86169c01a73beda1918c188e4e1c6e39e78874172c21dec89c2c42eda5a91ff1

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/07/2026, 12:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Claude Setup.exe
Size 6.7MB
Sample260710-pdfc2aa19q
SHA256 86169c01a73beda1918c188e4e1c6e39e78874172c21dec89c2c42eda5a91ff1
MD5 9e78cc98cc6518531c0b6fc0d8b0cb5e
SHA1 5a632c91009aa923bb701a60862ffc370f7fa875
SHA512 be735ad4fb4c8514006f3ac30431bec09b2bd1761d27a1cf42f99d1dfef22901a3764d7e415d48f78e4600332d0e2fce43d2c50f045a56d006bb155b8db1334d
SSDEEP 49152:2FATMATweCaOM1liQ9cz5iqCoFeUwXohxpI4Xp8tiaZch/75vh6YnpjC5vBY7wKb:2FrZlxFlca7p7ainJ+HEZ
TLSH
T1E6665A43ECA555E9C0AEE23485729253BA717C485F3123D76BA0F7382F76BC06AB9740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	Claude Setup.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB	cowork-svc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	cowork-svc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	cowork-svc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_A53644FA0CAAA458C7A0416292C7CC5B	cowork-svc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_A53644FA0CAAA458C7A0416292C7CC5B	cowork-svc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB	cowork-svc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	Claude.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	cowork-svc.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\claude\shell	Claude.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{F19D34B7-792B-42A8-BAC8-9E21ECE063F0}	Claude.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\claude	Claude.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\claude\URL Protocol	Claude.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\claude\ = "URL:claude"	Claude.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\claude\shell\open\command	Claude.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\claude\shell\open	Claude.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\claude\shell\open\command\ = "\"C:\\Program Files\\WindowsApps\\Claude_1.20186.0.0_x64__pzs8sxrjxfjjc\\app\\Claude.exe\" \"%1\""	Claude.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
7220	reg.exe
7228	reg.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1012	Claude Setup.exe
1012	Claude Setup.exe
3020	cowork-svc.exe
3020	cowork-svc.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	260	Claude.exe
Token: SeCreatePagefilePrivilege	260	Claude.exe
Token: SeShutdownPrivilege	260	Claude.exe
Token: SeCreatePagefilePrivilege	260	Claude.exe
Token: SeShutdownPrivilege	260	Claude.exe
Token: SeCreatePagefilePrivilege	260	Claude.exe
Token: SeShutdownPrivilege	260	Claude.exe
Token: SeCreatePagefilePrivilege	260	Claude.exe
Token: SeShutdownPrivilege	260	Claude.exe
Token: SeCreatePagefilePrivilege	260	Claude.exe
Token: SeShutdownPrivilege	260	Claude.exe
Token: SeCreatePagefilePrivilege	260	Claude.exe
Token: SeShutdownPrivilege	260	Claude.exe
Token: SeCreatePagefilePrivilege	260	Claude.exe
