373ee3efcdbd6f9e66fbc2ec7f3404fef4c07e9c8efdd491ea020b58c1dcc8a5

Analysis

user interaction
yes
max time kernel
3s
max time network
42s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/10/2026, 17:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Athena.exe
Size 73.1MB
Sample261023-whp7csdc92
SHA256 373ee3efcdbd6f9e66fbc2ec7f3404fef4c07e9c8efdd491ea020b58c1dcc8a5
MD5 e2819c691ccecb0ee43687beac2f85a6
SHA1 6ba7397c1804b215d76fd4bb8b593393f7abe7d8
SHA512 c816b0fe0407a1fd46d9d39fb740759a16c38fc7039e20bccd4c74a2e72a0db8e01e6b1905826abd2492f46f4a77d576171cb714ee5616ea8f67d00dc1a64706
SSDEEP 393216:AlB3+YhKxsl5AGJQyyy0CwMgEbjwP7/C:Az3HhKOulfWvwj
TLSH
T1F9F75B43FA252CD0E5ADC574CAB655237B303CB8672023DB6B54B6202F6F7D429BA718
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution trojan

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Run Powershell to get system information as a root user.

execution

PowerShell

T1059.001

pid	Process
2528	powershell.exe
1196	powershell.exe
5228	powershell.exe
5152	powershell.exe
4792	powershell.exe
1044	powershell.exe
2052	powershell.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Athena.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
29	raw.githubusercontent.com
31	raw.githubusercontent.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Athena.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Athena.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4528	Athena.exe
4528	Athena.exe
2528	powershell.exe
2528	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
3352	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2528	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4528 wrote to memory of 3352	4528	Athena.exe	87
PID 3352 wrote to memory of 3908	3352	msedgewebview2.exe	88
PID 3352 wrote to memory of 3340	3352	msedgewebview2.exe	89
PID 3352 wrote to memory of 3340	3352	msedgewebview2.exe	89
PID 3352 wrote to memory of 3340	3352	msedgewebview2.exe	89
PID 3352 wrote to memory of 4140	3352	msedgewebview2.exe	90
PID 3352 wrote to memory of 996	3352	msedgewebview2.exe	91
PID 3352 wrote to memory of 996	3352	msedgewebview2.exe	91
PID 3352 wrote to memory of 4108	3352	msedgewebview2.exe	92
PID 3352 wrote to memory of 4108	3352	msedgewebview2.exe	92
PID 3352 wrote to memory of 4108	3352	msedgewebview2.exe	92
PID 4528 wrote to memory of 2528	4528	Athena.exe	93

C:\Users\Admin\AppData\Local\Temp\Athena.exe
"C:\Users\Admin\AppData\Local\Temp\Athena.exe"
1⤵
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4528
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Athena.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Roaming\Athena.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msSmartScreenProtection --mojo-named-platform-channel-pipe=4528.2076.17984530048701361896
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:3352
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\Athena.exe\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\Athena.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x118,0x16c,0x7ffae28cb078,0x7ffae28cb084,0x7ffae28cb090
    3⤵
    PID:3908
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Athena.exe\EBWebView" --webview-exe-name=Athena.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1684,i,15685578697554855555,3164683547207818998,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=1688 /prefetch:2
    3⤵
    PID:3340
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Athena.exe\EBWebView" --webview-exe-name=Athena.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2032,i,15685578697554855555,3164683547207818998,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:3
    3⤵
    PID:4140
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Athena.exe\EBWebView" --webview-exe-name=Athena.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2364,i,15685578697554855555,3164683547207818998,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:8
    3⤵
    PID:996
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Athena.exe\EBWebView" --webview-exe-name=Athena.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3624,i,15685578697554855555,3164683547207818998,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1
    3⤵
    PID:4108
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct | Select-Object displayName, productState, pathToSignedProductExe | ConvertTo-Json -Compress"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2528
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "(Get-MpPreference).ExclusionPath | ForEach-Object { $_ }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4792
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "(Get-MpPreference).ExclusionPath | ForEach-Object { $_ }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1044
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "(Get-MpPreference).ExclusionPath | ForEach-Object { $_ }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2052
- C:\Users\Admin\AppData\Local\Temp\bin\lsp\luau-lsp.exe
  C:\Users\Admin\AppData\Local\Temp\bin\lsp\luau-lsp.exe lsp --definitions:@roblox=C:\Users\Admin\AppData\Local\Temp\bin\lsp\globalTypes.d.luau --definitions:@athena=C:\Users\Admin\AppData\Local\Temp\bin\lsp\athena.d.luau --base-luaurc C:\Users\Admin\AppData\Local\Temp\bin\lsp\base.luaurc --docs C:\Users\Admin\AppData\Local\Temp\bin\lsp\athena.docs.json
  2⤵
  PID:5072
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "(Get-MpPreference).ExclusionPath | ForEach-Object { $_ }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1196
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "(Get-MpPreference).ExclusionPath | ForEach-Object { $_ }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5228
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "(Get-MpPreference).ExclusionPath | ForEach-Object { $_ }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5152

