86169c01a73beda1918c188e4e1c6e39e78874172c21dec89c2c42eda5a91ff1

Analysis

user interaction
yes
max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 12:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Claude Setup.exe
Size 6.7MB
Sample260710-pdfc2aa19q
SHA256 86169c01a73beda1918c188e4e1c6e39e78874172c21dec89c2c42eda5a91ff1
MD5 9e78cc98cc6518531c0b6fc0d8b0cb5e
SHA1 5a632c91009aa923bb701a60862ffc370f7fa875
SHA512 be735ad4fb4c8514006f3ac30431bec09b2bd1761d27a1cf42f99d1dfef22901a3764d7e415d48f78e4600332d0e2fce43d2c50f045a56d006bb155b8db1334d
SSDEEP 49152:2FATMATweCaOM1liQ9cz5iqCoFeUwXohxpI4Xp8tiaZch/75vh6YnpjC5vBY7wKb:2FrZlxFlca7p7ainJ+HEZ
TLSH
T1E6665A43ECA555E9C0AEE23485729253BA717C485F3123D76BA0F7382F76BC06AB9740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	cowork-svc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_A53644FA0CAAA458C7A0416292C7CC5B	cowork-svc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_A53644FA0CAAA458C7A0416292C7CC5B	cowork-svc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB	cowork-svc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB	cowork-svc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	cowork-svc.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	Claude.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	Claude.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	cowork-svc.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-189034102-168398478-1159367937-1000\{AF8C9DA7-C284-43F1-879B-A7A656A5BC86}	Claude.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\claude\URL Protocol	Claude.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\claude	Claude.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\claude\ = "URL:claude"	Claude.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\claude\shell\open\command	Claude.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\claude\shell	Claude.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\claude\shell\open	Claude.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\claude\shell\open\command\ = "\"C:\\Program Files\\WindowsApps\\Claude_1.20186.0.0_x64__pzs8sxrjxfjjc\\app\\Claude.exe\" \"%1\""	Claude.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
6888	reg.exe
6876	reg.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
6072	Claude Setup.exe
6072	Claude Setup.exe
3212	cowork-svc.exe
3212	cowork-svc.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4916	Claude.exe
Token: SeCreatePagefilePrivilege	4916	Claude.exe
Token: SeShutdownPrivilege	4916	Claude.exe
Token: SeCreatePagefilePrivilege	4916	Claude.exe
Token: SeShutdownPrivilege	4916	Claude.exe
Token: SeCreatePagefilePrivilege	4916	Claude.exe
Token: SeShutdownPrivilege	4916	Claude.exe
Token: SeCreatePagefilePrivilege	4916	Claude.exe
Token: SeShutdownPrivilege	4916	Claude.exe
Token: SeCreatePagefilePrivilege	4916	Claude.exe
Token: SeShutdownPrivilege	4916	Claude.exe
Token: SeCreatePagefilePrivilege	4916	Claude.exe
Token: SeShutdownPrivilege	4916	Claude.exe
Token: SeCreatePagefilePrivilege	4916	Claude.exe
Token: SeShutdownPrivilege	4916	Claude.exe
