hxxps://github[.]com/LightnigFast/Project-Lightning/releases

Analysis

user interaction
yes
max time kernel
140s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 19:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/LightnigFast/Project-Lightning/releases
Sample260809-ybehdsxxbx

Score

8^/10

discovery execution installer spyware stealer

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
74	628	msedge.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	Project Lightning.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	Project Lightning.exe

Executes dropped EXE 6 IoCs

pid	Process
3976	ProjectLightningInstaller-v5.exe
5108	ProjectLightningInstaller-v5.tmp
4112	Project Lightning.exe
2468	Project Lightning.exe
1988	Project Lightning.exe
4228	Project Lightning.exe

Loads dropped DLL 9 IoCs

pid	Process
4112	Project Lightning.exe
2468	Project Lightning.exe
2468	Project Lightning.exe
2468	Project Lightning.exe
2468	Project Lightning.exe
2468	Project Lightning.exe
2468	Project Lightning.exe
4228	Project Lightning.exe
4112	Project Lightning.exe

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Discovers running processes 1 TTPs 5 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
5720	tasklist.exe
1288	tasklist.exe
4156	tasklist.exe
5568	tasklist.exe
5256	tasklist.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2952	cmd.exe
5416	cmd.exe
6128	cmd.exe
5212	cmd.exe
5520	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ProjectLightningInstaller-v5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ProjectLightningInstaller-v5.tmp

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
628	msedge.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/3976-323-0x0000000000240000-0x000000000031D000-memory.dmp	innosetup
behavioral1/memory/3976-461-0x0000000000240000-0x000000000031D000-memory.dmp	innosetup
behavioral1/memory/3976-5568-0x0000000000240000-0x000000000031D000-memory.dmp	innosetup

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Project Lightning.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Project Lightning.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	Project Lightning.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	Project Lightning.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307777972442243"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\lightning\shell	Project Lightning.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\lightning\shell\open	Project Lightning.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\lightning\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\ProjectLightningV5\\Project Lightning.exe\" \"%1\""	Project Lightning.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\lightning\ = "URL:lightning"	Project Lightning.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\lightning\shell\open\command	Project Lightning.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{CDA61BCF-4030-4FEF-915F-7E876C2D3005}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\lightning	Project Lightning.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\lightning\URL Protocol	Project Lightning.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5108	ProjectLightningInstaller-v5.tmp
5108	ProjectLightningInstaller-v5.tmp
6036	msedge.exe
6036	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe

Suspicious use of AdjustPrivilegeToken 55 IoCs

description	pid	Process
Token: SeDebugPrivilege	5256	tasklist.exe
Token: SeShutdownPrivilege	4112	Project Lightning.exe
Token: SeCreatePagefilePrivilege	4112	Project Lightning.exe
Token: SeDebugPrivilege	5720	tasklist.exe
Token: SeShutdownPrivilege	4112	Project Lightning.exe
Token: SeCreatePagefilePrivilege	4112	Project Lightning.exe
Token: SeShutdownPrivilege	4112	Project Lightning.exe
Token: SeCreatePagefilePrivilege	4112	Project Lightning.exe
Token: SeShutdownPrivilege	4112	Project Lightning.exe
Token: SeCreatePagefilePrivilege	4112	Project Lightning.exe
Token: SeShutdownPrivilege	4112	Project Lightning.exe
Token: SeCreatePagefilePrivilege	4112	Project Lightning.exe
Token: SeShutdownPrivilege	4112	Project Lightning.exe
Token: SeCreatePagefilePrivilege	4112	Project Lightning.exe
Token: SeShutdownPrivilege	4112	Project Lightning.exe
Token: SeCreatePagefilePrivilege	4112	Project Lightning.exe
Token: SeDebugPrivilege	1288	tasklist.exe
Token: SeShutdownPrivilege	4112	Project Lightning.exe
Token: SeCreatePagefilePrivilege	4112	Project Lightning.exe
Token: SeShutdownPrivilege	4112	Project Lightning.exe
Token: SeCreatePagefilePrivilege	4112	Project Lightning.exe
Token: SeShutdownPrivilege	4112	Project Lightning.exe
Token: SeCreatePagefilePrivilege	4112	Project Lightning.exe
Token: SeShutdownPrivilege	4112	Project Lightning.exe
Token: SeCreatePagefilePrivilege	4112	Project Lightning.exe
Token: SeShutdownPrivilege	4112	Project Lightning.exe
Token: SeCreatePagefilePrivilege	4112	Project Lightning.exe
Token: SeShutdownPrivilege	4112	Project Lightning.exe
Token: SeCreatePagefilePrivilege	4112	Project Lightning.exe
Token: SeShutdownPrivilege	4112	Project Lightning.exe
Token: SeCreatePagefilePrivilege	4112	Project Lightning.exe
Token: SeShutdownPrivilege	4112	Project Lightning.exe
Token: SeCreatePagefilePrivilege	4112	Project Lightning.exe
Token: SeDebugPrivilege	4156	tasklist.exe
Token: SeShutdownPrivilege	4112	Project Lightning.exe
Token: SeCreatePagefilePrivilege	4112	Project Lightning.exe
Token: SeShutdownPrivilege	4112	Project Lightning.exe
Token: SeCreatePagefilePrivilege	4112	Project Lightning.exe
Token: SeShutdownPrivilege	4112	Project Lightning.exe
Token: SeCreatePagefilePrivilege	4112	Project Lightning.exe
Token: SeShutdownPrivilege	4112	Project Lightning.exe
Token: SeCreatePagefilePrivilege	4112	Project Lightning.exe
Token: SeShutdownPrivilege	4112	Project Lightning.exe
Token: SeCreatePagefilePrivilege	4112	Project Lightning.exe
Token: SeShutdownPrivilege	4112	Project Lightning.exe
Token: SeCreatePagefilePrivilege	4112	Project Lightning.exe
Token: SeShutdownPrivilege	4112	Project Lightning.exe
Token: SeCreatePagefilePrivilege	4112	Project Lightning.exe
Token: SeDebugPrivilege	5568	tasklist.exe
Token: SeShutdownPrivilege	4112	Project Lightning.exe
Token: SeCreatePagefilePrivilege	4112	Project Lightning.exe
Token: SeShutdownPrivilege	4112	Project Lightning.exe
Token: SeCreatePagefilePrivilege	4112	Project Lightning.exe
Token: SeShutdownPrivilege	4112	Project Lightning.exe
Token: SeCreatePagefilePrivilege	4112	Project Lightning.exe

Suspicious use of FindShellTrayWindow 61 IoCs

pid	Process
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
5108	ProjectLightningInstaller-v5.tmp
4112	Project Lightning.exe
4112	Project Lightning.exe
4112	Project Lightning.exe
4112	Project Lightning.exe
4112	Project Lightning.exe

Suspicious use of SendNotifyMessage 37 IoCs

pid	Process
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
4112	Project Lightning.exe
4112	Project Lightning.exe
4112	Project Lightning.exe
4112	Project Lightning.exe
4112	Project Lightning.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5108	ProjectLightningInstaller-v5.tmp

