ba6072c6168a05f3820fa3f80f02eea6a439a6d4ce48e99c86031db5885f7065

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 13:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Claude Setup.exe
Size 6.7MB
Sample260718-p88casfv2x
SHA256 ba6072c6168a05f3820fa3f80f02eea6a439a6d4ce48e99c86031db5885f7065
MD5 051e7a7a26d1723698175bf07ecb2d0c
SHA1 166fb78afd26868ba77e2dfb6514cff2ef065493
SHA512 86c9ec463693df5ce16d663ad8c4df083ebd5dd558612106ed26284d9d53bf70672b254dcadb81bb8dccd25d00f6729bb7fe93dd9b55dd210af58a4dc429e3b5
SSDEEP 49152:/FATMATweCaOM1liQ9cz5iqCoFeUwXohxpI4Xp8tiaZch/75vh6YnpjChvBY7wKJ:/FrZlxFlca7p7aint+HED
TLSH
T18A665A43ECA555E9C0AEE23485729253BA717C485F3123D76BA0F7382F76BC06AB9740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB	cowork-svc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB	cowork-svc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	cowork-svc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	cowork-svc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_A53644FA0CAAA458C7A0416292C7CC5B	cowork-svc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_A53644FA0CAAA458C7A0416292C7CC5B	cowork-svc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	Claude.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	cowork-svc.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\claude	Claude.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\claude\ = "URL:claude"	Claude.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\claude\shell\open\command	Claude.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\claude\shell	Claude.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\claude\shell\open\command\ = "\"C:\\Program Files\\WindowsApps\\Claude_1.22209.0.0_x64__pzs8sxrjxfjjc\\app\\Claude.exe\" \"%1\""	Claude.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\claude\URL Protocol	Claude.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\claude\shell\open	Claude.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2301830172-776172150-2531349243-1000\{72CDD926-D09F-45C4-AACB-2AB69FD98853}	Claude.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
5872	reg.exe
1348	reg.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
472	Claude Setup.exe
472	Claude Setup.exe
1616	cowork-svc.exe
1616	cowork-svc.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4076	Claude.exe
Token: SeCreatePagefilePrivilege	4076	Claude.exe
Token: SeShutdownPrivilege	4076	Claude.exe
Token: SeCreatePagefilePrivilege	4076	Claude.exe
Token: SeShutdownPrivilege	4076	Claude.exe
Token: SeCreatePagefilePrivilege	4076	Claude.exe
Token: SeShutdownPrivilege	4076	Claude.exe
Token: SeCreatePagefilePrivilege	4076	Claude.exe
Token: SeShutdownPrivilege	4076	Claude.exe
Token: SeCreatePagefilePrivilege	4076	Claude.exe
Token: SeShutdownPrivilege	4076	Claude.exe
Token: SeCreatePagefilePrivilege	4076	Claude.exe
Token: SeShutdownPrivilege	4076	Claude.exe
Token: SeCreatePagefilePrivilege	4076	Claude.exe
Token: SeShutdownPrivilege	4076	Claude.exe
Token: SeCreatePagefilePrivilege	4076	Claude.exe
Token: SeShutdownPrivilege	4076	Claude.exe