Token: SeCreatePagefilePrivilege	4916	Claude.exe
Token: SeShutdownPrivilege	4916	Claude.exe
Token: SeCreatePagefilePrivilege	4916	Claude.exe
Token: SeShutdownPrivilege	4916	Claude.exe
Token: SeCreatePagefilePrivilege	4916	Claude.exe
Token: SeShutdownPrivilege	4916	Claude.exe
Token: SeCreatePagefilePrivilege	4916	Claude.exe
Token: SeShutdownPrivilege	4916	Claude.exe
Token: SeCreatePagefilePrivilege	4916	Claude.exe
Token: SeShutdownPrivilege	4916	Claude.exe
Token: SeCreatePagefilePrivilege	4916	Claude.exe
Token: SeShutdownPrivilege	4916	Claude.exe
Token: SeCreatePagefilePrivilege	4916	Claude.exe
Token: SeShutdownPrivilege	4916	Claude.exe
Token: SeCreatePagefilePrivilege	4916	Claude.exe
Token: SeShutdownPrivilege	4916	Claude.exe
Token: SeCreatePagefilePrivilege	4916	Claude.exe
Token: SeShutdownPrivilege	4916	Claude.exe
Token: SeCreatePagefilePrivilege	4916	Claude.exe
Token: SeShutdownPrivilege	4916	Claude.exe
Token: SeCreatePagefilePrivilege	4916	Claude.exe
Token: SeShutdownPrivilege	4916	Claude.exe
Token: SeCreatePagefilePrivilege	4916	Claude.exe
Token: SeShutdownPrivilege	4916	Claude.exe
Token: SeCreatePagefilePrivilege	4916	Claude.exe
Token: SeShutdownPrivilege	4916	Claude.exe
Token: SeCreatePagefilePrivilege	4916	Claude.exe
Token: SeShutdownPrivilege	4916	Claude.exe
Token: SeCreatePagefilePrivilege	4916	Claude.exe
Token: SeShutdownPrivilege	4916	Claude.exe
Token: SeCreatePagefilePrivilege	4916	Claude.exe
Token: SeShutdownPrivilege	4916	Claude.exe
Token: SeCreatePagefilePrivilege	4916	Claude.exe
Token: SeShutdownPrivilege	4916	Claude.exe
Token: SeCreatePagefilePrivilege	4916	Claude.exe
Token: SeShutdownPrivilege	4916	Claude.exe
Token: SeCreatePagefilePrivilege	4916	Claude.exe
Token: SeShutdownPrivilege	4916	Claude.exe
Token: SeCreatePagefilePrivilege	4916	Claude.exe
Token: SeShutdownPrivilege	4916	Claude.exe
Token: SeCreatePagefilePrivilege	4916	Claude.exe
Token: SeShutdownPrivilege	4916	Claude.exe
Token: SeCreatePagefilePrivilege	4916	Claude.exe
Token: SeShutdownPrivilege	4916	Claude.exe
Token: SeCreatePagefilePrivilege	4916	Claude.exe
Token: SeShutdownPrivilege	4916	Claude.exe
Token: SeCreatePagefilePrivilege	4916	Claude.exe
Token: SeShutdownPrivilege	4916	Claude.exe
Token: SeCreatePagefilePrivilege	4916	Claude.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4336	explorer.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4524 wrote to memory of 6072	4524	Claude Setup.exe	93
PID 6072 wrote to memory of 5796	6072	Claude Setup.exe	97
PID 4916 wrote to memory of 4548	4916	Claude.exe	101
PID 4916 wrote to memory of 6132	4916	Claude.exe	102
PID 4916 wrote to memory of 3936	4916	Claude.exe	103
PID 4916 wrote to memory of 2192	4916	Claude.exe	105
PID 4916 wrote to memory of 5348	4916	Claude.exe	106
PID 4916 wrote to memory of 2600	4916	Claude.exe	107
PID 4916 wrote to memory of 6876	4916	Claude.exe	108
PID 4916 wrote to memory of 6888	4916	Claude.exe	109
PID 4916 wrote to memory of 972	4916	Claude.exe	112
PID 4916 wrote to memory of 4248	4916	Claude.exe	113
PID 4916 wrote to memory of 4772	4916	Claude.exe	114

