Overview

overview

7

Static

static

3

ProjectLig...v5.exe

windows10-2004-x64

7

ProjectLig...v5.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    02/08/2026, 03:33

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ProjectLightningInstaller-v5.exe
  • Size 121.5MB
  • Sample260802-d4qe5stdje
  • SHA256 d69c87e613a28b740288f4716b2989513ac75f5fc1ef0b8d4c70553ebdb14e2a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutioninstallerspywarestealer

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 9 IoCs
  • Reads ssh keys stored on the system 2 TTPs

    Tries to access SSH used by SSH programs.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Discovers running processes 1 TTPs 17 IoCs

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 17 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 40 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ProjectLightningInstaller-v5.exe
    "C:\Users\Admin\AppData\Local\Temp\ProjectLightningInstaller-v5.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1728
    • C:\Users\Admin\AppData\Local\Temp\is-XGI379DE0N.tmp\ProjectLightningInstaller-v5.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-XGI379DE0N.tmp\ProjectLightningInstaller-v5.tmp" /SL5="$602CC,126019679,842240,C:\Users\Admin\AppData\Local\Temp\ProjectLightningInstaller-v5.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2828
      • C:\Users\Admin\AppData\Roaming\ProjectLightningV5\Project Lightning.exe
        "C:\Users\Admin\AppData\Roaming\ProjectLightningV5\Project Lightning.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:888
        • C:\Users\Admin\AppData\Roaming\ProjectLightningV5\Project Lightning.exe
          "C:\Users\Admin\AppData\Roaming\ProjectLightningV5\Project Lightning.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\project-lightning-data" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1748,i,7962597269117935674,11487526258366988563,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1744 /prefetch:2
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4796
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3360
          • C:\Windows\system32\tasklist.exe
            tasklist /FO CSV /NH
            5⤵
            • Discovers running processes
            • Suspicious use of AdjustPrivilegeToken
            PID:5064
        • C:\Users\Admin\AppData\Roaming\ProjectLightningV5\Project Lightning.exe
          "C:\Users\Admin\AppData\Roaming\ProjectLightningV5\Project Lightning.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\project-lightning-data" --field-trial-handle=1748,i,7962597269117935674,11487526258366988563,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2192 /prefetch:3
          4⤵
          • Executes dropped EXE
          PID:2500
        • C:\Users\Admin\AppData\Roaming\ProjectLightningV5\Project Lightning.exe
          "C:\Users\Admin\AppData\Roaming\ProjectLightningV5\Project Lightning.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\project-lightning-data" --app-user-model-id="Project Lightning" --app-path="C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1748,i,7962597269117935674,11487526258366988563,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2400 --from-game-shortcut=false /prefetch:1
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1220
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:2496
          • C:\Windows\system32\tasklist.exe
            tasklist /FO CSV /NH
            5⤵
            • Discovers running processes
            • Suspicious use of AdjustPrivilegeToken
            PID:5124
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:384
          • C:\Windows\system32\tasklist.exe
            tasklist /FO CSV /NH
            5⤵
            • Discovers running processes
            • Suspicious use of AdjustPrivilegeToken
            PID:6120
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3992
          • C:\Windows\system32\tasklist.exe
            tasklist /FO CSV /NH
            5⤵
            • Discovers running processes
            • Suspicious use of AdjustPrivilegeToken
            PID:3180
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:5568
          • C:\Windows\system32\tasklist.exe
            tasklist /FO CSV /NH
            5⤵
            • Discovers running processes
            • Suspicious use of AdjustPrivilegeToken
            PID:2652
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:4140
          • C:\Windows\system32\tasklist.exe
            tasklist /FO CSV /NH
            5⤵
            • Discovers running processes
            PID:1164
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3004
          • C:\Windows\system32\tasklist.exe
            tasklist /FO CSV /NH
            5⤵
            • Discovers running processes
            PID:5772
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:2744
          • C:\Windows\system32\tasklist.exe
            tasklist /FO CSV /NH
            5⤵
            • Discovers running processes
            PID:5824
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:5684
          • C:\Windows\system32\tasklist.exe
            tasklist /FO CSV /NH
            5⤵
            • Discovers running processes
            PID:2516
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:1172
          • C:\Windows\system32\tasklist.exe
            tasklist /FO CSV /NH
            5⤵
            • Discovers running processes
            PID:1732
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:4984
          • C:\Windows\system32\tasklist.exe
            tasklist /FO CSV /NH
            5⤵
            • Discovers running processes
            PID:692
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:4612
          • C:\Windows\system32\tasklist.exe
            tasklist /FO CSV /NH
            5⤵
            • Discovers running processes
            PID:3644
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:4564
          • C:\Windows\system32\tasklist.exe
            tasklist /FO CSV /NH
            5⤵
            • Discovers running processes
            PID:5640
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:4688
          • C:\Windows\system32\tasklist.exe
            tasklist /FO CSV /NH
            5⤵
            • Discovers running processes
            PID:5184
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:5300
          • C:\Windows\system32\tasklist.exe
            tasklist /FO CSV /NH
            5⤵
            • Discovers running processes
            PID:512
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3868
          • C:\Windows\system32\tasklist.exe
            tasklist /FO CSV /NH
            5⤵
            • Discovers running processes
            PID:5368
        • C:\Users\Admin\AppData\Roaming\ProjectLightningV5\Project Lightning.exe
          "C:\Users\Admin\AppData\Roaming\ProjectLightningV5\Project Lightning.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\project-lightning-data" --gpu-preferences=SAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAEIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1748,i,7962597269117935674,11487526258366988563,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3896 /prefetch:8
          4⤵
          • Executes dropped EXE
          PID:4588
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
          4⤵
          • Executes a command shell one-liner
          PID:2200
          • C:\Windows\system32\tasklist.exe
            tasklist /FO CSV /NH
            5⤵
            • Discovers running processes
            PID:5124

