097569960c142aeb6c11ba6f9e9ed822a710a609de73feb64be9282f9314aa89

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 18:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-04_0b47b5325197e3ec142cca0de7604b6c_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Size 6.8MB
Sample260905-xhvbrazhrc
SHA256 097569960c142aeb6c11ba6f9e9ed822a710a609de73feb64be9282f9314aa89
MD5 0b47b5325197e3ec142cca0de7604b6c
SHA1 844d5dccc0e5226ac2bae4871dd6ece0c38d23ab
SHA512 d9870ff40b57103e2eff705d988ad26f7c360badd25eb731b3fac42f066560c2f947505b7815a75cf9b5b1454934a611a8fcb16ec747958d8321ce3cde95c7ac
SSDEEP 49152:t64pYde+u1bCkBpkfFwjkdlp5ebiPTDDKUU80+6hwk8uPA5D0UjjyVtAv8nfKiK8:tZCLXaibDDfY+6aCK6bfLEpu
TLSH
T1BD663907ECA145E5C0A9E23489679253BB727C885B3123D72F90F7282F76BE06DB9750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_A53644FA0CAAA458C7A0416292C7CC5B	cowork-svc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB	cowork-svc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB	cowork-svc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	cowork-svc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	cowork-svc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_A53644FA0CAAA458C7A0416292C7CC5B	cowork-svc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	Claude.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	cowork-svc.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\claude	Claude.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\claude\URL Protocol	Claude.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\claude\ = "URL:claude"	Claude.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\claude\shell\open\command	Claude.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\claude\shell\open\command\ = "\"C:\\Program Files\\WindowsApps\\Claude_1.46388.4.0_x64__pzs8sxrjxfjjc\\app\\Claude.exe\" \"%1\""	Claude.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{1F2B7F1D-7AD2-4D59-B7AC-517E95C30B4D}	Claude.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\claude\shell	Claude.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\claude\shell\open	Claude.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4964	2026-09-04_0b47b5325197e3ec142cca0de7604b6c_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
4964	2026-09-04_0b47b5325197e3ec142cca0de7604b6c_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
3008	cowork-svc.exe
3008	cowork-svc.exe
2040	Claude.exe
2040	Claude.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2040	Claude.exe
Token: SeCreatePagefilePrivilege	2040	Claude.exe
Token: SeShutdownPrivilege	2040	Claude.exe
Token: SeCreatePagefilePrivilege	2040	Claude.exe
Token: SeShutdownPrivilege	2040	Claude.exe
Token: SeCreatePagefilePrivilege	2040	Claude.exe
Token: SeShutdownPrivilege	2040	Claude.exe
Token: SeCreatePagefilePrivilege	2040	Claude.exe
Token: SeShutdownPrivilege	2040	Claude.exe
Token: SeCreatePagefilePrivilege	2040	Claude.exe
Token: SeShutdownPrivilege	2040	Claude.exe
Token: SeCreatePagefilePrivilege	2040	Claude.exe
Token: SeShutdownPrivilege	2040	Claude.exe
Token: SeCreatePagefilePrivilege	2040	Claude.exe
Token: SeShutdownPrivilege	2040	Claude.exe
Token: SeCreatePagefilePrivilege	2040	Claude.exe
Token: SeShutdownPrivilege	2040	Claude.exe
Token: SeCreatePagefilePrivilege	2040	Claude.exe
Token: SeShutdownPrivilege	2040	Claude.exe
Token: SeCreatePagefilePrivilege	2040	Claude.exe
Token: SeShutdownPrivilege	2040	Claude.exe
Token: SeCreatePagefilePrivilege	2040	Claude.exe
Token: SeShutdownPrivilege	2040	Claude.exe
Token: SeCreatePagefilePrivilege	2040	Claude.exe
Token: SeShutdownPrivilege	2040	Claude.exe
Token: SeCreatePagefilePrivilege	2040	Claude.exe
Token: SeShutdownPrivilege	2040	Claude.exe
Token: SeCreatePagefilePrivilege	2040	Claude.exe
Token: SeShutdownPrivilege	2040	Claude.exe
Token: SeCreatePagefilePrivilege	2040	Claude.exe
Token: SeShutdownPrivilege	2040	Claude.exe
Token: SeCreatePagefilePrivilege	2040	Claude.exe
Token: SeShutdownPrivilege	2040	Claude.exe
Token: SeCreatePagefilePrivilege	2040	Claude.exe
Token: SeShutdownPrivilege	2040	Claude.exe
Token: SeCreatePagefilePrivilege	2040	Claude.exe
Token: SeShutdownPrivilege	2040	Claude.exe
Token: SeCreatePagefilePrivilege	2040	Claude.exe
Token: SeShutdownPrivilege	2040	Claude.exe
Token: SeCreatePagefilePrivilege	2040	Claude.exe
Token: SeShutdownPrivilege	2040	Claude.exe
Token: SeCreatePagefilePrivilege	2040	Claude.exe
Token: SeShutdownPrivilege	2040	Claude.exe
Token: SeCreatePagefilePrivilege	2040	Claude.exe
Token: SeShutdownPrivilege	2040	Claude.exe
Token: SeCreatePagefilePrivilege	2040	Claude.exe
Token: SeShutdownPrivilege	2040	Claude.exe
Token: SeCreatePagefilePrivilege	2040	Claude.exe
Token: SeShutdownPrivilege	2040	Claude.exe
Token: SeCreatePagefilePrivilege	2040	Claude.exe
Token: SeShutdownPrivilege	2040	Claude.exe
Token: SeCreatePagefilePrivilege	2040	Claude.exe
Token: SeShutdownPrivilege	2040	Claude.exe
Token: SeCreatePagefilePrivilege	2040	Claude.exe
Token: SeShutdownPrivilege	2040	Claude.exe
Token: SeCreatePagefilePrivilege	2040	Claude.exe
Token: SeShutdownPrivilege	2040	Claude.exe
Token: SeCreatePagefilePrivilege	2040	Claude.exe
Token: SeShutdownPrivilege	2040	Claude.exe
Token: SeCreatePagefilePrivilege	2040	Claude.exe
Token: SeShutdownPrivilege	2040	Claude.exe
Token: SeCreatePagefilePrivilege	2040	Claude.exe
Token: SeShutdownPrivilege	2040	Claude.exe
Token: SeCreatePagefilePrivilege	2040	Claude.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2040	Claude.exe
2040	Claude.exe
2040	Claude.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2040	Claude.exe
2040	Claude.exe
2040	Claude.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1776	explorer.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4544 wrote to memory of 4964	4544	2026-09-04_0b47b5325197e3ec142cca0de7604b6c_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	89
PID 4964 wrote to memory of 4436	4964	2026-09-04_0b47b5325197e3ec142cca0de7604b6c_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	94
PID 2040 wrote to memory of 5620	2040	Claude.exe	98
PID 2040 wrote to memory of 5132	2040	Claude.exe	99
PID 2040 wrote to memory of 880	2040	Claude.exe	100
PID 2040 wrote to memory of 3328	2040	Claude.exe	101
PID 2040 wrote to memory of 424	2040	Claude.exe	103
PID 2040 wrote to memory of 3276	2040	Claude.exe	104
PID 2040 wrote to memory of 4576	2040	Claude.exe	105
PID 2040 wrote to memory of 6432	2040	Claude.exe	107
PID 2040 wrote to memory of 6424	2040	Claude.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-09-04_0b47b5325197e3ec142cca0de7604b6c_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_0b47b5325197e3ec142cca0de7604b6c_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4544
- C:\Users\Admin\AppData\Local\Temp\2026-09-04_0b47b5325197e3ec142cca0de7604b6c_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-04_0b47b5325197e3ec142cca0de7604b6c_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe" --elevated --msix-path "C:\Users\Admin\AppData\Local\Temp\Claude-1826921221.msix" --log-path "C:\Users\Admin\AppData\Local\Temp\ClaudeSetup.log" --all-users
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4964
- - C:\Windows\explorer.exe
    explorer.exe shell:AppsFolder\Claude_pzs8sxrjxfjjc!Claude
    3⤵
    PID:4436

