d76d7e01f4d58e13b47c7880a0393d8dd0420a1c4b5be85313a2c0a9ac8b38e4

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 15:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_860db55d4d5f960f0a1100c0c0b19fdc_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Size 6.7MB
Sample260804-sh2zdaz1cs
SHA256 d76d7e01f4d58e13b47c7880a0393d8dd0420a1c4b5be85313a2c0a9ac8b38e4
MD5 860db55d4d5f960f0a1100c0c0b19fdc
SHA1 b87283444ce2180184094439699e653a9bddb49c
SHA512 3ad5e19938475fb71e8e0aee6a032d99d48c2fa603e8fed33cd3da059ca45b060cf2f11b2b126a0ed11db095fa28899920bb234c261a7f9628aa6ca0b5a1cc8c
SSDEEP 49152:lFATMATweCaOM1liQ9cz5iqCoFeUwXohxpI4Xp8tiaZch/75vh6YnpjCtvBY7wK0:lFrZlxFlca7p7ainB+DEi
TLSH
T1B8665A43ECA555E9C0AEE23485729253BA717C485F3123D76BA0F7382F76BC06AB9740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB	cowork-svc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB	cowork-svc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	cowork-svc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	cowork-svc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_A53644FA0CAAA458C7A0416292C7CC5B	cowork-svc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_A53644FA0CAAA458C7A0416292C7CC5B	cowork-svc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	Claude.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	cowork-svc.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\claude	Claude.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\claude\ = "URL:claude"	Claude.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\claude\shell\open\command\ = "\"C:\\Program Files\\WindowsApps\\Claude_1.24012.11.0_x64__pzs8sxrjxfjjc\\app\\Claude.exe\" \"%1\""	Claude.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3986082593-3624157295-3514260330-1000\{C779BEEF-B462-46F1-AB1E-45E454148642}	Claude.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\claude\URL Protocol	Claude.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\claude\shell\open\command	Claude.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\claude\shell	Claude.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\claude\shell\open	Claude.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
2960	reg.exe
5312	reg.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4788	2026-08-04_860db55d4d5f960f0a1100c0c0b19fdc_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
4788	2026-08-04_860db55d4d5f960f0a1100c0c0b19fdc_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
2860	cowork-svc.exe
2860	cowork-svc.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5508	Claude.exe
Token: SeCreatePagefilePrivilege	5508	Claude.exe
Token: SeShutdownPrivilege	5508	Claude.exe
Token: SeCreatePagefilePrivilege	5508	Claude.exe
Token: SeShutdownPrivilege	5508	Claude.exe
Token: SeCreatePagefilePrivilege	5508	Claude.exe
Token: SeShutdownPrivilege	5508	Claude.exe
Token: SeCreatePagefilePrivilege	5508	Claude.exe
Token: SeShutdownPrivilege	5508	Claude.exe
Token: SeCreatePagefilePrivilege	5508	Claude.exe
Token: SeShutdownPrivilege	5508	Claude.exe
Token: SeCreatePagefilePrivilege	5508	Claude.exe
Token: SeShutdownPrivilege	5508	Claude.exe
Token: SeCreatePagefilePrivilege	5508	Claude.exe
Token: SeShutdownPrivilege	5508	Claude.exe
Token: SeCreatePagefilePrivilege	5508	Claude.exe
Token: SeShutdownPrivilege	5508	Claude.exe
Token: SeCreatePagefilePrivilege	5508	Claude.exe
Token: SeShutdownPrivilege	5508	Claude.exe
Token: SeCreatePagefilePrivilege	5508	Claude.exe
Token: SeShutdownPrivilege	5508	Claude.exe
Token: SeCreatePagefilePrivilege	5508	Claude.exe
Token: SeShutdownPrivilege	5508	Claude.exe
Token: SeCreatePagefilePrivilege	5508	Claude.exe
Token: SeShutdownPrivilege	5508	Claude.exe
