d69c87e613a28b740288f4716b2989513ac75f5fc1ef0b8d4c70553ebdb14e2a

Analysis

max time kernel
152s
max time network
167s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 03:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ProjectLightningInstaller-v5.exe
Size 121.5MB
Sample260802-d4qe5stdje
SHA256 d69c87e613a28b740288f4716b2989513ac75f5fc1ef0b8d4c70553ebdb14e2a
MD5 19c3bf607eb4fd72125c75eb28eea763
SHA1 ef9ec452ee72dcabd1f9b24a39b15e2aa9cfef9b
SHA512 5150a077df894495a33853b2f486be2b18b252dc36693ab6939271e9803cfe4d57f31eadf11acf5578f251817e16adb3378a700b872e34d1143b5b363db57c10
SSDEEP 3145728:qHl7hJ2t1yO/PfG7gjvx/iy1mB2seY3H/L9ySYJdx/N2USPXz:WhO1yQGK/jrsrz9ytf2TD
TLSH
T1F758333774D2E53EE06B9633A9BB92A1A0776AC1581EC84265F84D6CCF2D1305E7F702
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution installer spyware stealer

Malware Config

Signatures

Executes dropped EXE 5 IoCs

pid	Process
1284	ProjectLightningInstaller-v5.tmp
1472	Project Lightning.exe
3016	Project Lightning.exe
932	Project Lightning.exe
2368	Project Lightning.exe

Loads dropped DLL 9 IoCs

pid	Process
1472	Project Lightning.exe
3016	Project Lightning.exe
2368	Project Lightning.exe
3016	Project Lightning.exe
3016	Project Lightning.exe
3016	Project Lightning.exe
3016	Project Lightning.exe
3016	Project Lightning.exe
1472	Project Lightning.exe

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Discovers running processes 1 TTPs 16 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
5884	tasklist.exe
3696	tasklist.exe
2884	tasklist.exe
4368	tasklist.exe
4112	tasklist.exe
4596	tasklist.exe
1640	tasklist.exe
5884	tasklist.exe
3752	tasklist.exe
1240	tasklist.exe
1084	tasklist.exe
5252	tasklist.exe
3276	tasklist.exe
3316	tasklist.exe
3524	tasklist.exe
824	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 16 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5888	cmd.exe
4232	cmd.exe
1372	cmd.exe
3388	cmd.exe
3924	cmd.exe
5784	cmd.exe
1360	cmd.exe
5612	cmd.exe
4420	cmd.exe
3532	cmd.exe
5296	cmd.exe
5688	cmd.exe
4492	cmd.exe
5952	cmd.exe
3356	cmd.exe
896	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ProjectLightningInstaller-v5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ProjectLightningInstaller-v5.tmp

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/1464-0-0x0000000000D90000-0x0000000000E6D000-memory.dmp	innosetup
behavioral2/memory/1464-11-0x0000000000D90000-0x0000000000E6D000-memory.dmp	innosetup
behavioral2/memory/1464-1364-0x0000000000D90000-0x0000000000E6D000-memory.dmp	innosetup

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	Project Lightning.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	Project Lightning.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	Project Lightning.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Project Lightning.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Project Lightning.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	Project Lightning.exe

Modifies registry class 7 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\lightning\ = "URL:lightning"	Project Lightning.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\lightning\shell\open\command	Project Lightning.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\lightning\shell	Project Lightning.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\lightning\shell\open	Project Lightning.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\lightning\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\ProjectLightningV5\\Project Lightning.exe\" \"%1\""	Project Lightning.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\lightning	Project Lightning.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\lightning\URL Protocol	Project Lightning.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1284	ProjectLightningInstaller-v5.tmp
1284	ProjectLightningInstaller-v5.tmp

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1472	Project Lightning.exe
Token: SeCreatePagefilePrivilege	1472	Project Lightning.exe
Token: SeDebugPrivilege	5884	tasklist.exe
Token: SeShutdownPrivilege	1472	Project Lightning.exe
Token: SeCreatePagefilePrivilege	1472	Project Lightning.exe
Token: SeShutdownPrivilege	1472	Project Lightning.exe
Token: SeCreatePagefilePrivilege	1472	Project Lightning.exe
Token: SeShutdownPrivilege	1472	Project Lightning.exe
Token: SeCreatePagefilePrivilege	1472	Project Lightning.exe
Token: SeShutdownPrivilege	1472	Project Lightning.exe
Token: SeCreatePagefilePrivilege	1472	Project Lightning.exe
Token: SeDebugPrivilege	3752	tasklist.exe
Token: SeShutdownPrivilege	1472	Project Lightning.exe
Token: SeCreatePagefilePrivilege	1472	Project Lightning.exe
Token: SeShutdownPrivilege	1472	Project Lightning.exe
Token: SeCreatePagefilePrivilege	1472	Project Lightning.exe
Token: SeShutdownPrivilege	1472	Project Lightning.exe
Token: SeCreatePagefilePrivilege	1472	Project Lightning.exe
Token: SeShutdownPrivilege	1472	Project Lightning.exe
Token: SeCreatePagefilePrivilege	1472	Project Lightning.exe
Token: SeShutdownPrivilege	1472	Project Lightning.exe
Token: SeCreatePagefilePrivilege	1472	Project Lightning.exe
Token: SeShutdownPrivilege	1472	Project Lightning.exe
Token: SeCreatePagefilePrivilege	1472	Project Lightning.exe
Token: SeShutdownPrivilege	1472	Project Lightning.exe
Token: SeCreatePagefilePrivilege	1472	Project Lightning.exe
Token: SeDebugPrivilege	3696	tasklist.exe
Token: SeShutdownPrivilege	1472	Project Lightning.exe
Token: SeCreatePagefilePrivilege	1472	Project Lightning.exe
Token: SeShutdownPrivilege	1472	Project Lightning.exe
Token: SeCreatePagefilePrivilege	1472	Project Lightning.exe
Token: SeShutdownPrivilege	1472	Project Lightning.exe
Token: SeCreatePagefilePrivilege	1472	Project Lightning.exe
Token: SeShutdownPrivilege	1472	Project Lightning.exe
Token: SeCreatePagefilePrivilege	1472	Project Lightning.exe
Token: SeShutdownPrivilege	1472	Project Lightning.exe
Token: SeCreatePagefilePrivilege	1472	Project Lightning.exe
Token: SeShutdownPrivilege	1472	Project Lightning.exe
Token: SeCreatePagefilePrivilege	1472	Project Lightning.exe
Token: SeShutdownPrivilege	1472	Project Lightning.exe
Token: SeCreatePagefilePrivilege	1472	Project Lightning.exe
Token: SeDebugPrivilege	2884	tasklist.exe
Token: SeShutdownPrivilege	1472	Project Lightning.exe
Token: SeCreatePagefilePrivilege	1472	Project Lightning.exe
Token: SeShutdownPrivilege	1472	Project Lightning.exe
Token: SeCreatePagefilePrivilege	1472	Project Lightning.exe
Token: SeShutdownPrivilege	1472	Project Lightning.exe
Token: SeCreatePagefilePrivilege	1472	Project Lightning.exe
Token: SeShutdownPrivilege	1472	Project Lightning.exe
Token: SeCreatePagefilePrivilege	1472	Project Lightning.exe
Token: SeShutdownPrivilege	1472	Project Lightning.exe
Token: SeCreatePagefilePrivilege	1472	Project Lightning.exe
Token: SeShutdownPrivilege	1472	Project Lightning.exe
Token: SeCreatePagefilePrivilege	1472	Project Lightning.exe
Token: SeShutdownPrivilege	1472	Project Lightning.exe
Token: SeCreatePagefilePrivilege	1472	Project Lightning.exe
Token: SeShutdownPrivilege	1472	Project Lightning.exe
Token: SeCreatePagefilePrivilege	1472	Project Lightning.exe
Token: SeDebugPrivilege	4368	tasklist.exe
Token: SeShutdownPrivilege	1472	Project Lightning.exe
Token: SeCreatePagefilePrivilege	1472	Project Lightning.exe
Token: SeShutdownPrivilege	1472	Project Lightning.exe
Token: SeCreatePagefilePrivilege	1472	Project Lightning.exe
Token: SeShutdownPrivilege	1472	Project Lightning.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1284	ProjectLightningInstaller-v5.tmp
1472	Project Lightning.exe
1472	Project Lightning.exe
1472	Project Lightning.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1472	Project Lightning.exe
1472	Project Lightning.exe
1472	Project Lightning.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1284	ProjectLightningInstaller-v5.tmp

