86ad0bc1f58be0815f17fc69f3327752f34a2541ab9da857a323178ed3263d6b

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 14:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_5012899ec400ed01aea2c8fe2cfd4b1e_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Size 6.7MB
Sample260816-rwkftazeqa
SHA256 86ad0bc1f58be0815f17fc69f3327752f34a2541ab9da857a323178ed3263d6b
MD5 5012899ec400ed01aea2c8fe2cfd4b1e
SHA1 94d6e776e2eba1d25c3cb9386742d2716faa2a0f
SHA512 3ceba1558d96e6389acdc9781f56c305ef9e5c56d6f0c5cef9b49b04239e94a25139389988b0167322a4d36844a4e8eebed670103ccbd57b7f439a0dc749c4ea
SSDEEP 49152:/boLAzmH+c7RRwlB5XUez70SDjLi/pp1PIuXi4hp8Y8kbE1lDs7S46QpjaOvBYZQ:/bcxMcQLihDVrpGAQFr+QET
TLSH
T19F666B43E8A655E9C0AEE63085729253BA717C485F3123D72B90F7382F77BD06AB9740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	cowork-svc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_A53644FA0CAAA458C7A0416292C7CC5B	cowork-svc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_A53644FA0CAAA458C7A0416292C7CC5B	cowork-svc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB	cowork-svc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB	cowork-svc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	cowork-svc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	Claude.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	cowork-svc.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\claude	Claude.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\claude\URL Protocol	Claude.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\claude\ = "URL:claude"	Claude.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\claude\shell	Claude.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\claude\shell\open\command	Claude.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\claude\shell\open	Claude.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\claude\shell\open\command\ = "\"C:\\Program Files\\WindowsApps\\Claude_1.30096.5.0_x64__pzs8sxrjxfjjc\\app\\Claude.exe\" \"%1\""	Claude.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{926BA435-1103-408E-A013-6B669385F220}	Claude.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
3372	reg.exe
6136	reg.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1704	2026-08-16_5012899ec400ed01aea2c8fe2cfd4b1e_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
1704	2026-08-16_5012899ec400ed01aea2c8fe2cfd4b1e_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
1944	cowork-svc.exe
1944	cowork-svc.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1132	Claude.exe
Token: SeCreatePagefilePrivilege	1132	Claude.exe
Token: SeShutdownPrivilege	1132	Claude.exe
Token: SeCreatePagefilePrivilege	1132	Claude.exe
Token: SeShutdownPrivilege	1132	Claude.exe
Token: SeCreatePagefilePrivilege	1132	Claude.exe
Token: SeShutdownPrivilege	1132	Claude.exe
Token: SeCreatePagefilePrivilege	1132	Claude.exe
Token: SeShutdownPrivilege	1132	Claude.exe
Token: SeCreatePagefilePrivilege	1132	Claude.exe
Token: SeShutdownPrivilege	1132	Claude.exe
Token: SeCreatePagefilePrivilege	1132	Claude.exe
Token: SeShutdownPrivilege	1132	Claude.exe
Token: SeCreatePagefilePrivilege	1132	Claude.exe
Token: SeShutdownPrivilege	1132	Claude.exe
Token: SeCreatePagefilePrivilege	1132	Claude.exe
Token: SeShutdownPrivilege	1132	Claude.exe
Token: SeCreatePagefilePrivilege	1132	Claude.exe
Token: SeShutdownPrivilege	1132	Claude.exe
Token: SeCreatePagefilePrivilege	1132	Claude.exe
Token: SeShutdownPrivilege	1132	Claude.exe
Token: SeCreatePagefilePrivilege	1132	Claude.exe
Token: SeShutdownPrivilege	1132	Claude.exe
Token: SeCreatePagefilePrivilege	1132	Claude.exe
Token: SeShutdownPrivilege	1132	Claude.exe
Token: SeCreatePagefilePrivilege	1132	Claude.exe
Token: SeShutdownPrivilege	1132	Claude.exe
Token: SeCreatePagefilePrivilege	1132	Claude.exe
Token: SeShutdownPrivilege	1132	Claude.exe
Token: SeCreatePagefilePrivilege	1132	Claude.exe
Token: SeShutdownPrivilege	1132	Claude.exe
Token: SeCreatePagefilePrivilege	1132	Claude.exe
Token: SeShutdownPrivilege	1132	Claude.exe
Token: SeCreatePagefilePrivilege	1132	Claude.exe
Token: SeShutdownPrivilege	1132	Claude.exe
Token: SeCreatePagefilePrivilege	1132	Claude.exe
Token: SeShutdownPrivilege	1132	Claude.exe
Token: SeCreatePagefilePrivilege	1132	Claude.exe
Token: SeShutdownPrivilege	1132	Claude.exe
Token: SeCreatePagefilePrivilege	1132	Claude.exe
Token: SeShutdownPrivilege	1132	Claude.exe
Token: SeCreatePagefilePrivilege	1132	Claude.exe
Token: SeShutdownPrivilege	1132	Claude.exe
Token: SeCreatePagefilePrivilege	1132	Claude.exe
Token: SeShutdownPrivilege	1132	Claude.exe
Token: SeCreatePagefilePrivilege	1132	Claude.exe
Token: SeShutdownPrivilege	1132	Claude.exe
Token: SeCreatePagefilePrivilege	1132	Claude.exe
Token: SeShutdownPrivilege	1132	Claude.exe
Token: SeCreatePagefilePrivilege	1132	Claude.exe
Token: SeShutdownPrivilege	1132	Claude.exe
Token: SeCreatePagefilePrivilege	1132	Claude.exe
Token: SeShutdownPrivilege	1132	Claude.exe
Token: SeCreatePagefilePrivilege	1132	Claude.exe
Token: SeShutdownPrivilege	1132	Claude.exe
Token: SeCreatePagefilePrivilege	1132	Claude.exe
Token: SeShutdownPrivilege	1132	Claude.exe
Token: SeCreatePagefilePrivilege	1132	Claude.exe
Token: SeShutdownPrivilege	1132	Claude.exe
Token: SeCreatePagefilePrivilege	1132	Claude.exe
Token: SeShutdownPrivilege	1132	Claude.exe
Token: SeCreatePagefilePrivilege	1132	Claude.exe
Token: SeShutdownPrivilege	1132	Claude.exe
Token: SeCreatePagefilePrivilege	1132	Claude.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1132	Claude.exe
1132	Claude.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1132	Claude.exe
1132	Claude.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4616	explorer.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 1704	2036	2026-08-16_5012899ec400ed01aea2c8fe2cfd4b1e_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	91
PID 1704 wrote to memory of 3192	1704	2026-08-16_5012899ec400ed01aea2c8fe2cfd4b1e_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	95
PID 1132 wrote to memory of 5016	1132	Claude.exe	99
PID 1132 wrote to memory of 2832	1132	Claude.exe	100
PID 1132 wrote to memory of 3900	1132	Claude.exe	101
PID 1132 wrote to memory of 2436	1132	Claude.exe	102
PID 1132 wrote to memory of 4512	1132	Claude.exe	103
PID 1132 wrote to memory of 6136	1132	Claude.exe	104
PID 1132 wrote to memory of 3372	1132	Claude.exe	105
PID 1132 wrote to memory of 1932	1132	Claude.exe	109
PID 1132 wrote to memory of 4484	1132	Claude.exe	110
PID 1132 wrote to memory of 928	1132	Claude.exe	112
PID 1132 wrote to memory of 4816	1132	Claude.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-08-16_5012899ec400ed01aea2c8fe2cfd4b1e_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_5012899ec400ed01aea2c8fe2cfd4b1e_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Users\Admin\AppData\Local\Temp\2026-08-16_5012899ec400ed01aea2c8fe2cfd4b1e_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-16_5012899ec400ed01aea2c8fe2cfd4b1e_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe" --elevated --msix-path "C:\Users\Admin\AppData\Local\Temp\Claude-1298991647.msix" --log-path "C:\Users\Admin\AppData\Local\Temp\ClaudeSetup.log" --all-users
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1704
- - C:\Windows\explorer.exe
    explorer.exe shell:AppsFolder\Claude_pzs8sxrjxfjjc!Claude
    3⤵
    PID:3192

