004aacc2c12461f3a0c65c53996ea33945ddb53ef5a992ba86e1084798a16317

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 04:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AlphaAI.exe
Size 14.9MB
Sample260804-e8byzs1fqf
SHA256 004aacc2c12461f3a0c65c53996ea33945ddb53ef5a992ba86e1084798a16317
MD5 89ac8169f5eecb7d6b6f22a209f8a0d6
SHA1 b0b99dad909fcd55e6822acf5ec927cf53cfa52e
SHA512 6adae8a73053018a5fd0705c6218019ba381cb08437d22551bfbba5acf5bdfde4a747d87af740cdb1e6052f35177e519ac9a9a354349cf8cc9cd1e042f22ae1e
SSDEEP 98304:OYyIard360EO7XjGJ7PrKi0S7Fo1nXtjmYTRJ20vqgMWWG5w7GFO9wHM6pcJ5HEa:Nq7XjGN2i0FnNfuW4JfHEvZo8d7
TLSH
T12FF65B43F6A181E8C0AAC5B9931AA233F7317C8D092472AB6BD45F312F59F105B1DB9D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution spyware trojan

Malware Config

Extracted

Language

Source

URLs

exe.dropper
https://devres.alphalawyer.cn/ai/AlphaClaw/scripts/offline-uv-python

Signatures

Badlisted process makes network request 7 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
28	556	powershell.exe
35	556	powershell.exe
36	556	powershell.exe
46	556	powershell.exe
47	556	powershell.exe
49	556	powershell.exe
51	556	powershell.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	AlphaAI.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 63 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1265494248\hyph-ml.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1265494248\hyph-nb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1265494248\hyph-bg.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1265494248\hyph-en-gb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1265494248\hyph-hr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1265494248\hyph-hy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1265494248\hyph-pa.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1265494248\hyph-sv.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_745243805\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1265494248\hyph-el.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1265494248\hyph-es.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1265494248\hyph-sq.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1265494248\hyph-tk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1265494248\hyph-uk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1265494248\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1265494248\hyph-ga.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1251838627\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1265494248\hyph-mr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1265494248\hyph-mul-ethi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1265494248\hyph-cs.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1265494248\hyph-de-ch-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1265494248\hyph-lv.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1265494248\hyph-nl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1265494248\hyph-pt.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_745243805\_platform_specific\win_x64\widevinecdm.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1265494248\hyph-as.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1265494248\hyph-da.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1265494248\hyph-eu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_745243805\_platform_specific\win_x64\widevinecdm.dll.sig	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_745243805\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1265494248\hyph-hi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1265494248\hyph-or.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1265494248\hyph-und-ethi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1265494248\hyph-ka.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1265494248\hyph-te.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1265494248\hyph-af.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1265494248\hyph-fr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1265494248\hyph-gl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1265494248\hyph-hu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1265494248\hyph-sl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1265494248\hyph-ta.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1265494248\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1265494248\hyph-et.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1265494248\hyph-kn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1265494248\hyph-cu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1265494248\hyph-cy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1265494248\hyph-de-1996.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1265494248\hyph-en-us.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1265494248\hyph-gu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1265494248\hyph-sk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_745243805\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_745243805\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1265494248\hyph-lt.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1265494248\hyph-la.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1265494248\hyph-mn-cyrl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1265494248\hyph-nn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1265494248\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1265494248\hyph-be.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1265494248\hyph-de-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1265494248\hyph-ru.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1251838627\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1265494248\hyph-bn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1265494248\hyph-it.hyb	msedgewebview2.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
5328	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4240	powershell.exe
1296	powershell.exe
556	powershell.exe

Executes a command shell one-liner 1 TTPs 18 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4468	cmd.exe
3060	cmd.exe
2808	cmd.exe
4144	cmd.exe
2560	cmd.exe
4828	cmd.exe
3580	cmd.exe
5100	cmd.exe
1564	cmd.exe
4128	cmd.exe
4264	cmd.exe
3504	cmd.exe
3260	cmd.exe
5892	cmd.exe
4556	cmd.exe
3884	cmd.exe
2892	cmd.exe
1468	cmd.exe

System Network Connections Discovery 1 TTPs 18 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
1912	NETSTAT.EXE
2716	NETSTAT.EXE
3780	NETSTAT.EXE
1564	cmd.exe
1468	cmd.exe
4128	cmd.exe
2808	cmd.exe
5892	cmd.exe
4608	NETSTAT.EXE
4264	cmd.exe
3260	cmd.exe
1868	NETSTAT.EXE
920	NETSTAT.EXE
700	NETSTAT.EXE
4308	NETSTAT.EXE
3504	cmd.exe
3092	NETSTAT.EXE
2892	cmd.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Gathers network information 2 TTPs 9 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2716	NETSTAT.EXE
3780	NETSTAT.EXE
1868	NETSTAT.EXE
1912	NETSTAT.EXE
4608	NETSTAT.EXE
920	NETSTAT.EXE
4308	NETSTAT.EXE
3092	NETSTAT.EXE
700	NETSTAT.EXE

