fe7d98ab8611eb7b50a3f44852554b987fc9181a24ea49ce0f2de2a1a96ee996

Analysis

max time kernel
150s
max time network
137s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/10/2026, 13:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-16_7b5640e0dbd6d9ab182ba890d01103ee_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Size 6.8MB
Sample261017-q7r5csvshy
SHA256 fe7d98ab8611eb7b50a3f44852554b987fc9181a24ea49ce0f2de2a1a96ee996
MD5 7b5640e0dbd6d9ab182ba890d01103ee
SHA1 d467bb653d3792dcccad229dd4114f312c916e99
SHA512 535ac9e0131faa0654983f6832420cb7158a8b68c018dacb30624c933025dfa745ee9e32e50e6f4af2cc701e2a2acdb10b89dc9ddd209fd30255284b9ec4e53f
SSDEEP 49152:+ylBbII6znLZ3JA/yKdXJ5Xz1KiFTpebQiZ0ahUJh6OML0KteEcmiK2JoWbj9htO:+Os3+7e/0aWJhygOk4pbiEB
TLSH
T1D2763907F89145E9C0ADE23589639252BBB27C885B3127D72F90F7282F76BE06D79740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB	cowork-svc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB	cowork-svc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	cowork-svc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	cowork-svc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DDCCB28E49D2ADDE2B322BB926E7FF2D	cowork-svc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_DDCCB28E49D2ADDE2B322BB926E7FF2D	cowork-svc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-16_7b5640e0dbd6d9ab182ba890d01103ee_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-16_7b5640e0dbd6d9ab182ba890d01103ee_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-16_7b5640e0dbd6d9ab182ba890d01103ee_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-16_7b5640e0dbd6d9ab182ba890d01103ee_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	Claude.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	cowork-svc.exe

Modifies registry class 45 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Applications\claude-desktop.exe\shell	Claude.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Applications\claude-desktop.exe\SupportedTypes\.pdf	Claude.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Applications\claude-desktop.exe\SupportedTypes\.log	Claude.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Applications\claude-desktop.exe\SupportedTypes\.gif	Claude.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Applications\claude-desktop.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\WindowsApps\\Claude_pzs8sxrjxfjjc\\claude-desktop.exe\" \"%1\""	Claude.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Applications\claude-desktop.exe\SupportedTypes\.csv	Claude.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Applications\claude-desktop.exe\SupportedTypes\.epub	Claude.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Applications\claude-desktop.exe\SupportedTypes\.png	Claude.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Applications\claude-desktop.exe\SupportedTypes\.jpg	Claude.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\claude	Claude.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\claude\URL Protocol	Claude.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\claude\shell	Claude.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Applications\claude-desktop.exe\shell\open	Claude.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Applications\claude-desktop.exe\SupportedTypes\.xlsx	Claude.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Applications\claude-desktop.exe\SupportedTypes\.xml	Claude.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Applications\claude-desktop.exe\SupportedTypes\.odt	Claude.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Applications	Claude.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Applications\claude-desktop.exe\shell\open\command	Claude.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Applications\claude-desktop.exe\SupportedTypes	Claude.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Applications\claude-desktop.exe\SupportedTypes\.doc	Claude.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Applications\claude-desktop.exe\SupportedTypes\.text	Claude.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Applications\claude-desktop.exe\SupportedTypes\.jpeg	Claude.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Applications\claude-desktop.exe\shell\open\MultiSelectModel = "Player"	Claude.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Applications\claude-desktop.exe\SupportedTypes\.xls	Claude.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Applications\claude-desktop.exe\SupportedTypes\.docx	Claude.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Applications\claude-desktop.exe\SupportedTypes\.pptx	Claude.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Applications\claude-desktop.exe\SupportedTypes\.txt	Claude.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Applications\claude-desktop.exe\SupportedTypes\.md	Claude.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Applications\claude-desktop.exe\SupportedTypes\.markdown	Claude.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Applications\claude-desktop.exe\FriendlyAppName = "Claude"	Claude.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Applications\claude-desktop.exe\SupportedTypes\.tsv	Claude.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Applications\claude-desktop.exe\SupportedTypes\.xlsm	Claude.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Applications\claude-desktop.exe\SupportedTypes\.json	Claude.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Applications\claude-desktop.exe\SupportedTypes\.webp	Claude.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\claude\ = "URL:claude"	Claude.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\claude\shell\open\command\ = "\"C:\\Program Files\\WindowsApps\\Claude_2.42304.0.0_x64__pzs8sxrjxfjjc\\app\\Claude.exe\" \"%1\""	Claude.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Applications\claude-desktop.exe	Claude.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\claude\shell\open\command	Claude.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\claude\shell\open	Claude.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Applications\claude-desktop.exe\SupportedTypes\.yaml	Claude.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Applications\claude-desktop.exe\SupportedTypes\.yml	Claude.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Applications\claude-desktop.exe\SupportedTypes\.rtf	Claude.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Applications\claude-desktop.exe\SupportedTypes\.ppt	Claude.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4136	2026-10-16_7b5640e0dbd6d9ab182ba890d01103ee_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
4136	2026-10-16_7b5640e0dbd6d9ab182ba890d01103ee_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
916	cowork-svc.exe
916	cowork-svc.exe
2968	Claude.exe
2968	Claude.exe
2968	Claude.exe
2968	Claude.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2968	Claude.exe
Token: SeCreatePagefilePrivilege	2968	Claude.exe
Token: SeShutdownPrivilege	2968	Claude.exe
Token: SeCreatePagefilePrivilege	2968	Claude.exe
Token: SeShutdownPrivilege	2968	Claude.exe
Token: SeCreatePagefilePrivilege	2968	Claude.exe
Token: SeShutdownPrivilege	2968	Claude.exe
Token: SeCreatePagefilePrivilege	2968	Claude.exe
Token: SeShutdownPrivilege	2968	Claude.exe
Token: SeCreatePagefilePrivilege	2968	Claude.exe
Token: SeShutdownPrivilege	2968	Claude.exe
Token: SeCreatePagefilePrivilege	2968	Claude.exe
Token: SeShutdownPrivilege	2968	Claude.exe
Token: SeCreatePagefilePrivilege	2968	Claude.exe
Token: SeShutdownPrivilege	2968	Claude.exe
Token: SeCreatePagefilePrivilege	2968	Claude.exe
Token: SeShutdownPrivilege	2968	Claude.exe
Token: SeCreatePagefilePrivilege	2968	Claude.exe
Token: SeShutdownPrivilege	2968	Claude.exe
Token: SeCreatePagefilePrivilege	2968	Claude.exe
Token: SeShutdownPrivilege	2968	Claude.exe
Token: SeCreatePagefilePrivilege	2968	Claude.exe
Token: SeShutdownPrivilege	2968	Claude.exe
Token: SeCreatePagefilePrivilege	2968	Claude.exe
Token: SeShutdownPrivilege	2968	Claude.exe
Token: SeCreatePagefilePrivilege	2968	Claude.exe
Token: SeShutdownPrivilege	2968	Claude.exe
Token: SeCreatePagefilePrivilege	2968	Claude.exe
Token: SeShutdownPrivilege	2968	Claude.exe
Token: SeCreatePagefilePrivilege	2968	Claude.exe
Token: SeShutdownPrivilege	2968	Claude.exe
Token: SeCreatePagefilePrivilege	2968	Claude.exe
Token: SeShutdownPrivilege	2968	Claude.exe
Token: SeCreatePagefilePrivilege	2968	Claude.exe
Token: SeShutdownPrivilege	2968	Claude.exe
Token: SeCreatePagefilePrivilege	2968	Claude.exe
Token: SeShutdownPrivilege	2968	Claude.exe
Token: SeCreatePagefilePrivilege	2968	Claude.exe
Token: SeShutdownPrivilege	2968	Claude.exe
Token: SeCreatePagefilePrivilege	2968	Claude.exe
Token: SeShutdownPrivilege	2968	Claude.exe
Token: SeCreatePagefilePrivilege	2968	Claude.exe
Token: SeShutdownPrivilege	2968	Claude.exe
Token: SeCreatePagefilePrivilege	2968	Claude.exe
Token: SeShutdownPrivilege	2968	Claude.exe
Token: SeCreatePagefilePrivilege	2968	Claude.exe
Token: SeShutdownPrivilege	2968	Claude.exe
Token: SeCreatePagefilePrivilege	2968	Claude.exe
Token: SeShutdownPrivilege	2968	Claude.exe
Token: SeCreatePagefilePrivilege	2968	Claude.exe
Token: SeShutdownPrivilege	2968	Claude.exe
Token: SeCreatePagefilePrivilege	2968	Claude.exe
Token: SeShutdownPrivilege	2968	Claude.exe
Token: SeCreatePagefilePrivilege	2968	Claude.exe
Token: SeShutdownPrivilege	2968	Claude.exe
Token: SeCreatePagefilePrivilege	2968	Claude.exe
Token: SeShutdownPrivilege	2968	Claude.exe
Token: SeCreatePagefilePrivilege	2968	Claude.exe
Token: SeShutdownPrivilege	2968	Claude.exe
Token: SeCreatePagefilePrivilege	2968	Claude.exe
Token: SeShutdownPrivilege	2968	Claude.exe
Token: SeCreatePagefilePrivilege	2968	Claude.exe
Token: SeShutdownPrivilege	2968	Claude.exe
Token: SeCreatePagefilePrivilege	2968	Claude.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2968	Claude.exe
2968	Claude.exe
2968	Claude.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2968	Claude.exe
2968	Claude.exe
2968	Claude.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4780	explorer.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4568 wrote to memory of 4136	4568	2026-10-16_7b5640e0dbd6d9ab182ba890d01103ee_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	90
PID 4136 wrote to memory of 2320	4136	2026-10-16_7b5640e0dbd6d9ab182ba890d01103ee_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	94
PID 2968 wrote to memory of 3180	2968	Claude.exe	98
PID 2968 wrote to memory of 460	2968	Claude.exe	99
PID 2968 wrote to memory of 4816	2968	Claude.exe	100
PID 2968 wrote to memory of 2852	2968	Claude.exe	101
PID 2968 wrote to memory of 4980	2968	Claude.exe	102
PID 2968 wrote to memory of 5332	2968	Claude.exe	103
PID 2968 wrote to memory of 4824	2968	Claude.exe	105
PID 2968 wrote to memory of 2256	2968	Claude.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-10-16_7b5640e0dbd6d9ab182ba890d01103ee_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-16_7b5640e0dbd6d9ab182ba890d01103ee_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:4568
- C:\Users\Admin\AppData\Local\Temp\2026-10-16_7b5640e0dbd6d9ab182ba890d01103ee_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-16_7b5640e0dbd6d9ab182ba890d01103ee_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe" --elevated --msix-path "C:\Users\Admin\AppData\Local\Temp\Claude-3620363132.msix" --log-path "C:\Users\Admin\AppData\Local\Temp\ClaudeSetup.log" --all-users
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4136
- - C:\Windows\explorer.exe
    explorer.exe shell:AppsFolder\Claude_pzs8sxrjxfjjc!Claude
    3⤵
    PID:2320