Token: SeCreatePagefilePrivilege	4076	Claude.exe
Token: SeShutdownPrivilege	4076	Claude.exe
Token: SeCreatePagefilePrivilege	4076	Claude.exe
Token: SeShutdownPrivilege	4076	Claude.exe
Token: SeCreatePagefilePrivilege	4076	Claude.exe
Token: SeShutdownPrivilege	4076	Claude.exe
Token: SeCreatePagefilePrivilege	4076	Claude.exe
Token: SeShutdownPrivilege	4076	Claude.exe
Token: SeCreatePagefilePrivilege	4076	Claude.exe
Token: SeShutdownPrivilege	4076	Claude.exe
Token: SeCreatePagefilePrivilege	4076	Claude.exe
Token: SeShutdownPrivilege	4076	Claude.exe
Token: SeCreatePagefilePrivilege	4076	Claude.exe
Token: SeShutdownPrivilege	4076	Claude.exe
Token: SeCreatePagefilePrivilege	4076	Claude.exe
Token: SeShutdownPrivilege	4076	Claude.exe
Token: SeCreatePagefilePrivilege	4076	Claude.exe
Token: SeShutdownPrivilege	4076	Claude.exe
Token: SeCreatePagefilePrivilege	4076	Claude.exe
Token: SeShutdownPrivilege	4076	Claude.exe
Token: SeCreatePagefilePrivilege	4076	Claude.exe
Token: SeShutdownPrivilege	4076	Claude.exe
Token: SeCreatePagefilePrivilege	4076	Claude.exe
Token: SeShutdownPrivilege	4076	Claude.exe
Token: SeCreatePagefilePrivilege	4076	Claude.exe
Token: SeShutdownPrivilege	4076	Claude.exe
Token: SeCreatePagefilePrivilege	4076	Claude.exe
Token: SeShutdownPrivilege	4076	Claude.exe
Token: SeCreatePagefilePrivilege	4076	Claude.exe
Token: SeShutdownPrivilege	4076	Claude.exe
Token: SeCreatePagefilePrivilege	4076	Claude.exe
Token: SeShutdownPrivilege	4076	Claude.exe
Token: SeCreatePagefilePrivilege	4076	Claude.exe
Token: SeShutdownPrivilege	4076	Claude.exe
Token: SeCreatePagefilePrivilege	4076	Claude.exe
Token: SeShutdownPrivilege	4076	Claude.exe
Token: SeCreatePagefilePrivilege	4076	Claude.exe
Token: SeShutdownPrivilege	4076	Claude.exe
Token: SeCreatePagefilePrivilege	4076	Claude.exe
Token: SeShutdownPrivilege	4076	Claude.exe
Token: SeCreatePagefilePrivilege	4076	Claude.exe
Token: SeShutdownPrivilege	4076	Claude.exe
Token: SeCreatePagefilePrivilege	4076	Claude.exe
Token: SeShutdownPrivilege	4076	Claude.exe
Token: SeCreatePagefilePrivilege	4076	Claude.exe
Token: SeShutdownPrivilege	4076	Claude.exe
Token: SeCreatePagefilePrivilege	4076	Claude.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4076	Claude.exe
4076	Claude.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
4076	Claude.exe
4076	Claude.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4308	explorer.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 472	1876	Claude Setup.exe	91
PID 472 wrote to memory of 1184	472	Claude Setup.exe	94
PID 4076 wrote to memory of 4168	4076	Claude.exe	98
PID 4076 wrote to memory of 4288	4076	Claude.exe	99
PID 4076 wrote to memory of 2636	4076	Claude.exe	100
PID 4076 wrote to memory of 3412	4076	Claude.exe	101
PID 4076 wrote to memory of 2832	4076	Claude.exe	102
PID 4076 wrote to memory of 1348	4076	Claude.exe	103
PID 4076 wrote to memory of 5872	4076	Claude.exe	104
PID 4076 wrote to memory of 5964	4076	Claude.exe	108
PID 4076 wrote to memory of 6152	4076	Claude.exe	109
PID 4076 wrote to memory of 6148	4076	Claude.exe	110