Modifies system certificate store 2 TTPs 4 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	AlphaAI.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	AlphaAI.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 6b0000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	AlphaAI.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800001900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d578112866b0000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef4200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	AlphaAI.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
4240	powershell.exe
4240	powershell.exe
4240	powershell.exe
1296	powershell.exe
1296	powershell.exe
1296	powershell.exe
5328	powershell.exe
5328	powershell.exe
5328	powershell.exe
5328	powershell.exe
556	powershell.exe
556	powershell.exe
556	powershell.exe
3688	msedgewebview2.exe
3688	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
6068	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	4240	powershell.exe
Token: SeDebugPrivilege	1296	powershell.exe
Token: SeDebugPrivilege	5328	powershell.exe
Token: SeDebugPrivilege	556	powershell.exe
Token: SeDebugPrivilege	1912	NETSTAT.EXE
Token: SeDebugPrivilege	4608	NETSTAT.EXE
Token: SeDebugPrivilege	920	NETSTAT.EXE
Token: SeDebugPrivilege	4308	NETSTAT.EXE
Token: SeDebugPrivilege	700	NETSTAT.EXE
Token: SeDebugPrivilege	2716	NETSTAT.EXE
Token: SeDebugPrivilege	3780	NETSTAT.EXE
Token: SeDebugPrivilege	1868	NETSTAT.EXE
Token: SeDebugPrivilege	3092	NETSTAT.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5612	AlphaAI.exe
5612	AlphaAI.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
5612	AlphaAI.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 5612 wrote to memory of 4556	5612	AlphaAI.exe	89
PID 4556 wrote to memory of 4128	4556	cmd.exe	91
PID 5612 wrote to memory of 6068	5612	AlphaAI.exe	92
PID 6068 wrote to memory of 4252	6068	msedgewebview2.exe	93
PID 6068 wrote to memory of 4208	6068	msedgewebview2.exe	94
PID 6068 wrote to memory of 4208	6068	msedgewebview2.exe	94
PID 6068 wrote to memory of 4208	6068	msedgewebview2.exe	94
PID 6068 wrote to memory of 4208	6068	msedgewebview2.exe	94
PID 6068 wrote to memory of 1136	6068	msedgewebview2.exe	95
PID 6068 wrote to memory of 3044	6068	msedgewebview2.exe	96
PID 6068 wrote to memory of 3044	6068	msedgewebview2.exe	96
PID 6068 wrote to memory of 3044	6068	msedgewebview2.exe	96
PID 6068 wrote to memory of 4148	6068	msedgewebview2.exe	97
PID 6068 wrote to memory of 4148	6068	msedgewebview2.exe	97
PID 6068 wrote to memory of 4148	6068	msedgewebview2.exe	97
PID 6068 wrote to memory of 4148	6068	msedgewebview2.exe	97
PID 6068 wrote to memory of 4148	6068	msedgewebview2.exe	97
PID 5612 wrote to memory of 2560	5612	AlphaAI.exe	98
PID 5612 wrote to memory of 3884	5612	AlphaAI.exe	100
PID 2560 wrote to memory of 4240	2560	cmd.exe	102
PID 3884 wrote to memory of 1296	3884	cmd.exe	103
PID 5612 wrote to memory of 4828	5612	AlphaAI.exe	104
PID 5612 wrote to memory of 3580	5612	AlphaAI.exe	106
PID 3580 wrote to memory of 5568	3580	cmd.exe	108
PID 5612 wrote to memory of 5328	5612	AlphaAI.exe	109
PID 5612 wrote to memory of 556	5612	AlphaAI.exe	111
PID 5612 wrote to memory of 2892	5612	AlphaAI.exe	113
PID 2892 wrote to memory of 1912	2892	cmd.exe	115
PID 5612 wrote to memory of 1564	5612	AlphaAI.exe	117
PID 5612 wrote to memory of 1468	5612	AlphaAI.exe	118
PID 1468 wrote to memory of 4608	1468	cmd.exe	121
PID 1564 wrote to memory of 920	1564	cmd.exe	122
PID 5612 wrote to memory of 5100	5612	AlphaAI.exe	123
PID 5100 wrote to memory of 5644	5100	cmd.exe	125
PID 5612 wrote to memory of 4264	5612	AlphaAI.exe	128
PID 5612 wrote to memory of 4128	5612	AlphaAI.exe	129
PID 4264 wrote to memory of 4308	4264	cmd.exe	132
PID 4128 wrote to memory of 700	4128	cmd.exe	133
PID 5612 wrote to memory of 4468	5612	AlphaAI.exe	134
PID 4468 wrote to memory of 1780	4468	cmd.exe	136
PID 6068 wrote to memory of 1404	6068	msedgewebview2.exe	137
PID 6068 wrote to memory of 1404	6068	msedgewebview2.exe	137
PID 6068 wrote to memory of 1404	6068	msedgewebview2.exe	137
PID 5612 wrote to memory of 3504	5612	AlphaAI.exe	138
PID 5612 wrote to memory of 3260	5612	AlphaAI.exe	139
PID 3260 wrote to memory of 2716	3260	cmd.exe	142
PID 3504 wrote to memory of 3780	3504	cmd.exe	143
PID 5612 wrote to memory of 3060	5612	AlphaAI.exe	144
PID 3060 wrote to memory of 6004	3060	cmd.exe	146
PID 6068 wrote to memory of 1684	6068	msedgewebview2.exe	147
PID 6068 wrote to memory of 1684	6068	msedgewebview2.exe	147
PID 6068 wrote to memory of 1684	6068	msedgewebview2.exe	147
PID 6068 wrote to memory of 3688	6068	msedgewebview2.exe	148
PID 5612 wrote to memory of 2808	5612	AlphaAI.exe	149
PID 5612 wrote to memory of 5892	5612	AlphaAI.exe	150
PID 2808 wrote to memory of 1868	2808	cmd.exe	153
PID 5892 wrote to memory of 3092	5892	cmd.exe	154
PID 5612 wrote to memory of 4144	5612	AlphaAI.exe	155
PID 4144 wrote to memory of 1720	4144	cmd.exe	157
PID 6068 wrote to memory of 4120	6068	msedgewebview2.exe	158
PID 6068 wrote to memory of 4120	6068	msedgewebview2.exe	158
PID 6068 wrote to memory of 4120	6068	msedgewebview2.exe	158

