097569960c142aeb6c11ba6f9e9ed822a710a609de73feb64be9282f9314aa89

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/09/2026, 12:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Claude Setup.exe
Size 6.8MB
Sample260903-pm2bvsgp8s
SHA256 097569960c142aeb6c11ba6f9e9ed822a710a609de73feb64be9282f9314aa89
MD5 0b47b5325197e3ec142cca0de7604b6c
SHA1 844d5dccc0e5226ac2bae4871dd6ece0c38d23ab
SHA512 d9870ff40b57103e2eff705d988ad26f7c360badd25eb731b3fac42f066560c2f947505b7815a75cf9b5b1454934a611a8fcb16ec747958d8321ce3cde95c7ac
SSDEEP 49152:t64pYde+u1bCkBpkfFwjkdlp5ebiPTDDKUU80+6hwk8uPA5D0UjjyVtAv8nfKiK8:tZCLXaibDDfY+6aCK6bfLEpu
TLSH
T1BD663907ECA145E5C0A9E23489679253BB727C885B3123D72F90F7282F76BE06DB9750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_A53644FA0CAAA458C7A0416292C7CC5B	cowork-svc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB	cowork-svc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB	cowork-svc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\616AD1AB067CFD351D6C0EF6F3E12F40	cowork-svc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\616AD1AB067CFD351D6C0EF6F3E12F40	cowork-svc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	cowork-svc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	cowork-svc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_A53644FA0CAAA458C7A0416292C7CC5B	cowork-svc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	Claude.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	cowork-svc.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\claude\shell\open\command	Claude.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\claude\shell\open	Claude.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{4C735820-1BB0-41C7-BEA7-D37507A651E3}	Claude.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\claude	Claude.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\claude\URL Protocol	Claude.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\claude\shell	Claude.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\claude\shell\open\command\ = "\"C:\\Program Files\\WindowsApps\\Claude_1.44121.4.0_x64__pzs8sxrjxfjjc\\app\\Claude.exe\" \"%1\""	Claude.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\claude\ = "URL:claude"	Claude.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3488	Claude Setup.exe
3488	Claude Setup.exe
2572	cowork-svc.exe
2572	cowork-svc.exe
5372	Claude.exe
5372	Claude.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5372	Claude.exe
Token: SeCreatePagefilePrivilege	5372	Claude.exe
Token: SeShutdownPrivilege	5372	Claude.exe
Token: SeCreatePagefilePrivilege	5372	Claude.exe
Token: SeShutdownPrivilege	5372	Claude.exe
Token: SeCreatePagefilePrivilege	5372	Claude.exe
Token: SeShutdownPrivilege	5372	Claude.exe
Token: SeCreatePagefilePrivilege	5372	Claude.exe
Token: SeShutdownPrivilege	5372	Claude.exe
Token: SeCreatePagefilePrivilege	5372	Claude.exe
Token: SeShutdownPrivilege	5372	Claude.exe
Token: SeCreatePagefilePrivilege	5372	Claude.exe
Token: SeShutdownPrivilege	5372	Claude.exe
Token: SeCreatePagefilePrivilege	5372	Claude.exe
Token: SeShutdownPrivilege	5372	Claude.exe
Token: SeCreatePagefilePrivilege	5372	Claude.exe
Token: SeShutdownPrivilege	5372	Claude.exe
Token: SeCreatePagefilePrivilege	5372	Claude.exe
Token: SeShutdownPrivilege	5372	Claude.exe
Token: SeCreatePagefilePrivilege	5372	Claude.exe
Token: SeShutdownPrivilege	5372	Claude.exe
Token: SeCreatePagefilePrivilege	5372	Claude.exe
Token: SeShutdownPrivilege	5372	Claude.exe
Token: SeCreatePagefilePrivilege	5372	Claude.exe
Token: SeShutdownPrivilege	5372	Claude.exe
Token: SeCreatePagefilePrivilege	5372	Claude.exe
Token: SeShutdownPrivilege	5372	Claude.exe
Token: SeCreatePagefilePrivilege	5372	Claude.exe
Token: SeShutdownPrivilege	5372	Claude.exe
Token: SeCreatePagefilePrivilege	5372	Claude.exe
Token: SeShutdownPrivilege	5372	Claude.exe
Token: SeCreatePagefilePrivilege	5372	Claude.exe
Token: SeShutdownPrivilege	5372	Claude.exe
Token: SeCreatePagefilePrivilege	5372	Claude.exe
Token: SeShutdownPrivilege	5372	Claude.exe
Token: SeCreatePagefilePrivilege	5372	Claude.exe
Token: SeShutdownPrivilege	5372	Claude.exe
Token: SeCreatePagefilePrivilege	5372	Claude.exe
Token: SeShutdownPrivilege	5372	Claude.exe
Token: SeCreatePagefilePrivilege	5372	Claude.exe
Token: SeShutdownPrivilege	5372	Claude.exe
Token: SeCreatePagefilePrivilege	5372	Claude.exe
Token: SeShutdownPrivilege	5372	Claude.exe
Token: SeCreatePagefilePrivilege	5372	Claude.exe
Token: SeShutdownPrivilege	5372	Claude.exe
Token: SeCreatePagefilePrivilege	5372	Claude.exe
Token: SeShutdownPrivilege	5372	Claude.exe
Token: SeCreatePagefilePrivilege	5372	Claude.exe
Token: SeShutdownPrivilege	5372	Claude.exe
Token: SeCreatePagefilePrivilege	5372	Claude.exe
Token: SeShutdownPrivilege	5372	Claude.exe
Token: SeCreatePagefilePrivilege	5372	Claude.exe
Token: SeShutdownPrivilege	5372	Claude.exe
Token: SeCreatePagefilePrivilege	5372	Claude.exe
Token: SeShutdownPrivilege	5372	Claude.exe
Token: SeCreatePagefilePrivilege	5372	Claude.exe
Token: SeShutdownPrivilege	5372	Claude.exe
Token: SeCreatePagefilePrivilege	5372	Claude.exe
Token: SeShutdownPrivilege	5372	Claude.exe
Token: SeCreatePagefilePrivilege	5372	Claude.exe
Token: SeShutdownPrivilege	5372	Claude.exe
Token: SeCreatePagefilePrivilege	5372	Claude.exe
Token: SeShutdownPrivilege	5372	Claude.exe
Token: SeCreatePagefilePrivilege	5372	Claude.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
5372	Claude.exe
5372	Claude.exe
5372	Claude.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
5372	Claude.exe
5372	Claude.exe
5372	Claude.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4356	explorer.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3428 wrote to memory of 3488	3428	Claude Setup.exe	89
PID 3488 wrote to memory of 5476	3488	Claude Setup.exe	94
PID 5372 wrote to memory of 1836	5372	Claude.exe	99
PID 5372 wrote to memory of 2296	5372	Claude.exe	100
PID 5372 wrote to memory of 1380	5372	Claude.exe	101
PID 5372 wrote to memory of 1516	5372	Claude.exe	102
PID 5372 wrote to memory of 1704	5372	Claude.exe	103
PID 5372 wrote to memory of 6048	5372	Claude.exe	104
PID 5372 wrote to memory of 7436	5372	Claude.exe	105
PID 5372 wrote to memory of 7648	5372	Claude.exe	106
PID 5372 wrote to memory of 7656	5372	Claude.exe	107

