hxxps://www[.]google[.]com/aclk?sa=L&ai=DChsSEwiJtYHkpcyVAxVkMwgFHTBgE2oYACICCAIQABoCbWQ&co=1&ase=2&gclid=CjwKCAjw08fSBhA7EiwAfbQTsHhlCCqbU8mqXX1q6V2KNMLDzrbWNtEUMBeOvzrnTS-srlZgfb7cqRoCQl4QAvD_BwE&cid=CAASugHkaLnK9iZHYR0i1LIEOjdXUg5LmhYWqDcY_jsFYDpLXKWEC1sc1LkTWK4uedoQXqfy_1lKUX8gZKITIQEPp7d2uWKc8dULkxa8sbv-qoybuffgYaCof-gKOrpnjten_Acnb8oRMCcR4QCy7J9vzXS2ezDH74IezBr-ARtu1rOgszCqVMVUc4k5zcJVArz-VcW_2wnEQEOEVUIxOlWH2yJThLo3ll-9Z8M_1E_xNyWro2MPXi0knm4gj64&cce=2&category=acrcp_v1_32&sig=AOD64_2FlP66fNf-TZ6Eg1VTJVbO5oh72w&q&nis=4&adurl&ved=2ahUKEwjhovrjpcyVAxVlg4kEHTHVKVUQ0Qx6BAhyEAE

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/07/2026, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.google.com/aclk?sa=L&ai=DChsSEwiJtYHkpcyVAxVkMwgFHTBgE2oYACICCAIQABoCbWQ&co=1&ase=2&gclid=CjwKCAjw08fSBhA7EiwAfbQTsHhlCCqbU8mqXX1q6V2KNMLDzrbWNtEUMBeOvzrnTS-srlZgfb7cqRoCQl4QAvD_BwE&cid=CAASugHkaLnK9iZHYR0i1LIEOjdXUg5LmhYWqDcY_jsFYDpLXKWEC1sc1LkTWK4uedoQXqfy_1lKUX8gZKITIQEPp7d2uWKc8dULkxa8sbv-qoybuffgYaCof-gKOrpnjten_Acnb8oRMCcR4QCy7J9vzXS2ezDH74IezBr-ARtu1rOgszCqVMVUc4k5zcJVArz-VcW_2wnEQEOEVUIxOlWH2yJThLo3ll-9Z8M_1E_xNyWro2MPXi0knm4gj64&cce=2&category=acrcp_v1_32&sig=AOD64_2FlP66fNf-TZ6Eg1VTJVbO5oh72w&q&nis=4&adurl&ved=2ahUKEwjhovrjpcyVAxVlg4kEHTHVKVUQ0Qx6BAhyEAE
Sample260712-e2dt1acy5p

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
80	4484	msedge.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	Claude Setup.exe

Executes dropped EXE 2 IoCs

pid	Process
3076	Claude Setup.exe
5432	Claude Setup.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_A53644FA0CAAA458C7A0416292C7CC5B	cowork-svc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB	cowork-svc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB	cowork-svc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	cowork-svc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	cowork-svc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_A53644FA0CAAA458C7A0416292C7CC5B	cowork-svc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4484	msedge.exe

Checks processor information in registry 2 TTPs 26 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	Claude.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 43 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	cowork-svc.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134283039635445584"	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	cowork-svc.exe