Token: SeCreatePagefilePrivilege	5508	Claude.exe
Token: SeShutdownPrivilege	5508	Claude.exe
Token: SeCreatePagefilePrivilege	5508	Claude.exe
Token: SeShutdownPrivilege	5508	Claude.exe
Token: SeCreatePagefilePrivilege	5508	Claude.exe
Token: SeShutdownPrivilege	5508	Claude.exe
Token: SeCreatePagefilePrivilege	5508	Claude.exe
Token: SeShutdownPrivilege	5508	Claude.exe
Token: SeCreatePagefilePrivilege	5508	Claude.exe
Token: SeShutdownPrivilege	5508	Claude.exe
Token: SeCreatePagefilePrivilege	5508	Claude.exe
Token: SeShutdownPrivilege	5508	Claude.exe
Token: SeCreatePagefilePrivilege	5508	Claude.exe
Token: SeShutdownPrivilege	5508	Claude.exe
Token: SeCreatePagefilePrivilege	5508	Claude.exe
Token: SeShutdownPrivilege	5508	Claude.exe
Token: SeCreatePagefilePrivilege	5508	Claude.exe
Token: SeShutdownPrivilege	5508	Claude.exe
Token: SeCreatePagefilePrivilege	5508	Claude.exe
Token: SeShutdownPrivilege	5508	Claude.exe
Token: SeCreatePagefilePrivilege	5508	Claude.exe
Token: SeShutdownPrivilege	5508	Claude.exe
Token: SeCreatePagefilePrivilege	5508	Claude.exe
Token: SeShutdownPrivilege	5508	Claude.exe
Token: SeCreatePagefilePrivilege	5508	Claude.exe
Token: SeShutdownPrivilege	5508	Claude.exe
Token: SeCreatePagefilePrivilege	5508	Claude.exe
Token: SeShutdownPrivilege	5508	Claude.exe
Token: SeCreatePagefilePrivilege	5508	Claude.exe
Token: SeShutdownPrivilege	5508	Claude.exe
Token: SeCreatePagefilePrivilege	5508	Claude.exe
Token: SeShutdownPrivilege	5508	Claude.exe
Token: SeCreatePagefilePrivilege	5508	Claude.exe
Token: SeShutdownPrivilege	5508	Claude.exe
Token: SeCreatePagefilePrivilege	5508	Claude.exe
Token: SeShutdownPrivilege	5508	Claude.exe
Token: SeCreatePagefilePrivilege	5508	Claude.exe
Token: SeShutdownPrivilege	5508	Claude.exe
Token: SeCreatePagefilePrivilege	5508	Claude.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5508	Claude.exe
5508	Claude.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
5508	Claude.exe
5508	Claude.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4356	explorer.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 4788	2964	2026-08-04_860db55d4d5f960f0a1100c0c0b19fdc_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	90
PID 4788 wrote to memory of 3012	4788	2026-08-04_860db55d4d5f960f0a1100c0c0b19fdc_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	93
PID 5508 wrote to memory of 4748	5508	Claude.exe	97
PID 5508 wrote to memory of 1124	5508	Claude.exe	98
PID 5508 wrote to memory of 4340	5508	Claude.exe	99
PID 5508 wrote to memory of 1064	5508	Claude.exe	100
PID 5508 wrote to memory of 5900	5508	Claude.exe	101
PID 5508 wrote to memory of 2960	5508	Claude.exe	102
PID 5508 wrote to memory of 5312	5508	Claude.exe	103
PID 5508 wrote to memory of 1820	5508	Claude.exe	107
PID 5508 wrote to memory of 6780	5508	Claude.exe	108
PID 5508 wrote to memory of 6940	5508	Claude.exe	109
PID 5508 wrote to memory of 6936	5508	Claude.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-08-04_860db55d4d5f960f0a1100c0c0b19fdc_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_860db55d4d5f960f0a1100c0c0b19fdc_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Users\Admin\AppData\Local\Temp\2026-08-04_860db55d4d5f960f0a1100c0c0b19fdc_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-04_860db55d4d5f960f0a1100c0c0b19fdc_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe" --elevated --msix-path "C:\Users\Admin\AppData\Local\Temp\Claude-1497965992.msix" --log-path "C:\Users\Admin\AppData\Local\Temp\ClaudeSetup.log" --all-users
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4788
- - C:\Windows\explorer.exe
    explorer.exe shell:AppsFolder\Claude_pzs8sxrjxfjjc!Claude
    3⤵
    PID:3012