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 1464 wrote to memory of 1284	1464	ProjectLightningInstaller-v5.exe	89
PID 1284 wrote to memory of 1472	1284	ProjectLightningInstaller-v5.tmp	92
PID 1472 wrote to memory of 3016	1472	Project Lightning.exe	93
PID 1472 wrote to memory of 3016	1472	Project Lightning.exe	93
PID 1472 wrote to memory of 1372	1472	Project Lightning.exe	94
PID 1472 wrote to memory of 932	1472	Project Lightning.exe	96
PID 1472 wrote to memory of 2368	1472	Project Lightning.exe	97
PID 1472 wrote to memory of 2368	1472	Project Lightning.exe	97
PID 1372 wrote to memory of 5884	1372	cmd.exe	98
PID 1472 wrote to memory of 3388	1472	Project Lightning.exe	100
PID 3388 wrote to memory of 3752	3388	cmd.exe	102
PID 1472 wrote to memory of 3924	1472	Project Lightning.exe	103
PID 3924 wrote to memory of 3696	3924	cmd.exe	105
PID 1472 wrote to memory of 5296	1472	Project Lightning.exe	106
PID 5296 wrote to memory of 2884	5296	cmd.exe	108
PID 1472 wrote to memory of 5688	1472	Project Lightning.exe	109
PID 5688 wrote to memory of 4368	5688	cmd.exe	111
PID 1472 wrote to memory of 5612	1472	Project Lightning.exe	112
PID 5612 wrote to memory of 1240	5612	cmd.exe	114
PID 1472 wrote to memory of 5952	1472	Project Lightning.exe	115
PID 5952 wrote to memory of 4112	5952	cmd.exe	117
PID 1472 wrote to memory of 5784	1472	Project Lightning.exe	118
PID 5784 wrote to memory of 5252	5784	cmd.exe	120
PID 1472 wrote to memory of 4420	1472	Project Lightning.exe	121
PID 4420 wrote to memory of 4596	4420	cmd.exe	123
PID 1472 wrote to memory of 3532	1472	Project Lightning.exe	124
PID 3532 wrote to memory of 3524	3532	cmd.exe	126
PID 1472 wrote to memory of 3356	1472	Project Lightning.exe	127
PID 3356 wrote to memory of 3276	3356	cmd.exe	129
PID 1472 wrote to memory of 1360	1472	Project Lightning.exe	130
PID 1360 wrote to memory of 1640	1360	cmd.exe	132
PID 1472 wrote to memory of 896	1472	Project Lightning.exe	133
PID 896 wrote to memory of 1084	896	cmd.exe	135
PID 1472 wrote to memory of 5888	1472	Project Lightning.exe	136
PID 5888 wrote to memory of 824	5888	cmd.exe	138
PID 1472 wrote to memory of 4492	1472	Project Lightning.exe	139
PID 4492 wrote to memory of 5884	4492	cmd.exe	141
PID 1472 wrote to memory of 4232	1472	Project Lightning.exe	142
PID 4232 wrote to memory of 3316	4232	cmd.exe	144

