38de7f31255ecbe51fa04a26bc781108c3a62ef01e44fd63e702414c4cce1834

Analysis

user interaction
yes
max time kernel
2s
max time network
24s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/10/2026, 23:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
athena.exe
Size 73.0MB
Sample261018-3yetwsvs4k
SHA256 38de7f31255ecbe51fa04a26bc781108c3a62ef01e44fd63e702414c4cce1834
MD5 c7de2ac846a37c7bedb5673a58f9ac55
SHA1 07aaddf057e2fa9546bf2da162a072734d23d08f
SHA512 4de1d7336fe26a056b2acd3452861d5ecf170d411872396b1efd5dbe731d531b8af30b947badc99add2d32c818c5471684d0ada50794697ee3074e47a07d7a4c
SSDEEP 393216:sAopeznzWnMbR6/v2y0JaUiOAsJbgdh+Uns:stIznzHbu+pd1gL+U
TLSH
T15DF74A83FA662CE0E5ADC134C57685237B313CB9972023D76B54BA242F2F7D029BA754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution trojan

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to get system information as a root user.

execution

PowerShell

T1059.001

pid	Process
4912	powershell.exe
5924	powershell.exe
1924	powershell.exe
1392	powershell.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	athena.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
20	raw.githubusercontent.com
21	raw.githubusercontent.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	athena.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	athena.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4084	athena.exe
4084	athena.exe
4912	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
2088	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4912	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4084 wrote to memory of 2088	4084	athena.exe	86
PID 2088 wrote to memory of 668	2088	msedgewebview2.exe	87
PID 2088 wrote to memory of 5920	2088	msedgewebview2.exe	88
PID 2088 wrote to memory of 5920	2088	msedgewebview2.exe	88
PID 2088 wrote to memory of 5920	2088	msedgewebview2.exe	88
PID 2088 wrote to memory of 2392	2088	msedgewebview2.exe	89
PID 2088 wrote to memory of 4976	2088	msedgewebview2.exe	90
PID 2088 wrote to memory of 4976	2088	msedgewebview2.exe	90
PID 2088 wrote to memory of 2532	2088	msedgewebview2.exe	91
PID 2088 wrote to memory of 2532	2088	msedgewebview2.exe	91
PID 2088 wrote to memory of 2532	2088	msedgewebview2.exe	91
PID 4084 wrote to memory of 4912	4084	athena.exe	92

C:\Users\Admin\AppData\Local\Temp\athena.exe
"C:\Users\Admin\AppData\Local\Temp\athena.exe"
1⤵
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4084
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=athena.exe --webview-exe-version=0.1.2 --user-data-dir="C:\Users\Admin\AppData\Roaming\athena.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msSmartScreenProtection --mojo-named-platform-channel-pipe=4084.5276.12852908313685647173
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:2088
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\athena.exe\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\athena.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ff84237b078,0x7ff84237b084,0x7ff84237b090
    3⤵
    PID:668
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\athena.exe\EBWebView" --webview-exe-name=athena.exe --webview-exe-version=0.1.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1720,i,4578938833528015515,15512963868928047817,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=1716 /prefetch:2
    3⤵
    PID:5920
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\athena.exe\EBWebView" --webview-exe-name=athena.exe --webview-exe-version=0.1.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2036,i,4578938833528015515,15512963868928047817,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=1920 /prefetch:3
    3⤵
    PID:2392
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\athena.exe\EBWebView" --webview-exe-name=athena.exe --webview-exe-version=0.1.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1724,i,4578938833528015515,15512963868928047817,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:8
    3⤵
    PID:4976
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\athena.exe\EBWebView" --webview-exe-name=athena.exe --webview-exe-version=0.1.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3628,i,4578938833528015515,15512963868928047817,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
    3⤵
    PID:2532
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct | Select-Object displayName, productState, pathToSignedProductExe | ConvertTo-Json -Compress"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4912
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "(Get-MpPreference).ExclusionPath | ForEach-Object { $_ }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5924
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "(Get-MpPreference).ExclusionPath | ForEach-Object { $_ }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1924
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "(Get-MpPreference).ExclusionPath | ForEach-Object { $_ }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1392
- C:\Users\Admin\AppData\Local\Temp\bin\lsp\luau-lsp.exe
  C:\Users\Admin\AppData\Local\Temp\bin\lsp\luau-lsp.exe lsp --definitions:@roblox=C:\Users\Admin\AppData\Local\Temp\bin\lsp\globalTypes.d.luau --definitions:@athena=C:\Users\Admin\AppData\Local\Temp\bin\lsp\athena.d.luau --base-luaurc C:\Users\Admin\AppData\Local\Temp\bin\lsp\base.luaurc --docs C:\Users\Admin\AppData\Local\Temp\bin\lsp\athena.docs.json
  2⤵
  PID:1284