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 bdabc722b54683101ece10b3c6a97dd08a448ae7afb334bb1b58c9c5fd9233a7
MD5 15cbf20a4d4c5629da5b58482c0c743a
SHA1 a7cb6ac2e79bddfe7f92e0ccb581e87e9b804afc
SHA512 52d098cfdc66c14e2a7245b141ddcd4fba7934f0023387960e11294d425bc25a8e2972f80de8e6d284aaebae5859cce0cb199a2d3974f3d2de2bda80a44dd0c1
TLSH
T15D71C1323275B0D4C8567F071A2819C063BF4396EA98AF4CB25C621ED92751BDB221F7
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 a78dca0d470c353064c51dbe58a9bf408c188b65d44636759aace9011f5b482e
MD5 fd9152fd0fab56908fe168af91a08303
SHA1 e4e64d449aaae4e5cda388fc492ff8ee0878af24
SHA512 c29093187dcc35ba79e20c11a00ad4063cb81bf7b0bc269f3aee66f583ebece5821cf1ac8748e49247a8eb0eccf4e47f5eb4c1f8577327d8a754a807d5a4aa16
TLSH
T1D9112223F38C89A1CC861639509DAC5172B686CB81AEDFDF7FC0C210E5AF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a815b25c9899e73f624d996a5a00aeb9e25a4d4816133e42378325a78dbc6a56
MD5 3e7639e0ccadda70f85207bde5d64e94
SHA1 bacf3f1f59b1c20b98bd335a5d8d83aacf72629f
SHA512 686d1177c594e245e341de38dcfd3113c49d343c752abb9fb6021817385dd4d156aafab98b6581e934daa56f92c0bac376dbf0e6f7a667cef6a7e7642810f5ed
TLSH
T15A217327B39CC921CCC9213A609DAD5176B683C7809ECF8F6EC0D314A47F698CB71694
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 11298d54e10f9d37f17b13fa487d24e803c5c6c789a7abf9fc1213aac744e9d1
MD5 13ac24f9852883354d166ea4e4b9bd87
SHA1 4bcfe85bb7926be7c2694e3be804a64d0f219ac3
SHA512 79136feeeceae0b35dc54e5562d88cf117c14c008fefc2fd1f5f7888971700536abf49bba2f9432de61b2f9f84776050de3c60d902c58c1b888c836564a1cbbc
TLSH
T1F5112223F78C89A1CC861639509DAC5172B686CB81AEDFDF7FC0C210E5AF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 e981ba57e2617381d8d75f0c7ffb6e836afbeb475434a06b56b9a5a988761e92
MD5 6a5650126660a2760e93e48a63a9f626
SHA1 35710b657094c22ed66a37854173ce2090f02caa
SHA512 4e4cc9dc507cd95d5f9ddc181f68e97e5351aa7748c574717ac4cf0ff882f7fb1c6d6460b63560db382697c44118b8c2a288e2c94c9c8457b15ca6a9b1a66ba9
TLSH
T108112223F38C8920CC961539509DAC5172B586CB81AFDE9F7FC0C210A1BF584CB61194
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_hq2dwh2c.ot2.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hq2dwh2c.ot2.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

secrets.json

Path C:\Users\Admin\AppData\Local\Temp\bin\cliproxy\secrets.json
Size 140B
SHA256 ff1abde87137d72f5defc14d334854824ebf5dc861cca45ef9ca81ea1eef030b
MD5 0f0cfe5e9963529f18b4b22571e6e10d
SHA1 f33edee2d220e9e5d0451141f63adea3ba306f1b
SHA512 bcfdb70a148af01a07e20d4def1231ecd8bd8e114bfe3f06d8cc25d78543140c8e91407b5463b134201ffc0969bfdad62408a04025470913fca94d21ceaeaec0
TLSH
T117C02BFA926744F50CEEA249118F91670A6E0C41BFE0FA0E23F1261C100E077851E6B2
MD5 SHA1 SHA512 TLSH