C:\Users\Admin\AppData\Local\Temp\AlphaAI.exe
"C:\Users\Admin\AppData\Local\Temp\AlphaAI.exe"
1⤵
- Checks whether UAC is enabled
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5612
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /C where uv
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4556
- - C:\Windows\System32\where.exe
    where uv
    3⤵
    PID:4128
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=AlphaAI.exe --webview-exe-version=0.0.50 --user-data-dir="C:\Users\Admin\AppData\Local\cn.alphalawyer.gptclaw\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=5612.4600.6605396113136229893 /pfhostedapp:125bc60092726163af858670902eeda269f720df
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:6068
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\cn.alphalawyer.gptclaw\EBWebView /prefetch:4 /pfhostedapp:125bc60092726163af858670902eeda269f720df --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\cn.alphalawyer.gptclaw\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ff864e75fd8,0x7ff864e75fe4,0x7ff864e75ff0
    3⤵
    PID:4252
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\cn.alphalawyer.gptclaw\EBWebView" --webview-exe-name=AlphaAI.exe --webview-exe-version=0.0.50 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1740 --field-trial-handle=1744,i,923311775898149149,8685920536140984706,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:125bc60092726163af858670902eeda269f720df
    3⤵
    PID:4208
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\cn.alphalawyer.gptclaw\EBWebView" --webview-exe-name=AlphaAI.exe --webview-exe-version=0.0.50 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2064 --field-trial-handle=1744,i,923311775898149149,8685920536140984706,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:125bc60092726163af858670902eeda269f720df
    3⤵
    PID:1136
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\cn.alphalawyer.gptclaw\EBWebView" --webview-exe-name=AlphaAI.exe --webview-exe-version=0.0.50 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2300 --field-trial-handle=1744,i,923311775898149149,8685920536140984706,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:125bc60092726163af858670902eeda269f720df
    3⤵
    PID:3044
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\cn.alphalawyer.gptclaw\EBWebView" --webview-exe-name=AlphaAI.exe --webview-exe-version=0.0.50 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3396 --field-trial-handle=1744,i,923311775898149149,8685920536140984706,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:125bc60092726163af858670902eeda269f720df /prefetch:1
    3⤵
    PID:4148
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\cn.alphalawyer.gptclaw\EBWebView" --webview-exe-name=AlphaAI.exe --webview-exe-version=0.0.50 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4404 --field-trial-handle=1744,i,923311775898149149,8685920536140984706,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:125bc60092726163af858670902eeda269f720df
    3⤵
    PID:1404
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\cn.alphalawyer.gptclaw\EBWebView" --webview-exe-name=AlphaAI.exe --webview-exe-version=0.0.50 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4424 --field-trial-handle=1744,i,923311775898149149,8685920536140984706,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:125bc60092726163af858670902eeda269f720df
    3⤵
    PID:1684
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\cn.alphalawyer.gptclaw\EBWebView" --webview-exe-name=AlphaAI.exe --webview-exe-version=0.0.50 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4400 --field-trial-handle=1744,i,923311775898149149,8685920536140984706,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:125bc60092726163af858670902eeda269f720df
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3688
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\cn.alphalawyer.gptclaw\EBWebView" --webview-exe-name=AlphaAI.exe --webview-exe-version=0.0.50 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=3944 --field-trial-handle=1744,i,923311775898149149,8685920536140984706,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:125bc60092726163af858670902eeda269f720df
    3⤵
    PID:4120
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /C "powershell -NoProfile -Command \"(Get-CimInstance Win32_OperatingSystem).Version\""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2560
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command \"(Get-CimInstance Win32_OperatingSystem).Version\"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4240
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /C "powershell -NoProfile -Command \"(Get-CimInstance Win32_OperatingSystem).Version\""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3884
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command \"(Get-CimInstance Win32_OperatingSystem).Version\"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1296
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /C node --version
  2⤵
  - Executes a command shell one-liner
  PID:4828
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /C where uv
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3580
- - C:\Windows\System32\where.exe
    where uv
    3⤵
    PID:5568
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -Command "Get-Process -Name uv -ErrorAction SilentlyContinue | Stop-Process -Force -ErrorAction SilentlyContinue"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5328
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -File C:\Users\Admin\.openclaw-alphaclaw\temp\install_uv_python_offline-db258de6-install.ps1
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:556
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /C netstat -ano
  2⤵
  - Executes a command shell one-liner
  - System Network Connections Discovery
  - Suspicious use of WriteProcessMemory
  PID:2892
- - C:\Windows\System32\NETSTAT.EXE
    netstat -ano
    3⤵
    - System Network Connections Discovery
    - Gathers network information
    - Suspicious use of AdjustPrivilegeToken
    PID:1912
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /C netstat -ano
  2⤵
  - Executes a command shell one-liner
  - System Network Connections Discovery
  - Suspicious use of WriteProcessMemory
  PID:1564
- - C:\Windows\System32\NETSTAT.EXE
    netstat -ano
    3⤵
    - System Network Connections Discovery
    - Gathers network information
    - Suspicious use of AdjustPrivilegeToken
    PID:920
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /C netstat -ano
  2⤵
  - Executes a command shell one-liner
  - System Network Connections Discovery
  - Suspicious use of WriteProcessMemory
  PID:1468
- - C:\Windows\System32\NETSTAT.EXE
    netstat -ano
    3⤵
    - System Network Connections Discovery
    - Gathers network information
    - Suspicious use of AdjustPrivilegeToken
    PID:4608
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /C where uv
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5100
- - C:\Windows\System32\where.exe
    where uv
    3⤵
    PID:5644
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /C netstat -ano
  2⤵
  - Executes a command shell one-liner
  - System Network Connections Discovery
  - Suspicious use of WriteProcessMemory
  PID:4264
- - C:\Windows\System32\NETSTAT.EXE
    netstat -ano
    3⤵
    - System Network Connections Discovery
    - Gathers network information
    - Suspicious use of AdjustPrivilegeToken
    PID:4308
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /C netstat -ano
  2⤵
  - Executes a command shell one-liner
  - System Network Connections Discovery
  - Suspicious use of WriteProcessMemory
  PID:4128
- - C:\Windows\System32\NETSTAT.EXE
    netstat -ano
    3⤵
    - System Network Connections Discovery
    - Gathers network information
    - Suspicious use of AdjustPrivilegeToken
    PID:700
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /C where uv
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4468
- - C:\Windows\System32\where.exe
    where uv
    3⤵
    PID:1780
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /C netstat -ano
  2⤵
  - Executes a command shell one-liner
  - System Network Connections Discovery
  - Suspicious use of WriteProcessMemory
  PID:3504
- - C:\Windows\System32\NETSTAT.EXE
    netstat -ano
    3⤵
    - System Network Connections Discovery
    - Gathers network information
    - Suspicious use of AdjustPrivilegeToken
    PID:3780
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /C netstat -ano
  2⤵
  - Executes a command shell one-liner
  - System Network Connections Discovery
  - Suspicious use of WriteProcessMemory
  PID:3260
- - C:\Windows\System32\NETSTAT.EXE
    netstat -ano
    3⤵
    - System Network Connections Discovery
    - Gathers network information
    - Suspicious use of AdjustPrivilegeToken
    PID:2716
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /C where uv
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3060
- - C:\Windows\System32\where.exe
    where uv
    3⤵
    PID:6004
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /C netstat -ano
  2⤵
  - Executes a command shell one-liner
  - System Network Connections Discovery
  - Suspicious use of WriteProcessMemory
  PID:2808
- - C:\Windows\System32\NETSTAT.EXE
    netstat -ano
    3⤵
    - System Network Connections Discovery
    - Gathers network information
    - Suspicious use of AdjustPrivilegeToken
    PID:1868
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /C netstat -ano
  2⤵
  - Executes a command shell one-liner
  - System Network Connections Discovery
  - Suspicious use of WriteProcessMemory
  PID:5892
- - C:\Windows\System32\NETSTAT.EXE
    netstat -ano
    3⤵
    - System Network Connections Discovery
    - Gathers network information
    - Suspicious use of AdjustPrivilegeToken
    PID:3092
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /C where uv
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4144
- - C:\Windows\System32\where.exe
    where uv
    3⤵
    PID:1720

