86ad0bc1f58be0815f17fc69f3327752f34a2541ab9da857a323178ed3263d6b

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/08/2026, 14:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_5012899ec400ed01aea2c8fe2cfd4b1e_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Size 6.7MB
Sample260816-rwkftazeqa
SHA256 86ad0bc1f58be0815f17fc69f3327752f34a2541ab9da857a323178ed3263d6b
MD5 5012899ec400ed01aea2c8fe2cfd4b1e
SHA1 94d6e776e2eba1d25c3cb9386742d2716faa2a0f
SHA512 3ceba1558d96e6389acdc9781f56c305ef9e5c56d6f0c5cef9b49b04239e94a25139389988b0167322a4d36844a4e8eebed670103ccbd57b7f439a0dc749c4ea
SSDEEP 49152:/boLAzmH+c7RRwlB5XUez70SDjLi/pp1PIuXi4hp8Y8kbE1lDs7S46QpjaOvBYZQ:/bcxMcQLihDVrpGAQFr+QET
TLSH
T19F666B43E8A655E9C0AEE63085729253BA717C485F3123D72B90F7382F77BD06AB9740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	2026-08-16_5012899ec400ed01aea2c8fe2cfd4b1e_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	cowork-svc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_A53644FA0CAAA458C7A0416292C7CC5B	cowork-svc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_A53644FA0CAAA458C7A0416292C7CC5B	cowork-svc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB	cowork-svc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB	cowork-svc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	cowork-svc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	Claude.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	cowork-svc.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{54C3E990-4A75-44DA-A80B-CC2A44E69B45}	Claude.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\claude	Claude.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\claude\URL Protocol	Claude.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\claude\shell\open\command	Claude.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\claude\shell	Claude.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\claude\ = "URL:claude"	Claude.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\claude\shell\open	Claude.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\claude\shell\open\command\ = "\"C:\\Program Files\\WindowsApps\\Claude_1.30096.5.0_x64__pzs8sxrjxfjjc\\app\\Claude.exe\" \"%1\""	Claude.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
2900	reg.exe
3692	reg.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2500	2026-08-16_5012899ec400ed01aea2c8fe2cfd4b1e_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
2500	2026-08-16_5012899ec400ed01aea2c8fe2cfd4b1e_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
3012	cowork-svc.exe
3012	cowork-svc.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1828	Claude.exe
Token: SeCreatePagefilePrivilege	1828	Claude.exe
Token: SeShutdownPrivilege	1828	Claude.exe
Token: SeCreatePagefilePrivilege	1828	Claude.exe
Token: SeShutdownPrivilege	1828	Claude.exe
Token: SeCreatePagefilePrivilege	1828	Claude.exe
Token: SeShutdownPrivilege	1828	Claude.exe
Token: SeCreatePagefilePrivilege	1828	Claude.exe
Token: SeShutdownPrivilege	1828	Claude.exe
Token: SeCreatePagefilePrivilege	1828	Claude.exe
Token: SeShutdownPrivilege	1828	Claude.exe
Token: SeCreatePagefilePrivilege	1828	Claude.exe
Token: SeShutdownPrivilege	1828	Claude.exe
Token: SeCreatePagefilePrivilege	1828	Claude.exe
Token: SeShutdownPrivilege	1828	Claude.exe
Token: SeCreatePagefilePrivilege	1828	Claude.exe
Token: SeShutdownPrivilege	1828	Claude.exe
Token: SeCreatePagefilePrivilege	1828	Claude.exe
Token: SeShutdownPrivilege	1828	Claude.exe
Token: SeCreatePagefilePrivilege	1828	Claude.exe
Token: SeShutdownPrivilege	1828	Claude.exe
Token: SeCreatePagefilePrivilege	1828	Claude.exe
Token: SeShutdownPrivilege	1828	Claude.exe
Token: SeCreatePagefilePrivilege	1828	Claude.exe
Token: SeShutdownPrivilege	1828	Claude.exe
Token: SeCreatePagefilePrivilege	1828	Claude.exe
Token: SeShutdownPrivilege	1828	Claude.exe
Token: SeCreatePagefilePrivilege	1828	Claude.exe
Token: SeShutdownPrivilege	1828	Claude.exe
Token: SeCreatePagefilePrivilege	1828	Claude.exe
Token: SeShutdownPrivilege	1828	Claude.exe
Token: SeCreatePagefilePrivilege	1828	Claude.exe
Token: SeShutdownPrivilege	1828	Claude.exe
Token: SeCreatePagefilePrivilege	1828	Claude.exe
Token: SeShutdownPrivilege	1828	Claude.exe
Token: SeCreatePagefilePrivilege	1828	Claude.exe
Token: SeShutdownPrivilege	1828	Claude.exe
Token: SeCreatePagefilePrivilege	1828	Claude.exe
Token: SeShutdownPrivilege	1828	Claude.exe
Token: SeCreatePagefilePrivilege	1828	Claude.exe
Token: SeShutdownPrivilege	1828	Claude.exe
Token: SeCreatePagefilePrivilege	1828	Claude.exe
Token: SeShutdownPrivilege	1828	Claude.exe
Token: SeCreatePagefilePrivilege	1828	Claude.exe
Token: SeShutdownPrivilege	1828	Claude.exe
Token: SeCreatePagefilePrivilege	1828	Claude.exe
Token: SeShutdownPrivilege	1828	Claude.exe
Token: SeCreatePagefilePrivilege	1828	Claude.exe
Token: SeShutdownPrivilege	1828	Claude.exe
Token: SeCreatePagefilePrivilege	1828	Claude.exe
Token: SeShutdownPrivilege	1828	Claude.exe
Token: SeCreatePagefilePrivilege	1828	Claude.exe
Token: SeShutdownPrivilege	1828	Claude.exe
Token: SeCreatePagefilePrivilege	1828	Claude.exe
Token: SeShutdownPrivilege	1828	Claude.exe
Token: SeCreatePagefilePrivilege	1828	Claude.exe
Token: SeShutdownPrivilege	1828	Claude.exe
Token: SeCreatePagefilePrivilege	1828	Claude.exe
Token: SeShutdownPrivilege	1828	Claude.exe
Token: SeCreatePagefilePrivilege	1828	Claude.exe
Token: SeShutdownPrivilege	1828	Claude.exe
Token: SeCreatePagefilePrivilege	1828	Claude.exe
Token: SeShutdownPrivilege	1828	Claude.exe
Token: SeCreatePagefilePrivilege	1828	Claude.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1828	Claude.exe
1828	Claude.exe
1828	Claude.exe
1828	Claude.exe