C:\Users\Admin\AppData\Local\Temp\Claude Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Claude Setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Users\Admin\AppData\Local\Temp\Claude Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Claude Setup.exe" --elevated --msix-path "C:\Users\Admin\AppData\Local\Temp\Claude-2837756636.msix" --log-path "C:\Users\Admin\AppData\Local\Temp\ClaudeSetup.log" --all-users
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:472
- - C:\Windows\explorer.exe
    explorer.exe shell:AppsFolder\Claude_pzs8sxrjxfjjc!Claude
    3⤵
    PID:1184

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4132

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness
1⤵
PID:2692

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4308

C:\Program Files\WindowsApps\Claude_1.22209.0.0_x64__pzs8sxrjxfjjc\app\resources\cowork-svc.exe
"C:\Program Files\WindowsApps\Claude_1.22209.0.0_x64__pzs8sxrjxfjjc\app\resources\cowork-svc.exe"
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1616

C:\Program Files\WindowsApps\Claude_1.22209.0.0_x64__pzs8sxrjxfjjc\app\Claude.exe
"C:\Program Files\WindowsApps\Claude_1.22209.0.0_x64__pzs8sxrjxfjjc\app\Claude.exe"
1⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4076
- C:\Program Files\WindowsApps\Claude_1.22209.0.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.22209.0.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\Claude /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\Claude\Crashpad --url=https://f.a.k/e --annotation=_productName=Claude --annotation=_version=1.22209.0 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=42.5.1 --initial-client-data=0x4c4,0x4c8,0x4cc,0x4c0,0x4d0,0x7ff7e36ca148,0x7ff7e36ca158,0x7ff7e36ca168
  2⤵
  PID:4168
- C:\Program Files\WindowsApps\Claude_1.22209.0.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.22209.0.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1952,i,4893735834550114276,10071923856603511107,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1956,i,16199276530027064766,8132844217125746601,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1948 /prefetch:2
  2⤵
  PID:4288
- C:\Program Files\WindowsApps\Claude_1.22209.0.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.22209.0.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --field-trial-handle=1952,i,4893735834550114276,10071923856603511107,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1956,i,16199276530027064766,8132844217125746601,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2032 /prefetch:11
  2⤵
  PID:2636
- C:\Program Files\WindowsApps\Claude_1.22209.0.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.22209.0.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --app-path="C:\Program Files\WindowsApps\Claude_1.22209.0.0_x64__pzs8sxrjxfjjc\app\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1784379078904425 --launch-time-ticks=657026260 --field-trial-handle=1952,i,4893735834550114276,10071923856603511107,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1956,i,16199276530027064766,8132844217125746601,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2928 --desktop-enterprise-config="{\"forceLoginOrgUUIDs\":null,\"loginSsoOrgDomain\":null,\"disableEssentialTelemetry\":false,\"disableNonessentialTelemetry\":false,\"disableMobileSimulatorTools\":false,\"banner\":null}" /prefetch:1
  2⤵
  PID:3412
- C:\Program Files\WindowsApps\Claude_1.22209.0.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.22209.0.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --app-path="C:\Program Files\WindowsApps\Claude_1.22209.0.0_x64__pzs8sxrjxfjjc\app\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1784379078904425 --launch-time-ticks=657038617 --field-trial-handle=1952,i,4893735834550114276,10071923856603511107,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1956,i,16199276530027064766,8132844217125746601,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3012 --desktop-features="{\"artifactsPane\":{\"status\":\"unavailable\"},\"nativeQuickEntry\":{\"status\":\"unavailable\"},\"quickEntryDictation\":{\"status\":\"unavailable\"},\"quickEntryGlobalShortcut\":{\"status\":\"supported\"},\"customQuickEntryDictationShortcut\":{\"status\":\"supported\"},\"plushRaccoon\":{\"status\":\"unavailable\"},\"quietPenguin\":{\"status\":\"unavailable\"},\"chillingSlothFeat\":{\"status\":\"supported\"},\"chillingSlothSshShell\":{\"status\":\"supported\"},\"chillingSlothEnterprise\":{\"status\":\"supported\"},\"chillingSlothLocal\":{\"status\":\"supported\"},\"chillingSlothPool\":{\"status\":\"unavailable\"},\"yukonSilver\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute, vfpext\",\"unsupportedCode\":\"hcs_not_available\"},\"yukonSilverGems\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute, vfpext\",\"unsupportedCode\":\"hcs_not_available\"},\"yukonSilverGemsCache\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute, vfpext\",\"unsupportedCode\":\"hcs_not_available\"},\"wakeScheduler\":{\"status\":\"unavailable\"},\"desktopTopBar\":{\"status\":\"supported\"},\"ccdPlugins\":{\"status\":\"supported\"},\"computerUse\":{\"status\":\"supported\"},\"coworkWatchRecord\":{\"status\":\"unsupported\",\"reason\":\"Watch-record is not available on this platform\",\"unsupportedCode\":\"unsupported_platform\"},\"coworkWatchers\":{\"status\":\"unavailable\"},\"coworkKappa\":{\"status\":\"unavailable\"},\"coworkArtifacts\":{\"status\":\"unavailable\"},\"coworkAutoModeAlwaysAllowOverride\":{\"status\":\"unavailable\"},\"framebufferPreview\":{\"status\":\"unavailable\"},\"iosSimulator\":{\"status\":\"unsupported\",\"reason\":\"iOS Simulator panel requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"androidEmulator\":{\"status\":\"unsupported\",\"reason\":\"Android emulator is disabled by its rollout flag\",\"unsupportedCode\":\"unknown\"},\"iosSimulatorH264\":{\"status\":\"unsupported\",\"reason\":\"iOS Simulator panel requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"grandPrix\":{\"status\":\"unavailable\"},\"tearOffHalo\":{\"status\":\"unsupported\",\"reason\":\"Tear-off halo overlay requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"coworkArtifactPopout\":{\"status\":\"supported\"},\"claudeDesignWindow\":{\"status\":\"supported\"},\"coworkRemoteSessionSpaces\":{\"status\":\"supported\"},\"spaceMemoryBridge\":{\"status\":\"unavailable\"},\"grandPrixRequest\":{\"status\":\"unavailable\"},\"coworkBranchSession\":{\"status\":\"supported\"},\"coworkScheduledTaskProjects\":{\"status\":\"supported\"},\"coworkLocalSessionProjects\":{\"status\":\"supported\"},\"bootstrapConfig\":{\"status\":\"supported\"},\"chatIn3p\":{\"status\":\"supported\"},\"builtinMcpPresets\":{\"status\":\"supported\"},\"surfaceTogglesPreview\":{\"status\":\"unavailable\"},\"chatTab\":{\"status\":\"unavailable\"},\"chatCodeExecution\":{\"status\":\"unavailable\"},\"epitaxyMcpApps\":{\"status\":\"unavailable\"}}" --desktop-enterprise-config="{\"forceLoginOrgUUIDs\":null,\"loginSsoOrgDomain\":null,\"disableEssentialTelemetry\":false,\"disableNonessentialTelemetry\":false,\"disableMobileSimulatorTools\":false,\"banner\":null}" --desktop-telemetry-config="{\"deploymentMode\":\"1p\",\"appVersion\":\"1.22209.0\",\"cookielessOrigin\":false}" /prefetch:1
  2⤵
  PID:2832
- C:\Windows\System32\reg.exe
  C:\Windows\System32\reg.exe query HKLM\SOFTWARE\Policies\ClaudeCode /v Settings
  2⤵
  - Modifies registry key
  PID:1348
- C:\Windows\System32\reg.exe
  C:\Windows\System32\reg.exe query HKCU\SOFTWARE\Policies\ClaudeCode /v Settings
  2⤵
  - Modifies registry key
  PID:5872
- C:\Program Files\WindowsApps\Claude_1.22209.0.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.22209.0.