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 1388 wrote to memory of 4724	1388	msedge.exe	88
PID 1388 wrote to memory of 628	1388	msedge.exe	89
PID 1388 wrote to memory of 892	1388	msedge.exe	90
PID 1388 wrote to memory of 892	1388	msedge.exe	90
PID 1388 wrote to memory of 892	1388	msedge.exe	90
PID 1388 wrote to memory of 2088	1388	msedge.exe	91
PID 1388 wrote to memory of 2088	1388	msedge.exe	91
PID 1388 wrote to memory of 1068	1388	msedge.exe	92
PID 1388 wrote to memory of 1068	1388	msedge.exe	92
PID 1388 wrote to memory of 4596	1388	msedge.exe	93
PID 1388 wrote to memory of 1068	1388	msedge.exe	92
PID 1388 wrote to memory of 4596	1388	msedge.exe	93
PID 1388 wrote to memory of 4596	1388	msedge.exe	93
PID 1388 wrote to memory of 3280	1388	msedge.exe	95
PID 1388 wrote to memory of 1800	1388	msedge.exe	96
PID 1388 wrote to memory of 3280	1388	msedge.exe	95
PID 1388 wrote to memory of 3280	1388	msedge.exe	95
PID 1388 wrote to memory of 1800	1388	msedge.exe	96
PID 1388 wrote to memory of 1800	1388	msedge.exe	96
PID 1388 wrote to memory of 4628	1388	msedge.exe	100
PID 1388 wrote to memory of 1244	1388	msedge.exe	101
PID 1388 wrote to memory of 4628	1388	msedge.exe	100
PID 1388 wrote to memory of 1244	1388	msedge.exe	101
PID 1388 wrote to memory of 3776	1388	msedge.exe	103
PID 1388 wrote to memory of 3744	1388	msedge.exe	105
PID 1388 wrote to memory of 2112	1388	msedge.exe	106
PID 1388 wrote to memory of 3744	1388	msedge.exe	105
PID 1388 wrote to memory of 2112	1388	msedge.exe	106
PID 1388 wrote to memory of 2112	1388	msedge.exe	106
PID 1388 wrote to memory of 4484	1388	msedge.exe	108
PID 1388 wrote to memory of 4712	1388	msedge.exe	109
PID 1388 wrote to memory of 3760	1388	msedge.exe	110
PID 1388 wrote to memory of 928	1388	msedge.exe	113
PID 1388 wrote to memory of 3976	1388	msedge.exe	114
PID 3976 wrote to memory of 5108	3976	ProjectLightningInstaller-v5.exe	116
PID 1388 wrote to memory of 4208	1388	msedge.exe	117
PID 1388 wrote to memory of 4208	1388	msedge.exe	117
PID 5108 wrote to memory of 4112	5108	ProjectLightningInstaller-v5.tmp	126
PID 4112 wrote to memory of 2468	4112	Project Lightning.exe	127
PID 4112 wrote to memory of 2468	4112	Project Lightning.exe	127
PID 4112 wrote to memory of 2952	4112	Project Lightning.exe	128
PID 4112 wrote to memory of 1988	4112	Project Lightning.exe	129
PID 4112 wrote to memory of 4228	4112	Project Lightning.exe	131
PID 4112 wrote to memory of 4228	4112	Project Lightning.exe	131
PID 2952 wrote to memory of 5256	2952	cmd.exe	132
PID 4112 wrote to memory of 5416	4112	Project Lightning.exe	133
PID 5416 wrote to memory of 5720	5416	cmd.exe	135
PID 1388 wrote to memory of 6036	1388	msedge.exe	138
PID 4112 wrote to memory of 6128	4112	Project Lightning.exe	139
PID 6128 wrote to memory of 1288	6128	cmd.exe	141
PID 4112 wrote to memory of 5212	4112	Project Lightning.exe	142
PID 5212 wrote to memory of 4156	5212	cmd.exe	144
PID 4112 wrote to memory of 5520	4112	Project Lightning.exe	145
PID 5520 wrote to memory of 5568	5520	cmd.exe	147

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/LightnigFast/Project-Lightning/releases
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b8,0x7fff659cc188,0x7fff659cc194,0x7fff659cc1a0
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1776,i,6865755623631921488,2897143657133031835,524288 --field-trial-handle=2304,i,17218929720877444567,8424952558452284567,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,10913085045080766435,17182867575785828134,262144 --field-trial-handle=2304,i,17218929720877444567,8424952558452284567,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
  2⤵
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2360,i,4834162382180854812,1877377851183410525,524288 --field-trial-handle=2304,i,17218929720877444567,8424952558452284567,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:8
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,1232430564866688142,16547021000360902371,2097152 --field-trial-handle=2304,i,17218929720877444567,8424952558452284567,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,13973741053947088233,2344631209516892466,2097152 --field-trial-handle=2304,i,17218929720877444567,8424952558452284567,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,8358220895603652661,16237125758062704580,2097152 --field-trial-handle=2304,i,17218929720877444567,8424952558452284567,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:1
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,1234900884623916358,6980228503229979079,2097152 --field-trial-handle=2304,i,17218929720877444567,8424952558452284567,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:2
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3624,i,8909120376589426722,5119638788041623435,524288 --field-trial-handle=2304,i,17218929720877444567,8424952558452284567,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3664,i,17991600143797829923,11110261642713600955,524288 --field-trial-handle=2304,i,17218929720877444567,8424952558452284567,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,6853370674940737354,2870545147350249878,524288 --field-trial-handle=2304,i,17218929720877444567,8424952558452284567,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,6853370674940737354,2870545147350249878,524288 --field-trial-handle=2304,i,17218929720877444567,8424952558452284567,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,4982283439825965026,3909528856538394573,524288 --field-trial-handle=2304,i,17218929720877444567,8424952558452284567,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:8
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6232,i,15368538613909154769,9214672870661517058,2097152 --field-trial-handle=2304,i,17218929720877444567,8424952558452284567,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:1
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,11504799365354447014,8712512144319245026,524288 --field-trial-handle=2304,i,17218929720877444567,8424952558452284567,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,16264911907026321546,17936629059487384480,524288 --field-trial-handle=2304,i,17218929720877444567,8424952558452284567,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5688,i,9241507656420109137,12716735346987568793,524288 --field-trial-handle=2304,i,17218929720877444567,8424952558452284567,262144 --variations-seed-version --mojo-platform-channel-handle=6888 /prefetch:8
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,3987719942521018763,6093759872820146260,524288 --field-trial-handle=2304,i,17218929720877444567,8424952558452284567,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:928
- C:\Users\Admin\Downloads\ProjectLightningInstaller-v5.exe
  "C:\Users\Admin\Downloads\ProjectLightningInstaller-v5.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3976
- - C:\Users\Admin\AppData\Local\Temp\is-PIAE8JEDGM.tmp\ProjectLightningInstaller-v5.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-PIAE8JEDGM.tmp\ProjectLightningInstaller-v5.tmp" /SL5="$B02DE,389142176,842240,C:\Users\Admin\Downloads\ProjectLightningInstaller-v5.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5108
  - - C:\Users\Admin\AppData\Roaming\ProjectLightningV5\Project Lightning.exe
      "C:\Users\Admin\AppData\Roaming\ProjectLightningV5\Project Lightning.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Checks SCSI registry key(s)
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:4112
    - - C:\Users\Admin\AppData\Roaming\ProjectLightningV5\Project Lightning.exe
        
        "C:\Users\Admin\AppData\Roaming\ProjectLightningV5\Project Lightning.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\project-lightning-data" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1752,i,8587298823298102906,16082105797948031519,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1748 /prefetch:2
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2468
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2952
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FO CSV /NH
        6⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:5256
    - - C:\Users\Admin\AppData\Roaming\ProjectLightningV5\Project Lightning.exe
        
        "C:\Users\Admin\AppData\Roaming\ProjectLightningV5\Project Lightning.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\project-lightning-data" --field-trial-handle=1752,i,8587298823298102906,16082105797948031519,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2316 /prefetch:3
        5⤵
        Executes dropped EXE
        
        PID:1988
    - - C:\Users\Admin\AppData\Roaming\ProjectLightningV5\Project Lightning.exe
        
        "C:\Users\Admin\AppData\Roaming\ProjectLightningV5\Project Lightning.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\project-lightning-data" --app-user-model-id="Project Lightning" --app-path="C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1786303672273281 --launch-time-ticks=626410876 --field-trial-handle=1752,i,8587298823298102906,16082105797948031519,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2660 --from-game-shortcut=false /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4228
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5416
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FO CSV /NH
        6⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:5720
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:6128
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FO CSV /NH
        6⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:1288
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5212
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FO CSV /NH
        6⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:4156
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5520
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FO CSV /NH
        6⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:5568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,4725587772121597436,2457582239464891107,524288 --field-trial-handle=2304,i,17218929720877444567,8424952558452284567,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:8
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6496,i,5642895984182938786,1873436042195621790,262144 --field-trial-handle=2304,i,17218929720877444567,8424952558452284567,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6036