Token: SeShutdownPrivilege	260	Claude.exe
Token: SeCreatePagefilePrivilege	260	Claude.exe
Token: SeShutdownPrivilege	260	Claude.exe
Token: SeCreatePagefilePrivilege	260	Claude.exe
Token: SeShutdownPrivilege	260	Claude.exe
Token: SeCreatePagefilePrivilege	260	Claude.exe
Token: SeShutdownPrivilege	260	Claude.exe
Token: SeCreatePagefilePrivilege	260	Claude.exe
Token: SeShutdownPrivilege	260	Claude.exe
Token: SeCreatePagefilePrivilege	260	Claude.exe
Token: SeShutdownPrivilege	260	Claude.exe
Token: SeCreatePagefilePrivilege	260	Claude.exe
Token: SeShutdownPrivilege	260	Claude.exe
Token: SeCreatePagefilePrivilege	260	Claude.exe
Token: SeShutdownPrivilege	260	Claude.exe
Token: SeCreatePagefilePrivilege	260	Claude.exe
Token: SeShutdownPrivilege	260	Claude.exe
Token: SeCreatePagefilePrivilege	260	Claude.exe
Token: SeShutdownPrivilege	260	Claude.exe
Token: SeCreatePagefilePrivilege	260	Claude.exe
Token: SeShutdownPrivilege	260	Claude.exe
Token: SeCreatePagefilePrivilege	260	Claude.exe
Token: SeShutdownPrivilege	260	Claude.exe
Token: SeCreatePagefilePrivilege	260	Claude.exe
Token: SeShutdownPrivilege	260	Claude.exe
Token: SeCreatePagefilePrivilege	260	Claude.exe
Token: SeShutdownPrivilege	260	Claude.exe
Token: SeCreatePagefilePrivilege	260	Claude.exe
Token: SeShutdownPrivilege	260	Claude.exe
Token: SeCreatePagefilePrivilege	260	Claude.exe
Token: SeShutdownPrivilege	260	Claude.exe
Token: SeCreatePagefilePrivilege	260	Claude.exe
Token: SeShutdownPrivilege	260	Claude.exe
Token: SeCreatePagefilePrivilege	260	Claude.exe
Token: SeShutdownPrivilege	260	Claude.exe
Token: SeCreatePagefilePrivilege	260	Claude.exe
Token: SeShutdownPrivilege	260	Claude.exe
Token: SeCreatePagefilePrivilege	260	Claude.exe
Token: SeShutdownPrivilege	260	Claude.exe
Token: SeCreatePagefilePrivilege	260	Claude.exe
Token: SeShutdownPrivilege	260	Claude.exe
Token: SeCreatePagefilePrivilege	260	Claude.exe
Token: SeShutdownPrivilege	260	Claude.exe
Token: SeCreatePagefilePrivilege	260	Claude.exe
Token: SeShutdownPrivilege	260	Claude.exe
Token: SeCreatePagefilePrivilege	260	Claude.exe
Token: SeShutdownPrivilege	260	Claude.exe
Token: SeCreatePagefilePrivilege	260	Claude.exe
Token: SeShutdownPrivilege	260	Claude.exe
Token: SeCreatePagefilePrivilege	260	Claude.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4592 wrote to memory of 1012	4592	Claude Setup.exe	91
PID 1012 wrote to memory of 2944	1012	Claude Setup.exe	95
PID 260 wrote to memory of 2380	260	Claude.exe	102
PID 260 wrote to memory of 1480	260	Claude.exe	103
PID 260 wrote to memory of 2972	260	Claude.exe	104
PID 260 wrote to memory of 5512	260	Claude.exe	105
PID 260 wrote to memory of 360	260	Claude.exe	106
PID 260 wrote to memory of 3344	260	Claude.exe	107
PID 260 wrote to memory of 7220	260	Claude.exe	109
PID 260 wrote to memory of 7228	260	Claude.exe	110
PID 260 wrote to memory of 7904	260	Claude.exe	113
PID 260 wrote to memory of 540	260	Claude.exe	115
PID 260 wrote to memory of 1040	260	Claude.exe	116