C:\Users\Admin\AppData\Local\Temp\Claude Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Claude Setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4524
- C:\Users\Admin\AppData\Local\Temp\Claude Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Claude Setup.exe" --elevated --msix-path "C:\Users\Admin\AppData\Local\Temp\Claude-1045975465.msix" --log-path "C:\Users\Admin\AppData\Local\Temp\ClaudeSetup.log" --all-users
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:6072
- - C:\Windows\explorer.exe
    explorer.exe shell:AppsFolder\Claude_pzs8sxrjxfjjc!Claude
    3⤵
    PID:5796

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:4380

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2552

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness
1⤵
PID:2352

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4336

C:\Program Files\WindowsApps\Claude_1.20186.0.0_x64__pzs8sxrjxfjjc\app\resources\cowork-svc.exe
"C:\Program Files\WindowsApps\Claude_1.20186.0.0_x64__pzs8sxrjxfjjc\app\resources\cowork-svc.exe"
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3212

C:\Program Files\WindowsApps\Claude_1.20186.0.0_x64__pzs8sxrjxfjjc\app\Claude.exe
"C:\Program Files\WindowsApps\Claude_1.20186.0.0_x64__pzs8sxrjxfjjc\app\Claude.exe"
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Program Files\WindowsApps\Claude_1.20186.0.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.20186.0.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\Claude /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\Claude\Crashpad --url=https://f.a.k/e --annotation=_productName=Claude --annotation=_version=1.20186.0 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=42.5.1 --initial-client-data=0x4d8,0x4dc,0x4e0,0x4d4,0x4e4,0x7ff7963ba148,0x7ff7963ba158,0x7ff7963ba168
  2⤵
  PID:4548
- C:\Program Files\WindowsApps\Claude_1.20186.0.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.20186.0.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --field-trial-handle=1908,i,5180990833097916144,12959933278215723642,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1916,i,14150006361726642837,3945222308250665011,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2052 /prefetch:11
  2⤵
  PID:6132
- C:\Program Files\WindowsApps\Claude_1.20186.0.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.20186.0.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1908,i,5180990833097916144,12959933278215723642,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1916,i,14150006361726642837,3945222308250665011,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:3936
- C:\Program Files\WindowsApps\Claude_1.20186.0.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.20186.0.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --app-path="C:\Program Files\WindowsApps\Claude_1.20186.0.0_x64__pzs8sxrjxfjjc\app\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1908,i,5180990833097916144,12959933278215723642,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1916,i,14150006361726642837,3945222308250665011,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2916 --desktop-enterprise-config="{\"forceLoginOrgUUIDs\":null,\"loginSsoOrgDomain\":null,\"disableEssentialTelemetry\":false,\"disableNonessentialTelemetry\":false,\"banner\":null}" /prefetch:1
  2⤵
  PID:2192
- C:\Program Files\WindowsApps\Claude_1.20186.0.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.20186.0.