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness
1⤵
PID:1368

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4356

C:\Program Files\WindowsApps\Claude_1.24012.11.0_x64__pzs8sxrjxfjjc\app\resources\cowork-svc.exe
"C:\Program Files\WindowsApps\Claude_1.24012.11.0_x64__pzs8sxrjxfjjc\app\resources\cowork-svc.exe"
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2860

C:\Program Files\WindowsApps\Claude_1.24012.11.0_x64__pzs8sxrjxfjjc\app\Claude.exe
"C:\Program Files\WindowsApps\Claude_1.24012.11.0_x64__pzs8sxrjxfjjc\app\Claude.exe"
1⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5508
- C:\Program Files\WindowsApps\Claude_1.24012.11.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.24012.11.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\Claude /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\Claude\Crashpad --url=https://f.a.k/e --annotation=_productName=Claude --annotation=_version=1.24012.11 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=42.7.0 --initial-client-data=0x4dc,0x4e0,0x4e4,0x4d8,0x4e8,0x7ff6b199d188,0x7ff6b199d198,0x7ff6b199d1a8
  2⤵
  PID:4748
- C:\Program Files\WindowsApps\Claude_1.24012.11.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.24012.11.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1972,i,6425110137795488767,4357179435430954046,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1976,i,3891045527744345191,12320740780624723298,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1968 /prefetch:2
  2⤵
  PID:1124
- C:\Program Files\WindowsApps\Claude_1.24012.11.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.24012.11.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --field-trial-handle=1972,i,6425110137795488767,4357179435430954046,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1976,i,3891045527744345191,12320740780624723298,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2028 /prefetch:11
  2⤵
  PID:4340
- C:\Program Files\WindowsApps\Claude_1.24012.11.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.24012.11.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --app-path="C:\Program Files\WindowsApps\Claude_1.24012.11.0_x64__pzs8sxrjxfjjc\app\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1785855508956836 --launch-time-ticks=654004447 --field-trial-handle=1972,i,6425110137795488767,4357179435430954046,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1976,i,3891045527744345191,12320740780624723298,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2952 --desktop-enterprise-config="{\"forceLoginOrgUUIDs\":null,\"loginSsoOrgDomain\":null,\"disableEssentialTelemetry\":false,\"disableNonessentialTelemetry\":false,\"disableMobileSimulatorTools\":false,\"banner\":null}" /prefetch:1
  2⤵
  PID:1064
- C:\Program Files\WindowsApps\Claude_1.24012.11.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.24012.11.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --app-path="C:\Program Files\WindowsApps\Claude_1.24012.11.0_x64__pzs8sxrjxfjjc\app\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1785855508956836 --launch-time-ticks=654012399 --field-trial-handle=1972,i,6425110137795488767,4357179435430954046,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1976,i,3891045527744345191,12320740780624723298,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=2992 --desktop-features="{\"launch\":{\"status\":\"supported\"},\"artifactsPane\":{\"status\":\"unavailable\"},\"nativeQuickEntry\":{\"status\":\"unavailable\"},\"quickEntryDictation\":{\"status\":\"unavailable\"},\"quickEntryGlobalShortcut\":{\"status\":\"supported\"},\"customQuickEntryDictationShortcut\":{\"status\":\"supported\"},\"ultrareviewErrorCategories\":{\"status\":\"supported\"},\"plushRaccoon\":{\"status\":\"unavailable\"},\"quietPenguin\":{\"status\":\"unavailable\"},\"chillingSlothFeat\":{\"status\":\"supported\"},\"chillingSlothSshShell\":{\"status\":\"supported\"},\"chillingSlothEnterprise\":{\"status\":\"supported\"},\"chillingSlothLocal\":{\"status\":\"supported\"},\"chillingSlothPool\":{\"status\":\"unavailable\"},\"yukonSilver\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute, vfpext\",\"unsupportedCode\":\"hcs_not_available\"},\"yukonSilverGems\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute, vfpext\",\"unsupportedCode\":\"hcs_not_available\"},\"yukonSilverGemsCache\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute, vfpext\",\"unsupportedCode\":\"hcs_not_available\"},\"wakeScheduler\":{\"status\":\"unavailable\"},\"desktopTopBar\":{\"status\":\"supported\"},\"ccdPlugins\":{\"status\":\"supported\"},\"computerUse\":{\"status\":\"supported\"},\"computerUseAppScoped\":{\"status\":\"unsupported\",\"reason\":\"Background app-scoped mode is macOS-only\",\"unsupportedCode\":\"unsupported_platform\"},\"coworkWatchRecord\":{\"status\":\"unsupported\",\"reason\":\"Watch-record is not available on this platform\",\"unsupportedCode\":\"unsupported_platform\"},\"coworkWatchers\":{\"status\":\"unavailable\"},\"coworkKappa\":{\"status\":\"unavailable\"},\"coworkArtifacts\":{\"status\":\"unavailable\"},\"coworkAutoModeAlwaysAllowOverride\":{\"status\":\"unavailable\"},\"framebufferPreview\":{\"status\":\"unavailable\"},\"iosSimulator\":{\"status\":\"unsupported\",\"reason\":\"iOS Simulator panel requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"androidEmulator\":{\"status\":\"unsupported\",\"reason\":\"Android emulator is disabled by its rollout flag\",\"unsupportedCode\":\"unknown\"},\"iosSimulatorH264\":{\"status\":\"unsupported\",\"reason\":\"iOS