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1868

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness
1⤵
PID:1668

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1776

C:\Program Files\WindowsApps\Claude_1.46388.4.0_x64__pzs8sxrjxfjjc\app\resources\cowork-svc.exe
"C:\Program Files\WindowsApps\Claude_1.46388.4.0_x64__pzs8sxrjxfjjc\app\resources\cowork-svc.exe"
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3008

C:\Program Files\WindowsApps\Claude_1.46388.4.0_x64__pzs8sxrjxfjjc\app\Claude.exe
"C:\Program Files\WindowsApps\Claude_1.46388.4.0_x64__pzs8sxrjxfjjc\app\Claude.exe"
1⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Program Files\WindowsApps\Claude_1.46388.4.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.46388.4.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\Claude /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\Claude\Crashpad --url=https://f.a.k/e --annotation=_productName=Claude --annotation=_version=1.46388.4 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=42.10.0 --initial-client-data=0x4d8,0x4dc,0x4e0,0x4d4,0x4e4,0x7ff681183208,0x7ff681183218,0x7ff681183228
  2⤵
  PID:5620
- C:\Program Files\WindowsApps\Claude_1.46388.4.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.46388.4.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2132,i,13457532176397360065,13073147339570736248,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,IsolatesPriorityUseProcessPriority,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WebGPUService --variations-seed-version --pseudonymization-salt-handle=2136,i,2490812346202152852,9633139260400719026,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:5132
- C:\Program Files\WindowsApps\Claude_1.46388.4.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.46388.4.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --field-trial-handle=2132,i,13457532176397360065,13073147339570736248,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,IsolatesPriorityUseProcessPriority,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WebGPUService --variations-seed-version --pseudonymization-salt-handle=2136,i,2490812346202152852,9633139260400719026,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2168 /prefetch:11
  2⤵
  PID:880
- C:\Program Files\WindowsApps\Claude_1.46388.4.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.46388.4.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --app-user-model-id=Claude_pzs8sxrjxfjjc!Claude --app-path="C:\Program Files\WindowsApps\Claude_1.46388.4.0_x64__pzs8sxrjxfjjc\app\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2132,i,13457532176397360065,13073147339570736248,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,IsolatesPriorityUseProcessPriority,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WebGPUService --variations-seed-version --pseudonymization-salt-handle=2136,i,2490812346202152852,9633139260400719026,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=3316 --desktop-managed-config="{\"forceLoginOrgUUIDs\":null,\"loginSsoOrgDomain\":null,\"disableEssentialTelemetry\":false,\"disableNonessentialTelemetry\":false,\"disableMobileSimulatorTools\":false,\"banner\":null,\"deploymentDisplayName\":null,\"deploymentDisplaySubtitle\":null,\"dictationAvailable\":false,\"userPluginMarketplacesEnabled\":true,\"userPluginUploadsEnabled\":true,\"configDeprecations\":[],\"configDeprecationNoticesSuppressed\":false,\"configOrgDelivered\":false,\"deploymentMode\":\"1p\",\"appVersion\":\"1.46388.4\",\"cookielessOrigin\":false,\"deviceClass\":\"16\",\"extensionsEnabled\":true,\"localExtensionInstallAllowed\":true}" --desktop-boot-placeholder="{\"enabled\":false}" /prefetch:1
  2⤵
  PID:3328
- C:\Program Files\WindowsApps\Claude_1.46388.4.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.46388.4.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --app-user-model-id=Claude_pzs8sxrjxfjjc!Claude --app-path="C:\Program Files\WindowsApps\Claude_1.46388.4.0_x64__pzs8sxrjxfjjc\app\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2132,i,13457532176397360065,13073147339570736248,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,IsolatesPriorityUseProcessPriority,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WebGPUService --variations-seed-version --pseudonymization-salt-handle=2136,i,2490812346202152852,9633139260400719026,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3356 --desktop-features="{\"launch\":{\"status\":\"supported\"},\"coworkBrowser\":{\"status\":\"unsupported\",\"reason\":\"cowork_browser_disabled\",\"unsupportedCode\":\"unknown\"},\"artifactsPane\":{\"status\":\"unavailable\"},\"nativeQuickEntry\":{\"status\":\"unavailable\"},\"quickEntryDictation\":{\"status\":\"unavailable\"},\"quickEntryGlobalShortcut\":{\"status\":\"supported\"},\"customQuickEntryDictationShortcut\":{\"status\":\"supported\"},\"ultrareviewErrorCategories\":{\"status\":\"supported\"},\"spawnTaskPendingPop\":{\"status\":\"supported\"},\"spawnTaskInFlightIds\":{\"status\":\"supported\"},\"plushRaccoon\":{\"status\":\"unavailable\"},\"quietPenguin\":{\"status\":\"unavailable\"},\"rubberDuck\":{\"status\":\"unavailable\"},\"chillingSlothFeat\":{\"status\":\"supported\"},\"chillingSlothSshShell\":{\"status\":\"supported\"},\"chillingSlothSshWorktreeLocation\":{\"status\":\"supported\"},\"chillingSlothEnterprise\":{\"status\":\"supported\"},\"chillingSlothLocal\":{\"status\":\"supported\"},\"yukonSilver\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute, vfpext\",\"unsupportedCode\":\"hcs_not_available\"},\"yukonSilverGems\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute, vfpext\",\"unsupportedCode\":\"hcs_not_available\"},\"yukonSilverGemsCache\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute, vfpext\",\"unsupportedCode\":\"hcs_not_available\"},\"wakeScheduler\":{\"status\":\"unavailable\"},\"codeSessionKeepAwake\":{\"status\":\"supported\"},\"desktopTopBar\":{\"status\":\"supported\"},\"ccdPlugins\":{\"status\":\"supported\"},\"computerUse\":{\"status\":\"supported\"},\"computerUseComplianceGate\":{\"status\":\"supported\"},\"computerUseAppScoped\":{\"status\":\"unsupported\",\"reason\":\"Background