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4932

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness
1⤵
PID:4432

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4616

C:\Program Files\WindowsApps\Claude_1.30096.5.0_x64__pzs8sxrjxfjjc\app\resources\cowork-svc.exe
"C:\Program Files\WindowsApps\Claude_1.30096.5.0_x64__pzs8sxrjxfjjc\app\resources\cowork-svc.exe"
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1944

C:\Program Files\WindowsApps\Claude_1.30096.5.0_x64__pzs8sxrjxfjjc\app\Claude.exe
"C:\Program Files\WindowsApps\Claude_1.30096.5.0_x64__pzs8sxrjxfjjc\app\Claude.exe"
1⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1132
- C:\Program Files\WindowsApps\Claude_1.30096.5.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.30096.5.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\Claude /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\Claude\Crashpad --url=https://f.a.k/e --annotation=_productName=Claude --annotation=_version=1.30096.5 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=42.7.0 --initial-client-data=0x4d8,0x4dc,0x4e0,0x4d4,0x4e4,0x7ff774e0d188,0x7ff774e0d198,0x7ff774e0d1a8
  2⤵
  PID:5016
- C:\Program Files\WindowsApps\Claude_1.30096.5.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.30096.5.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1968,i,13841999163142456329,11186194093595700463,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1972,i,10273143376545111574,10024561194968432222,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1964 /prefetch:2
  2⤵
  PID:2832
- C:\Program Files\WindowsApps\Claude_1.30096.5.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.30096.5.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --field-trial-handle=1968,i,13841999163142456329,11186194093595700463,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1972,i,10273143376545111574,10024561194968432222,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1280 /prefetch:11
  2⤵
  PID:3900
- C:\Program Files\WindowsApps\Claude_1.30096.5.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.30096.5.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --app-path="C:\Program Files\WindowsApps\Claude_1.30096.5.0_x64__pzs8sxrjxfjjc\app\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1968,i,13841999163142456329,11186194093595700463,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1972,i,10273143376545111574,10024561194968432222,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=3420 --desktop-managed-config="{\"forceLoginOrgUUIDs\":null,\"loginSsoOrgDomain\":null,\"disableEssentialTelemetry\":false,\"disableNonessentialTelemetry\":false,\"disableMobileSimulatorTools\":false,\"banner\":null,\"deploymentDisplayName\":null,\"deploymentDisplaySubtitle\":null,\"deploymentMode\":\"1p\",\"appVersion\":\"1.30096.5\",\"cookielessOrigin\":false,\"deviceClass\":\"16\"}" /prefetch:1
  2⤵
  PID:2436
- C:\Program Files\WindowsApps\Claude_1.30096.5.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.30096.5.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --app-path="C:\Program Files\WindowsApps\Claude_1.30096.5.0_x64__pzs8sxrjxfjjc\app\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1968,i,13841999163142456329,11186194093595700463,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1972,i,10273143376545111574,10024561194968432222,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=2924 --desktop-features="{\"launch\":{\"status\":\"supported\"},\"coworkBrowser\":{\"status\":\"unsupported\",\"reason\":\"cowork_browser_disabled\",\"unsupportedCode\":\"unknown\"},\"artifactsPane\":{\"status\":\"unavailable\"},\"nativeQuickEntry\":{\"status\":\"unavailable\"},\"quickEntryDictation\":{\"status\":\"unavailable\"},\"quickEntryGlobalShortcut\":{\"status\":\"supported\"},\"customQuickEntryDictationShortcut\":{\"status\":\"supported\"},\"ultrareviewErrorCategories\":{\"status\":\"supported\"},\"parkaMeetings\":{\"status\":\"unavailable\"},\"plushRaccoon\":{\"status\":\"unavailable\"},\"quietPenguin\":{\"status\":\"unavailable\"},\"chillingSlothFeat\":{\"status\":\"supported\"},\"chillingSlothSshShell\":{\"status\":\"supported\"},\"chillingSlothEnterprise\":{\"status\":\"supported\"},\"chillingSlothLocal\":{\"status\":\"supported\"},\"yukonSilver\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute, vfpext\",\"unsupportedCode\":\"hcs_not_available\"},\"yukonSilverGems\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute, vfpext\",\"unsupportedCode\":\"hcs_not_available\"},\"yukonSilverGemsCache\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute, vfpext\",\"unsupportedCode\":\"hcs_not_available\"},\"wakeScheduler\":{\"status\":\"unavailable\"},\"desktopTopBar\":{\"status\":\"supported\"},\"ccdPlugins\":{\"status\":\"supported\"},\"computerUse\":{\"status\":\"supported\"},\"computerUseAppScoped\":{\"status\":\"unsupported\",\"reason\":\"Background app-scoped mode is macOS-only\",\"unsupportedCode\":\"unsupported_platform\"},\"coworkWatchRecord\":{\"status\":\"unsupported\",\"reason\":\"Watch-record is not available on this platform\",\"unsupportedCode\":\"unsupported_platform\"},\"coworkWatchers\":{\"status\":\"unavailable\"},\"coworkKappa\":{\"status\":\"unavailable\"},\"coworkArtifacts\":{\"status\":\"unavailable\"},\"coworkAutoModeAlwaysAllowOverride\":{\"status\":\"unavailable\"},\"framebufferPreview\":{\"status\":\"unavailable\"},\"iosSimulator\":{\"status\":\"unsupported\",\"reason\":\"iOS Simulator panel requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"androidEmulator\":{\"status\":\"unsupported\",\"reason\":\"Android emulator is disabled by its rollout flag\",\"unsupportedCode\":\"unknown\"},\"iosSimulatorH264\":{\"status\":\"unsupported\",\"reason\":\"iOS Simulator panel requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"grandPrix\":{\"status\":\"unavailable\"},\"ccdGitEngine\":{\"status\":\"unavailable\"},\"tearOffHalo\":{\"status\":\"unsupported\",\"reason\":\"Tear-off halo overlay requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"coworkArtifactPopout\":{\"status\":\"supported\"},\"sidePanePopoutNativeViews\":{\"status\":\"supported\"},\"filePreviewNativeViewRouting\":{\"status\":\"supported\"},\"claudeDesignWindow\":{\"status\":\"supported\"},\"coworkRemoteSessionSpaces\":{\"status\":\"supported\"},\"spaceMemoryBridge\":{\"status\":\"unavailable\"},\"grandPrixRequest\":{\"status\":\"unavailable\"},\"bootPlaceholder\":{\"status\":\"unsupported\",\"reason\":\"Boot placeholder not built in\",\"unsupportedCode\":\"unknown\"},\"coworkBranchSession\":{\"status\":\"supported\"},\"coworkScheduledTaskProjects\":{\"status\":\"supported\"},\"coworkLocalSessionProjects\":{\"status\":\"supported\"},\"sshAttachmentTransport\":{\"status\":\"supported\"},\"bootstrapConfig\":{\"status\":\"supported\"},\"chatIn3p\":{\"status\":\"supported\"},\"builtinMcpPresets\":{\"status\":\"supported\"},\"surfaceTogglesPreview\":{\"status\":\"unavailable\"},\"chatTab\":{\"status\":\"unavailable\"},\"chatCodeExecution\":{\"status\":\"unavailable\"},\"mcpPersistentAlwaysAllow\":{\"status\":\"supported\"},\"epitaxyMcpApps\":{\"status\":\"unavailable\"}}" --desktop-managed-config="{\"forceLoginOrgUUIDs\":null,\"loginSsoOrgDomain\":null,\"disableEssentialTelemetry\":false,\"disableNonessentialTelemetry\":false,\"disableMobileSimulatorTools\":false,\"banner\":null,\"deploymentDisplayName\":null,\"deploymentDisplaySubtitle\":null,\"deploymentMode\":\"1p\",\"appVersion\":\"1.30096.5\",\"cookielessOrigin\":false,\"deviceClass\":\"16\"}" /prefetch:1
  2⤵
  PID:4512
- C:\Windows\System32\reg.exe
  C:\Windows\System32\reg.exe query HKLM\SOFTWARE\Policies\ClaudeCode /v Settings
  2⤵
  - Modifies registry key
  PID:6136
- C:\Windows\System32\reg.exe
  C:\Windows\System32\reg.exe query HKCU\SOFTWARE\Policies\ClaudeCode /v Settings
  2⤵
  - Modifies registry key
  PID:3372
- C:\Program Files\WindowsApps\Claude_1.30096.5.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.30096.5.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --app-path="C:\Program Files\WindowsApps\Claude_1.30096.5.0_x64__pzs8sxrjxfjjc\app\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1968,i,13841999163142456329,11186194093595700463,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1972,i,10273143376545111574,10024561194968432222,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=4176 --desktop-features="{\"launch\":{\"status\":\"supported\"},\"coworkBrowser\":{\"status\":\"unsupported\",\"reason\":\"cowork_browser_disabled\",\"unsupportedCode\":\"unknown\"},\"artifactsPane\":{\"status\":\"unavailable\"},\"nativeQuickEntry\":{\"status\":\"unavailable\"},\"quickEntryDictation\":{\"status\":\"unavailable\"},\"quickEntryGlobalShortcut\":{\"status\":\"supported\"},\"customQuickEntryDictationShortcut\":{\"status\":\"supported\"},\"ultrareviewErrorCategories\":{\"status\":\"supported\"},\"parkaMeetings\":{\"status\":\"unavailable\"},\"plushRaccoon\":{\"status\":\"unavailable\"},\"quietPenguin\":{\"status\":\"unavailable\"},\"chillingSlothFeat\":{\"status\":\"supported\"},\"chillingSlothSshShell\":{\"status\":\"supported\"},\"chillingSlothEnterprise\":{\"status\":\"supported\"},\"chillingSlothLocal\":{\"status\":\"supported\"},\"yukonSilver\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute, vfpext\",\"unsupportedCode\":\"hcs_not_available\"},\"yukonSilverGems\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute, vfpext\",\"unsupportedCode\":\"hcs_not_available\"},\"yukonSilverGemsCache\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute, vfpext\",\"unsupportedCode\":\"hcs_not_available\"},\"wakeScheduler\":{\"status\":\"unavailable\"},\"desktopTopBar\":{\"status\":\"supported\"},\"ccdPlugins\":{\"status\":\"supported\"},\"computerUse\":{\"status\":\"supported\"},\"computerUseAppScoped\":{\"status\":\"unsupported\",\"reason\":\"Background app-scoped mode is macOS-only\",\"unsupportedCode\":\"unsupported_platform\"},\"coworkWatchRecord\":{\"status\":\"unsupported\",\"reason\":\"Watch-record is not available on this platform\",\"unsupportedCode\":\"unsupported_platform\"},\"coworkWatchers\":{\"status\":\"unavailable\"},\"coworkKappa\":{\"status\":\"unavailable\"},\"coworkArtifacts\":{\"status\":\"unavailable\"},\"coworkAutoModeAlwaysAllowOverride\":{\"status\":\"unavailable\"},\"framebufferPreview\":{\"status\":\"unavailable\"},\"iosSimulator\":{\"status\":\"unsupported\",\"reason\":\"iOS Simulator panel requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"androidEmulator\":{\"status\":\"unsupported\",\"reason\":\"Android emulator is disabled by its rollout flag\",\"unsupportedCode\":\"unknown\"},\"iosSimulatorH264\":{\"status\":\"unsupported\",\"reason\":\"iOS Simulator panel requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"grandPrix\":{\"status\":\"unavailable\"},\"ccdGitEngine\":{\"status\":\"unavailable\"},\"tearOffHalo\":{\"status\":\"unsupported\",\"reason\":\"Tear-off halo overlay requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"coworkArtifactPopout\":{\"status\":\"supported\"},\"sidePanePopoutNativeViews\":{\"status\":\"supported\"},\"filePreviewNativeViewRouting\":{\"status\":\"supported\"},\"claudeDesignWindow\":{\"status\":\"supported\"},\"coworkRemoteSessionSpaces\":{\"status\":\"supported\"},\"spaceMemoryBridge\":{\"status\":\"unavailable\"},\"grandPrixRequest\":{\"status\":\"unavailable\"},\"bootPlaceholder\":{\"status\":\"unsupported\",\"reason\":\"Boot placeholder not built in\",\"unsupportedCode\":\"unknown\"},\"coworkBranchSession\":{\"status\":\"supported\"},\"coworkScheduledTaskProjects\":{\"status\":\"supported\"},\"coworkLocalSessionProjects\":{\"status\":\"supported\"},\"sshAttachmentTransport\":{\"status\":\"supported\"},\"bootstrapConfig\":{\"status\":\"supported\"},\"chatIn3p\":{\"status\":\"supported\"},\"builtinMcpPresets\":{\"status\":\"supported\"},\"surfaceTogglesPreview\":{\"status\":\"unavailable\"},\"chatTab\":{\"status\":\"unavailable\"},\"chatCodeExecution\":{\"status\":\"unavailable\"},\"mcpPersistentAlwaysAllow\":{\"status\":\"supported\"},\"epitaxyMcpApps\":{\"status\":\"unavailable\"}}" --desktop-managed-config="{\"forceLoginOrgUUIDs\":null,\"loginSsoOrgDomain\":null,\"disableEssentialTelemetry\":false,\"disableNonessentialTelemetry\":false,\"disableMobileSimulatorTools\":false,\"banner\":null,\"deploymentDisplayName\":null,\"deploymentDisplaySubtitle\":null,\"deploymentMode\":\"1p\",\"appVersion\":\"1.30096.5\",\"cookielessOrigin\":false,\"deviceClass\":\"16\"}" /prefetch:1