C:\Users\Admin\AppData\Local\Temp\Claude Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Claude Setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3428
- C:\Users\Admin\AppData\Local\Temp\Claude Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Claude Setup.exe" --elevated --msix-path "C:\Users\Admin\AppData\Local\Temp\Claude-4104529109.msix" --log-path "C:\Users\Admin\AppData\Local\Temp\ClaudeSetup.log" --all-users
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3488
- - C:\Windows\explorer.exe
    explorer.exe shell:AppsFolder\Claude_pzs8sxrjxfjjc!Claude
    3⤵
    PID:5476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4444

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness
1⤵
PID:3048

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4356

C:\Program Files\WindowsApps\Claude_1.44121.4.0_x64__pzs8sxrjxfjjc\app\resources\cowork-svc.exe
"C:\Program Files\WindowsApps\Claude_1.44121.4.0_x64__pzs8sxrjxfjjc\app\resources\cowork-svc.exe"
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2572

C:\Program Files\WindowsApps\Claude_1.44121.4.0_x64__pzs8sxrjxfjjc\app\Claude.exe
"C:\Program Files\WindowsApps\Claude_1.44121.4.0_x64__pzs8sxrjxfjjc\app\Claude.exe"
1⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5372
- C:\Program Files\WindowsApps\Claude_1.44121.4.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.44121.4.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\Claude /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\Claude\Crashpad --url=https://f.a.k/e --annotation=_productName=Claude --annotation=_version=1.44121.4 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=42.10.0 --initial-client-data=0x4c0,0x4c4,0x4c8,0x4b4,0x4cc,0x7ff7d8273208,0x7ff7d8273218,0x7ff7d8273228
  2⤵
  PID:1836
- C:\Program Files\WindowsApps\Claude_1.44121.4.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.44121.4.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2360,i,11927642296953218121,15709801984058570906,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,IsolatesPriorityUseProcessPriority,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WebGPUService --variations-seed-version --pseudonymization-salt-handle=2364,i,14354453599588457200,4921765257666152989,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2356 /prefetch:2
  2⤵
  PID:2296
- C:\Program Files\WindowsApps\Claude_1.44121.4.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.44121.4.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --field-trial-handle=2360,i,11927642296953218121,15709801984058570906,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,IsolatesPriorityUseProcessPriority,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WebGPUService --variations-seed-version --pseudonymization-salt-handle=2364,i,14354453599588457200,4921765257666152989,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2392 /prefetch:11
  2⤵
  PID:1380
- C:\Program Files\WindowsApps\Claude_1.44121.4.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.44121.4.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --app-user-model-id=Claude_pzs8sxrjxfjjc!Claude --app-path="C:\Program Files\WindowsApps\Claude_1.44121.4.0_x64__pzs8sxrjxfjjc\app\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1788437888992086 --launch-time-ticks=624344254 --field-trial-handle=2360,i,11927642296953218121,15709801984058570906,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,IsolatesPriorityUseProcessPriority,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WebGPUService --variations-seed-version --pseudonymization-salt-handle=2364,i,14354453599588457200,4921765257666152989,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=3368 --desktop-managed-config="{\"forceLoginOrgUUIDs\":null,\"loginSsoOrgDomain\":null,\"disableEssentialTelemetry\":false,\"disableNonessentialTelemetry\":false,\"disableMobileSimulatorTools\":false,\"banner\":null,\"deploymentDisplayName\":null,\"deploymentDisplaySubtitle\":null,\"dictationAvailable\":false,\"userPluginMarketplacesEnabled\":true,\"userPluginUploadsEnabled\":true,\"configDeprecations\":[],\"configDeprecationNoticesSuppressed\":false,\"configOrgDelivered\":false,\"deploymentMode\":\"1p\",\"appVersion\":\"1.44121.4\",\"cookielessOrigin\":false,\"deviceClass\":\"16\",\"extensionsEnabled\":true,\"localExtensionInstallAllowed\":true}" --desktop-boot-placeholder="{\"enabled\":false}" /prefetch:1
  2⤵
  PID:1516
- C:\Program Files\WindowsApps\Claude_1.44121.4.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.44121.4.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --app-user-model-id=Claude_pzs8sxrjxfjjc!Claude --app-path="C:\Program Files\WindowsApps\Claude_1.44121.4.0_x64__pzs8sxrjxfjjc\app\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1788437888992086 --launch-time-ticks=624361708 --field-trial-handle=2360,i,11927642296953218121,15709801984058570906,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,IsolatesPriorityUseProcessPriority,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WebGPUService --variations-seed-version --pseudonymization-salt-handle=2364,i,14354453599588457200,4921765257666152989,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3412 --desktop-features="{\"launch\":{\"status\":\"supported\"},\"coworkBrowser\":{\"status\":\"unsupported\",\"reason\":\"cowork_browser_disabled\",\"unsupportedCode\":\"unknown\"},\"artifactsPane\":{\"status\":\"unavailable\"},\"nativeQuickEntry\":{\"status\":\"unavailable\"},\"quickEntryDictation\":{\"status\":\"unavailable\"},\"quickEntryGlobalShortcut\":{\"status\":\"supported\"},\"customQuickEntryDictationShortcut\":{\"status\":\"supported\"},\"ultrareviewErrorCategories\":{\"status\":\"supported\"},\"spawnTaskPendingPop\":{\"status\":\"supported\"},\"spawnTaskInFlightIds\":{\"status\":\"supported\"},\"plushRaccoon\":{\"status\":\"unavailable\"},\"quietPenguin\":{\"status\":\"unavailable\"},\"rubberDuck\":{\"status\":\"unavailable\"},\"chillingSlothFeat\":{\"status\":\"supported\"},\"chillingSlothSshShell\":{\"status\":\"supported\"},\"chillingSlothSshWorktreeLocation\":{\"status\":\"supported\"},\"chillingSlothEnterprise\":{\"status\":\"supported\"},\"chillingSlothLocal\":{\"status\":\"supported\"},\"yukonSilver\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute, vfpext\",\"unsupportedCode\":\"hcs_not_available\"},\"yukonSilverGems\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute, vfpext\",\"unsupportedCode\":\"hcs_not_available\"},\"yukonSilverGemsCache\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute, vfpext\",\"unsupportedCode\":\"hcs_not_available\"},\"wakeScheduler\":{\"status\":\"unavailable\"},\"desktopTopBar\":{\"status\":\"supported\"},\"ccdPlugins\":{\"status\":\"supported\"},\"computerUse\":{\"status\":\"supported\"},\"computerUseComplianceGate\":{\"status\":\"supported\"},\"computerUseAppScoped\":{\"status\":\"unsupported\",\"reason\":\"Background app-scoped mode is macOS-only\",\"unsupportedCode\":\"unsupported_platform\"},\"coworkWatchRecord\":{\"status\":\"unavailable\"},\"coworkWatchers\":{\"status\":\"unavailable\"},\"coworkKappa\":{\"status\":\"unavailable\"},\"coworkArtifacts\":{\"status\":\"unavailable\"},\"coworkAutoModeAlwaysAllowOverride\":{\"status\":\"unavailable\"},\"framebufferPreview\":{\"status\":\"unavailable\"},\"iosSimulator\":{\"status\":\"unsupported\",\"reason\":\"iOS Simulator panel requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"androidEmulator\":{\"status\":\"unsupported\",\"reason\":\"Android emulator is disabled by its rollout flag\",\"unsupportedCode\":\"unknown\"},\"iosSimulatorH264\":{\"status\":\"unsupported\",\"reason\":\"iOS Simulator panel requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"grandPrix\":{\"status\":\"unavailable\"},\"ccdGitEngine\":{\"status\":\"unavailable\"},\"sessionPrOwnership\":{\"status\":\"unavailable\"},\"sessionFolderFileAccess\":{\"status\":\"supported\"},\"tearOffHalo\":{\"status\":\"unsupported\",\"reason\":\"Tear-off halo overlay requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"coworkArtifactPopout\":{\"status\":\"supported\"},\"sidePanePopoutNativeViews\":{\"status\":\"supported\"},\"popoutZoom\":{\"status\":\"supported\"},\"popoutTitleBarOverlay\":{\"status\":\"supported\"},\"filePreviewNativeViewRouting\":{\"status\":\"supported\"},\"claudeDesignWindow\":{\"status\":\"supported\"},\"coworkRemoteSessionSpaces\":{\"status\":\"supported\"},\"spaceMemoryBridge\":{\"status\":\"unavailable\"},\"grandPrixRequest\":{\"status\":\"unavailable\"},\"bootPlaceholder\":{\"status\":\"unsupported\",\"reason\":\"Boot placeholder disabled for this launch\",\"unsupportedCode\":\"unknown\"},\"coworkBranchSession\":{\"status\":\"supported\"},\"coworkScheduledTaskProjects\":{\"status\":\"supported\"},\"coworkLocalSessionProjects\":{\"status\":\"supported\"},\"sshAttachmentTransport\":{\"status\":\"supported\"},\"coworkSeededSummon\":{\"status\":\"supported\"},\"sessionMentions\":{\"status\":\"supported\"},\"wslForkSession\":{\"status\":\"unavailable\"},\"violinBow\":{\"status\":\"unavailable\"},\"violinBowHomeSettings\":{\"status\":\"unavailable\"},\"coworkThinkingInSend\":{\"status\":\"supported\"},\"bootstrapConfig\":{\"status\":\"supported\"},\"chatIn3p\":{\"status\":\"supported\"},\"surfaceTogglesPreview\":{\"status\":\"unavailable\"},\"chatTab\":{\"status\":\"unavailable\"},\"chatCodeExecution\":{\"status\":\"unavailable\"},\"mcpPersistentAlwaysAllow\":{\"status\":\"supported\"},\"epitaxyMcpApps\":{\"status\":\"supported\"},\"sideSessions\":{\"status\":\"unavailable\"}}" --desktop-managed-config="{\"forceLoginOrgUUIDs\":null,\"loginSsoOrgDomain\":null,\"disableEssentialTelemetry\":false,\"disableNonessentialTelemetry\":false,\"disableMobileSimulatorTools\":false,\"banner\":null,\"deploymentDisplayName\":null,\"deploymentDisplaySubtitle\":null,\"dictationAvailable\":false,\"userPluginMarketplacesEnabled\":true,\"userPluginUploadsEnabled\":true,\"configDeprecations\":[],\"configDeprecationNoticesSuppressed\":false,\"configOrgDelivered\":false,\"deploymentMode\":\"1p\",\"appVersion\":\"1.44121.4\",\"cookielessOrigin\":false,\"deviceClass\":\"16\",\"extensionsEnabled\":true,\"localExtensionInstallAllowed\":true}" /prefetch:1
  2⤵
  PID:1704
- C:\Program Files\WindowsApps\Claude_1.44121.4.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.44121.4.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --app-user-model-id=Claude_pzs8sxrjxfjjc!Claude --app-path="C:\Program Files\WindowsApps\Claude_1.44121.4.0_x64__pzs8sxrjxfjjc\app\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1788437888992086 --launch-time-ticks=624998895 --field-trial-handle=2360,i,11927642296953218121,15709801984058570906,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,IsolatesPriorityUseProcessPriority,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WebGPUService --variations-seed-version --pseudonymization-salt-handle=2364,i,14354453599588457200,4921765257666152989,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3972 --desktop-features="{\"launch\":{\"status\":\"supported\"},\"coworkBrowser\":{\"status\":\"unsupported\",\"reason\":\"cowork_browser_disabled\",\"unsupportedCode\":\"unknown\"},\"artifactsPane\":{\"status\":\"unavailable\"},\"nativeQuickEntry\":{\"status\":\"unavailable\"},\"quickEntryDictation\":{\"status\":\"unavailable\"},\"quickEntryGlobalShortcut\":{\"status\":\"supported\"},\"customQuickEntryDictationShortcut\":{\"status\":\"supported\"},\"ultrareviewErrorCategories\":{\"status\":\"supported\"},\"spawnTaskPendingPop\":{\"status\":\"supported\"},\"spawnTaskInFlightIds\":{\"status\":\"supported\"},\"plushRaccoon\":{\"status\":\"unavailable\"},\"quietPenguin\":{\"status\":\"unavailable\"},\"rubberDuck\":{\"status\":\"unavailable\"},\"chillingSlothFeat\":{\"status\":\"supported\"},\"chillingSlothSshShell\":{\"status\":\"supported\"},\"chillingSlothSshWorktreeLocation\":{\"status\":\"supported\"},\"chillingSlothEnterprise\":{\"status\":\"supported\"},\"chillingSlothLocal\":{\"status\":\"supported\"},\"yukonSilver\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute, vfpext\",\"unsupportedCode\":\"hcs_not_available\"},\"yukonSilverGems\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute, vfpext\",\"unsupportedCode\":\"hcs_not_available\"},\"yukonSilverGemsCache\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute, vfpext\",\"unsupportedCode\":\"hcs_not_available\"},\"wakeScheduler\":{\"status\":\"unavailable\"},\"desktopTopBar\":{\"status\":\"supported\"},\"ccdPlugins\":{\"status\":\"supported\"},\"computerUse\":{\"status\":\"supported\"},\"computerUseComplianceGate\":{\"status\":\"supported\"},\"computerUseAppScoped\":{\"status\":\"unsupported\",\"reason\":\"Background app-scoped mode is macOS-only\",\"unsupportedCode\":\"unsupported_platform\"},\"coworkWatchRecord\":{\"status\":\"unavailable\"},\"coworkWatchers\":{\"status\":\"unavailable\"},\"coworkKappa\":{\"status\":\"unavailable\"},\"coworkArtifacts\":{\"status\":\"unavailable\"},\"coworkAutoModeAlwaysAllowOverride\":{\"status\":\"unavailable\"},\"framebufferPreview\":{\"status\":\"unavailable\"},\"iosSimulator\":{\"status\":\"unsupported\",\"reason\":\"iOS Simulator panel requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"androidEmulator\":{\"status\":\"unsupported\",\"reason\":\"Android emulator is disabled by its rollout flag\",\"unsupportedCode\":\"unknown\"},\"iosSimulatorH264\":{\"status\":\"unsupported\",\"reason\":\"iOS Simulator panel requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"grandPrix\":{\"status\":\"unavailable\"},\"ccdGitEngine\":{\"status\":\"unavailable\"},\"sessionPrOwnership\":{\"status\":\"unavailable\"},\"sessionFolderFileAccess\":{\"status\":\"supported\"},\"tearOffHalo\":{\"status\":\"unsupported\",\"reason\":\"Tear-off halo overlay requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"coworkArtifactPopout\":{\"status\":\"supported\"},\"sidePanePopoutNativeViews\":{\"status\":\"supported\"},\"popoutZoom\":{\"status\":\"supported\"},\"popoutTitleBarOverlay\":{\"status\":\"supported\"},\"filePreviewNativeViewRouting\":{\"status\":\"supported\"},\"claudeDesignWindow\":{\"status\":\"supported\"},\"coworkRemoteSessionSpaces\":{\"status\":\"supported\"},\"spaceMemoryBridge\":{\"status\":\"unavailable\"},\"grandPrixRequest\":{\"status\":\"unavailable\"},\"bootPlaceholder\":{\"status\":\"unsupported\",\"reason\":\"Boot placeholder disabled for this launch\",\"unsupportedCode\":\"unknown\"},\"coworkBranchSession\":{\"status\":\"supported\"},\"coworkScheduledTaskProjects\":{\"status\":\"supported\"},\"coworkLocalSessionProjects\":{\"status\":\"supported\"},\"sshAttachmentTransport\":{\"status\":\"supported\"},\"coworkSeededSummon\":{\"status\":\"supported\"},\"sessionMentions\":{\"status\":\"supported\"},\"wslForkSession\":{\"status\":\"unavailable\"},\"violinBow\":{\"status\":\"unavailable\"},\"violinBowHomeSettings\":{\"status\":\"unavailable\"},\"coworkThinkingInSend\":{\"status\":\"supported\"},\"bootstrapConfig\":{\"status\":\"supported\"},\"chatIn3p\":{\"status\":\"supported\"},\"surfaceTogglesPreview\":{\"status\":\"unavailable\"},\"chatTab\":{\"status\":\"unavailable\"},\"chatCodeExecution\":{\"status\":\"unavailable\"},\"mcpPersistentAlwaysAllow\":{\"status\":\"supported\"},\"epitaxyMcpApps\":{\"status\":\"supported\"},\"sideSessions\":{\"status\":\"unavailable\"}}" --desktop-managed-config="{\"forceLoginOrgUUIDs\":null,\"loginSsoOrgDomain\":null,\"disableEssentialTelemetry\":false,\"disableNonessentialTelemetry\":false,\"disableMobileSimulatorTools\":false,\"banner\":null,\"deploymentDisplayName\":null,\"deploymentDisplaySubtitle\":null,\"dictationAvailable\":false,\"userPluginMarketplacesEnabled\":true,\"userPluginUploadsEnabled\":true,\"configDeprecations\":[],\"configDeprecationNoticesSuppressed\":false,\"configOrgDelivered\":false,\"deploymentMode\":\"1p\",\"appVersion\":\"1.44121.4\",\"cookielessOrigin\":false,\"deviceClass\":\"16\",\"extensionsEnabled\":true,\"localExtensionInstallAllowed\":true}" /prefetch:1
  2⤵
  PID:6048
- C:\Program Files\WindowsApps\Claude_1.44121.4.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.44121.4.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --app-user-model-id=Claude_pzs8sxrjxfjjc!Claude --app-path="C:\Program Files\WindowsApps\Claude_1.44121.4.0_x64__pzs8sxrjxfjjc\app\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --time-ticks-at-unix-epoch=-1788437888992086 --launch-time-ticks=629594568 --field-trial-handle=2360,i,11927642296953218121,15709801984058570906,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,IsolatesPriorityUseProcessPriority,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WebGPUService --variations-seed-version --pseudonymization-salt-handle=2364,i,14354453599588457200,4921765257666152989,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=4420 --desktop-features="{\"launch\":{\"status\":\"supported\"},\"coworkBrowser\":{\"status\":\"unsupported\",\"reason\":\"cowork_browser_disabled\",\"unsupportedCode\":\"unknown\"},\"artifactsPane\":{\"status\":\"unavailable\"},\"nativeQuickEntry\":{\"status\":\"unavailable\"},\"quickEntryDictation\":{\"status\":\"unavailable\"},\"quickEntryGlobalShortcut\":{\"status\":\"supported\"},\"customQuickEntryDictationShortcut\":{\"status\":\"supported\"},\"ultrareviewErrorCategories\":{\"status\":\"supported\"},\"spawnTaskPendingPop\":{\"status\":\"supported\"},\"spawnTaskInFlightIds\":{\"status\":\"supported\"},\"plushRaccoon\":{\"status\":\"unavailable\"},\"quietPenguin\":{\"status\":\"unavailable\"},\"rubberDuck\":{\"status\":\"unavailable\"},\"chillingSlothFeat\":{\"status\":\"supported\"},\"chillingSlothSshShell\":{\"status\":\"supported\"},\"chillingSlothSshWorktreeLocation\":{\"status\":\"supported\"},\"chillingSlothEnterprise\":{\"status\":\"supported\"},\"chillingSlothLocal\":{\"status\":\"supported\"},\"yukonSilver\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute, vfpext\",\"unsupportedCode\":\"hcs_not_available\"},\"yukonSilverGems\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute, vfpext\",\"unsupportedCode\":\"hcs_not_available\"},\"yukonSilverGemsCache\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute, vfpext\",\"unsupportedCode\":\"hcs_not_available\"},\"wakeScheduler\":{\"status\":\"unavailable\"},\"desktopTopBar\":{\"status\":\"supported\"},\"ccdPlugins\":{\"status\":\"supported\"},\"computerUse\":{\"status\":\"supported\"},\"computerUseComplianceGate\":{\"status\":\"supported\"},\"computerUseAppScoped\":{\"status\":\"unsupported\",\"reason\":\"Background app-scoped mode is macOS-only\",\"unsupportedCode\":\"unsupported_platform\"},\"coworkWatchRecord\":{\"status\":\"unavailable\"},\"coworkWatchers\":{\"status\":\"unavailable\"},\"coworkKappa\":{\"status\":\"unavailable\"},\"coworkArtifacts\":{\"status\":\"unavailable\"},\"coworkAutoModeAlwaysAllowOverride\":{\"status\":\"unavailable\"},\"framebufferPreview\":{\"status\":\"unavailable\"},\"iosSimulator\":{\"status\":\"unsupported\",\"reason\":\"iOS Simulator panel requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"androidEmulator\":{\"status\":\"unsupported\",\"reason\":\"Android emulator is disabled by its rollout flag\",\"unsupportedCode\":\"unknown\"},\"iosSimulatorH264\":{\"status\":\"unsupported\",\"reason\":\"iOS Simulator panel requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"grandPrix\":{\"status\":\"unavailable\"},\"ccdGitEngine\":{\"status\":\"unavailable\"},\"sessionPrOwnership\":{\"status\":\"unavailable\"},\"sessionFolderFileAccess\":{\"status\":\"supported\"},\"tearOffHalo\":{\"status\":\"unsupported\",\"reason\":\"Tear-off halo overlay requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"coworkArtifactPopout\":{\"status\":\"supported\"},\"sidePanePopoutNativeViews\":{\"status\":\"supported\"},\"popoutZoom\":{\"status\":\"supported\"},\"popoutTitleBarOverlay\":{\"status\":\"supported\"},\"filePreviewNativeViewRouting\":{\"status\":\"supported\"},\"claudeDesignWindow\":{\"status\":\"supported\"},\"coworkRemoteSessionSpaces\":{\"status\":\"supported\"},\"spaceMemoryBridge\":{\"status\":\"unavailable\"},\"grandPrixRequest\":{\"status\":\"unavailable\"},\"bootPlaceholder\":{\"status\":\"unsupported\",\"reason\":\"Boot placeholder disabled for this launch\",\"unsupportedCode\":\"unknown\"},\"coworkBranchSession\":{\"status\":\"supported\"},\"coworkScheduledTaskProjects\":{\"status\":\"supported\"},\"coworkLocalSessionProjects\":{\"status\":\"supported\"},\"sshAttachmentTransport\":{\"status\":\"supported\"},\"coworkSeededSummon\":{\"status\":\"supported\"},\"sessionMentions\":{\"status\":\"supported\"},\"wslForkSession\":{\"status\":\"unavailable\"},\"violinBow\":{\"status\":\"unavailable\"},\"violinBowHomeSettings\":{\"status\":\"unavailable\"},\"coworkThinkingInSend\":{\"status\":\"supported\"},\"bootstrapConfig\":{\"status\":\"supported\"},\"chatIn3p\":{\"status\":\"supported\"},\"surfaceTogglesPreview\":{\"status\":\"unavailable\"},\"chatTab\":{\"status\":\"unavailable\"},\"chatCodeExecution\":{\"status\":\"unavailable\"},\"mcpPersistentAlwaysAllow\":{\"status\":\"supported\"},\"epitaxyMcpApps\":{\"status\":\"supported\"},\"sideSessions\":{\"status\":\"unavailable\"}}" --desktop-managed-config="{\"forceLoginOrgUUIDs\":null,\"loginSsoOrgDomain\":null,\"disableEssentialTelemetry\":false,\"disableNonessentialTelemetry\":false,\"disableMobileSimulatorTools\":false,\"banner\":null,\"deploymentDisplayName\":null,\"deploymentDisplaySubtitle\":null,\"dictationAvailable\":false,\"userPluginMarketplacesEnabled\":true,\"userPluginUploadsEnabled\":true,\"configDeprecations\":[],\"configDeprecationNoticesSuppressed\":false,\"configOrgDelivered\":false,\"deploymentMode\":\"1p\",\"appVersion\":\"1.44121.4\",\"cookielessOrigin\":false,\"deviceClass\":\"16\",\"extensionsEnabled\":true,\"localExtensionInstallAllowed\":true}" /prefetch:1
  2⤵
  PID:7436
- C:\Program Files\WindowsApps\Claude_1.44121.4.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.44121.4.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --field-trial-handle=2360,i,11927642296953218121,15709801984058570906,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,IsolatesPriorityUseProcessPriority,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WebGPUService --variations-seed-version --pseudonymization-salt-handle=2364,i,14354453599588457200,4921765257666152989,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=3604 /prefetch:14
  2⤵
  - Modifies registry class
  PID:7648
- C:\Program Files\WindowsApps\Claude_1.44121.4.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.44121.4.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --field-trial-handle=2360,i,11927642296953218121,15709801984058570906,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,IsolatesPriorityUseProcessPriority,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WebGPUService --variations-seed-version --pseudonymization-salt-handle=2364,i,14354453599588457200,4921765257666152989,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=3624 /prefetch:12
  2⤵
  PID:7656