C:\Users\Admin\AppData\Local\Temp\ProjectLightningInstaller-v5.exe
"C:\Users\Admin\AppData\Local\Temp\ProjectLightningInstaller-v5.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1464
- C:\Users\Admin\AppData\Local\Temp\is-2NYSWZCS0R.tmp\ProjectLightningInstaller-v5.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-2NYSWZCS0R.tmp\ProjectLightningInstaller-v5.tmp" /SL5="$601A8,126019679,842240,C:\Users\Admin\AppData\Local\Temp\ProjectLightningInstaller-v5.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1284
- - C:\Users\Admin\AppData\Roaming\ProjectLightningV5\Project Lightning.exe
    "C:\Users\Admin\AppData\Roaming\ProjectLightningV5\Project Lightning.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks SCSI registry key(s)
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1472
  - - C:\Users\Admin\AppData\Roaming\ProjectLightningV5\Project Lightning.exe
      "C:\Users\Admin\AppData\Roaming\ProjectLightningV5\Project Lightning.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\project-lightning-data" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1720,i,14813120597052544848,7691049189392093857,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1716 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3016
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:1372
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO CSV /NH
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:5884
  - - C:\Users\Admin\AppData\Roaming\ProjectLightningV5\Project Lightning.exe
      "C:\Users\Admin\AppData\Roaming\ProjectLightningV5\Project Lightning.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\project-lightning-data" --field-trial-handle=1720,i,14813120597052544848,7691049189392093857,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2300 /prefetch:11
      4⤵
      Executes dropped EXE
      PID:932
  - - C:\Users\Admin\AppData\Roaming\ProjectLightningV5\Project Lightning.exe
      "C:\Users\Admin\AppData\Roaming\ProjectLightningV5\Project Lightning.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\project-lightning-data" --app-user-model-id="Project Lightning" --app-path="C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1720,i,14813120597052544848,7691049189392093857,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2628 --from-game-shortcut=false /prefetch:1
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2368
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:3388
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO CSV /NH
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:3752
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:3924
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO CSV /NH
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:3696
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5296
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO CSV /NH
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:2884
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5688
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO CSV /NH
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:4368
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5612
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO CSV /NH
        5⤵
        Discovers running processes
        
        PID:1240
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5952
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO CSV /NH
        5⤵
        Discovers running processes
        
        PID:4112
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5784
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO CSV /NH
        5⤵
        Discovers running processes
        
        PID:5252
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4420
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO CSV /NH
        5⤵
        Discovers running processes
        
        PID:4596
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:3532
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO CSV /NH
        5⤵
        Discovers running processes
        
        PID:3524
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:3356
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO CSV /NH
        5⤵
        Discovers running processes
        
        PID:3276
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:1360
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO CSV /NH
        5⤵
        Discovers running processes
        
        PID:1640
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:896
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO CSV /NH
        5⤵
        Discovers running processes
        
        PID:1084
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5888
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO CSV /NH
        5⤵
        Discovers running processes
        
        PID:824
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4492
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO CSV /NH
        5⤵
        Discovers running processes
        
        PID:5884
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4232
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO CSV /NH
        5⤵
        Discovers running processes
        
        PID:3316

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0d9e5f2c-598c-4706-a666-3363b85a68b7.tmp.ico

Path C:\Users\Admin\AppData\Local\Temp\0d9e5f2c-598c-4706-a666-3363b85a68b7.tmp.ico
Size 361KB
SHA256 d8e29cb60fb03bfa6f1d7dc51ab22e8f840feba979d20577d9f2111691165aa5
MD5 6b0834bfb77f6985e1c1dce6b6a43beb
SHA1 c18e011bbdd22814aed4b6805f0478185e3d6cd4
SHA512 c3a779dd8f45359e30bb483766ef0271cf9a52fc3c8502eaea0821e71fd28a8194d5837bb78f627d6066512d8431be24816cc63ea1f72a4ebb1f3f9d618a000b
SSDEEP 1536:SDraUMInt/nWE5icLDMyAsdK0OYho7HmTsWQJQQ92CyGUnfcTr0BrmevXWDbj7il:67qrD8NdA9651suDX
TLSH
T10A7454F7C5C50865C4B72EF7491989E8488ACF5308271FAB2CB575CF847F4F8228AA56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ProjectLightningInstaller-v5.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-2NYSWZCS0R.tmp\ProjectLightningInstaller-v5.tmp
Size 4.2MB
SHA256 afe50ff7d71ec93eba12004b8e634dfbd766a765ff1cbde43156422cf2845148
MD5 3ea1949a4a8c8cd60d1382a5481638c9
SHA1 df864167634913fe215a4cf24c650d829ada30d8
SHA512 c2ba2fe4fd2133dc1a8fb3f9c1b223809f2980ae37dbc962170ff11a5e5f8cc129e743143aebc7a30b9d47a4a6d351bab1ee404e74bafa957fa7e9aff0915082
SSDEEP 49152:d3yGw7V2h9z2lqSvM0/WtmueejA0JuDeT4q3ZCNW7Iu9ReR9nc4NDR5mo4333lwz:ds7Y8/7ueejA0JuDeT4eZyuaNHm1333g
TLSH
T1F2267C13B389613FD06A2B3A7837A254993F76703916CDDB6BF41A4C8E351807D2AB47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

D3DCompiler_47.dll

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\D3DCompiler_47.dll
Size 4.5MB
SHA256 c8e25abd3d45dfb55966a74613258c39b4a83ea2ac77f2f80903499f4d5c03f0
MD5 6ac6cc720fb6bbe5c0ed4e84ad2b3337
SHA1 8556531bd06691ce0f8b7d83814c867a420526a4
SHA512 216084dc2a84ca818d68d603968acc978c0b60bdbe0a3152cbfc400ec11a2b96e81d1698a15dbb7738974f4365a8feb109f2bca5b641b42acedeaeff1e2a342c
SSDEEP 49152:JSHvWaWTktEzfRriMsCL98dhdVhpHGC6GNCxJYrv9y5Eze+V7ZpdKMZzaWoUyxqJ:suktcrfNlTyj5byqSC
TLSH
T1FE268D5767E840E9C5BBD138D687831BEBB1B80413345BDF01508669AF73BE26A3E724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\chrome_100_percent.pak
Size 112KB
SHA256 cbe052e9bd36032cde9d0ad7496d611c6a3c98a130b960e1298d490254be1159
MD5 129f8cee761c5bb414b2270356177f6c
SHA1 0a10b55daf24c7f9fff1b22f853dd87a98433b7d
SHA512 33f4ceb0ed18b2172e2f6d203ccab2954dd900592b2e62ce4a1019ab9404889ebdcf462a2479f1847c01b2835473e83859c77816e83ef76ee133990be3d55eb4
SSDEEP 3072:DS4PisCv+/P9NebGz8LI1TwuLjQBHe7YAP18RVC2I:LYWFUbGz8LI1TnjQBQCrC
TLSH
T136B3D0D7B3B09D7DDA460BB783560170FCB31B2D06C2120A5A9AE479652BF88C8D93D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\chrome_200_percent.pak
Size 182KB
SHA256 6593ba8ece63001a3fb77bd1d872566edeb26213a1be8e852dd956f6d0e2c93e
MD5 ed7b4e5eb15a086ce7e117a3228e3f15
SHA1 bb6debc27ed4e2f20149a17e36a24ef4482a96a7
SHA512 7278e0acdd8a1806bbdfd147d5439f7f849fbf95f1be1ffb741ea84cecad2557469e99f91cca66ce36349a9aa55d0107e34b9499b8fcb3e7fb3a8bbf84c1e911
SSDEEP 3072:CJ8LahaY7d6iN6uSwxohPQDQYaEjrvy/IwXJPoLjQBHe7YAP10uxR/TbIM0:7GQ+N6uSZQDQYakvyAkcjQBQNd4
TLSH
T1EB04F1D723B8AD3DD9570B73926610E0FE7A20291EB3110A5A9FD8397925E8CD9CD343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxcompiler.dll