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1456

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness
1⤵
PID:1632

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4780

C:\Program Files\WindowsApps\Claude_2.42304.0.0_x64__pzs8sxrjxfjjc\app\resources\cowork-svc.exe
"C:\Program Files\WindowsApps\Claude_2.42304.0.0_x64__pzs8sxrjxfjjc\app\resources\cowork-svc.exe"
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:916

C:\Program Files\WindowsApps\Claude_2.42304.0.0_x64__pzs8sxrjxfjjc\app\Claude.exe
"C:\Program Files\WindowsApps\Claude_2.42304.0.0_x64__pzs8sxrjxfjjc\app\Claude.exe"
1⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Program Files\WindowsApps\Claude_2.42304.0.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_2.42304.0.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\Claude /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\Claude\Crashpad --url=https://f.a.k/e --annotation=_productName=Claude --annotation=_version=2.42304.0 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=44.7.2 --initial-client-data=0x4e4,0x4e8,0x4ec,0x4e0,0x4f0,0x7ff6f9508898,0x7ff6f95088a8,0x7ff6f95088b8
  2⤵
  PID:3180
- C:\Program Files\WindowsApps\Claude_2.42304.0.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_2.42304.0.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --field-trial-handle=2104,i,4356282697539129121,4919723039506101747,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,DocumentPolicyIncludeJSCallStacksInCrashReports,IsolatesPriorityUseProcessPriority,PdfUseShowSaveFilePicker --disable-features=ConnectionAllowlists,DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2112,i,11092768600002444553,7907668024742386581,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:460
- C:\Program Files\WindowsApps\Claude_2.42304.0.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_2.42304.0.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --field-trial-handle=2104,i,4356282697539129121,4919723039506101747,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,DocumentPolicyIncludeJSCallStacksInCrashReports,IsolatesPriorityUseProcessPriority,PdfUseShowSaveFilePicker --disable-features=ConnectionAllowlists,DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2112,i,11092768600002444553,7907668024742386581,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2404 /prefetch:11
  2⤵
  PID:4816
- C:\Program Files\WindowsApps\Claude_2.42304.0.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_2.42304.0.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --app-user-model-id=Claude_pzs8sxrjxfjjc!Claude --app-path="C:\Program Files\WindowsApps\Claude_2.42304.0.0_x64__pzs8sxrjxfjjc\app\resources\app.asar" --enable-sandbox --blink-settings=dnsPrefetchingEnabled=false --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2104,i,4356282697539129121,4919723039506101747,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,DocumentPolicyIncludeJSCallStacksInCrashReports,IsolatesPriorityUseProcessPriority,PdfUseShowSaveFilePicker --disable-features=ConnectionAllowlists,DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2112,i,11092768600002444553,7907668024742386581,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2556 /prefetch:1
  2⤵
  PID:2852
- C:\Program Files\WindowsApps\Claude_2.42304.0.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_2.42304.0.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --app-user-model-id=Claude_pzs8sxrjxfjjc!Claude --app-path="C:\Program Files\WindowsApps\Claude_2.42304.0.0_x64__pzs8sxrjxfjjc\app\resources\app.asar" --enable-sandbox --blink-settings=dnsPrefetchingEnabled=false --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2104,i,4356282697539129121,4919723039506101747,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,DocumentPolicyIncludeJSCallStacksInCrashReports,IsolatesPriorityUseProcessPriority,PdfUseShowSaveFilePicker --disable-features=ConnectionAllowlists,DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2112,i,11092768600002444553,7907668024742386581,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3836 --desktop-managed-config="{\"forceLoginOrgUUIDs\":null,\"loginSsoOrgDomain\":null,\"disableEssentialTelemetry\":false,\"disableNonessentialTelemetry\":false,\"disableMobileSimulatorTools\":false,\"banner\":null,\"deploymentDisplayName\":null,\"deploymentDisplaySubtitle\":null,\"dictationAvailable\":false,\"userPluginMarketplacesEnabled\":true,\"userPluginUploadsEnabled\":true,\"configDeprecations\":[],\"configDeprecationNoticesSuppressed\":false,\"configOrgDelivered\":false,\"userContentFrameAllowed\":true,\"deploymentMode\":\"1p\",\"appVersion\":\"2.42304.0\",\"cookielessOrigin\":false,\"deviceClass\":\"16\",\"preferredSystemLanguages\":[\"en-US\"],\"extensionsEnabled\":true,\"localExtensionInstallAllowed\":true,\"unpackedExtensionInstallAllowed\":true}" --desktop-boot-placeholder="{\"enabled\":true}" /prefetch:1
  2⤵
  PID:4980
- C:\Program Files\WindowsApps\Claude_2.42304.0.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_2.42304.0.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --app-user-model-id=Claude_pzs8sxrjxfjjc!Claude --app-path="C:\Program Files\WindowsApps\Claude_2.42304.0.0_x64__pzs8sxrjxfjjc\app\resources\app.asar" --enable-sandbox --blink-settings=dnsPrefetchingEnabled=false --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2104,i,4356282697539129121,4919723039506101747,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,DocumentPolicyIncludeJSCallStacksInCrashReports,IsolatesPriorityUseProcessPriority,PdfUseShowSaveFilePicker --disable-features=ConnectionAllowlists,DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2112,i,11092768600002444553,7907668024742386581,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3824 --desktop-features="{\"launch\":{\"status\":\"supported\"},\"coworkBrowser\":{\"status\":\"unsupported\",\"reason\":\"cowork_browser_disabled\",\"unsupportedCode\":\"unknown\"},\"artifactsPane\":{\"status\":\"unavailable\"},\"nativeQuickEntry\":{\"status\":\"unavailable\"},\"quickEntryDictation\":{\"status\":\"unavailable\"},\"quickEntryGlobalShortcut\":{\"status\":\"supported\"},\"trayIcon\":{\"status\":\"supported\"},\"customQuickEntryDictationShortcut\":{\"status\":\"supported\"},\"ultrareviewErrorCategories\":{\"status\":\"supported\"},\"spawnTaskPendingPop\":{\"status\":\"supported\"},\"spawnTaskInFlightIds\":{\"status\":\"supported\"},\"folderWorktrees\":{\"status\":\"supported\"},\"folderWorktreesRemote\":{\"status\":\"supported\"},\"folderWorktreesListedDiscard\":{\"status\":\"supported\"},\"sableOtter\":{\"status\":\"unavailable\"},\"telescopeBridge\":{\"status\":\"unavailable\"},\"mcpFinishInApp\":{\"status\":\"unavailable\"},\"copperLarkA\":{\"status\":\"supported\"},\"copperLarkB\":{\"status\":\"supported\"},\"copperLarkC\":{\"status\":\"unavailable\"},\"copperLarkD\":{\"status\":\"unavailable\"},\"quietPenguin\":{\"status\":\"unavailable\"},\"rubberDuck\":{\"status\":\"unavailable\"},\"chillingSlothFeat\":{\"status\":\"supported\"},\"chillingSlothSshShell\":{\"status\":\"supported\"},\"terminalShellReported\":{\"status\":\"supported\"},\"chillingSlothSshWorktreeLocation\":{\"status\":\"supported\"},\"chillingSlothSshPuttyKeyConversion\":{\"status\":\"unavailable\"},\"chillingSlothRemoteFilePreview\":{\"status\":\"supported\"},\"chillingSlothEnterprise\":{\"status\":\"supported\"},\"chillingSlothLocal\":{\"status\":\"supported\"},\"yukonSilver\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute, vfpext\",\"unsupportedCode\":\"hcs_not_available\"},\"yukonSilverGems\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute, vfpext\",\"unsupportedCode\":\"hcs_not_available\"},\"yukonSilverGemsCache\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute, vfpext\",\"unsupportedCode\":\"hcs_not_available\"},\"wakeScheduler\":{\"status\":\"unavailable\"},\"keepAwake\":{\"status\":\"supported\"},\"codeSessionKeepAwake\":{\"status\":\"supported\"},\"ccdPromptSuggestionsSetting\":{\"status\":\"unavailable\"},\"ccdLandingTools\":{\"status\":\"supported\"},\"ccdMcpVerbsMidTurn\":{\"status\":\"supported\"},\"ccdMcpTurnOnSshHost\":{\"status\":\"supported\"},\"ccdRestartRemoteClaudeCode\":{\"status\":\"supported\"},\"ccdSshStartsWithoutBlockedPlugins\":{\"status\":\"supported\"},\"openWithConsentAnyLanding\":{\"status\":\"supported\"},\"desktopTopBar\":{\"status\":\"supported\"},\"ccdPlugins\":{\"status\":\"supported\"},\"ccdPluginSourceRouting\":{\"status\":\"supported\"},\"computerUse\":{\"status\":\"supported\"},\"computerUseRollout\":{\"status\":\"unavailable\"},\"computerUseComplianceGate\":{\"status\":\"supported\"},\"computerUseAppScoped\":{\"status\":\"unsupported\",\"reason\":\"Background