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
1828	Claude.exe
1828	Claude.exe
1828	Claude.exe
1828	Claude.exe
1828	Claude.exe
1828	Claude.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4652 wrote to memory of 2500	4652	2026-08-16_5012899ec400ed01aea2c8fe2cfd4b1e_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	99
PID 2500 wrote to memory of 3760	2500	2026-08-16_5012899ec400ed01aea2c8fe2cfd4b1e_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	104
PID 1828 wrote to memory of 176	1828	Claude.exe	110
PID 1828 wrote to memory of 5092	1828	Claude.exe	111
PID 1828 wrote to memory of 1644	1828	Claude.exe	112
PID 1828 wrote to memory of 940	1828	Claude.exe	114
PID 1828 wrote to memory of 5088	1828	Claude.exe	115
PID 1828 wrote to memory of 3692	1828	Claude.exe	117
PID 1828 wrote to memory of 2900	1828	Claude.exe	118
PID 1828 wrote to memory of 1684	1828	Claude.exe	121
PID 1828 wrote to memory of 11152	1828	Claude.exe	122
PID 1828 wrote to memory of 5796	1828	Claude.exe	123
PID 1828 wrote to memory of 5804	1828	Claude.exe	124

C:\Users\Admin\AppData\Local\Temp\2026-08-16_5012899ec400ed01aea2c8fe2cfd4b1e_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_5012899ec400ed01aea2c8fe2cfd4b1e_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4652
- C:\Users\Admin\AppData\Local\Temp\2026-08-16_5012899ec400ed01aea2c8fe2cfd4b1e_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-16_5012899ec400ed01aea2c8fe2cfd4b1e_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe" --elevated --msix-path "C:\Users\Admin\AppData\Local\Temp\Claude-3251150698.msix" --log-path "C:\Users\Admin\AppData\Local\Temp\ClaudeSetup.log" --all-users
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2500
- - C:\Windows\explorer.exe
    explorer.exe shell:AppsFolder\Claude_pzs8sxrjxfjjc!Claude
    3⤵
    PID:3760

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness
1⤵
PID:1428

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
PID:856

C:\Program Files\WindowsApps\Claude_1.30096.5.0_x64__pzs8sxrjxfjjc\app\resources\cowork-svc.exe
"C:\Program Files\WindowsApps\Claude_1.30096.5.0_x64__pzs8sxrjxfjjc\app\resources\cowork-svc.exe"
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3012