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 ddacfa56eff2ce24339422c2bc6f1478cbf46205cdcc4afbc51ed52c47b35e4e
MD5 f0f24678897a02b007fa963c88097e33
SHA1 60bd864fc31b8591cf3c957a6964a7232d7f8665
SHA512 0c56667b926e91e9afc2ef289d474fe31cdc44d10dc7819c8fa59cc47df885cd7c7e9ab888e4967409db3404660f47f13f71a19f07e4d96d879829b62660cda2
SSDEEP 96:clsnH9sWUsp2mFwKON7LPQXto7l43aVotK7ex7:clsndasrwKONHPQdJvg7w7
TLSH
T1BBA14DB8484144E1FF5D0032EBE1691A7BBB8BD4FD1B6EA193901E7C37A5393C055B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 0ea31b8a3b2fa24f645b9383d662a4909df9bdc4a33dba04af00d8b43d4f397a
MD5 519a2b4530f8f8243db54487a3f12c02
SHA1 961ab10e9811d5afe39c0568fc4f01dc7e7a5629
SHA512 597e70eeb69fe3228314a00f66145310013716d3d58609a618878dc36ba9c72c0158862013c722d279c3d9cef5dfdd68e2063eb9f12fb010ca029b8cfe209800
TLSH
T10A419AF787F1956DDA025AF0AA18EE1BCE2C0515831C786989E0BE17D3E3871E00275F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 e7627c759550fc3eb19a0e3af58fe6e9d1eb78c44268b36b4a2644fdfa765579
MD5 667c1a39c4d2083a7bf1741f77ee7c83
SHA1 2187a95c04c2611d227f26e601a1df4148960322
SHA512 a29693e4dd7163802262f58cd4dd84feaced172419043e88140c431173e54066cd8e3b7c4dab6e91c361cb95de36cad7d492a420f964ce741c89b583cd8b4fc9
SSDEEP 192:sxZ0RV9a/fqXsVIhp3Idp9BBHW6+WNY20/YzG8FJIgrJ:sxZ0Fa/fss2hShHb6/y9
TLSH
T1FF32C8526E38A97B8CCBD219BA15BF53E2F90032D5811E58E6FC961C04E76DD120B80B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 81e0f42b66904f946605d948f8e30345bf832a9a7d837b90d5984032ff4aa382
MD5 93e397a4572159ae18333911753aa107
SHA1 c21c66b5d8289219e3764635286101722f865098
SHA512 307271a0c65dd39cc862c1c6f8021317776e6e62e89ae074e9d398d691d44c9f95a128dd00dec4bf0951f0ccdd24eae2b9c90a8beec8d2ab405a2003404dc8d1
SSDEEP 192:sxZ0RV9a/fqXsHIhp3Idp9BBHW6+WNY20/YzG8FJIg5PJ:sxZ0Fa/fssohShHb6/yr
TLSH
T19632C9526E38697B8CCBD219BA15BF53E6F90032D5911E58E6FC961C04E77DD120B80B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 972f5e96974fe3537bb20324fe7b9a35af2d4debe310c7f047ca580ee7bcfe18
MD5 72035cf63d8a4c2a33247d1f871106c4
SHA1 8b864912103bfb255ff877781a1234f8dc29ebb0
SHA512 cc666396eb61f6fd921f742ef78d8761f96579ab72d96eed776813101735d8f097477d1d6c555c25158fc48e508d1732cb82c52792245f214ce30ce92916bd50
SSDEEP 192:sxZ0RV9a/fqXsHIWp3Idp9BBHW6+WNY20/YzmsFJIg5tJ:sxZ0Fa/fssoWShHb6/Ot
TLSH
T1D132C7526E38697B8CCBD219BA15BF63E6F94032D5811E58E6FC961C05E77CD220B80B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 0d7299ba896501ad98ada271fa1476bd4bcf8f23df862a6ef9e3b37067daf702
MD5 19b5078281e9f7d119a8f681b508148f
SHA1 d7e171b7c9496fdeabae465d96a3b93e664cd301
SHA512 c51b65125bbb92de6d571fe5328f5a6914bad384c7b5f982ea2eb0034e121d64e0484d1d3c0c303ec4a54ace859e18dd1d0e0da1fe99c618cb74400c8f4b6937
SSDEEP 768:tNk7u70WvqiEa8F1+UoAYDCx9Tuqh0VfUC9xbog/OV35LlWYSBuroycYp:tNk7u70WvqiEau1jai5LA3Bl+p
TLSH
T19AC2E93B740CCB7E4F801E9DAC5A6F977E9802C7A6948D4087FA994C02C77EA51264DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 acb6bcc21716296795700868eaf3304cf64ade96ef24199ecc67202a9cf2c348
MD5 b86abbb530a5211fc51998f3f4d7888d
SHA1 f09a4790b1d55e9697236d2ad3ec18d0c8a04971
SHA512 7723494be6290cf78201731ec6251c8217aaaeff739c64d1c88e3c785e179799460c7bfe22ce1b3ae69ae947034a13ae462f91504cf1d956db8e1fbbd16b62f0
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYT3MIXKZqYHyNlIJKek8YTKfj5dhMpt4XIg7MKvZnr:KIbCKc3MIKZqS2lCKekdMoKBr
TLSH
T10191141A313B06113C7E6D49A2AA85369F8231933458A8AF7FB800715E67F125FFC9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ed61dad4-1183-4521-8698-b147c6b5bcdc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\ed61dad4-1183-4521-8698-b147c6b5bcdc.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 4dde9ee10903c8efa1b2852fd18238b398de41bc6cebb3b02279e7ac3da15f0b
MD5 f2cb73dec47766d3976a25c70082d91d
SHA1 988e3592e1d4d947441be55bd98caacb7af0555b
SHA512 821d9181cf03530243eac378433f0a7888cb4e936295485b230995e5264a8e0d9a5db08adf1e348b603ce64cf6477039618dd93f00a2924fd3aacf753f52e243
SSDEEP 192:uO2LsNI0QfyhzBb2PkQmiU1ar2D4aGBPKScC256bePNYdNfqZPU8:ssNI0cyhtbz2Xn2VSMPU8
TLSH
T14A322B35BC786D7A5EA2B150F18637139FA4417BDA847F40EAEC6B1C01DB29C631B907
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 080fc4a2c5b6f2bb535584579e0480737cfcafb05e7b4a33693364abc1a42a47
MD5 7367637e8482b51e2e9a86481ed0eae5
SHA1 4c43d4001ca81aa5eae4d2c32c4af3b708ebdc92
SHA512 ae5cf7149c922eadcd4827720284827727b602a399b7ee3e59d61a4f9a7fb8dd9489d21dae0eec1324912e26f47de9b39ebb62663be6553081df2e62963ccaf7
SSDEEP 192:MONa64BAQmiUyB1YW5GBPKScC2567aDWphU6:MONa6eA6+WE2B0U6
TLSH
T1DE021A39AC796C7B9EB2AD05F48737175FA4117FE6916B40EAE82B1C00D724C230792B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 7b964516d23eec9c01afaad70f746306a7632e9db7a0d058e535ac3c19d124c0
MD5 8339ecf9962ce010a4797c174dfc514e
SHA1 ad4b4a01279923f3d4f714c52d174fb21da88e5e
SHA512 e7b78c59c5d12c0c7f2ce593b2a6b32ce620b43f79e9b446b705f37b7ecf8abb97e18d02b7dae13d18723750f7097ecf2a9c93e3d45b47014f3a86845c145940
SSDEEP 384:SsNIOcyhtb12Xn2VSMPnTKwBODNZOCHWL:STyTY37MPnewBKZOyWL
TLSH
T18D726D397C796D7A4EE2B140F54A33079EB881A7E6842F50A6EDBB1C01DB24C630BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 2b904a31c28f34e896c41e0961ef8900b81cd9341dfdfa0ac6e519e496cb8236
MD5 8ee8d6c23709610629899b4d07779753
SHA1 6427ad3170aae8f412f77c086eb08e561ea448e4
SHA512 7b4da88372d7181da965c4c872838d68b2ef16661ecd44b14b2364952278aa0eb9586ea36acdfc73ea2f6870656001db3b966fbdb22d189b27b8d8c98812e191
SSDEEP 384:eiF5ZcIfzsN48TUNTUlIlncyhtb13Xn2VDMPnTKwBODNZOCHWi:1FRb5wgWyTZ38MPnewBKZOyWi
TLSH
T16FD218F258E7593AD9AE6703A77D2E074EBCC067F5846A50B3D8A60CCC9617FD306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 6ddc0beaae60a20ce9987fdce34246b4e9288ff572402781e61e0827ce9ca5d5
MD5 5c25b7fb04f73f989a0f6786fea07266
SHA1 892b9dcd5e055db7860080be80c33e4b71e8aaf0
SHA512 277a7ca1befebb20c21c66401d7c6b8858a81d50081b01be80bbba0f015c468f3361d6cb88b823a46e4b9432d9a8d4182e4f859d037323c091e11e50c6867190
SSDEEP 384:eiFYZcIfrsN78TUNTUlIlncyhtbO3Xn2VhMPnTKwBODNZOCHWi:1FmzAwgWyTo3oMPnewBKZOyWi
TLSH
T1CFD218F258E7593AD9AE6703A77D2E074EBCC067F5846A50B3D8A60CCC9617FC30A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5b4ac43a9340dcb42b8fdd92addb23ae7a927d73c5d428e2874eb9b84ef7ecfd
MD5 e68f82e3527c725d2bc6ae97eaac8d68
SHA1 703f618a82895514a8ffc7567bf1d355d5662113
SHA512 5781c2ea76039005fe660c3d4df26c58f2924331e9132e7ef69f6439f59f8da1b4b5264e138132892e97f70178e410331227d0682091a1b7f83bd17da23e846c
SSDEEP 192:2EONh64BJ4QmiUy3Y285GBPKScC256bePN4WwfqZPU6:pONh6eOFlE2VeMPU6
TLSH
T1F7121B35BC796D2B5EA2B451F08637175EA4427BEA84AF40E6EC3B1C01EF25C630B917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 66b55d2e60b60dcba34a29bf4c237db085091038768fd7903f7f9daf1c2847bd
MD5 fde13f572fc958f95adaddcbe5f1bf67
SHA1 012231e4fd9cc70026f429e0d31d153674071c75
SHA512 0c74dd6c06169842ebf458c4f424c92e6f32ef6301dec5c9bd969c942c4d38f845cf60a11fffdf9333441ecb4d50845368c2c35f0793c5efc7d305ff507f94c7
SSDEEP 384:/sNIqcyhtbz2Xn2VSMPnTKwBODNZOCHWL:/3yTW37MPnewBKZOyWL
TLSH
T1C0726E397C786D7A4ED27150F54A33075EB881A7E6842F50AAEDBB1C01DB25C530BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