app-scoped mode is macOS-only\",\"unsupportedCode\":\"unsupported_platform\"},\"computerUsePerAppAccess\":{\"status\":\"supported\"},\"coworkWatchRecord\":{\"status\":\"unavailable\"},\"coworkCopperHeron\":{\"status\":\"unavailable\"},\"coworkWatchers\":{\"status\":\"unavailable\"},\"coworkKappa\":{\"status\":\"unavailable\"},\"coworkArtifacts\":{\"status\":\"unavailable\"},\"trustedFolderSettingsConsent\":{\"status\":\"unavailable\"},\"coworkAutoModeAlwaysAllowOverride\":{\"status\":\"unavailable\"},\"framebufferPreview\":{\"status\":\"unavailable\"},\"iosSimulator\":{\"status\":\"unsupported\",\"reason\":\"iOS Simulator panel requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"androidEmulator\":{\"status\":\"unsupported\",\"reason\":\"Android emulator is disabled by its rollout flag\",\"unsupportedCode\":\"unknown\"},\"iosSimulatorH264\":{\"status\":\"unsupported\",\"reason\":\"iOS Simulator panel requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"iosSimulatorAccessibilityReader\":{\"status\":\"unsupported\",\"reason\":\"iOS Simulator panel requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"iosSimulatorDuo\":{\"status\":\"unavailable\"},\"simulatorScreenshotEditor\":{\"status\":\"unavailable\"},\"simulatorMiniView\":{\"status\":\"unavailable\"},\"grandPrix\":{\"status\":\"unavailable\"},\"chromeExtensionInstall\":{\"status\":\"supported\"},\"ccdGitEngine\":{\"status\":\"unavailable\"},\"sessionPrOwnership\":{\"status\":\"unavailable\"},\"sessionFolderFileAccess\":{\"status\":\"supported\"},\"conversationFolderGrants\":{\"status\":\"supported\"},\"localSessionsWithoutGit\":{\"status\":\"supported\"},\"tearOffHalo\":{\"status\":\"unsupported\",\"reason\":\"Tear-off halo overlay requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"coworkArtifactPopout\":{\"status\":\"supported\"},\"sidePanePopoutNativeViews\":{\"status\":\"supported\"},\"simulatorNativeViewPopout\":{\"status\":\"supported\"},\"simulatorPopoutShortcuts\":{\"status\":\"supported\"},\"simulatorNativeViewPerPane\":{\"status\":\"supported\"},\"popoutZoom\":{\"status\":\"supported\"},\"popoutTitleBarOverlay\":{\"status\":\"supported\"},\"filePreviewNativeViewRouting\":{\"status\":\"supported\"},\"claudeDesignWindow\":{\"status\":\"supported\"},\"coworkRemoteSessionSpaces\":{\"status\":\"supported\"},\"spaceMemoryBridge\":{\"status\":\"unavailable\"},\"multiAccount\":{\"status\":\"unavailable\"},\"grandPrixRequest\":{\"status\":\"unavailable\"},\"bootPlaceholder\":{\"status\":\"supported\"},\"coworkBranchSession\":{\"status\":\"supported\"},\"coworkScheduledTaskProjects\":{\"status\":\"supported\"},\"coworkLocalSessionProjects\":{\"status\":\"supported\"},\"coworkScheduledTaskRepoint\":{\"status\":\"supported\"},\"sshAttachmentTransport\":{\"status\":\"supported\"},\"coworkSeededSummon\":{\"status\":\"supported\"},\"seededKind\":{\"status\":\"supported\"},\"sendNowEscalation\":{\"status\":\"supported\"},\"steerDetachField\":{\"status\":\"supported\"},\"sessionMentions\":{\"status\":\"supported\"},\"inlinePastes\":{\"status\":\"supported\"},\"turnDiscardedEvent\":{\"status\":\"supported\"},\"wslForkSession\":{\"status\":\"unavailable\"},\"wslTerminal\":{\"status\":\"unavailable\"},\"wslMcp\":{\"status\":\"unavailable\"},\"wslPreview\":{\"status\":\"unavailable\"},\"wslLocalFiles\":{\"status\":\"unavailable\"},\"wslRoutines\":{\"status\":\"unavailable\"},\"humbleSky\":{\"status\":\"unavailable\"},\"violinBow\":{\"status\":\"unavailable\"},\"violinBowHomeSettings\":{\"status\":\"unavailable\"},\"coworkThinkingInSend\":{\"status\":\"supported\"},\"bootstrapConfig\":{\"status\":\"supported\"},\"chatIn3p\":{\"status\":\"supported\"},\"chatTab\":{\"status\":\"unavailable\"},\"selfHostedSessions\":{\"status\":\"unavailable\"},\"selfHostedCowork\":{\"status\":\"unavailable\"},\"desktopHome\":{\"status\":\"unavailable\"},\"chatCodeExecution\":{\"status\":\"unavailable\"},\"mcpPersistentAlwaysAllow\":{\"status\":\"supported\"},\"mcpScheduledTaskAlwaysAllow\":{\"status\":\"supported\"},\"mcpScheduledTaskApprovalLifetime\":{\"status\":\"unavailable\"},\"epitaxyMcpApps\":{\"status\":\"supported\"},\"sideSessionProposalPicks\":{\"status\":\"supported\"},\"sideSessionProposalWorktreePick\":{\"status\":\"supported\"},\"sideSessionOfferCloudStart\":{\"status\":\"supported\"},\"sideSessions\":{\"status\":\"unavailable\"},\"btwChildSessions\":{\"status\":\"unavailable\"},\"nestedArchiveKeepsFamily\":{\"status\":\"unavailable\"},\"epitaxyMcpAppPane\":{\"status\":\"unavailable\"},\"ccdConnectorTools\":{\"status\":\"unavailable\"},\"ccdTeleportSnapshot\":{\"status\":\"unavailable\"}}" --desktop-managed-config="{\"forceLoginOrgUUIDs\":null,\"loginSsoOrgDomain\":null,\"disableEssentialTelemetry\":false,\"disableNonessentialTelemetry\":false,\"disableMobileSimulatorTools\":false,\"banner\":null,\"deploymentDisplayName\":null,\"deploymentDisplaySubtitle\":null,\"dictationAvailable\":false,\"userPluginMarketplacesEnabled\":true,\"userPluginUploadsEnabled\":true,\"configDeprecations\":[],\"configDeprecationNoticesSuppressed\":false,\"configOrgDelivered\":false,\"userContentFrameAllowed\":true,\"deploymentMode\":\"1p\",\"appVersion\":\"2.42304.0\",\"cookielessOrigin\":false,\"deviceClass\":\"16\",\"preferredSystemLanguages\":[\"en-US\"],\"extensionsEnabled\":true,\"localExtensionInstallAllowed\":true,\"unpackedExtensionInstallAllowed\":true}" /prefetch:1
  2⤵
  PID:5332
- C:\Program Files\WindowsApps\Claude_2.42304.0.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_2.42304.0.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --app-user-model-id=Claude_pzs8sxrjxfjjc!Claude --app-path="C:\Program Files\WindowsApps\Claude_2.42304.0.0_x64__pzs8sxrjxfjjc\app\resources\app.asar" --enable-sandbox --blink-settings=dnsPrefetchingEnabled=false --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=2104,i,4356282697539129121,4919723039506101747,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,DocumentPolicyIncludeJSCallStacksInCrashReports,IsolatesPriorityUseProcessPriority,PdfUseShowSaveFilePicker --disable-features=ConnectionAllowlists,DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2112,i,11092768600002444553,7907668024742386581,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=4160 --desktop-features="{\"launch\":{\"status\":\"supported\"},\"coworkBrowser\":{\"status\":\"unsupported\",\"reason\":\"cowork_browser_disabled\",\"unsupportedCode\":\"unknown\"},\"artifactsPane\":{\"status\":\"unavailable\"},\"nativeQuickEntry\":{\"status\":\"unavailable\"},\"quickEntryDictation\":{\"status\":\"unavailable\"},\"quickEntryGlobalShortcut\":{\"status\":\"supported\"},\"trayIcon\":{\"status\":\"supported\"},\"customQuickEntryDictationShortcut\":{\"status\":\"supported\"},\"ultrareviewErrorCategories\":{\"status\":\"supported\"},\"spawnTaskPendingPop\":{\"status\":\"supported\"},\"spawnTaskInFlightIds\":{\"status\":\"supported\"},\"folderWorktrees\":{\"status\":\"supported\"},\"folderWorktreesRemote\":{\"status\":\"supported\"},\"folderWorktreesListedDiscard\":{\"status\":\"supported\"},\"sableOtter\":{\"status\":\"unavailable\"},\"telescopeBridge\":{\"status\":\"unavailable\"},\"mcpFinishInApp\":{\"status\":\"unavailable\"},\"copperLarkA\":{\"status\":\"supported\"},\"copperLarkB\":{\"status\":\"supported\"},\"copperLarkC\":{\"status\":\"unavailable\"},\"copperLarkD\":{\"status\":\"unavailable\"},\"quietPenguin\":{\"status\":\"unavailable\"},\"rubberDuck\":{\"status\":\"unavailable\"},\"chillingSlothFeat\":{\"status\":\"supported\"},\"chillingSlothSshShell\":{\"status\":\"supported\"},\"terminalShellReported\":{\"status\":\"supported\"},\"chillingSlothSshWorktreeLocation\":{\"status\":\"supported\"},\"chillingSlothSshPuttyKeyConversion\":{\"status\":\"unavailable\"},\"chillingSlothRemoteFilePreview\":{\"status\":\"supported\"},\"chillingSlothEnterprise\":{\"status\":\"supported\"},\"chillingSlothLocal\":{\"status\":\"supported\"},\"yukonSilver\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute, vfpext\",\"unsupportedCode\":\"hcs_not_available\"},\"yukonSilverGems\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute, vfpext\",\"unsupportedCode\":\"hcs_not_available\"},\"yukonSilverGemsCache\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute, vfpext\",\"unsupportedCode\":\"hcs_not_available\"},\"wakeScheduler\":{\"status\":\"unavailable\"},\"keepAwake\":{\"status\":\"supported\"},\"codeSessionKeepAwake\":{\"status\":\"supported\"},\"ccdPromptSuggestionsSetting\":{\"status\":\"unavailable\"},\"ccdLandingTools\":{\"status\":\"supported\"},\"ccdMcpVerbsMidTurn\":{\"status\":\"supported\"},\"ccdMcpTurnOnSshHost\":{\"status\":\"supported\"},\"ccdRestartRemoteClaudeCode\":{\"status\":\"supported\"},\"ccdSshStartsWithoutBlockedPlugins\":{\"status\":\"supported\"},\"openWithConsentAnyLanding\":{\"status\":\"supported\"},\"desktopTopBar\":{\"status\":\"supported\"},\"ccdPlugins\":{\"status\":\"supported\"},\"ccdPluginSourceRouting\":{\"status\":\"supported\"},\"computerUse\":{\"status\":\"supported\"},\"computerUseRollout\":{\"status\":\"unavailable\"},\"computerUseComplianceGate\":{\"status\":\"supported\"},\"computerUseAppScoped\":{\"status\":\"unsupported\",\"reason\":\"Background app-scoped mode is macOS-only\",\"unsupportedCode\":\"unsupported_platform\"},\"computerUsePerAppAccess\":{\"status\":\"supported\"},\"coworkWatchRecord\":{\"status\":\"unavailable\"},\"coworkCopperHeron\":{\"status\":\"unavailable\"},\"coworkWatchers\":{\"status\":\"unavailable\"},\"coworkKappa\":{\"status\":\"unavailable\"},\"coworkArtifacts\":{\"status\":\"unavailable\"},\"trustedFolderSettingsConsent\":{\"status\":\"unavailable\"},\"coworkAutoModeAlwaysAllowOverride\":{\"status\":\"unavailable\"},\"framebufferPreview\":{\"status\":\"unavailable\"},\"iosSimulator\":{\"status\":\"unsupported\",\"reason\":\"iOS Simulator panel requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"androidEmulator\":{\"status\":\"unsupported\",\"reason\":\"Android emulator is disabled by its rollout flag\",\"unsupportedCode\":\"unknown\"},\"iosSimulatorH264\":{\"status\":\"unsupported\",\"reason\":\"iOS Simulator panel requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"iosSimulatorAccessibilityReader\":{\"status\":\"unsupported\",\"reason\":\"iOS Simulator panel requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"iosSimulatorDuo\":{\"status\":\"unavailable\"},\"simulatorScreenshotEditor\":{\"status\":\"unavailable\"},\"simulatorMiniView\":{\"status\":\"unavailable\"},\"grandPrix\":{\"status\":\"unavailable\"},\"chromeExtensionInstall\":{\"status\":\"supported\"},\"ccdGitEngine\":{\"status\":\"unavailable\"},\"sessionPrOwnership\":{\"status\":\"unavailable\"},\"sessionFolderFileAccess\":{\"status\":\"supported\"},\"conversationFolderGrants\":{\"status\":\"supported\"},\"localSessionsWithoutGit\":{\"status\":\"supported\"},\"tearOffHalo\":{\"status\":\"unsupported\",\"reason\":\"Tear-off halo overlay requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"coworkArtifactPopout\":{\"status\":\"supported\"},\"sidePanePopoutNativeViews\":{\"status\":\"supported\"},\"simulatorNativeViewPopout\":{\"status\":\"supported\"},\"simulatorPopoutShortcuts\":{\"status\":\"supported\"},\"simulatorNativeViewPerPane\":{\"status\":\"supported\"},\"popoutZoom\":{\"status\":\"supported\"},\"popoutTitleBarOverlay\":{\"status\":\"supported\"},\"filePreviewNativeViewRouting\":{\"status\":\"supported\"},\"claudeDesignWindow\":{\"status\":\"supported\"},\"coworkRemoteSessionSpaces\":{\"status\":\"supported\"},\"spaceMemoryBridge\":{\"status\":\"unavailable\"},\"multiAccount\":{\"status\":\"unavailable\"},\"grandPrixRequest\":{\"status\":\"unavailable\"},\"bootPlaceholder\":{\"status\":\"supported\"},\"coworkBranchSession\":{\"status\":\"supported\"},\"coworkScheduledTaskProjects\":{\"status\":\"supported\"},\"coworkLocalSessionProjects\":{\"status\":\"supported\"},\"coworkScheduledTaskRepoint\":{\"status\":\"supported\"},\"sshAttachmentTransport\":{\"status\":\"supported\"},\"coworkSeededSummon\":{\"status\":\"supported\"},\"seededKind\":{\"status\":\"supported\"},\"sendNowEscalation\":{\"status\":\"supported\"},\"steerDetachField\":{\"status\":\"supported\"},\"sessionMentions\":{\"status\":\"supported\"},\"inlinePastes\":{\"status\":\"supported\"},\"turnDiscardedEvent\":{\"status\":\"supported\"},\"wslForkSession\":{\"status\":\"unavailable\"},\"wslTerminal\":{\"status\":\"unavailable\"},\"wslMcp\":{\"status\":\"unavailable\"},\"wslPreview\":{\"status\":\"unavailable\"},\"wslLocalFiles\":{\"status\":\"unavailable\"},\"wslRoutines\":{\"status\":\"unavailable\"},\"humbleSky\":{\"status\":\"unavailable\"},\"violinBow\":{\"status\":\"unavailable\"},\"violinBowHomeSettings\":{\"status\":\"unavailable\"},\"coworkThinkingInSend\":{\"status\":\"supported\"},\"bootstrapConfig\":{\"status\":\"supported\"},\"chatIn3p\":{\"status\":\"supported\"},\"chatTab\":{\"status\":\"unavailable\"},\"selfHostedSessions\":{\"status\":\"unavailable\"},\"selfHostedCowork\":{\"status\":\"unavailable\"},\"desktopHome\":{\"status\":\"unavailable\"},\"chatCodeExecution\":{\"status\":\"unavailable\"},\"mcpPersistentAlwaysAllow\":{\"status\":\"supported\"},\"mcpScheduledTaskAlwaysAllow\":{\"status\":\"supported\"},\"mcpScheduledTaskApprovalLifetime\":{\"status\":\"unavailable\"},\"epitaxyMcpApps\":{\"status\":\"supported\"},\"sideSessionProposalPicks\":{\"status\":\"supported\"},\"sideSessionProposalWorktreePick\":{\"status\":\"supported\"},\"sideSessionOfferCloudStart\":{\"status\":\"supported\"},\"sideSessions\":{\"status\":\"unavailable\"},\"btwChildSessions\":{\"status\":\"unavailable\"},\"nestedArchiveKeepsFamily\":{\"status\":\"unavailable\"},\"epitaxyMcpAppPane\":{\"status\":\"unavailable\"},\"ccdConnectorTools\":{\"status\":\"unavailable\"},\"ccdTeleportSnapshot\":{\"status\":\"unavailable\"}}" --desktop-managed-config="{\"forceLoginOrgUUIDs\":null,\"loginSsoOrgDomain\":null,\"disableEssentialTelemetry\":false,\"disableNonessentialTelemetry\":false,\"disableMobileSimulatorTools\":false,\"banner\":null,\"deploymentDisplayName\":null,\"deploymentDisplaySubtitle\":null,\"dictationAvailable\":false,\"userPluginMarketplacesEnabled\":true,\"userPluginUploadsEnabled\":true,\"configDeprecations\":[],\"configDeprecationNoticesSuppressed\":false,\"configOrgDelivered\":false,\"userContentFrameAllowed\":true,\"deploymentMode\":\"1p\",\"appVersion\":\"2.42304.0\",\"cookielessOrigin\":false,\"deviceClass\":\"16\",\"preferredSystemLanguages\":[\"en-US\"],\"extensionsEnabled\":true,\"localExtensionInstallAllowed\":true,\"unpackedExtensionInstallAllowed\":true}" /prefetch:1
  2⤵
  PID:4824