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\dxcompiler.dll
Size 24.4MB
SHA256 1565adbd62a0e8ba2a8b25b3da5d2e2a45032c13aeffdd061228abc3ee5c1585
MD5 a41223961c47f5e60f2a83597ccc125e
SHA1 d3050c6e99fa83919ab02e3c7b5d8c40eb566200
SHA512 7a25b88a9d044cfd471a6c131d85a82ab395168e069204117fb0176e3b393c549b0be23794e48b3ea09f6cdbda83bc20c90795e750e579c9989bde6a19dcefef
SSDEEP 196608:ysq7jjh1u1/1i9iJj24AD14c9TR8Z6GmfozCEJdXqaq:ysq7jjh1u1/Dxc14e8Z6GmfyFqa
TLSH
T1D04729122646D49DC059C879C7678B268A6C30E73FA7B8EBC0F451252B79EFC5B39234
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxil.dll

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\dxil.dll
Size 1.4MB
SHA256 436f128f22050ae27323da61321a469de0678def7a4e6d86f9ccad4858724f0a
MD5 f8f3501026df30556c34a9af9cb7af9c
SHA1 961d9012b6d79e2e3c28b310a80ba3ab36e2c559
SHA512 3631f8a3d48e8eea25091b93147d88f0e8a7539f2f242fe287d37f82fc4344528901e4cc48c93ebcf8691d2e11227a9b50f2b5ad45f2475c0119ad8b2d3661fd
SSDEEP 24576:zY+wATtbKYxy0y3ny6eBjNSGlVZyi27+V0IJNSD11J7R+j+v1acLUkJvS5Kao:8iTMYxy0Sy66Zh7Sh/cyvS5W
TLSH
T154657E1B229801B6D4BBD17CDA47CE0BE6B2B41503B09BCF12B406692F5BBF55A3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\ffmpeg.dll
Size 2.9MB
SHA256 26eed00c4da27de095ba76030b47bc0436ba659a7443e05f11ee162dc225e828
MD5 38c4d1074280e903212f6b4bf7e650b9
SHA1 fdece1b93bbec86f949eca244c780b6809ffb2b4
SHA512 0904363e03102b8ee72b172ab02b78456472a5c726fb1c6b990713c640f48ac16cebb2ac2374dc82a62aeab589b46b9c851493b5768ed28c1e8358d81bdd8e48
SSDEEP 49152:ncHnAGZ5/wriV8Ay6AC6L6BEH199a1LKIbQ7k6xQv8VNoJHfmX/6s6l8b+:cHnh8F6lC6i9rNoJM4g
TLSH
T11AE59D03F6D651EDD019C03497AB9313F631780A4F209AEB16905A223F67FE86D7E768
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\icudtl.dat
Size 10.3MB
SHA256 1cf67874b5a87a8363a86fb3f81e3cbbed54d389062dab8fb52308d5cf8c8612
MD5 5bfd3eefca4b5ef2d1a869396390a7de
SHA1 c58567f7fe308ccd43f406b70aa8bf6fdbea4f3a
SHA512 4489a55fa0b47c8d1e9679032e036c7998f82efb4191b98900ae40cfc30a26b65290867527161c594c42fe7999b2314f8928a5d717d65d4eeedd4fdb0ed0f427
SSDEEP 196608:A6akBhOR8LE/dUHiXUxa/iJ53IWhls2E91Z0G:AqwKLBHiXUxa/iJ53IWhls2E6G
TLSH
T118B63903A2EB4EC6F9FB5F7498F562779527BD49AE32804A51043F3B1C333908664B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libegl.dll

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\libegl.dll
Size 503KB
SHA256 61ebcd780d17d37ec09a5eb7ff7399ad67726a5a1ff73be1c37734551c3ef1fe
MD5 e2125f8574719b50c955f8b3e9444d68
SHA1 75ef9ab467080e726eb8f1a906deefee5c1980b8
SHA512 8ca2cda69c61aa78ceb2a869cf757a68365bcf801892ad7250807ce77ba8312fc54e6347a381cb399c92337fd43aa82518973aa92345cbfae000306a117414ab
SSDEEP 6144:dQ4VIVcVQMLMVwCtKpDaLnjSFeN+a+BAiLm4LiE0z0WhcEuvBLPdvtYPqQa:dn0iCZjF+CymG0z0WhcEuvRltY
TLSH
T147B48D15F3E84BA8D07AC0348A538646EB7574960B65F9DF02E052792F3BBF45A3E324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libglesv2.dll