abb6d411-34d0-41c5-880b-10538002ade2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\abb6d411-34d0-41c5-880b-10538002ade2.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b1dd8dc72577ffa64961e02d80145bfb2961446c4811e5c1df2ac26a5c4afc61
MD5 4712c1995f45beaaee58022e06aa8dc3
SHA1 3a6b7e96d4d2243ff77e8db6f4ae3acf9777fa44
SHA512 b520c5e9f84c5e067f77a26c654f97d4f605703f20b97c41303c30463be98ea4e43e61179a25f50b42173279dde3f34d379ea0a959097f3769183abc65c9c882
TLSH
T11F411849A6E91108B3B76F57ABF7646E887FBD372F57D45E10010E8F0A22A00C862737
MD5 SHA1 SHA512 TLSH

Submit Download

694b4a08-1ade-4916-aaad-d829bf206c74.tmp.ico

Path C:\Users\Admin\AppData\Local\Temp\694b4a08-1ade-4916-aaad-d829bf206c74.tmp.ico
Size 361KB
SHA256 d8e29cb60fb03bfa6f1d7dc51ab22e8f840feba979d20577d9f2111691165aa5
MD5 6b0834bfb77f6985e1c1dce6b6a43beb
SHA1 c18e011bbdd22814aed4b6805f0478185e3d6cd4
SHA512 c3a779dd8f45359e30bb483766ef0271cf9a52fc3c8502eaea0821e71fd28a8194d5837bb78f627d6066512d8431be24816cc63ea1f72a4ebb1f3f9d618a000b
SSDEEP 1536:SDraUMInt/nWE5icLDMyAsdK0OYho7HmTsWQJQQ92CyGUnfcTr0BrmevXWDbj7il:67qrD8NdA9651suDX
TLSH
T10A7454F7C5C50865C4B72EF7491989E8488ACF5308271FAB2CB575CF847F4F8228AA56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ProjectLightningInstaller-v5.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-PIAE8JEDGM.tmp\ProjectLightningInstaller-v5.tmp
Size 4.2MB
SHA256 fb6b4eba91ce05cf71dc1cc7428d9e083646392eb289fb9983b50ebed0a7da80
MD5 95aa1e58a88387a941c4a85d98363467
SHA1 af1c5733b4bdbe82b4cc3f3229878d9d693979d2
SHA512 28a371a0c2d728f052e201c13d83cdd03c1a03775c67d12c4ccdfe30ad86756b90ff2060fcc66e1bc7966b0e069d666d013fc2134794aaf9fca7f6e8e7c2741b
SSDEEP 49152:d3yGw7V2h9z2lqSvM0/WtmueejA0JuDeT4q3ZCNW7Iu9ReR9nc4NDR5mo4333lwZ:ds7Y8/7ueejA0JuDeT4eZyuaNHm1333G
TLSH
T1D2267C13B389613FD06A2B3A7837A254993F76703916CDDB6BF41A4C8E351807D2AB47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\chrome_100_percent.pak
Size 112KB
SHA256 cbe052e9bd36032cde9d0ad7496d611c6a3c98a130b960e1298d490254be1159
MD5 129f8cee761c5bb414b2270356177f6c
SHA1 0a10b55daf24c7f9fff1b22f853dd87a98433b7d
SHA512 33f4ceb0ed18b2172e2f6d203ccab2954dd900592b2e62ce4a1019ab9404889ebdcf462a2479f1847c01b2835473e83859c77816e83ef76ee133990be3d55eb4
SSDEEP 3072:DS4PisCv+/P9NebGz8LI1TwuLjQBHe7YAP18RVC2I:LYWFUbGz8LI1TnjQBQCrC
TLSH
T136B3D0D7B3B09D7DDA460BB783560170FCB31B2D06C2120A5A9AE479652BF88C8D93D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\chrome_200_percent.pak
Size 182KB
SHA256 6593ba8ece63001a3fb77bd1d872566edeb26213a1be8e852dd956f6d0e2c93e
MD5 ed7b4e5eb15a086ce7e117a3228e3f15
SHA1 bb6debc27ed4e2f20149a17e36a24ef4482a96a7
SHA512 7278e0acdd8a1806bbdfd147d5439f7f849fbf95f1be1ffb741ea84cecad2557469e99f91cca66ce36349a9aa55d0107e34b9499b8fcb3e7fb3a8bbf84c1e911
SSDEEP 3072:CJ8LahaY7d6iN6uSwxohPQDQYaEjrvy/IwXJPoLjQBHe7YAP10uxR/TbIM0:7GQ+N6uSZQDQYakvyAkcjQBQNd4
TLSH
T1EB04F1D723B8AD3DD9570B73926610E0FE7A20291EB3110A5A9FD8397925E8CD9CD343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\d3dcompiler_47.dll
Size 4.5MB
SHA256 c8e25abd3d45dfb55966a74613258c39b4a83ea2ac77f2f80903499f4d5c03f0
MD5 6ac6cc720fb6bbe5c0ed4e84ad2b3337
SHA1 8556531bd06691ce0f8b7d83814c867a420526a4
SHA512 216084dc2a84ca818d68d603968acc978c0b60bdbe0a3152cbfc400ec11a2b96e81d1698a15dbb7738974f4365a8feb109f2bca5b641b42acedeaeff1e2a342c
SSDEEP 49152:JSHvWaWTktEzfRriMsCL98dhdVhpHGC6GNCxJYrv9y5Eze+V7ZpdKMZzaWoUyxqJ:suktcrfNlTyj5byqSC
TLSH
T1FE268D5767E840E9C5BBD138D687831BEBB1B80413345BDF01508669AF73BE26A3E724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxcompiler.dll

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\dxcompiler.dll
Size 24.4MB
SHA256 1565adbd62a0e8ba2a8b25b3da5d2e2a45032c13aeffdd061228abc3ee5c1585
MD5 a41223961c47f5e60f2a83597ccc125e
SHA1 d3050c6e99fa83919ab02e3c7b5d8c40eb566200
SHA512 7a25b88a9d044cfd471a6c131d85a82ab395168e069204117fb0176e3b393c549b0be23794e48b3ea09f6cdbda83bc20c90795e750e579c9989bde6a19dcefef
SSDEEP 196608:ysq7jjh1u1/1i9iJj24AD14c9TR8Z6GmfozCEJdXqaq:ysq7jjh1u1/Dxc14e8Z6GmfyFqa
TLSH
T1D04729122646D49DC059C879C7678B268A6C30E73FA7B8EBC0F451252B79EFC5B39234
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxil.dll