Simulator panel requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"grandPrix\":{\"status\":\"unavailable\"},\"tearOffHalo\":{\"status\":\"unsupported\",\"reason\":\"Tear-off halo overlay requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"coworkArtifactPopout\":{\"status\":\"supported\"},\"claudeDesignWindow\":{\"status\":\"supported\"},\"coworkRemoteSessionSpaces\":{\"status\":\"supported\"},\"spaceMemoryBridge\":{\"status\":\"unavailable\"},\"grandPrixRequest\":{\"status\":\"unavailable\"},\"coworkBranchSession\":{\"status\":\"supported\"},\"coworkScheduledTaskProjects\":{\"status\":\"supported\"},\"coworkLocalSessionProjects\":{\"status\":\"supported\"},\"bootstrapConfig\":{\"status\":\"supported\"},\"chatIn3p\":{\"status\":\"supported\"},\"builtinMcpPresets\":{\"status\":\"supported\"},\"surfaceTogglesPreview\":{\"status\":\"unavailable\"},\"chatTab\":{\"status\":\"unavailable\"},\"chatCodeExecution\":{\"status\":\"unavailable\"},\"mcpPersistentAlwaysAllow\":{\"status\":\"supported\"},\"epitaxyMcpApps\":{\"status\":\"unavailable\"}}" --desktop-enterprise-config="{\"forceLoginOrgUUIDs\":null,\"loginSsoOrgDomain\":null,\"disableEssentialTelemetry\":false,\"disableNonessentialTelemetry\":false,\"disableMobileSimulatorTools\":false,\"banner\":null}" --desktop-telemetry-config="{\"deploymentMode\":\"1p\",\"appVersion\":\"1.24012.11\",\"cookielessOrigin\":false}" /prefetch:1
  2⤵
  PID:5900
- C:\Windows\System32\reg.exe
  C:\Windows\System32\reg.exe query HKLM\SOFTWARE\Policies\ClaudeCode /v Settings
  2⤵
  - Modifies registry key
  PID:2960
- C:\Windows\System32\reg.exe
  C:\Windows\System32\reg.exe query HKCU\SOFTWARE\Policies\ClaudeCode /v Settings
  2⤵
  - Modifies registry key
  PID:5312
- C:\Program Files\WindowsApps\Claude_1.24012.11.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.24012.11.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --app-path="C:\Program Files\WindowsApps\Claude_1.24012.11.0_x64__pzs8sxrjxfjjc\app\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1785855508956836 --launch-time-ticks=654974184 --field-trial-handle=1972,i,6425110137795488767,4357179435430954046,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1976,i,3891045527744345191,12320740780624723298,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=4168 --desktop-features="{\"launch\":{\"status\":\"supported\"},\"artifactsPane\":{\"status\":\"unavailable\"},\"nativeQuickEntry\":{\"status\":\"unavailable\"},\"quickEntryDictation\":{\"status\":\"unavailable\"},\"quickEntryGlobalShortcut\":{\"status\":\"supported\"},\"customQuickEntryDictationShortcut\":{\"status\":\"supported\"},\"ultrareviewErrorCategories\":{\"status\":\"supported\"},\"plushRaccoon\":{\"status\":\"unavailable\"},\"quietPenguin\":{\"status\":\"unavailable\"},\"chillingSlothFeat\":{\"status\":\"supported\"},\"chillingSlothSshShell\":{\"status\":\"supported\"},\"chillingSlothEnterprise\":{\"status\":\"supported\"},\"chillingSlothLocal\":{\"status\":\"supported\"},\"chillingSlothPool\":{\"status\":\"unavailable\"},\"yukonSilver\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute, vfpext\",\"unsupportedCode\":\"hcs_not_available\"},\"yukonSilverGems\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute, vfpext\",\"unsupportedCode\":\"hcs_not_available\"},\"yukonSilverGemsCache\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute, vfpext\",\"unsupportedCode\":\"hcs_not_available\"},\"wakeScheduler\":{\"status\":\"unavailable\"},\"desktopTopBar\":{\"status\":\"supported\"},\"ccdPlugins\":{\"status\":\"supported\"},\"computerUse\":{\"status\":\"supported\"},\"computerUseAppScoped\":{\"status\":\"unsupported\",\"reason\":\"Background app-scoped mode is macOS-only\",\"unsupportedCode\":\"unsupported_platform\"},\"coworkWatchRecord\":{\"status\":\"unsupported\",\"reason\":\"Watch-record is not available on this platform\",\"unsupportedCode\":\"unsupported_platform\"},\"coworkWatchers\":{\"status\":\"unavailable\"},\"coworkKappa\":{\"status\":\"unavailable\"},\"coworkArtifacts\":{\"status\":\"unavailable\"},\"coworkAutoModeAlwaysAllowOverride\":{\"status\":\"unavailable\"},\"framebufferPreview\":{\"status\":\"unavailable\"},\"iosSimulator\":{\"status\":\"unsupported\",\"reason\":\"iOS Simulator panel requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"androidEmulator\":{\"status\":\"unsupported\",\"reason\":\"Android emulator is disabled by its rollout flag\",\"unsupportedCode\":\"unknown\"},\"iosSimulatorH264\":{\"status\":\"unsupported\",\"reason\":\"iOS Simulator panel requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"grandPrix\":{\"status\":\"unavailable\"},\"tearOffHalo\":{\"status\":\"unsupported\",\"reason\":\"Tear-off halo overlay requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"coworkArtifactPopout\":{\"status\":\"supported\"},\"claudeDesignWindow\":{\"status\":\"supported\"},\"coworkRemoteSessionSpaces\":{\"status\":\"supported\"},\"spaceMemoryBridge\":{\"status\":\"unavailable\"},\"grandPrixRequest\":{\"status\":\"unavailable\"},\"coworkBranchSession\":{\"status\":\"supported\"},\"coworkScheduledTaskProjects\":{\"status\":\"supported\"},\"coworkLocalSessionProjects\":{\"status\":\"supported\"},\"bootstrapConfig\":{\"status\":\"supported\"},\"chatIn3p\":{\"status\":\"supported\"},\"builtinMcpPresets\":{\"status\":\"supported\"},\"surfaceTogglesPreview\":{\"status\":\"unavailable\"},\"chatTab\":{\"status\":\"unavailable\"},\"chatCodeExecution\":{\"status\":\"unavailable\"},\"mcpPersistentAlwaysAllow\":{\"status\":\"supported\"},\"epitaxyMcpApps\":{\"status\":\"unavailable\"}}" --desktop-enterprise-config="{\"forceLoginOrgUUIDs\":null,\"loginSsoOrgDomain\":null,\"disableEssentialTelemetry\":false,\"disableNonessentialTelemetry\":false,\"disableMobileSimulatorTools\":false,\"banner\":null}" --desktop-telemetry-config="{\"deploymentMode\":\"1p\",\"appVersion\":\"1.24012.11\",\"cookielessOrigin\":false}" /prefetch:1