app-scoped mode is macOS-only\",\"unsupportedCode\":\"unsupported_platform\"},\"coworkWatchRecord\":{\"status\":\"unavailable\"},\"coworkWatchers\":{\"status\":\"unavailable\"},\"coworkKappa\":{\"status\":\"unavailable\"},\"coworkArtifacts\":{\"status\":\"unavailable\"},\"coworkAutoModeAlwaysAllowOverride\":{\"status\":\"unavailable\"},\"framebufferPreview\":{\"status\":\"unavailable\"},\"iosSimulator\":{\"status\":\"unsupported\",\"reason\":\"iOS Simulator panel requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"androidEmulator\":{\"status\":\"unsupported\",\"reason\":\"Android emulator is disabled by its rollout flag\",\"unsupportedCode\":\"unknown\"},\"iosSimulatorH264\":{\"status\":\"unsupported\",\"reason\":\"iOS Simulator panel requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"grandPrix\":{\"status\":\"unavailable\"},\"ccdGitEngine\":{\"status\":\"unavailable\"},\"sessionPrOwnership\":{\"status\":\"unavailable\"},\"sessionFolderFileAccess\":{\"status\":\"supported\"},\"tearOffHalo\":{\"status\":\"unsupported\",\"reason\":\"Tear-off halo overlay requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"coworkArtifactPopout\":{\"status\":\"supported\"},\"sidePanePopoutNativeViews\":{\"status\":\"supported\"},\"popoutZoom\":{\"status\":\"supported\"},\"popoutTitleBarOverlay\":{\"status\":\"supported\"},\"filePreviewNativeViewRouting\":{\"status\":\"supported\"},\"claudeDesignWindow\":{\"status\":\"supported\"},\"coworkRemoteSessionSpaces\":{\"status\":\"supported\"},\"spaceMemoryBridge\":{\"status\":\"unavailable\"},\"multiAccount\":{\"status\":\"unavailable\"},\"grandPrixRequest\":{\"status\":\"unavailable\"},\"bootPlaceholder\":{\"status\":\"unsupported\",\"reason\":\"Boot placeholder disabled for this launch\",\"unsupportedCode\":\"unknown\"},\"coworkBranchSession\":{\"status\":\"supported\"},\"coworkScheduledTaskProjects\":{\"status\":\"supported\"},\"coworkLocalSessionProjects\":{\"status\":\"supported\"},\"sshAttachmentTransport\":{\"status\":\"supported\"},\"coworkSeededSummon\":{\"status\":\"supported\"},\"sessionMentions\":{\"status\":\"supported\"},\"wslForkSession\":{\"status\":\"unavailable\"},\"violinBow\":{\"status\":\"unavailable\"},\"violinBowHomeSettings\":{\"status\":\"unavailable\"},\"coworkThinkingInSend\":{\"status\":\"supported\"},\"bootstrapConfig\":{\"status\":\"supported\"},\"chatIn3p\":{\"status\":\"supported\"},\"surfaceTogglesPreview\":{\"status\":\"unavailable\"},\"chatTab\":{\"status\":\"unavailable\"},\"chatCodeExecution\":{\"status\":\"unavailable\"},\"mcpPersistentAlwaysAllow\":{\"status\":\"supported\"},\"epitaxyMcpApps\":{\"status\":\"supported\"},\"sideSessions\":{\"status\":\"unavailable\"}}" --desktop-managed-config="{\"forceLoginOrgUUIDs\":null,\"loginSsoOrgDomain\":null,\"disableEssentialTelemetry\":false,\"disableNonessentialTelemetry\":false,\"disableMobileSimulatorTools\":false,\"banner\":null,\"deploymentDisplayName\":null,\"deploymentDisplaySubtitle\":null,\"dictationAvailable\":false,\"userPluginMarketplacesEnabled\":true,\"userPluginUploadsEnabled\":true,\"configDeprecations\":[],\"configDeprecationNoticesSuppressed\":false,\"configOrgDelivered\":false,\"deploymentMode\":\"1p\",\"appVersion\":\"1.46388.4\",\"cookielessOrigin\":false,\"deviceClass\":\"16\",\"extensionsEnabled\":true,\"localExtensionInstallAllowed\":true}" /prefetch:1
  2⤵
  PID:424
- C:\Program Files\WindowsApps\Claude_1.46388.4.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.46388.4.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --app-user-model-id=Claude_pzs8sxrjxfjjc!Claude --app-path="C:\Program Files\WindowsApps\Claude_1.46388.4.0_x64__pzs8sxrjxfjjc\app\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2132,i,13457532176397360065,13073147339570736248,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,IsolatesPriorityUseProcessPriority,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WebGPUService --variations-seed-version --pseudonymization-salt-handle=2136,i,2490812346202152852,9633139260400719026,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3956 --desktop-features="{\"launch\":{\"status\":\"supported\"},\"coworkBrowser\":{\"status\":\"unsupported\",\"reason\":\"cowork_browser_disabled\",\"unsupportedCode\":\"unknown\"},\"artifactsPane\":{\"status\":\"unavailable\"},\"nativeQuickEntry\":{\"status\":\"unavailable\"},\"quickEntryDictation\":{\"status\":\"unavailable\"},\"quickEntryGlobalShortcut\":{\"status\":\"supported\"},\"customQuickEntryDictationShortcut\":{\"status\":\"supported\"},\"ultrareviewErrorCategories\":{\"status\":\"supported\"},\"spawnTaskPendingPop\":{\"status\":\"supported\"},\"spawnTaskInFlightIds\":{\"status\":\"supported\"},\"plushRaccoon\":{\"status\":\"unavailable\"},\"quietPenguin\":{\"status\":\"unavailable\"},\"rubberDuck\":{\"status\":\"unavailable\"},\"chillingSlothFeat\":{\"status\":\"supported\"},\"chillingSlothSshShell\":{\"status\":\"supported\"},\"chillingSlothSshWorktreeLocation\":{\"status\":\"supported\"},\"chillingSlothEnterprise\":{\"status\":\"supported\"},\"chillingSlothLocal\":{\"status\":\"supported\"},\"yukonSilver\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute, vfpext\",\"unsupportedCode\":\"hcs_not_available\"},\"yukonSilverGems\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute, vfpext\",\"unsupportedCode\":\"hcs_not_available\"},\"yukonSilverGemsCache\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute, vfpext\",\"unsupportedCode\":\"hcs_not_available\"},\"wakeScheduler\":{\"status\":\"unavailable\"},\"codeSessionKeepAwake\":{\"status\":\"supported\"},\"desktopTopBar\":{\"status\":\"supported\"},\"ccdPlugins\":{\"status\":\"supported\"},\"computerUse\":{\"status\":\"supported\"},\"computerUseComplianceGate\":{\"status\":\"supported\"},\"computerUseAppScoped\":{\"status\":\"unsupported\",\"reason\":\"Background