C:\Users\Admin\AppData\Local\Temp\Claude Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Claude Setup.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4592
- C:\Users\Admin\AppData\Local\Temp\Claude Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Claude Setup.exe" --elevated --msix-path "C:\Users\Admin\AppData\Local\Temp\Claude-1569133204.msix" --log-path "C:\Users\Admin\AppData\Local\Temp\ClaudeSetup.log" --all-users
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1012
- - C:\Windows\explorer.exe
    explorer.exe shell:AppsFolder\Claude_pzs8sxrjxfjjc!Claude
    3⤵
    PID:2944

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness
1⤵
PID:5932

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
PID:4928

C:\Program Files\WindowsApps\Claude_1.20186.0.0_x64__pzs8sxrjxfjjc\app\resources\cowork-svc.exe
"C:\Program Files\WindowsApps\Claude_1.20186.0.0_x64__pzs8sxrjxfjjc\app\resources\cowork-svc.exe"
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3020

C:\Program Files\WindowsApps\Claude_1.20186.0.0_x64__pzs8sxrjxfjjc\app\Claude.exe
"C:\Program Files\WindowsApps\Claude_1.20186.0.0_x64__pzs8sxrjxfjjc\app\Claude.exe"
1⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:260
- C:\Program Files\WindowsApps\Claude_1.20186.0.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.20186.0.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\Claude /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\Claude\Crashpad --url=https://f.a.k/e --annotation=_productName=Claude --annotation=_version=1.20186.0 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=42.5.1 --initial-client-data=0x4a0,0x4a4,0x4a8,0x490,0x4ac,0x7ff743eea148,0x7ff743eea158,0x7ff743eea168
  2⤵
  PID:2380
- C:\Program Files\WindowsApps\Claude_1.20186.0.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.20186.0.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --field-trial-handle=2344,i,5950014051827032870,7191433707079959162,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2348,i,18077217427872143602,8983802400915180227,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2376 /prefetch:3
  2⤵
  PID:1480
- C:\Program Files\WindowsApps\Claude_1.20186.0.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.20186.0.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2344,i,5950014051827032870,7191433707079959162,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2348,i,18077217427872143602,8983802400915180227,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2340 /prefetch:2
  2⤵
  PID:2972
- C:\Program Files\WindowsApps\Claude_1.20186.0.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.20186.0.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --app-path="C:\Program Files\WindowsApps\Claude_1.20186.0.0_x64__pzs8sxrjxfjjc\app\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2344,i,5950014051827032870,7191433707079959162,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2348,i,18077217427872143602,8983802400915180227,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=3076 --desktop-enterprise-config="{\"forceLoginOrgUUIDs\":null,\"loginSsoOrgDomain\":null,\"disableEssentialTelemetry\":false,\"disableNonessentialTelemetry\":false,\"banner\":null}" /prefetch:1
  2⤵
  PID:5512
- C:\Program Files\WindowsApps\Claude_1.20186.0.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.20186.0.