C:\Program Files\WindowsApps\Claude_1.30096.5.0_x64__pzs8sxrjxfjjc\app\Claude.exe
"C:\Program Files\WindowsApps\Claude_1.30096.5.0_x64__pzs8sxrjxfjjc\app\Claude.exe"
1⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1828
- C:\Program Files\WindowsApps\Claude_1.30096.5.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.30096.5.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\Claude /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\Claude\Crashpad --url=https://f.a.k/e --annotation=_productName=Claude --annotation=_version=1.30096.5 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=42.7.0 --initial-client-data=0x4a8,0x4ac,0x4b0,0x4a4,0x4b4,0x7ff6ccced188,0x7ff6ccced198,0x7ff6ccced1a8
  2⤵
  PID:176
- C:\Program Files\WindowsApps\Claude_1.30096.5.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.30096.5.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2020,i,11935378904896821694,10620111355919541233,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2024,i,5821386968185889084,16730483154407191835,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2016 /prefetch:2
  2⤵
  PID:5092
- C:\Program Files\WindowsApps\Claude_1.30096.5.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.30096.5.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --field-trial-handle=2020,i,11935378904896821694,10620111355919541233,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2024,i,5821386968185889084,16730483154407191835,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  PID:1644
- C:\Program Files\WindowsApps\Claude_1.30096.5.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.30096.5.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --app-path="C:\Program Files\WindowsApps\Claude_1.30096.5.0_x64__pzs8sxrjxfjjc\app\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1786890239835050 --launch-time-ticks=637110942 --field-trial-handle=2020,i,11935378904896821694,10620111355919541233,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2024,i,5821386968185889084,16730483154407191835,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=3556 --desktop-managed-config="{\"forceLoginOrgUUIDs\":null,\"loginSsoOrgDomain\":null,\"disableEssentialTelemetry\":false,\"disableNonessentialTelemetry\":false,\"disableMobileSimulatorTools\":false,\"banner\":null,\"deploymentDisplayName\":null,\"deploymentDisplaySubtitle\":null,\"deploymentMode\":\"1p\",\"appVersion\":\"1.30096.5\",\"cookielessOrigin\":false,\"deviceClass\":\"16\"}" /prefetch:1
  2⤵
  PID:940
- C:\Program Files\WindowsApps\Claude_1.30096.5.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.30096.5.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --app-path="C:\Program Files\WindowsApps\Claude_1.30096.5.0_x64__pzs8sxrjxfjjc\app\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1786890239835050 --launch-time-ticks=637170597 --field-trial-handle=2020,i,11935378904896821694,10620111355919541233,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2024,i,5821386968185889084,16730483154407191835,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3944 --desktop-features="{\"launch\":{\"status\":\"supported\"},\"coworkBrowser\":{\"status\":\"unsupported\",\"reason\":\"cowork_browser_disabled\",\"unsupportedCode\":\"unknown\"},\"artifactsPane\":{\"status\":\"unavailable\"},\"nativeQuickEntry\":{\"status\":\"unavailable\"},\"quickEntryDictation\":{\"status\":\"unavailable\"},\"quickEntryGlobalShortcut\":{\"status\":\"supported\"},\"customQuickEntryDictationShortcut\":{\"status\":\"supported\"},\"ultrareviewErrorCategories\":{\"status\":\"supported\"},\"parkaMeetings\":{\"status\":\"unavailable\"},\"plushRaccoon\":{\"status\":\"unavailable\"},\"quietPenguin\":{\"status\":\"unavailable\"},\"chillingSlothFeat\":{\"status\":\"supported\"},\"chillingSlothSshShell\":{\"status\":\"supported\"},\"chillingSlothEnterprise\":{\"status\":\"supported\"},\"chillingSlothLocal\":{\"status\":\"supported\"},\"yukonSilver\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute\",\"unsupportedCode\":\"hcs_not_available\"},\"yukonSilverGems\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute\",\"unsupportedCode\":\"hcs_not_available\"},\"yukonSilverGemsCache\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute\",\"unsupportedCode\":\"hcs_not_available\"},\"wakeScheduler\":{\"status\":\"unavailable\"},\"desktopTopBar\":{\"status\":\"supported\"},\"ccdPlugins\":{\"status\":\"supported\"},\"computerUse\":{\"status\":\"supported\"},\"computerUseAppScoped\":{\"status\":\"unsupported\",\"reason\":\"Background app-scoped mode is macOS-only\",\"unsupportedCode\":\"unsupported_platform\"},\"coworkWatchRecord\":{\"status\":\"unsupported\",\"reason\":\"Watch-record is not available on this platform\",\"unsupportedCode\":\"unsupported_platform\"},\"coworkWatchers\":{\"status\":\"unavailable\"},\"coworkKappa\":{\"status\":\"unavailable\"},\"coworkArtifacts\":{\"status\":\"unavailable\"},\"coworkAutoModeAlwaysAllowOverride\":{\"status\":\"unavailable\"},\"framebufferPreview\":{\"status\":\"unavailable\"},\"iosSimulator\":{\"status\":\"unsupported\",\"reason\":\"iOS Simulator panel requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"androidEmulator\":{\"status\":\"unsupported\",\"reason\":\"Android emulator is disabled by its rollout flag\",\"unsupportedCode\":\"unknown\"},\"iosSimulatorH264\":{\"status\":\"unsupported\",\"reason\":\"iOS Simulator panel requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"grandPrix\":{\"status\":\"unavailable\"},\"ccdGitEngine\":{\"status\":\"unavailable\"},\"tearOffHalo\":{\"status\":\"unsupported\",\"reason\":\"Tear-off halo overlay requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"coworkArtifactPopout\":{\"status\":\"supported\"},\"sidePanePopoutNativeViews\":{\"status\":\"supported\"},\"filePreviewNativeViewRouting\":{\"status\":\"supported\"},\"claudeDesignWindow\":{\"status\":\"supported\"},\"coworkRemoteSessionSpaces\":{\"status\":\"supported\"},\"spaceMemoryBridge\":{\"status\":\"unavailable\"},\"grandPrixRequest\":{\"status\":\"unavailable\"},\"bootPlaceholder\":{\"status\":\"unsupported\",\"reason\":\"Boot