app-scoped mode is macOS-only\",\"unsupportedCode\":\"unsupported_platform\"},\"coworkWatchRecord\":{\"status\":\"unavailable\"},\"coworkWatchers\":{\"status\":\"unavailable\"},\"coworkKappa\":{\"status\":\"unavailable\"},\"coworkArtifacts\":{\"status\":\"unavailable\"},\"coworkAutoModeAlwaysAllowOverride\":{\"status\":\"unavailable\"},\"framebufferPreview\":{\"status\":\"unavailable\"},\"iosSimulator\":{\"status\":\"unsupported\",\"reason\":\"iOS Simulator panel requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"androidEmulator\":{\"status\":\"unsupported\",\"reason\":\"Android emulator is disabled by its rollout flag\",\"unsupportedCode\":\"unknown\"},\"iosSimulatorH264\":{\"status\":\"unsupported\",\"reason\":\"iOS Simulator panel requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"grandPrix\":{\"status\":\"unavailable\"},\"ccdGitEngine\":{\"status\":\"unavailable\"},\"sessionPrOwnership\":{\"status\":\"unavailable\"},\"sessionFolderFileAccess\":{\"status\":\"supported\"},\"tearOffHalo\":{\"status\":\"unsupported\",\"reason\":\"Tear-off halo overlay requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"coworkArtifactPopout\":{\"status\":\"supported\"},\"sidePanePopoutNativeViews\":{\"status\":\"supported\"},\"popoutZoom\":{\"status\":\"supported\"},\"popoutTitleBarOverlay\":{\"status\":\"supported\"},\"filePreviewNativeViewRouting\":{\"status\":\"supported\"},\"claudeDesignWindow\":{\"status\":\"supported\"},\"coworkRemoteSessionSpaces\":{\"status\":\"supported\"},\"spaceMemoryBridge\":{\"status\":\"unavailable\"},\"multiAccount\":{\"status\":\"unavailable\"},\"grandPrixRequest\":{\"status\":\"unavailable\"},\"bootPlaceholder\":{\"status\":\"unsupported\",\"reason\":\"Boot placeholder disabled for this launch\",\"unsupportedCode\":\"unknown\"},\"coworkBranchSession\":{\"status\":\"supported\"},\"coworkScheduledTaskProjects\":{\"status\":\"supported\"},\"coworkLocalSessionProjects\":{\"status\":\"supported\"},\"sshAttachmentTransport\":{\"status\":\"supported\"},\"coworkSeededSummon\":{\"status\":\"supported\"},\"sessionMentions\":{\"status\":\"supported\"},\"wslForkSession\":{\"status\":\"unavailable\"},\"violinBow\":{\"status\":\"unavailable\"},\"violinBowHomeSettings\":{\"status\":\"unavailable\"},\"coworkThinkingInSend\":{\"status\":\"supported\"},\"bootstrapConfig\":{\"status\":\"supported\"},\"chatIn3p\":{\"status\":\"supported\"},\"surfaceTogglesPreview\":{\"status\":\"unavailable\"},\"chatTab\":{\"status\":\"unavailable\"},\"chatCodeExecution\":{\"status\":\"unavailable\"},\"mcpPersistentAlwaysAllow\":{\"status\":\"supported\"},\"epitaxyMcpApps\":{\"status\":\"supported\"},\"sideSessions\":{\"status\":\"unavailable\"}}" --desktop-managed-config="{\"forceLoginOrgUUIDs\":null,\"loginSsoOrgDomain\":null,\"disableEssentialTelemetry\":false,\"disableNonessentialTelemetry\":false,\"disableMobileSimulatorTools\":false,\"banner\":null,\"deploymentDisplayName\":null,\"deploymentDisplaySubtitle\":null,\"dictationAvailable\":false,\"userPluginMarketplacesEnabled\":true,\"userPluginUploadsEnabled\":true,\"configDeprecations\":[],\"configDeprecationNoticesSuppressed\":false,\"configOrgDelivered\":false,\"deploymentMode\":\"1p\",\"appVersion\":\"1.46388.4\",\"cookielessOrigin\":false,\"deviceClass\":\"16\",\"extensionsEnabled\":true,\"localExtensionInstallAllowed\":true}" /prefetch:1
  2⤵
  PID:3276
- C:\Program Files\WindowsApps\Claude_1.46388.4.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.46388.4.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --app-user-model-id=Claude_pzs8sxrjxfjjc!Claude --app-path="C:\Program Files\WindowsApps\Claude_1.46388.4.0_x64__pzs8sxrjxfjjc\app\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=2132,i,13457532176397360065,13073147339570736248,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,IsolatesPriorityUseProcessPriority,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WebGPUService --variations-seed-version --pseudonymization-salt-handle=2136,i,2490812346202152852,9633139260400719026,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=4472 --desktop-features="{\"launch\":{\"status\":\"supported\"},\"coworkBrowser\":{\"status\":\"unsupported\",\"reason\":\"cowork_browser_disabled\",\"unsupportedCode\":\"unknown\"},\"artifactsPane\":{\"status\":\"unavailable\"},\"nativeQuickEntry\":{\"status\":\"unavailable\"},\"quickEntryDictation\":{\"status\":\"unavailable\"},\"quickEntryGlobalShortcut\":{\"status\":\"supported\"},\"customQuickEntryDictationShortcut\":{\"status\":\"supported\"},\"ultrareviewErrorCategories\":{\"status\":\"supported\"},\"spawnTaskPendingPop\":{\"status\":\"supported\"},\"spawnTaskInFlightIds\":{\"status\":\"supported\"},\"plushRaccoon\":{\"status\":\"unavailable\"},\"quietPenguin\":{\"status\":\"unavailable\"},\"rubberDuck\":{\"status\":\"unavailable\"},\"chillingSlothFeat\":{\"status\":\"supported\"},\"chillingSlothSshShell\":{\"status\":\"supported\"},\"chillingSlothSshWorktreeLocation\":{\"status\":\"supported\"},\"chillingSlothEnterprise\":{\"status\":\"supported\"},\"chillingSlothLocal\":{\"status\":\"supported\"},\"yukonSilver\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute, vfpext\",\"unsupportedCode\":\"hcs_not_available\"},\"yukonSilverGems\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute, vfpext\",\"unsupportedCode\":\"hcs_not_available\"},\"yukonSilverGemsCache\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute, vfpext\",\"unsupportedCode\":\"hcs_not_available\"},\"wakeScheduler\":{\"status\":\"unavailable\"},\"codeSessionKeepAwake\":{\"status\":\"supported\"},\"desktopTopBar\":{\"status\":\"supported\"},\"ccdPlugins\":{\"status\":\"supported\"},\"computerUse\":{\"status\":\"supported\"},\"computerUseComplianceGate\":{\"status\":\"supported\"},\"computerUseAppScoped\":{\"status\":\"unsupported\",\"reason\":\"Background app-scoped mode is macOS-only\",\"unsupportedCode\":\"unsupported_platform\"},\"coworkWatchRecord\":{\"status\":\"unavailable\"},\"coworkWatchers\":{\"status\":\"unavailable\"},\"coworkKappa\":{\"status\":\"unavailable\"},\"coworkArtifacts\":{\"status\":\"unavailable\"},\"coworkAutoModeAlwaysAllowOverride\":{\"status\":\"unavailable\"},\"framebufferPreview\":{\"status\":\"unavailable\"},\"iosSimulator\":{\"status\":\"unsupported\",\"reason\":\"iOS Simulator panel requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"androidEmulator\":{\"status\":\"unsupported\",\"reason\":\"Android emulator is disabled by its rollout flag\",\"unsupportedCode\":\"unknown\"},\"iosSimulatorH264\":{\"status\":\"unsupported\",\"reason\":\"iOS Simulator panel requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"grandPrix\":{\"status\":\"unavailable\"},\"ccdGitEngine\":{\"status\":\"unavailable\"},\"sessionPrOwnership\":{\"status\":\"unavailable\"},\"sessionFolderFileAccess\":{\"status\":\"supported\"},\"tearOffHalo\":{\"status\":\"unsupported\",\"reason\":\"Tear-off halo overlay requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"coworkArtifactPopout\":{\"status\":\"supported\"},\"sidePanePopoutNativeViews\":{\"status\":\"supported\"},\"popoutZoom\":{\"status\":\"supported\"},\"popoutTitleBarOverlay\":{\"status\":\"supported\"},\"filePreviewNativeViewRouting\":{\"status\":\"supported\"},\"claudeDesignWindow\":{\"status\":\"supported\"},\"coworkRemoteSessionSpaces\":{\"status\":\"supported\"},\"spaceMemoryBridge\":{\"status\":\"unavailable\"},\"multiAccount\":{\"status\":\"unavailable\"},\"grandPrixRequest\":{\"status\":\"unavailable\"},\"bootPlaceholder\":{\"status\":\"unsupported\",\"reason\":\"Boot placeholder disabled for this launch\",\"unsupportedCode\":\"unknown\"},\"coworkBranchSession\":{\"status\":\"supported\"},\"coworkScheduledTaskProjects\":{\"status\":\"supported\"},\"coworkLocalSessionProjects\":{\"status\":\"supported\"},\"sshAttachmentTransport\":{\"status\":\"supported\"},\"coworkSeededSummon\":{\"status\":\"supported\"},\"sessionMentions\":{\"status\":\"supported\"},\"wslForkSession\":{\"status\":\"unavailable\"},\"violinBow\":{\"status\":\"unavailable\"},\"violinBowHomeSettings\":{\"status\":\"unavailable\"},\"coworkThinkingInSend\":{\"status\":\"supported\"},\"bootstrapConfig\":{\"status\":\"supported\"},\"chatIn3p\":{\"status\":\"supported\"},\"surfaceTogglesPreview\":{\"status\":\"unavailable\"},\"chatTab\":{\"status\":\"unavailable\"},\"chatCodeExecution\":{\"status\":\"unavailable\"},\"mcpPersistentAlwaysAllow\":{\"status\":\"supported\"},\"epitaxyMcpApps\":{\"status\":\"supported\"},\"sideSessions\":{\"status\":\"unavailable\"}}" --desktop-managed-config="{\"forceLoginOrgUUIDs\":null,\"loginSsoOrgDomain\":null,\"disableEssentialTelemetry\":false,\"disableNonessentialTelemetry\":false,\"disableMobileSimulatorTools\":false,\"banner\":null,\"deploymentDisplayName\":null,\"deploymentDisplaySubtitle\":null,\"dictationAvailable\":false,\"userPluginMarketplacesEnabled\":true,\"userPluginUploadsEnabled\":true,\"configDeprecations\":[],\"configDeprecationNoticesSuppressed\":false,\"configOrgDelivered\":false,\"deploymentMode\":\"1p\",\"appVersion\":\"1.46388.4\",\"cookielessOrigin\":false,\"deviceClass\":\"16\",\"extensionsEnabled\":true,\"localExtensionInstallAllowed\":true}" /prefetch:1
  2⤵
  PID:4576
- C:\Program Files\WindowsApps\Claude_1.46388.4.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.46388.4.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --field-trial-handle=2132,i,13457532176397360065,13073147339570736248,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,IsolatesPriorityUseProcessPriority,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WebGPUService --variations-seed-version --pseudonymization-salt-handle=2136,i,2490812346202152852,9633139260400719026,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=3640 /prefetch:14
  2⤵
  - Modifies registry class
  PID:6424
- C:\Program Files\WindowsApps\Claude_1.46388.4.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.46388.4.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --field-trial-handle=2132,i,13457532176397360065,13073147339570736248,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,IsolatesPriorityUseProcessPriority,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WebGPUService --variations-seed-version --pseudonymization-salt-handle=2136,i,2490812346202152852,9633139260400719026,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=3692 /prefetch:12
  2⤵
  PID:6432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

381e0dc0-4599-4863-a8a3-20bc7476fbec.tmp

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Code Cache\js\index-dir\381e0dc0-4599-4863-a8a3-20bc7476fbec.tmp
Size 48B
SHA256 4fcd6cf138a770fc8a5e3083ca48660eaed6f61a4d55937c115cc3c457da2be7
MD5 f7b321fb3383ee689ebf606323c8cda5
SHA1 6d570dddd3dd0f5578aa37145127c58b80c6d76d
SHA512 a7560b637b108bee29cbc71b6dbac7d66ef49814037fd1283c78c6ec00e2138728f7ef395ee76e86beb387fcfdd981f766e12304fb4201bb003abb2a23d96685
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ab6e7fa854ec643b5981b222458cf32483f9a38ff305f8421b5fd90381a32d34
MD5 c90c65f55ceb2d01924e7a45d47912b8
SHA1 421a661b8da28c87444a025b6c90f9f0775843e7
SHA512 d67b1b78844fad4d205a8e13d746dee495ad108b5c8a5795cde51ba0a1c27af6ef9bc4286b88232dd096e5fbb1b0426ce5241f3330d0e8c570b1c4046c14d6ab
TLSH
T122810BAD4E9E8948EF197A70F1D70A573D767E4684335E4259EAD7B27DD2FB20120004
MD5 SHA1 SHA512 TLSH

Submit Download

7c553c49-842d-4492-8c32-2a503592e0bf.tmp

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Network\7c553c49-842d-4492-8c32-2a503592e0bf.tmp
Size 2KB
SHA256 1140f4f6bc1584c5e583ebf164ef68cfcbe1e608a4f6781f267ba7cad7966355
MD5 42a264bde71d86aed5d87679fe398c1b
SHA1 ab002f4383d3ede17a027196dac310225d0896f5
SHA512 6a6487051aa501a767a2b99db5cae5dd7c5fe3bdf0e21a1f4cca6afeb2812aa16b34a223084fd887a5dc70565eb6fc13b9b09bc23250493ee5662dc577c1bba9
TLSH
T1F041DFD3C6DD467E89622BF51F247AA3C0BE1A5C83187C078CD9DF8E57E1431660164D
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Partitions\launch-preview-static\Cache\Cache_Data\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Partitions\launch-preview-static\Cache\Cache_Data\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Partitions\launch-preview-static\Cache\Cache_Data\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Partitions\launch-preview-static\Cache\Cache_Data\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Partitions\launch-preview-static\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Partitions\launch-preview-static\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

cdec3132-de51-4be0-b514-5351100a269f.tmp

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Partitions\launch-preview-static\Network\cdec3132-de51-4be0-b514-5351100a269f.tmp
Size 84B
SHA256 712196693e3527ac1131831f1a2108b6c0e5c68967b26d51a452611cdfb86e0c
MD5 32b9dc9cc81d0682e78627c873fdd651
SHA1 46c486386d3e153c3e9b11d54cb52cf0064b71cf
SHA512 f18bc37f8b72411548da247aa1394cc5ac03c3bbd98e82eb8ba290ef239ef5b8625cf4835bd41ce7c52766d0bc3bfe9150dd22dbf62f0f05992ddde5fbfdc811
TLSH
T154A0121490405CFB0308835504146463C3F50002421848A91634318D019209D0004403
MD5 SHA1 SHA512 TLSH