Modifies registry class 12 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\claude\shell\open\command\ = "\"C:\\Program Files\\WindowsApps\\Claude_1.20186.1.0_x64__pzs8sxrjxfjjc\\app\\Claude.exe\" \"%1\""	Claude.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\claude	Claude.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\claude\URL Protocol	Claude.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\claude\shell\open\command	Claude.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\claude\shell	Claude.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{6E819650-9F7E-404F-BE8F-1172D2305EB7}	Claude.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{38591E1E-B3BA-476C-A2CA-E8B3D9D24059}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\claude\ = "URL:claude"	Claude.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\claude\shell\open	Claude.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
7144	reg.exe
7136	reg.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5432	Claude Setup.exe
5432	Claude Setup.exe
2248	cowork-svc.exe
2248	cowork-svc.exe
6260	msedge.exe
6260	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3424	Claude.exe
Token: SeCreatePagefilePrivilege	3424	Claude.exe
Token: SeShutdownPrivilege	3424	Claude.exe
Token: SeCreatePagefilePrivilege	3424	Claude.exe
Token: SeShutdownPrivilege	3424	Claude.exe
Token: SeCreatePagefilePrivilege	3424	Claude.exe
Token: SeShutdownPrivilege	3424	Claude.exe
Token: SeCreatePagefilePrivilege	3424	Claude.exe
Token: SeShutdownPrivilege	3424	Claude.exe
Token: SeCreatePagefilePrivilege	3424	Claude.exe
Token: SeShutdownPrivilege	3424	Claude.exe
Token: SeCreatePagefilePrivilege	3424	Claude.exe
Token: SeShutdownPrivilege	3424	Claude.exe
Token: SeCreatePagefilePrivilege	3424	Claude.exe
Token: SeShutdownPrivilege	3424	Claude.exe
Token: SeCreatePagefilePrivilege	3424	Claude.exe
Token: SeShutdownPrivilege	3424	Claude.exe
Token: SeCreatePagefilePrivilege	3424	Claude.exe
Token: SeShutdownPrivilege	3424	Claude.exe
Token: SeCreatePagefilePrivilege	3424	Claude.exe
Token: SeShutdownPrivilege	3424	Claude.exe
Token: SeCreatePagefilePrivilege	3424	Claude.exe
Token: SeShutdownPrivilege	3424	Claude.exe
Token: SeCreatePagefilePrivilege	3424	Claude.exe
Token: SeShutdownPrivilege	3424	Claude.exe
Token: SeCreatePagefilePrivilege	3424	Claude.exe
Token: SeShutdownPrivilege	3424	Claude.exe
Token: SeCreatePagefilePrivilege	3424	Claude.exe
Token: SeShutdownPrivilege	3424	Claude.exe
Token: SeCreatePagefilePrivilege	3424	Claude.exe
Token: SeShutdownPrivilege	3424	Claude.exe
Token: SeCreatePagefilePrivilege	3424	Claude.exe
Token: SeShutdownPrivilege	3424	Claude.exe
Token: SeCreatePagefilePrivilege	3424	Claude.exe
Token: SeShutdownPrivilege	3424	Claude.exe
Token: SeCreatePagefilePrivilege	3424	Claude.exe
Token: SeShutdownPrivilege	3424	Claude.exe
Token: SeCreatePagefilePrivilege	3424	Claude.exe
Token: SeShutdownPrivilege	3424	Claude.exe
Token: SeCreatePagefilePrivilege	3424	Claude.exe
Token: SeShutdownPrivilege	3424	Claude.exe
Token: SeCreatePagefilePrivilege	3424	Claude.exe
Token: SeShutdownPrivilege	3424	Claude.exe
Token: SeCreatePagefilePrivilege	3424	Claude.exe
Token: SeShutdownPrivilege	3424	Claude.exe
Token: SeCreatePagefilePrivilege	3424	Claude.exe
Token: SeShutdownPrivilege	3424	Claude.exe
Token: SeCreatePagefilePrivilege	3424	Claude.exe
Token: SeShutdownPrivilege	3424	Claude.exe
Token: SeCreatePagefilePrivilege	3424	Claude.exe
Token: SeShutdownPrivilege	3424	Claude.exe
Token: SeCreatePagefilePrivilege	3424	Claude.exe
Token: SeShutdownPrivilege	3424	Claude.exe
Token: SeCreatePagefilePrivilege	3424	Claude.exe
Token: SeShutdownPrivilege	3424	Claude.exe
Token: SeCreatePagefilePrivilege	3424	Claude.exe
Token: SeShutdownPrivilege	3424	Claude.exe
Token: SeCreatePagefilePrivilege	3424	Claude.exe
Token: SeShutdownPrivilege	3424	Claude.exe
Token: SeCreatePagefilePrivilege	3424	Claude.exe
Token: SeShutdownPrivilege	3424	Claude.exe
Token: SeCreatePagefilePrivilege	3424	Claude.exe
Token: SeShutdownPrivilege	3424	Claude.exe
Token: SeCreatePagefilePrivilege	3424	Claude.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 5996 wrote to memory of 6076	5996	msedge.exe	87
PID 5996 wrote to memory of 4484	5996	msedge.exe	88
PID 5996 wrote to memory of 5952	5996	msedge.exe	89
PID 5996 wrote to memory of 5952	5996	msedge.exe	89
PID 5996 wrote to memory of 5952	5996	msedge.exe	89
PID 5996 wrote to memory of 4552	5996	msedge.exe	90
PID 5996 wrote to memory of 4552	5996	msedge.exe	90
PID 5996 wrote to memory of 5372	5996	msedge.exe	92
PID 5996 wrote to memory of 5372	5996	msedge.exe	92
PID 5996 wrote to memory of 5372	5996	msedge.exe	92
PID 5996 wrote to memory of 3748	5996	msedge.exe	93
PID 5996 wrote to memory of 3748	5996	msedge.exe	93
PID 5996 wrote to memory of 3748	5996	msedge.exe	93
PID 5996 wrote to memory of 5440	5996	msedge.exe	95
PID 5996 wrote to memory of 5440	5996	msedge.exe	95
PID 5996 wrote to memory of 5440	5996	msedge.exe	95
PID 5996 wrote to memory of 3288	5996	msedge.exe	98
PID 5996 wrote to memory of 3288	5996	msedge.exe	98
PID 5996 wrote to memory of 3560	5996	msedge.exe	97
PID 5996 wrote to memory of 3560	5996	msedge.exe	97
PID 5996 wrote to memory of 3480	5996	msedge.exe	102
PID 5996 wrote to memory of 3176	5996	msedge.exe	109
PID 5996 wrote to memory of 3176	5996	msedge.exe	109
PID 5996 wrote to memory of 3176	5996	msedge.exe	109
PID 5996 wrote to memory of 5912	5996	msedge.exe	110
PID 5996 wrote to memory of 5920	5996	msedge.exe	111
PID 5996 wrote to memory of 5912	5996	msedge.exe	110
PID 5996 wrote to memory of 5920	5996	msedge.exe	111
PID 5996 wrote to memory of 5920	5996	msedge.exe	111
PID 5996 wrote to memory of 4984	5996	msedge.exe	112
PID 5996 wrote to memory of 4828	5996	msedge.exe	113
PID 5996 wrote to memory of 4828	5996	msedge.exe	113
PID 5996 wrote to memory of 3076	5996	msedge.exe	117
PID 5996 wrote to memory of 5492	5996	msedge.exe	120
PID 5996 wrote to memory of 824	5996	msedge.exe	121
PID 5996 wrote to memory of 3428	5996	msedge.exe	122
PID 3076 wrote to memory of 5432	3076	Claude Setup.exe	124
PID 5432 wrote to memory of 204	5432	Claude Setup.exe	128
PID 3424 wrote to memory of 5732	3424	Claude.exe	135
PID 3424 wrote to memory of 1724	3424	Claude.exe	136
PID 3424 wrote to memory of 1444	3424	Claude.exe	137
PID 3424 wrote to memory of 464	3424	Claude.exe	138
PID 3424 wrote to memory of 4044	3424	Claude.exe	139
PID 3424 wrote to memory of 3996	3424	Claude.exe	140
PID 3424 wrote to memory of 7136	3424	Claude.exe	142
PID 3424 wrote to memory of 7144	3424	Claude.exe	143
PID 3424 wrote to memory of 5688	3424	Claude.exe	146
PID 5996 wrote to memory of 7764	5996	msedge.exe	148
PID 5996 wrote to memory of 7764	5996	msedge.exe	148
PID 3424 wrote to memory of 6988	3424	Claude.exe	149
PID 3424 wrote to memory of 6996	3424	Claude.exe	150
PID 5996 wrote to memory of 6260	5996	msedge.exe	153