placeholder not built in\",\"unsupportedCode\":\"unknown\"},\"coworkBranchSession\":{\"status\":\"supported\"},\"coworkScheduledTaskProjects\":{\"status\":\"supported\"},\"coworkLocalSessionProjects\":{\"status\":\"supported\"},\"sshAttachmentTransport\":{\"status\":\"supported\"},\"bootstrapConfig\":{\"status\":\"supported\"},\"chatIn3p\":{\"status\":\"supported\"},\"builtinMcpPresets\":{\"status\":\"supported\"},\"surfaceTogglesPreview\":{\"status\":\"unavailable\"},\"chatTab\":{\"status\":\"unavailable\"},\"chatCodeExecution\":{\"status\":\"unavailable\"},\"mcpPersistentAlwaysAllow\":{\"status\":\"supported\"},\"epitaxyMcpApps\":{\"status\":\"unavailable\"}}" --desktop-managed-config="{\"forceLoginOrgUUIDs\":null,\"loginSsoOrgDomain\":null,\"disableEssentialTelemetry\":false,\"disableNonessentialTelemetry\":false,\"disableMobileSimulatorTools\":false,\"banner\":null,\"deploymentDisplayName\":null,\"deploymentDisplaySubtitle\":null,\"deploymentMode\":\"1p\",\"appVersion\":\"1.30096.5\",\"cookielessOrigin\":false,\"deviceClass\":\"16\"}" /prefetch:1
  2⤵
  PID:5088
- C:\Windows\System32\reg.exe
  C:\Windows\System32\reg.exe query HKLM\SOFTWARE\Policies\ClaudeCode /v Settings
  2⤵
  - Modifies registry key
  PID:3692
- C:\Windows\System32\reg.exe
  C:\Windows\System32\reg.exe query HKCU\SOFTWARE\Policies\ClaudeCode /v Settings
  2⤵
  - Modifies registry key
  PID:2900
- C:\Program Files\WindowsApps\Claude_1.30096.5.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.30096.5.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --app-path="C:\Program Files\WindowsApps\Claude_1.30096.5.0_x64__pzs8sxrjxfjjc\app\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1786890239835050 --launch-time-ticks=637990243 --field-trial-handle=2020,i,11935378904896821694,10620111355919541233,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2024,i,5821386968185889084,16730483154407191835,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3908 --desktop-features="{\"launch\":{\"status\":\"supported\"},\"coworkBrowser\":{\"status\":\"unsupported\",\"reason\":\"cowork_browser_disabled\",\"unsupportedCode\":\"unknown\"},\"artifactsPane\":{\"status\":\"unavailable\"},\"nativeQuickEntry\":{\"status\":\"unavailable\"},\"quickEntryDictation\":{\"status\":\"unavailable\"},\"quickEntryGlobalShortcut\":{\"status\":\"supported\"},\"customQuickEntryDictationShortcut\":{\"status\":\"supported\"},\"ultrareviewErrorCategories\":{\"status\":\"supported\"},\"parkaMeetings\":{\"status\":\"unavailable\"},\"plushRaccoon\":{\"status\":\"unavailable\"},\"quietPenguin\":{\"status\":\"unavailable\"},\"chillingSlothFeat\":{\"status\":\"supported\"},\"chillingSlothSshShell\":{\"status\":\"supported\"},\"chillingSlothEnterprise\":{\"status\":\"supported\"},\"chillingSlothLocal\":{\"status\":\"supported\"},\"yukonSilver\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute\",\"unsupportedCode\":\"hcs_not_available\"},\"yukonSilverGems\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute\",\"unsupportedCode\":\"hcs_not_available\"},\"yukonSilverGemsCache\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute\",\"unsupportedCode\":\"hcs_not_available\"},\"wakeScheduler\":{\"status\":\"unavailable\"},\"desktopTopBar\":{\"status\":\"supported\"},\"ccdPlugins\":{\"status\":\"supported\"},\"computerUse\":{\"status\":\"supported\"},\"computerUseAppScoped\":{\"status\":\"unsupported\",\"reason\":\"Background app-scoped mode is macOS-only\",\"unsupportedCode\":\"unsupported_platform\"},\"coworkWatchRecord\":{\"status\":\"unsupported\",\"reason\":\"Watch-record is not available on this platform\",\"unsupportedCode\":\"unsupported_platform\"},\"coworkWatchers\":{\"status\":\"unavailable\"},\"coworkKappa\":{\"status\":\"unavailable\"},\"coworkArtifacts\":{\"status\":\"unavailable\"},\"coworkAutoModeAlwaysAllowOverride\":{\"status\":\"unavailable\"},\"framebufferPreview\":{\"status\":\"unavailable\"},\"iosSimulator\":{\"status\":\"unsupported\",\"reason\":\"iOS Simulator panel requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"androidEmulator\":{\"status\":\"unsupported\",\"reason\":\"Android emulator is disabled by its rollout flag\",\"unsupportedCode\":\"unknown\"},\"iosSimulatorH264\":{\"status\":\"unsupported\",\"reason\":\"iOS Simulator panel requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"grandPrix\":{\"status\":\"unavailable\"},\"ccdGitEngine\":{\"status\":\"unavailable\"},\"tearOffHalo\":{\"status\":\"unsupported\",\"reason\":\"Tear-off halo overlay requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"coworkArtifactPopout\":{\"status\":\"supported\"},\"sidePanePopoutNativeViews\":{\"status\":\"supported\"},\"filePreviewNativeViewRouting\":{\"status\":\"supported\"},\"claudeDesignWindow\":{\"status\":\"supported\"},\"coworkRemoteSessionSpaces\":{\"status\":\"supported\"},\"spaceMemoryBridge\":{\"status\":\"unavailable\"},\"grandPrixRequest\":{\"status\":\"unavailable\"},\"bootPlaceholder\":{\"status\":\"unsupported\",\"reason\":\"Boot placeholder not built in\",\"unsupportedCode\":\"unknown\"},\"coworkBranchSession\":{\"status\":\"supported\"},\"coworkScheduledTaskProjects\":{\"status\":\"supported\"},\"coworkLocalSessionProjects\":{\"status\":\"supported\"},\"sshAttachmentTransport\":{\"status\":\"supported\"},\"bootstrapConfig\":{\"status\":\"supported\"},\"chatIn3p\":{\"status\":\"supported\"},\"builtinMcpPresets\":{\"status\":\"supported\"},\"surfaceTogglesPreview\":{\"status\":\"unavailable\"},\"chatTab\":{\"status\":\"unavailable\"},\"chatCodeExecution\":{\"status\":\"unavailable\"},\"mcpPersistentAlwaysAllow\":{\"status\":\"supported\"},\"epitaxyMcpApps\":{\"status\":\"unavailable\"}}" --desktop-managed-config="{\"forceLoginOrgUUIDs\":null,\"loginSsoOrgDomain\":null,\"disableEssentialTelemetry\":false,\"disableNonessentialTelemetry\":false,\"disableMobileSimulatorTools\":false,\"banner\":null,\"deploymentDisplayName\":null,\"deploymentDisplaySubtitle\":null,\"deploymentMode\":\"1p\",\"appVersion\":\"1.30096.5\",\"cookielessOrigin\":false,\"deviceClass\":\"16\"}" /prefetch:1