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LICENSE

Path C:\Users\Admin\.openclaw-alphaclaw\__tmp_extract__\node-v22.22.2-win-x64\node_modules\npm\node_modules\@sigstore\tuf\LICENSE
Size 11KB
SHA256 7b0ce3425a26fdba501cb13508af096ade77e4036dd2bd8849031ddecf64f7c9
MD5 dfc1b916d4555a69859202f8bd8ad40c
SHA1 fc22b6ee39814d22e77fe6386c883a58ecac6465
SHA512 1fbe6bb1f60c8932e4dcb927fc8c8131b9c73afd824ecbabc2045e7af07b35a4155a0f8ad3103bf25f192b6d59282bfc927aead3cb7aaeb954e1b6dbd68369fa
SSDEEP 192:qf9qG4QSAVOSbwF1wOFXuFJyQtxmG3ep/7rlzKfHbxc+Xq0rhlkT8cHfH2:kOu9b01DY/rGBt+dc+aclkT8cH+
TLSH
T1B932722BBA4903771AF20162AB4764CEF31EA03F37591525315CC1682F7B96183FB69E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

shared.types.js

Path C:\Users\Admin\.openclaw-alphaclaw\__tmp_extract__\node-v22.22.2-win-x64\node_modules\npm\node_modules\@sigstore\verify\dist\shared.types.js
Size 79B
SHA256 ef1f170ad28f2d870a474d2f96ae353d770fff5f20e642cd8f9b6f1d7742df13
MD5 24563705cc4bb54fccd88e52bc96c711
SHA1 871fa42907b821246de04785a532297500372fc7
SHA512 2ce8d2cf580623358fef5f4f8925d0c9943a657c2503c80048ca789bf16eacdb980bfc8aaaa50101a738e939926fcf2545500484dcad782c700ee206d8c6f9b9
TLSH
T1C4A01201A934C5F1038000C44525E0C1A0C10432006528A55BA84D65440088C5050001
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\.openclaw-alphaclaw\__tmp_extract__\node-v22.22.2-win-x64\node_modules\npm\node_modules\bin-links\LICENSE
Size 754B
SHA256 45e433413760dc3ae8169be5ed9c2c77adc31ad4d1bc5a28939576df240f29a0
MD5 d2cf52aa43e18fdc87562d4c1303f46a
SHA1 58fb4a65fffb438630351e7cafd322579817e5e1
SHA512 54e33d7998b5e9ba76b2c852b4d0493ebb1b1ee3db777c97e6606655325ff66124a0c0857ca4d62de96350dbaee8d20604ec22b0edc17b472086da4babbbcb16
TLSH
T1DC01208FB2E52AD454D19BA53DA1EC8961C9F0773D43AA0430B4E34CCBB780F98AB404
MD5 SHA1 SHA512 TLSH