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.google.com/aclk?sa=L&ai=DChsSEwiJtYHkpcyVAxVkMwgFHTBgE2oYACICCAIQABoCbWQ&co=1&ase=2&gclid=CjwKCAjw08fSBhA7EiwAfbQTsHhlCCqbU8mqXX1q6V2KNMLDzrbWNtEUMBeOvzrnTS-srlZgfb7cqRoCQl4QAvD_BwE&cid=CAASugHkaLnK9iZHYR0i1LIEOjdXUg5LmhYWqDcY_jsFYDpLXKWEC1sc1LkTWK4uedoQXqfy_1lKUX8gZKITIQEPp7d2uWKc8dULkxa8sbv-qoybuffgYaCof-gKOrpnjten_Acnb8oRMCcR4QCy7J9vzXS2ezDH74IezBr-ARtu1rOgszCqVMVUc4k5zcJVArz-VcW_2wnEQEOEVUIxOlWH2yJThLo3ll-9Z8M_1E_xNyWro2MPXi0knm4gj64&cce=2&category=acrcp_v1_32&sig=AOD64_2FlP66fNf-TZ6Eg1VTJVbO5oh72w&q&nis=4&adurl&ved=2ahUKEwjhovrjpcyVAxVlg4kEHTHVKVUQ0Qx6BAhyEAE
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff8da57c188,0x7ff8da57c194,0x7ff8da57c1a0
  2⤵
  PID:6076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,2640998101813645321,16412429372985120325,524288 --field-trial-handle=2348,i,17763546178599251265,10537830947235337065,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1752,i,8183978825012862056,16890814763239323548,262144 --field-trial-handle=2348,i,17763546178599251265,10537830947235337065,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:2
  2⤵
  PID:5952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2488,i,17330089921391136305,591547236572843124,524288 --field-trial-handle=2348,i,17763546178599251265,10537830947235337065,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:8
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,9504324083066338940,11852245017964562818,2097152 --field-trial-handle=2348,i,17763546178599251265,10537830947235337065,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:5372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3408,i,861893184969418197,11377574604620034159,2097152 --field-trial-handle=2348,i,17763546178599251265,10537830947235337065,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4920,i,4679662814895461244,993092926012723086,2097152 --field-trial-handle=2348,i,17763546178599251265,10537830947235337065,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:1
  2⤵
  PID:5440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3728,i,4873497651892133450,17089764132570393551,524288 --field-trial-handle=2348,i,17763546178599251265,10537830947235337065,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:8
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3712,i,4389191461071458778,5834953435610933681,524288 --field-trial-handle=2348,i,17763546178599251265,10537830947235337065,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:8
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5772,i,8827480313664820511,4598835979425293344,524288 --field-trial-handle=2348,i,17763546178599251265,10537830947235337065,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:8
  2⤵
  PID:5492
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5772,i,8827480313664820511,4598835979425293344,524288 --field-trial-handle=2348,i,17763546178599251265,10537830947235337065,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:8
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6156,i,12097063100849945509,4310761654549486920,2097152 --field-trial-handle=2348,i,17763546178599251265,10537830947235337065,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:1
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5052,i,14337172880174450116,10778780418686120507,524288 --field-trial-handle=2348,i,17763546178599251265,10537830947235337065,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:8
  2⤵
  PID:5912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4964,i,14521316885770920422,3657272932441539983,2097152 --field-trial-handle=2348,i,17763546178599251265,10537830947235337065,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:1
  2⤵
  PID:5920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,11423077710668776205,1017287850408931857,524288 --field-trial-handle=2348,i,17763546178599251265,10537830947235337065,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:8
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6692,i,11174236404665970508,13556933499422519669,524288 --field-trial-handle=2348,i,17763546178599251265,10537830947235337065,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:8
  2⤵
  PID:4828
- C:\Users\Admin\Downloads\Claude Setup.exe
  "C:\Users\Admin\Downloads\Claude Setup.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3076
- - C:\Users\Admin\Downloads\Claude Setup.exe
    "C:\Users\Admin\Downloads\Claude Setup.exe" --elevated --msix-path "C:\Users\Admin\AppData\Local\Temp\Claude-2027382993.msix" --log-path "C:\Users\Admin\AppData\Local\Temp\ClaudeSetup.log" --all-users
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:5432
  - - C:\Windows\explorer.exe
      explorer.exe shell:AppsFolder\Claude_pzs8sxrjxfjjc!Claude
      4⤵
      PID:204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,1236086000565533277,12625845117806515571,524288 --field-trial-handle=2348,i,17763546178599251265,10537830947235337065,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:8
  2⤵
  PID:5492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,13650277997959425667,10701505464051255291,524288 --field-trial-handle=2348,i,17763546178599251265,10537830947235337065,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:8
  2⤵
  PID:824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,5657142779529629969,7566012525564198735,524288 --field-trial-handle=2348,i,17763546178599251265,10537830947235337065,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:8
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,16559487402045147697,10213772650775343468,524288 --field-trial-handle=2348,i,17763546178599251265,10537830947235337065,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:8
  2⤵
  PID:7764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3688,i,6028245164145405766,15369863153247276623,262144 --field-trial-handle=2348,i,17763546178599251265,10537830947235337065,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6260

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5992

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4900

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness
1⤵
PID:1592

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
PID:4468

C:\Program Files\WindowsApps\Claude_1.20186.1.0_x64__pzs8sxrjxfjjc\app\resources\cowork-svc.exe
"C:\Program Files\WindowsApps\Claude_1.20186.1.0_x64__pzs8sxrjxfjjc\app\resources\cowork-svc.exe"
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2248