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --app-path="C:\Program Files\WindowsApps\Claude_1.20186.0.0_x64__pzs8sxrjxfjjc\app\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2344,i,5950014051827032870,7191433707079959162,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2348,i,18077217427872143602,8983802400915180227,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3244 --desktop-features="{\"artifactsPane\":{\"status\":\"unavailable\"},\"nativeQuickEntry\":{\"status\":\"unavailable\"},\"quickEntryDictation\":{\"status\":\"unavailable\"},\"quickEntryGlobalShortcut\":{\"status\":\"supported\"},\"customQuickEntryDictationShortcut\":{\"status\":\"supported\"},\"plushRaccoon\":{\"status\":\"unavailable\"},\"quietPenguin\":{\"status\":\"unavailable\"},\"chillingSlothFeat\":{\"status\":\"supported\"},\"chillingSlothSshShell\":{\"status\":\"supported\"},\"chillingSlothEnterprise\":{\"status\":\"supported\"},\"chillingSlothLocal\":{\"status\":\"supported\"},\"chillingSlothPool\":{\"status\":\"unavailable\"},\"yukonSilver\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute\",\"unsupportedCode\":\"hcs_not_available\"},\"yukonSilverGems\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute\",\"unsupportedCode\":\"hcs_not_available\"},\"yukonSilverGemsCache\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute\",\"unsupportedCode\":\"hcs_not_available\"},\"wakeScheduler\":{\"status\":\"unavailable\"},\"desktopTopBar\":{\"status\":\"supported\"},\"ccdPlugins\":{\"status\":\"supported\"},\"computerUse\":{\"status\":\"supported\"},\"coworkWatchRecord\":{\"status\":\"unsupported\",\"reason\":\"Watch-record is not available on this platform\",\"unsupportedCode\":\"unsupported_platform\"},\"coworkKappa\":{\"status\":\"unavailable\"},\"coworkArtifacts\":{\"status\":\"unavailable\"},\"framebufferPreview\":{\"status\":\"unavailable\"},\"iosSimulator\":{\"status\":\"unavailable\"},\"androidEmulator\":{\"status\":\"unavailable\"},\"iosSimulatorH264\":{\"status\":\"unavailable\"},\"grandPrix\":{\"status\":\"unavailable\"},\"tearOffHalo\":{\"status\":\"unsupported\",\"reason\":\"Tear-off halo overlay requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"coworkArtifactPopout\":{\"status\":\"supported\"},\"claudeDesignWindow\":{\"status\":\"supported\"},\"coworkRemoteSessionSpaces\":{\"status\":\"supported\"},\"spaceMemoryBridge\":{\"status\":\"unavailable\"},\"grandPrixRequest\":{\"status\":\"unavailable\"},\"coworkBranchSession\":{\"status\":\"supported\"},\"coworkScheduledTaskProjects\":{\"status\":\"supported\"},\"bootstrapConfig\":{\"status\":\"supported\"},\"chatIn3p\":{\"status\":\"supported\"},\"builtinMcpPresets\":{\"status\":\"supported\"},\"surfaceTogglesPreview\":{\"status\":\"unavailable\"},\"chatTab\":{\"status\":\"unavailable\"},\"chatCodeExecution\":{\"status\":\"unavailable\"},\"epitaxyMcpApps\":{\"status\":\"unavailable\"}}" --desktop-enterprise-config="{\"forceLoginOrgUUIDs\":null,\"loginSsoOrgDomain\":null,\"disableEssentialTelemetry\":false,\"disableNonessentialTelemetry\":false,\"banner\":null}" --desktop-telemetry-config="{\"deploymentMode\":\"1p\",\"appVersion\":\"1.20186.0\",\"cookielessOrigin\":false}" /prefetch:1
  2⤵
  PID:360
- C:\Program Files\WindowsApps\Claude_1.20186.0.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.20186.0.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --app-path="C:\Program Files\WindowsApps\Claude_1.20186.0.0_x64__pzs8sxrjxfjjc\app\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2344,i,5950014051827032870,7191433707079959162,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2348,i,18077217427872143602,8983802400915180227,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3112 --desktop-enterprise-config="{\"forceLoginOrgUUIDs\":null,\"loginSsoOrgDomain\":null,\"disableEssentialTelemetry\":false,\"disableNonessentialTelemetry\":false,\"banner\":null}" /prefetch:1
  2⤵
  PID:3344
- C:\Windows\System32\reg.exe
  C:\Windows\System32\reg.exe query HKLM\SOFTWARE\Policies\ClaudeCode /v Settings
  2⤵
  - Modifies registry key
  PID:7220
- C:\Windows\System32\reg.exe
  C:\Windows\System32\reg.exe query HKCU\SOFTWARE\Policies\ClaudeCode /v Settings
  2⤵
  - Modifies registry key
  PID:7228