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\dxil.dll
Size 1.4MB
SHA256 436f128f22050ae27323da61321a469de0678def7a4e6d86f9ccad4858724f0a
MD5 f8f3501026df30556c34a9af9cb7af9c
SHA1 961d9012b6d79e2e3c28b310a80ba3ab36e2c559
SHA512 3631f8a3d48e8eea25091b93147d88f0e8a7539f2f242fe287d37f82fc4344528901e4cc48c93ebcf8691d2e11227a9b50f2b5ad45f2475c0119ad8b2d3661fd
SSDEEP 24576:zY+wATtbKYxy0y3ny6eBjNSGlVZyi27+V0IJNSD11J7R+j+v1acLUkJvS5Kao:8iTMYxy0Sy66Zh7Sh/cyvS5W
TLSH
T154657E1B229801B6D4BBD17CDA47CE0BE6B2B41503B09BCF12B406692F5BBF55A3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\ffmpeg.dll
Size 2.9MB
SHA256 26eed00c4da27de095ba76030b47bc0436ba659a7443e05f11ee162dc225e828
MD5 38c4d1074280e903212f6b4bf7e650b9
SHA1 fdece1b93bbec86f949eca244c780b6809ffb2b4
SHA512 0904363e03102b8ee72b172ab02b78456472a5c726fb1c6b990713c640f48ac16cebb2ac2374dc82a62aeab589b46b9c851493b5768ed28c1e8358d81bdd8e48
SSDEEP 49152:ncHnAGZ5/wriV8Ay6AC6L6BEH199a1LKIbQ7k6xQv8VNoJHfmX/6s6l8b+:cHnh8F6lC6i9rNoJM4g
TLSH
T11AE59D03F6D651EDD019C03497AB9313F631780A4F209AEB16905A223F67FE86D7E768
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\icudtl.dat
Size 10.3MB
SHA256 1cf67874b5a87a8363a86fb3f81e3cbbed54d389062dab8fb52308d5cf8c8612
MD5 5bfd3eefca4b5ef2d1a869396390a7de
SHA1 c58567f7fe308ccd43f406b70aa8bf6fdbea4f3a
SHA512 4489a55fa0b47c8d1e9679032e036c7998f82efb4191b98900ae40cfc30a26b65290867527161c594c42fe7999b2314f8928a5d717d65d4eeedd4fdb0ed0f427
SSDEEP 196608:A6akBhOR8LE/dUHiXUxa/iJ53IWhls2E91Z0G:AqwKLBHiXUxa/iJ53IWhls2E6G
TLSH
T118B63903A2EB4EC6F9FB5F7498F562779527BD49AE32804A51043F3B1C333908664B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-TFG01IVP37.tmp

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\is-TFG01IVP37.tmp
Size 106B
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
TLSH
T1A6B01211430088B36062AF3C41811F468765411C36020D491040540E83BBDB6A102394
MD5 SHA1 SHA512 TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\libEGL.dll
Size 503KB
SHA256 61ebcd780d17d37ec09a5eb7ff7399ad67726a5a1ff73be1c37734551c3ef1fe
MD5 e2125f8574719b50c955f8b3e9444d68
SHA1 75ef9ab467080e726eb8f1a906deefee5c1980b8
SHA512 8ca2cda69c61aa78ceb2a869cf757a68365bcf801892ad7250807ce77ba8312fc54e6347a381cb399c92337fd43aa82518973aa92345cbfae000306a117414ab
SSDEEP 6144:dQ4VIVcVQMLMVwCtKpDaLnjSFeN+a+BAiLm4LiE0z0WhcEuvBLPdvtYPqQa:dn0iCZjF+CymG0z0WhcEuvRltY
TLSH
T147B48D15F3E84BA8D07AC0348A538646EB7574960B65F9DF02E052792F3BBF45A3E324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\libGLESv2.dll
Size 7.6MB
SHA256 b35d3337ef4cad5423f4e11a06e280763deae634f7e39c7844e4f0fcb455b3e9
MD5 c9b6de9b18d0f5dda94589cf038e1bfc
SHA1 6fbb1ec482e6c0988a5b5fe84b4ca9695d960039
SHA512 4a59fa62445ace0b27d51ca246b02d5e9ceaf6a4edee2d02051aad52de63b70376406347fb2ab97e42a9d70f3844dfcb0c2eba301bc54a3902b8c11a316f7957
SSDEEP 49152:4upJ61ZvUdnnnzCwAOqBmONJAbLfkcO0VsWkgp9rnnG45/ifbKnNdCusheIYklbo:LeCXaoJl9aWNd5JIBhhpJK1Ixe2l4
TLSH
T1A3867B03F69681D9C05DE278875BA623FA34B8450724B7CF2A9453162F66FE0EB3E714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\locales\en-US.pak
Size 537KB
SHA256 ef30389492cc2d31bc5c162056fe68c27a5d57b0a69f5f878562325f795c5185
MD5 0604e26677ebd9417c7de4c421f6254e
SHA1 ed023212b6951afcd80ece283d6ddc68b663e079
SHA512 8af64b75a40a6dca6ac5feef06ab5e8c898bf30b50be73e480df923461d42e2cc417bad5151eb957c9606540321e0dea48820b2c5009408e0420e1ebe1b01a29
SSDEEP 6144:K7dq1yx5HfUOQkbaqMP9qQ0BFfaYQDp9I3AjkgngP8/I2wf:K74k5HfCqM8Q0BkTjzwf
TLSH
T1BAC45C1FF744122A059352A2BF099562FF32D06CA35112663CBD812C3376B6AD3B76F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources.pak
Size 6.1MB
SHA256 ce5c35017fd7aa648fe44381711cbf42eff5f6923b11241a4789058dbc5b27aa
MD5 79762f4295600653dca20bbaffeed153
SHA1 85b8ab7d9e7fa663dca0babd1f72c79a1f39d99f
SHA512 13784fda38785e3dc23b118969478c61040e81e1271f6ca7d7536ae60872b1adc9f2a99e15fc17e5c4903046eee8508b686fa18092cfdbd1c0a29b79fbf18484
SSDEEP 98304:5vjQ8HDIPJ132R3lW4uKXegybAHltND8rwri0J/xUaAUXLPC1GP4kFbG:JB0BRulFzPtND8kri0JlAYz4kFi
TLSH
T1985633E1B7A06CAFC5484379D19542343A3ED95F2581739A188CB33CED6D91EEA4823F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.asar

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\app.asar
Size 38.1MB
SHA256 8d3e572ff8aaa75a8d5ffd9b01460abf5a6509f021d47c44f4bb9e699dcba0ad
MD5 1c60fafe3d89babe88efe5c578e912ff
SHA1 5e659b80c22b6718e2b6dc7ebf3dc8174418ff25
SHA512 e17be313b72752cd2b764a6007ef0ab07459b411b4e3f19c43182dc05ccd53d5be724e21ccc0106a8089e19053a870d5d6b2abfadafdada3606075d9b09b040e
SSDEEP 196608:fHiZZWP8z5ypUE4GnMkqCMnjJnxvepvwJko3Ukbj:uWPA5SUEVnM33n5Swl
TLSH
T172977C0269B7A433D31362B75ACF8146BB20A50B29149520784CD794BF92F3CE6F6F79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

better_sqlite3.node

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\app.asar.unpacked\node_modules\better-sqlite3\build\Release\better_sqlite3.node
Size 1.8MB
SHA256 715dc7eadd3fa56a68716eba485e45ffc687a16a3affb7c592fa1c246cedadd5
MD5 105909e67cf828fce962e20acfa06c05
SHA1 ddae166497339577d5e9d8084b3bc8fe72e54e87
SHA512 42e6da355710ca28eacfbd456f75a83a7bc6a2d9dc37a274fb56f2d8196a3dc6e1e33121b5e5fd79e0308fc852580bbd8dc4bada14ca77e2db303e880903172a
SSDEEP 49152:+iUd54kxDpwLra1BlDANOup1ha9yZjcmIDr/x0ipjssmW7D:+V4kxDpwi1BlDANZ181j
TLSH
T17A958C4BF2B400FDC1A7C0B9851B160BEBB6B40517749BDB1590CA696F63FE217BA324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

database.js

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\database.js
Size 4KB
SHA256 02ea23bdd23d7ac5de0675a2f32fc686e76d5c6a32bd3e3891f360e72e07f61f
MD5 952ebcfa3d8727e8b1d7b681c9f5bf32
SHA1 6168b5f5ed77669b3c6c1f1d526f0eb116bd3a43
SHA512 d2dc310d2e4a491903988ed88228d35e9688e48c9b6180c797fb58f84d1105724ab3933ade92be0e73c8a27fb6f3064449bfe00cfa1dc92919ad53a81af2680e
SSDEEP 48:+FzYIUZFeVxWy3h9zxIEXMOK0ZHQZ27euTqQaqE8E+LC7yIGrtRxtjFvcLd3s03M:ac1ZFjQBG1oQZi9qSvNRBkLveomRz
TLSH
T1EA818388DBF5611247EB30D4A674A48D6234D27971AD08E0D8CBC3F531E60C9BBE3B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\index.js
Size 110B
SHA256 82db11c4ee43a41d859988c5db42c3771dff565371f94bacbd1e4d8d6ceb47cd
MD5 26660b3078523a953ee252b4e86e1c8b
SHA1 f7c22bdc8183f6a9cb73a9b4a735a5bab7ca01b4
SHA512 d4f32ba712ff15e8b6a1634eee089057a4716318b90e932b95a1c1cd30945ba708e7e725316fc824107637d2e97a2a64193ae81c0a3d2484651f52122bace99f
TLSH
T16EB012CF1BF0B18F26A44184E9618493D8C2E466841A40208F05CFFFA484CC42FE2DE1
MD5 SHA1 SHA512 TLSH