- C:\Program Files\WindowsApps\Claude_2.42304.0.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_2.42304.0.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --app-user-model-id=Claude_pzs8sxrjxfjjc!Claude --app-path="C:\Program Files\WindowsApps\Claude_2.42304.0.0_x64__pzs8sxrjxfjjc\app\resources\app.asar" --enable-sandbox --blink-settings=dnsPrefetchingEnabled=false --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=2104,i,4356282697539129121,4919723039506101747,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,DocumentPolicyIncludeJSCallStacksInCrashReports,IsolatesPriorityUseProcessPriority,PdfUseShowSaveFilePicker --disable-features=ConnectionAllowlists,DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2112,i,11092768600002444553,7907668024742386581,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=4036 --desktop-features="{\"launch\":{\"status\":\"supported\"},\"coworkBrowser\":{\"status\":\"unsupported\",\"reason\":\"cowork_browser_disabled\",\"unsupportedCode\":\"unknown\"},\"artifactsPane\":{\"status\":\"unavailable\"},\"nativeQuickEntry\":{\"status\":\"unavailable\"},\"quickEntryDictation\":{\"status\":\"unavailable\"},\"quickEntryGlobalShortcut\":{\"status\":\"supported\"},\"trayIcon\":{\"status\":\"supported\"},\"customQuickEntryDictationShortcut\":{\"status\":\"supported\"},\"ultrareviewErrorCategories\":{\"status\":\"supported\"},\"spawnTaskPendingPop\":{\"status\":\"supported\"},\"spawnTaskInFlightIds\":{\"status\":\"supported\"},\"folderWorktrees\":{\"status\":\"supported\"},\"folderWorktreesRemote\":{\"status\":\"supported\"},\"folderWorktreesListedDiscard\":{\"status\":\"supported\"},\"sableOtter\":{\"status\":\"unavailable\"},\"telescopeBridge\":{\"status\":\"unavailable\"},\"mcpFinishInApp\":{\"status\":\"unavailable\"},\"copperLarkA\":{\"status\":\"supported\"},\"copperLarkB\":{\"status\":\"supported\"},\"copperLarkC\":{\"status\":\"unavailable\"},\"copperLarkD\":{\"status\":\"unavailable\"},\"quietPenguin\":{\"status\":\"unavailable\"},\"rubberDuck\":{\"status\":\"unavailable\"},\"chillingSlothFeat\":{\"status\":\"supported\"},\"chillingSlothSshShell\":{\"status\":\"supported\"},\"terminalShellReported\":{\"status\":\"supported\"},\"chillingSlothSshWorktreeLocation\":{\"status\":\"supported\"},\"chillingSlothSshPuttyKeyConversion\":{\"status\":\"unavailable\"},\"chillingSlothRemoteFilePreview\":{\"status\":\"supported\"},\"chillingSlothEnterprise\":{\"status\":\"supported\"},\"chillingSlothLocal\":{\"status\":\"supported\"},\"yukonSilver\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute, vfpext\",\"unsupportedCode\":\"hcs_not_available\"},\"yukonSilverGems\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute, vfpext\",\"unsupportedCode\":\"hcs_not_available\"},\"yukonSilverGemsCache\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute, vfpext\",\"unsupportedCode\":\"hcs_not_available\"},\"wakeScheduler\":{\"status\":\"unavailable\"},\"keepAwake\":{\"status\":\"supported\"},\"codeSessionKeepAwake\":{\"status\":\"supported\"},\"ccdPromptSuggestionsSetting\":{\"status\":\"unavailable\"},\"ccdLandingTools\":{\"status\":\"supported\"},\"ccdMcpVerbsMidTurn\":{\"status\":\"supported\"},\"ccdMcpTurnOnSshHost\":{\"status\":\"supported\"},\"ccdRestartRemoteClaudeCode\":{\"status\":\"supported\"},\"ccdSshStartsWithoutBlockedPlugins\":{\"status\":\"supported\"},\"openWithConsentAnyLanding\":{\"status\":\"supported\"},\"desktopTopBar\":{\"status\":\"supported\"},\"ccdPlugins\":{\"status\":\"supported\"},\"ccdPluginSourceRouting\":{\"status\":\"supported\"},\"computerUse\":{\"status\":\"supported\"},\"computerUseRollout\":{\"status\":\"unavailable\"},\"computerUseComplianceGate\":{\"status\":\"supported\"},\"computerUseAppScoped\":{\"status\":\"unsupported\",\"reason\":\"Background app-scoped mode is macOS-only\",\"unsupportedCode\":\"unsupported_platform\"},\"computerUsePerAppAccess\":{\"status\":\"supported\"},\"coworkWatchRecord\":{\"status\":\"unavailable\"},\"coworkCopperHeron\":{\"status\":\"unavailable\"},\"coworkWatchers\":{\"status\":\"unavailable\"},\"coworkKappa\":{\"status\":\"unavailable\"},\"coworkArtifacts\":{\"status\":\"unavailable\"},\"trustedFolderSettingsConsent\":{\"status\":\"unavailable\"},\"coworkAutoModeAlwaysAllowOverride\":{\"status\":\"unavailable\"},\"framebufferPreview\":{\"status\":\"unavailable\"},\"iosSimulator\":{\"status\":\"unsupported\",\"reason\":\"iOS Simulator panel requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"androidEmulator\":{\"status\":\"unsupported\",\"reason\":\"Android emulator is disabled by its rollout flag\",\"unsupportedCode\":\"unknown\"},\"iosSimulatorH264\":{\"status\":\"unsupported\",\"reason\":\"iOS Simulator panel requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"iosSimulatorAccessibilityReader\":{\"status\":\"unsupported\",\"reason\":\"iOS Simulator panel requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"iosSimulatorDuo\":{\"status\":\"unavailable\"},\"simulatorScreenshotEditor\":{\"status\":\"unavailable\"},\"simulatorMiniView\":{\"status\":\"unavailable\"},\"grandPrix\":{\"status\":\"unavailable\"},\"chromeExtensionInstall\":{\"status\":\"supported\"},\"ccdGitEngine\":{\"status\":\"unavailable\"},\"sessionPrOwnership\":{\"status\":\"unavailable\"},\"sessionFolderFileAccess\":{\"status\":\"supported\"},\"conversationFolderGrants\":{\"status\":\"supported\"},\"localSessionsWithoutGit\":{\"status\":\"supported\"},\"tearOffHalo\":{\"status\":\"unsupported\",\"reason\":\"Tear-off halo overlay requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"coworkArtifactPopout\":{\"status\":\"supported\"},\"sidePanePopoutNativeViews\":{\"status\":\"supported\"},\"simulatorNativeViewPopout\":{\"status\":\"supported\"},\"simulatorPopoutShortcuts\":{\"status\":\"supported\"},\"simulatorNativeViewPerPane\":{\"status\":\"supported\"},\"popoutZoom\":{\"status\":\"supported\"},\"popoutTitleBarOverlay\":{\"status\":\"supported\"},\"filePreviewNativeViewRouting\":{\"status\":\"supported\"},\"claudeDesignWindow\":{\"status\":\"supported\"},\"coworkRemoteSessionSpaces\":{\"status\":\"supported\"},\"spaceMemoryBridge\":{\"status\":\"unavailable\"},\"multiAccount\":{\"status\":\"unavailable\"},\"grandPrixRequest\":{\"status\":\"unavailable\"},\"bootPlaceholder\":{\"status\":\"supported\"},\"coworkBranchSession\":{\"status\":\"supported\"},\"coworkScheduledTaskProjects\":{\"status\":\"supported\"},\"coworkLocalSessionProjects\":{\"status\":\"supported\"},\"coworkScheduledTaskRepoint\":{\"status\":\"supported\"},\"sshAttachmentTransport\":{\"status\":\"supported\"},\"coworkSeededSummon\":{\"status\":\"supported\"},\"seededKind\":{\"status\":\"supported\"},\"sendNowEscalation\":{\"status\":\"supported\"},\"steerDetachField\":{\"status\":\"supported\"},\"sessionMentions\":{\"status\":\"supported\"},\"inlinePastes\":{\"status\":\"supported\"},\"turnDiscardedEvent\":{\"status\":\"supported\"},\"wslForkSession\":{\"status\":\"unavailable\"},\"wslTerminal\":{\"status\":\"unavailable\"},\"wslMcp\":{\"status\":\"unavailable\"},\"wslPreview\":{\"status\":\"unavailable\"},\"wslLocalFiles\":{\"status\":\"unavailable\"},\"wslRoutines\":{\"status\":\"unavailable\"},\"humbleSky\":{\"status\":\"unavailable\"},\"violinBow\":{\"status\":\"unavailable\"},\"violinBowHomeSettings\":{\"status\":\"unavailable\"},\"coworkThinkingInSend\":{\"status\":\"supported\"},\"bootstrapConfig\":{\"status\":\"supported\"},\"chatIn3p\":{\"status\":\"supported\"},\"chatTab\":{\"status\":\"unavailable\"},\"selfHostedSessions\":{\"status\":\"unavailable\"},\"selfHostedCowork\":{\"status\":\"unavailable\"},\"desktopHome\":{\"status\":\"unavailable\"},\"chatCodeExecution\":{\"status\":\"unavailable\"},\"mcpPersistentAlwaysAllow\":{\"status\":\"supported\"},\"mcpScheduledTaskAlwaysAllow\":{\"status\":\"supported\"},\"mcpScheduledTaskApprovalLifetime\":{\"status\":\"unavailable\"},\"epitaxyMcpApps\":{\"status\":\"supported\"},\"sideSessionProposalPicks\":{\"status\":\"supported\"},\"sideSessionProposalWorktreePick\":{\"status\":\"supported\"},\"sideSessionOfferCloudStart\":{\"status\":\"supported\"},\"sideSessions\":{\"status\":\"unavailable\"},\"btwChildSessions\":{\"status\":\"unavailable\"},\"nestedArchiveKeepsFamily\":{\"status\":\"unavailable\"},\"epitaxyMcpAppPane\":{\"status\":\"unavailable\"},\"ccdConnectorTools\":{\"status\":\"unavailable\"},\"ccdTeleportSnapshot\":{\"status\":\"unavailable\"}}" --desktop-managed-config="{\"forceLoginOrgUUIDs\":null,\"loginSsoOrgDomain\":null,\"disableEssentialTelemetry\":false,\"disableNonessentialTelemetry\":false,\"disableMobileSimulatorTools\":false,\"banner\":null,\"deploymentDisplayName\":null,\"deploymentDisplaySubtitle\":null,\"dictationAvailable\":false,\"userPluginMarketplacesEnabled\":true,\"userPluginUploadsEnabled\":true,\"configDeprecations\":[],\"configDeprecationNoticesSuppressed\":false,\"configOrgDelivered\":false,\"userContentFrameAllowed\":true,\"deploymentMode\":\"1p\",\"appVersion\":\"2.42304.0\",\"cookielessOrigin\":false,\"deviceClass\":\"16\",\"preferredSystemLanguages\":[\"en-US\"],\"extensionsEnabled\":true,\"localExtensionInstallAllowed\":true,\"unpackedExtensionInstallAllowed\":true}" /prefetch:1
  2⤵
  PID:2256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

