SHA256 e76e503e75da0bf427b8239e5cfc93c9a803c5b9d86d0c604ba73fcb67164d2a
MD5 7c00d601e09f06b27745e821c5184f0d
SHA1 167b8e498b6e48e05a8510085b3d29367f53e72a
SHA512 c21a664b2cbc08087c1d724160ab9f9b123b33661a4164ec5bac936e549473c568c4c851cc2cc06cf95569aed9f8ba0f29c96d8112aaee6f905b10ad2c078b45
SSDEEP 3072:I4tm2jWaHIx+cIhWV9JiWwJcTTsLtDaFvPEoBqrUe7O5Zf89hB:C2CUIIcia92cTMpmlQ/7+ZU9L
TLSH
T198D312480C700355C62BFB14BBC906B03246DB9D9BC26A976EABE536D9CDB10F5637D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

promo4.png

Path C:\Users\Admin\AppData\Roaming\ProjectLightning\res\media\promos\promo4.png
Size 209KB
SHA256 d87ca24fbc45fa3e1a9df815c3350d98583736e9057cf6060bf2befc37b8cd23
MD5 5f93ff47a464b8c1e16d41307008e835
SHA1 a17a5ac06fbf77577ac6b885165c7337d0fba546
SHA512 da12438a437e5f0ca6b80c3f71dc25bf94b204a40d7006b091ad230ba952717205f55b52d56f9d086927a709085b3b8e62731aa76deeb360276f4d848feb8078
SSDEEP 6144:rXZUXAWOshSOY4B2nEjxOzWzDrVhgof0e6I70KV:LZUXDVhShxc8of0ehrV
TLSH
T14C2423B59B8338B65F49E1D9ADE1CC964DB5A44F196B53CE3A810EC2B5F502B2F07043
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

promo5.png

Path C:\Users\Admin\AppData\Roaming\ProjectLightning\res\media\promos\promo5.png
Size 271KB
SHA256 99b7a4c7c210922da0014cc926c2ce2c2232b649cb71089c657c24d5eff39ba9
MD5 f3a126ff4acbbd3e8878b0e3620b8c11
SHA1 b9230930fd7e0401866eee52b9367c2a8ddeeb28
SHA512 5a8cd31c3c20d5e0156a62665b18b32d582cb667020dd855fc9fbcea2b250205d5b74b214a15a3314e83a4c7b4b7f69dfd7876413e7122bbba58be2906ed3992
SSDEEP 6144:1oPZfNWy0xazQYymvGoRLq1118xupggTKwwBgRD1:1QJr0xazQYymjhqlhgG5l
TLSH
T11D44233830636813F92AAA343CF1DC9040E915DDE2E95E4D7A59E6CBCB2F5A04B7C94D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

promo6.png

Path C:\Users\Admin\AppData\Roaming\ProjectLightning\res\media\promos\promo6.png
Size 143KB
SHA256 86e2fc61af3e38d55433295d79abdd53e09f91b33a1bede459a28bcb0bd7427d
MD5 457b4e195492aa6600d83faaf916c590
SHA1 2c51858e64ad056e57c6a46bef96a5ee9706341f
SHA512 76cd8dcdc4845aeaac29bc0ed81ea3a7a8ebb1e763e77b800fe477218c57124732f86ff507a031ac34dd74b7fe73e4b07acef0b2525f9ff9a63e99a52a4e2d75
SSDEEP 3072:JKUKtZlSe0KQsKlcQ66DI/I+VtNkg3PY2dYUTK+Arr:4Z4sKlJ64ItN53wfb+6
TLSH
T1A4E31353BE8578D195D22C73CFF71D96F08C7925905902C7CC63382BAB606A61B7EE88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