Submit Download

aggregate.js

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\aggregate.js
Size 1KB
SHA256 e9f74eb919ec93fe089c95ddf25a98f1f631c80418fa34fb2346ca1bc29f1b82
MD5 25fdd950809b2b22d0ba6917fe014c35
SHA1 5555b3223918668b5bf244e892b1d6a258f0099a
SHA512 50516a2d2265513dd7ee727cf9cf21d118601a0ee2b9de61111c6f5fd8933915f3029ef6f764f7803cf5438725c6017002d7f58cc36988d97cc1bdb805dd42c1
TLSH
T142412121E2D2221605DB24E07097F909EA7ED720B54DB4F0C92EA7E910D1DCDE9E7A80
MD5 SHA1 SHA512 TLSH

Submit Download

backup.js

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\backup.js
Size 2KB
SHA256 ea29d34992bb02e006d0fdeda9675ac5d2bb227aaf57468decd997e9fc9c7dbf
MD5 69638dc10c19961a0c05350ae333d6a4
SHA1 5941988b67c6fa083358002ba36538f1e39ad03b
SHA512 495ecffdadbc8c9bb2e886f9f7a93668fa5b2192a0ba79a7e1a9d3c2640e0520e39f2d2c6f3a26b55c72ff882bff43ed6439c0ad7c7622461e6ccaf1ee8f119a
TLSH
T171413158F39E5169436734C04490E00EE93DD6B6313E09F1AC8953F022C66CDE9DBBC5
MD5 SHA1 SHA512 TLSH

Submit Download

function.js

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\function.js
Size 1KB
SHA256 f431d49303b8bbdc044b1f1b455bdad21fc9b74b007de0acb22f08f25b4febd3
MD5 1036ce624efbb9fbbb387fec25fd1bcb
SHA1 35395f7ef4c18b845582b9289bc802d87c9e3c11
SHA512 7d65a4bc5bf5c9b97dce021cdb8c888cf975ad24613b12b239db1e03a98dda89faf7b1b204c906f6dde5439d22414d9b4410554d01eea8fc121287ed8821f9a0
TLSH
T1E021C911F2A6214246DB24E0B0ABF909E97AD765B44C74F0C58B97FC40A1DCED8E3A81
MD5 SHA1 SHA512 TLSH

Submit Download

inspect.js

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\inspect.js
Size 174B
SHA256 4975a78daee850adee62ba98719d0f223819a0ec135a07c0e302994bd8dbff61
MD5 21784edff107eaec0e9ef7e66e83552b
SHA1 6b59caa4cc8a568a8ed3f184a075d66c68f17d08
SHA512 9bf6d36dbc01dbad11d5d01c0b662620bf6c0cebd85c0065882e8ec57e3304bc4d301add25bf57ea425a270f3ace6a44fcb958dcc8bf993f411eb81a5369adfa
TLSH
T125C0800973F1B465554F30D5955FD00451E5F0242CC450420D1DC684CD708697F3790F
MD5 SHA1 SHA512 TLSH

Submit Download

pragma.js

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\pragma.js
Size 536B
SHA256 8b1c54475bd4340b15e25c50d53d06308be65f8f919ecbe4aa9d285ca859ad5a
MD5 9354074a096ee1cf58905ca8dabfd60c
SHA1 63e6c02339c45c252ae3bb24267610a636117eb6
SHA512 32bdf8866d1c4e3db8a2ca65df2c1bd0d33c064d4cc526e264587cbf9c09ba7b97c8adc430a9dc019d9863e0e90b4318442ffb5cd08e0de52cdd4f081b5150b5
TLSH
T155F0C91602F245530BFF14C094E5F534F4B7C668B50E94F0D99E83FE41808DAEA83E95
MD5 SHA1 SHA512 TLSH

Submit Download

serialize.js

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\serialize.js
Size 625B
SHA256 7a10ee5c2735384b7f0c361811bc6d017db29f62b203fd3c68a35f667e2c2605
MD5 41cfeffe67a2975f68aeeaaed0bf384c
SHA1 321f3f817bc095c34b76d060d706ed2cc48f204d
SHA512 8a0ad9732b5a07866eee742b2e884e521111f213af9ae39ebd92fa029d88f087c43f8826672d1fac5c571d14b284f20ae25e12aa4058a7881d6fd5e93c0b0a0c
TLSH
T1F5F0783A3365564B0997A0C050E1B429E9B5D324312D68A0E989C3F511D48CEEAF7B9F
MD5 SHA1 SHA512 TLSH

Submit Download

table.js

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\table.js
Size 6KB
SHA256 97c42d9ded1aa96c7d916b5b92f96b4e59581d50eaf629cd2c7afb78ff26a9ea
MD5 43137a36158617045d106a2ff534edaa
SHA1 f365ee98f7e36d1bab09e58187d467dd5f73b6f3
SHA512 f4330d881ae76d41083d3ba9d0056697abd634638a9951a4ebe4044fb79eceff4da034d22d9ba2ad4cd1a208fb0ec1c47855da781d9c9dabc34979f6f7f9eff3
SSDEEP 96:bJx7JBAUU6VtWpzwukGy2K3rN6gYMNEXxulo+yrgrm+IttSXFJ:bJx7J25PUyKb0+UklovOQk1J
TLSH
T18BE12308A7E17A13404B7095BC58605EEDBC98B27C1C48F5B8DC45E92491CBEF9EAF26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

transaction.js

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\transaction.js
Size 2KB
SHA256 bc8624a3ef689d8f78e5669020ad121e17acbc93b1d5ee5afe26860b1084c66c
MD5 6b77badde74e5a5b854041134e62041d
SHA1 47f5883e26f1aedb2bc1557cef9dd21c26e0e0ef
SHA512 d5be3aed74a9c9a948afbf6f03c19e21ec6d5a86f5f277de85d9d7374136fab4cf68bca1a6e752e5d41ba6b48c00577ca26ebacabd5bec51491da28affb3719d
TLSH
T1EB514312F67ADE7063E23088FA0B630EF5299A49E03494B0E760EB4A3A958CD8117D53
MD5 SHA1 SHA512 TLSH

Submit Download

wrappers.js

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\wrappers.js
Size 1KB
SHA256 a150a6271d23f4e5f8953b129f370ff096c7cdc4b812afbf080a6cf4ab741bcf
MD5 9e2ba6058f66127065c27ea3e81b8e68
SHA1 92346423dab9536ca4afa50e7ef171843d5eba5d
SHA512 2b6644404fea27117b74f904bc608fa42e36e3b100f51010394ef917df7c48f40af018e5b06243d31d7ccba5ab05cb32541566e79775df482e09a107524d091d
TLSH
T187213A8A72E6F162D31530309DCFD184FCF9B861694C64BCE47497922DE007942DEDB8
MD5 SHA1 SHA512 TLSH

Submit Download

sqlite-error.js

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\sqlite-error.js
Size 717B
SHA256 2582d61c27680dead168543f392eb102be621dfbef282a4ca4c7c21aa5e7c75d
MD5 e1372372ca8f94dd66666d886a81f9b5
SHA1 437034e71dedf15013967b540db157cbe3eac3ef
SHA512 5bbfce635aa1b10b30f1703eded4256224500705e3b14c7cefcd522ad703596d15d6cfee7914dd70700827afd01a50d61bef1954d29b8788bf6347f96e9cd8d4
TLSH
T1660168C69F7099BB01E15884FC116806996C5678C021B5E4B6C8DD9F2DF0087CDA56A0
MD5 SHA1 SHA512 TLSH