  2⤵
  PID:1932
- C:\Program Files\WindowsApps\Claude_1.30096.5.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.30096.5.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --app-path="C:\Program Files\WindowsApps\Claude_1.30096.5.0_x64__pzs8sxrjxfjjc\app\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1968,i,13841999163142456329,11186194093595700463,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1972,i,10273143376545111574,10024561194968432222,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=4308 --desktop-features="{\"launch\":{\"status\":\"supported\"},\"coworkBrowser\":{\"status\":\"unsupported\",\"reason\":\"cowork_browser_disabled\",\"unsupportedCode\":\"unknown\"},\"artifactsPane\":{\"status\":\"unavailable\"},\"nativeQuickEntry\":{\"status\":\"unavailable\"},\"quickEntryDictation\":{\"status\":\"unavailable\"},\"quickEntryGlobalShortcut\":{\"status\":\"supported\"},\"customQuickEntryDictationShortcut\":{\"status\":\"supported\"},\"ultrareviewErrorCategories\":{\"status\":\"supported\"},\"parkaMeetings\":{\"status\":\"unavailable\"},\"plushRaccoon\":{\"status\":\"unavailable\"},\"quietPenguin\":{\"status\":\"unavailable\"},\"chillingSlothFeat\":{\"status\":\"supported\"},\"chillingSlothSshShell\":{\"status\":\"supported\"},\"chillingSlothEnterprise\":{\"status\":\"supported\"},\"chillingSlothLocal\":{\"status\":\"supported\"},\"yukonSilver\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute, vfpext\",\"unsupportedCode\":\"hcs_not_available\"},\"yukonSilverGems\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute, vfpext\",\"unsupportedCode\":\"hcs_not_available\"},\"yukonSilverGemsCache\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute, vfpext\",\"unsupportedCode\":\"hcs_not_available\"},\"wakeScheduler\":{\"status\":\"unavailable\"},\"desktopTopBar\":{\"status\":\"supported\"},\"ccdPlugins\":{\"status\":\"supported\"},\"computerUse\":{\"status\":\"supported\"},\"computerUseAppScoped\":{\"status\":\"unsupported\",\"reason\":\"Background app-scoped mode is macOS-only\",\"unsupportedCode\":\"unsupported_platform\"},\"coworkWatchRecord\":{\"status\":\"unsupported\",\"reason\":\"Watch-record is not available on this platform\",\"unsupportedCode\":\"unsupported_platform\"},\"coworkWatchers\":{\"status\":\"unavailable\"},\"coworkKappa\":{\"status\":\"unavailable\"},\"coworkArtifacts\":{\"status\":\"unavailable\"},\"coworkAutoModeAlwaysAllowOverride\":{\"status\":\"unavailable\"},\"framebufferPreview\":{\"status\":\"unavailable\"},\"iosSimulator\":{\"status\":\"unsupported\",\"reason\":\"iOS Simulator panel requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"androidEmulator\":{\"status\":\"unsupported\",\"reason\":\"Android emulator is disabled by its rollout flag\",\"unsupportedCode\":\"unknown\"},\"iosSimulatorH264\":{\"status\":\"unsupported\",\"reason\":\"iOS Simulator panel requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"grandPrix\":{\"status\":\"unavailable\"},\"ccdGitEngine\":{\"status\":\"unavailable\"},\"tearOffHalo\":{\"status\":\"unsupported\",\"reason\":\"Tear-off halo overlay requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"coworkArtifactPopout\":{\"status\":\"supported\"},\"sidePanePopoutNativeViews\":{\"status\":\"supported\"},\"filePreviewNativeViewRouting\":{\"status\":\"supported\"},\"claudeDesignWindow\":{\"status\":\"supported\"},\"coworkRemoteSessionSpaces\":{\"status\":\"supported\"},\"spaceMemoryBridge\":{\"status\":\"unavailable\"},\"grandPrixRequest\":{\"status\":\"unavailable\"},\"bootPlaceholder\":{\"status\":\"unsupported\",\"reason\":\"Boot placeholder not built in\",\"unsupportedCode\":\"unknown\"},\"coworkBranchSession\":{\"status\":\"supported\"},\"coworkScheduledTaskProjects\":{\"status\":\"supported\"},\"coworkLocalSessionProjects\":{\"status\":\"supported\"},\"sshAttachmentTransport\":{\"status\":\"supported\"},\"bootstrapConfig\":{\"status\":\"supported\"},\"chatIn3p\":{\"status\":\"supported\"},\"builtinMcpPresets\":{\"status\":\"supported\"},\"surfaceTogglesPreview\":{\"status\":\"unavailable\"},\"chatTab\":{\"status\":\"unavailable\"},\"chatCodeExecution\":{\"status\":\"unavailable\"},\"mcpPersistentAlwaysAllow\":{\"status\":\"supported\"},\"epitaxyMcpApps\":{\"status\":\"unavailable\"}}" --desktop-managed-config="{\"forceLoginOrgUUIDs\":null,\"loginSsoOrgDomain\":null,\"disableEssentialTelemetry\":false,\"disableNonessentialTelemetry\":false,\"disableMobileSimulatorTools\":false,\"banner\":null,\"deploymentDisplayName\":null,\"deploymentDisplaySubtitle\":null,\"deploymentMode\":\"1p\",\"appVersion\":\"1.30096.5\",\"cookielessOrigin\":false,\"deviceClass\":\"16\"}" /prefetch:1
  2⤵
  PID:4484
- C:\Program Files\WindowsApps\Claude_1.30096.5.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.30096.5.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --field-trial-handle=1968,i,13841999163142456329,11186194093595700463,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1972,i,10273143376545111574,10024561194968432222,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=4516 /prefetch:14
  2⤵
  - Modifies registry class
  PID:4816
- C:\Program Files\WindowsApps\Claude_1.30096.5.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.30096.5.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --field-trial-handle=1968,i,13841999163142456329,11186194093595700463,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1972,i,10273143376545111574,10024561194968432222,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=4492 /prefetch:12
  2⤵
  PID:928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e01cc6a2-4eef-4aad-9b5e-7428e4f00060.tmp