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --app-path="C:\Program Files\WindowsApps\Claude_1.22209.0.0_x64__pzs8sxrjxfjjc\app\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1784379078904425 --launch-time-ticks=658023074 --field-trial-handle=1952,i,4893735834550114276,10071923856603511107,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1956,i,16199276530027064766,8132844217125746601,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=4148 --desktop-features="{\"artifactsPane\":{\"status\":\"unavailable\"},\"nativeQuickEntry\":{\"status\":\"unavailable\"},\"quickEntryDictation\":{\"status\":\"unavailable\"},\"quickEntryGlobalShortcut\":{\"status\":\"supported\"},\"customQuickEntryDictationShortcut\":{\"status\":\"supported\"},\"plushRaccoon\":{\"status\":\"unavailable\"},\"quietPenguin\":{\"status\":\"unavailable\"},\"chillingSlothFeat\":{\"status\":\"supported\"},\"chillingSlothSshShell\":{\"status\":\"supported\"},\"chillingSlothEnterprise\":{\"status\":\"supported\"},\"chillingSlothLocal\":{\"status\":\"supported\"},\"chillingSlothPool\":{\"status\":\"unavailable\"},\"yukonSilver\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute, vfpext\",\"unsupportedCode\":\"hcs_not_available\"},\"yukonSilverGems\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute, vfpext\",\"unsupportedCode\":\"hcs_not_available\"},\"yukonSilverGemsCache\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute, vfpext\",\"unsupportedCode\":\"hcs_not_available\"},\"wakeScheduler\":{\"status\":\"unavailable\"},\"desktopTopBar\":{\"status\":\"supported\"},\"ccdPlugins\":{\"status\":\"supported\"},\"computerUse\":{\"status\":\"supported\"},\"coworkWatchRecord\":{\"status\":\"unsupported\",\"reason\":\"Watch-record is not available on this platform\",\"unsupportedCode\":\"unsupported_platform\"},\"coworkWatchers\":{\"status\":\"unavailable\"},\"coworkKappa\":{\"status\":\"unavailable\"},\"coworkArtifacts\":{\"status\":\"unavailable\"},\"coworkAutoModeAlwaysAllowOverride\":{\"status\":\"unavailable\"},\"framebufferPreview\":{\"status\":\"unavailable\"},\"iosSimulator\":{\"status\":\"unsupported\",\"reason\":\"iOS Simulator panel requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"androidEmulator\":{\"status\":\"unsupported\",\"reason\":\"Android emulator is disabled by its rollout flag\",\"unsupportedCode\":\"unknown\"},\"iosSimulatorH264\":{\"status\":\"unsupported\",\"reason\":\"iOS Simulator panel requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"grandPrix\":{\"status\":\"unavailable\"},\"tearOffHalo\":{\"status\":\"unsupported\",\"reason\":\"Tear-off halo overlay requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"coworkArtifactPopout\":{\"status\":\"supported\"},\"claudeDesignWindow\":{\"status\":\"supported\"},\"coworkRemoteSessionSpaces\":{\"status\":\"supported\"},\"spaceMemoryBridge\":{\"status\":\"unavailable\"},\"grandPrixRequest\":{\"status\":\"unavailable\"},\"coworkBranchSession\":{\"status\":\"supported\"},\"coworkScheduledTaskProjects\":{\"status\":\"supported\"},\"coworkLocalSessionProjects\":{\"status\":\"supported\"},\"bootstrapConfig\":{\"status\":\"supported\"},\"chatIn3p\":{\"status\":\"supported\"},\"builtinMcpPresets\":{\"status\":\"supported\"},\"surfaceTogglesPreview\":{\"status\":\"unavailable\"},\"chatTab\":{\"status\":\"unavailable\"},\"chatCodeExecution\":{\"status\":\"unavailable\"},\"epitaxyMcpApps\":{\"status\":\"unavailable\"}}" --desktop-enterprise-config="{\"forceLoginOrgUUIDs\":null,\"loginSsoOrgDomain\":null,\"disableEssentialTelemetry\":false,\"disableNonessentialTelemetry\":false,\"disableMobileSimulatorTools\":false,\"banner\":null}" --desktop-telemetry-config="{\"deploymentMode\":\"1p\",\"appVersion\":\"1.22209.0\",\"cookielessOrigin\":false}" /prefetch:1
  2⤵
  PID:5964
- C:\Program Files\WindowsApps\Claude_1.22209.0.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.22209.0.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --field-trial-handle=1952,i,4893735834550114276,10071923856603511107,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1956,i,16199276530027064766,8132844217125746601,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=4636 /prefetch:14
  2⤵
  - Modifies registry class
  PID:6152
- C:\Program Files\WindowsApps\Claude_1.22209.0.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.22209.0.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --field-trial-handle=1952,i,4893735834550114276,10071923856603511107,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1956,i,16199276530027064766,8132844217125746601,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=4616 /prefetch:12
  2⤵
  PID:6148