Submit Download

d11537c9-d714-4c9b-b9ff-1dd7dfd48b04.tmp

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Partitions\launch-preview-static\Network\d11537c9-d714-4c9b-b9ff-1dd7dfd48b04.tmp
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Partitions\launch-preview-static\Session Storage\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

2e6c5797-6764-417b-8592-d846cd62c25f.tmp

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\WebStorage\2\CacheStorage\2e6c5797-6764-417b-8592-d846cd62c25f.tmp
Size 176B
SHA256 5264d15c6a14e6de27fb3fefb578214719a7e0e3007db78fa014239cada66f96
MD5 dda4768fdeb2b1a33c3d96a1c62be5b0
SHA1 884f9cd774d524845d5dc353aedff05881bfe04f
SHA512 481080cac7c5d71590daf953543f4380fd3079717ad3cc633533ff3033feee12a794bbd3dcec8aad235910e6cbc97c9cedca724459c117d8d4eb935331e6bc6f
TLSH
T1A7C08077118493817EA725D7214272D9CA363FD84CC0BA0C483230A43330C5D1501511
MD5 SHA1 SHA512 TLSH

Submit Download

55f98b21-4bf1-4efd-ada4-0ebe3b1bfca5.tmp

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\WebStorage\2\CacheStorage\5d73a1d8-dad9-4440-8795-a64e7ad42295\index-dir\55f98b21-4bf1-4efd-ada4-0ebe3b1bfca5.tmp
Size 48B
SHA256 5fed47076ccfc8ede105ae9b18596d1bae1c17d4c88ac19f7cba38bf666b347b
MD5 81d9538cd2a391e1c02a612f96b9ad80
SHA1 a4fb425b6a7b09df833c635a1ce044f70f50eccd
SHA512 26dfbe4ea325b2be8b16a1c0a4f2f667c892f889e9074fd72520c306bad3882a299c814de14da1f147efe0f2256b2aeb827ab2d4e0848f117f60dfa548aac643
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\WebStorage\2\CacheStorage\5d73a1d8-dad9-4440-8795-a64e7ad42295\index-dir\the-real-index
Size 72B
SHA256 1873322d29ed38b72887f2f1e58bfc38c32a6587e3c6929d4bc9adff52ca8765
MD5 a31dcbc3078c5af38a210d540b6007ba
SHA1 0378298f08836a174d657744020759bb35efedb2
SHA512 bcbaa619e7630a44a52707ca5785c8e25ad8ec317b2a90d7a96218409b5176ed04ca1686715c53fca594d0985621bcef7328305a99dbe690189bca756064b612
TLSH
T1C2A0029163861162C11C127554460BA63310E8A509034767459881498CA47C4A91144C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\WebStorage\2\CacheStorage\index.txt
Size 89B
SHA256 92cda5a28f4c1874bcf0aca7ca908e1234751120abf372f5a81cbb33590c3590
MD5 8684fe11e05213691ad78cf380e7c451
SHA1 1c075025a185041ddeb120c2c8e8cc2fe175d82b
SHA512 fd3ede8f008a3407360d649eb6c2c07c14454f2c17e823af53217c15baeb965494074dfff8b87acf24474839cdf9aab03c71be349e434dc6ba89e32b2a57bc55
TLSH
T1B2B002FF014156D15EA135E7100731DEC56376D85CC0EA4CD572105473104AD5401C24
MD5 SHA1 SHA512 TLSH

Submit Download

claude_desktop_config.json

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\claude_desktop_config.json
Size 213B
SHA256 908697c7b7bdb10e1b4792c26d12cc189520dbec34dc7a14d02abcc2d5a3b92a
MD5 be725c6ec8ab220b276b9a201205a118
SHA1 fd649e65da7a3710b9ac242022e48d2d6a2cb779
SHA512 490c84688d9681b7f85b8014b40f99cfd8be73c23fe95e71fc2aecd4607cbcecef689d99421bc8f95cb40ff7b1c9a62f32557cc89a4dfa2c2b9df69286cc76b4
TLSH
T1BCD02231F8261DFB0AB4206C8CACDE4308423433192C283CA0EA018C1F4CF3AB0750D3
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\config.json
Size 42B
SHA256 c21dda0345f62bbed2bdfbea93425f2a48cf45b92195faab7931e74d9be4b141
MD5 33ba2df319fe72d7d6818987d022e205
SHA1 e119bc38d115afb92d4d188d43ca01b0657cd8e0
SHA512 c5c7845eedf5e22db4adee61af0c135da3f6479a9802ee47180db775ba69360b0ec3b8545da8c6ebc868d3af254a4e75962042005867ba7d63f8005d1e6f7c01
MD5 SHA1 SHA512

Submit Download

config.json.tmp-863437246210fe8c

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\config.json.tmp-863437246210fe8c
Size 77B
SHA256 fbdcfaa87570af509145d3a358e621f60d5edabd3150dab7650ae49697b14cd0
MD5 331e593c9e1d3d5e296b0714d0f79702
SHA1 56e679b1551a628b0934d3e044475d7a2ec82dc5
SHA512 f2542c354e9b25763f9d4e227f5920c35a78982b18c99fb0e32777566e98fe88c6d466c1a6a640c90afea1e7d38a2e33dbcd53574c79ee0a11c80246f3cda6d9
TLSH
T12BA022CCA8A0C0028B0E03B88C8C288BCFAC030C8A0F00000808833ECE02B3C328A380
MD5 SHA1 SHA512 TLSH

Submit Download

config.json.tmp-8634372588ca26e4

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\config.json.tmp-8634372588ca26e4
Size 156B
SHA256 49a822454f512da9a498a17d5fb03ddb46ba059cd70c3cca4766653fea535887
MD5 b998a17e75bf1d1189220b96003e1639
SHA1 904c6ddaddd2cfe2617ecb12b95b360931fb738b
SHA512 51ffc330253b54e2f29476fa2eac5f5875131e7cba14435021ac51d3e210b3dde46ec17e4702220a078f4cc7ca1ee482edb895db964032eff3f62bfccd2acf20
TLSH
T15BC08C886890C053670F03748C4C89C78B38434E550B00400D245629CAE17BC7285790
MD5 SHA1 SHA512 TLSH