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Code Cache\js\index-dir\e01cc6a2-4eef-4aad-9b5e-7428e4f00060.tmp
Size 48B
SHA256 0915234b5b3dee62db4a8cf07902f30afad868f1e27ddedf8b69d06dc442ba3a
MD5 8e6fa759442469c1f62e9277e07407f9
SHA1 3ccf8a42633b2e14ca6614d04d33f4406d3aa1a7
SHA512 8d755dae486a9038f9fd4a031fdcbcc4cc14eb4d8ba0d3fbc7768a90a86b99ce75eeb130cc6d2e646cfd2a83987178eded45cc9a4e3172e0fd83c98735af45e9
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 de4dee63e55cf49ae1bb502d59c5abc48cd4e01df84aad042e8a37b5dc04f431
MD5 5f5b3197f80b1cac76351a2191152230
SHA1 0f0725e7665cb3084d58e9dddfa69e8aa27c7aff
SHA512 607243c172a96194e5ab53b48dcf12dbce1f62dcca6282fe28df70158ae56a1a3e343ffae3871f1821acc9a438ef599353df115d2c24e5ae7a7fbd1b81761f05
TLSH
T17A51A1514EB7B029F7100AB1B2E39846B935B403DABB1ECFBBB16C30596DFC10606310
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\IndexedDB\https_claude.ai_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Network\Network Persistent State
Size 2KB
SHA256 e53ce12bf18ecf11782f17616bf79c819c48b53853fe7af6775bb17554c1e692
MD5 24722d6e2c05321eaff2b357b6b661d5
SHA1 1518671bc2280509a267ddd5972f51534e334268
SHA512 0f59d53f55992a6dec0b9b8ce21204fbd34502ab03ee7d2b924fdaaca85f315ea1946b1ec3f8b34a0796eb75333ea808888a8fd57f1c6931681ddb2b98a7cca6
TLSH
T14B41CBD6C7D9077DC56227F51E243AA3C1BE2A1C92187D07C8C9EF8E6BE1436561254C
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Partitions\cowork-file-preview\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Partitions\launch-preview-static\Cache\Cache_Data\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Partitions\launch-preview-static\Cache\Cache_Data\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Partitions\launch-preview-static\Cache\Cache_Data\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Partitions\launch-preview-static\Cache\Cache_Data\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Partitions\launch-preview-static\Local Storage\leveldb\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Partitions\launch-preview-static\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