- C:\Program Files\WindowsApps\Claude_1.20186.0.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.20186.0.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --app-path="C:\Program Files\WindowsApps\Claude_1.20186.0.0_x64__pzs8sxrjxfjjc\app\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=2344,i,5950014051827032870,7191433707079959162,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2348,i,18077217427872143602,8983802400915180227,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=4404 --desktop-features="{\"artifactsPane\":{\"status\":\"unavailable\"},\"nativeQuickEntry\":{\"status\":\"unavailable\"},\"quickEntryDictation\":{\"status\":\"unavailable\"},\"quickEntryGlobalShortcut\":{\"status\":\"supported\"},\"customQuickEntryDictationShortcut\":{\"status\":\"supported\"},\"plushRaccoon\":{\"status\":\"unavailable\"},\"quietPenguin\":{\"status\":\"unavailable\"},\"chillingSlothFeat\":{\"status\":\"supported\"},\"chillingSlothSshShell\":{\"status\":\"supported\"},\"chillingSlothEnterprise\":{\"status\":\"supported\"},\"chillingSlothLocal\":{\"status\":\"supported\"},\"chillingSlothPool\":{\"status\":\"unavailable\"},\"yukonSilver\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute\",\"unsupportedCode\":\"hcs_not_available\"},\"yukonSilverGems\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute\",\"unsupportedCode\":\"hcs_not_available\"},\"yukonSilverGemsCache\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute\",\"unsupportedCode\":\"hcs_not_available\"},\"wakeScheduler\":{\"status\":\"unavailable\"},\"desktopTopBar\":{\"status\":\"supported\"},\"ccdPlugins\":{\"status\":\"supported\"},\"computerUse\":{\"status\":\"supported\"},\"coworkWatchRecord\":{\"status\":\"unsupported\",\"reason\":\"Watch-record is not available on this platform\",\"unsupportedCode\":\"unsupported_platform\"},\"coworkKappa\":{\"status\":\"unavailable\"},\"coworkArtifacts\":{\"status\":\"unavailable\"},\"framebufferPreview\":{\"status\":\"unavailable\"},\"iosSimulator\":{\"status\":\"unavailable\"},\"androidEmulator\":{\"status\":\"unavailable\"},\"iosSimulatorH264\":{\"status\":\"unavailable\"},\"grandPrix\":{\"status\":\"unavailable\"},\"tearOffHalo\":{\"status\":\"unsupported\",\"reason\":\"Tear-off halo overlay requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"coworkArtifactPopout\":{\"status\":\"supported\"},\"claudeDesignWindow\":{\"status\":\"supported\"},\"coworkRemoteSessionSpaces\":{\"status\":\"supported\"},\"spaceMemoryBridge\":{\"status\":\"unavailable\"},\"grandPrixRequest\":{\"status\":\"unavailable\"},\"coworkBranchSession\":{\"status\":\"supported\"},\"coworkScheduledTaskProjects\":{\"status\":\"supported\"},\"bootstrapConfig\":{\"status\":\"supported\"},\"chatIn3p\":{\"status\":\"supported\"},\"builtinMcpPresets\":{\"status\":\"supported\"},\"surfaceTogglesPreview\":{\"status\":\"unavailable\"},\"chatTab\":{\"status\":\"unavailable\"},\"chatCodeExecution\":{\"status\":\"unavailable\"},\"epitaxyMcpApps\":{\"status\":\"unavailable\"}}" --desktop-enterprise-config="{\"forceLoginOrgUUIDs\":null,\"loginSsoOrgDomain\":null,\"disableEssentialTelemetry\":false,\"disableNonessentialTelemetry\":false,\"banner\":null}" --desktop-telemetry-config="{\"deploymentMode\":\"1p\",\"appVersion\":\"1.20186.0\",\"cookielessOrigin\":false}" /prefetch:1
  2⤵
  PID:7904
- C:\Program Files\WindowsApps\Claude_1.20186.0.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.20186.0.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --field-trial-handle=2344,i,5950014051827032870,7191433707079959162,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2348,i,18077217427872143602,8983802400915180227,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=4684 /prefetch:8
  2⤵
  PID:540
- C:\Program Files\WindowsApps\Claude_1.20186.0.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.20186.0.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --field-trial-handle=2344,i,5950014051827032870,7191433707079959162,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2348,i,18077217427872143602,8983802400915180227,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5056 /prefetch:8
  2⤵
  - Modifies registry class
  PID:1040