  2⤵
  PID:1820
- C:\Program Files\WindowsApps\Claude_1.24012.11.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.24012.11.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --app-path="C:\Program Files\WindowsApps\Claude_1.24012.11.0_x64__pzs8sxrjxfjjc\app\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --time-ticks-at-unix-epoch=-1785855508956836 --launch-time-ticks=659539625 --field-trial-handle=1972,i,6425110137795488767,4357179435430954046,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1976,i,3891045527744345191,12320740780624723298,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3400 --desktop-features="{\"launch\":{\"status\":\"supported\"},\"artifactsPane\":{\"status\":\"unavailable\"},\"nativeQuickEntry\":{\"status\":\"unavailable\"},\"quickEntryDictation\":{\"status\":\"unavailable\"},\"quickEntryGlobalShortcut\":{\"status\":\"supported\"},\"customQuickEntryDictationShortcut\":{\"status\":\"supported\"},\"ultrareviewErrorCategories\":{\"status\":\"supported\"},\"plushRaccoon\":{\"status\":\"unavailable\"},\"quietPenguin\":{\"status\":\"unavailable\"},\"chillingSlothFeat\":{\"status\":\"supported\"},\"chillingSlothSshShell\":{\"status\":\"supported\"},\"chillingSlothEnterprise\":{\"status\":\"supported\"},\"chillingSlothLocal\":{\"status\":\"supported\"},\"chillingSlothPool\":{\"status\":\"unavailable\"},\"yukonSilver\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute, vfpext\",\"unsupportedCode\":\"hcs_not_available\"},\"yukonSilverGems\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute, vfpext\",\"unsupportedCode\":\"hcs_not_available\"},\"yukonSilverGemsCache\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute, vfpext\",\"unsupportedCode\":\"hcs_not_available\"},\"wakeScheduler\":{\"status\":\"unavailable\"},\"desktopTopBar\":{\"status\":\"supported\"},\"ccdPlugins\":{\"status\":\"supported\"},\"computerUse\":{\"status\":\"supported\"},\"computerUseAppScoped\":{\"status\":\"unsupported\",\"reason\":\"Background app-scoped mode is macOS-only\",\"unsupportedCode\":\"unsupported_platform\"},\"coworkWatchRecord\":{\"status\":\"unsupported\",\"reason\":\"Watch-record is not available on this platform\",\"unsupportedCode\":\"unsupported_platform\"},\"coworkWatchers\":{\"status\":\"unavailable\"},\"coworkKappa\":{\"status\":\"unavailable\"},\"coworkArtifacts\":{\"status\":\"unavailable\"},\"coworkAutoModeAlwaysAllowOverride\":{\"status\":\"unavailable\"},\"framebufferPreview\":{\"status\":\"unavailable\"},\"iosSimulator\":{\"status\":\"unsupported\",\"reason\":\"iOS Simulator panel requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"androidEmulator\":{\"status\":\"unsupported\",\"reason\":\"Android emulator is disabled by its rollout flag\",\"unsupportedCode\":\"unknown\"},\"iosSimulatorH264\":{\"status\":\"unsupported\",\"reason\":\"iOS Simulator panel requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"grandPrix\":{\"status\":\"unavailable\"},\"tearOffHalo\":{\"status\":\"unsupported\",\"reason\":\"Tear-off halo overlay requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"coworkArtifactPopout\":{\"status\":\"supported\"},\"claudeDesignWindow\":{\"status\":\"supported\"},\"coworkRemoteSessionSpaces\":{\"status\":\"supported\"},\"spaceMemoryBridge\":{\"status\":\"unavailable\"},\"grandPrixRequest\":{\"status\":\"unavailable\"},\"coworkBranchSession\":{\"status\":\"supported\"},\"coworkScheduledTaskProjects\":{\"status\":\"supported\"},\"coworkLocalSessionProjects\":{\"status\":\"supported\"},\"bootstrapConfig\":{\"status\":\"supported\"},\"chatIn3p\":{\"status\":\"supported\"},\"builtinMcpPresets\":{\"status\":\"supported\"},\"surfaceTogglesPreview\":{\"status\":\"unavailable\"},\"chatTab\":{\"status\":\"unavailable\"},\"chatCodeExecution\":{\"status\":\"unavailable\"},\"mcpPersistentAlwaysAllow\":{\"status\":\"supported\"},\"epitaxyMcpApps\":{\"status\":\"unavailable\"}}" --desktop-enterprise-config="{\"forceLoginOrgUUIDs\":null,\"loginSsoOrgDomain\":null,\"disableEssentialTelemetry\":false,\"disableNonessentialTelemetry\":false,\"disableMobileSimulatorTools\":false,\"banner\":null}" --desktop-telemetry-config="{\"deploymentMode\":\"1p\",\"appVersion\":\"1.24012.11\",\"cookielessOrigin\":false}" /prefetch:1
  2⤵
  PID:6780
- C:\Program Files\WindowsApps\Claude_1.24012.11.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.24012.11.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --field-trial-handle=1972,i,6425110137795488767,4357179435430954046,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1976,i,3891045527744345191,12320740780624723298,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=4512 /prefetch:14
  2⤵
  - Modifies registry class
  PID:6940
- C:\Program Files\WindowsApps\Claude_1.24012.11.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.24012.11.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --field-trial-handle=1972,i,6425110137795488767,4357179435430954046,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1976,i,3891045527744345191,12320740780624723298,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=4452 /prefetch:12
  2⤵
  PID:6936