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\libglesv2.dll
Size 7.6MB
SHA256 b35d3337ef4cad5423f4e11a06e280763deae634f7e39c7844e4f0fcb455b3e9
MD5 c9b6de9b18d0f5dda94589cf038e1bfc
SHA1 6fbb1ec482e6c0988a5b5fe84b4ca9695d960039
SHA512 4a59fa62445ace0b27d51ca246b02d5e9ceaf6a4edee2d02051aad52de63b70376406347fb2ab97e42a9d70f3844dfcb0c2eba301bc54a3902b8c11a316f7957
SSDEEP 49152:4upJ61ZvUdnnnzCwAOqBmONJAbLfkcO0VsWkgp9rnnG45/ifbKnNdCusheIYklbo:LeCXaoJl9aWNd5JIBhhpJK1Ixe2l4
TLSH
T1A3867B03F69681D9C05DE278875BA623FA34B8450724B7CF2A9453162F66FE0EB3E714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\locales\en-US.pak
Size 537KB
SHA256 ef30389492cc2d31bc5c162056fe68c27a5d57b0a69f5f878562325f795c5185
MD5 0604e26677ebd9417c7de4c421f6254e
SHA1 ed023212b6951afcd80ece283d6ddc68b663e079
SHA512 8af64b75a40a6dca6ac5feef06ab5e8c898bf30b50be73e480df923461d42e2cc417bad5151eb957c9606540321e0dea48820b2c5009408e0420e1ebe1b01a29
SSDEEP 6144:K7dq1yx5HfUOQkbaqMP9qQ0BFfaYQDp9I3AjkgngP8/I2wf:K74k5HfCqM8Q0BkTjzwf
TLSH
T1BAC45C1FF744122A059352A2BF099562FF32D06CA35112663CBD812C3376B6AD3B76F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources.pak
Size 6.1MB
SHA256 ce5c35017fd7aa648fe44381711cbf42eff5f6923b11241a4789058dbc5b27aa
MD5 79762f4295600653dca20bbaffeed153
SHA1 85b8ab7d9e7fa663dca0babd1f72c79a1f39d99f
SHA512 13784fda38785e3dc23b118969478c61040e81e1271f6ca7d7536ae60872b1adc9f2a99e15fc17e5c4903046eee8508b686fa18092cfdbd1c0a29b79fbf18484
SSDEEP 98304:5vjQ8HDIPJ132R3lW4uKXegybAHltND8rwri0J/xUaAUXLPC1GP4kFbG:JB0BRulFzPtND8kri0JlAYz4kFi
TLSH
T1985633E1B7A06CAFC5484379D19542343A3ED95F2581739A188CB33CED6D91EEA4823F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.asar

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\app.asar
Size 48.9MB
SHA256 e71d1b3b2638bc4479c44c1559ad0f75d9c55d9816895af83c930625948ccf24
MD5 5945f5546f9d6e559e81d37ca039f917
SHA1 e5465bdd2c3e31ab8499dbbb1ae9306458759bad
SHA512 9ad0e18b14cf85d189b4cd74abc0cc56325bea6a744d007f584408d32b482a11eb05fe21ca10f1833a1084778b87140d52a6a5525eefb426b8169b1d1c7cb50e
SSDEEP 196608:uHiZZWPJcQdzR6og5qOcXQVS/RL4Tchkz5ypUE4GnMkqCMnjJnxvepvwJko3Ukbj:ZWP9zRNRlfY5SUEVnM33n5Swl
TLSH
T170B79E027AB7A033D25752B74BCF8146BA20B40B1A249561384CD7A47F92F38E6F6F75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

better_sqlite3.node

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\app.asar.unpacked\node_modules\better-sqlite3\build\Release\better_sqlite3.node
Size 1.8MB
SHA256 715dc7eadd3fa56a68716eba485e45ffc687a16a3affb7c592fa1c246cedadd5
MD5 105909e67cf828fce962e20acfa06c05
SHA1 ddae166497339577d5e9d8084b3bc8fe72e54e87
SHA512 42e6da355710ca28eacfbd456f75a83a7bc6a2d9dc37a274fb56f2d8196a3dc6e1e33121b5e5fd79e0308fc852580bbd8dc4bada14ca77e2db303e880903172a
SSDEEP 49152:+iUd54kxDpwLra1BlDANOup1ha9yZjcmIDr/x0ipjssmW7D:+V4kxDpwi1BlDANZ181j
TLSH
T17A958C4BF2B400FDC1A7C0B9851B160BEBB6B40517749BDB1590CA696F63FE217BA324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

database.js

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\database.js
Size 4KB
SHA256 02ea23bdd23d7ac5de0675a2f32fc686e76d5c6a32bd3e3891f360e72e07f61f
MD5 952ebcfa3d8727e8b1d7b681c9f5bf32
SHA1 6168b5f5ed77669b3c6c1f1d526f0eb116bd3a43
SHA512 d2dc310d2e4a491903988ed88228d35e9688e48c9b6180c797fb58f84d1105724ab3933ade92be0e73c8a27fb6f3064449bfe00cfa1dc92919ad53a81af2680e
SSDEEP 48:+FzYIUZFeVxWy3h9zxIEXMOK0ZHQZ27euTqQaqE8E+LC7yIGrtRxtjFvcLd3s03M:ac1ZFjQBG1oQZi9qSvNRBkLveomRz
TLSH
T1EA818388DBF5611247EB30D4A674A48D6234D27971AD08E0D8CBC3F531E60C9BBE3B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\index.js
Size 110B
SHA256 82db11c4ee43a41d859988c5db42c3771dff565371f94bacbd1e4d8d6ceb47cd
MD5 26660b3078523a953ee252b4e86e1c8b
SHA1 f7c22bdc8183f6a9cb73a9b4a735a5bab7ca01b4
SHA512 d4f32ba712ff15e8b6a1634eee089057a4716318b90e932b95a1c1cd30945ba708e7e725316fc824107637d2e97a2a64193ae81c0a3d2484651f52122bace99f
TLSH
T16EB012CF1BF0B18F26A44184E9618493D8C2E466841A40208F05CFFFA484CC42FE2DE1
MD5 SHA1 SHA512 TLSH

Submit Download

aggregate.js

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\aggregate.js
Size 1KB
SHA256 e9f74eb919ec93fe089c95ddf25a98f1f631c80418fa34fb2346ca1bc29f1b82
MD5 25fdd950809b2b22d0ba6917fe014c35
SHA1 5555b3223918668b5bf244e892b1d6a258f0099a
SHA512 50516a2d2265513dd7ee727cf9cf21d118601a0ee2b9de61111c6f5fd8933915f3029ef6f764f7803cf5438725c6017002d7f58cc36988d97cc1bdb805dd42c1
TLSH
T142412121E2D2221605DB24E07097F909EA7ED720B54DB4F0C92EA7E910D1DCDE9E7A80
MD5 SHA1 SHA512 TLSH