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4f8 0x2e0
1⤵
PID:6108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

data_2

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Cache\Cache_Data\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Cache\Cache_Data\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 ba7daa65fd0d96a7c1f8f20581a9ef2638f5bc51e169f929065540638f82f1b1
MD5 ca384173db1bd562a5e49bac90c9b9a7
SHA1 3ac71522666adec5bef97db1e0ba6ea6f806a9fb
SHA512 d67efcc8c57a839d0de232474388b65d321c54786eb06c8c252c074a87caf37f0d5d2103e5ed6a5b13f37f7f3775bf11f2d19b3dc1e35a01007fa21c73d84058
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 1a7269cba6008d28780afb6ea4dbbf1bea84e9ce054d377377e7dcb653d4abdf
MD5 944eb71ec5a406c45c5669ecbc851623
SHA1 6d425fbd303d995d096912b11b4ba2b57a62538c
SHA512 fe00c448bd133067d53a16a9190f394da41e4d89685d208af9e161e83473347c58eb57dc7ff5b4155144f5634171f50a499e7309e9c4d2b135bcccf6341badee
TLSH
T14C416FA6533D66E2D79C02BA54E494F3717D781044EF6DC00932AB7AE4203875C4BF6D
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Network\Network Persistent State
Size 1KB
SHA256 e535ac47907240864887edf199decd89b013cd02fb37c9fe6a9fcd1808f3b7c3
MD5 fafc7923ed3697e3d3c79bd8cf6887f8
SHA1 0f6ce007a143a09fde697228b372d95b253a42e3
SHA512 b3167bb9b7c47e98eb2dc1a22cce05e0a920bdc806c47996ec2b81a10496e3a1fa267910879e7a2d83d3c8553025c672c3836f12fa4892fd6f7c0aeb9ffb6486
TLSH
T13B31FC82C3EE467DC26227F86F213E63D5AE1A1C53183C03C9C9EF8E57E14366A0054D
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Partitions\cowork-file-preview\Local Storage\leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Partitions\launch-preview-static\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

6818df14-1544-445f-b642-b6d3d0461e45.tmp

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Partitions\launch-preview-static\Network\6818df14-1544-445f-b642-b6d3d0461e45.tmp
Size 84B
SHA256 712196693e3527ac1131831f1a2108b6c0e5c68967b26d51a452611cdfb86e0c
MD5 32b9dc9cc81d0682e78627c873fdd651
SHA1 46c486386d3e153c3e9b11d54cb52cf0064b71cf
SHA512 f18bc37f8b72411548da247aa1394cc5ac03c3bbd98e82eb8ba290ef239ef5b8625cf4835bd41ce7c52766d0bc3bfe9150dd22dbf62f0f05992ddde5fbfdc811
TLSH
T154A0121490405CFB0308835504146463C3F50002421848A91634318D019209D0004403
MD5 SHA1 SHA512 TLSH

Submit Download

7ffc49d5-77a6-4416-a996-b9d3a980533d.tmp

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Partitions\launch-preview-static\Network\7ffc49d5-77a6-4416-a996-b9d3a980533d.tmp
Size 59B
SHA256 c257f929cff0e4380bf08d9f36f310753f7b1ccb5cb2ab811b52760dd8cb9572
MD5 78bfcecb05ed1904edce3b60cb5c7e62
SHA1 bf77a7461de9d41d12aa88fba056ba758793d9ce
SHA512 2420dff6eb853f5e1856cdab99561a896ea0743fcff3e04b37cb87eddf063770608a30c6ffb0319e5d353b0132c5f8135b7082488e425666b2c22b753a6a4d73
TLSH
T1D2A0026ADA612D881B4A839026187553807B0445130982FDE43877A841561AE582C865
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Partitions\launch-preview-static\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Partitions\launch-preview-static\Session Storage\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

claude_desktop_config.json.tmp

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\claude_desktop_config.json.tmp
Size 228B
SHA256 d7c754f7b4095233b797c159ed69533bc88498a587c32655a6e72501186b656b
MD5 e3671cf71c3231f0bf2c3ecbeacceb46
SHA1 8a2f8a93e85d9afb597b1d84d29002afc9128a6b
SHA512 3fdb2f07856e75a2d537662adf3b55bd63846f70a5a34a00599d33a0d0644751c6ad5973a079c61959da5f99ba6b0b406c1855908570be44acdffba3b7ec4167
TLSH
T10FD0A720D8210EE706F292184D2D8413434179931928742CA55E061C1FCC93C7834452
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\config.json
Size 42B
SHA256 b55285b1cba17a7d1afbc9e8941cc36e0c2a36d7ad95f39d56b4e6c3b0440702
MD5 ff7cca5ff62924f56201884e190f2bb1
SHA1 8e1abdb7412c534a46f2d7e168a97ca88d4dbc2c
SHA512 922ea2a1d863ba1512ff16ab022c8a0c1fb0ac88f4542953c5d612a11050b76b6362573e42c56770d3ff1f2bf0adf3209aa09fa4dde539ec81855500e2b44238
MD5 SHA1 SHA512