  2⤵
  PID:1684
- C:\Program Files\WindowsApps\Claude_1.30096.5.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.30096.5.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --app-path="C:\Program Files\WindowsApps\Claude_1.30096.5.0_x64__pzs8sxrjxfjjc\app\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --time-ticks-at-unix-epoch=-1786890239835050 --launch-time-ticks=642493204 --field-trial-handle=2020,i,11935378904896821694,10620111355919541233,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2024,i,5821386968185889084,16730483154407191835,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=4584 --desktop-features="{\"launch\":{\"status\":\"supported\"},\"coworkBrowser\":{\"status\":\"unsupported\",\"reason\":\"cowork_browser_disabled\",\"unsupportedCode\":\"unknown\"},\"artifactsPane\":{\"status\":\"unavailable\"},\"nativeQuickEntry\":{\"status\":\"unavailable\"},\"quickEntryDictation\":{\"status\":\"unavailable\"},\"quickEntryGlobalShortcut\":{\"status\":\"supported\"},\"customQuickEntryDictationShortcut\":{\"status\":\"supported\"},\"ultrareviewErrorCategories\":{\"status\":\"supported\"},\"parkaMeetings\":{\"status\":\"unavailable\"},\"plushRaccoon\":{\"status\":\"unavailable\"},\"quietPenguin\":{\"status\":\"unavailable\"},\"chillingSlothFeat\":{\"status\":\"supported\"},\"chillingSlothSshShell\":{\"status\":\"supported\"},\"chillingSlothEnterprise\":{\"status\":\"supported\"},\"chillingSlothLocal\":{\"status\":\"supported\"},\"yukonSilver\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute\",\"unsupportedCode\":\"hcs_not_available\"},\"yukonSilverGems\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute\",\"unsupportedCode\":\"hcs_not_available\"},\"yukonSilverGemsCache\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute\",\"unsupportedCode\":\"hcs_not_available\"},\"wakeScheduler\":{\"status\":\"unavailable\"},\"desktopTopBar\":{\"status\":\"supported\"},\"ccdPlugins\":{\"status\":\"supported\"},\"computerUse\":{\"status\":\"supported\"},\"computerUseAppScoped\":{\"status\":\"unsupported\",\"reason\":\"Background app-scoped mode is macOS-only\",\"unsupportedCode\":\"unsupported_platform\"},\"coworkWatchRecord\":{\"status\":\"unsupported\",\"reason\":\"Watch-record is not available on this platform\",\"unsupportedCode\":\"unsupported_platform\"},\"coworkWatchers\":{\"status\":\"unavailable\"},\"coworkKappa\":{\"status\":\"unavailable\"},\"coworkArtifacts\":{\"status\":\"unavailable\"},\"coworkAutoModeAlwaysAllowOverride\":{\"status\":\"unavailable\"},\"framebufferPreview\":{\"status\":\"unavailable\"},\"iosSimulator\":{\"status\":\"unsupported\",\"reason\":\"iOS Simulator panel requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"androidEmulator\":{\"status\":\"unsupported\",\"reason\":\"Android emulator is disabled by its rollout flag\",\"unsupportedCode\":\"unknown\"},\"iosSimulatorH264\":{\"status\":\"unsupported\",\"reason\":\"iOS Simulator panel requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"grandPrix\":{\"status\":\"unavailable\"},\"ccdGitEngine\":{\"status\":\"unavailable\"},\"tearOffHalo\":{\"status\":\"unsupported\",\"reason\":\"Tear-off halo overlay requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"coworkArtifactPopout\":{\"status\":\"supported\"},\"sidePanePopoutNativeViews\":{\"status\":\"supported\"},\"filePreviewNativeViewRouting\":{\"status\":\"supported\"},\"claudeDesignWindow\":{\"status\":\"supported\"},\"coworkRemoteSessionSpaces\":{\"status\":\"supported\"},\"spaceMemoryBridge\":{\"status\":\"unavailable\"},\"grandPrixRequest\":{\"status\":\"unavailable\"},\"bootPlaceholder\":{\"status\":\"unsupported\",\"reason\":\"Boot placeholder not built in\",\"unsupportedCode\":\"unknown\"},\"coworkBranchSession\":{\"status\":\"supported\"},\"coworkScheduledTaskProjects\":{\"status\":\"supported\"},\"coworkLocalSessionProjects\":{\"status\":\"supported\"},\"sshAttachmentTransport\":{\"status\":\"supported\"},\"bootstrapConfig\":{\"status\":\"supported\"},\"chatIn3p\":{\"status\":\"supported\"},\"builtinMcpPresets\":{\"status\":\"supported\"},\"surfaceTogglesPreview\":{\"status\":\"unavailable\"},\"chatTab\":{\"status\":\"unavailable\"},\"chatCodeExecution\":{\"status\":\"unavailable\"},\"mcpPersistentAlwaysAllow\":{\"status\":\"supported\"},\"epitaxyMcpApps\":{\"status\":\"unavailable\"}}" --desktop-managed-config="{\"forceLoginOrgUUIDs\":null,\"loginSsoOrgDomain\":null,\"disableEssentialTelemetry\":false,\"disableNonessentialTelemetry\":false,\"disableMobileSimulatorTools\":false,\"banner\":null,\"deploymentDisplayName\":null,\"deploymentDisplaySubtitle\":null,\"deploymentMode\":\"1p\",\"appVersion\":\"1.30096.5\",\"cookielessOrigin\":false,\"deviceClass\":\"16\"}" /prefetch:1
  2⤵
  PID:11152
- C:\Program Files\WindowsApps\Claude_1.30096.5.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.30096.5.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --field-trial-handle=2020,i,11935378904896821694,10620111355919541233,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2024,i,5821386968185889084,16730483154407191835,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5024 /prefetch:8
  2⤵
  - Modifies registry class
  PID:5796
- C:\Program Files\WindowsApps\Claude_1.30096.5.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.30096.5.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --field-trial-handle=2020,i,11935378904896821694,10620111355919541233,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2024,i,5821386968185889084,16730483154407191835,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=4960 /prefetch:8
  2⤵
  PID:5804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