Submit Download

game-scripts.json

Path C:\Users\Admin\AppData\Local\Temp\bin\game-scripts.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

athena.d.luau

Path C:\Users\Admin\AppData\Local\Temp\bin\lsp\athena.d.luau
Size 18KB
SHA256 f1ea11f5ab92f96a453a194a896a97031bc2d58a5f832c29dec084822b6a48d5
MD5 7d5cb3ded0db7e6c6dc8aa0d2c1b782c
SHA1 70e4bbf3e08d1ebd9759f1d460aef3c96eac02c1
SHA512 bdfd2178a150d710414db1b72bb3176d7108c61ca0774bcb12dfb0bd5e3715ae4adc0edb6d688091b9e200905bfd54c1032561b513aa251ecd66cb5f6a2584e6
SSDEEP 192:aqrpDgu5psleE7I+8hLlI7HcuV8uNIaZm+93B:NrpkypLEtIpM8uNlZm+93B
TLSH
T1BE82C741F5BC31B6B8F84343F5BE15A7AD162AC4A1B7B8F5ECE8660B025317D88D190E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

athena.docs.json

Path C:\Users\Admin\AppData\Local\Temp\bin\lsp\athena.docs.json
Size 91KB
SHA256 73ea4584569c9b6b9f860f51faf02aa25a46b1db10d5477ff7ae1bec54c840d7
MD5 020bed16dbbd42d08f6a779aba4b3612
SHA1 2a7b4aed6d8f11fe61d95af99371980bd1a62197
SHA512 209e0f82f72c598e0257b8f59e1ba882bdea26c854370b82e4fdc6da485a0cfc09401fa2bf34dde4d96190266d4080f750c01f9a047ecc64b5502653a0b43e9a
SSDEEP 768:HdIe3qxORQAQQQbU29sVIdDtyn48ttiEBIkUew67/+9jPDf12ruA7im6FvFXOv:Ke3qxV8tYEtUew67W9G0FvFXOv
TLSH
T1A19332F6DDB51AB219CB2279583D8382B639406739AD7C147D7C894C2F0C83EDA7A1C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base.luaurc

Path C:\Users\Admin\AppData\Local\Temp\bin\lsp\base.luaurc
Size 500B
SHA256 787bb1dc74910abd3bd7bb0ef7b24bf87d1fb878d7114848e9c41ccdda2cf404
MD5 0c873e0e0b95a34609770ed4075c14fd
SHA1 4a78fa51c5b6ff6541db7c9ba188fffd0a224817
SHA512 940a9754d77003c521f726576bd99840ff229e549a94de31465468c1f35d89ac0e7b51c9b71436117513b6043a75bda5690ae19997ef5796e6982d0cada03483
TLSH
T11FF01569D5596CFC28B9819EE4AEC113D62007AB35491E07F2FD420C3F7997D3428EC0
MD5 SHA1 SHA512 TLSH

Submit Download

globalTypes.d.luau

Path C:\Users\Admin\AppData\Local\Temp\bin\lsp\globalTypes.d.luau
Size 851KB
SHA256 71698e2454aacef1a144a498ffc1d7ea80654b9593025344672bc9106997bf6a
MD5 67438875e3a909782fd882db976e1b4f
SHA1 09fe1f5904b05b42646546788949bf6e7090fca8
SHA512 d62141076c67411dd399f12673e53fd71fcb603775589c3df7764d1a5fd49aebd76d628ccc81c17ef31cb660375b92090ceaba5ebb0653472179fdb496ff11c8
SSDEEP 6144:wKk1ZUqKGWqx2CZEzBXl0vgbttxQc3zVvD+J5RGyY3FY/OSRlXA1APplSm3TU2AX:VxQc3zVvD+JDB7XCf
TLSH
T11105540DB604A130598F53F56E9F8884ECB5D2C5612C90F494FCBB461B7F83E26A6ADC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

luau-lsp.exe

Path C:\Users\Admin\AppData\Local\Temp\bin\lsp\luau-lsp.exe
Size 17.0MB
SHA256 3c834f9402c82681ef2b8cc171c769f239eb094028bb31469296e1f0f4c489a6
MD5 8f890ca7382ce4517422a73ec3c432b0
SHA1 0a69749e532f7bc7a08a09c711b8d87149b22876
SHA512 692a35d1494649f96851ec333a0265805e46cc6f8f2688371a88ba3b4b8d899ea403dfd3bd2e4ee94a9d1c4eb7fe4a7b2d5a61c5092354a220e6edfc6f0f2552
SSDEEP 393216:dWfmgggFgl6ggDg/gpQiMRgFEggUggg3dgfgi1UBgggggUuMwFgggg6NggggggeD:YDggFgl6ggDg/gpQrRgFEggUggg3dgfF
TLSH
T1FA075B2A21AC10DCF17BD0BD8BDB9E47D6B2340903319ADF05D15A9E1E1BDED4A7E620
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.log