C:\Program Files\WindowsApps\Claude_1.20186.1.0_x64__pzs8sxrjxfjjc\app\Claude.exe
"C:\Program Files\WindowsApps\Claude_1.20186.1.0_x64__pzs8sxrjxfjjc\app\Claude.exe"
1⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3424
- C:\Program Files\WindowsApps\Claude_1.20186.1.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.20186.1.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\Claude /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\Claude\Crashpad --url=https://f.a.k/e --annotation=_productName=Claude --annotation=_version=1.20186.1 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=42.5.1 --initial-client-data=0x4b0,0x4b4,0x4b8,0x4ac,0x4bc,0x7ff68e62a148,0x7ff68e62a158,0x7ff68e62a168
  2⤵
  PID:5732
- C:\Program Files\WindowsApps\Claude_1.20186.1.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.20186.1.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2092,i,14355242132159801426,3776343819646704536,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2096,i,11943327724845891699,12571673592459706663,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:1724
- C:\Program Files\WindowsApps\Claude_1.20186.1.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.20186.1.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --field-trial-handle=2092,i,14355242132159801426,3776343819646704536,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2096,i,11943327724845891699,12571673592459706663,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  PID:1444
- C:\Program Files\WindowsApps\Claude_1.20186.1.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.20186.1.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --app-path="C:\Program Files\WindowsApps\Claude_1.20186.1.0_x64__pzs8sxrjxfjjc\app\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2092,i,14355242132159801426,3776343819646704536,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2096,i,11943327724845891699,12571673592459706663,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2880 --desktop-enterprise-config="{\"forceLoginOrgUUIDs\":null,\"loginSsoOrgDomain\":null,\"disableEssentialTelemetry\":false,\"disableNonessentialTelemetry\":false,\"banner\":null}" /prefetch:1
  2⤵
  PID:464
- C:\Program Files\WindowsApps\Claude_1.20186.1.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.20186.1.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --app-path="C:\Program Files\WindowsApps\Claude_1.20186.1.0_x64__pzs8sxrjxfjjc\app\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2092,i,14355242132159801426,3776343819646704536,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2096,i,11943327724845891699,12571673592459706663,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3124 --desktop-features="{\"artifactsPane\":{\"status\":\"unavailable\"},\"nativeQuickEntry\":{\"status\":\"unavailable\"},\"quickEntryDictation\":{\"status\":\"unavailable\"},\"quickEntryGlobalShortcut\":{\"status\":\"supported\"},\"customQuickEntryDictationShortcut\":{\"status\":\"supported\"},\"plushRaccoon\":{\"status\":\"unavailable\"},\"quietPenguin\":{\"status\":\"unavailable\"},\"chillingSlothFeat\":{\"status\":\"supported\"},\"chillingSlothSshShell\":{\"status\":\"supported\"},\"chillingSlothEnterprise\":{\"status\":\"supported\"},\"chillingSlothLocal\":{\"status\":\"supported\"},\"chillingSlothPool\":{\"status\":\"unavailable\"},\"yukonSilver\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute\",\"unsupportedCode\":\"hcs_not_available\"},\"yukonSilverGems\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute\",\"unsupportedCode\":\"hcs_not_available\"},\"yukonSilverGemsCache\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute\",\"unsupportedCode\":\"hcs_not_available\"},\"wakeScheduler\":{\"status\":\"unavailable\"},\"desktopTopBar\":{\"status\":\"supported\"},\"ccdPlugins\":{\"status\":\"supported\"},\"computerUse\":{\"status\":\"supported\"},\"coworkWatchRecord\":{\"status\":\"unsupported\",\"reason\":\"Watch-record is not available on this platform\",\"unsupportedCode\":\"unsupported_platform\"},\"coworkKappa\":{\"status\":\"unavailable\"},\"coworkArtifacts\":{\"status\":\"unavailable\"},\"framebufferPreview\":{\"status\":\"unavailable\"},\"iosSimulator\":{\"status\":\"unavailable\"},\"androidEmulator\":{\"status\":\"unavailable\"},\"iosSimulatorH264\":{\"status\":\"unavailable\"},\"grandPrix\":{\"status\":\"unavailable\"},\"tearOffHalo\":{\"status\":\"unsupported\",\"reason\":\"Tear-off halo overlay requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"coworkArtifactPopout\":{\"status\":\"supported\"},\"claudeDesignWindow\":{\"status\":\"supported\"},\"coworkRemoteSessionSpaces\":{\"status\":\"supported\"},\"spaceMemoryBridge\":{\"status\":\"unavailable\"},\"grandPrixRequest\":{\"status\":\"unavailable\"},\"coworkBranchSession\":{\"status\":\"supported\"},\"coworkScheduledTaskProjects\":{\"status\":\"supported\"},\"bootstrapConfig\":{\"status\":\"supported\"},\"chatIn3p\":{\"status\":\"supported\"},\"builtinMcpPresets\":{\"status\":\"supported\"},\"surfaceTogglesPreview\":{\"status\":\"unavailable\"},\"chatTab\":{\"status\":\"unavailable\"},\"chatCodeExecution\":{\"status\":\"unavailable\"},\"epitaxyMcpApps\":{\"status\":\"unavailable\"}}" --desktop-enterprise-config="{\"forceLoginOrgUUIDs\":null,\"loginSsoOrgDomain\":null,\"disableEssentialTelemetry\":false,\"disableNonessentialTelemetry\":false,\"banner\":null}" --desktop-telemetry-config="{\"deploymentMode\":\"1p\",\"appVersion\":\"1.20186.1\",\"cookielessOrigin\":false}" /prefetch:1
  2⤵
  PID:4044
- C:\Program Files\WindowsApps\Claude_1.20186.1.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.20186.1.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --app-path="C:\Program Files\WindowsApps\Claude_1.20186.1.0_x64__pzs8sxrjxfjjc\app\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2092,i,14355242132159801426,3776343819646704536,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2096,i,11943327724845891699,12571673592459706663,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3136 --desktop-enterprise-config="{\"forceLoginOrgUUIDs\":null,\"loginSsoOrgDomain\":null,\"disableEssentialTelemetry\":false,\"disableNonessentialTelemetry\":false,\"banner\":null}" /prefetch:1
  2⤵
  PID:3996
- C:\Windows\System32\reg.exe
  C:\Windows\System32\reg.exe query HKLM\SOFTWARE\Policies\ClaudeCode /v Settings
  2⤵
  - Modifies registry key
  PID:7136
- C:\Windows\System32\reg.exe
  C:\Windows\System32\reg.exe query HKCU\SOFTWARE\Policies\ClaudeCode /v Settings
  2⤵
  - Modifies registry key
  PID:7144
- C:\Program Files\WindowsApps\Claude_1.20186.1.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.20186.1.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --app-path="C:\Program Files\WindowsApps\Claude_1.20186.1.0_x64__pzs8sxrjxfjjc\app\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=2092,i,14355242132159801426,3776343819646704536,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2096,i,11943327724845891699,12571673592459706663,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3480 --desktop-features="{\"artifactsPane\":{\"status\":\"unavailable\"},\"nativeQuickEntry\":{\"status\":\"unavailable\"},\"quickEntryDictation\":{\"status\":\"unavailable\"},\"quickEntryGlobalShortcut\":{\"status\":\"supported\"},\"customQuickEntryDictationShortcut\":{\"status\":\"supported\"},\"plushRaccoon\":{\"status\":\"unavailable\"},\"quietPenguin\":{\"status\":\"unavailable\"},\"chillingSlothFeat\":{\"status\":\"supported\"},\"chillingSlothSshShell\":{\"status\":\"supported\"},\"chillingSlothEnterprise\":{\"status\":\"supported\"},\"chillingSlothLocal\":{\"status\":\"supported\"},\"chillingSlothPool\":{\"status\":\"unavailable\"},\"yukonSilver\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute\",\"unsupportedCode\":\"hcs_not_available\"},\"yukonSilverGems\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute\",\"unsupportedCode\":\"hcs_not_available\"},\"yukonSilverGemsCache\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute\",\"unsupportedCode\":\"hcs_not_available\"},\"wakeScheduler\":{\"status\":\"unavailable\"},\"desktopTopBar\":{\"status\":\"supported\"},\"ccdPlugins\":{\"status\":\"supported\"},\"computerUse\":{\"status\":\"supported\"},\"coworkWatchRecord\":{\"status\":\"unsupported\",\"reason\":\"Watch-record is not available on this platform\",\"unsupportedCode\":\"unsupported_platform\"},\"coworkKappa\":{\"status\":\"unavailable\"},\"coworkArtifacts\":{\"status\":\"unavailable\"},\"framebufferPreview\":{\"status\":\"unavailable\"},\"iosSimulator\":{\"status\":\"unavailable\"},\"androidEmulator\":{\"status\":\"unavailable\"},\"iosSimulatorH264\":{\"status\":\"unavailable\"},\"grandPrix\":{\"status\":\"unavailable\"},\"tearOffHalo\":{\"status\":\"unsupported\",\"reason\":\"Tear-off halo overlay requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"coworkArtifactPopout\":{\"status\":\"supported\"},\"claudeDesignWindow\":{\"status\":\"supported\"},\"coworkRemoteSessionSpaces\":{\"status\":\"supported\"},\"spaceMemoryBridge\":{\"status\":\"unavailable\"},\"grandPrixRequest\":{\"status\":\"unavailable\"},\"coworkBranchSession\":{\"status\":\"supported\"},\"coworkScheduledTaskProjects\":{\"status\":\"supported\"},\"bootstrapConfig\":{\"status\":\"supported\"},\"chatIn3p\":{\"status\":\"supported\"},\"builtinMcpPresets\":{\"status\":\"supported\"},\"surfaceTogglesPreview\":{\"status\":\"unavailable\"},\"chatTab\":{\"status\":\"unavailable\"},\"chatCodeExecution\":{\"status\":\"unavailable\"},\"epitaxyMcpApps\":{\"status\":\"unavailable\"}}" --desktop-enterprise-config="{\"forceLoginOrgUUIDs\":null,\"loginSsoOrgDomain\":null,\"disableEssentialTelemetry\":false,\"disableNonessentialTelemetry\":false,\"banner\":null}" --desktop-telemetry-config="{\"deploymentMode\":\"1p\",\"appVersion\":\"1.20186.1\",\"cookielessOrigin\":false}" /prefetch:1
  2⤵
  PID:5688
- C:\Program Files\WindowsApps\Claude_1.20186.1.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.20186.1.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --field-trial-handle=2092,i,14355242132159801426,3776343819646704536,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2096,i,11943327724845891699,12571673592459706663,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=4808 /prefetch:8
  2⤵
  PID:6988
- C:\Program Files\WindowsApps\Claude_1.20186.1.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.20186.1.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --field-trial-handle=2092,i,14355242132159801426,3776343819646704536,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2096,i,11943327724845891699,12571673592459706663,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=4792 /prefetch:8
  2⤵
  - Modifies registry class
  PID:6996