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

59d5fad4-b1a9-4888-b729-a84cfbc95a96.tmp

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Code Cache\js\index-dir\59d5fad4-b1a9-4888-b729-a84cfbc95a96.tmp
Size 48B
SHA256 a7b19ed6f9f2b8e92b329ef45a9052d1a65735209de4e030e22bf1095c382d47
MD5 3d4a2f8ca6e2d0073fd2465eb9def6e3
SHA1 3b58cee634347fb7a34b720814c7af1fd75efe2e
SHA512 d25c8989735aa6dd4b14ebbcee58ebe2c490844bb759315607a05bbce88f949f0a448bac8088571bd7b0a18e5a7bf4dcc6b45465ee3503b4adbd85468dc56a95
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0aca3ab8562f2aeedf95f30180cef03f5dbd1915c445e9395da20a9334a06db4
MD5 201bc4a9d49121d1a57ba2ecf06a973d
SHA1 04d7154833165a8893c225935feea7d0fc281034
SHA512 2239f56bf7fd61666a66fc757c7ed37a9c0cbc477da903ab0c114dad4862c97bb4d47f3daf3bd19c2e1c1434904690e12e596bb30c1383c67cd856b0f3130d80
TLSH
T10F71418A2498DA8DCB447DF046D154D7B273825E34674D497834E1B0C86D3DB173467F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Network\Network Persistent State
Size 2KB
SHA256 4d6df23b24a5033ba7f8aafa83e1b8f7c371bc221cd0853bf81bb678e4b2317e
MD5 6f2f4365a7e094028be2f80d889a4be4
SHA1 d4c3462e61f5c00a80e03600cd3f43c01b675ca3
SHA512 af8f489ef051d843a8686eb103c7b1b371bb6a19052413b91ce6b64f961ab19bf3601ddae2941179253674d50a0e304fdf56d214da9163c41a8c29a6a787857c
TLSH
T16041EFC7C3DA46AEC5622BF56F247A63C0BE1A1C93287C0BC8DADF8E67E1431560164D
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Partitions\launch-preview-static\Cache\Cache_Data\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Partitions\launch-preview-static\Cache\Cache_Data\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Partitions\launch-preview-static\Cache\Cache_Data\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Partitions\launch-preview-static\Cache\Cache_Data\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Partitions\launch-preview-static\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Partitions\launch-preview-static\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

450db2e8-41f9-4e48-845b-025af93fdf3d.tmp

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Partitions\launch-preview-static\Network\450db2e8-41f9-4e48-845b-025af93fdf3d.tmp
Size 84B
SHA256 712196693e3527ac1131831f1a2108b6c0e5c68967b26d51a452611cdfb86e0c
MD5 32b9dc9cc81d0682e78627c873fdd651
SHA1 46c486386d3e153c3e9b11d54cb52cf0064b71cf
SHA512 f18bc37f8b72411548da247aa1394cc5ac03c3bbd98e82eb8ba290ef239ef5b8625cf4835bd41ce7c52766d0bc3bfe9150dd22dbf62f0f05992ddde5fbfdc811
TLSH
T154A0121490405CFB0308835504146463C3F50002421848A91634318D019209D0004403
MD5 SHA1 SHA512 TLSH

Submit Download

689b034d-2a1d-4050-8ae7-bcc9925ed975.tmp

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Partitions\launch-preview-static\Network\689b034d-2a1d-4050-8ae7-bcc9925ed975.tmp
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Partitions\launch-preview-static\Network\Network Persistent State
Size 59B
SHA256 c257f929cff0e4380bf08d9f36f310753f7b1ccb5cb2ab811b52760dd8cb9572
MD5 78bfcecb05ed1904edce3b60cb5c7e62
SHA1 bf77a7461de9d41d12aa88fba056ba758793d9ce
SHA512 2420dff6eb853f5e1856cdab99561a896ea0743fcff3e04b37cb87eddf063770608a30c6ffb0319e5d353b0132c5f8135b7082488e425666b2c22b753a6a4d73
TLSH
T1D2A0026ADA612D881B4A839026187553807B0445130982FDE43877A841561AE582C865
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Partitions\launch-preview-static\Session Storage\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