the-real-index

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 eed5808c1baf5a3986910123fac9e922e7e15089c4cc7fc2d7700a6179c2de2c
MD5 f89fd602d4c8a723cc2955216943e40e
SHA1 3e3f33492405e7bf71688363eae613c3179d81dc
SHA512 07061f0d8089f7a5e2a6e0692f616d80a48719613b1f9c0c392fb4215170e5299e6764cc717a263b1581e5d513073617281ad3e60f4db98393dbccc98df7d520
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 adc8d4075c84179828b61e4b5a31f6bc142b7af9f5ead0ce0d67f57c7e99a6a4
MD5 af6a519ac6e16b9d42e8ffe25ed530af
SHA1 6fe9b11d85ebef821343163fa02601a12cfbba4b
SHA512 65e62a8c2eccdfe768d6a738567784bfedb2d6a28a930e7e9b1cd5ad598d71a21b74ba8de9e7250d96a90176d9ff663ef25425fc05e6ece0d6fa29148d0d6e88
TLSH
T12151A1205E77A860E3506A7666D2C549F536E841C6931FA6BBFE9F30CC5C3D0D971038
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Partitions\cowork-file-preview\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Partitions\cowork-file-preview\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

86052a9a-0c9a-4f9c-867d-49282b0e28f0.tmp

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Partitions\launch-preview-static\Network\86052a9a-0c9a-4f9c-867d-49282b0e28f0.tmp
Size 84B
SHA256 712196693e3527ac1131831f1a2108b6c0e5c68967b26d51a452611cdfb86e0c
MD5 32b9dc9cc81d0682e78627c873fdd651
SHA1 46c486386d3e153c3e9b11d54cb52cf0064b71cf
SHA512 f18bc37f8b72411548da247aa1394cc5ac03c3bbd98e82eb8ba290ef239ef5b8625cf4835bd41ce7c52766d0bc3bfe9150dd22dbf62f0f05992ddde5fbfdc811
TLSH
T154A0121490405CFB0308835504146463C3F50002421848A91634318D019209D0004403
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Partitions\launch-preview-static\Session Storage\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Partitions\launch-preview-static\Session Storage\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

5da3f1f0-d828-44f7-a097-dbf486cdc7bf.tmp

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\WebStorage\2\CacheStorage\69163f99-66bd-432c-9b40-1cc3b29ddba2\index-dir\5da3f1f0-d828-44f7-a097-dbf486cdc7bf.tmp
Size 48B
SHA256 bae54bab5afacb3b5a6809c93091b09af56bd04af9a5129908e548cb54b5b781
MD5 4c27e52593e84e7adcb71c8c89bc8341
SHA1 356d71285ec94ba84a87a2d5cf25f0ac566a66c5
SHA512 67870619bceb6dbacc6838b60a2e1958351c52a448b3730af1ef93daf6c4389390b74ef48db4651a3d3c0e7b6dde98b810bba23fb7abe9e6f484085f2205385d
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\WebStorage\2\CacheStorage\69163f99-66bd-432c-9b40-1cc3b29ddba2\index-dir\the-real-index
Size 72B
SHA256 485441acfb1fdd1c30be4074e431a20547e63d9ad58b1cd6c08031a641e3ef5e
MD5 9cf9f7dc602c73f509f739008cf4c4da
SHA1 62f52f2a6f379ef39728c0a3ce0fe4f85c180518
SHA512 c7ac6ca673b3365032f1a05cb9d8ef03e0d8f2d7c18100f047d411d5f167a6c3e0076b1a07577fc1fc85e6bfecec30a5eca2bd073dd1fb0093620d2c05c5f973
TLSH
T1FFA0026463961056D050367A504A4BAA3320C8288E834703659403898CA46C55D91449
MD5 SHA1 SHA512 TLSH

Submit Download

6b300bcd-58d2-43ba-a3f5-fab6eaeefcae.tmp

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\WebStorage\2\CacheStorage\6b300bcd-58d2-43ba-a3f5-fab6eaeefcae.tmp
Size 176B
SHA256 9516eb90d0964fe8e568c5f2b553e2af55fc5f6f9dd345aceb40a20c45b87250
MD5 be2bf6513c14e20a6590892980e41b0c
SHA1 f346f9e443020bbb36bfe156fe70340445ddd414
SHA512 fc5a9fc1c3a5e8ed346f0e6e3a9f6e71ca722129ce6c84ce30db28497f5839c44ed6b9120e2f16d828c23f35fda77a5f3b5faea18daa2a95d881ef2e095ccf25
TLSH
T117C08CBF00C596922FA964EB221732CEC936BFD81CC0AB8C957230A47230CAA5634924
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\WebStorage\2\CacheStorage\index.txt
Size 89B
SHA256 92cda5a28f4c1874bcf0aca7ca908e1234751120abf372f5a81cbb33590c3590
MD5 8684fe11e05213691ad78cf380e7c451
SHA1 1c075025a185041ddeb120c2c8e8cc2fe175d82b
SHA512 fd3ede8f008a3407360d649eb6c2c07c14454f2c17e823af53217c15baeb965494074dfff8b87acf24474839cdf9aab03c71be349e434dc6ba89e32b2a57bc55
TLSH
T1B2B002FF014156D15EA135E7100731DEC56376D85CC0EA4CD572105473104AD5401C24
MD5 SHA1 SHA512 TLSH