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 bdabc722b54683101ece10b3c6a97dd08a448ae7afb334bb1b58c9c5fd9233a7
MD5 15cbf20a4d4c5629da5b58482c0c743a
SHA1 a7cb6ac2e79bddfe7f92e0ccb581e87e9b804afc
SHA512 52d098cfdc66c14e2a7245b141ddcd4fba7934f0023387960e11294d425bc25a8e2972f80de8e6d284aaebae5859cce0cb199a2d3974f3d2de2bda80a44dd0c1
TLSH
T15D71C1323275B0D4C8567F071A2819C063BF4396EA98AF4CB25C621ED92751BDB221F7
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e7f8a0fa565a128d81187a59cb42c1903d4ea6a9ffd081baa2aeacdccddaab8d
MD5 619547263f6900d49f7a8d24fd3d4478
SHA1 68d297b27b075771cb9909c6876d43cf2fbb8f05
SHA512 da07982f8b0ab0c2b37690f6b037574b1fccde617f33e2c410dfa3c063f09d30f04f7856a4428d4fa86aa1935aeed7c3003490a57510bac76de17b1d8c7b4eb9
TLSH
T1E6217327B39DC921CCC9213A609DAC5172B683C7809ECF8F6EC0D214A47F698CB71694
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 3367baf6d28d601966ec6b2905587a1b8372d18f11a316ecf18e373f12c71a1a
MD5 57359e8a52af5b5eb6f81945c98fd001
SHA1 bd0fe9b90d9683c5bb7f45f794a230a271acbb91
SHA512 aa47fee216b36180327423051b6deb75c637c43c79bc9391f10683db34692eaf27b18e2a42aab2c0a5da87fe1c21b9a12ad5cfa10aacdd543c27dec263f52b86
TLSH
T1DA112223F38C89A1CC961639509DAC5172B686CB81AEDFDF7FC0C210E5AF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 2b139c74072ccbdaa17b950f32a6dbc934dfb7af9973d97c9b0d9c498012ba68
MD5 d8cb3e9459807e35f02130fad3f9860d
SHA1 5af7f32cb8a30e850892b15e9164030a041f4bd6
SHA512 045239ba31367fbdd59e883f74eafc05724e23bd6e8f0c1e7171ea2496a497eb9e0cfcb57285bb81c4d569daadba43d6ef64c626ca48f1e2a59e8d97f0cc9184
TLSH
T13F112223F38C8920CC961539509DAC5172B686CB81AFDE9F7FC0C210A1BF584CB611D4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_zl5htb52.uu4.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zl5htb52.uu4.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

secrets.json

Path C:\Users\Admin\AppData\Local\Temp\bin\cliproxy\secrets.json
Size 140B
SHA256 30751e9f3d1e886020e87f9e62cfa3fe1093fc834ccf0633390e015cf765ceb6
MD5 7b8512e818ea5fed47e5edb14eb39a5c
SHA1 18ebc778f12891c28021837d17eb9471d27f91d8
SHA512 226f5b4d9c1edde751ed293df2126ea329cf6077a20d01ff83eb1b3dc1371b914364ca21666a5612fddce8bd8a4a340a502de00301f67be7f78470624c1286de
TLSH
T1FBC02B317233083680CD700D7CCA430BAB3F5C9321C6EC883522046F15C0C251E1CCC5
MD5 SHA1 SHA512 TLSH

Submit Download

game-scripts.json

Path C:\Users\Admin\AppData\Local\Temp\bin\game-scripts.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

athena.d.luau

Path C:\Users\Admin\AppData\Local\Temp\bin\lsp\athena.d.luau
Size 18KB
SHA256 0ee95b9ce296c9583a583b86c65c330cc7d56b7eca01729eaff9131457db0d98
MD5 0e2f96f3e91882af9071e5be44ba7a72
SHA1 46f880930f29f812fb2d754ac260fa9775a13693
SHA512 a85dc0e7d79fee920c2dc67263e4680c6b45e68295ce7bd400a74747faf244fbc9600beaa0f6e2e7ce5f8b5f0718375e907d40eab89c2facca94a97c543c8f8b
SSDEEP 384:SQpb7pKCl2GdIjrmbZWWuGvIMFxzS6znp3B:pl2GdMrmbZWWuGvIMF5d
TLSH
T13482BE41F56C31B6FCB84363F6AE1497BD162FC861B2B8F4DDFA560B025312D88A184E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