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --app-path="C:\Program Files\WindowsApps\Claude_1.20186.0.0_x64__pzs8sxrjxfjjc\app\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1908,i,5180990833097916144,12959933278215723642,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1916,i,14150006361726642837,3945222308250665011,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3088 --desktop-features="{\"artifactsPane\":{\"status\":\"unavailable\"},\"nativeQuickEntry\":{\"status\":\"unavailable\"},\"quickEntryDictation\":{\"status\":\"unavailable\"},\"quickEntryGlobalShortcut\":{\"status\":\"supported\"},\"customQuickEntryDictationShortcut\":{\"status\":\"supported\"},\"plushRaccoon\":{\"status\":\"unavailable\"},\"quietPenguin\":{\"status\":\"unavailable\"},\"chillingSlothFeat\":{\"status\":\"supported\"},\"chillingSlothSshShell\":{\"status\":\"supported\"},\"chillingSlothEnterprise\":{\"status\":\"supported\"},\"chillingSlothLocal\":{\"status\":\"supported\"},\"chillingSlothPool\":{\"status\":\"unavailable\"},\"yukonSilver\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute, vfpext\",\"unsupportedCode\":\"hcs_not_available\"},\"yukonSilverGems\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute, vfpext\",\"unsupportedCode\":\"hcs_not_available\"},\"yukonSilverGemsCache\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute, vfpext\",\"unsupportedCode\":\"hcs_not_available\"},\"wakeScheduler\":{\"status\":\"unavailable\"},\"desktopTopBar\":{\"status\":\"supported\"},\"ccdPlugins\":{\"status\":\"supported\"},\"computerUse\":{\"status\":\"supported\"},\"coworkWatchRecord\":{\"status\":\"unsupported\",\"reason\":\"Watch-record is not available on this platform\",\"unsupportedCode\":\"unsupported_platform\"},\"coworkKappa\":{\"status\":\"unavailable\"},\"coworkArtifacts\":{\"status\":\"unavailable\"},\"framebufferPreview\":{\"status\":\"unavailable\"},\"iosSimulator\":{\"status\":\"unavailable\"},\"androidEmulator\":{\"status\":\"unavailable\"},\"iosSimulatorH264\":{\"status\":\"unavailable\"},\"grandPrix\":{\"status\":\"unavailable\"},\"tearOffHalo\":{\"status\":\"unsupported\",\"reason\":\"Tear-off halo overlay requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"coworkArtifactPopout\":{\"status\":\"supported\"},\"claudeDesignWindow\":{\"status\":\"supported\"},\"coworkRemoteSessionSpaces\":{\"status\":\"supported\"},\"spaceMemoryBridge\":{\"status\":\"unavailable\"},\"grandPrixRequest\":{\"status\":\"unavailable\"},\"coworkBranchSession\":{\"status\":\"supported\"},\"coworkScheduledTaskProjects\":{\"status\":\"supported\"},\"bootstrapConfig\":{\"status\":\"supported\"},\"chatIn3p\":{\"status\":\"supported\"},\"builtinMcpPresets\":{\"status\":\"supported\"},\"surfaceTogglesPreview\":{\"status\":\"unavailable\"},\"chatTab\":{\"status\":\"unavailable\"},\"chatCodeExecution\":{\"status\":\"unavailable\"},\"epitaxyMcpApps\":{\"status\":\"unavailable\"}}" --desktop-enterprise-config="{\"forceLoginOrgUUIDs\":null,\"loginSsoOrgDomain\":null,\"disableEssentialTelemetry\":false,\"disableNonessentialTelemetry\":false,\"banner\":null}" --desktop-telemetry-config="{\"deploymentMode\":\"1p\",\"appVersion\":\"1.20186.0\",\"cookielessOrigin\":false}" /prefetch:1
  2⤵
  PID:5348
- C:\Program Files\WindowsApps\Claude_1.20186.0.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.20186.0.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --app-path="C:\Program Files\WindowsApps\Claude_1.20186.0.0_x64__pzs8sxrjxfjjc\app\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1908,i,5180990833097916144,12959933278215723642,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1916,i,14150006361726642837,3945222308250665011,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3156 --desktop-enterprise-config="{\"forceLoginOrgUUIDs\":null,\"loginSsoOrgDomain\":null,\"disableEssentialTelemetry\":false,\"disableNonessentialTelemetry\":false,\"banner\":null}" /prefetch:1
  2⤵
  PID:2600
- C:\Windows\System32\reg.exe
  C:\Windows\System32\reg.exe query HKLM\SOFTWARE\Policies\ClaudeCode /v Settings
  2⤵
  - Modifies registry key
  PID:6876
- C:\Windows\System32\reg.exe
  C:\Windows\System32\reg.exe query HKCU\SOFTWARE\Policies\ClaudeCode /v Settings
  2⤵
  - Modifies registry key
  PID:6888