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x394 0x4b8
1⤵
PID:7112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 b906fb4d27fba6cbc7530f850a5d54d22ea9679d5d13729cbe5132d882299e50
MD5 a9e1512125d76e977d036272c3e70971
SHA1 08177b39320ae59b339d5d12d9ab2fad931e91f2
SHA512 4cc9d52e125c4dc21dfd1f7e97f66d5019e61a81f4fea49cec968b59b5b525f0d56f9f4b72b59d38b0d2e7126696c0a6e6fa66b907b02b10495b97a3a7603b7d
TLSH
T1CBE02BA6CC62EC3718FD0758A0598656E70013172640894F3B3C82098FB973A45C9C5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0c90318583fafa49095ff4cdcf2e485a582b4083fdb147ab5a5c1343faf1b5d4
MD5 4e22a182b31ecec7ffee4205960ee1c6
SHA1 214576b5a32c18224a565b1564d60848cfe7c208
SHA512 fb08e66099301ec468e36c787d4e53b11bfcd6aada4294068a9f9746f1248ee8913436d432d6a601fd0bd3bb6a94fd0e59baa962b357f90c6954f46ad0011fce
TLSH
T1D881A43A5FBD0CE0EB1C00309AE62651BDB54CE6F913DEA38950F57C29BAB91839D541
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58cadd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58cadd.TMP
Size 3KB
SHA256 02e6a18da1efffbae66e99cd4d0ce8b0e5cdc97977b5cc14beb91cad19a90c40
MD5 15c64f5c328889e1133b8966472bb2c3
SHA1 260a18ef33836296602ca43c8f699953b145f22d
SHA512 9a19438997536e261cb66be19698e952639ab8e99d3c6d48945284ead79e4a84ee0c9bdb07ade91d9e2eafc043ccfa7124961bacf2298465b4a5a9c62b6809c4
TLSH
T14F617D3A6F7C08F1E71C0030AAE622613CB14DEAFD13DEC38100F4BC6A797528389600
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 284b3432eea9317a3625ff1dce687f07d6bb4ed787bf2dbaaef99990ff1e41bc
MD5 8147bb567b0e327f43ff239ca09b6ac1
SHA1 a231f49facbdcf8ad06d8e2379724136cf652af4
SHA512 8e27872c59d9052f2d60574f1ec3538cfa1e46d6aadfbeaa637e88156972f489f1201db80bb5178cac190685ed9bf45d033ce1fb64f0a34ee3cc8327c35ca99d
SSDEEP 96:D1ioOg3yqu/Saaij6DMzAqdpebw6tGw4w/:D1iTSjuqaaij6DMEqdpebwuGtw/
TLSH
T16B918AF3C7E9866ECA1165F8AB14BE2BCE1D0514431C3D2A85D4BF1BD7E24B1E11261E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 649b5c15beb22e4c19e84aa2efc699ca9d31cfc39f556dc78e3c552696e62d1a
MD5 6914838c701d1c2086606b59617bda30
SHA1 fd7bd77025fb754d2ef9efee2ac70170a1fe7789
SHA512 ede8278a260b1ebb671197b98ec00d6e3492311bc1e4316d6d0614287e657c7a260eee6a780ec62865d5b9a33f970bb55c288815b08fef7819bdf7ce3958c47e
SSDEEP 192:sxZYRfyMqZjK1Ml8UQ/9X/f3sl8ZdfzodpoABHW6+WNl4WXYva/qft6AIg5SaJ:sxZYkqVX/f3sl8z0XHbPX3otpQW
TLSH
T10172E916AA7459778CDBD219F645BB93D6F90563A2904E44AAFCCB0C00E7BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 838885fdc20639ce6225ec44702ad4cc0f22cd035d23c51f24653950b978c32d
MD5 cb21351e6cffa7b377a028d6dcdd4ad5
SHA1 0eb9d8d2ef401f13b9f13fc701ed239f79fff510
SHA512 b72282b89341c22d57d0dd107929a10fdbc0b4d72d34a83c8a86502c46e088e22a940b7c10c80b56b371cb6e96ef09e383529899a5426a96fdd36af7b546774e
SSDEEP 192:sxZYRfyMqZjK1Ml8MkX/f3ssR7aZdfzodpoABHW6+WNlD5/Yvzu/O3t6AIgjaJ:sxZYkMX/f3ssR7az0XHbT/Z8tpjW
TLSH
T14D62E8166A3859778DD7D219F645BB93D6F91123A2945E44AAFCCA0C00E7BEC320382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d3ed28410c95bcdd49b775e999633ec95a9fd79e43121075d441a0e078c22041
MD5 f69e750b13c549c16996bde771106f07
SHA1 f3ce7bce220e59cf4ead817ef6423038f0d78324
SHA512 f942c9f08562a4828ba0e5eddd4688fc3995511e90fac2e939ef5f22ba5105f580b294d4c4e56e3adef92b0304627a7501a96a18e13b795a929ffee8b420600b
SSDEEP 768:ZYsv8Od/hWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQroIRLO:eY8Od/hWvFvmXu1ja10Lm2NuIq
TLSH
T19BD20B3B680CCB7E4F840D9DEC2A6F966DD801CB66984D5447FA884C03C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 68db49c2601ad35279c1bdae15861a7aa0dd78283fa83fc1983a58dabf642024
MD5 9cdd8fe2b0250c24b6cb227dce008986
SHA1 75bdc6a7ed0923dbd728683dd93f76bb2fd6c487
SHA512 8ab1f95163c4d344a114bf4c9f52fb229769594d1317b89246a3e30b6f720b5bb38ea24d966481d9503a4088ba4a363233350c37f26fd01b8bedb6590bcc9508
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGQ:05ppxnY753RNBvRJJdt7p5J9E5N5
TLSH
T18AB28A5A713A0212397E2948B39696364F4235A37058E4BF7FB810A14F67E225CFDCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 d13091783e5e558dd41d8aeee357ca204956f4c3a8017db1908dc317865f7393
MD5 a7cc93bdf38b2f36cbcf608feade920d
SHA1 5591e577f41a9638a6978baa5b554d81679e1438
SHA512 5b65f25a8f92eebf51f50c8f72cadd95dd5b8996601da180a43cca79e949abec8b7f77093e5f08c1c4e36fca8040a6c825a178fbeddf11c18d98b44d8a50876d
SSDEEP 384:npdiFTCcmyWCe3sNv8TUNTUlI478QckCrMfMpvBfxGoVY7kLzj9sUoe4KV8p03HE:pUFmcpe3SwgKsk7aDGoukLz6UoI8p0XE
TLSH
T11CC24B36ECA8CDB7ECD34B89B64A3607DEE0512786CC9AE4DADC5E0D10971ED130B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 415eb6a11fc93a20adb9b840f03902cdac373bc19c2dd7a2504a7054a08e7046
MD5 8c91384f78487cc6051410790ff95325