05e0e7de-dd6f-4525-9021-dbf3d4da5d14.tmp

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Partitions\launch-preview-static\Network\05e0e7de-dd6f-4525-9021-dbf3d4da5d14.tmp
Size 84B
SHA256 712196693e3527ac1131831f1a2108b6c0e5c68967b26d51a452611cdfb86e0c
MD5 32b9dc9cc81d0682e78627c873fdd651
SHA1 46c486386d3e153c3e9b11d54cb52cf0064b71cf
SHA512 f18bc37f8b72411548da247aa1394cc5ac03c3bbd98e82eb8ba290ef239ef5b8625cf4835bd41ce7c52766d0bc3bfe9150dd22dbf62f0f05992ddde5fbfdc811
TLSH
T154A0121490405CFB0308835504146463C3F50002421848A91634318D019209D0004403
MD5 SHA1 SHA512 TLSH

Submit Download

901b0d22-67bd-4238-a78d-67b5c3676abb.tmp

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Partitions\launch-preview-static\Network\901b0d22-67bd-4238-a78d-67b5c3676abb.tmp
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

869eb5dd-c39a-4f9d-b9b1-ab194f07caf9.tmp

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\WebStorage\2\CacheStorage\7cf4be4d-90c6-474a-8357-6869e5314738\index-dir\869eb5dd-c39a-4f9d-b9b1-ab194f07caf9.tmp
Size 48B
SHA256 d0487ae159c463f00a17768e0a7e2dafea1d87dea074dd5c91c5553750586a54
MD5 a741f213f4168d7094ea76ac00de6554
SHA1 3f06955de164eaaf56a8b6871205e0d7b2ce719f
SHA512 4197008fbba6f2369f2d0fa804ede38871795251469b951b0422180c8d1754f4e4541dcc0744c071eefe7bd2791b1f80d34fa4cdd0862328019a354dcc5ddb20
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\WebStorage\2\CacheStorage\7cf4be4d-90c6-474a-8357-6869e5314738\index-dir\the-real-index
Size 72B
SHA256 37eeb041eb9da45d9a0b162206f639a89af03b8297bb6d6221985e6c0a27835b
MD5 9948fe6e15d185ae1c8e73c695088ef0
SHA1 31c6292fb8b06f4277b54aba1256870bbfa02ce0
SHA512 793c5d036e76143a811b34c71bc674e2b48731511687de65ed42eb8c290503c119d37205c2414549f1a9f07fe6982a830fbfceb92f78a2e6ee86beeae6778901
TLSH
T1F2A00271538A1082C0511375E4450B967350C81089034703509607588CA56C45D1512D
MD5 SHA1 SHA512 TLSH