Submit Download

config.json.tmp-86343729934b3cd9

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\config.json.tmp-86343729934b3cd9
Size 97B
SHA256 cba54c4421aa518a082609aa636f74a198bb4331f3c24729a9f9aa0828b4154c
MD5 364ff189be013c247a33b0fa532a11fa
SHA1 66df603e407d22b47728b13399a51cc869f5ac2f
SHA512 dc97d91378b6bf2468c918a0075ee274aa773ed1fa0825357ed8c9203fcf33fad78b8e47b493f10fbfe5f2091f5fc931723fdf3924816287eb743ff1b60bc004
TLSH
T16AB0125894508003560D42EC4C4C08C686A8034C560F05010554E229C942B3C218A741
MD5 SHA1 SHA512 TLSH

Submit Download

config.json.tmp-8634376003089eae

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\config.json.tmp-8634376003089eae
Size 110B
SHA256 32fdb1d21554e944886278cace83e1eaf0153ef669cf19a610998adc7062c225
MD5 773e23be1b1865663865bd6c3669f83a
SHA1 b13c4a53082f5a1214d90121d6658f88f4683bbf
SHA512 58466b3be5d6f4d9599ee733beea7c2409ab1aa2cff252db51f95bf6d83808806d30830ea0b39d362d9212febf099f2dfd513f9ffbc2fe2f87a0be8ac58ab94e
TLSH
T116B01299D4508075572E0BEC4E4D6E578E68030C415F04404A09DB3DD91173E6946BD1
MD5 SHA1 SHA512 TLSH

Submit Download

APPX.88l3f_3jyxqc32v223j6r8c6f.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX.88l3f_3jyxqc32v223j6r8c6f.tmp
Size 9KB
SHA256 e55fa50f7a71adeab79751367a190c1c075dd43e2a8ec1bc99bbe9660a5b369e
MD5 23edbb4355fb1beab4e93c2175aeb89d
SHA1 15d7984b308e9ce20db203242d9207ac3b490141
SHA512 5943e9c5098c65d14846d4730e24b6c3ebb90c1db1a3d4c1793f1a04b7b1a1e5f505054b19bb9b6dbd08982e248b961eac44dd56d95bcb4392261ea2561fa221
SSDEEP 192:rJG1F4Ra8brotDKq6LBwYcwpzibTYp+bkk6W+Gkk63:rJG1F4Ra8brotDKTLBw/wpz1+bkk6W+Z
TLSH
T1B4221487E4EE58208571927ABE12D682EB180957949E41C0B89D4B433F62FBF03377D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

APPX.e47twb6zh6s0pb5r1nukhqknh.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX.e47twb6zh6s0pb5r1nukhqknh.tmp
Size 10KB
SHA256 db82d64cfec5aec8532b68e4323f39c42026e10f8255b380960be49b84d9b130
MD5 b216e2d8dcbed2ceffe35bab366c737f
SHA1 8dd118833aab0110235beeff794b443deb08e81c
SHA512 f2fe7c7e7b110bccada5d5606eb2b456695cfd778ad23bb863702179dd13eb0dbf009c517f2e4aa7a4ffc9df75e8a46593fc531c400f14b2ffaaadc8a0cefef9
SSDEEP 192:8mNyEIYiYF80dmL4pUQo78WzP7pDA+75hz28uNNTPKTPd4KZ1gJ7:TNyEIYi2mL46rA+rE7Ud3f2
TLSH
T1FB224AA38C945C45EE179D1074D8A53BEEB5728679D082C2B21EC14287983877FEE1FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

APPX.hrcfiz4gmbl8qstwam39a5cuc.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX.hrcfiz4gmbl8qstwam39a5cuc.tmp
Size 1.2MB
SHA256 311b847d379cbd1c9ba9fc7598977ee3c3a59d56e17b91e3924c76cfecf28986
MD5 61077b27a34e20749341f2afddd0317b
SHA1 cdfcd1391e015e27285918c20f1f016f53ecff8c
SHA512 19ca95b8ebcabc58f2b0a512986daac5f1fe50fb56c13fceb65e7596f8ddc1c89ebe600e16c6204e5ba2fbe78a49d56b298577182bacefe5148dea0ffec2889e
SSDEEP 12288:MciIsNuRwtpyWswZvnxueNVqAA1+GAA/f4rdxx/Uv7iJZr4Pl7SGkI4q6:wIsNEYptzxKEGAA/fOdTUv70s7QD
TLSH
T12C45B8E1512DBE36816D0AED8F29F5002C35883653376E0E9C6E92B318BF9725F674E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ClaudeSetup.log

Path C:\Users\Admin\AppData\Local\Temp\ClaudeSetup.log
Size 3KB
SHA256 8f7195dff92317620ee465238c99f8e22ec6af4b72ec6e39ea3f0d4ac920b5e3
MD5 8ecda8739859b15afbe5f751eceb7751
SHA1 6d3665210ea23e53ade3d61aab2eb9d9ec50de89
SHA512 245ada0a9a2ce99d58f14e8eec1588dd9de16990144f3c75cbf61ea7187bd6b6044ce7ecb5ae053543bd9e3d24660cac2159c904098210b669cdee9999ffcb2e
TLSH
T1FD81DD6844CE88F8325194A3D3B60A07538FBF1ABA6CD32837043548643173D7E49BDE
MD5 SHA1 SHA512 TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/1776-1096-0x0000000003520000-0x000000000377F000-memory.dmp

Download

memory/1776-1602-0x0000000003520000-0x000000000377F000-memory.dmp

Download

memory/3328-190-0x00007FFD3CBD0000-0x00007FFD3CBD1000-memory.dmp

Download

memory/3328-189-0x00007FFD3BF50000-0x00007FFD3BF51000-memory.dmp

Download