SHA1 269d8d7995adee04f226eb96d297098382326a7b
SHA512 a4c40afe8f4321a3950502bc9a7ffa2a37b1aee9f91b396b0ce208918c2255d65f16745bc8303ebfdcc39e0c17a2c1954aeb4e527e60dfb70029190e1e8ad06c
SSDEEP 384:nxiFKtNn/s3n9SC3sNv8TUNTUlI4nJQckCr5fMpvBfxGoVY7kLzj9MUoOObjI9Gv:YFKj+9n3SwgWPkQaDGoukLzmUo29MD
TLSH
T10FD24B36E895CAA7ECE74BC9B74A3A07DEE0416785CC5AD8D9DC5E0D00D71AC430BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 6e5130aed5950d6e2e2640dc39448b67b9f0d47699ea1495406be8d927e74500
MD5 015b7660c2c820f167c58670fa37b20f
SHA1 aac0e213a4b31e1d0e75406bb3d3583235e27c62
SHA512 c19603645d432041619ef94d860a468f4c77c8e83f421068de55e372fb4ba3c9e4d13a3175751e1679b9a80846514be55e05f1354773b9fb2adfe8e88979ca22
SSDEEP 384:npdiF9CcmyWCo3sNv8TUNTUlI478QckCrcfMpvBfxGoVY7kLzj9sUoe4KV8p03HE:pUFccpo3SwgKskXaDGoukLz6UoI8p0XE
TLSH
T1F7C24B36E8A8CDB7ECD34B89B64A7607DEE0512386CC9AE4DADC5E0D10D71ED130B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 8da868a207cb3237d451ea7161008efe52d753fb6f2652a966a87630b83a7e16
MD5 b98b5fc5451f9b5e28a647f664951818
SHA1 376cfbe7720d2d951d5f321df6362ae1a4425e09
SHA512 05e5e1c33cd106a8a7f9c465ff289c96d2bb9de6dbc97236cb344b1d49d58c373c9dff20249cd987cf1866212a120544a26d42710ed7f553b8125b50ae0e8c2a
SSDEEP 384:npdiF0CcmyWCe3sNv8TUNTUlI4n8QckCr5fMpvBfxGoVY7kLzj9MUoe4KV8p03HE:pUF/cpe3SwgWskQaDGoukLzmUoI8p0XE
TLSH
T1F5C24B36ECA8CDB7ECD34B89B64A3607DEE0512786CC9AE4DADC5E0D10971ED430B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 0d9ba5924af74f8297a543b552e58cbada82ee989a54586728524e6409bad418
MD5 02bafab60a962b82b36dc2fb17ade26e
SHA1 b21dec8f7bf7b0c428b660531b119f46f7c55acd
SHA512 7214d6d885f6177db290a7a83570336827ba35e178b74934df4e828f6ef5db8c8d645bb8bbbfc5ad11a89e8069642f1b00e9d54ccab5f30ae11ee1da1c400f7f
SSDEEP 384:np3iF9CcmyWCs3sNq8TUNTUlIm2QckCr9lNKpvBfxGoVY7kLzBepme4KV8p03HHl:pyFccps3nwgbkUTkDGoukLzBdI8p0XF
TLSH
T1F8B24C36EC58CDBBECE74F89B74A6A07DEE0122785DC5AE4CAD81E0D109719D130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 2e1868b992bca2f50e3f1dfecf1a167f88e7fde5627c7ede1ac6a82540a59e8e
MD5 23adbbc5b2cf3db179e41e2615f33337
SHA1 32ddad4cc25e61e0da93f33111a56c91257fe55d
SHA512 0f58e55efc1aee841781b9be079f51f2e90d7450f9212d7293ff65fde0af59907b790e6787690071e62ab973f1f7b6efd20f22e0fa7d265db556e14697fc31ed
SSDEEP 384:npmiF9CcmyWCs3sND8TUNTUlIm2QckCr9Z9ppvBfxGoVY7kLzj9lUoe4KV8p03HF:pNFccps3iwgbkUrXDGoukLznUoI8p0XF
TLSH
T137C24C36D898C9ABECD34B89B64A3607DEE0522786CC9AE4DADC5E0D10D71ED530BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 7fdf717865a2e6377a0d5f29afc1109de1b210f330ed28caa3c52e600d939893
MD5 839c98f503c73b198feb193c3a0a29f1
SHA1 43ac3744122cd89ee349d2f7d154a83a6a93e990
SHA512 f6409bc23b1c63ffef40c021713d4e397c78754af2b1027d0f72aeebc0af9389c4436b989421f7512cce5e36f19af1d4dd07cf3f5d40fa04d8667fdbd6ded961
SSDEEP 384:npiFKtNn/s3n9SN+3sNv8TUNTUlI4nJQckCr0oMpvBfxGoVY7kLzj9g2UoOObjIU:AFKj+9l3SwgWPk0aDGoukLzhUo29MD
TLSH
T1AEE2E6F698D78977E89E4B87637E2E069AFCC153B5885A84B7C85D0CCC861BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 98f30fc6eecb868b6016836a5de4afb0a09a295ff0216716211694cc165280d0
MD5 70c2298ef915d37f63a4170cee6a5d13
SHA1 88c7d6b5c66ca33cdce28b7e30a8d7270216a2eb
SHA512 78f33b14f94b94932efb0b5dd0698f0a3accd3a42099f5392d337765bdbf7645f1c66406a07d4cb3467cb0a29819e9109d4ef815bc2b4a23eea3ae038f458d22
TLSH
T109410B98B6E92108B7B77F56AFF2A86E447F79772F07D09D10110D4E0A22B01C861737
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Cache\Cache_Data\data_0
Size 44KB
SHA256 55547c20f2a48438d4d0172037f1599935bc5a90ef2a6558c0c74bc1958275cb
MD5 7e67f23fec4fc0e90c723baf5f9b6465
SHA1 e5c82a158f7b3d2acab7ee754d32e34121ddbda5
SHA512 29d55b1a2e30ab62a7539fb399f45ec304057d257dcc0b5d52b30e1510d0a41aba45ecdf621523d9498090c9f168156d52f9287d29bd0d7199332a617104444b
SSDEEP 3:MsFlEakPfkellSIVk+gds3MEjX:/F2a+keT++bl
TLSH
T1161311AFAA800E0AC22B0C30203A82B0C332CC82A220030380EAE00008083AE0800200
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Cache\Cache_Data\data_1
Size 264KB
SHA256 ff4687f3385fbc8899212ea1c2c99ecec7f087dbb2d22317ca6a534b4b147d9f
MD5 c954b49032f78b0eb6c9070d047f98f0
SHA1 c7cd98ff570d33f1f5c5fb091b9fc212a6c5198c
SHA512 019819e2dee0a574e6bb9f42a2ceeba31bc1fe595ed9d03c5a947e17bc10ccbae7702bf04e7d86fe4159119c410039f08347372773220f9928b4da7e273ac548
SSDEEP 3:MsEllllkql5lluPglXNrTwrjsROMoLl7AiVKDwXAW1lPDi9ltMLsl/30NOMoLl:/M/LlEOTt0Mo62YwJtiHLvMo
TLSH
T1CB444CEF16400658C745D4F5A023E8BED6E6FCB88E9ABB4261EAC4A2AD412581C15450
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Cache\Cache_Data\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Cache\Cache_Data\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