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x0000000000000500 0x00000000000004D8
1⤵
PID:7272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

data_0

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Cache\Cache_Data\data_0
Size 44KB
SHA256 97cfe5dd57134cfa74befb4d0549727dbec4f9e7ae543c36ae8ff7f920b5ff11
MD5 993e856d1e901a54730d2f71f2f21b49
SHA1 79d360b0c51ac656128e00f8ea1b3c0ffc50c44b
SHA512 adf56bbf5e481a42262a117c8fdc841f2f3baac1bb16081f31e36164c6884aa141de0cf399246bc4a0b310919ee8a2bcbc22dcb0325167840a759664539ed5e3
SSDEEP 3:MsFlTlrllkl2bL0lHlCkellYjFTKlHlVMES//l:/F02bL0lHlCkeQlKlHl
TLSH
T14913125F64822C03CB1A0133D0624FF01E31C413B1325F6B50F01091DC877810D00000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Cache\Cache_Data\data_1
Size 264KB
SHA256 42758f4a2a85ea3777eae59045312decbbfc51d4dfaec17bde9ffe98a6277546
MD5 4cbf890cda4da9adc0a0a9832cfdc153
SHA1 0c15a2d3c366e75e75652453e6a9704ab200a3aa
SHA512 92e65aabe1d7725f547cf490b335e6eb6ebae73a7211eadb994b52d1945ed4ba4bb1d7e2ff0fc00a6964eb1b03ded4b2fccd5c6b2f3e279df4d81a36f7b77205
SSDEEP 6:/M/LlEtL0lbFMo62YwJtiHeL0lxA5l4Mo:U/YcyodZ0HmcxALro
TLSH
T112448CEF02801258CB8080B3E022E9EE9ED3E83CAE5A7F4322F200E3E8812102C04440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Cache\Cache_Data\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Cache\Cache_Data\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

8da21727-c3b5-45c8-979a-43e008cc1279.tmp

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Code Cache\js\index-dir\8da21727-c3b5-45c8-979a-43e008cc1279.tmp
Size 48B
SHA256 551c0d49d78bc5775837a081d68c530155f8efddfe9a8ccd5920975702d28835
MD5 5582b36b9f6061a22604e89e2209602f
SHA1 f0e0a0ad098dc6210b690605dad28b508dedba72
SHA512 e378c7789d2a55f4b6a67dacb448ef7e17ea4361a90a16a91989b78b5174cce0de45c98b9607be9d3b8cf8db0863991bbfdcae4d1f704a3738bf1cfb5e439e62
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 ce1dcf0769290425531f315440bdf8da28c8c7350f937731d685a3b78ac50213
MD5 242ac9e26dd2797010702dab7aa4ee09
SHA1 656d05121ac1ff3e2b0083ff9fb2a15bb89ee39b
SHA512 5ea7da1b9488073aebb84e99f45d6bf523fd4f310744f5aa18aa68cf7c6953102d0362403e725fc86b145dfd1cadcc6d81e3a511f7779dde74141252e7d7c0a6
TLSH
T1643110C8D6FBD0C2DB2331FF58D77DEC75B4D21E491B1DE184606232808E710927A648
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Network\Network Persistent State
Size 2KB
SHA256 50b885b87ae1537c9367bb75f2a0b7cf7d7a1053387b17c6ee754d0f64c51438
MD5 8b34756cfea9b0fd2c4ab43a1d31a54e
SHA1 186d04196e9bcbfbae0f7289fed5ee6bec64003b
SHA512 62dae5c7a9f76c4107316de36a44810671cd142745117c325705c510c95b3007db50275a71c2060bd2f6c425dd42b98a94c7adabc9cc9f4707946aabb098234d
TLSH
T17651AAC6C7D9077E85A32BF61F653963C1BE1A1C92287C0788CAFF8E67E1435561164C
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Partitions\cowork-file-preview\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Partitions\cowork-file-preview\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Partitions\launch-preview-static\Local Storage\leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

c963e08f-0758-47e5-9884-fec1255b26fa.tmp

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Partitions\launch-preview-static\Network\c963e08f-0758-47e5-9884-fec1255b26fa.tmp
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

efa3257f-f2cb-4f84-9df9-ae59a8dc21bb.tmp

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Partitions\launch-preview-static\Network\efa3257f-f2cb-4f84-9df9-ae59a8dc21bb.tmp
Size 84B
SHA256 712196693e3527ac1131831f1a2108b6c0e5c68967b26d51a452611cdfb86e0c
MD5 32b9dc9cc81d0682e78627c873fdd651
SHA1 46c486386d3e153c3e9b11d54cb52cf0064b71cf
SHA512 f18bc37f8b72411548da247aa1394cc5ac03c3bbd98e82eb8ba290ef239ef5b8625cf4835bd41ce7c52766d0bc3bfe9150dd22dbf62f0f05992ddde5fbfdc811
TLSH
T154A0121490405CFB0308835504146463C3F50002421848A91634318D019209D0004403
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\WebStorage\2\CacheStorage\index.txt
Size 176B
SHA256 f98f940ae2e87d02979349770db62eebd0e81c2a445b101a46156c51f674db4c
MD5 84aae7982bf79999f113aef9bf772392
SHA1 c6650d16eed4c7f0e4d8de91c46256600bb79d6d
SHA512 837c4b6dbea00bb1b861613042884a7bf06128432b20e71fcacf14510104e6c1de8b88c7106a4af87871a0c425b92fe4c5e9728aa8b4503c7fce5043b8f66737
TLSH
T1F8C012BB01808A81BEF125FAA00332CACA223EEA0DC0A64DA8623084B23485A0801A20
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\WebStorage\2\CacheStorage\index.txt
Size 89B
SHA256 92cda5a28f4c1874bcf0aca7ca908e1234751120abf372f5a81cbb33590c3590
MD5 8684fe11e05213691ad78cf380e7c451
SHA1 1c075025a185041ddeb120c2c8e8cc2fe175d82b
SHA512 fd3ede8f008a3407360d649eb6c2c07c14454f2c17e823af53217c15baeb965494074dfff8b87acf24474839cdf9aab03c71be349e434dc6ba89e32b2a57bc55
TLSH
T1B2B002FF014156D15EA135E7100731DEC56376D85CC0EA4CD572105473104AD5401C24
MD5 SHA1 SHA512 TLSH