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004F4 0x00000000000004F8
1⤵
PID:6296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

691a72dd-8773-41eb-968b-dc12a477c5e6.tmp

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\691a72dd-8773-41eb-968b-dc12a477c5e6.tmp
Size 197B
SHA256 e2312a54ca27465ee5686999061765049d61b3acb77ff39ccfc6eae0bad2606f
MD5 36c41e7037f0af2be1bcadaa700221ad
SHA1 4ffb7bb33fd7960d0cf7658f34cf53b8ac6a0dda
SHA512 e6c4b699bc379bbd6ae4272ab7d21cc40afbef5b45318ecf8701f9f8e64bb8a6be79f76f8f4bc8cc1bc5819ab23e8f8eccd5b9a66bc3a2112dbda57e12034050
TLSH
T1DDD0C035607114F3482FDD3055CC7CA44EF809404D472DD28ADC32081D2333C054B60F
MD5 SHA1 SHA512 TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Cache\Cache_Data\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Cache\Cache_Data\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

6147e0ee-54e9-4ed4-b29b-d6b1f68d7ae5.tmp

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Code Cache\js\index-dir\6147e0ee-54e9-4ed4-b29b-d6b1f68d7ae5.tmp
Size 48B
SHA256 dc50053fb98c9e408b14295ad60b5874e5943b7ade3b8d6d2360702138faf180
MD5 f83f782ccfc5f87f8140cc72bca45ad2
SHA1 592118d46f2f8c331d403613e9712f739521f878
SHA512 b09479ec43eecabb97cd44f911b2ce733efc256de422006fee5737221ef46a32145956b26d0b0afd69e96a865879fa2ead769d48738fccb052e62613d89f2b52
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 0ec926cdae96eeefb5240ce3da5433f37afbc2c08a096ff2e63af31b18ff36b5
MD5 60641ba6c24af31395a34655f5b27d51
SHA1 2d404554a8c8fb3249be5cbc39bd0cc7a5e265d2
SHA512 84cf5a5d073668e0244f67012523679ddaef0d972f1d69b20d24fab2bcb54ecc05183b4f59d338ab11ba29e00a06b6d5cb7e00304c71440fa6dc59bd8d679ca2
TLSH
T15F31621BD718B5C0C7AF567114C148B73FB8E834D8033E920617A3BBAD6638935A7364
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Network\Network Persistent State
Size 1KB
SHA256 3a8c5c1c7b172c4453ed1396883c4d0af7f90be2881ff446ef522fe31056d2ea
MD5 d86953680337a34c08d0d01b17478591
SHA1 c16d1061bd513e6dcc9d6c5cebfd1f4fc897ba68
SHA512 2de5f17733b316468ceeedf698283ba1f5f03e7f14c006683b07fdb07186307b67d2dfd82d1302a152cf3386e47da5c61c72a51b427466c94b8a3a079dafafe2
TLSH
T16131AED2C7ED467DC66226F52F213A63C2AE062C43587C03C9D9EFCE97E18356A1164D
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Partitions\cowork-file-preview\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Partitions\launch-preview-static\Local Storage\leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

35688e2e-b9f5-4a28-8d32-9b3619b6f8c2.tmp

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Partitions\launch-preview-static\Network\35688e2e-b9f5-4a28-8d32-9b3619b6f8c2.tmp
Size 84B
SHA256 712196693e3527ac1131831f1a2108b6c0e5c68967b26d51a452611cdfb86e0c
MD5 32b9dc9cc81d0682e78627c873fdd651
SHA1 46c486386d3e153c3e9b11d54cb52cf0064b71cf
SHA512 f18bc37f8b72411548da247aa1394cc5ac03c3bbd98e82eb8ba290ef239ef5b8625cf4835bd41ce7c52766d0bc3bfe9150dd22dbf62f0f05992ddde5fbfdc811
TLSH
T154A0121490405CFB0308835504146463C3F50002421848A91634318D019209D0004403
MD5 SHA1 SHA512 TLSH

Submit Download

6d31a605-1655-4af7-a9e9-2b36af200f19.tmp

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Partitions\launch-preview-static\Network\6d31a605-1655-4af7-a9e9-2b36af200f19.tmp
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Partitions\launch-preview-static\Session Storage\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