Submit Download

license

Path C:\Users\Admin\.openclaw-alphaclaw\__tmp_extract__\node-v22.22.2-win-x64\node_modules\npm\node_modules\chalk\license
Size 1KB
SHA256 fcf1a18be2e25ba82acf2c59821b030d8ee764e4e201db6ef3c51900d385515f
MD5 b862aeb7e1d01452e0f07403591e5a55
SHA1 b8765be74fea9525d978661759be8c11bab5e60e
SHA512 885369fe9b8cb0af1107ee92b52c6a353da7cf75bc86abb622e2b637c81e9c5ffe36b0ac74e11cfb66a7a126b606fe7a27e91f3f4338954c847ed2280af76a5f
TLSH
T1A821961E72551363186613E069A9ACC5B32BB11F7DAF5684286DF248633746CD4FB844
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\.openclaw-alphaclaw\__tmp_extract__\node-v22.22.2-win-x64\node_modules\npm\node_modules\ini\LICENSE
Size 780B
SHA256 3f24d692d165989cd9a00fe35ca15a2bc6859e3361fa42aa20babd435f2e4706
MD5 b020de8f88eacc104c21d6e6cacc636d
SHA1 20b35e641e3a5ea25f012e13d69fab37e3d68d6b
SHA512 4220617e29dd755ad592295bc074d6bc14d44a1feeed5101129669f3ecf0e34eaa4c7c96bbc83da7352631fa262baab45d4a370dad7dabec52b66f1720c28e38
TLSH
T1D501418FB2A12A8414D09B643DA1EC8971C9F03B3C43AA153074E258C7BB80F947A400
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Users\Admin\.openclaw-alphaclaw\__tmp_extract__\node-v22.22.2-win-x64\node_modules\npm\node_modules\jackspeak\dist\commonjs\package.json
Size 28B
SHA256 58b55392b5778941e1e96892a70edc12e2d7bb8541289b237fbddc9926ed51bd
MD5 56368b3e2b84dac2c9ed38b5c4329ec2
SHA1 f67c4acef5973c256c47998b20b5165ab7629ed4
SHA512 d662bff3885118e607079fcbeedb27368589bc0ee89f90b9281723fa08bda65e5a08d9640da188773193c0076ec0a5c92624673a6a961490be163e2553d6f482
MD5 SHA1 SHA512

Submit Download

package.json

Path C:\Users\Admin\.openclaw-alphaclaw\__tmp_extract__\node-v22.22.2-win-x64\node_modules\npm\node_modules\jackspeak\dist\esm\package.json
Size 26B
SHA256 1bf0e53fc74b05f1aade7451fbac72f1944b067d4229d96bae7a225519a250e4
MD5 2324363c71f28a5b7e946a38dc2d9293
SHA1 7eda542849fb3a4a7b4ba8a7745887adcade1673
SHA512 7437cf8f337d2562a4046246fbfcc5e9949f475a1435e94efbc4b6a55880050077d72692cbc3413e0ccd8f36adf9956a6cc633a2adc85fbff6c4aa2b8edac677
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Users\Admin\.openclaw-alphaclaw\__tmp_extract__\node-v22.22.2-win-x64\node_modules\npm\node_modules\libnpmsearch\LICENSE
Size 730B
SHA256 2ef361317adeda98117f14c5110182c28eae233af1f7050c83d4396961d14013
MD5 072ac9ab0c4667f8f876becedfe10ee0
SHA1 0227492dcdc7fb8de1d14f9d3421c333230cf8fe
SHA512 f38fd6506bd9795bb27d31f1ce38b08c9e6f1689c34fca90e9e1d5194fa064d1f34a9c51d15941506ebbbcd6d4193055e9664892521b7e39ebcd61c3b6f25013
TLSH
T1C001D08FA2D12AD454D59F643DA1BD4861C9F17B7D43AB043074E358DB7744F986A404
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.md

Path C:\Users\Admin\.openclaw-alphaclaw\__tmp_extract__\node-v22.22.2-win-x64\node_modules\npm\node_modules\npm-profile\LICENSE.md
Size 818B
SHA256 733dcbf5b1c95dc765b76db969b998ce0cbb26f01be2e55e7bccd6c7af29cb04
MD5 2916d8b51a5cc0a350d64389bc07aef6
SHA1 c9d5ac416c1dd7945651bee712dbed4d158d09e1
SHA512 508c5d1842968c478e6b42b94e04e0b53a342dfaf52d55882fdcfe02c98186e9701983ab5e9726259fba8336282e20126c70d04fc57964027586a40e96c56b74
TLSH
T14301128A62E62A9055D19F956DA2B89E61CCF0673903681430B4E24CDA7704AC07E414
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\.openclaw-alphaclaw\__tmp_extract__\node-v22.22.2-win-x64\node_modules\npm\node_modules\promise-call-limit\LICENSE
Size 763B
SHA256 1fccd0ad2e7e0e31ddfadeaf0660d7318947b425324645aa85afd7227cab52d7
MD5 7428aa9f83c500c4a434f8848ee23851
SHA1 166b3e1c1b7d7cb7b070108876492529f546219f
SHA512 c7f01de85f0660560206784cdf159b2bdc5f1bc87131f5a8edf384eba47a113005491520b0a25d3cc425985b5def7b189e18ff76d7d562c434dc5d8c82e90cce
TLSH
T14701F18FB2A16A9454D19B653DA1ED8961CDF0373D43AA143075E258C77780FA46A404
MD5 SHA1 SHA512 TLSH

Submit Download

license

Path C:\Users\Admin\.openclaw-alphaclaw\__tmp_extract__\node-v22.22.2-win-x64\node_modules\npm\node_modules\shebang-regex\license
Size 1KB
SHA256 67292c32894c8ac99db06ffa1cb8e9a5171ef988120723ebe673bf76712260ec
MD5 5ad87d95c13094fa67f25442ff521efd
SHA1 01f1438a98e1b796e05a74131e6bb9d66c9e8542
SHA512 7187720ccd335a10c9698f8493d6caa2d404e7b21731009de5f0da51ad5b9604645fbf4bc640aa94513b9eb372aa6a31df2467198989234bc2afbce87f76fbc3
TLSH
T18521961D72551363186613A069A9ACC5B32BB11F7DAF5684286DF248633746CD4FB844
MD5 SHA1 SHA512 TLSH