promo7.png

Path C:\Users\Admin\AppData\Roaming\ProjectLightning\res\media\promos\promo7.png
Size 207KB
SHA256 a1267fef3efd4af3c6bc5d775f52aec796c6c184982aae6f18386a298e5993e6
MD5 b6be4a4b94ea6fd8b46fb31b3a02783c
SHA1 4f30ad7c34bdac3be9ca728b1d29810fcab91ff8
SHA512 9c202734c4e7153692d2a28ee071d5011ce5a59e53485a4f9dfde167d0e36b8b672ceb93d95ec1bbd27604262df3c9a7dafb45e16bf80eea54aa2fc2dd927b51
SSDEEP 6144:tCmjd+t0DyoFiKIT7jmObr6vnDHcNS2eabOwYBCf2:tCgd2oYvj1br6vnDHcE2Ja
TLSH
T1E624224C3A88E3C6156FBD9CCC002795B4C8B0AAB1AEDC3794FF807206866A59595CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

promo8.png

Path C:\Users\Admin\AppData\Roaming\ProjectLightning\res\media\promos\promo8.png
Size 241KB
SHA256 246e182b36e69ddae97a791bcaba49946d46b425ef8c54a695cf89a8f4dc8cd1
MD5 8a8c8ba36eb585a443b5c32d4e33a015
SHA1 3925d07f204b2940f0468fd9260a12cc90ac9a49
SHA512 ed2fff1d9ee40069e46f6a82b199b35db9605222025bc03c5de1f5220d2dcf9208723da11a7744dcd70afdd327356dbe521f10b0ab1973f2cbc4073794d649b9
SSDEEP 6144:HG3lS3kfTo2AKE6+RycCdAOHtS1LlQMi67UBd5:QlS0WrFJCd01Lln6f
TLSH
T1F73422311300ED4B81B426A7D93C0DEA86FEA50A1C275C7E7272DA5D0C656FAE78F5B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

promo9.png

Path C:\Users\Admin\AppData\Roaming\ProjectLightning\res\media\promos\promo9.png
Size 184KB
SHA256 aa75bd6659377b468fbe02ab3e98085cde60215d72c484d314076e8d22d6e81f
MD5 77fd268503ae65248a8299dc3477d9cb
SHA1 ab5929a7e77769c8c09c6fb468bddeadcaf2d892
SHA512 ec9c3e873dba239ec72cca87d1d5b4a587319794c6e2f75eb696d069b0aeb94b1648b45ab6f13763bd342ced4c2c7ca707efd2acfd3e77010ff8150488c6b08f
SSDEEP 3072:iBMlymGTWphekLL3u8EvRBocd2guTqiO/ugQ4J4vIWsjifTbXMDkcgUtpupXNMuk:iBCGipk6e8Ere7O/ugl4vIWgSnXukPUr
TLSH
T1E1041367F28CAD25F4761E1324E2575D6280F0E3FA7B18224C7CFBD96065A8973A240D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sponsors.txt

Path C:\Users\Admin\AppData\Roaming\ProjectLightning\res\media\sponsors\sponsors.txt
Size 53B
SHA256 b06c6a114d65b916a660b73df53ced8c00749055bfb1da959d487f4ec707407b
MD5 f678eac6ad3640b8229fb02c0805206b
SHA1 dd8e9376f19222c21445c9a08c6afa1a060fa12b
SHA512 e0df82c18b634cbf4a095b860292449fa010265f59f874aeaff375e5b0009126406b01d0d020b99307b5279e2e69a7df89d05990b9cf784a64f1582fe51f251e
TLSH
T11B9002A71A040C6D570C2569838725194203C45B564E5865980B085C85442529344595
MD5 SHA1 SHA512 TLSH