032f6927-075f-41ed-a605-9ed8f23a4f6d.tmp

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\WebStorage\2\CacheStorage\032f6927-075f-41ed-a605-9ed8f23a4f6d.tmp
Size 176B
SHA256 edd48cd93026fd10279c56fdb6f4dc5fc28f95f1734ea2bf903aaf062766fd89
MD5 8d61dac06c402d4b8a9889e1ca490b20
SHA1 64a8c44cef781b00e09c8b90035078749d3e69a4
SHA512 4ad05b29c576a0e96eeeed26404a972a97e74a649de1e07b59920192360a56a7e2dfa5642fb36bcfb8801cfb458e542cc97550d3d63c172bd9dd56daaa6df8c4
TLSH
T11EC08CBB20D192C1AFA134EB6116F2C9C973BFC81CC1E74CAA623188B370C6A4600D24
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\WebStorage\2\CacheStorage\ed4e3b43-9081-49e2-92ab-fac85b455219\index-dir\the-real-index
Size 48B
SHA256 d3f21024e64954731a73858c3a985357c0232431f13c9325554b25524351a9dd
MD5 9db9a682ce9f979ada5a0eeff98c3dc7
SHA1 df03bd949ad03c667bbd72b50d08f294c51a90bf
SHA512 4b35f3daab43bb3389c854b164836355ba5815583f1d4e594646d6986e194eeeed5ecb8262c0fe8108e2207f8056f48c7ae0ad0dfc214aa53ec6530898853deb
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\WebStorage\2\CacheStorage\ed4e3b43-9081-49e2-92ab-fac85b455219\index-dir\the-real-index
Size 72B
SHA256 2a7fcab8e4494480a931662abd02955bd14220898493724d1949ba68174462c7
MD5 e19925fa6137828b707a87a1d78d05f3
SHA1 166f327482f1cf728018c3d91331b58a45b5052d
SHA512 b0a3fa65dbf99a77e1184f11b851b1d574bdeb6ed997a4677db9c576e227adabcb1bf5d553bdb02401431042c41b69700c31e5d6dca8190328b71001ecc96e99
TLSH
T14CA00254A3C610C6C01453B550451B927315CC540E13474755D04248CCE43D49A22119
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\WebStorage\2\CacheStorage\index.txt
Size 89B
SHA256 92cda5a28f4c1874bcf0aca7ca908e1234751120abf372f5a81cbb33590c3590
MD5 8684fe11e05213691ad78cf380e7c451
SHA1 1c075025a185041ddeb120c2c8e8cc2fe175d82b
SHA512 fd3ede8f008a3407360d649eb6c2c07c14454f2c17e823af53217c15baeb965494074dfff8b87acf24474839cdf9aab03c71be349e434dc6ba89e32b2a57bc55
TLSH
T1B2B002FF014156D15EA135E7100731DEC56376D85CC0EA4CD572105473104AD5401C24
MD5 SHA1 SHA512 TLSH

Submit Download

claude_desktop_config.json

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\claude_desktop_config.json
Size 115B
SHA256 ca0da0f68003cc22214c5590cdcfae27d06c7ae027cc2aaefc33bccb0c71eb7d
MD5 16b34c8598cdd1ae4107109c7a9873ba
SHA1 dc44c8c23710ce6824a73d55b2b208a5fe4e8b0c
SHA512 8db22d8c781ce4722609fc46ad599c658601edc06a68dc783a498a92ffcfd13599910fb7e1eae9e7619cd7e5f0f4461dbaf3f8ad94c2cdb9defab9c444b7d2e8
TLSH
T1C9B09B3454350F5616F653140D3E411797515AC315787424555D051D479552C6D16491
MD5 SHA1 SHA512 TLSH

Submit Download

claude_desktop_config.json.tmp

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\claude_desktop_config.json.tmp
Size 228B
SHA256 fa1cddf575574bf3febabc8f28f39a00bb3939c0182ac4d79190688659a378ad
MD5 ccbc038685f15dd2f109ca3e0e1925b8
SHA1 92dbb9d9fbe93613ae7ca2bfb4c9cf65205d092c
SHA512 61cbc9a60b821eec8494d06336b64e85fe176d17a5f3e43de12a3792f67d9b0690d938278656251f1b050f5b02b8f752df801ba5692d5f754bdee417e7042b0b
TLSH
T1F9D0A720D8350EA705F2A2584D2D8413570179D319287028A55F091C1FCC93C7935492
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\config.json
Size 42B
SHA256 8ed0df63cc5b11197863d86313e3de65ebac7a1f427f0333a606224d17014c08
MD5 daa8575b251bf03f47e990f7104074de
SHA1 2f607019cbe848d716ce908e12c234e28f2ea7e8
SHA512 eb731fc2d0874fe5a5852d66eabe20ca686cc64c1bc29265e24371e4245ad02c3e83f182f03da515b8f357d8a3423de6562a57b70e8de1a53c5af894e2504cce
MD5 SHA1 SHA512

Submit Download

config.json.tmp-8438515935c4c9ce

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\config.json.tmp-8438515935c4c9ce
Size 77B
SHA256 fe892b6cb7897bfb3c18272cda913088c5b5c1a2ecc5b4fba3468bc7b631efda
MD5 314d4180261df7d288675b68890758f9
SHA1 373466ca01af07af488fe6c3bc603952d09ffb4d
SHA512 52d53c667de7958892a12323f4a6b88b71c36ab3ed02a1df24dcb50091ca0159b917910ae4baa5a4a58ae7383c63590b93f42d664859105966e61c71e74fbd2e
TLSH
T1EFA0228CA82080038EAE8FFC888CC02F82AE030FC30B000000208B2FCC02B2CA08E302
MD5 SHA1 SHA512 TLSH

Submit Download

config.json.tmp-843851626030c90b

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\config.json.tmp-843851626030c90b
Size 121B
SHA256 cd1f3e9141bc386f8b7b78d109f886c0721abbfbcf9a94e6a15ed774b5a686d3
MD5 3758d202761b2cc2c3236fb3fb4071d6
SHA1 f7d9e63d0dc0b44a76a0f54431b03d0efb6850f0
SHA512 10877348339b0d5805226c6b4a5ab160563240c5839a812f28f54f14d7ce4576604cafcfcb99dfc6ed54e9bc94ba28c45ebc7c5787deee5ce3eb8c2ad640cef9
TLSH
T181B0924AA895D16385A2C3B84418C1CA836A920CE60604850A112B0ACEA07BCE21A688
MD5 SHA1 SHA512 TLSH