Path C:\Users\Admin\AppData\Local\Temp\bin\system.log
Size 854B
SHA256 8ae18831695d9a0b1a0d9e6c1040d5eeac4e32fafb9e4b199e6ccb323cb5e15d
MD5 cfd7f0847db31ef1d7a286d5642f930a
SHA1 23085838b00924064313528e5c87286dafeea8e2
SHA512 64cfbf3853967438ae43dac54b88cb34f4c9055e74b5adb95709c4070f22cbf48aed5c1ec111d166dadfbc0b52d2a59f959cd14ce94de4cbb13df44c7c4a5cf3
TLSH
T1A701AF1152CAF67E6C4551A75524EF49CA650407379D2901CF35CC6972C706E9E68A43
MD5 SHA1 SHA512 TLSH

Submit Download

system.log

Path C:\Users\Admin\AppData\Local\Temp\bin\system.log
Size 854B
SHA256 0c07970fab74ebbb52335c822e919a2334c72e3a22fa9b78765680ea769a698f
MD5 436df5989cd29200f2ac7b170cc54dc9
SHA1 b5b57ee67515dd332a328811e1000320d417e210
SHA512 fc8ca4a0a7001b016ccbcce0f65c5bb560ea8f7dee7473ee69d52e653192e554bdae64bf51d458da374ba35ac7689957a94a2c38446806abd4049db2686171e4
TLSH
T13301EB1252CAF67A2C4551AB5428EF4A8A650007379D2A01CE35CC6A72C706EAE68A43
MD5 SHA1 SHA512 TLSH

Submit Download

versions.json

Path C:\Users\Admin\AppData\Local\Temp\bin\versions.json
Size 143B
SHA256 c650c48b853142be5918e9eace4d8b5ff5832642b69dd17301d56c7bb537645a
MD5 6421f02aaf041e2d506c92d4c3ae7d67
SHA1 5a3da6c3deaf1f919f2055c9b0684dab5caf0c00
SHA512 3f2a8d6c4f9bc44075eb19c32cb1e7a3bf29bcbb9b9da2c2f05ec39fc158ae78b22c8a78d2977f72a23877d3913cd70e41cb60d7881ca3e1b6dfec0eaa5b8ff0
TLSH
T165C08CF0F99009C32120405EC82A6017F24414030808980A2A490A8E87826AA946C51E
MD5 SHA1 SHA512 TLSH

Submit Download

2359a380-1a7d-4ac7-bfad-64b42c99303c.tmp

Path C:\Users\Admin\AppData\Roaming\Athena.exe\EBWebView\2359a380-1a7d-4ac7-bfad-64b42c99303c.tmp
Size 3KB
SHA256 ae9f743b2d740bb28b93c15df45c8416c32dd36f0b9d6d9c394000b9c9905de3
MD5 3837e22abadbcf53663766e410654bbb
SHA1 5d2e25eb464d5566840e8ad0e5d93f0cc1fa4900
SHA512 9e21ae2474030377476ba819b6bbc6313f848dbbb1dc684ec5a703b2fb3f809e5fde0d4d56d01833eda69abb05baabc693a84e10227f4bba3f2b8b31cb7198d8
TLSH
T13171A772A8A4A9374DE2DA4479462F0AF6615137F5D13F98D6FD0F0C01DB6981346C17
MD5 SHA1 SHA512 TLSH