f_000001

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Cache\Cache_Data\f_000001
Size 28KB
SHA256 9efb4bafccfb9adf806fa7f05c1a7065fce7a4b85a49618546a946adaab88070
MD5 8aceaf2af4111a2fa84ef8f373f950c6
SHA1 268390cc83124924a9666b5f0fde42158ae432f7
SHA512 195cc57a43e4d76ee5e6beb0d73e991c7ad6d353481f794ec4b5eb18ddf3ab7faf2d61cdc19a4ffcff4004ae7c3ce04b9394c741f79f6d91d8b58dbdd7f39143
SSDEEP 768:m5BFpJEj3zGpUXp6hMKVYS3TXcxAjbRBtsIdw6h:m7FA3zGp06TVDljdBtf/h
TLSH
T16BD2F1D67CBD834CC9235DE626F23706762A7ED207D38C1DD85D65B28440A044D6EFE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Cache\Cache_Data\f_000002
Size 40KB
SHA256 71d8a513364853d883b90d3e931d12a1399cc6824bbe84b873c35ab28af32105
MD5 817d94882bab55854b69763ea3820d88
SHA1 d42f876c5acf6ec060bb8a359a47f0c6e955f5e6
SHA512 a56210df786792ecd547ee5ef8f31487e66469a5c09a12eda0c7136b05e29ca81638c1c217e5d641c0fc2f0d0a82431f8a5c25b17cbd50ddbe93479153544d68
SSDEEP 768:/3cOZsc6vJVzBFnLhb4dEU4kelbZetj6yDZkmpWrALRkJkYO:/XZxaJVz7lb24keJZeIyFkIW8lkDO
TLSH
T16913F16E356D9092F4B2D5BCCA010F08971ABBC223B2F96E460771B41DE7A17DD81928
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00003f

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Cache\Cache_Data\f_00003f
Size 54KB
SHA256 0e62cec662e96ec1dc1eafef2132f794b449d3609f3e2b8a4bb2c80823a138b2
MD5 e1b9e687cd6a2bcd9caddf551ad8144a
SHA1 0d8556c75f475d78d5d094b45ba5c448572ab4fc
SHA512 24abd7e8428e10539632a15bcd2c23bdb02668d25ec95fac80b12cb7fed5333cc89fec632990c2436218a20a044b9bb1f1a7c4fa426dbf0e59e7c0d5998e9d35
SSDEEP 1536:K7sutCMM+wILWVt1SYGa3GCs/92XdIRqqjf:udtCMM+wmUt1Z3GCJXdVCf
TLSH
T1E543F1B27897E32A5C04676452BDAFFA10EF0BB534CD78E41C6B7CA24F34E635821921
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000044

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Cache\Cache_Data\f_000044
Size 38KB
SHA256 4667b28136f666a99285bc799b0982ac650751ad776c9403a79032380b874f9a
MD5 cb312525cb633ea8ad3164a5d4d0e984
SHA1 b52fd75479bae49aecc17ebc347b8812c5164ae6
SHA512 ddb7ace946a10e712ad3f0b5344b15d3b55d54002ee11edba93e7b4b89fdd6e29afe245e9e1c43323aaa7e52446b358dc7640cc42857df5261276a7d1f1b91eb
SSDEEP 768:y7QcPAi1nBZApAtnnacihh/J6tSiyR8sF1BddTlsCaE6/u4DDF3RD35:qQ/iPCpAtaLhhR6thyyahbWE6nDD3p
TLSH
T11E0302221886A6F2FD4811DDADF1D09F02188343D2576A23E6D3AFBE1B844D194679FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000046

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Cache\Cache_Data\f_000046
Size 19KB
SHA256 effd1bc66f62b9aef63b56521fb8356ae730b18eeb332653015e45d79810210b
MD5 e03075a72edd1b876a24faf435eb5d9d
SHA1 2e980ddbfab2639382b1bafdc7231a210359b517
SHA512 a362a2b0f703335e2de7eaff75ea83b8d4578a027b83b504c8706d967d8802f5db2160eb03e7736e11815eeaaaa8c89f5b9a35642006eb501e00b55cbf5f087d
SSDEEP 384:ErsKlJkKeomcMSb4osdTmaHQQ7XdnfY9KHOv9OkT/HjToQ/PzzLF8o5pd:EAK/VMSns7HQQDdnfmKHOAkTLToG20pd
TLSH
T13A92F146C15F2F61C223816CACB1BCECA91745622A936183CE80577753FBEB4776C225
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Code Cache\js\index-dir\temp-index
Size 5KB
SHA256 9fa7125d878b533654899ec905a56aa4381b9c2b5c5789916aeb2df25594279f
MD5 98516087e12349eceaa34cc921b0778c
SHA1 17fd0aa1e135f130c0c99e9e80366dbac9dc8d85
SHA512 ae6335a9a7f9209fa65bbdb6f2c7bd5c8a75189519ae5d1464fcab08ddcdb1c1b52d9820b3b463ca2d13bf1b88a4962c43248947bd1034519cc7343a9b2e47b8
SSDEEP 96:t8Ol2ta59TVjaZy1ddyIIyKHSP5BjMFXWSVW0OaFPKqguYJczVLUXWWOrWr0S8I+:pxgWU5zrnOhFYCtP+
TLSH
T14FC1E6F11E86EC41F3E0783A1EC605223236B7EF335B7E2D4420B17D18827284ABB264
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 8b57d77276d8abddcc2e85823fb7c1144819448edaafddc94e0d398303534d1b
MD5 a0c463c9cefc679d94e08412e10b39b3
SHA1 b922f847de5516d3d5e963a6412419da86f0509e
SHA512 27b3171377284daef579bdfffeee104bffd45ad44e5b9ad982e90ef5a672d58c71acb22dd4a7c6af2d6328f81cc8a50b9903b248df2fc2fc5e1e8441da9d98d1
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\DawnGraphiteCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\DawnGraphiteCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\DawnGraphiteCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\DawnGraphiteCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Local Storage\leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Network\Network Persistent State
Size 59B
SHA256 c257f929cff0e4380bf08d9f36f310753f7b1ccb5cb2ab811b52760dd8cb9572
MD5 78bfcecb05ed1904edce3b60cb5c7e62
SHA1 bf77a7461de9d41d12aa88fba056ba758793d9ce
SHA512 2420dff6eb853f5e1856cdab99561a896ea0743fcff3e04b37cb87eddf063770608a30c6ffb0319e5d353b0132c5f8135b7082488e425666b2c22b753a6a4d73
TLSH
T1D2A0026ADA612D881B4A839026187553807B0445130982FDE43877A841561AE582C865
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent Statebac67551-73a7-496b-95fa-589ee6b661a0.tmp