Submit Download

RGI_Emoji.js

Path C:\Users\Admin\.openclaw-alphaclaw\__tmp_extract__\node-v22.22.2-win-x64\node_modules\npm\node_modules\wrap-ansi\node_modules\emoji-regex\RGI_Emoji.js
Size 12KB
SHA256 de04908dc7f8e992e649e317d2b72108d0c20f622647e33170237b6d3afd2372
MD5 dc07d6e3b5be4a8fe3c570b22c3a4671
SHA1 6a6195959560f0cd732bcd7cd119b87132a9b670
SHA512 ad3c9eade92a6e1913dacf6f19866f58618030e3f862ed58cf2a225f770a8894ec8af3e9ed38e317316be638df2502ceef0b53c44539d12eb76cc4be22675903
SSDEEP 96:49tOjllm4Uh4zutkZyhRA4JUraRFsw7ZpqsFRatj9Fnkz+jmS0WVJK4m1io++Qd6:4bzTgMU4GgawCZleP
TLSH
T171428CB085217E6274A2001B5D541B1FF0ACA54BE962EF37979CF19EB345231CAD36F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RGI_Emoji.js

Path C:\Users\Admin\.openclaw-alphaclaw\__tmp_extract__\node-v22.22.2-win-x64\node_modules\npm\node_modules\wrap-ansi\node_modules\emoji-regex\es2015\RGI_Emoji.js
Size 13KB
SHA256 74839f673bb72c8ae55ce2c844a832e75c7b14b244c9181e446b6b00485b458e
MD5 bb5cc58d6a908fba4c33adc7437e858b
SHA1 a87a9b7bcbb25d5b8328aebf05979c2ea45bb02c
SHA512 fe69afde16b9269e48529046e7c546a98286a3c4a0bba463a30c63905ac3c6e71ba4ad426a554bb0f45bd7777f08d0a7434912dd40b9aab47eb4dc957b84d3e0
SSDEEP 192:4uyCa20qNgG/kFBEKT4BlvFuTMS8Z4wZQZotVNZl8b2vKO9XuLYRfTAkCwtU1kI9:4ng4LYVNn8b8K+eLWD7GxuM
TLSH
T1925292BC018846973D2DE0D4AF64EAD6299D4B4A240CD3365F8BFC3726CA4F4ED994E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

download-manager.log

Path C:\Users\Admin\.openclaw-alphaclaw\logs\download-manager.log
Size 1KB
SHA256 e2591465b9047ceed35bbeb2c7d4fceb00b638197fc52dae49b77114ac92ceae
MD5 7a67fe9493b21ec1e2915c940d66fef3
SHA1 d801bdccb2dc99bef0a1563493b7d12ceb0ffbf5
SHA512 903b7b6c060da347fedc20f6efc9da7fb6f2cc3b2aee3afcc3319ca4a757e8d673e76a1566943f077434690df1852b864ab9bb76c6b1ffa85d17171094afab57
TLSH
T1ED1102545BD90074FB56CCEC69314F058162AB03ED0254047A6117C00CB3422DEB7E0C
MD5 SHA1 SHA512 TLSH

Submit Download

download-manager.log

Path C:\Users\Admin\.openclaw-alphaclaw\logs\download-manager.log
Size 15KB
SHA256 53732c5493428281ec66cc5af9cff70a32a2f015eea97009d1964ac551bbe859
MD5 e8996aaf15fc44fa2914c0eb30b52722
SHA1 138b1a7b8dc9d9a80404a419ddbec483b3f77152
SHA512 28d8361201bf0dd94efceab7a394c6d73626bf3bfa398d3e9283225ff7035d6f97927079ecf017a07c33c44a7c0e4d7946db05982ef8bf9e05ee873446e1ead2
SSDEEP 192:mGAL9DDKOpFB35LBxBknpAQaq2EUZFmV6Tz/7/:mNgkX3xynp/y/
TLSH
T1A67277D89CEC15774B079F2DA8279F081085B3BFC988FC289A6150E96DE9C7ACDD0C59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