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        eb9f4b07-062d-403f-9921-81d99699e19c.tmp.ico
        • Path C:\Users\Admin\AppData\Local\Temp\eb9f4b07-062d-403f-9921-81d99699e19c.tmp.ico
        • Size 361KB
        • SHA256 d8e29cb60fb03bfa6f1d7dc51ab22e8f840feba979d20577d9f2111691165aa5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ProjectLightningInstaller-v5.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\is-XGI379DE0N.tmp\ProjectLightningInstaller-v5.tmp
        • Size 4.2MB
        • SHA256 afe50ff7d71ec93eba12004b8e634dfbd766a765ff1cbde43156422cf2845148
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        default.dic
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
        • Size 2B
        • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
        • MD5 SHA1 SHA512
        Submit Download

        chrome_100_percent.pak
        • Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\chrome_100_percent.pak
        • Size 112KB
        • SHA256 cbe052e9bd36032cde9d0ad7496d611c6a3c98a130b960e1298d490254be1159
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_200_percent.pak
        • Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\chrome_200_percent.pak
        • Size 182KB
        • SHA256 6593ba8ece63001a3fb77bd1d872566edeb26213a1be8e852dd956f6d0e2c93e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        d3dcompiler_47.dll
        • Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\d3dcompiler_47.dll
        • Size 4.5MB
        • SHA256 c8e25abd3d45dfb55966a74613258c39b4a83ea2ac77f2f80903499f4d5c03f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dxcompiler.dll
        • Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\dxcompiler.dll
        • Size 24.4MB
        • SHA256 1565adbd62a0e8ba2a8b25b3da5d2e2a45032c13aeffdd061228abc3ee5c1585
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dxcompiler.dll
        • Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\dxcompiler.dll
        • Size 2.9MB
        • SHA256 98b9a25c99e76e6115893753abae3c382b9a8d05d47e1a8d3ed274f7c15e7c2b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dxil.dll
        • Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\dxil.dll
        • Size 1.4MB
        • SHA256 436f128f22050ae27323da61321a469de0678def7a4e6d86f9ccad4858724f0a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ffmpeg.dll
        • Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\ffmpeg.dll
        • Size 2.9MB
        • SHA256 26eed00c4da27de095ba76030b47bc0436ba659a7443e05f11ee162dc225e828
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        icudtl.dat
        • Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\icudtl.dat
        • Size 10.3MB
        • SHA256 1cf67874b5a87a8363a86fb3f81e3cbbed54d389062dab8fb52308d5cf8c8612
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libEGL.dll
        • Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\libEGL.dll
        • Size 503KB
        • SHA256 61ebcd780d17d37ec09a5eb7ff7399ad67726a5a1ff73be1c37734551c3ef1fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libGLESv2.dll
        • Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\libGLESv2.dll
        • Size 7.6MB
        • SHA256 b35d3337ef4cad5423f4e11a06e280763deae634f7e39c7844e4f0fcb455b3e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        en-US.pak
        • Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\locales\en-US.pak
        • Size 537KB
        • SHA256 ef30389492cc2d31bc5c162056fe68c27a5d57b0a69f5f878562325f795c5185
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        resources.pak
        • Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources.pak
        • Size 6.1MB
        • SHA256 ce5c35017fd7aa648fe44381711cbf42eff5f6923b11241a4789058dbc5b27aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        app.asar
        • Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\app.asar
        • Size 48.9MB
        • SHA256 e71d1b3b2638bc4479c44c1559ad0f75d9c55d9816895af83c930625948ccf24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        better_sqlite3.node
        • Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\app.asar.unpacked\node_modules\better-sqlite3\build\Release\better_sqlite3.node
        • Size 1.8MB
        • SHA256 715dc7eadd3fa56a68716eba485e45ffc687a16a3affb7c592fa1c246cedadd5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        database.js
        • Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\database.js
        • Size 4KB
        • SHA256 02ea23bdd23d7ac5de0675a2f32fc686e76d5c6a32bd3e3891f360e72e07f61f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        index.js
        • Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\index.js
        • Size 110B
        • SHA256 82db11c4ee43a41d859988c5db42c3771dff565371f94bacbd1e4d8d6ceb47cd
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        aggregate.js
        • Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\aggregate.js
        • Size 1KB
        • SHA256 e9f74eb919ec93fe089c95ddf25a98f1f631c80418fa34fb2346ca1bc29f1b82
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        backup.js
        • Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\backup.js
        • Size 2KB
        • SHA256 ea29d34992bb02e006d0fdeda9675ac5d2bb227aaf57468decd997e9fc9c7dbf
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        function.js
        • Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\function.js
        • Size 1KB
        • SHA256 f431d49303b8bbdc044b1f1b455bdad21fc9b74b007de0acb22f08f25b4febd3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        inspect.js
        • Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\inspect.js
        • Size 174B
        • SHA256 4975a78daee850adee62ba98719d0f223819a0ec135a07c0e302994bd8dbff61
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        pragma.js
        • Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\pragma.js
        • Size 536B
        • SHA256 8b1c54475bd4340b15e25c50d53d06308be65f8f919ecbe4aa9d285ca859ad5a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        serialize.js
        • Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\serialize.js
        • Size 625B