Submit Download

steam-force-sponsor.png

Path C:\Users\Admin\AppData\Roaming\ProjectLightning\res\media\sponsors\steam-force-sponsor.png
Size 42KB
SHA256 2e6bd9f01fae043133f839b732f69422bbc3e66bbc3ef94dc3467eb0ad706fc4
MD5 df3d80a3cbea9ffd3143e9eb734c19d2
SHA1 fbf99797c7ae014add720b34046c7947d1cf1253
SHA512 c2fd1110236f783c606dedae5dd763f4cfa164e7d9ce106e3e63af803a0eac7b274b58c984a71fa90bc957424ccbd8864da0f76611577b5e401b1bfc4539e2f7
SSDEEP 768:9Z+ZWXPKk8nmiXQ9c4vgm3GEXsVyXNjWQzmWoBlYTnqeX1AAgEadItOk:9IZWyk8m8yvgnEXsVuWQ6Wo4nvRed+Ok
TLSH
T10713F16A0D8F94FE7191A1085ADF3865CB4B95C4E4BD15CAA0E1D4C3C14C8C7EEA53AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/900-251-0x0000000000D30000-0x000000000119A000-memory.dmp

Download

memory/900-249-0x0000000000D30000-0x000000000119A000-memory.dmp

Download

memory/900-250-0x0000000003760000-0x0000000003761000-memory.dmp

Download

memory/900-5-0x0000000003760000-0x0000000003761000-memory.dmp

Download

memory/5528-0-0x0000000000FF0000-0x00000000010CD000-memory.dmp

Download

memory/5528-252-0x0000000000FF0000-0x00000000010CD000-memory.dmp

Download

memory/5528-248-0x0000000000FF0000-0x00000000010CD000-memory.dmp

Download

memory/6116-293-0x000000000A920000-0x000000000A930000-memory.dmp

Download

memory/6116-312-0x000000001BB10000-0x000000001BB2E000-memory.dmp

Download

memory/6116-311-0x000000001AB70000-0x000000001AB92000-memory.dmp

Download

memory/6116-309-0x00000000167C0000-0x00000000167F8000-memory.dmp

Download

memory/6116-310-0x000000000FDC0000-0x000000000FDCE000-memory.dmp

Download

memory/6116-325-0x0000000019220000-0x0000000019230000-memory.dmp

Download

memory/6116-308-0x000000000E1E0000-0x000000000E1E8000-memory.dmp

Download

memory/6116-327-0x0000000006290000-0x00000000062A0000-memory.dmp

Download

memory/6116-328-0x0000000006290000-0x00000000062A0000-memory.dmp

Download

memory/6116-295-0x000000000A960000-0x000000000A970000-memory.dmp

Download

memory/6116-294-0x000000000A920000-0x000000000A930000-memory.dmp

Download

memory/6116-292-0x000000000A960000-0x000000000A970000-memory.dmp

Download

memory/6116-291-0x000000000A960000-0x000000000A970000-memory.dmp

Download

memory/6116-287-0x000000000A920000-0x000000000A930000-memory.dmp

Download

memory/6116-289-0x000000000A920000-0x000000000A930000-memory.dmp

Download

memory/6116-290-0x000000000A920000-0x000000000A930000-memory.dmp

Download

memory/6116-288-0x000000000A920000-0x000000000A930000-memory.dmp

Download

memory/6116-285-0x000000000AA60000-0x000000000AAD6000-memory.dmp

Download

memory/6116-284-0x000000000A9A0000-0x000000000AA52000-memory.dmp

Download

memory/6116-278-0x000000000A650000-0x000000000A7D8000-memory.dmp

Download

memory/6116-268-0x0000000007BD0000-0x0000000007BEC000-memory.dmp

Download

memory/6116-267-0x0000000006290000-0x00000000062A0000-memory.dmp

Download

memory/6116-266-0x0000000007160000-0x0000000007168000-memory.dmp

Download

memory/6116-262-0x00000000065B0000-0x00000000065CA000-memory.dmp

Download

memory/6116-261-0x0000000003C50000-0x0000000003C5C000-memory.dmp

Download

memory/6116-257-0x0000000006290000-0x00000000062A0000-memory.dmp

Download

memory/6116-256-0x0000000000C20000-0x00000000016D0000-memory.dmp

Download