- C:\Program Files\WindowsApps\Claude_1.20186.0.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.20186.0.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --app-path="C:\Program Files\WindowsApps\Claude_1.20186.0.0_x64__pzs8sxrjxfjjc\app\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1908,i,5180990833097916144,12959933278215723642,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1916,i,14150006361726642837,3945222308250665011,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=4152 --desktop-features="{\"artifactsPane\":{\"status\":\"unavailable\"},\"nativeQuickEntry\":{\"status\":\"unavailable\"},\"quickEntryDictation\":{\"status\":\"unavailable\"},\"quickEntryGlobalShortcut\":{\"status\":\"supported\"},\"customQuickEntryDictationShortcut\":{\"status\":\"supported\"},\"plushRaccoon\":{\"status\":\"unavailable\"},\"quietPenguin\":{\"status\":\"unavailable\"},\"chillingSlothFeat\":{\"status\":\"supported\"},\"chillingSlothSshShell\":{\"status\":\"supported\"},\"chillingSlothEnterprise\":{\"status\":\"supported\"},\"chillingSlothLocal\":{\"status\":\"supported\"},\"chillingSlothPool\":{\"status\":\"unavailable\"},\"yukonSilver\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute, vfpext\",\"unsupportedCode\":\"hcs_not_available\"},\"yukonSilverGems\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute, vfpext\",\"unsupportedCode\":\"hcs_not_available\"},\"yukonSilverGemsCache\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute, vfpext\",\"unsupportedCode\":\"hcs_not_available\"},\"wakeScheduler\":{\"status\":\"unavailable\"},\"desktopTopBar\":{\"status\":\"supported\"},\"ccdPlugins\":{\"status\":\"supported\"},\"computerUse\":{\"status\":\"supported\"},\"coworkWatchRecord\":{\"status\":\"unsupported\",\"reason\":\"Watch-record is not available on this platform\",\"unsupportedCode\":\"unsupported_platform\"},\"coworkKappa\":{\"status\":\"unavailable\"},\"coworkArtifacts\":{\"status\":\"unavailable\"},\"framebufferPreview\":{\"status\":\"unavailable\"},\"iosSimulator\":{\"status\":\"unavailable\"},\"androidEmulator\":{\"status\":\"unavailable\"},\"iosSimulatorH264\":{\"status\":\"unavailable\"},\"grandPrix\":{\"status\":\"unavailable\"},\"tearOffHalo\":{\"status\":\"unsupported\",\"reason\":\"Tear-off halo overlay requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"coworkArtifactPopout\":{\"status\":\"supported\"},\"claudeDesignWindow\":{\"status\":\"supported\"},\"coworkRemoteSessionSpaces\":{\"status\":\"supported\"},\"spaceMemoryBridge\":{\"status\":\"unavailable\"},\"grandPrixRequest\":{\"status\":\"unavailable\"},\"coworkBranchSession\":{\"status\":\"supported\"},\"coworkScheduledTaskProjects\":{\"status\":\"supported\"},\"bootstrapConfig\":{\"status\":\"supported\"},\"chatIn3p\":{\"status\":\"supported\"},\"builtinMcpPresets\":{\"status\":\"supported\"},\"surfaceTogglesPreview\":{\"status\":\"unavailable\"},\"chatTab\":{\"status\":\"unavailable\"},\"chatCodeExecution\":{\"status\":\"unavailable\"},\"epitaxyMcpApps\":{\"status\":\"unavailable\"}}" --desktop-enterprise-config="{\"forceLoginOrgUUIDs\":null,\"loginSsoOrgDomain\":null,\"disableEssentialTelemetry\":false,\"disableNonessentialTelemetry\":false,\"banner\":null}" --desktop-telemetry-config="{\"deploymentMode\":\"1p\",\"appVersion\":\"1.20186.0\",\"cookielessOrigin\":false}" /prefetch:1
  2⤵
  PID:972
- C:\Program Files\WindowsApps\Claude_1.20186.0.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.20186.0.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --field-trial-handle=1908,i,5180990833097916144,12959933278215723642,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1916,i,14150006361726642837,3945222308250665011,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=4632 /prefetch:12
  2⤵
  PID:4248
- C:\Program Files\WindowsApps\Claude_1.20186.0.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.20186.0.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --field-trial-handle=1908,i,5180990833097916144,12959933278215723642,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1916,i,14150006361726642837,3945222308250665011,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=4652 /prefetch:14
  2⤵
  - Modifies registry class
  PID:4772