install_uv_python_offline-db258de6-install.ps1

Path C:\Users\Admin\.openclaw-alphaclaw\temp\install_uv_python_offline-db258de6-install.ps1
Size 12KB
SHA256 f8e6a279cb0fa33da9c7ea5ca369c7d90bce752f2525ad87958311d76aa3d283
MD5 e7a2c6a7e448137a29d4ce89c9c411d0
SHA1 f0e74e757b4b29d4b6e4aa477bc672466d449a5f
SHA512 c63ccafab97de914be96e7eb35c65e921f97bdb299a803b8cfc146911e1d4a1c35f17b49ca07d33bbde67772348971758548ba06f464a04d3c806ef68e1f667e
SSDEEP 192:dSCFDLa4FYMhmUG2XTH9aQXclHlQu+FHZQabzziKRXTj0iYtqo1X11ZfoA9SNFpv:dSCFS4FYMhmRe9E+V3RfWsTo+
TLSH
T14042751936D9D0756986232E48DE1009376682DB84068A68BDFD53C0BFB753E87F07BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 b3a033bc9967f667e05c806a479d9fd9632c228ffaa4e9626a9ecb9147cc127d
MD5 d66598884abd76ff8bcdcd4350c33525
SHA1 004e70032a4bda2b9cec8b749ad4de1002e6fb48
SHA512 033f0cb4619de7ca61534a441ed24c056cba10b446789e7e301aa184a2a13a70120b514c0cfb071f8653c47dd8112d57ff47d1b2b68ffa24dc9ae93fe1b331f9
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
MD5 446dd1cf97eaba21cf14d03aebc79f27
SHA1 36e4cc7367e0c7b40f4a8ace272941ea46373799
SHA512 a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b7d2ecc082c7fe8d939d3d6a7b128a70e60fd1e65219902359b3042d85f19f60
MD5 fb1ff22097c5763fce68ea452f7e1443
SHA1 df38dfbab1bd3a756afb576d20c628f5c76d6b72
SHA512 1035f9df6fb81fba8ff798017799aaf5121e459c153676778ce8508c709edc75cdbd906c45631a087cb3ae610a6bb92404ec952f531485b390951b9ce8e7de84
TLSH
T14B115733F3CC8664C89A413650CAAC1036B687DB509EDE9BBB84D155A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_t1b0ommv.mbv.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_t1b0ommv.mbv.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\cn.alphalawyer.gptclaw\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 06e21e0077a3f8d94681f607abe1ddc569da9878610b391fdb553a24618d6745
MD5 56d3d15bc3f243975695066968ea2db0
SHA1 e32d5e83f584072043be749e95bb96a3d2869835
SHA512 7d8f606159b96214f027a295c32b1e148f6a7599cc7557d68790a010a5f5b7acc1f412ef20f0e3fe5ab7e74144c79e08146a95fdba88a4ec92f3829ac53ef11b
TLSH
T198D012123342813DC01062730E07A14C1400C10B41098115942E851D1E044541D13491
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\cn.alphalawyer.gptclaw\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 90170da95798dbc30781e8df508d024b98ed3e60bd176e943e2bfefd841c69ea
MD5 31601cbe5d86ec2d539ff22e0b26077d
SHA1 5367b40189e3c80bfb513a7219d6e1cb0a0e1e7f
SHA512 15879b84ce2ba5908310fec5c141e3a972e299d5afebba330e0c512fb7005863b0fd018d7c6f3f541941a903df9c0b93ca41023344564bfbaef697e9d54192ca
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\cn.alphalawyer.gptclaw\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

9f1955a9-2a5c-44ff-aa88-4f82c8184580.tmp

Path C:\Users\Admin\AppData\Local\cn.alphalawyer.gptclaw\EBWebView\Default\9f1955a9-2a5c-44ff-aa88-4f82c8184580.tmp
Size 6KB
SHA256 31dac5dd605d5288d2d9a78d9f2e7d65124d2e5f9f9fd25af63bea3917ab974c
MD5 420ea558cdb4145129d444b00a06de8e
SHA1 e02971d34b37f5c0565d539b4a72ee46283574fc
SHA512 f3e75b00b629156c44b97fced2cab5d8a757b771878e7e9a90ad4fa7713fb16e64f482f48d2f0a460c6318f49399ee9ca49f661ef37beac951db4494e7d164b3
SSDEEP 96:ste/dJP16b9jk+9o5h16Zsss7/x+6Mhmuec9/U1ejeDK+gS+28XM1C7K:stmLKBoDssV+FB/UQjZA+G6K
TLSH
T18ED1C6015E68797B4CCBF14DFA29BA47E2F5607264D52E58EBF8462C08DB6CC6307907
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\cn.alphalawyer.gptclaw\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 336B
SHA256 5c05562887cd3b2d4d913cfc22a49e13af23afe436359d7c2742aa3110e080af
MD5 7d47c4d63e577229b94f45920590dd2d
SHA1 24fbef272063f783fa4fdaa73c3314424a5f6d59
SHA512 5f392e82daea9416f5d30278a408910d1332960202bb9414bb429de9b454eb261c477aeee4396939ea8f7385ad2b406461ef692753ec2f251d27d5503797866d
TLSH
T140E0A93B04808EC6CF0B43F000DA0698B0B007F138931DC7C46AA2B0ACA23AEB90A801
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5982c3.TMP

Path C:\Users\Admin\AppData\Local\cn.alphalawyer.gptclaw\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5982c3.TMP
Size 48B
SHA256 22be60e40f525b36bfd5be54ec2212918da37883cc4254e0fcb860a54048222b
MD5 dabd4459cc5d9bc4cefce7ffdc5e6d9b
SHA1 7a63e67c3cdaa1a322b753f3d3c49d4d936b73a3
SHA512 be402538adad1906a6d33684f97854d166dca8fcbc7b477ae2c4912f8eb27c1d98f7d3cde15b96153b53ba6f11cb430725bdea1448634651dfebc3d431a911b8
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\cn.alphalawyer.gptclaw\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\cn.alphalawyer.gptclaw\EBWebView\Default\Network\Network Persistent State
Size 377B
SHA256 b73dbda698fd9a6cd1d76e26f51c571d187434ddaee3747a4a28471bf5959528
MD5 a780ec0aa9398ea7a10956f7f757e05c
SHA1 198a62b0de28babb8e361ad825d1f259011c08c2
SHA512 a2c5b65eb94aa9737163946176aaa56ff2b2b3aaf898fa97995403a8adc381b1c6646b46a09afa97b7ffd7f5896e1842a8b2cc6d1bae3a2e16b3f1c9b0f39a61
TLSH
T133E02366A3704D7F8BD542785A14FD1FDF5611110B2C1D1B85607B9182D1495D110917
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a3181.TMP