        • SHA256 7a10ee5c2735384b7f0c361811bc6d017db29f62b203fd3c68a35f667e2c2605
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        table.js
        • Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\table.js
        • Size 6KB
        • SHA256 97c42d9ded1aa96c7d916b5b92f96b4e59581d50eaf629cd2c7afb78ff26a9ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        transaction.js
        • Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\transaction.js
        • Size 2KB
        • SHA256 bc8624a3ef689d8f78e5669020ad121e17acbc93b1d5ee5afe26860b1084c66c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        wrappers.js
        • Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\wrappers.js
        • Size 1KB
        • SHA256 a150a6271d23f4e5f8953b129f370ff096c7cdc4b812afbf080a6cf4ab741bcf
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        sqlite-error.js
        • Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\sqlite-error.js
        • Size 717B
        • SHA256 2582d61c27680dead168543f392eb102be621dfbef282a4ca4c7c21aa5e7c75d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        util.js
        • Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\util.js
        • Size 331B
        • SHA256 92b2e39e2151b43a2252e10b6d6de876ecaf0008336a4fa1dfe1317b20f1916f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        package.json
        • Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\app.asar.unpacked\node_modules\better-sqlite3\package.json
        • Size 936B
        • SHA256 67f68163a5fba6a9920b1f9151c997c7b4d03d74669035c6d3f52a3620b486d6
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        binding-options.js
        • Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\app.asar.unpacked\node_modules\node-hid\binding-options.js
        • Size 64B
        • SHA256 e7c820107f3b6571ca1505a5ffbe17511088336e4c410ec718ea9ec200c6b1e6
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        HID.node
        • Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\app.asar.unpacked\node_modules\node-hid\build\Release\HID.node
        • Size 593KB
        • SHA256 3b35b1f90763bdc89e24c9864c11f65f3cf22432495aa5bfee4b0391c15c4d65
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        is-DXB2A1E4CW.tmp
        • Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\app.asar.unpacked\node_modules\node-hid\hidapi\windows\test\data\is-DXB2A1E4CW.tmp
        • Size 219B
        • SHA256 a18fcc24552c8abcee4cc9e324056971dc92e06208d33ca5e2f01495a910d6a5
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        is-MW9S1B5PZS.tmp
        • Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\app.asar.unpacked\node_modules\node-hid\hidapi\windows\test\data\is-MW9S1B5PZS.tmp
        • Size 219B
        • SHA256 68843541e7bf5b3ba766d3cbaf26c8f4ab7c9d090ba746feff32b9d35ce25417
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        nodehid.js
        • Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\app.asar.unpacked\node_modules\node-hid\nodehid.js
        • Size 7KB
        • SHA256 84053a6ea19b238e61368f5220a9a8af96b27e752569f14d63dba2127a37988b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        package.json
        • Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\app.asar.unpacked\node_modules\node-hid\package.json
        • Size 934B
        • SHA256 6fde9f9e079631f100806daeab792c456b5e90b718146effff5bb4288ba55bbf
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        v8_context_snapshot.bin
        • Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\v8_context_snapshot.bin
        • Size 696KB
        • SHA256 1df86ae706c6fc60bb6f4e60d76c5a3f56affa54e6b1442f51127bedc589d089
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vk_swiftshader.dll
        • Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\vk_swiftshader.dll
        • Size 5.4MB
        • SHA256 a638bd2235309493f50adfcae707675bb6c3615a2ac44ccefeca7c7085389d49
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vk_swiftshader.dll
        • Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\vk_swiftshader.dll
        • Size 3.0MB
        • SHA256 7e1c52754ad1ffcd77636720309f8a1d4f94aea0f00724e85bda8316d6eb2388
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        f_000007
        • Path C:\Users\Admin\AppData\Roaming\project-lightning-data\Cache\Cache_Data\f_000007
        • Size 33KB
        • SHA256 faa24ec881e6040655c187a681d6dc496eb8aa41e1bd0652a180b3a40b457187
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        index
        • Path C:\Users\Admin\AppData\Roaming\project-lightning-data\DawnGraphiteCache\index
        • Size 256KB
        • SHA256 7bff3eb5962b1c0d57a78c706c1b82f550456693ff0dce2aade821101c5248b6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        data_0
        • Path C:\Users\Admin\AppData\Roaming\project-lightning-data\GPUCache\data_0
        • Size 8KB
        • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        data_1
        • Path C:\Users\Admin\AppData\Roaming\project-lightning-data\GPUCache\data_1
        • Size 264KB
        • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        data_2
        • Path C:\Users\Admin\AppData\Roaming\project-lightning-data\GPUCache\data_2
        • Size 8KB
        • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        data_3
        • Path C:\Users\Admin\AppData\Roaming\project-lightning-data\GPUCache\data_3
        • Size 8KB
        • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Network Persistent State
        • Path C:\Users\Admin\AppData\Roaming\project-lightning-data\Network\Network Persistent State
        • Size 1KB
        • SHA256 3f832e1c248bead447d0924f15f3640cc19e6f68b688ea4bb8d8d03b1877f05a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Network Persistent State~RFe59c078.TMP
        • Path C:\Users\Admin\AppData\Roaming\project-lightning-data\Network\Network Persistent State~RFe59c078.TMP
        • Size 59B
        • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        CURRENT
        • Path C:\Users\Admin\AppData\Roaming\project-lightning-data\Session Storage\CURRENT
        • Size 16B
        • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
        • MD5 SHA1 SHA512
        Submit Download