Submit Download

backup.js

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\backup.js
Size 2KB
SHA256 ea29d34992bb02e006d0fdeda9675ac5d2bb227aaf57468decd997e9fc9c7dbf
MD5 69638dc10c19961a0c05350ae333d6a4
SHA1 5941988b67c6fa083358002ba36538f1e39ad03b
SHA512 495ecffdadbc8c9bb2e886f9f7a93668fa5b2192a0ba79a7e1a9d3c2640e0520e39f2d2c6f3a26b55c72ff882bff43ed6439c0ad7c7622461e6ccaf1ee8f119a
TLSH
T171413158F39E5169436734C04490E00EE93DD6B6313E09F1AC8953F022C66CDE9DBBC5
MD5 SHA1 SHA512 TLSH

Submit Download

function.js

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\function.js
Size 1KB
SHA256 f431d49303b8bbdc044b1f1b455bdad21fc9b74b007de0acb22f08f25b4febd3
MD5 1036ce624efbb9fbbb387fec25fd1bcb
SHA1 35395f7ef4c18b845582b9289bc802d87c9e3c11
SHA512 7d65a4bc5bf5c9b97dce021cdb8c888cf975ad24613b12b239db1e03a98dda89faf7b1b204c906f6dde5439d22414d9b4410554d01eea8fc121287ed8821f9a0
TLSH
T1E021C911F2A6214246DB24E0B0ABF909E97AD765B44C74F0C58B97FC40A1DCED8E3A81
MD5 SHA1 SHA512 TLSH

Submit Download

inspect.js

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\inspect.js
Size 174B
SHA256 4975a78daee850adee62ba98719d0f223819a0ec135a07c0e302994bd8dbff61
MD5 21784edff107eaec0e9ef7e66e83552b
SHA1 6b59caa4cc8a568a8ed3f184a075d66c68f17d08
SHA512 9bf6d36dbc01dbad11d5d01c0b662620bf6c0cebd85c0065882e8ec57e3304bc4d301add25bf57ea425a270f3ace6a44fcb958dcc8bf993f411eb81a5369adfa
TLSH
T125C0800973F1B465554F30D5955FD00451E5F0242CC450420D1DC684CD708697F3790F
MD5 SHA1 SHA512 TLSH

Submit Download

pragma.js

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\pragma.js
Size 536B
SHA256 8b1c54475bd4340b15e25c50d53d06308be65f8f919ecbe4aa9d285ca859ad5a
MD5 9354074a096ee1cf58905ca8dabfd60c
SHA1 63e6c02339c45c252ae3bb24267610a636117eb6
SHA512 32bdf8866d1c4e3db8a2ca65df2c1bd0d33c064d4cc526e264587cbf9c09ba7b97c8adc430a9dc019d9863e0e90b4318442ffb5cd08e0de52cdd4f081b5150b5
TLSH
T155F0C91602F245530BFF14C094E5F534F4B7C668B50E94F0D99E83FE41808DAEA83E95
MD5 SHA1 SHA512 TLSH

Submit Download

serialize.js

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\serialize.js
Size 625B
SHA256 7a10ee5c2735384b7f0c361811bc6d017db29f62b203fd3c68a35f667e2c2605
MD5 41cfeffe67a2975f68aeeaaed0bf384c
SHA1 321f3f817bc095c34b76d060d706ed2cc48f204d
SHA512 8a0ad9732b5a07866eee742b2e884e521111f213af9ae39ebd92fa029d88f087c43f8826672d1fac5c571d14b284f20ae25e12aa4058a7881d6fd5e93c0b0a0c
TLSH
T1F5F0783A3365564B0997A0C050E1B429E9B5D324312D68A0E989C3F511D48CEEAF7B9F
MD5 SHA1 SHA512 TLSH

Submit Download

table.js

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\table.js
Size 6KB
SHA256 97c42d9ded1aa96c7d916b5b92f96b4e59581d50eaf629cd2c7afb78ff26a9ea
MD5 43137a36158617045d106a2ff534edaa
SHA1 f365ee98f7e36d1bab09e58187d467dd5f73b6f3
SHA512 f4330d881ae76d41083d3ba9d0056697abd634638a9951a4ebe4044fb79eceff4da034d22d9ba2ad4cd1a208fb0ec1c47855da781d9c9dabc34979f6f7f9eff3
SSDEEP 96:bJx7JBAUU6VtWpzwukGy2K3rN6gYMNEXxulo+yrgrm+IttSXFJ:bJx7J25PUyKb0+UklovOQk1J
TLSH
T18BE12308A7E17A13404B7095BC58605EEDBC98B27C1C48F5B8DC45E92491CBEF9EAF26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

transaction.js

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\transaction.js
Size 2KB
SHA256 bc8624a3ef689d8f78e5669020ad121e17acbc93b1d5ee5afe26860b1084c66c
MD5 6b77badde74e5a5b854041134e62041d
SHA1 47f5883e26f1aedb2bc1557cef9dd21c26e0e0ef
SHA512 d5be3aed74a9c9a948afbf6f03c19e21ec6d5a86f5f277de85d9d7374136fab4cf68bca1a6e752e5d41ba6b48c00577ca26ebacabd5bec51491da28affb3719d
TLSH
T1EB514312F67ADE7063E23088FA0B630EF5299A49E03494B0E760EB4A3A958CD8117D53
MD5 SHA1 SHA512 TLSH

Submit Download

wrappers.js

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\wrappers.js
Size 1KB
SHA256 a150a6271d23f4e5f8953b129f370ff096c7cdc4b812afbf080a6cf4ab741bcf
MD5 9e2ba6058f66127065c27ea3e81b8e68
SHA1 92346423dab9536ca4afa50e7ef171843d5eba5d
SHA512 2b6644404fea27117b74f904bc608fa42e36e3b100f51010394ef917df7c48f40af018e5b06243d31d7ccba5ab05cb32541566e79775df482e09a107524d091d
TLSH
T187213A8A72E6F162D31530309DCFD184FCF9B861694C64BCE47497922DE007942DEDB8
MD5 SHA1 SHA512 TLSH