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004DC 0x00000000000004D8
1⤵
PID:5888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8faf7ff3-f8ef-413a-9774-df6f431308fc.tmp

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\8faf7ff3-f8ef-413a-9774-df6f431308fc.tmp
Size 122B
SHA256 27891dea04544c18a65fd0e789d3e7eb6e55fd3fdf3b046ebc181f8fd4303444
MD5 ff82c5926f71d4ddb8a5a7f6c1bd894f
SHA1 9cc69e4deb7817fd953c36bd6b7c5d1b5c63f8de
SHA512 68b38789d9ee6b104fb0b1bba6187550b093fcaa9f55e3efaacfca6c5c3334598a4e563714a8532eda72d4ee3a4a0e0bd5c84990f06a8016a523c5f857dce514
TLSH
T176B09256643064B2091F9E31410EB86A58B915208E472A4B86E832899A6726C098B21E
MD5 SHA1 SHA512 TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Cache\Cache_Data\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Cache\Cache_Data\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

a24024ed-8d10-447f-b85e-95b5c21813e0.tmp

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Code Cache\js\index-dir\a24024ed-8d10-447f-b85e-95b5c21813e0.tmp
Size 48B
SHA256 8322f6b20473e2863c881022d4300c81dc51fcf37f4d725c2eed3971538360ad
MD5 e76cae9c3425d9bd448a63ae79a0407b
SHA1 8043367303894f5845804e41acf90a090eb3ba56
SHA512 02ae028a5adff727791f716591eaa12347c3a9ece5e54cbcf51e0c2c6eb7f1008146194ede72d08f12611521aefa3af3ac9000e94eb1c4c1a0d85ad3bdfd0eb4
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 5d1653cc257f7c05deee47b7d066f4f034d3dd335dc6474a96c8f1329fc7be59
MD5 1d45ea6f44c7a82e0add38b046ebf121
SHA1 8c8add2ca41c15e36fd2609affd91d0196785675
SHA512 d990b125ef3a8b0f12fd32ba460de62ecd6b6cb3172990bf1fd09e89478abcc7d80961eeb93a3050b6a73042d019167645a5428f3dcd5cd32ce7fd4f6d355a06
TLSH
T1EB412D8E032599CFDFEF31FB68C8546334792D349863AE414D63AC3AA020F95474B900
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Network\Network Persistent State
Size 1KB
SHA256 714e2d0f1777126c84b49bc085d52dc39037dd53eb2c9aa6d9129d11309ed1aa
MD5 e0a356c0248f47c384b1ac025854de9a
SHA1 bde3aee9786e5b7199b6550b9a82d239821841c5
SHA512 475b3540553afe87f3dc28a5b5b9c9c0cab083166a1e79ffcd2b54a709c37021cc1f3e7917b2768b1da7e33ff48bc9a878f6a0ebab92484e43620fddd1821d6f
TLSH
T13931DC82C3ED42BDC66267F92F213A63C1AE0A5C43183C07C9DAEF8E57E18365A1054E
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Partitions\cowork-file-preview\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Partitions\cowork-file-preview\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Partitions\launch-preview-static\Local Storage\leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

1100b3a5-0c06-49b0-866b-254d5f573a61.tmp

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Partitions\launch-preview-static\Network\1100b3a5-0c06-49b0-866b-254d5f573a61.tmp
Size 84B
SHA256 712196693e3527ac1131831f1a2108b6c0e5c68967b26d51a452611cdfb86e0c
MD5 32b9dc9cc81d0682e78627c873fdd651
SHA1 46c486386d3e153c3e9b11d54cb52cf0064b71cf
SHA512 f18bc37f8b72411548da247aa1394cc5ac03c3bbd98e82eb8ba290ef239ef5b8625cf4835bd41ce7c52766d0bc3bfe9150dd22dbf62f0f05992ddde5fbfdc811
TLSH
T154A0121490405CFB0308835504146463C3F50002421848A91634318D019209D0004403
MD5 SHA1 SHA512 TLSH

Submit Download

f0a3d7d7-b106-42ea-a7fd-a719343cf489.tmp

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Partitions\launch-preview-static\Network\f0a3d7d7-b106-42ea-a7fd-a719343cf489.tmp
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Preferences
Size 197B
SHA256 e10b48b2069614ef9070f74023e51565b0a9544bca143fbf4e199fc5682e11be
MD5 148379f83c32581ed558fb4e25eee110
SHA1 80eb8f36e134e5a356e05592277bef021cce5580
SHA512 d7d883f27749f684672b1c7995bed422670c72dd6a631a84d90072958388b779eab7e05c5e6c3c51e6b9f772a63a66bb9a13c0bc99aaa0b22864721ceb49f130
TLSH
T1DED02206607051F2082FEC21404C785549B406008E0B2A8389F63244092B22C058750E
MD5 SHA1 SHA512 TLSH

Submit Download

claude_desktop_config.json.tmp

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\claude_desktop_config.json.tmp
Size 228B
SHA256 9acc445eca7de0738ef57460645c93207f143466a40dc535183bbfaad41ebd64
MD5 c137425a4787ac3d923563ec34db66c4
SHA1 9dd67695757d5cb4c36bde76db8aaa3213383fbb
SHA512 3e6d5e6eabdbe1cefbadcd120749b4d3f863af87451418eec40085c64d96557a22dfa359fc4b4dfdb2ce05780cc7a9ccb8e5ebf17e3edd2a0b9af9b224f74c6d
TLSH
T114D0A720D8310FA705F2921C4D3D845343017A832928702CA5AF055C1FCC93C6834452
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\config.json
Size 42B
SHA256 b55285b1cba17a7d1afbc9e8941cc36e0c2a36d7ad95f39d56b4e6c3b0440702
MD5 ff7cca5ff62924f56201884e190f2bb1
SHA1 8e1abdb7412c534a46f2d7e168a97ca88d4dbc2c
SHA512 922ea2a1d863ba1512ff16ab022c8a0c1fb0ac88f4542953c5d612a11050b76b6362573e42c56770d3ff1f2bf0adf3209aa09fa4dde539ec81855500e2b44238
MD5 SHA1 SHA512