6488dd43-74cd-4f07-81d4-a9bf600a4ae2.tmp

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Code Cache\js\index-dir\6488dd43-74cd-4f07-81d4-a9bf600a4ae2.tmp
Size 48B
SHA256 d278df354646dc8aa25d2242a384f9cfe38fa3b165294e3ece3ba71677c60346
MD5 e57f2ce7fd44b58172c3e911d7b86b7c
SHA1 be656734b1a72708a6918824f9533103dcf988c6
SHA512 e6bc4a7fba6020a6d45f197d6fa78ef718110dbed47794c6e65351fcd4be48211885511ad13cb8004f63106261f0c2e5ee39cca86892de52e53720e7b2373549
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 789def97d64995e6dd2c819a57f48c3226f849cc3224d83b9c97d4cf28b2fc25
MD5 c06fd6eab66b324f5da4ea76aec60627
SHA1 d8d35f9e1213706a70bc70e7601785b1ec96601d
SHA512 b8777c8293d4b67ece2bb878651f88bfb83d8b00f542977f6b0d1604c8275c359f4754bcba5c82e1c6f811b7da58886e7006436b1d5e6705e71fa83dcf3e848a
TLSH
T170514E95D3756EC9FFBB943A00CA07A6F638ED85407B2E45C4CCC5B0A015356B1A9B19
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Network\Network Persistent State
Size 1KB
SHA256 32e04c268045c8876174330f31defb14d461cbbbd8f2de318e6cb6446d11ca20
MD5 b75618e64eac44bd76a19311da9e7458
SHA1 9ae77a860c6431434ca9ac4f1434c3d885432ef8
SHA512 c84828fde76ebd754343faa339535f9722627c9ab4ab72ce2aa80765259e28ac0fbdd3984bcae111b30140a5203e188d3bd644b38e3b8d35ce131d813f2af98f
TLSH
T1213188D2C7ED067DC66227F92F213A63C1AE1A1C43683C03C9C9EF8E97E14355A1154E
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Partitions\cowork-file-preview\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

97d6d604-7f1a-40b6-aed8-e88f7865a901.tmp

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Partitions\launch-preview-static\Network\97d6d604-7f1a-40b6-aed8-e88f7865a901.tmp
Size 84B
SHA256 712196693e3527ac1131831f1a2108b6c0e5c68967b26d51a452611cdfb86e0c
MD5 32b9dc9cc81d0682e78627c873fdd651
SHA1 46c486386d3e153c3e9b11d54cb52cf0064b71cf
SHA512 f18bc37f8b72411548da247aa1394cc5ac03c3bbd98e82eb8ba290ef239ef5b8625cf4835bd41ce7c52766d0bc3bfe9150dd22dbf62f0f05992ddde5fbfdc811
TLSH
T154A0121490405CFB0308835504146463C3F50002421848A91634318D019209D0004403
MD5 SHA1 SHA512 TLSH

Submit Download

d16e73d1-620e-4821-9016-90ff147e6ec0.tmp

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Partitions\launch-preview-static\Network\d16e73d1-620e-4821-9016-90ff147e6ec0.tmp
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\config.json
Size 42B
SHA256 76fefb09eb827a21a20ae1256bc43fac736ee5fb91ff4a5d5f4e77329e18d929
MD5 77e2b84592c46eb33afa6f0fb55d6fd0
SHA1 d8b98ac15b612fad1561be6f813c43864db5133a
SHA512 57ae8a16bf9b1e6367092130d8f61df960d71c1b07bccbe7b9e7bc0a0296a16396307e2c0df70862aba0b4f620dab46a6fe8b861e04f90b64c666a0c4b6b33e5
MD5 SHA1 SHA512

Submit Download

config.json

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\config.json
Size 90B
SHA256 a46df796359d568b8e5b96a09bae638786ac3214dc8abaec0f630c13c9fa3854
MD5 ff47207bdab800e6e751860e78322b06
SHA1 350f3dbdc01dd26851061da919ac2e360db6b1f9
SHA512 919bf43ea7eb82425a64b11cb9f571d17d2a223492aa71e4a50f83d962733933a08164f024314185ac6a7b2d0473319a1b4479b25001c25eaeacb7662ca599f2
TLSH
T1D6B01235C0164063F04481EC000C00C540AC12195D07040F47A16109C147E6C7125B21
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\config.json
Size 62B
SHA256 e2bc6efa7858729121235cc2bb3220ccd077d4b4af6060315a0d0ef8ab4982c1
MD5 39c5caf4c6cb54936d2c2aa20e997dc0
SHA1 ac6655c10adfe9a8decc04c1b1349140b80c9d12
SHA512 73831d410e1de82274c66da9af7513dc5a5ffccf5ed75a67fb0e38c1d611a00db7e92e70239d54637b11cf1e3f778438e723707e2c44c44c14f00ac149694554
TLSH
T11EA0022AC0269173F05882EC040401C685D9025C6A0B19064791711AC547B7C654A365
MD5 SHA1 SHA512 TLSH