athena.docs.json

Path C:\Users\Admin\AppData\Local\Temp\bin\lsp\athena.docs.json
Size 91KB
SHA256 73ea4584569c9b6b9f860f51faf02aa25a46b1db10d5477ff7ae1bec54c840d7
MD5 020bed16dbbd42d08f6a779aba4b3612
SHA1 2a7b4aed6d8f11fe61d95af99371980bd1a62197
SHA512 209e0f82f72c598e0257b8f59e1ba882bdea26c854370b82e4fdc6da485a0cfc09401fa2bf34dde4d96190266d4080f750c01f9a047ecc64b5502653a0b43e9a
SSDEEP 768:HdIe3qxORQAQQQbU29sVIdDtyn48ttiEBIkUew67/+9jPDf12ruA7im6FvFXOv:Ke3qxV8tYEtUew67W9G0FvFXOv
TLSH
T1A19332F6DDB51AB219CB2279583D8382B639406739AD7C147D7C894C2F0C83EDA7A1C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base.luaurc

Path C:\Users\Admin\AppData\Local\Temp\bin\lsp\base.luaurc
Size 500B
SHA256 787bb1dc74910abd3bd7bb0ef7b24bf87d1fb878d7114848e9c41ccdda2cf404
MD5 0c873e0e0b95a34609770ed4075c14fd
SHA1 4a78fa51c5b6ff6541db7c9ba188fffd0a224817
SHA512 940a9754d77003c521f726576bd99840ff229e549a94de31465468c1f35d89ac0e7b51c9b71436117513b6043a75bda5690ae19997ef5796e6982d0cada03483
TLSH
T11FF01569D5596CFC28B9819EE4AEC113D62007AB35491E07F2FD420C3F7997D3428EC0
MD5 SHA1 SHA512 TLSH

Submit Download

globalTypes.d.luau

Path C:\Users\Admin\AppData\Local\Temp\bin\lsp\globalTypes.d.luau
Size 848KB
SHA256 f2c5ca08f17a08e9ec43ee998f0ed2825b00b4adea83ece4775b21719e280765
MD5 988d872bfcada2aea1b4e12e69ea01da
SHA1 4f1d2cec29427bdb66990afa0e3e6653859f81c7
SHA512 6d083a8ac78e1a2266b74fff8283672512c6ead3f98d3d912d4d72b37219d54c26a53ca43491e78b7eb2d398c4e72bc9ac365a6867b286f486160a6bd5c4eb2d
SSDEEP 6144:xIk1ZUqKGVqx2CZEzBXlyvTbttxQc3zVvD+J5RGyY3FY/OSRlXA1APplSm3TU2At:QxQc3zVvD+RDB7XEf
TLSH
T1BB05550DB604A130594F53F66E9F8884ECB5D2C5612C90F494FCBB461B7F83E26A6ADC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

luau-lsp.exe

Path C:\Users\Admin\AppData\Local\Temp\bin\lsp\luau-lsp.exe
Size 17.0MB
SHA256 3c834f9402c82681ef2b8cc171c769f239eb094028bb31469296e1f0f4c489a6
MD5 8f890ca7382ce4517422a73ec3c432b0
SHA1 0a69749e532f7bc7a08a09c711b8d87149b22876
SHA512 692a35d1494649f96851ec333a0265805e46cc6f8f2688371a88ba3b4b8d899ea403dfd3bd2e4ee94a9d1c4eb7fe4a7b2d5a61c5092354a220e6edfc6f0f2552
SSDEEP 393216:dWfmgggFgl6ggDg/gpQiMRgFEggUggg3dgfgi1UBgggggUuMwFgggg6NggggggeD:YDggFgl6ggDg/gpQrRgFEggUggg3dgfF
TLSH
T1FA075B2A21AC10DCF17BD0BD8BDB9E47D6B2340903319ADF05D15A9E1E1BDED4A7E620
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.log

Path C:\Users\Admin\AppData\Local\Temp\bin\system.log
Size 854B
SHA256 11ac4ad4760ce48cb48a948b87a45f32e5af9fda1b1ae5503a507ec4abc3794b
MD5 177a65a0407668d99045370681e376e5
SHA1 6b811c6daa636226e478315dd444c521862a9cb0
SHA512 c58bf722f3a3b8784ac4109e08673ef1de27b5caec9e9069cc2ad38eef6496d1d615a0b7354ec3e8b9da539de0f49859ba1de43f9bb055160e63829ae4210a6f
TLSH
T17501EF1152CEF2BA2C4455A75434EF498A650007379D2901CE30CC6976C706D9E68A43
MD5 SHA1 SHA512 TLSH