Submit Download

config.json.tmp-368562341421c427

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\config.json.tmp-368562341421c427
Size 77B
SHA256 25609dfec2beccac61ab21a7fef6c74dabfe38496df749e72b9953e50901868b
MD5 15e3fdefbdc13362907898d5bd59f9bc
SHA1 8f0abd52c2fb744b034ce9b32569b4f7506d3cb6
SHA512 3d322fcaea8c44e0c455f3784631b0b219ef35ef93c7398f22ca7b6ff01ea4e6ee43426d18eec296d8bae371ee1f3fbdd0e0582408a802bea018c46fc6fa3fc9
TLSH
T19EA022AEB0208022EC0E0BFC088C0083828803CC0F2B0008002C023CC883BAC3BCA282
MD5 SHA1 SHA512 TLSH

Submit Download

config.json.tmp-36856240137cea50

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\config.json.tmp-36856240137cea50
Size 62B
SHA256 417384b5c8320cc8de6d5b3ab3b82cb952a2f478e12e37cb104d8f1d29003117
MD5 27b3b688e9792681b109ca3f61466156
SHA1 a27d6c12c17dc4ef313b03d7f4608e4812b70705
SHA512 31a188782e67d183027a08d5555544673d3f9485f31335fa067262e8539061e9d90bb7771835be5c06800ecacc20829ec604a42a031ca58b1be1d12887359650
TLSH
T1EFA0022AC0219023F01482EC040401C785D9025C6A0B190646917119C547BBC664A356
MD5 SHA1 SHA512 TLSH

Submit Download

config.json.tmp-36856241892bd15b

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\config.json.tmp-36856241892bd15b
Size 90B
SHA256 7be28b76852ec1ddcdd8c934a27f98ec0da9548450a0dc54d620657a62a6b4a8
MD5 a19694fe87db2fb6fc814315c8fb140b
SHA1 55d980952d361f4ba8fd7f8a4ae5516ef68c4142
SHA512 1ef36d6a0c417003b5f2100b5cd55ee3b67d8168881a953b8f810fc0f8cae8636fbe2279360c343b39f1c3c0339947116820ee400422b91253b777af0ade13e0
TLSH
T136B01235C0114013F00081EC000C00C640AC12195D07040F45A16108C147EAC7225B12
MD5 SHA1 SHA512 TLSH

Submit Download

git-worktrees.json

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\git-worktrees.json
Size 20B
SHA256 f0bc550ac05dd2b909b3551952c6d420bcab2f00c06056f9cd22a767c4ce389b
MD5 e81562802df3ee9bdae750db6449fbe3
SHA1 9f33369ff7aa8ea66075158a79d1f7de923b4924
SHA512 7a77e2e73b4ea7dc9ed36bca78adb5ad01609668bb9a2a1e6964d9c464246bb770495a9a66fba07dde054d38ff3c0d61c4a9d2f7026ce0f654a81a6e06e667f2
MD5 SHA1 SHA512

Submit Download

git-worktrees.json.tmp-3685619642c268df

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\git-worktrees.json.tmp-3685619642c268df
Size 41B
SHA256 8fc79e5ab7122d9bdefc19199129249ed3823801840d7d065579dfdae8cfad15
MD5 b248a937ded76419d289994d74555354
SHA1 785642689ccfe95fb266d894ee85438030be9e55
SHA512 4720de5d5c54a601c3acffa7639b0055b88e8672027ccd5cf99590176101bf2b62dfac820bd27182b41d5f886f49ddf46fb6803b3622e4b5cbc12995a015a349
MD5 SHA1 SHA512