Submit Download

config.json.tmp-38304166459a33f4

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\config.json.tmp-38304166459a33f4
Size 77B
SHA256 8e0208e37b6270b0f7a4ac8b6ffae3a1e44c1261fbe0e36e54fc14d3fb4ee019
MD5 9fcd25866b41f5397a53f2073ac204c9
SHA1 bc0bfd9ae44f41fce85d478707963890f9b63ee1
SHA512 bdebec41c35a91a26e5b81120365da14b482a81a1ae7ff18aa57b8fbf09d99aab6f085d686ce39088810573704bd951e26059c869e54e1448ed41b764a41b650
TLSH
T19EA022CE80308032E80E03FC888C00038A8E030C0B2B008003A0223FC802BAC300A2B0
MD5 SHA1 SHA512 TLSH

Submit Download

git-worktrees.json

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\git-worktrees.json
Size 20B
SHA256 f0bc550ac05dd2b909b3551952c6d420bcab2f00c06056f9cd22a767c4ce389b
MD5 e81562802df3ee9bdae750db6449fbe3
SHA1 9f33369ff7aa8ea66075158a79d1f7de923b4924
SHA512 7a77e2e73b4ea7dc9ed36bca78adb5ad01609668bb9a2a1e6964d9c464246bb770495a9a66fba07dde054d38ff3c0d61c4a9d2f7026ce0f654a81a6e06e667f2
MD5 SHA1 SHA512

Submit Download

git-worktrees.json.tmp-38304136053bd603

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\git-worktrees.json.tmp-38304136053bd603
Size 41B
SHA256 8fc79e5ab7122d9bdefc19199129249ed3823801840d7d065579dfdae8cfad15
MD5 b248a937ded76419d289994d74555354
SHA1 785642689ccfe95fb266d894ee85438030be9e55
SHA512 4720de5d5c54a601c3acffa7639b0055b88e8672027ccd5cf99590176101bf2b62dfac820bd27182b41d5f886f49ddf46fb6803b3622e4b5cbc12995a015a349
MD5 SHA1 SHA512

Submit Download

APPX.9maxo_7h1m3n73mq1lk83ncpf.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX.9maxo_7h1m3n73mq1lk83ncpf.tmp
Size 7KB
SHA256 44a193679f54651f745aba7664ccc6ddc1e02c0e87e83f413857ad91ce3a9e5f
MD5 5d0d00319053dbd70ccd1d2deea2f85f
SHA1 13278acadc1fac063a809db9df1dfbcab6bf9f7b
SHA512 a7d811b796a3ee7ce3a72f243057130da5be3ce1320b04ae309c2cd2352bbd55e817b150a18ce4014f787781858052c1b62bbc14afb30364efd227da98834965
SSDEEP 192:rJG1F4RVbrowDjq6LYYcwmbTYp+bkk6W+Gkk63:rJG1F4RVbrowDjTLY/wJ+bkk6W+Gkk63
TLSH
T1DAE1F14BD4AD18504672E1AAAF13D685EB2C095758DE00C0BCDD56432FB265F033BB9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

APPX.lt3e7z54fec__7uv55bxrc2_h.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX.lt3e7z54fec__7uv55bxrc2_h.tmp
Size 856KB
SHA256 20ec25fe82952701720dec16a1d143b634c1850bb42588a0c3b85717fbf5b4d4
MD5 f63ac6396e4308c49cea9b28bd5338ba
SHA1 820e3f5bdaf1fb33c4c6f1691d0da7394712cd51
SHA512 8ce429bf3d08b1089e74d2cb8e8b5acba3de0ac0a737610dfb0614e4206f73e12c2fd225a44ce58c4d07ebdf7b30860bb5d6a43381057c447bede502d5086379
SSDEEP 12288:Jj5AB3CPCV68+1jzW2FMzOUjmo2/x3BizVZU1hdDniy2yRjW+gwFt:J2BvqdW2WzHKoupkzVZU1jXjQ+H
TLSH
T13B15B3E1153DBE36816D0AAD8F24F4042C35983613376E0E9C5EA2B71CBF9A25F674E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

APPX.n3feo3l4f9dffgb1boq3bj7dg.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX.n3feo3l4f9dffgb1boq3bj7dg.tmp
Size 10KB
SHA256 4abb8482a8d9916ac6f219b6383553ea46bfc5e7ca6b388983253596e58b41ac
MD5 55a25c73a9542dd90995b5ec274051fc
SHA1 00d103eec0e0aaf3b058cffdafe3b59d13da8350
SHA512 a5f05dfabf31f4e89580f7465b60b01a7cd624cb7c6eca5d434644ae6f7abecc3add87946cabf0e167f176ad1ef7c6f65054f6b4cd217848467a7104eb98286d
SSDEEP 192:ENyEIYiYF80dmL4pUQaULc8pq8RuX5hz28uNNTPKTAIwixpd2kwyr:ENyEIYi2mL4/y8RKE7H2kHm
TLSH
T132225BA388D06C46ED275D5074D8A536EEB2B2866EC0D1C6721DC126C7853823BDD2FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ClaudeSetup.log

Path C:\Users\Admin\AppData\Local\Temp\ClaudeSetup.log
Size 3KB
SHA256 caf813a4654561df40135a027208f8cdb3750a5eca502a45d0d5d352a733865e
MD5 7b5ff978a70c40b5c5e711050f0daecd
SHA1 23c3e194a464385b13942b1613f6ab4550e1ceee
SHA512 63d917d9c23d3da7e99930c5d5a07a888b2defb781828e56871d0ca24df92175a89bc06b20304ae047d875191e971fc2a44a979c8f06047a5fde04f528145dc1
TLSH
T1D4719C38AE47E8F406D55405FD2A42BE500B350BA60D93A476C0E960D81EF3B5BFA1DE
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

Claude Setup.exe.crdownload

Path C:\Users\Admin\Downloads\Claude Setup.exe.crdownload
Size 6.7MB
SHA256 012ae65ca7d363e94563d70e5dfef465bd83c3d3826780471129666cf70d4e51
MD5 c4e24dc85b22fe6a837b485474651ec0
SHA1 ce8f43e906e44d4c38946253dfa58fb3e9389271
SHA512 855b4d83b6376570b90fb4df34372257a838596fc669be33545c7ea8fdb66f87373299788c9e97ddc565cc86ce512472ac3f93baf1165ffa3e9ffaa470b7b134
SSDEEP 49152:/FATMATweCaOM1liQ9cz5iqCoFeUwXohxpI4Xp8tiaZch/75vh6YnpjC+vBY7wKk:/FrZlxFlca7p7ain8+cEF
TLSH
T193665A43ECA555E9C0AEE23485729253BA717C485F3123D76BA0F7382F76BC06AB9740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/464-464-0x00007FF8E9610000-0x00007FF8E9611000-memory.dmp

Download

memory/464-465-0x00007FF8E8380000-0x00007FF8E8381000-memory.dmp

Download

memory/3480-332-0x000002BBDCFB0000-0x000002BBDDFB0000-memory.dmp

Download