        config.json
        • Path C:\Users\Admin\AppData\Roaming\project-lightning-data\config.json
        • Size 20B
        • SHA256 876c2ee98531d13b8fc50e49fb768944f36504b17ee4a56267c7006163d01280
        • MD5 SHA1 SHA512
        Submit Download

        memory/1220-1427-0x00007FFE5B200000-0x00007FFE5B201000-memory.dmp
        Download

        memory/1220-1428-0x00007FFE5A680000-0x00007FFE5A681000-memory.dmp
        Download

        memory/1728-1492-0x0000000000450000-0x000000000052D000-memory.dmp
        Download

        memory/1728-10-0x0000000000450000-0x000000000052D000-memory.dmp
        Download

        memory/1728-0-0x0000000000450000-0x000000000052D000-memory.dmp
        Download

        memory/2828-11-0x00000000009A0000-0x0000000000E0A000-memory.dmp
        Download

        memory/2828-1491-0x00000000009A0000-0x0000000000E0A000-memory.dmp
        Download

        memory/2828-12-0x0000000000FB0000-0x0000000000FB1000-memory.dmp
        Download

        memory/2828-1164-0x00000000009A0000-0x0000000000E0A000-memory.dmp
        Download

        memory/2828-5-0x0000000000FB0000-0x0000000000FB1000-memory.dmp
        Download

        memory/4588-1592-0x00000293EED40000-0x00000293EED41000-memory.dmp
        Download

        memory/4588-1593-0x00000293EED40000-0x00000293EED41000-memory.dmp
        Download

        memory/4588-1591-0x00000293EED40000-0x00000293EED41000-memory.dmp
        Download

        memory/4588-1590-0x00000293EED40000-0x00000293EED41000-memory.dmp
        Download

        memory/4588-1589-0x00000293EED40000-0x00000293EED41000-memory.dmp
        Download

        memory/4588-1588-0x00000293EED40000-0x00000293EED41000-memory.dmp
        Download

        memory/4588-1587-0x00000293EED40000-0x00000293EED41000-memory.dmp
        Download

        memory/4588-1582-0x00000293EED40000-0x00000293EED41000-memory.dmp
        Download

        memory/4588-1581-0x00000293EED40000-0x00000293EED41000-memory.dmp
        Download

        memory/4588-1583-0x00000293EED40000-0x00000293EED41000-memory.dmp
        Download