Submit Download

58036224-312e-4984-8f3f-015f658e2230.tmp

Path C:\Users\Admin\AppData\Roaming\Athena.exe\EBWebView\58036224-312e-4984-8f3f-015f658e2230.tmp
Size 4KB
SHA256 faafb2900ab28bd880db4b25c47f3a9041d1fbd5d22684706c102e36891f9fa0
MD5 174fc6e9900511fe529515f6b106094f
SHA1 66f05e919ae211d00dad62bca0383d1d814304b3
SHA512 96bf58ef3208baa5fcf2fcebc7d6b267d1f709f41fe0a75a8f04b475d1673e536bba98a5eefe4e20c384dd1d1f838588c256f9bc0fca0ed8d4bb3a56ef393cef
SSDEEP 96:zuSeNkCEPo/fZHT0UA8Frh/cInURoDoto+5/OJwjDXPBhDBLH6hEJZcZZTAlDa:zveNb4o5HTVvooDUhMwXp5BLNQlL
TLSH
T16E91B622A4B4A9774DE2E949B9463F06F6A15067F4E07F98DAED0F0C01DB2D81346C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\Athena.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 cf815ac74d3204c970529f5824d8ae87bc93dbb1be6d2ed367742ed8d5c87e9e
MD5 aef8fd5d1c1325fbd47a35c5b1671f8c
SHA1 c6dec54bb004a56ab9484ea8a0eeeb121c428749
SHA512 cc92b3b6119568d6570ac951e93d5883dbc84c61c465beb0443551d8089cc9dbf271b9547c3fc50d281707309e9a87497fe1155c67e969b0bf4cdee899127c59
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\Athena.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 d45b632a434977f6c9957c8604915efc23e49e4812e01ba4989bcf5468a09ef5
MD5 b0de519c5c75e11980e94ced495f1d5b
SHA1 ccd8b0cde31a507fce59cae1b18b66bddd01fa6b
SHA512 182d87a2a656c9d7180616f20cd506fb55d851a05b4ed48cc70f6273c990ce66ad032674796220671d38043fefeec7e4554bc75292e901041b3c9b7df438d03a
TLSH
T157D0121636010234C03035330002610D04C0D12B42158101682CC91D5E448642E16C41
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Roaming\Athena.exe\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

7b0a386e-70de-4de2-8521-54935f2cf640.tmp

Path C:\Users\Admin\AppData\Roaming\Athena.exe\EBWebView\Default\7b0a386e-70de-4de2-8521-54935f2cf640.tmp
Size 6KB
SHA256 0bcbb9a27dec7d62f10249538bbe2fdc8dde5259516d0377ad922a03cb9e9966
MD5 3d3ac1a24f4d6d733369fbdcdd22f633
SHA1 d1d11bd4815d7c1390dd4470de1ddd400701bf12
SHA512 3a5b7728d1820ef833c9a6da0b5fc5ebcde6557ce6ab125a4e08e5b7d28150c7ac2c34f18436fff76a2683ffec6118245d63efbe95a435c39ca33d4924177403
SSDEEP 96:sts05MFPapb92rff6dZ8i0vhEHkc3m/7qx+WVHMSm+uecSVN8jMdQjm+gj6EMEB:sts0ykCf0Z8paLW/S+WiQVN8odD8EM8
TLSH
T1E5D1A8029E6869774CC7F21D7A35BB06E2FA206175D40E98EBFC861C08E66CC6207D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Roaming\Athena.exe\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 168B
SHA256 b1221ced015edc0d4d8f468156d24d3e9f725a47fb9ba33ef1f977eb65ba9f47
MD5 487242ac0d6c6b865d0fde1d309db5e1
SHA1 d32d29be0cdb270e48c0620313255e45fa0bf0d1
SHA512 6cfebd0a92c92822ab469634661cc4eecfcfd484342d2e5dbb29aac4edb0118dd6d5d360d2be4a56044bf2cb62197520ba7d6cbba1244f54de19e34877c90784
TLSH
T1D9C09256C95140C0C73BC1B064F29A78F931AC6FCEBF9DC76E940674CE26384899C329
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Roaming\Athena.exe\EBWebView\Default\Code Cache\wasm\index-dir\temp-index
Size 48B
SHA256 007ffbe8c94209608f9cc8c88172ae6dd36adfff76b9fe3d667bafae8981e25e
MD5 d75487bf5f862bb7e81ecdefc2df528d
SHA1 c2a09b8d28d5c01991c85beb8459b815d83d4d98
SHA512 2897f2942be3241913e18c0921bce1f1aeace3c67d258962717ef265af7e35f4af4c6c5260665e8beb3857fd919ddfb37cab67b6e9995dc516389c2cab6bc28d
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\Athena.exe\EBWebView\Default\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\Athena.exe\EBWebView\Default\GPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\Athena.exe\EBWebView\Default\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\Athena.exe\EBWebView\Default\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Roaming\Athena.exe\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\Athena.exe\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\Athena.exe\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\Athena.exe\EBWebView\Local State
Size 1KB
SHA256 ee388a3d34e1cd80211ffbc57ea98bfe16433c2f144fc16af2e1e3630444fe7c
MD5 31705b73e14e6bddec367755443a3dc2
SHA1 eae555f79c23f74e3c91483e5e97eed53b9a8315
SHA512 e765e7f76d65946642a6b4ce6c4dd9b3f612977c94617a1d622473eacdb352f904917bf99ca701590261774210a48e11ccba45d39727c763d565581094f8107e
TLSH
T1842187B3D4D46B7229818DC576026B8F5D109179F1509E08E1EE0E1800DB8EC962FC37
MD5 SHA1 SHA512 TLSH