Submit Download

sqlite-error.js

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\sqlite-error.js
Size 717B
SHA256 2582d61c27680dead168543f392eb102be621dfbef282a4ca4c7c21aa5e7c75d
MD5 e1372372ca8f94dd66666d886a81f9b5
SHA1 437034e71dedf15013967b540db157cbe3eac3ef
SHA512 5bbfce635aa1b10b30f1703eded4256224500705e3b14c7cefcd522ad703596d15d6cfee7914dd70700827afd01a50d61bef1954d29b8788bf6347f96e9cd8d4
TLSH
T1660168C69F7099BB01E15884FC116806996C5678C021B5E4B6C8DD9F2DF0087CDA56A0
MD5 SHA1 SHA512 TLSH

Submit Download

util.js

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\util.js
Size 331B
SHA256 92b2e39e2151b43a2252e10b6d6de876ecaf0008336a4fa1dfe1317b20f1916f
MD5 a5d75fb36bedb4938a8b9dc6525fd515
SHA1 b5270aef455a7de04d31d19713ed7dfceb55fa06
SHA512 c181b25f5b991826159125a4f7af8ec0f8a7bbceba674121f144f401295670136daa64598d4e0f48cb8ea2849000ac8e7f59881220f6a30a4905ce9309db8067
TLSH
T1E6E0261BDAD2876511AB30862E8EE404DE6CD2A6746854F0682AB64970C84B4EA8B25A
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\app.asar.unpacked\node_modules\better-sqlite3\package.json
Size 936B
SHA256 67f68163a5fba6a9920b1f9151c997c7b4d03d74669035c6d3f52a3620b486d6
MD5 5e32e88e6545358c0be5ae75230b31f0
SHA1 4ad39cb96d30ac40a751110757d90c8fc5715089
SHA512 fd7f1b86c4799442cfc028296086f90e25ecffb6258c7e49d740b7082ae74787c53ed5bf107f50a18e6b5eae0b12a9e690c16733bf30f95a6001a73a8cb23b07
TLSH
T1D0113D50CE158DA329C559D5ACB91042A22048178CA4FC4C3387466D5F4E4BF21BD57E
MD5 SHA1 SHA512 TLSH

Submit Download

binding-options.js

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\app.asar.unpacked\node_modules\node-hid\binding-options.js
Size 64B
SHA256 e7c820107f3b6571ca1505a5ffbe17511088336e4c410ec718ea9ec200c6b1e6
MD5 8cb198b85d4166d350a455d5a7cbd985
SHA1 90b9715f66d95ab9e17deecea3531d1d9a4f3d0f
SHA512 185b5d8c5278d4878bd0cebb25262cdcc9838ff2bf373f7eb7c31c5c6a427bb12312e728ca6b3540004c9f49cbab0abd7b1a9fd9a90afafb755cfe3989738fc5
TLSH
T141A002434411F2D70335462491645712F6904176A4004023F5E9455C2F30C6F3010D55
MD5 SHA1 SHA512 TLSH

Submit Download

HID.node

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\app.asar.unpacked\node_modules\node-hid\build\Release\HID.node
Size 593KB
SHA256 3b35b1f90763bdc89e24c9864c11f65f3cf22432495aa5bfee4b0391c15c4d65
MD5 85956c021bfc92cb5ad196630ed6e742
SHA1 1ae69316de3300b8c760ac160b532977250b215b
SHA512 2b7417a3f9e2284f657b73f6672323ccda51bab90df8b40d65e73947436e6dd1e6d22b207dd2c1419c4802f4ae92ae28b54a2a51d36d4178b69221d4d464c18f
SSDEEP 6144:uL+mt+BVwyal/b1XXLHPfoB1lLU1lht20Q5gJRUDYVGc2TfX9qKsQpkkifZI6klj:dmtcjeb5tJR79SsjkihIb
TLSH
T1FFD47D29A6A801B9E177D178C9870917FFB278461371A6CF03A15BA72F277E0473E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-V6FVGZW8OW.tmp

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\app.asar.unpacked\node_modules\node-hid\hidapi\windows\test\data\is-V6FVGZW8OW.tmp
Size 219B
SHA256 a18fcc24552c8abcee4cc9e324056971dc92e06208d33ca5e2f01495a910d6a5
MD5 03cacdf6a68cebc65d28bd6bbb462b34
SHA1 94a75b98100a70f06a562598800bc2d88a1cbfdf
SHA512 1c932a5155f25051fc0ac473a197bb89c988907f2012f8c6782e798dce13a977eeb12f421dfbc96ef5b5e51934da07f7c0eb13d44c6e4b852cbb347b33a2dd63
TLSH
T123D002D7B70D54D43953603CC7C644D0958D913501F1909AF3EA863DF4CA41884F132D
MD5 SHA1 SHA512 TLSH

Submit Download

is-XU6FKFE7QC.tmp

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\app.asar.unpacked\node_modules\node-hid\hidapi\windows\test\data\is-XU6FKFE7QC.tmp
Size 219B
SHA256 68843541e7bf5b3ba766d3cbaf26c8f4ab7c9d090ba746feff32b9d35ce25417
MD5 2d4f76db6175ff5f7f28f0d923a66654
SHA1 123d7c009f8e0cc29ac86e971ba15b782d65a51e
SHA512 f56a47f7bc60e04136f70ae848e31421b839453fdb01dfd0303a06256ebfb0955a16720cf84a3d35ab0e3fdc90323e97282daa36430e568e283b10990f76766a
TLSH
T1D1D002C7B70D65D43D57743CC7C604D1958DA03501F0905AB7EE862DF4C640888B132D
MD5 SHA1 SHA512 TLSH