Submit Download

versions.json

Path C:\Users\Admin\AppData\Local\Temp\bin\versions.json
Size 143B
SHA256 742d2d0af32e3c87df87af1dde97b70ded2a91ec6e0e6253295af3170182ed23
MD5 bbb7d4a6a88e95b2bd26e1b8751f1587
SHA1 2638941bf89534f0eeae5a90183a5af7b6c3aef8
SHA512 45fb686cb4120f8b8a7026d29967ca1e253e7a9f24123e3727b302bbc8bf37ca6044ff8bbb5a4b979545490d01d178b86a1c0c1e609e9483d81228bcbb7e4e18
TLSH
T17BC02B95E1F41EC77D1C01C84138F003730880334C0E1C1F1652010C8B063BBA43932C
MD5 SHA1 SHA512 TLSH

Submit Download

09d708bc-9b41-48b9-9af8-9b6c21ad35b2.tmp

Path C:\Users\Admin\AppData\Roaming\athena.exe\EBWebView\09d708bc-9b41-48b9-9af8-9b6c21ad35b2.tmp
Size 3KB
SHA256 b6789582ddc9afa111565b555fccb65eeb554b1041b46891e82f0e19871f8e7c
MD5 8014c35e23678de476138bb04dc5cc20
SHA1 6a80e5539009083728c9054ae658783567413c38
SHA512 877960676617826b2ef4ccbc8c856757b95e493063ac0a300c7a4639eda39de6befbbc87dfd3671ab288f8f7068e6fc9f38be1fd10735b8ea7f63eeef56b10c7
TLSH
T10E7194326868AA374DE7DA06BCC63B06B6665127E5C63FA8C9ED0F1C01DB7D81352C17
MD5 SHA1 SHA512 TLSH

Submit Download

6662ceb1-aa61-4431-9bbe-0f0c40058426.tmp

Path C:\Users\Admin\AppData\Roaming\athena.exe\EBWebView\6662ceb1-aa61-4431-9bbe-0f0c40058426.tmp
Size 1KB
SHA256 cae56329fd6b90aa76c01ac78f47719646b348af46a41f6ef4fcf693a16e85b5
MD5 2c93afefc8cdd85974f6f3047585e6cd
SHA1 ffe770091cf55202c21656429b2f35b5ca521cc0
SHA512 a629c74bca1fe0fcc217a7129d167c0b6f2cf10811c890fecc91e126d9506949748302eb5b2324a3533ef219f8e5a3e1077cdfa60b3b644d0e41cb446e4ed18b
TLSH
T1C6318573A0942B339C87A257B8D27B0B2D226066D1415F0855EF1B1801E7ADC8276C33
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\athena.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 3b06901a71af971265415716a4075fa7d3f8dcd5cabb508539bec82891e1e3e5
MD5 822a376c5a6a547d3615905e640f8db6
SHA1 6ffa72164975a0ba522b8068196758c4b24d93cd
SHA512 985ededee513027eba244fb9d405560d6652ebb3403aa9a2da91e270c26121a0374e8fa7ff58dbb63475032ca2d20cce3315115c3181f2194a59e5b485891707
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\athena.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 a2d0bd33be0d7b6259c31af9d7d4ae2c21e0aa1da8e4f904897668ae0ded666e
MD5 d9bf4258f11c7eac6f89e68ed142fe46
SHA1 f6065d103fcb6939c3a5e5556763c53649602b45
SHA512 8b7953317ced98ff24c8b1261eeb180677903f4785835840b868380342cb9160e4f4597f1456082ef4144972bf5f02c90c44c4d06213f3836f74749e9d020d8d
TLSH
T1A1D0121233110A74D4203133284662491400C51F80054401683D851D2A440940D02C81
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Roaming\athena.exe\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Roaming\athena.exe\EBWebView\Default\Code Cache\wasm\index-dir\temp-index
Size 48B
SHA256 994b7a10d27f1940b1746c3ee69aafc850b8f4ffd269d7e981bc4809096e5e4a
MD5 22c281e769b632223dc33c86597ab405
SHA1 f7ab3803e8c515cd834f38d9e71a6e726477df38
SHA512 e19232ea10eba9996f0e2a1a45af354e0677f91703a3f83f9f213c2681be23c0fd9599bd0ed9cd3fcce335b48944ef8bd72624fd65c9580303424d00cf9070bc
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\athena.exe\EBWebView\Default\DawnWebGPUCache\index
Size 256KB
SHA256 f8c44d3344777fb84752d46d3bbad4e69f8cf92ef94e77a9a3cd4ef89a438f06
MD5 818ff6c4cd8b018fa2eda8cb3d794599
SHA1 ac95f2af89f5abe4eba30f9dc0f90a098e8a9c6a
SHA512 8dac16fd485a905e8feac5f5643d58006d701587b5f90e8d8a789e71b4edae2f49be071d3ceb174833cd30eaeb6066ec90c2b832c170870c3b96c89ab3ac3a9f
SSDEEP 3:LstlNllkll/lEctl:LsX3lEtEc
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\athena.exe\EBWebView\Default\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\athena.exe\EBWebView\Default\GPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\athena.exe\EBWebView\Default\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\athena.exe\EBWebView\Default\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Roaming\athena.exe\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\athena.exe\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\athena.exe\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\athena.exe\EBWebView\Local State
Size 1KB
SHA256 4c5bc9e6b5a8876c14af39b5f3acb693e7fff29bd08749a6088b09d3d9e87442
MD5 4fdc4804d48b18c67adc6a3e4a52dcda
SHA1 1ed33ffb25ccb926df3b9680d65af445f77258e1
SHA512 2bd09001be07664c29886c504427f4937cfe4a456380ed97d27d10df0279b6135cb168b48a97259c6623ede4598bb46e95c2555082ca914f37276842b1cad5c6
TLSH
T1A121953390882B37A8879557B8927B0F2D116026D1015F0C95DF172401DBADCC373C33
MD5 SHA1 SHA512 TLSH