Submit Download

claude_desktop_config.json.tmp

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\claude_desktop_config.json.tmp
Size 228B
SHA256 5bf0ed64542463a59d10a84abea1f69fde0ae9384917a444abda2bd6c9752423
MD5 2f25da2b08d096f499456ceb60acdeaf
SHA1 f693a2d70e019532e33447540a215414522ed068
SHA512 73c2a711404567182163661135e071d643bc03e3dc4e74bafab279b2b305a99c428cf1e6438f8c00232ef1bbbd9c54239205fd46ca6aa27bb6ff943aff46b6ba
TLSH
T1C8D0A720D8210EA716F2A31C4D3D8513430179831928B028A55E091C1FCC93C6934462
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\config.json
Size 43B
SHA256 9f94bf83662c83ff69a001e2967f8b86f5ec060e552d1ac95e2a9ecea1941d00
MD5 f36e143865949979cc2d5c3fb73860b7
SHA1 82e07c95502ae607b757a14973fb80f6b3b214af
SHA512 6d79a245f6ee0740f81ad6814cc63be9b68c68a70e5f8aa9a6664b6e61360ebb6f5ebf34dbbe457bd930868f59cae84ff87c67f1b7f8b4e137372935d32edbb7
MD5 SHA1 SHA512

Submit Download

config.json.tmp-5856165474a13ef4

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\config.json.tmp-5856165474a13ef4
Size 78B
SHA256 9bb9bf714ccfb758268224ca23dd24a046a707e11a840ab781e031d891f875fc
MD5 57331bb0ddac8e6694c198ad203f4277
SHA1 55381e95d8b4f2d851972091e0d3f9383272a244
SHA512 b2a50c59b6304127b2ae6df9d01e502b1c47304d8ba366369e34af20927e321f78f48293ed492954ce68f7182dd8dce9aa32fc18364396e9b207a1625c3461cb
TLSH
T1E5A0228C8A308022CC0F03BC8CCC02A382CA038C020F80080888AB2FCA20FFC0B8E202
MD5 SHA1 SHA512 TLSH

Submit Download

config.json.tmp-5856165642d3171f

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\config.json.tmp-5856165642d3171f
Size 63B
SHA256 9915ade55cfdd39b61fee9b23bd6b658b1af37c613485fefd30626c197581958
MD5 27a31de0a4fb8afd06af88897f8d912b
SHA1 2cf8dc83eb4430a0718220532969f7e65dd0e81f
SHA512 d8453b5b22dd66ef9e78685877751f7569a27a30d5cf2a21969aff7f4521fd11e9a93105efa9cb6140037a3c4709eacf6f3c9e232fb59e7aa9b500b679ff5351
TLSH
T1A0A00228C0219023E01482AC040400C685DA129C660B590686D1B24BC646BFC0A4E756
MD5 SHA1 SHA512 TLSH

Submit Download

config.json.tmp-5856165787998d26

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\config.json.tmp-5856165787998d26
Size 71B
SHA256 4ba55854f740709254a196e563549cb7f3a42e9f6415045632d0ab410bdc4100
MD5 39444b798ecfe07076ac2ea5c4059149
SHA1 cfce5b58578a1102ca10753777e4625f7338bd17
SHA512 28db3598dc7ffc1f489a76a3a5d1fa99b96dd3fb362239b3c08ee0d342d906e138a7740a359bacb4ddb9be1bb4c5d8d4a5894763ab3bcc12546787c3cd40ceeb
TLSH
T114A00278C1258427E454827C100D44CA85FE775D9507400F99E5A24FC745FF86B39F66
MD5 SHA1 SHA512 TLSH

Submit Download

config.json.tmp-5856165902a3182e

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\config.json.tmp-5856165902a3182e
Size 76B
SHA256 f54a76b428706a08b8b8362993986677c268212a6b443cfdeb696934dee73cd9
MD5 49325f69a24cc757e9b729a06e9d9631
SHA1 30943bd04a0b19debd67aca2d05c76f529ec538c
SHA512 8a0761b6071cb9fa019c9366a1b5bee1e2483b3b9292e544d6cc8d71ce488a65c9876250e74d0d4e6c9f511e781664528f2e638c621e1954843146c522dd3fd9
TLSH
T187A0222AC0208032E0300BAC0B0822838CCA020C008B8800CB82FB8FE2003FE0E0ABE2
MD5 SHA1 SHA512 TLSH