Submit Download

nodehid.js

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\app.asar.unpacked\node_modules\node-hid\nodehid.js
Size 7KB
SHA256 84053a6ea19b238e61368f5220a9a8af96b27e752569f14d63dba2127a37988b
MD5 990d51eeaabc0d11d836d3aa0a8e78f2
SHA1 9d12a1ae2e5697a8763eb53aeec10c54eafc39ad
SHA512 3a47c21c296dad6e52f1c52c8865730466879b3c8a0581cc72d89376e7e3d73c76df6c532c681dfe374257592d6f9fd5fe95c3347474233707ddda17f4f55014
SSDEEP 96:rHufZcdof9GLAMX8dNwdJKPq5ArO3zXhMwkjLuThaD5zktBdK/e34x+E+C/iTIkd:rOhf9XQMwd0qcozpVTMgtB8k4x5lm
TLSH
T151F13359ABAF1361C2F370A90F5E60422326817B220FCA583D2DD3D81F9D57896A1FF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\app.asar.unpacked\node_modules\node-hid\package.json
Size 934B
SHA256 6fde9f9e079631f100806daeab792c456b5e90b718146effff5bb4288ba55bbf
MD5 295a4c85b34ca9e5529906a0a1e6f9b5
SHA1 944bb67d7091a84892b37fbb1669f166bacf2717
SHA512 5ddae2344dd90b78e3cf715d21fd8267acd39ff484788540c69de1107d145e4ba638be7d80899956dd00e3dfc218b0592ad7db863b506a2eabf948dfefa9b2ed
TLSH
T175118CE2D9780E532ACA6DB49C29224AE1214D4B8C1CBC54B39341AF4F1E07F20FD17C
MD5 SHA1 SHA512 TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\v8_context_snapshot.bin
Size 696KB
SHA256 1df86ae706c6fc60bb6f4e60d76c5a3f56affa54e6b1442f51127bedc589d089
MD5 ac1ecab348d666e70d3bfe6877a43f99
SHA1 7e22faa7dd16b965c4af9e6b85b12a11d2060f19
SHA512 81bc684328821627718339eca626130380dad46c9c024df775d5356ca20a5fa9cc55b48f8e9d7ea244f065c86977c952a14c7dce29963f1c5afe1285bdf76d08
SSDEEP 6144:9af8tLrT5X3ukt+H92AqD9clxP2NyhaigNw69I3ndbkboE/UZ703yCTzrWD:9af8tL35X3usCN2NyI4NbkboE1rTzm
TLSH
T197E49761F71ACF26C6493A7D8DD657463930B2CE8E46E24B3406B33E78B96704D3662C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\vk_swiftshader.dll
Size 5.4MB
SHA256 a638bd2235309493f50adfcae707675bb6c3615a2ac44ccefeca7c7085389d49
MD5 91869ba2775cbd0135b8ac20854cdb77
SHA1 07ff72e2afa2fc876565c8d7a9bae1f67105e5c0
SHA512 d970633cba93639fe46a569b45f5b4547125f0505cd6878879a7d729a0a89bf723d604e53563fe17120e4825b92c2124b5a82a17f185e46f52d7025893f3076c
SSDEEP 49152:+hqQRjgbS5A0V4NmoIb193Km3QIH6hvweSNerodqG5iBgP6zPPvT48unNHRVq45u:+1gbID4lz8ZlwZswtwmdXn
TLSH
T1F0463803F28681E9C06DE579875FA633B631F8850B2276DF56A00F192E66FE06B3D714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000007

Path C:\Users\Admin\AppData\Roaming\project-lightning-data\Cache\Cache_Data\f_000007
Size 33KB
SHA256 faa24ec881e6040655c187a681d6dc496eb8aa41e1bd0652a180b3a40b457187
MD5 f953f499c9824953791551bfef65fe61
SHA1 00fbf8d23d0e9549798383179c9b0eae5d653f9f
SHA512 07bf316d186ac8d6eb8cf860fd0dbce854ae74ae26276be3950bd32b06894c7b24268280d504bb490218c5ec0e85b4eeb7e858011dcf4de64bbb06e4eb296fca
SSDEEP 768:Pr8FwJ2kfmG7rCq0GJtSBVRF0UGuEuOZejwpiUCTVwiYz:PVJ3fd7rCqduSduOZnIVVwvz
TLSH
T1D0F2F185B0036A346E502FB459DBE6CE1FADF8041A5318EDCE9DC30BA394C7648792BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\project-lightning-data\Network\Network Persistent State
Size 1KB
SHA256 cb1eb7e8622044c6caae17dbeb83459034e10a68d3ef69cbbe1a208492812d60
MD5 0e351cf6421cc26684094e350cbadcd5
SHA1 2f92ebbfbaf2ed8f8b7c93d6ac2467f25b10df13
SHA512 79e143280a0891ccf97d733ad6f5b1646ac89e2b6405f7ae7749276a22b85605deb95c594b43d1a2a7baa23687c45766d5a270ec96e9aeecb4cc7af45f08a28d
TLSH
T1222187E6C7E8097E8A1363F46F217E33C1FE0428076C2C4285D4AF8E97E1432A65224E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5b2fe6.TMP

Path C:\Users\Admin\AppData\Roaming\project-lightning-data\Network\Network Persistent State~RFe5b2fe6.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\project-lightning-data\Session Storage\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

config.json

Path C:\Users\Admin\AppData\Roaming\project-lightning-data\config.json
Size 20B
SHA256 876c2ee98531d13b8fc50e49fb768944f36504b17ee4a56267c7006163d01280
MD5 740c384390b5510561ab16800cfa5e68
SHA1 67577409440ba681a231da37631ee19b9d6f135a
SHA512 cafc89f2c06a9cb5712e2fdb0c1f6cd6d5c651e2315073acc0acc06bfece5828721a066a59b4065a9042a58ef41e459dcffa7195be7af84f0fdee121786cbf8e
MD5 SHA1 SHA512

Submit Download

memory/1284-13-0x0000000003230000-0x0000000003231000-memory.dmp

Download

memory/1284-12-0x0000000000050000-0x00000000004BA000-memory.dmp

Download

memory/1284-1350-0x0000000000050000-0x00000000004BA000-memory.dmp

Download

memory/1284-6-0x0000000003230000-0x0000000003231000-memory.dmp

Download

memory/1284-1291-0x0000000000050000-0x00000000004BA000-memory.dmp

Download

memory/1464-0-0x0000000000D90000-0x0000000000E6D000-memory.dmp

Download

memory/1464-11-0x0000000000D90000-0x0000000000E6D000-memory.dmp

Download

memory/1464-1364-0x0000000000D90000-0x0000000000E6D000-memory.dmp

Download

memory/2368-1435-0x00007FFD3FFD0000-0x00007FFD3FFD1000-memory.dmp

Download

memory/2368-1434-0x00007FFD3F7A0000-0x00007FFD3F7A1000-memory.dmp

Download