Submit Download

config.json.tmp-843851665240800e

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\config.json.tmp-843851665240800e
Size 141B
SHA256 4be47b240b6b055d4cc8b814d743a802833ae7da05e9c66ececa0d134f7c4906
MD5 50d32a789454cde24aeb0e0ce243b1b9
SHA1 be6d3685a0b574e84c4ab8c9c88de1dea0650613
SHA512 550e48acd0b6606a5d7bc651bcdbca6410862b840f228ada94edce78da8642d4af5ab5f46dd88f99a0dc48df118cb554774417cbe0d346f678f5d107f98fb094
TLSH
T17FC09B59D855D1534551C3FC4418C1CA8369511CF707188589527B05CDD57BCD15A745
MD5 SHA1 SHA512 TLSH

Submit Download

config.json.tmp-84385170889edf35

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\config.json.tmp-84385170889edf35
Size 174B
SHA256 4bdf6aba8a1be07f86608159ea116a42c865af1b002a6fc704684b5515d76a4d
MD5 0c1ac415a82580563bb63931634ee05b
SHA1 d6f1d26c61899e59f40b76f56c378005ad92e2f2
SHA512 f907b96331d64110988345d4fc095bf1661475bbcb2bfdfe8383a79bb129b737fceba09864434ecdfece0ab758c72399e836a71d0bd9d4acb3e7d15e83a665f4
TLSH
T1C1C08C5AE84191B34262C7FC0A0CC2CA8769410CEA4B1C89CA13BF09D9A57BDD50A681
MD5 SHA1 SHA512 TLSH

Submit Download

APPX.75pqzhbqfyhmwbfiw29vxcsvb.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX.75pqzhbqfyhmwbfiw29vxcsvb.tmp
Size 1.2MB
SHA256 3c8c889b92f2a63602c246169e048d0af703dfddae515cd41fc5d90a47d16bd0
MD5 baa0bc248b659eab0ca8d7738341959a
SHA1 f9e499da8fb06da0ad99b1c00bec04d0d4e873bd
SHA512 cd1de1ab03aad50b9a34eb8f599b30adbc2903b10ac15de807469a64b643503fba524b1631fc2908b0dd546e62521b31d4d70019d417e785912083b15417d8a8
SSDEEP 12288:MciIsNuREsM1QQgqdxVlyJNorBQvWpP9DxJUIxOVrfHl7SGkI4qH:wIsNEbQgESLoravWB9XUcap7QG
TLSH
T12745C8E1512DBE36816D0AED8F19F5002C35883653376E0E9C6EA2B318BF9725F674E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

APPX.885pma7f858eht73ven7ewzbd.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX.885pma7f858eht73ven7ewzbd.tmp
Size 9KB
SHA256 d07158e3f0bf0f22f5c0bf1d6db3890f143e01aab5757d4c5b192570d989fb1c
MD5 8858cbaa3869e8b9129c8cccd47af81e
SHA1 d125746bc698876a6f3d09890f698375b54afb4c
SHA512 eb89f97f1dee2b00fdfd724e1b9d1ad47952c207d6f844a31672c4fbfa9c16b573062786bd1d58a1c3148a3d3d14debae42b553d9cf676428f91e9c2e64cf100
SSDEEP 192:rJG1F4Ra8brotDxq6LBwYcwpzibTYp+bkk6W+Gkk63:rJG1F4Ra8brotDxTLBw/wpz1+bkk6W+Z
TLSH
T183221487E4EE58208571927ABE12D682EB180957949E41C0B89D4B433F62FBF03377D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

APPX.vrnfl9xjvwyq8plztb7wscppe.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX.vrnfl9xjvwyq8plztb7wscppe.tmp
Size 10KB
SHA256 66451e6abbb9c12eb2e121900bba49d82014f03b8101984ab0034134ff3605bb
MD5 7e652368e94bbe8c3be3c66617b7d667
SHA1 1301e1cf1b1b907a6b36f4b2214d60f168115da5
SHA512 1bc0207a4b5fb43e9f1347c07ec9411d163afb9c270e82438e919135464c1d119fa9fa0d002df00db398bc68cd49d78e9c09d2afc6fc88c2f703b4aea951daf0
SSDEEP 192:yMNyEIYiYF80dmL4pUQaULc8pq8RuX5hz28uNNTPKTac09hUz/y:3NyEIYi2mL4/y8RKE7ZcSuz/y
TLSH
T1B8224BA388946C05ED279D10B4C4A936EEB1B2966DD0D1C3B16DC166CB813873BDE2FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ClaudeSetup.log

Path C:\Users\Admin\AppData\Local\Temp\ClaudeSetup.log
Size 2KB
SHA256 6f8ace5296806f588b490b828eda0664ccdb251415a1a4a4cd1261a98699e459
MD5 63e393b6ce01d14c7ce02d6409b0657d
SHA1 555d1e9532b3275c7663e003617f17ce9663a91d
SHA512 90010bbc8243ed3c8cc29e0d34b82e788a4ed8f69b17f2a47c651a0ae61f7f4dfd709aa7cb8d44da787b8db7a094f008f9212b84f000ad84b250c5b337074c69
TLSH
T1FC51DC9FBCEBC8F057A20071ED291E07C99B3E15BE4C538576585E00962371EAF4E2D6
MD5 SHA1 SHA512 TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/1516-229-0x00007FFAA63F0000-0x00007FFAA63F1000-memory.dmp

Download

memory/1516-1708-0x0000016A81BB0000-0x0000016A81BDA000-memory.dmp

Download

memory/1516-230-0x0000016A81BE0000-0x0000016A81BE1000-memory.dmp

Download

memory/1704-232-0x000002385F300000-0x000002385F301000-memory.dmp

Download

memory/1704-1655-0x000002385F2D0000-0x000002385F2FA000-memory.dmp

Download

memory/6048-1709-0x00000218B5F20000-0x00000218B5F4A000-memory.dmp

Download

memory/6048-255-0x00000218B5F50000-0x00000218B5F51000-memory.dmp

Download

memory/7436-1783-0x0000017845490000-0x00000178454BA000-memory.dmp

Download

memory/7436-1653-0x00000178454C0000-0x00000178454C1000-memory.dmp

Download