Submit Download

c42c3ab9-f8ae-4205-98a3-9830ec316203.tmp

Path C:\Users\Admin\AppData\Roaming\Athena.exe\EBWebView\c42c3ab9-f8ae-4205-98a3-9830ec316203.tmp
Size 1KB
SHA256 4ea9fb58567b8e66024b71b04e0a6bd065f9cc49f8cfdadbf3c218f3f2d0a941
MD5 3bdfbde842ae5c7e080551f46bbdedbd
SHA1 15f35f2330b5994bc27db701ea10d5725d259a48
SHA512 959959cdcfe389b205f98cad76a64fe45d9786385d99015c9bf14c45413fba12258c019cea433119444114920ae143a74a98b46b2be57b1f69fa260a4a93bd61
TLSH
T13B31A7F2E4D46B721CC1DAC936022F9FAD20507AF1618E08A1EE0F1800EB99C961ED37
MD5 SHA1 SHA512 TLSH

Submit Download

e6599d6e-b4d5-46ec-938e-b51d10a00103.tmp

Path C:\Users\Admin\AppData\Roaming\Athena.exe\EBWebView\e6599d6e-b4d5-46ec-938e-b51d10a00103.tmp
Size 2KB
SHA256 090e8f52fd8bafbeaaaa0e14dc4512d50c315c2ca0577d80a3f8034b4a4b651b
MD5 a56c24fabf4509eff0d7be8c51285a37
SHA1 82afd2fc5d4240f6ea267ee7c13b9500edde8515
SHA512 dccf11d4c145b7306f761f009cf4ce0e4faf41bf0b69d4c0e3c66790a25cd91ece383a89a9fcecde43894d856230f6c6ab9d9a57d4e974b65d28442239fc7e9c
TLSH
T16B51B773B854AA7749D2DA8879063F1BEA3191B5F6A12F5496ED0F1C00DB59C230AC3B
MD5 SHA1 SHA512 TLSH

Submit Download

ec4c53ae-adb7-46b4-9ee3-3a92eade3222.tmp

Path C:\Users\Admin\AppData\Roaming\Athena.exe\EBWebView\ec4c53ae-adb7-46b4-9ee3-3a92eade3222.tmp
Size 4KB
SHA256 9e0c2f6dc3615761e9e0c6e2bd032a5eb7b86a331b22c3651a88fb98467ab990
MD5 65ad510813b6eca289ed09c6920d43e4
SHA1 72cae21579cd5dfd25c40f6d5c9c3498504cc1fc
SHA512 038e053267d31b2ee319af00f6fccb8f83b1389aa7cfd063b7de012b9a7d8c7bd710eddacdbd80783865c0b7f9a64779550d4640a6a72db3380f57907468a55f
SSDEEP 96:zuSPNkCEPo/fZHT0C8Frh/cInURoDoto+5/OJwjDXPBhDBLH6hEJZcZZTAlDa:zvPNb4o5HT0ooDUhMwXp5BLNQlL
TLSH
T1B091A422A8B4A9774DF2E949B9463F06F6615026F5E17F99CAED0F0C01DB2981346C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/996-83-0x00007FFAFE240000-0x00007FFAFE241000-memory.dmp

Download

memory/996-82-0x00007FFAFEAB0000-0x00007FFAFEAB1000-memory.dmp

Download

memory/2528-194-0x000001FD78600000-0x000001FD787C2000-memory.dmp

Download

memory/2528-191-0x000001FD77DF0000-0x000001FD77E12000-memory.dmp

Download

memory/2528-192-0x000001FD78280000-0x000001FD782AA000-memory.dmp

Download

memory/2528-193-0x000001FD78280000-0x000001FD782A4000-memory.dmp

Download

memory/3340-591-0x0000021655740000-0x000002165576B000-memory.dmp

Download

memory/3340-26-0x00007FFAFE210000-0x00007FFAFE211000-memory.dmp

Download

memory/4108-164-0x00007FFAFE210000-0x00007FFAFE211000-memory.dmp

Download