Path C:\Users\Admin\AppData\Local\cn.alphalawyer.gptclaw\EBWebView\Default\Network\Network Persistent State~RFe5a3181.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\cn.alphalawyer.gptclaw\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\cn.alphalawyer.gptclaw\EBWebView\Default\Preferences
Size 6KB
SHA256 b952bb8e5bdcc43ef46e38b4f903b26f37f73f58785955b87eeae3215396b8a5
MD5 c80c9331bf7a71c6a724c0bb2b8dd1a7
SHA1 b3f4407fc2e7db17ae185b0083c507d28a0b3b9f
SHA512 e969044691e7c2072213382e4feeb832204a9763e44f56942bc36e49f17af0b17c563806d6d3be052b45dd2bd360604e7aa6b4c9ba0cc85b3ade6e6dcab87f37
SSDEEP 96:ste/dJPcG6b9jk+9o5h16Zsss7/x+6Mhmuec9/U1ejeDK+gj+28XM1C7K:stmLkBoDssV+FB/UQjZV+G6K
TLSH
T11FD1D5025E64797B4CCBF14DFA29BA47E2F4607264D42E18EBF8452C08EB6CC630790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\cn.alphalawyer.gptclaw\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\cn.alphalawyer.gptclaw\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\cn.alphalawyer.gptclaw\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\cn.alphalawyer.gptclaw\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\cn.alphalawyer.gptclaw\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\cn.alphalawyer.gptclaw\EBWebView\Local State
Size 15KB
SHA256 8d81e0e47444a76ee5bd56ead84ba4f91f65f5b0ac553605d6862aa602573acc
MD5 f2d3ea8c94c508a3a47e968d4a403561
SHA1 7a8a3f11c2b09557a59b2dc835ecbfa21c1587a0
SHA512 2f1ada0553ea47edf546bf90191fbe50bef663db3beca8704044c01f5a52e0724f1456575c59457b192f6096ff93d8cc43ddec827f36f845394af958cbd4e7d5
SSDEEP 384:E+aQikB+z/xvxjg/qhEwNBSttzv5kdd65e9z0:j/UxvxjgC+lJRkr6QF0
TLSH
T127729E2B99B97E2395F7F505790E0B8FCBB884B2A1817A780DA96F0C06C72981342D13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\cn.alphalawyer.gptclaw\EBWebView\Local State
Size 2KB
SHA256 c392517703abbb61c2ee7c3a592569c3448695cfec701a771eb31c2a73e25410
MD5 4930467064f5e9a67e2221c91418d4d0
SHA1 d2a1676d7c192ddb264161c4f7bbcea714791123
SHA512 f0bf0a08e8ea12666c58eb0b6259803e7ac95e992e967c5568bf05faf466a041fed71ade3ab8be7f55fc458e2314addbfe11914550db93cc3361e4e2ab4fd66b
TLSH
T1A15195737D54AB3789E29689B80B3F67DE3580E2E6522F609AEC1B1C00D765D6342C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\cn.alphalawyer.gptclaw\EBWebView\Local State
Size 3KB
SHA256 e57b88a190a9845c62a73b120504ad390552c10702e1e8d64ad910e477d41636
MD5 17cd4b111ab57c783a55fddca9e4757f
SHA1 aa314dddd6ddca3b08b69fc1825e96a5300dcc1c
SHA512 725ddea774a02bc3a2831511a4b5d254155a37cff8574e048fba43f268162140725757c5e768895d9ddf5b191acd0ac9d6dfd838283e3ec2c352b000d71a11b0
TLSH
T1F76196366DB4AA274DF3DA45B84A3F1AA7618063E5813FA5CAEC1F0C01D73981382D13
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe59191c.TMP

Path C:\Users\Admin\AppData\Local\cn.alphalawyer.gptclaw\EBWebView\Local State~RFe59191c.TMP
Size 1KB
SHA256 d572c2c71e220c24cbd9708bf5d6d347ca83c0aa3c209bf82314a70623761ac6
MD5 95fc60c5bbce0b1156f8700238787674
SHA1 75d6516d77ed928e1320d8c4d14ececa48e15a93
SHA512 8ec2d3c2628c55b750ac9a501dc6da0b4adf88a5ede098952eb92e15ee936f7f7d41c1b9c4afdbf6f6ececb63ab70b738db9f6294be955cd1a5d4cf69837c31a
TLSH
T1F7219572A8A46B325CD262C6740B3FAB5D2080F791404F0059EC0A1C05D719DE75BD33
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-as.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1265494248\hyph-as.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-mr.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1265494248\hyph-mr.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1265494248\hyph-nn.hyb
Size 141KB
SHA256 5bcbb58eaf65f13f6d039244d942f37c127344e3a0a2e6c32d08236945132809
MD5 f2d8fe158d5361fc1d4b794a7255835a
SHA1 6c8744fa70651f629ed887cb76b6bc1bed304af9
SHA512 946f4e41be624458b5e842a6241d43cd40369b2e0abc2cacf67d892b5f3d8a863a0e37e8120e11375b0bacb4651eedb8d324271d9a0c37527d4d54dd4905afab
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgY:p73HEUP8dsiinTThjy90VKY
TLSH
T1C1E319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1404-2337-0x00007FF886070000-0x00007FF886071000-memory.dmp

Download

memory/1404-2336-0x00007FF887360000-0x00007FF887361000-memory.dmp

Download

memory/3688-2541-0x000001B9F0510000-0x000001B9F0511000-memory.dmp

Download

memory/3688-2537-0x000001B9F0510000-0x000001B9F0511000-memory.dmp

Download

memory/3688-2535-0x000001B9F0510000-0x000001B9F0511000-memory.dmp

Download

memory/3688-2546-0x000001B9F0510000-0x000001B9F0511000-memory.dmp

Download

memory/3688-2545-0x000001B9F0510000-0x000001B9F0511000-memory.dmp

Download

memory/3688-2544-0x000001B9F0510000-0x000001B9F0511000-memory.dmp

Download

memory/3688-2543-0x000001B9F0510000-0x000001B9F0511000-memory.dmp

Download

memory/3688-2542-0x000001B9F0510000-0x000001B9F0511000-memory.dmp

Download

memory/4148-81-0x00007FF886940000-0x00007FF886941000-memory.dmp

Download

memory/4208-26-0x00007FF886940000-0x00007FF886941000-memory.dmp

Download

memory/4240-201-0x000002215A0B0000-0x000002215A0D2000-memory.dmp

Download