Submit Download

util.js

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\util.js
Size 331B
SHA256 92b2e39e2151b43a2252e10b6d6de876ecaf0008336a4fa1dfe1317b20f1916f
MD5 a5d75fb36bedb4938a8b9dc6525fd515
SHA1 b5270aef455a7de04d31d19713ed7dfceb55fa06
SHA512 c181b25f5b991826159125a4f7af8ec0f8a7bbceba674121f144f401295670136daa64598d4e0f48cb8ea2849000ac8e7f59881220f6a30a4905ce9309db8067
TLSH
T1E6E0261BDAD2876511AB30862E8EE404DE6CD2A6746854F0682AB64970C84B4EA8B25A
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\app.asar.unpacked\node_modules\better-sqlite3\package.json
Size 936B
SHA256 67f68163a5fba6a9920b1f9151c997c7b4d03d74669035c6d3f52a3620b486d6
MD5 5e32e88e6545358c0be5ae75230b31f0
SHA1 4ad39cb96d30ac40a751110757d90c8fc5715089
SHA512 fd7f1b86c4799442cfc028296086f90e25ecffb6258c7e49d740b7082ae74787c53ed5bf107f50a18e6b5eae0b12a9e690c16733bf30f95a6001a73a8cb23b07
TLSH
T1D0113D50CE158DA329C559D5ACB91042A22048178CA4FC4C3387466D5F4E4BF21BD57E
MD5 SHA1 SHA512 TLSH

Submit Download

binding-options.js

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\app.asar.unpacked\node_modules\node-hid\binding-options.js
Size 64B
SHA256 e7c820107f3b6571ca1505a5ffbe17511088336e4c410ec718ea9ec200c6b1e6
MD5 8cb198b85d4166d350a455d5a7cbd985
SHA1 90b9715f66d95ab9e17deecea3531d1d9a4f3d0f
SHA512 185b5d8c5278d4878bd0cebb25262cdcc9838ff2bf373f7eb7c31c5c6a427bb12312e728ca6b3540004c9f49cbab0abd7b1a9fd9a90afafb755cfe3989738fc5
TLSH
T141A002434411F2D70335462491645712F6904176A4004023F5E9455C2F30C6F3010D55
MD5 SHA1 SHA512 TLSH

Submit Download

is-AUSKADA9O0.tmp

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\app.asar.unpacked\node_modules\node-hid\hidapi\windows\test\data\is-AUSKADA9O0.tmp
Size 219B
SHA256 68843541e7bf5b3ba766d3cbaf26c8f4ab7c9d090ba746feff32b9d35ce25417
MD5 2d4f76db6175ff5f7f28f0d923a66654
SHA1 123d7c009f8e0cc29ac86e971ba15b782d65a51e
SHA512 f56a47f7bc60e04136f70ae848e31421b839453fdb01dfd0303a06256ebfb0955a16720cf84a3d35ab0e3fdc90323e97282daa36430e568e283b10990f76766a
TLSH
T1D1D002C7B70D65D43D57743CC7C604D1958DA03501F0905AB7EE862DF4C640888B132D
MD5 SHA1 SHA512 TLSH

Submit Download

is-Y4101PJVR0.tmp

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\app.asar.unpacked\node_modules\node-hid\hidapi\windows\test\data\is-Y4101PJVR0.tmp
Size 219B
SHA256 a18fcc24552c8abcee4cc9e324056971dc92e06208d33ca5e2f01495a910d6a5
MD5 03cacdf6a68cebc65d28bd6bbb462b34
SHA1 94a75b98100a70f06a562598800bc2d88a1cbfdf
SHA512 1c932a5155f25051fc0ac473a197bb89c988907f2012f8c6782e798dce13a977eeb12f421dfbc96ef5b5e51934da07f7c0eb13d44c6e4b852cbb347b33a2dd63
TLSH
T123D002D7B70D54D43953603CC7C644D0958D913501F1909AF3EA863DF4CA41884F132D
MD5 SHA1 SHA512 TLSH

Submit Download

nodehid.js

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\app.asar.unpacked\node_modules\node-hid\nodehid.js
Size 7KB
SHA256 84053a6ea19b238e61368f5220a9a8af96b27e752569f14d63dba2127a37988b
MD5 990d51eeaabc0d11d836d3aa0a8e78f2
SHA1 9d12a1ae2e5697a8763eb53aeec10c54eafc39ad
SHA512 3a47c21c296dad6e52f1c52c8865730466879b3c8a0581cc72d89376e7e3d73c76df6c532c681dfe374257592d6f9fd5fe95c3347474233707ddda17f4f55014
SSDEEP 96:rHufZcdof9GLAMX8dNwdJKPq5ArO3zXhMwkjLuThaD5zktBdK/e34x+E+C/iTIkd:rOhf9XQMwd0qcozpVTMgtB8k4x5lm
TLSH
T151F13359ABAF1361C2F370A90F5E60422326817B220FCA583D2DD3D81F9D57896A1FF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\app.asar.unpacked\node_modules\node-hid\package.json
Size 934B
SHA256 6fde9f9e079631f100806daeab792c456b5e90b718146effff5bb4288ba55bbf
MD5 295a4c85b34ca9e5529906a0a1e6f9b5
SHA1 944bb67d7091a84892b37fbb1669f166bacf2717
SHA512 5ddae2344dd90b78e3cf715d21fd8267acd39ff484788540c69de1107d145e4ba638be7d80899956dd00e3dfc218b0592ad7db863b506a2eabf948dfefa9b2ed
TLSH
T175118CE2D9780E532ACA6DB49C29224AE1214D4B8C1CBC54B39341AF4F1E07F20FD17C
MD5 SHA1 SHA512 TLSH

Submit Download

is-HRYA8IPA6W.tmp

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\binaries\win\python\Lib\site-packages\pip-26.2.dist-info\licenses\src\pip\_vendor\packaging\is-HRYA8IPA6W.tmp
Size 9KB
SHA256 0d542e0c8804e39aa7f37eb00da5a762149dc682d7829451287e11b938e94594
MD5 2ee41112a44fe7014dce33e26468ba93
SHA1 598f87f072f66e2269dd6919292b2934dbb20492
SHA512 27b8c0252eae50ca3ce02ab7c5670664c0c824e03eb3da1089f3f0a00d23e648a956bcb9f53645c6d79674a87c4cc86d1085dc335911be0210d691336b121857
SSDEEP 192:nU6G5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLhP:U9vlKM1zJlFvmNz5VrZ
TLSH
T18822512FBB48037B06C20162A79764CBF31E903F3B552568314CD1681F6B96593FB6AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-69VTFCDV8Z.tmp

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\binaries\win\python\Lib\site-packages\pip-26.2.dist-info\licenses\src\pip\_vendor\tomli\is-69VTFCDV8Z.tmp
Size 1KB
SHA256 b80816b0d530b8accb4c2211783790984a6e3b61922c2b5ee92f3372ab2742fe
MD5 aaaaf0879d17df0110d1aa8c8c9f46f5
SHA1 9da6ca26337a886fb3e8d30efd4aeda623dc9ade
SHA512 eecd0c29febf51adefb02f970e66efe7e24d573686dfdb3beea63cefea012a79ce3c49a899b4f26e9b67dc27176b397f6041909227281f9866beedc97389095c
TLSH
T11411755E725147B618AB13605978ACD9F23BB25F7A6F2A84246DF345233A06CC6FF840
MD5 SHA1 SHA512 TLSH

Submit Download

is-4ABQUTH6D2.tmp

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\binaries\win\python\Lib\site-packages\playwright-1.62.0.dist-info\is-4ABQUTH6D2.tmp
Size 4B
SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
MD5 365c9bfeb7d89244f2ce01c1de44cb85
SHA1 d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA512 d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1
MD5 SHA1 SHA512

Submit Download

is-LZ34IEE1VZ.tmp

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\binaries\win\python\Lib\site-packages\playwright\driver\package\lib\vite\traceViewer\is-LZ34IEE1VZ.tmp
Size 78KB
SHA256 0f1d5219934e96e83b8db162d60b4d8c09b5de1e7d38031cbafe4a3c0f2889c9
MD5 cb7f0a51c106a33fb4abab8c454373d8
SHA1 e7c7d0f0e86371aa5e93a0200f395c5d37967e2e
SHA512 377e45744f8a7dcf4f706df9f6e420c2504180107a0f31c584ee220ebfe5a33889f0d4c6d58f1ef3dac4bd391de11ab383c64d4e3a8b9f8637d9cd6cb7d3cd4d
SSDEEP 1536:vMFZ2CRbK0INA8nc3sMVUdrulGhHjOuYWibNuuwzSf0WUZ1eB:vMf2CRbXGRc8MVUZ4uobAzSf0gB
TLSH
T136739D06D389DF2BE393CA7D4C65935B42A1844977DB1F43AA3D7EA4D4A2BC90CA43C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-IHYP0YO9K1.tmp