Submit Download

config.json

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\config.json
Size 62B
SHA256 417384b5c8320cc8de6d5b3ab3b82cb952a2f478e12e37cb104d8f1d29003117
MD5 27b3b688e9792681b109ca3f61466156
SHA1 a27d6c12c17dc4ef313b03d7f4608e4812b70705
SHA512 31a188782e67d183027a08d5555544673d3f9485f31335fa067262e8539061e9d90bb7771835be5c06800ecacc20829ec604a42a031ca58b1be1d12887359650
TLSH
T1EFA0022AC0219023F01482EC040401C785D9025C6A0B190646917119C547BBC664A356
MD5 SHA1 SHA512 TLSH

Submit Download

config.json.tmp-36880511098d7417

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\config.json.tmp-36880511098d7417
Size 77B
SHA256 cc32430aa98eebd6ce99fb7a4adc3b8fabd524cc2840939034d513bc695ef1fa
MD5 2c403f32e74d98c03f59692322daa72f
SHA1 aead4308d8b2772592bfd7c3f5833467a23c518a
SHA512 b8d5b3b8f0abab351aaf73bb4873e3d2d73e30000a87d6793141d77db683e2b0943c5216898b62cfcf88c3446fe3b6b6930d3619cc758ecd7ac609923b98aedb
TLSH
T128A0228EE022882BEA0E03FC888C0003838803CC0B0B000800000B3CC802BAC3E0A2AA
MD5 SHA1 SHA512 TLSH

Submit Download

config.json.tmp-3688051592f13868

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\config.json.tmp-3688051592f13868
Size 90B
SHA256 7be28b76852ec1ddcdd8c934a27f98ec0da9548450a0dc54d620657a62a6b4a8
MD5 a19694fe87db2fb6fc814315c8fb140b
SHA1 55d980952d361f4ba8fd7f8a4ae5516ef68c4142
SHA512 1ef36d6a0c417003b5f2100b5cd55ee3b67d8168881a953b8f810fc0f8cae8636fbe2279360c343b39f1c3c0339947116820ee400422b91253b777af0ade13e0
TLSH
T136B01235C0114013F00081EC000C00C640AC12195D07040F45A16108C147EAC7225B12
MD5 SHA1 SHA512 TLSH

Submit Download

git-worktrees.json

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\git-worktrees.json
Size 20B
SHA256 f0bc550ac05dd2b909b3551952c6d420bcab2f00c06056f9cd22a767c4ce389b
MD5 e81562802df3ee9bdae750db6449fbe3
SHA1 9f33369ff7aa8ea66075158a79d1f7de923b4924
SHA512 7a77e2e73b4ea7dc9ed36bca78adb5ad01609668bb9a2a1e6964d9c464246bb770495a9a66fba07dde054d38ff3c0d61c4a9d2f7026ce0f654a81a6e06e667f2
MD5 SHA1 SHA512

Submit Download

git-worktrees.json.tmp-3688048303d4240f

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\git-worktrees.json.tmp-3688048303d4240f
Size 41B
SHA256 8fc79e5ab7122d9bdefc19199129249ed3823801840d7d065579dfdae8cfad15
MD5 b248a937ded76419d289994d74555354
SHA1 785642689ccfe95fb266d894ee85438030be9e55
SHA512 4720de5d5c54a601c3acffa7639b0055b88e8672027ccd5cf99590176101bf2b62dfac820bd27182b41d5f886f49ddf46fb6803b3622e4b5cbc12995a015a349
MD5 SHA1 SHA512