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Network\Network Persistent Statebac67551-73a7-496b-95fa-589ee6b661a0.tmp
Size 2KB
SHA256 ab633002dd0bc542f88b523b979f9c43053b5d20c2aaa50e4f42c72a4829a739
MD5 8b758d602c0a0abeec10e620ca5fe276
SHA1 8fb09ef825396752a6b3585ca2b8f1433ea31203
SHA512 60b0c7f063cb80a7446d9888af1e6f2e8199fe316406c4bf3d6a984bc2971d8b95484ac11bc9fef29bbe54814aebbd38ac56c7076df142407777f994bb599dc3
TLSH
T19E41BCD7C7E9067E86622BF51F2539A3C1BE1A5C93187C0BC8C9DF8E67E1831560154D
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Session Storage\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\WebStorage\2\CacheStorage\26e9cd36-42f7-43f4-9f1a-d82be6876bce\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\WebStorage\2\CacheStorage\26e9cd36-42f7-43f4-9f1a-d82be6876bce\index-dir\temp-index
Size 72B
SHA256 f695650e961abab3abcd4aebe522583463e9727ec05975d786ebe7c82f91805d
MD5 bf9287ab8611455fed347536a517836c
SHA1 ef121a0613c5541c738c24c4b621978efd140093
SHA512 9981955b681284173e5982132ab831bc2bd83eda9e3ba05f8b74d2161e754a91aa480c11fa08df2733a825ae07652af7a98487add08a47c5f8384fff3dd6e687
TLSH
T196A002947F851451C818227550591B923720C8515903570350A101598CB07C59932058
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\WebStorage\2\CacheStorage\26e9cd36-42f7-43f4-9f1a-d82be6876bce\index-dir\the-real-index
Size 48B
SHA256 10b71e888dc8826119c43b127c94cf81a7d91413ea81b782fbeb0ce27281c0e3
MD5 4f8ece0156a95ee7d276f9c4f0f5c153
SHA1 88d1ea77beb0a9ca30204a6a4b733c90683124e9
SHA512 7bf18fec7ddb363a6f38f5e66deb3ab85b71dd04ecf30cddc941133f3271bee4758ea96dc9c018b4084c4993bd17568afeee36ae69b66187a33d2c7134161fa7
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\WebStorage\2\CacheStorage\index.txt
Size 176B
SHA256 60b90929f89f7626c2143f278977ef0f9aa83cb1feb553d8841dde6308b1ec7c
MD5 63e26a5c39c7d2289bcea8c4c8d11640
SHA1 8f5c757c64378afb81e79fb1c124ffb1e032f7a4
SHA512 f64cffd3965fe6d05c7049feb14513dc1675b9eb54f8c7254bd948b4f22227c1810da71cf04fc47a22c41c515012c2aac8569a39b9e4675da984630b18e548df
TLSH
T1BCC080FB404252D16E5924E6B10631CAC5377FD85DC0F58D587130487230C5A0D00824
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\WebStorage\2\CacheStorage\index.txt.tmp
Size 89B
SHA256 92cda5a28f4c1874bcf0aca7ca908e1234751120abf372f5a81cbb33590c3590
MD5 8684fe11e05213691ad78cf380e7c451
SHA1 1c075025a185041ddeb120c2c8e8cc2fe175d82b
SHA512 fd3ede8f008a3407360d649eb6c2c07c14454f2c17e823af53217c15baeb965494074dfff8b87acf24474839cdf9aab03c71be349e434dc6ba89e32b2a57bc55
TLSH
T1B2B002FF014156D15EA135E7100731DEC56376D85CC0EA4CD572105473104AD5401C24
MD5 SHA1 SHA512 TLSH

Submit Download

claude_desktop_config.json

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\claude_desktop_config.json
Size 67B
SHA256 59bd779dfa53ed935bc97962c4931c6239b83060b2a7468546802e3a1c1e42e8
MD5 b423c8312e956b42edb50caac1c19166
SHA1 2d3c46248c316e3bbc2365d1e0a1e2c2b504573b
SHA512 a7d5b945dc5eb68050bbb53268accea0779c26eeacce8202dedfbe6020b256b21706bce2a70d143e75783b01bfea3afea7d2d9e355d42ef268ec5ed32fdfc201
TLSH
T1B5A02230FC020AF20FF0203C00BCEA0328032832003C083C80A802AC2A00EB008080B2
MD5 SHA1 SHA512 TLSH

Submit Download

claude_desktop_config.json

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\claude_desktop_config.json
Size 111B
SHA256 f1891f589a45893a3a2aa36a15cf023470e917f4060fdf55946a41a9b8a5a771
MD5 f628c219b584e0f65092c660a796e256
SHA1 4890fe0f7678a20a102bb5ee06a05ca538afc935
SHA512 167f16bc7898442edfe2cae48941e30df2b77d482bb03f851d00696a1d7870f3ac907101868f60b637e08f5f940e2c2a2f685b13855be0b3590aa9b9764d482b
TLSH
T188B09230F93A1FA61EF1216945AE99176A8229A2012C2438A0AA064E0B80A7D6C2A0E1
MD5 SHA1 SHA512 TLSH

Submit Download

claude_desktop_config.json

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\claude_desktop_config.json
Size 225B
SHA256 b559b07986a21384586a7f4c9606ac4f0af899610c71cf6b3e73879205df6bb1
MD5 bceba01e57d922c60f0858e49c2ef6ac
SHA1 022f6cc19342b54d2dea9709b53d84b046acf517
SHA512 1bf44d71f039c8dc2e02710b9535a5fe492c70577e83f8a8355f2c5f3dcdc260adaf2ed28d8824b816980508ed436461581d535357928700fc557e17b272af46
TLSH
T106D0A730E8390E7605B522140D7D61235B9216A30968303C611E0A4C0B8461EA8254A0
MD5 SHA1 SHA512 TLSH

Submit Download

claude_desktop_config.json

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\claude_desktop_config.json
Size 266B
SHA256 e8a27ac24647d3d97cbafec776fc6582669027efae6f875b02ef7768596ffc56
MD5 17d3b5ea85c47ede1b30bd5a3d875afb
SHA1 7ea43a14f995b3ba122546548231338e8e19135c
SHA512 03d722f47760841093c8fb910b9d06bcfefc4a4368b525579f1cddfd6d876a2b4a96fd3ce2c9813c6fcc824bd9785d6b1212c7610ba46d790bb491af8741efe5
TLSH
T1B9D02B30ED390F7A09B561040D7D60135A9116A31824302CA01E091C0F98A1EB4250A0
MD5 SHA1 SHA512 TLSH

Submit Download

claude_desktop_config.json

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\claude_desktop_config.json
Size 157B
SHA256 337efe74552a0bfbf5e3a8a6dc4d069775bba46342b08d63f5d89160850de068
MD5 56b92818cb396fd257bf5ca1c3f0fbb3
SHA1 3a6d7e1f820eec2df71fb0efd0d72e892b356030
SHA512 d478b5253d60b17be088b35ed804ca6bbf6f0264018ee1afe3f0a783c53e6381a02521abfbce529b6817f15a379edbca32222349e2f709a32b455dec1db08403
TLSH
T1F0C08C30E83A0F761AF262280E7E8417AB526AD3156C303CA16D060D0B8462D2C2A0A1
MD5 SHA1 SHA512 TLSH

Submit Download

claude_desktop_config.json.tmp

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\claude_desktop_config.json.tmp
Size 383B
SHA256 db0054735e6afda3bc711d428ad2cb9491c4a2a98ee2ec2e42fd3fbfeb9cfc21
MD5 29e9b51266e9fd34045222ed723dd40a
SHA1 6ce97554d83f3f11971435ac536eeba6015c1417
SHA512 fee87e69be5c6c3ea1febbe1185e71d42b9b3d7d85a422d00bd77b144883b4fcffafa88ff47629f6f003bdd5a48305626f1f30755882255576634354d797da88
TLSH
T157E0D834D8291EBB09B2A12CCD7D94231E5175631E14703C641D095C1FDCB7EA4358A1
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\config.json
Size 42B
SHA256 a6f870529baa1f5c2ec650e13d7abaed08ed249cf0a8c44b68061866488cead5
MD5 8de07176a03b29c74df60057d19f9625
SHA1 b5e5cdca364633dc0d32230ad679184ba6491e44
SHA512 f7f35f807e727eb0a1dc8e0afa7ac39902324c0230be82cb7fc3baf6a9ec20476b567399f6a9bba3b0b2ef65fc525668f69c38cbfb3fd2afc2f7141b9c11b2ec
MD5 SHA1 SHA512

Submit Download

config.json

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\config.json
Size 77B
SHA256 96bdf12746e52a07eb78869bd300f05267b12eaf75dc60d52afb6e2ee1c5e138
MD5 43842da7da87a6050bd6e2b22569acfe
SHA1 d15db636e53e217f8c41fe4f144dbecc4d1a8b15
SHA512 83dcab7f29f1e85eae7260227cea13c461e5a541c65e4efa6bad10d901c48d260492a331119fb1fb739eaddc19a121d761f139c7420e6da1b77530d8624eddd7
TLSH
T176A0029E90745816CD3E97E8988C4157C79A078C5E0F100945689E7ECE25AAD37CF265
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\config.json
Size 110B
SHA256 dad72dad3497bf42f26c34d05449c976d7e517926c1ecda6dda6bc27b47e42e1
MD5 94d2a6a4265a4cea218912dab88e5f1b
SHA1 6ead630b4c2a5b7ea6f8a776fdb08a54031d79c2
SHA512 ad0f4d6ce999312a9aa13ce9bfe7d58cd97ff67467ec03f4fd938f2fd80f452029fe6f9ff1c8f4b7f1c4cd4538c589038adcd17fafeb50338750044891d48bf5
TLSH
T120B0129BC0200435C93A4BDC4E4D52178B450748094F14048619DE7CDD3457E2B4B2A1
MD5 SHA1 SHA512 TLSH

Submit Download

config.json.journal

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\config.json.journal
Size 111B
SHA256 f83c7bf0eeae4d45d51e46f272ee25f39f03281a4dd9b77c107039be9ea37fb5
MD5 3c3f0ebeb8a21886de746e37a84c67e2
SHA1 205aeb1534082e89ab991e073200b0d3d2032988
SHA512 32bd32f02fce492aeda3f139b51f7861500540e5c5c58d254caae448e2983638a63a40583ed22745cb43fd3bc616bffad0779a52c4138ca162d3e27dbc4d3eaf
TLSH
T123B0124DE83CB85EC420C70850108127A7F7661EEA520408D0D00E8586075BE1D4A676
MD5 SHA1 SHA512 TLSH

Submit Download

config.json.journal

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\config.json.journal
Size 174B
SHA256 c9b9ced34ac26ae049816ed20e36b5dfe6c756ef9794171517e3a36f4ab6277e
MD5 668f9381cfcdf11511acc01495877a81
SHA1 6c8bfa97d5c3351c02d0a67eb8e238f0112fb679
SHA512 79bf031dbab4f73767d05af33d294a9d732b2460e2a1c74c5b77690460325e33ed35b439e65afd17b3ec8b8b92617155456497a92284d6f0ad2b99603a55dfbe
TLSH
T1C5C08C89ED3CB45DC420CA08A000812737F7BA2FEAA20818C0D40FC146029BF1C8BA72
MD5 SHA1 SHA512 TLSH