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\binaries\win\python\Scripts\is-IHYP0YO9K1.tmp
Size 105KB
SHA256 a896f1cfa736f092873a2af32f540bccfef6ae715b41ae9eceba46a831ee4ed1
MD5 86f9c8d583f5857b2a77a1289ef705ca
SHA1 81d8a3176396bb25b36b299a1bee2785013bff22
SHA512 eb41322e4b5d4c67d221da8e535b8ae011a8d0131bfd17a89267efd1446e78fce4075ba56a4774721f5ab94e8fc63e25e10be34726870a71f884f605734306f9
SSDEEP 1536:1966Spw1RSGXwStXQR1mTqZh52bAGXHnDtCdGgYluexaNSxFfHYTo+GIC:j8wDSRUT0kbAYn2GgYlBYN2fHYTo+lC
TLSH
T18CB36A0A33D420FDD0675274CDB68A15D3B2BC2A4274934F27A47B6A1F733926D2E722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-5OPQK1GAM5.tmp

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\browsers\chromium-1234\chrome-win64\locales\is-5OPQK1GAM5.tmp
Size 18B
SHA256 ca73097bd968b363b7145e86b64f3c595e533808b0763dc8863a27fc363cfa51
MD5 65f69bd2d8b6458d3ecf77d84d70dc1c
SHA1 679bdfb03cbaa594ace5af4340a061ddc514309d
SHA512 39f2728a1898bc9406516fa737c58c349e3bd7f779276a2f6679b3e3f0db43f956e03ad25e5d9bf4b07b19909febcc6c0560f71ab4f4fa6b5dd1f021ef742c60
MD5 SHA1 SHA512

Submit Download

is-SDPGY99TT0.tmp

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\browsers\chromium_headless_shell-1234\chrome-headless-shell-win64\hyphen-data\is-SDPGY99TT0.tmp
Size 141KB
SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
MD5 677edd1a17d50f0bd11783f58725d0e7
SHA1 98fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA512 c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgk:p73HEUP8dsiinTThjy90VKk
TLSH
T1CCE319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-VKV48YJX76.tmp

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\browsers\chromium_headless_shell-1234\chrome-headless-shell-win64\hyphen-data\is-VKV48YJX76.tmp
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

is-ZCGM8WXEX4.tmp

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\browsers\chromium_headless_shell-1234\chrome-headless-shell-win64\hyphen-data\is-ZCGM8WXEX4.tmp
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

is-BGXMUI2JSG.tmp

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\resources\browsers\chromium_headless_shell-1234\chrome-headless-shell-win64\is-BGXMUI2JSG.tmp
Size 449KB
SHA256 ffe0c645274d73c10a0d60d2c53c9b928151d828d211253b10ea6807c96f9ae8
MD5 2a3178158622d30c1e84cae4e7e57cd8
SHA1 920c5df8b4bae44b41c3cecacc00324db18d37f2
SHA512 c1f053daa0fad251380c6b9536519ccd351e6bae97dc8f1c79ba26f15f5a55159a2180130693a7b39e41de2419a5120a636e759415a926907d9e2f4c07b99f03
SSDEEP 6144:Z+cJPab9TfpocD588jeei3Cap5651zs4bcFlyfJ2X+O:KicD5/eeap5651zs8cFlya+
TLSH
T197A47D05B7D548BCD077C1388A538647EBB178560B61EAEF03A0E2792F77BE41A7A311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\v8_context_snapshot.bin
Size 696KB
SHA256 1df86ae706c6fc60bb6f4e60d76c5a3f56affa54e6b1442f51127bedc589d089
MD5 ac1ecab348d666e70d3bfe6877a43f99
SHA1 7e22faa7dd16b965c4af9e6b85b12a11d2060f19
SHA512 81bc684328821627718339eca626130380dad46c9c024df775d5356ca20a5fa9cc55b48f8e9d7ea244f065c86977c952a14c7dce29963f1c5afe1285bdf76d08
SSDEEP 6144:9af8tLrT5X3ukt+H92AqD9clxP2NyhaigNw69I3ndbkboE/UZ703yCTzrWD:9af8tL35X3usCN2NyI4NbkboE1rTzm
TLSH
T197E49761F71ACF26C6493A7D8DD657463930B2CE8E46E24B3406B33E78B96704D3662C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Roaming\ProjectLightningV5\vk_swiftshader.dll
Size 5.4MB
SHA256 a638bd2235309493f50adfcae707675bb6c3615a2ac44ccefeca7c7085389d49
MD5 91869ba2775cbd0135b8ac20854cdb77
SHA1 07ff72e2afa2fc876565c8d7a9bae1f67105e5c0
SHA512 d970633cba93639fe46a569b45f5b4547125f0505cd6878879a7d729a0a89bf723d604e53563fe17120e4825b92c2124b5a82a17f185e46f52d7025893f3076c
SSDEEP 49152:+hqQRjgbS5A0V4NmoIb193Km3QIH6hvweSNerodqG5iBgP6zPPvT48unNHRVq45u:+1gbID4lz8ZlwZswtwmdXn
TLSH
T1F0463803F28681E9C06DE579875FA633B631F8850B2276DF56A00F192E66FE06B3D714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Roaming\project-lightning-data\Cache\Cache_Data\f_00000a
Size 33KB
SHA256 faa24ec881e6040655c187a681d6dc496eb8aa41e1bd0652a180b3a40b457187
MD5 f953f499c9824953791551bfef65fe61
SHA1 00fbf8d23d0e9549798383179c9b0eae5d653f9f
SHA512 07bf316d186ac8d6eb8cf860fd0dbce854ae74ae26276be3950bd32b06894c7b24268280d504bb490218c5ec0e85b4eeb7e858011dcf4de64bbb06e4eb296fca
SSDEEP 768:Pr8FwJ2kfmG7rCq0GJtSBVRF0UGuEuOZejwpiUCTVwiYz:PVJ3fd7rCqduSduOZnIVVwvz
TLSH
T1D0F2F185B0036A346E502FB459DBE6CE1FADF8041A5318EDCE9DC30BA394C7648792BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\project-lightning-data\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\project-lightning-data\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\project-lightning-data\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\project-lightning-data\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\project-lightning-data\Session Storage\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

config.json

Path C:\Users\Admin\AppData\Roaming\project-lightning-data\config.json
Size 20B
SHA256 876c2ee98531d13b8fc50e49fb768944f36504b17ee4a56267c7006163d01280
MD5 740c384390b5510561ab16800cfa5e68
SHA1 67577409440ba681a231da37631ee19b9d6f135a
SHA512 cafc89f2c06a9cb5712e2fdb0c1f6cd6d5c651e2315073acc0acc06bfece5828721a066a59b4065a9042a58ef41e459dcffa7195be7af84f0fdee121786cbf8e
MD5 SHA1 SHA512

Submit Download

config.json

Path C:\Users\Admin\AppData\Roaming\project-lightning-data\config.json
Size 52B
SHA256 1cbd9b062a8d2065982f2b2ca0c95456650ac21895864f6af0ef50a5dd381e20
MD5 0eb800f3f308e329e21c289d063c6429
SHA1 a5aeac85c95868359d745ce2bdc198071c10aa37
SHA512 1dc0dc5eeffd2db2052b87020093040a62484f027287f414ec6c9b063cd78faf53cb84a8afa9e8bfab703a2b622774b873f4d23fbc2d0d6efc3b9617db3e710e
TLSH
T1119002551245355A845624A0088046593E042E02B5B32368269209C85A874754151B28
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2468-5748-0x00000209ED050000-0x00000209EE8CC000-memory.dmp

Download

memory/2468-5853-0x00000209ED050000-0x00000209EE8CC000-memory.dmp

Download

memory/3976-461-0x0000000000240000-0x000000000031D000-memory.dmp

Download

memory/3976-5568-0x0000000000240000-0x000000000031D000-memory.dmp

Download

memory/3976-323-0x0000000000240000-0x000000000031D000-memory.dmp

Download

memory/4228-5650-0x00007FFF755D0000-0x00007FFF755D1000-memory.dmp

Download

memory/4228-5651-0x00007FFF73A90000-0x00007FFF73A91000-memory.dmp

Download

memory/5108-5567-0x0000000000500000-0x000000000096A000-memory.dmp

Download

memory/5108-5530-0x0000000000500000-0x000000000096A000-memory.dmp

Download

memory/5108-4925-0x0000000000500000-0x000000000096A000-memory.dmp

Download

memory/5108-4301-0x0000000000500000-0x000000000096A000-memory.dmp

Download

memory/5108-3393-0x0000000000500000-0x000000000096A000-memory.dmp

Download

memory/5108-462-0x0000000000500000-0x000000000096A000-memory.dmp

Download