Submit Download

e55b7bb5-d52a-4e83-9cee-5f4c8b5c19de.tmp

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\WebStorage\2\CacheStorage\e55b7bb5-d52a-4e83-9cee-5f4c8b5c19de.tmp
Size 176B
SHA256 cea71f90206d3d1d740a2d99d31583572aa241e2c5b28015b93c8b703842a7a6
MD5 1b3a01b0db8eb33ab67545e5596019cb
SHA1 4ff236aa870a5cb18136868a691ae4951c5df922
SHA512 d31a1851049881a46864037f0800b9f5d48f57f6f7adc9133179b494a1c9eec329444b4543c98b8cbeac0427848aaa4c9e3bc2c6b0f6f3fef8cf37019e827677
TLSH
T125C012BF008286912EA138EA200236C9C9323EC88CC0B60D882234456230D9A8800A24
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\WebStorage\2\CacheStorage\index.txt
Size 89B
SHA256 92cda5a28f4c1874bcf0aca7ca908e1234751120abf372f5a81cbb33590c3590
MD5 8684fe11e05213691ad78cf380e7c451
SHA1 1c075025a185041ddeb120c2c8e8cc2fe175d82b
SHA512 fd3ede8f008a3407360d649eb6c2c07c14454f2c17e823af53217c15baeb965494074dfff8b87acf24474839cdf9aab03c71be349e434dc6ba89e32b2a57bc55
TLSH
T1B2B002FF014156D15EA135E7100731DEC56376D85CC0EA4CD572105473104AD5401C24
MD5 SHA1 SHA512 TLSH

Submit Download

claude_desktop_config.json

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\claude_desktop_config.json
Size 228B
SHA256 fa1cddf575574bf3febabc8f28f39a00bb3939c0182ac4d79190688659a378ad
MD5 ccbc038685f15dd2f109ca3e0e1925b8
SHA1 92dbb9d9fbe93613ae7ca2bfb4c9cf65205d092c
SHA512 61cbc9a60b821eec8494d06336b64e85fe176d17a5f3e43de12a3792f67d9b0690d938278656251f1b050f5b02b8f752df801ba5692d5f754bdee417e7042b0b
TLSH
T1F9D0A720D8350EA705F2A2584D2D8413570179D319287028A55F091C1FCC93C7935492
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\config.json
Size 42B
SHA256 95ce361979ef56929c4b20f9a04756fa4e170e478e75aa3f31f07815b05ad28c
MD5 e05e441cdaeae8bbe08176dc0b5b7c49
SHA1 dc8b88d98ad2065da8f5126dd5ec3f6981aa0664
SHA512 17e62fe837a41aaa7a2608fe7caca0b3d59861cf1a812fbe9c1ac2012216df39aab2ce47457fbf58a2413373c1dfbdb072a435d648dddb2365ff972cdfb6e4b4
MD5 SHA1 SHA512

Submit Download

config.json.tmp-689082881940b30b

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\config.json.tmp-689082881940b30b
Size 77B
SHA256 57846dc4c047307dff46ff886353b46d2bbccdea35b503270979091e221e1dda
MD5 647086e447bafd428806eabc2ba3171f
SHA1 0f8cb85a804e4cca7603647a928e1991f04f9386
SHA512 4fa2c80c134078491d990203cda82b13ddce1ee621a5889312cad72d9b930476e98fb502427c3c8cf1e602635d500f7fed17bdf575fe0bdeb936462859d701e7
TLSH
T11CA022CFAA3008228E0F03BC2C8C82CB83C8030C830F00020308A33ECC20B2E208A200
MD5 SHA1 SHA512 TLSH

Submit Download

config.json.tmp-6890829315818f41

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\config.json.tmp-6890829315818f41
Size 62B
SHA256 e77e1e3184ad9ba8303979c19dcb05c25c3723d2d12814b059fa9f563b3e7eb4
MD5 3f01fb1793f639088275c8bc9b49273d
SHA1 2a77d3b225587d9cd89829bed076ca0dc67446cf
SHA512 b0a2d3a92c92aabb31ad59f056c99976e617e839ed64be950e72600b38a57801c660d760b1ea9388c6fa3fdc3a5b41fb42e382b724535dd83bc8b2aecd593d2c
TLSH
T155A0026AC0255413911582AD140411CA85D9065C6A0B19064795725AD946B7C554A355
MD5 SHA1 SHA512 TLSH

Submit Download

config.json.tmp-6890829436fda9b0

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\config.json.tmp-6890829436fda9b0
Size 70B
SHA256 a1af8a127d916d5eb88418802de0337efd15c6e8a1feae43f870921e2c25f6cc
MD5 d2f9154c442f8aa68501f21ebc1288a0
SHA1 23752df2ec954c21d374532e752f541183852896
SHA512 12fe78a01b247df6ba1ebc624f83f89a8f12a5e088d330625073b8a2eeedd49df2ad8ca2452892b1856fc36bdee624352902ff5e438f8e236d9481e3666f63d3
TLSH
T1C7A022BAC0280803C000823C200C00CE80FC2B0C8803000F0BA8220ECA00EB8B230F20
MD5 SHA1 SHA512 TLSH

Submit Download

config.json.tmp-6890829586c974cc

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\config.json.tmp-6890829586c974cc
Size 75B
SHA256 b25ff6a19de3df18d3d70597965ec5d9e94be631fc3c689a32ba5a12ae1b009c
MD5 5776793354453fe1b4d95f241e62480a
SHA1 84886ea7ac24608ddcdcc142d50aff24868e2034
SHA512 58dbadd24f707155419bcacd9b8dfb60a281a92f02ac43657f6e7ff7fe98574e376f77a59ca8ea67e647c78d0ec080139062344c3406c5aabbffafdf707e353a
TLSH
T128A022ABC020003282320BAC0B0833CB8CC8020C008B08008B0ABBAEF80023E8C023E0
MD5 SHA1 SHA512 TLSH