Submit Download

APPX.j6fkc7nvjma9n81o538wphr3h.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX.j6fkc7nvjma9n81o538wphr3h.tmp
Size 10KB
SHA256 1922c27eb36e3d7566ab049e0fc5dc4c4fdd34cd57de5cbce579505955023a00
MD5 369bf528594cc4d819479a06408a05bd
SHA1 00a72a02e5ec38f62c9b13c47d0cdeeea0c718e4
SHA512 1fdc060988e01bbff69e9faa068e3f63d7bd57a304ce1a910efecb336685dd7ef36c2bea98536069c9bf9a40d7c67341ef68dcdb447a64df10837992669bc1e8
SSDEEP 192:C8PRNyEIYiYF80dmL4pUQaULc8pq8RuX5hz28uNNTPKTdbNbJ+sFRE+LLY:CYRNyEIYi2mL4/y8RKE7qxb7Sz
TLSH
T194224BA388906C0AED275D50B4D4A936FEB2B2866AC0C1C77159C166CB843833FDD2FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

APPX.ufru_1uek0jy07dxvqxo9pu2g.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX.ufru_1uek0jy07dxvqxo9pu2g.tmp
Size 7KB
SHA256 3fdfddf4985ccb3c000a59e8a56e704c84369fec98f7754c3a9766487f2d6f68
MD5 d15b17174c9365e67a862d6e2b646df2
SHA1 033344f71bf7cdeb0948bc4b5fbc7b87bff25029
SHA512 262513161ae3c5fded8d836c2daeeaf8f23dd482dfb74517ef5f4c8d177890191f9355d3681ebda4c273101179cc12eac7201d19f8d45a03ce5d186417631f10
SSDEEP 192:rJG1F4RVbrowD+q6LYYcwmbTYp+bkk6W+Gkk63:rJG1F4RVbrowD+TLY/wJ+bkk6W+Gkk63
TLSH
T1FDE1F14BD4AD18504672E1AAAF13D686EB2C095758DE00C4BCDD56432FB265F033BB9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

APPX.ygxs4e0dj466daascy_r6l69f.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX.ygxs4e0dj466daascy_r6l69f.tmp
Size 856KB
SHA256 7e4afc483f31ddd3b14c2e1f4ce67d2fb0c16e0ef5c1801d3bbb5dffa7cf4966
MD5 9d792409c8506fc31b249ca80af684c4
SHA1 6048c5da66916715e172c8f3add95f8dc8845e34
SHA512 0eb85266dae848a22363754bb6b95ee5c520ec8c32a74f1bd942cdd0034ed97185e4ed9f244b6661ee86998d0ad38c74b94dd84e3d6e4c862925ef954d6d3c15
SSDEEP 12288:zTB7BSYM/VctITTJ6CpPaoWZx3BizVLU2vT9HmvFiy2yRjW+gwf:z97W/FXJ6CpyocpkzVLU2vxuRjQ+v
TLSH
T17F15B4E1153DBE3681AD0AAD8F24F4042C35983613376E0E9C5E92B71CBF9A25F674E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ClaudeSetup.log

Path C:\Users\Admin\AppData\Local\Temp\ClaudeSetup.log
Size 3KB
SHA256 e8a1ee0cf3ab5b22637c78ad62edd5d23bf73e059750976dc85f2661efaed96e
MD5 60966bd1e0feec867d28c13a27620c2e
SHA1 17949adc7b14067e9e227c48f5c87055c8ab14ba
SHA512 0c3f7ca87202fb511b4be9c825aaca055d174999fee4c304fe1d602af4d8e2ceb880be82564323ab6860c5122cd14163888e46a49afdc66fe7b7eef68aab6bca
TLSH
T17871B71648D3CCF413D498C2E6A6335DC91F792AAA8D4F28BBD4C47C5412319AF6DAC2
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/360-819-0x0000024463F50000-0x0000024463FFD000-memory.dmp

Download

memory/1040-1723-0x00000278FE800000-0x00000278FEF29000-memory.dmp

Download

memory/3344-1707-0x00000276CC6F0000-0x00000276CC79D000-memory.dmp

Download

memory/5512-1706-0x0000013BF50D0000-0x0000013BF517D000-memory.dmp

Download

memory/5512-240-0x00007FFDF0F70000-0x00007FFDF0F71000-memory.dmp

Download

memory/5512-207-0x00007FFDF2630000-0x00007FFDF2631000-memory.dmp

Download

memory/7904-1720-0x000001969D140000-0x000001969D1ED000-memory.dmp

Download