Submit Download

ce77b8af-60cb-48b7-91f1-b934206a7408.tmp

Path C:\Users\Admin\AppData\Roaming\athena.exe\EBWebView\ce77b8af-60cb-48b7-91f1-b934206a7408.tmp
Size 2KB
SHA256 a35ec00db656c81f322a8998697be786e383466f0f295ef11656e82b0ceeb315
MD5 2cb41868e9e7e68b755747a03af02fe3
SHA1 c53ccf8255e91bb87cebc0256074ccf59d13fbc0
SHA512 82a0fe729c4276de5ad26cb320ca055e7c16a730fe0ca8185ad8d1543628fcd56147438731b7727f6f3cf88c86014845afdc44117968d9fc5a9ff10c4ee3a518
TLSH
T13A51B6337818673788E79656BC8A3F13A93A6066EA922F5499DE0B1800DB6DC1352C37
MD5 SHA1 SHA512 TLSH

Submit Download

ec2b496d-7224-47e5-aab4-2d5e2ecce0f0.tmp

Path C:\Users\Admin\AppData\Roaming\athena.exe\EBWebView\ec2b496d-7224-47e5-aab4-2d5e2ecce0f0.tmp
Size 4KB
SHA256 e18b874088f61e202e4852d1f925877cf9b5d799cef9f8fc0c3ec7cb2f024e6b
MD5 fc821747a6d3b5a2fde52e7df0a3e39f
SHA1 91c92c3a2eb2d2e8833d99047726de1f0867349f
SHA512 cc637f8b1fdc9e8a1558355a60b7423c5a74728f96a44683bf9cb73e5d754376e314666b8a5ec3243a58ce3b23791f0fc9cbc5b2088177e110907d7671a350f9
SSDEEP 96:zuT2NkCEofSqySacvB8Frh/cInURoDoto+59eDVBQ146cuDZeZZTIzlIa:zS2NbWYpaooDUhirQ19klI5
TLSH
T11F9174326478AA374CE7D906B8863F07B6A55067E5D63FA8C9ED0F0C01DB2D81352C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2088-614-0x0000026BB7AE0000-0x0000026BB8AE0000-memory.dmp

Download

memory/2532-156-0x00007FF85CCA0000-0x00007FF85CCA1000-memory.dmp

Download

memory/4912-224-0x00000294B3550000-0x00000294B3712000-memory.dmp

Download

memory/4912-223-0x00000294B2E70000-0x00000294B2E94000-memory.dmp

Download

memory/4912-214-0x00000294B2E70000-0x00000294B2E9A000-memory.dmp

Download

memory/4912-206-0x00000294B2E10000-0x00000294B2E32000-memory.dmp

Download

memory/4976-52-0x00007FF85E6F0000-0x00007FF85E6F1000-memory.dmp

Download

memory/4976-53-0x00007FF85D700000-0x00007FF85D701000-memory.dmp

Download

memory/5920-26-0x00007FF85CCA0000-0x00007FF85CCA1000-memory.dmp

Download