Submit Download

claude_desktop_config.json.tmp

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\claude_desktop_config.json.tmp
Size 228B
SHA256 18312d5a9f7efa02339bd6b13729eb5b0131e0c7e6515d30898c4e55b8deffc6
MD5 f24bfaf8788c35ed91df9a8db974c2e1
SHA1 1bfb681606f5dac8b575ffc7954efffa20478a62
SHA512 0635aef0aaa7cb26fba59081bc7ecf09a498ab772052101fdaba9ffea28f7558e7d840a8e991ea797736ba8f22abd1ed999bfe283c5b74927f0156aa957d82a8
TLSH
T1B4D0A720DC350EE715F2921C4D2D84235711798219287428A85F095D0FCCA3C7835492
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\config.json
Size 42B
SHA256 95ce361979ef56929c4b20f9a04756fa4e170e478e75aa3f31f07815b05ad28c
MD5 e05e441cdaeae8bbe08176dc0b5b7c49
SHA1 dc8b88d98ad2065da8f5126dd5ec3f6981aa0664
SHA512 17e62fe837a41aaa7a2608fe7caca0b3d59861cf1a812fbe9c1ac2012216df39aab2ce47457fbf58a2413373c1dfbdb072a435d648dddb2365ff972cdfb6e4b4
MD5 SHA1 SHA512

Submit Download

config.json.tmp-6890879410f1930c

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\config.json.tmp-6890879410f1930c
Size 77B
SHA256 0f8f0d8b6dd1e967305e0097819a5cb440346ed150f3fb29f21e69b128bfb896
MD5 d1004cbbf33ac21a94754ff8bafff263
SHA1 32b6832f03679392ffcb5c31f81cdf18e7c48a79
SHA512 4f4552ea57e7f98b172018a580fd938b8cbb3298e3778c6b4cc56c2e14fb9051a73bd1f19f7e797c1fb83ebe1776a7d07871f99edb32a6fe41cd851f0a1967c4
TLSH
T183A022EEAA20082ACA0F03BC2C8C00CB8AC8030C020B000C030CE33ECE20B2E200A308
MD5 SHA1 SHA512 TLSH

Submit Download

config.json.tmp-689087979176e045

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\config.json.tmp-689087979176e045
Size 62B
SHA256 e77e1e3184ad9ba8303979c19dcb05c25c3723d2d12814b059fa9f563b3e7eb4
MD5 3f01fb1793f639088275c8bc9b49273d
SHA1 2a77d3b225587d9cd89829bed076ca0dc67446cf
SHA512 b0a2d3a92c92aabb31ad59f056c99976e617e839ed64be950e72600b38a57801c660d760b1ea9388c6fa3fdc3a5b41fb42e382b724535dd83bc8b2aecd593d2c
TLSH
T155A0026AC0255413911582AD140411CA85D9065C6A0B19064795725AD946B7C554A355
MD5 SHA1 SHA512 TLSH

Submit Download

config.json.tmp-6890879900cf465d

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\config.json.tmp-6890879900cf465d
Size 70B
SHA256 a1af8a127d916d5eb88418802de0337efd15c6e8a1feae43f870921e2c25f6cc
MD5 d2f9154c442f8aa68501f21ebc1288a0
SHA1 23752df2ec954c21d374532e752f541183852896
SHA512 12fe78a01b247df6ba1ebc624f83f89a8f12a5e088d330625073b8a2eeedd49df2ad8ca2452892b1856fc36bdee624352902ff5e438f8e236d9481e3666f63d3
TLSH
T1C7A022BAC0280803C000823C200C00CE80FC2B0C8803000F0BA8220ECA00EB8B230F20
MD5 SHA1 SHA512 TLSH

Submit Download

config.json.tmp-689088001710798d

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\config.json.tmp-689088001710798d
Size 75B
SHA256 b25ff6a19de3df18d3d70597965ec5d9e94be631fc3c689a32ba5a12ae1b009c
MD5 5776793354453fe1b4d95f241e62480a
SHA1 84886ea7ac24608ddcdcc142d50aff24868e2034
SHA512 58dbadd24f707155419bcacd9b8dfb60a281a92f02ac43657f6e7ff7fe98574e376f77a59ca8ea67e647c78d0ec080139062344c3406c5aabbffafdf707e353a
TLSH
T128A022ABC020003282320BAC0B0833CB8CC8020C008B08008B0ABBAEF80023E8C023E0
MD5 SHA1 SHA512 TLSH

Submit Download

config.json.tmp-6890880967fcaa5d

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\config.json.tmp-6890880967fcaa5d
Size 95B
SHA256 5562b69e679504aed40bb0ef04f03eb7407c10a394dd969893f81c5d211503a4
MD5 cf53f3194a6a516790c43e26994c35f1
SHA1 017e6d27af586ad397cfaf2b62047f07e3deea3b
SHA512 fa0b4a232fe91ebf71aab426634d3c145e3e2013c71527282d5cac5f58c722b2bf4a6ace4de1eaceb9f59039f3cb9ad7e1ebf049870815a392476fe057fd3e5c
TLSH
T10AB01267C0200037412146DC0E0C21C745C4010C154F1C018346B659E40563D4806391
MD5 SHA1 SHA512 TLSH