Submit Download

scope_v3.json

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\sentry\scope_v3.json
Size 7KB
SHA256 b7f9e5342c9b2485a3e714c165b1ca492564abaac8a0706198d8ffa49fb1e837
MD5 24c99b8a4aca9bdf5f4c2374a16dc435
SHA1 5bb6fead694e8efad509fe8036b491cc081a9d41
SHA512 d841ebb1a8b8d98af857e706698dd2fda516c61f52f491f44490c28ba7697acf34bd9274284df079aca957407b03c17827e58ba964132f2c522736ae1e758a76
SSDEEP 96:vxt12osDeBQgtVtFO9Gmy9G3flsryXWWfSEWIxPq88SEMcCEmWWvSEWI3/GZJKI5:ZsXWsSEWIxPn8SEMcwW4SEWIAQixDJ
TLSH
T1B9F14F5A2E6C9CBD0E46B38B74C63F8E9378678399CD3C431D15ED1CE99E192640D22E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

APPX.1g1ode1rc6bbrf9pw7ux9e0o.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX.1g1ode1rc6bbrf9pw7ux9e0o.tmp
Size 7KB
SHA256 e84fdf636741f0ded5d3c6f74df78b9af3e5cab341edfb30f6aef4ab99cb246b
MD5 16fc67eb1dc0cc89c77b7765ddd59afa
SHA1 d78266e4ab6acb5ca1f5cab7660f8e8f05096bfa
SHA512 388e6a2963803df689e30e8b91123ff54cdb3d8654ac75b4309c5535ee035e991428d1c0ceb1f7b332418489b3e700b93f5c4655d832b0b43d9577d48c930f0a
SSDEEP 192:rJG1F4Ra8brotDMq6LYYcwmbTYp+bkk6W+Gkk63:rJG1F4Ra8brotDMTLY/wJ+bkk6W+Gkku
TLSH
T1B2F1F24BD4AD185046B2E1AAEF13D685EB2C099758DE00C0BCDD56532FB265F033BB9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

APPX.b_rai2lx6qqorcqda7ats0ssh.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX.b_rai2lx6qqorcqda7ats0ssh.tmp
Size 10KB
SHA256 52f4215c308d24a7bd8ee4a11ce3db4adffbdb4e2855a816197c2b183731b9c3
MD5 c56cf8944d897b65d7b8ab83cd0d79d6
SHA1 773e3f51465a79f9ed366b1c68cd07d9a0e9c41b
SHA512 ce38fef0f176bd54b58603c7c88b65eb495fad915a56ccb1628295ebd20a1b0bbc298fc0da5bc6c3f5767db9a42f3437f43662103ec22bd9709e7fe43dd255dc
SSDEEP 192:MrNyEIYiYF80dmL4pUQaULc8pq8RuX5hz28uNNTPKTWi7pAqsw:MrNyEIYi2mL4/y8RKE7ZoLv
TLSH
T1B8223BA389906C05EE279D50B0D8A936EEB2B2C62DD0C1D2711DC226C7953863BDD2FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

APPX.jznt409pydzayyt0cfn7bztt.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX.jznt409pydzayyt0cfn7bztt.tmp
Size 1007KB
SHA256 a164acc248b0cac6a47952585e72482807c81c9b8471f2026ed4074ac54a921a
MD5 26f7ff4c9f97ca9cb670d918b14574a4
SHA1 27a5bcb4c11106efc19bf970c448c3d5742fa68e
SHA512 9786bcd5dc7f8ff2c076dae682872ec715687e39687c3235c05d023524847d7d13b5c3e4664fc57a6f1d445d0a9015b4f9e646cbe7ab0fcbd3c204e658d8019e
SSDEEP 12288:Sqkhv7aVcZ50DCv8z4GyMlosdv3r16iSUZlZ3Vd1FwHe71mT+9RG1:C9mDDCv8z7yMV93h/SUBL1ie7D/I
TLSH
T15925B5E1513DBE36816D0AAD8F24F5042C35883653376E0E9C6EA2B318BF9725F674E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ClaudeSetup.log

Path C:\Users\Admin\AppData\Local\Temp\ClaudeSetup.log
Size 3KB
SHA256 440c97af17d2129c2009fd7fece64ca9e5b5d720d54c37f88b408fcf4bbd2df6
MD5 0c78aa24ef1dc63fc60ba8cd06fc676d
SHA1 e4746454b12046cae9de19cd2638fc53308eaf73
SHA512 b815eecb45c02452909a6bd4b70223f1dc3779786648444a7fef4713454c7ff4a130816a1dbf2a33298154f0885c12f6678d6cef22505f7592a4051a9fc8c1e1
TLSH
T18A61DF2487CB88F62E521087FD2A1317508B390EBE0CF99872B4C545F413719AADBEDA
MD5 SHA1 SHA512 TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/1064-2274-0x000002C5E7D10000-0x000002C5E7D3F000-memory.dmp

Download

memory/1064-130-0x00007FF956B00000-0x00007FF956B01000-memory.dmp

Download

memory/1064-129-0x00007FF9564D0000-0x00007FF9564D1000-memory.dmp

Download

memory/1820-2277-0x000001B4B4E90000-0x000001B4B4EBF000-memory.dmp

Download

memory/5900-260-0x00000276AA990000-0x00000276AA9BF000-memory.dmp

Download

memory/6780-2288-0x000001C84DF90000-0x000001C84DFBF000-memory.dmp

Download