claude_desktop_config.json

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\claude_desktop_config.json
Size 228B
SHA256 ba7c89af0f509bd8b66242b14c17d0ab7b699cc7e5abd7ba4acc13d68b346749
MD5 1198ed02b26c535be8cb1ddf4c6f78b9
SHA1 0750af775ee337c13d7fa1dabf686bc9f376d0f2
SHA512 32c4120ed5471e756d235f940b751c8ec91c7142967b711d2e1596b43f13310c0acca96632868f6ccda939b6565023cb90d9065cca23128761822f446fe390a4
TLSH
T16DD0A720D8310EB706F292184E2D8513430179831A28702CA95E051C1FDC93C7874452
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\config.json
Size 42B
SHA256 300639f4014d329febb48edc086a146c31d5d573e7e9712d2df72cfda6d902f6
MD5 176c8f2f56d3a296609f05891b080887
SHA1 f4aaab462c289ac356e4412b0c578b7489395e0f
SHA512 1e84bd76fcc96bce2ed589177443909337c24da63b93de70ed66bd74a4daa00b07cbac4c1cfe20157d8e7eb78cd9d27291917602065084313b81d85964f8cfcd
MD5 SHA1 SHA512

Submit Download

config.json

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\config.json
Size 62B
SHA256 882518334a6e0a3773b17d788a599ef5a2e1b2884e803f014be9710df2768c1c
MD5 d0d49de82cbb972d892bd27a7830b7ec
SHA1 f5ab84a3bf3c2a0a973388106c2558df9c990a51
SHA512 4a56b304496dfc3c07c0979ed10de0465e926e914f1304bec8943692fee12473426c509cd9c94aabb072cb748486b52c40531de7cc0733cff63f6d720529ad2b
TLSH
T1D4A00238C1215013A42482EC040401C685DA076C660B190A86D17609C546F7C265A355
MD5 SHA1 SHA512 TLSH

Submit Download

config.json.tmp-4379739459b11b7a

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\config.json.tmp-4379739459b11b7a
Size 77B
SHA256 d83427ea1d8247d0206da0dfe08786d5d5c4760c85d9a2b2d0377dc945ceaff7
MD5 f88c3542c8dd3c817b128f24b28c2250
SHA1 d019975e1f453b5da1105cae160f98758c8765e9
SHA512 2760fdf5ce4e80860e730bb3c08bb7c1dd541093c331649a2cd94fe8818df256d8fff7d96de4f4cf4c34c09f5dfd6dcee8e56b298916e590d7486d69303d79a5
TLSH
T172A022EC8220C823AC2E03FC088C0023828B03EC020B000A00C83B2CC800F3C320A220
MD5 SHA1 SHA512 TLSH

Submit Download

config.json.tmp-437973999404bfda

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\config.json.tmp-437973999404bfda
Size 90B
SHA256 a8d5c2ac1a132c51dde6bf476ceae4a253fadd930cb8efc16925d11fa0d2bae3
MD5 7bb3846ff5b7c287eaefc3815e65d873
SHA1 32b1d74a45d241f837592c8f555dfbc07795b947
SHA512 e028f022d0ddfbac7645e502ebafc5823c5ed88f5048b7deee8fbffe777d09dc4a85bf19b7c3024f2740287e904b336a1ef3704ac8eb626ea32f611f2da27c94
TLSH
T125B01234C1110003A41081EC000C00C540AD172D5907040F85E17208C146E7C3235B11
MD5 SHA1 SHA512 TLSH

Submit Download

f4575449-c764-44b4-8154-28f4885fd05e.tmp

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\f4575449-c764-44b4-8154-28f4885fd05e.tmp
Size 122B
SHA256 27891dea04544c18a65fd0e789d3e7eb6e55fd3fdf3b046ebc181f8fd4303444
MD5 ff82c5926f71d4ddb8a5a7f6c1bd894f
SHA1 9cc69e4deb7817fd953c36bd6b7c5d1b5c63f8de
SHA512 68b38789d9ee6b104fb0b1bba6187550b093fcaa9f55e3efaacfca6c5c3334598a4e563714a8532eda72d4ee3a4a0e0bd5c84990f06a8016a523c5f857dce514
TLSH
T176B09256643064B2091F9E31410EB86A58B915208E472A4B86E832899A6726C098B21E
MD5 SHA1 SHA512 TLSH