Submit Download

APPX.dpakahe9nhj0n6b29j83byd9d.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX.dpakahe9nhj0n6b29j83byd9d.tmp
Size 10KB
SHA256 1922c27eb36e3d7566ab049e0fc5dc4c4fdd34cd57de5cbce579505955023a00
MD5 369bf528594cc4d819479a06408a05bd
SHA1 00a72a02e5ec38f62c9b13c47d0cdeeea0c718e4
SHA512 1fdc060988e01bbff69e9faa068e3f63d7bd57a304ce1a910efecb336685dd7ef36c2bea98536069c9bf9a40d7c67341ef68dcdb447a64df10837992669bc1e8
SSDEEP 192:C8PRNyEIYiYF80dmL4pUQaULc8pq8RuX5hz28uNNTPKTdbNbJ+sFRE+LLY:CYRNyEIYi2mL4/y8RKE7qxb7Sz
TLSH
T194224BA388906C0AED275D50B4D4A936FEB2B2866AC0C1C77159C166CB843833FDD2FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

APPX.ss6v7xnzr9k34yhfnhrgwn1vc.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX.ss6v7xnzr9k34yhfnhrgwn1vc.tmp
Size 7KB
SHA256 3fdfddf4985ccb3c000a59e8a56e704c84369fec98f7754c3a9766487f2d6f68
MD5 d15b17174c9365e67a862d6e2b646df2
SHA1 033344f71bf7cdeb0948bc4b5fbc7b87bff25029
SHA512 262513161ae3c5fded8d836c2daeeaf8f23dd482dfb74517ef5f4c8d177890191f9355d3681ebda4c273101179cc12eac7201d19f8d45a03ce5d186417631f10
SSDEEP 192:rJG1F4RVbrowD+q6LYYcwmbTYp+bkk6W+Gkk63:rJG1F4RVbrowD+TLY/wJ+bkk6W+Gkk63
TLSH
T1FDE1F14BD4AD18504672E1AAAF13D686EB2C095758DE00C4BCDD56432FB265F033BB9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

APPX.xz4nqu7vrkc66s07yehnyc70e.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX.xz4nqu7vrkc66s07yehnyc70e.tmp
Size 856KB
SHA256 7e4afc483f31ddd3b14c2e1f4ce67d2fb0c16e0ef5c1801d3bbb5dffa7cf4966
MD5 9d792409c8506fc31b249ca80af684c4
SHA1 6048c5da66916715e172c8f3add95f8dc8845e34
SHA512 0eb85266dae848a22363754bb6b95ee5c520ec8c32a74f1bd942cdd0034ed97185e4ed9f244b6661ee86998d0ad38c74b94dd84e3d6e4c862925ef954d6d3c15
SSDEEP 12288:zTB7BSYM/VctITTJ6CpPaoWZx3BizVLU2vT9HmvFiy2yRjW+gwf:z97W/FXJ6CpyocpkzVLU2vxuRjQ+v
TLSH
T17F15B4E1153DBE3681AD0AAD8F24F4042C35983613376E0E9C5E92B71CBF9A25F674E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ClaudeSetup.log

Path C:\Users\Admin\AppData\Local\Temp\ClaudeSetup.log
Size 3KB
SHA256 3683c92424446463f2d938a262f7cf938cab7a893f96dac0fd44f1f35175c1bd
MD5 7b1b5c6dad03d6a80adc069893e69fc7
SHA1 8f4a3d701faad3f6f1db3d6a25bd979a20e8331e
SHA512 b33c4dd63c7e86f9d84edc430580a1b2c42ca618652d9f260113ae1ba2d93862dd3c791f07328a81f063922b8d2ef10c3357b495830f0237184121afe03ac637
TLSH
T167711E9688D3C8F907D494C6E666331D882F39FABF2D9F1078D4C8F460123196F595C6
MD5 SHA1 SHA512 TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/2192-149-0x00007FF9E60B0000-0x00007FF9E60B1000-memory.dmp

Download

memory/2192-145-0x00007FF9E66D0000-0x00007FF9E66D1000-memory.dmp

Download

memory/6072-34-0x000002DEE90D0000-0x000002DEE9133000-memory.dmp

Download

memory/6072-36-0x000002DEE90D0000-0x000002DEE9133000-memory.dmp

Download