Submit Download

config.json.journal

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\config.json.journal
Size 209B
SHA256 a6add1fdcc0ac88820f10e57383178a79a33e4718b3db83fcf05b05622f636c6
MD5 4cb2a8316a86ac2489c60d47a6017b76
SHA1 4c9d3be69a21cfdee7ebc6e80c62ccd0aa3f31cb
SHA512 94b3d8d5a37460c0f7b573a177e6fc3ba950ad0e34f203ab2c15e9ae0bf639563609a56b9524b617feb2896e84c58672200ac80e5de598e11195103b60e905e3
TLSH
T15AD02289E87CA098CC25C74CA48A40A60BDB6A695A260008C0440E79CE0296F1D8B96B
MD5 SHA1 SHA512 TLSH

Submit Download

config.json.journal.tmp-224533490975eb85

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\config.json.journal.tmp-224533490975eb85
Size 351B
SHA256 8a73829849c696a6d23771bda048bc846b47b2eb3381cd84678bbbe04d5279e2
MD5 46b5c8e80ae0d9d90bb234e9a1c2c190
SHA1 a38f7641c0b7f5511a94163eac725fcab1b96c9c
SHA512 9d3077b1e5c39675117b83d6c4bcebb4cdae014c8f5cb67624eaffd1dd5888bae7eba5ebc27f2cd2ada89e1857a2327172426c1bd40fc6e5a920f15ddd746e97
TLSH
T1CFE0C68AA4BCE12AC802C398E48F80DB4B83026C0E0B000880100DA88E652BE2B9B127
MD5 SHA1 SHA512 TLSH

Submit Download

config.json.journal.tmp-2245335339438117

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\config.json.journal.tmp-2245335339438117
Size 292B
SHA256 b4e2199f90c45c77acdd46addc2580854573e720ab4bc2da411d499b38298c4b
MD5 b2424389dcc4ad7f14748ada2d52b033
SHA1 d4b5546f6793aac8cfde9a32e18036d08e34e8c7
SHA512 7d8b5402cde18384a176fbb34a940363b8faf1c7439dd6dff0cc658c5b0785157a3e0d92f5d5d9dd3e1169f9a370dd6a4efc31dd21d8751272e9802c927f15d3
TLSH
T19BE0EB8EA036644AC818C38CA88E40E60BE7027A5E272004C0002D30CD1393E0DDE217
MD5 SHA1 SHA512 TLSH

Submit Download

config.json.journal.tmp-2245335501b2eed0

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\config.json.journal.tmp-2245335501b2eed0
Size 305B
SHA256 7982be8d365af9431c558685554652410d267d5a75d918b7af373385c12f5399
MD5 8779cbd7196c9617e059ed330bdb67fb
SHA1 5cd2451690f1d96df942b72eaca8e10e7d4df3db
SHA512 55ab9414e6367465a9c833770f7040ecb5f8121ebb8fae26eb6ad6d3a31b048e7ccd8ded719733d25bd0e224bc0175b541c35520c5db51f9cc0a2618b10097ca
TLSH
T10DE0E7C5F4386154C511C74C7D1F42E70BD705264862100CC000CD78CD5042F0DA7DB7
MD5 SHA1 SHA512 TLSH

Submit Download

git-worktrees.json

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\git-worktrees.json
Size 23B
SHA256 4f8b8733a54cafbebcf7d9f2e37f7a78d0bc30bbecca37c7463b3e0cf0d68825
MD5 85db7d60d5a340864d277dfd05a7168f
SHA1 beaa9687e1e2645e5e0ae20901ca24c76c22fabe
SHA512 1fcbc5b87299029b612a2a6fba33131a04525a85cf5f73f04e28953e0bce91dae61532a22eb2e435294c0091fa3e7b6f1a7450f2347347aa2e920737dd66908e
MD5 SHA1 SHA512

Submit Download

git-worktrees.json.journal

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\git-worktrees.json.journal
Size 92B
SHA256 fefde3f6dab1b3db02f9d976ef33e13455980941887f90c195048cbac84347cc
MD5 d2184c9f7d424a05c1442eb2d54f13e2
SHA1 5bbc4e70a9668c805ae681f4eeb416e3f85eb2c4
SHA512 5ee1a2bea889c002fc78302b5d43cda30c670fb4730565e2887790cd000ec4df6a580060885591e102beef88aa0bd86107b04aaac70822cad5c7f8002f47576f
TLSH
T13CB012D8BC509A343030131030504E044B80122C902B942DE009A56177201764D0A387
MD5 SHA1 SHA512 TLSH

Submit Download

scope_v3.json

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\sentry\scope_v3.json
Size 7KB
SHA256 4dc5517c6d2b4917348347489ac5c6b64e1b6df346977f6f60332bcb96b36167
MD5 b9e1a5cfa1c939223c68dcff633cb2b9
SHA1 d2e9f2ce4268574627f8cb0634b36ef986c24bb3
SHA512 e34253461b814fe13516cb216decc72c1af795bf6a871add24a2e79ceb857b10f77768b468a23dea8cc9a0d500e8d347d3692ad07dab3441647fa0322ded99c3
SSDEEP 96:V/YFMIa6zecFqwlZvzdHbwH1T/PTcLYnZkWuSEnZkIxf6/WZqHhws8IbC+KdC:qFMiFq0sVT/PTcLYa1SEaIx4mZc
TLSH
T16FF13555192C6DBD1B9693DF30812E0FD3687B828884BC431A59CD8CE1CFDEE612D22E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

APPX.5k0788600et5cbb9eeduf7gbf.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX.5k0788600et5cbb9eeduf7gbf.tmp
Size 11KB
SHA256 93417dbed430d92545db5c12cd0e16211c642388b8002b977e372ef76a86dd1b
MD5 ecdaac680845238c2531d9997605d15e
SHA1 78ef546a8442404c2b116ebc396e51323bd99801
SHA512 fc42cfc06241193cb9716ed2596fac173fda1bd979879b7d05b90915e15e940d26cff38dfbebf248a23a8c7ef5902dcb176ed3bbd7f9c7c0fa5a019bd152abe1
SSDEEP 192:rJG1F4RaP+bromDEEqorIL4VYYzOjcV5TYgTjidn+bkk6W+Gkk63:rJG1F4RaP+bromDEEFrIL4VdzO8HQ+b2
TLSH
T14B32664BD0BD156046B2A567AF13D782EB29095B58DE00C0BCDD46473F76A9F032BB87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

APPX.fg1egzodzxq3tdd5lzalxu21g.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX.fg1egzodzxq3tdd5lzalxu21g.tmp
Size 1.5MB
SHA256 13a2d8b1e1145fe0de399c4f9d47dc8f886a0e39cded3f3c0db95ebb49b79f99
MD5 2c3b594b0869604c06305cbd48dda80f
SHA1 28ac9d1c821bf9fb79e53c6e47cb1f27dec8d178
SHA512 8c9864cdd1b43c195f1e0968b2dd423334c009edaa06ec65978603721ad63fe40b358d5c30b4f96b6d809e5214496da42a8c42c41c3fc41706e5ad9f58c5585d
SSDEEP 12288:roHu2knSzVKuRBhTwVoCXocxjivuWlCaUdz1HHsVtzxEU1UoMm04rD66JiTiujJQ:rF2nKUQ3Ld5baUdzhsVt+UKN4OitnPP
TLSH
T17165B9E1512CFE76816D0AAD8F19F5002C3588365337AE0E9C6E92B318BF9725F674E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

APPX.sgryoy_7xt1ubm05vqy37p99f.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX.sgryoy_7xt1ubm05vqy37p99f.tmp
Size 10KB
SHA256 c3a89871c58ec54554a68531077276c3e25a893e063c31ef9011114fefe45195
MD5 2e105705445a997c27bb30c8aa17e60b
SHA1 234f77e2d47f806fd07e4990357797655ce269dc
SHA512 2b682c4e2b21853ead92158a5debd7a9654cce6756e9878c74ab0f3b1392b4912c01045c673a1181916c06878af832d65d7de144f9ec3114592066812a2b4b75
SSDEEP 192:LdNyEIYiYF80dmL4pUQo78WzP7pDA+Nih86LPc58/l2AudLZ4L:LdNyEIYi2mL46rA+NU86LPd2Fe
TLSH
T18A223B638A941C04DE0B9D5074D4953BEEB6B68A2A9080D3721AC161DB943877FED1FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ClaudeSetup.log

Path C:\Users\Admin\AppData\Local\Temp\ClaudeSetup.log
Size 3KB
SHA256 4a0ebd20be9a3ade521a1a4b54e7c9cba4278ca923a6cf35fe7f922b3a7f093f
MD5 19c6a1a1837315f7c540935917de87f3
SHA1 34ff020ba31a2627d5183d074e91e6ca990883ef
SHA512 220486e713f3540b39a64259cba19b44c8fd515c7e8a2e816e68277e8a6f0d8711b17d53edf586a6d7538dd5ab012b286fbd01297022c3425d6cb8ace67378e3
TLSH
T1D7810B5247D3C07713AD1602A52B62299F0B183EBA1D972D77D0EAC4B41B32D6E722C7
MD5 SHA1 SHA512 TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/4980-158-0x00007FFDCCEE0000-0x00007FFDCCEE1000-memory.dmp

Download

memory/4980-157-0x00007FFDCC1D0000-0x00007FFDCC1D1000-memory.dmp

Download