Submit Download

scope_v3.json

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\sentry\scope_v3.json
Size 6KB
SHA256 0dc6da4fe7505062f3d0ec8981113b2a2ac5aea3dbc59c58f2a9362c50e3dbb2
MD5 40ad01f18fcb46d392371bb6aa6c1dae
SHA1 61011be4e942a27482b42b7f602ea27642b5fb95
SHA512 4025a8db20472bfbd35ca1f98f6c0630775be599dc4a8585dc03e491db330bca61ed89b988ca85e752a72e454a87364adaf620f7fd89be2e4a79502a8ae78064
SSDEEP 192:3mL62qqQQRNsfrqHeIF0gSEFIdeaCSERXakd:HrqHlSBCSLkd
TLSH
T18CE196D13E2C5DBD0F99A38E34823D4EC7A8638285C52C434E94CE5CDEEE597640D12E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

APPX.2owpdgyviopnc8_8i45as060c.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX.2owpdgyviopnc8_8i45as060c.tmp
Size 1.0MB
SHA256 5d2ce216a5fc05ea71c40e0b88541894f226b821b5e756b1a3f31018f6c91235
MD5 b0c462b32f860729ecd1b4da01a28008
SHA1 02c5601734959e6e28dc6bb63ec4ec649f52881f
SHA512 eebb811af6d39dd47fdcc7acfedf0e86b457ff1f16db69ff2b9786576a0050d5037603d4e0cb1801d1fc87af0c2f5168fb7fd0ef079983d29888bd9b73363b9c
SSDEEP 12288:hxiIsNuRF95PEj+ZLVcbzd+KRo8FihxpUfLcrIxHe71mT+9RG4:eIsNEZPE20+KyYilUfgWe7D/b
TLSH
T10C35C6E1552DBE36816D0AAD8F24F5042C35883653376E0E9C6EA2B31CBF9721F674E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

APPX.trs2ggaqk5x9lp__1pql40djf.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX.trs2ggaqk5x9lp__1pql40djf.tmp
Size 10KB
SHA256 25c8d4abf5d021d0e4f1caf86c5d4133238cfa5e081bbc2fc73019a596e79305
MD5 825c18d0933fd91ace46af2d0a1bf073
SHA1 b56d116b0a23a58b5d5edf22a15fee6bb71dd009
SHA512 e321a1d63e6d761e010b439de4d6420e4ae7f81efd8fbde712e5b18c874e54fa7d9e291eca8e9ab78be252f68be4e199c97c7f9ba658a06922aeae8c24a3c959
SSDEEP 192:DNyEIYiYF80dmL4pUQaULc8pq8RuX5hz28uNNTPKTi4pGpLdgLX:DNyEIYi2mL4/y8RKE7Vzddw
TLSH
T199224BA788846C45EE17AC10B4C4A53AEDB2B68569C0C1D77159C266C7943823FDD2ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

APPX.x_w6lvf5ezhur89v70eio0gbg.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX.x_w6lvf5ezhur89v70eio0gbg.tmp
Size 7KB
SHA256 e1a3ba261889cc4556a47039fdfaab2717d21f72ecc694ce7ce4896063fc5edc
MD5 72ae5029402693f18fd259cc3367014f
SHA1 6b0b79ff5a96612e65d14b7829960e63beea04e9
SHA512 c9d6eb93cb286c4e5c735297d1ffc5307c50d3d4db1ff9b0c1d38eca741b81633dd6ec74ad7687622445bdb8c77a1182d9912bda202ffdd57afbc4ea612a6a65
SSDEEP 192:rJG1F4Ra8brotDMq6LYYcwmbTYp+bkk6W+Gkk63:rJG1F4Ra8brotDMTLY/wJ+bkk6W+Gkku
TLSH
T129F1024BD4AD18504672E1AAAF13D685EB2C09575CDE00C0BCDD56432FB265F033BB9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ClaudeSetup.log

Path C:\Users\Admin\AppData\Local\Temp\ClaudeSetup.log
Size 4KB
SHA256 b498524a387c39ecff2481ba35b57e4889a2b45b5b928547bcc8ba01684d219f
MD5 6352c0e48105c657909912944f9a62f0
SHA1 4c98c57623678bdf70747d2bd6ef075ded83d70f
SHA512 3baec10c196ca6df18a0c24fb6910605c99454728e58897f8af5a615b0fccc9814d71960a1e961a5689026175156009df2b3759b42f5c11ad4e998ec73da9709
SSDEEP 96:POo9YTsdtmRbbwfsP8Y0HIFtxgIZHOOxWHOLFcSV6MINeG9wpex9dwo9e:ATsnqt0Uxg2HOOxWH6P
TLSH
T1E391CA9440C6CCF85FE600C7A52F131A911BAB2EAB2DE01473D04858BC26725AAEF7D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/940-2188-0x00000203A9540000-0x00000203A9895000-memory.dmp

Download

memory/940-155-0x00007FF98E9F0000-0x00007FF98E9F1000-memory.dmp

Download

memory/940-156-0x00007FF98EF20000-0x00007FF98EF21000-memory.dmp

Download

memory/1684-2201-0x00000244A5340000-0x00000244A5695000-memory.dmp

Download

memory/2500-37-0x000001DDE1FF0000-0x000001DDE2013000-memory.dmp

Download

memory/2500-16-0x000001DDE1FF0000-0x000001DDE2013000-memory.dmp

Download

memory/5088-241-0x0000022E0F540000-0x0000022E0F895000-memory.dmp

Download

memory/5796-2203-0x0000023B6DC50000-0x0000023B6E0E1000-memory.dmp

Download

memory/11152-2202-0x00000231E8F40000-0x00000231E9295000-memory.dmp

Download