Submit Download

APPX.229rikygi5_k999vh_65li5ag.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX.229rikygi5_k999vh_65li5ag.tmp
Size 7KB
SHA256 9026fab248e758c1297278acfbb6bd09abc4a188c35e478156b0270cad946147
MD5 6a58a220f8d3c1485c36e97ef2c08e2e
SHA1 691add6f273ac27570649dacbcc8af92949c1d95
SHA512 7c07200bad946a622a2a0ec2daa90d8862f2f645c4cf869430cd05c451cb526470b8d18559311c4999403e5e65a56993fc69bb7876340496dd7658c1c9a7c642
SSDEEP 192:rJG1F4Ra8brotDgq6LYYcwmbTYp+bkk6W+Gkk63:rJG1F4Ra8brotDgTLY/wJ+bkk6W+Gkku
TLSH
T1D9F1F24BD4AD18504672E1AAEF13D685EB2C095758DE00C4BCDD56432FB265F033BB9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

APPX.8gu3j2722f3_btym136nni0ah.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX.8gu3j2722f3_btym136nni0ah.tmp
Size 916KB
SHA256 ccc1f6a09b0926c508304fa51a830c50ee2dfeb5836b64df2ca80e709c6ae9a1
MD5 52cf8c56f6f61728f3f022bb4a25463a
SHA1 6d75f02374cd065b61a92cc551c4d23cfa5f0ec4
SHA512 424631be3db2cafeb96666db4e84dc4caf8093080d5285198405626a409e76d5f2983702a22d561e7644d698d3944a8473043446f17367d29ed382af55772bc2
SSDEEP 12288:j5C2NxI2Vc0U2aXY8oc+ANeZKMx3BizVqUXtiqmXeiy2yRjW+gwD:jY2pO2h8oc+ANevpkzVqUXt28jQ+T
TLSH
T15715B4E1553DBE3681AD0AAD8F24F5042C35883613376E0E9C5EA2B71CBF9621F674E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

APPX.av5f0rq82rczrrarz51yfwpj.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX.av5f0rq82rczrrarz51yfwpj.tmp
Size 10KB
SHA256 87989b496635ce18ecc47293abb3ac9b980d84cbb1a4bbe026d9bef33e7de5a7
MD5 b8bd6b1d30fa465230710372cf605337
SHA1 a2f22ce4e8af7450a674e721503a2dc4a2fae256
SHA512 7e72eed2105734d8d51fdc1bd7bb5cd7eac813b09302c217761b225a9fcd27f88a4ca21e739dfdaeb3fcbe69646f758e11aecd37039e5a469d613a5b8ecf8a4d
SSDEEP 192:oNyEIYiYF80dmL4pUQaULc8pq8RuX5hz28uNNTPKTbyIUVCvTqhNo2n:oNyEIYi2mL4/y8RKE7gyIjrgxn
TLSH
T145224BA389D05C49ED279D10B4D4A636EEB2B28A6ED0C1D2711DC152C7D53863BED2FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ClaudeSetup.log

Path C:\Users\Admin\AppData\Local\Temp\ClaudeSetup.log
Size 3KB
SHA256 def9b14868d6ecfcf43471a1d47f4c7f2603e70224f615ad8063a518b90c3125
MD5 302c65e704dc1a52667625d2c5910ff6
SHA1 d21d62e4b15e293b303127f88e5585099874b020
SHA512 16913cc1e972510abcfe2daf842f7fc03ec9251298b15684388560801a1ae21b2017e7b0454612c2cd8abaf9e52173932ee8c2be9d30f78d8fcd790b552b3e6e
TLSH
T1DD71CA1557C3C8E807D01447AAA7921BA13FE93EBA4D0B20B5D098744857639BBEFBC2
MD5 SHA1 SHA512 TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/2832-254-0x0000015F54D50000-0x0000015F54D7A000-memory.dmp

Download

memory/2832-124-0x0000015F54D80000-0x0000015F54D81000-memory.dmp

Download

memory/3412-121-0x00007FFF25430000-0x00007FFF25431000-memory.dmp

Download

memory/3412-949-0x0000015834ED0000-0x0000015834EFA000-memory.dmp

Download

memory/3412-122-0x0000015834F00000-0x0000015834F01000-memory.dmp

Download

memory/5964-952-0x00000235FAFB0000-0x00000235FAFDA000-memory.dmp

Download

memory/5964-162-0x00000235FAFE0000-0x00000235FAFE1000-memory.dmp

Download