claude.exe

Top Paths

• C:\Users\lab\AppData\Local\AnthropicClaude\app-1.44121.2
• C:\Users\lab\AppData\Local\AnthropicClaude\app-1.52386.3
• C:\Users\lab\AppData\Local\AnthropicClaude

Top Hashes (SHA256)

• ccb45896fab6c0977eb92666d71e29d1eab4d4cab1cf75ac9cc6f24bc482f4d1
• d7623484ffc720421ea9ee213eed369bf08967442cd792d92de46a03eeaa0692
• 4bc6e8cbf3f5c18fdfe392dad4192cb4b7610ce100d45ade74ac455c7f9cf056
• 087be863cb8ad9c62f712fb36effa2296e252a6e864f6cb3e64172fb4893acbe

Top Grandparents

• claude.exe
• Update.exe
• cmd.exe
• claude-817a7b4563855a33d4b678faefc71f87554445d8.exe
• svchost.exe
• explorer.exe
• userinit.exe

Top Parents

• claude.exe
• Update.exe
• cmd.exe
• explorer.exe

Top Children

• claude.exe
• Update.exe

What does claude.exe normally do?

Claude Desktop is Anthropic's Electron-based client for the Claude AI assistant; it is a per-user application that installs and updates without administrator rights. In the lab, the winget-delivered NSIS installer (signed "Anthropic, PBC") was run with /S, extracted Squirrel Update.exe to %LOCALAPPDATA%\SquirrelTemp, and staged the app into %LOCALAPPDATA%\AnthropicClaude\app-1.44121.2\, producing the expected Squirrel bootstrap chain (Update.exe --install, Squirrel.exe --updateSelf, claude.exe --squirrel-install, Update.exe --createShortcut=claude.exe --shortcut-locations=StartMenu, claude.exe --squirrel-firstrun). At runtime the stub %LOCALAPPDATA%\AnthropicClaude\claude.exe launches the versioned claude.exe, which spawns the normal Chromium child set from its own image path (--type=renderer, --type=gpu-process, --type=utility with network.mojom.NetworkService, audio.mojom.AudioService, video_capture.mojom.VideoCaptureService, and --type=crashpad-handler) all using --user-data-dir=%APPDATA%\Claude. Network activity observed was DNS plus TLS/QUIC to api.anthropic.com, claude.ai, downloads.claude.ai and Cloudflare/Google-fronted endpoints, including Update.exe calling https://api.anthropic.com/api/desktop/win32/x64/squirrel/update with --checkForUpdate/--update. Persistence is a single HKCU Run value "Claude" pointing at %LOCALAPPDATA%\AnthropicClaude\claude.exe --startup.

When is claude.exe suspicious?

claude.exe or Update.exe/Squirrel.exe running from a path other than %LOCALAPPDATA%\AnthropicClaude\ (e.g. %TEMP%, %PUBLIC%, ProgramData, a network share) or with an invalid/absent Anthropic, PBC signature. Update.exe invoked with --processStart / --processStartAndWait / --createShortcut pointing at an executable other than claude.exe, or --update/--checkForUpdate aimed at a non-api.anthropic.com URL or a local/UNC folder containing an attacker-supplied .nupkg. claude.exe launched with ELECTRON_RUN_AS_NODE=1 in the environment, or with --gpu-launcher=, --no-sandbox, --remote-debugging-port, --inspect, --user-data-dir pointing outside %APPDATA%\Claude, or --type= child flags whose parent is not claude.exe. claude.exe spawning cmd.exe, powershell.exe, wscript, node.exe/npx.cmd, uv/uvx or python — legitimate baseline spawned only itself, Update.exe and (for the console stub) conhost.exe; such children usually mean an MCP server entry was added to %APPDATA%\Claude\claude_desktop_config.json. New or modified DLLs dropped into app-<version>\ or its resources, changes to app.asar, modification of the HKCU Run "Claude" value to a different target or added arguments, and claude.exe/Update.exe connecting to hosts unrelated to Anthropic/Cloudflare (raw IPs, paste sites, Telegram, C2 domains) or the crashpad --url being repointed.

How do attackers abuse claude.exe?

Squirrel-packaged Electron apps are an established signed-binary proxy execution vector: the bundled Update.exe (same framework used by Teams, Discord, GitHub Desktop, Slack, 1Password) is a documented LOLBIN whose --processStart/--processStartAndWait arguments run an arbitrary EXE from the sibling app-* directory, and whose --update/--download options will fetch and unpack an attacker-controlled .nupkg from a local path, share or URL, giving execution under an Anthropic-signed parent and defeating naive allow-listing. Because the entire install tree is user-writable under %LOCALAPPDATA%, an unprivileged attacker can replace claude.exe, plant a hijack DLL for the Chromium/Electron loader to side-load, or swap app.asar to inject JavaScript that runs every launch — persistence that piggybacks on the existing HKCU Run "Claude" --startup entry without creating a new autorun. Electron binaries generally are abused as script hosts: setting ELECTRON_RUN_AS_NODE=1 turns claude.exe into a Node interpreter for arbitrary .js payloads, and --gpu-launcher=/--no-sandbox style switches have been used to launch shell commands from a trusted, signed image. AI-assistant specific tradecraft includes tampering with claude_desktop_config.json to register a malicious MCP server (command: cmd/powershell/npx pointing at attacker code), which yields recurring code execution and credential access under the signed app; stealing the app's OAuth/session tokens and Local Storage from %APPDATA%\Claude for account takeover; and prompt-injection of agentic file/terminal capabilities to read secrets or exfiltrate data through api.anthropic.com traffic that blends with normal use. Finally, the well-known filename and publisher make claude.exe an attractive masquerade target for droppers dropped into unrelated directories, and trojanized/typosquatted "Claude Desktop" installers have been distributed via malvertising and fake download sites.

Detection guidance

Baseline the legitimate tree (stub %LOCALAPPDATA%\AnthropicClaude\claude.exe -> app-<ver>\claude.exe -> only self with --type=* children and Update.exe with --checkForUpdate/--update/--createShortcut) and alert on any deviation, especially Update.exe/Squirrel.exe command lines containing --processStart, --processStartAndWait, --createShortcut with a non-claude.exe target, or --update/--download with a UNC/local/non-api.anthropic.com source. Hunt for claude.exe image paths outside %LOCALAPPDATA%\AnthropicClaude, unsigned or non-Anthropic-signed binaries using that name, and unsigned DLLs loaded from the app-<version> directory (DLL side-load/hijack). Alert on claude.exe as parent of cmd.exe, powershell.exe, node.exe, npx, python or wscript, and on process creations where ELECTRON_RUN_AS_NODE is set or the command line includes --gpu-launcher, --no-sandbox, --inspect or --remote-debugging-port. Monitor file integrity on %APPDATA%\Claude\claude_desktop_config.json, app.asar and the HKCU\...\Run \"Claude\" value, and flag claude.exe/Update.exe egress to destinations outside the Anthropic/Cloudflare/Google ranges seen at baseline.

MITRE ATT&CK techniques