Submit Download

config.json.tmp-68908308132e6d70

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\config.json.tmp-68908308132e6d70
Size 95B
SHA256 5562b69e679504aed40bb0ef04f03eb7407c10a394dd969893f81c5d211503a4
MD5 cf53f3194a6a516790c43e26994c35f1
SHA1 017e6d27af586ad397cfaf2b62047f07e3deea3b
SHA512 fa0b4a232fe91ebf71aab426634d3c145e3e2013c71527282d5cac5f58c722b2bf4a6ace4de1eaceb9f59039f3cb9ad7e1ebf049870815a392476fe057fd3e5c
TLSH
T10AB01267C0200037412146DC0E0C21C745C4010C154F1C018346B659E40563D4806391
MD5 SHA1 SHA512 TLSH

Submit Download

scope_v3.json

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\sentry\scope_v3.json
Size 7KB
SHA256 ed22c01d1e30f6c5dbf78e837032f5ddc0ea7d1c6ca3e8d4a6fef7e73b4e673f
MD5 f3386f322e93cdfcce3a439516434d3f
SHA1 0a31cd2dbd4d6e4d750c92f6b58b6ecb54664d1f
SHA512 edb57b615baac4982c645831e2ebd90268b05205390d964b436c31f4a9472e19eae852db618b87945525aee04635a7a8c1fc954e52b57dfafed8de475e211e3e
SSDEEP 96:qSByAua9ZDqPKdeTq9AF92SFWUSEFI9hGSERx9/uZdKIvKHHePVE3C+KIC:1JqPXrFnSEFI9kSERyIW1d
TLSH
T182F153952E6C9DBD0F4AA38E34823D4ED3687382C6C52C434E58DE5CD9EE597602D22E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

APPX.inc5fu9kg9a1k3bphhluc_kjd.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX.inc5fu9kg9a1k3bphhluc_kjd.tmp
Size 7KB
SHA256 e1a3ba261889cc4556a47039fdfaab2717d21f72ecc694ce7ce4896063fc5edc
MD5 72ae5029402693f18fd259cc3367014f
SHA1 6b0b79ff5a96612e65d14b7829960e63beea04e9
SHA512 c9d6eb93cb286c4e5c735297d1ffc5307c50d3d4db1ff9b0c1d38eca741b81633dd6ec74ad7687622445bdb8c77a1182d9912bda202ffdd57afbc4ea612a6a65
SSDEEP 192:rJG1F4Ra8brotDMq6LYYcwmbTYp+bkk6W+Gkk63:rJG1F4Ra8brotDMTLY/wJ+bkk6W+Gkku
TLSH
T129F1024BD4AD18504672E1AAAF13D685EB2C09575CDE00C0BCDD56432FB265F033BB9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

APPX.kbyufbknxsiskw75kdv62qf5c.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX.kbyufbknxsiskw75kdv62qf5c.tmp
Size 1.0MB
SHA256 5d2ce216a5fc05ea71c40e0b88541894f226b821b5e756b1a3f31018f6c91235
MD5 b0c462b32f860729ecd1b4da01a28008
SHA1 02c5601734959e6e28dc6bb63ec4ec649f52881f
SHA512 eebb811af6d39dd47fdcc7acfedf0e86b457ff1f16db69ff2b9786576a0050d5037603d4e0cb1801d1fc87af0c2f5168fb7fd0ef079983d29888bd9b73363b9c
SSDEEP 12288:hxiIsNuRF95PEj+ZLVcbzd+KRo8FihxpUfLcrIxHe71mT+9RG4:eIsNEZPE20+KyYilUfgWe7D/b
TLSH
T10C35C6E1552DBE36816D0AAD8F24F5042C35883653376E0E9C6EA2B31CBF9721F674E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

APPX.x7_0cfc281adywax_yvfqbt9c.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX.x7_0cfc281adywax_yvfqbt9c.tmp
Size 10KB
SHA256 25c8d4abf5d021d0e4f1caf86c5d4133238cfa5e081bbc2fc73019a596e79305
MD5 825c18d0933fd91ace46af2d0a1bf073
SHA1 b56d116b0a23a58b5d5edf22a15fee6bb71dd009
SHA512 e321a1d63e6d761e010b439de4d6420e4ae7f81efd8fbde712e5b18c874e54fa7d9e291eca8e9ab78be252f68be4e199c97c7f9ba658a06922aeae8c24a3c959
SSDEEP 192:DNyEIYiYF80dmL4pUQaULc8pq8RuX5hz28uNNTPKTi4pGpLdgLX:DNyEIYi2mL4/y8RKE7Vzddw
TLSH
T199224BA788846C45EE17AC10B4C4A53AEDB2B68569C0C1D77159C266C7943823FDD2ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ClaudeSetup.log

Path C:\Users\Admin\AppData\Local\Temp\ClaudeSetup.log
Size 3KB
SHA256 6abc7343097e954dd1051974bbdd364082f555e0ae027075f05d0e25a12a02a9
MD5 57a3c926ecc0bfa360b256ecf2873051
SHA1 c6911787f59708505796cb5ba5a2ebe1b8343f65
SHA512 9434ea9e4f2bb96ce2437aab137fee4bff1d942645cd6426be50c106ba5d2386209d39980cd07d3407d46215d7e3e3b69b064f2ef15262bd674390c512d99621
TLSH
T1F281B99A45C6CCF82FD65487E25F2319511B3B3AA72DF4287AC04C8074223246EEF2D6
MD5 SHA1 SHA512 TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/2436-151-0x00007FFE6E4C0000-0x00007FFE6E4C1000-memory.dmp

Download

memory/2436-150-0x00007FFE6E770000-0x00007FFE6E771000-memory.dmp

Download