d76d7e01f4d58e13b47c7880a0393d8dd0420a1c4b5be85313a2c0a9ac8b38e4

Analysis

user interaction
yes
max time kernel
508s
max time network
510s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 02:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Claude Setup.exe
Size 6.7MB
Sample260804-cmgagabd33
SHA256 d76d7e01f4d58e13b47c7880a0393d8dd0420a1c4b5be85313a2c0a9ac8b38e4
MD5 860db55d4d5f960f0a1100c0c0b19fdc
SHA1 b87283444ce2180184094439699e653a9bddb49c
SHA512 3ad5e19938475fb71e8e0aee6a032d99d48c2fa603e8fed33cd3da059ca45b060cf2f11b2b126a0ed11db095fa28899920bb234c261a7f9628aa6ca0b5a1cc8c
SSDEEP 49152:lFATMATweCaOM1liQ9cz5iqCoFeUwXohxpI4Xp8tiaZch/75vh6YnpjCtvBY7wK0:lFrZlxFlca7p7ainB+DEi
TLSH
T1B8665A43ECA555E9C0AEE23485729253BA717C485F3123D76BA0F7382F76BC06AB9740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	Claude Setup.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_A53644FA0CAAA458C7A0416292C7CC5B	cowork-svc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB	cowork-svc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB	cowork-svc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\616AD1AB067CFD351D6C0EF6F3E12F40	cowork-svc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\616AD1AB067CFD351D6C0EF6F3E12F40	cowork-svc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	cowork-svc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	cowork-svc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_A53644FA0CAAA458C7A0416292C7CC5B	cowork-svc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1484_524682913\hyph-en-us.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1484_524682913\hyph-et.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1484_1352425484\json\i18n-ec\th\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1484_1352425484\json\i18n-notification\ar\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1484_1352425484\json\i18n-notification\ru\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1484_1352425484\json\i18n-notification\zh-Hant\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1484_1352425484\json\i18n-shared-components\cs\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1484_524682913\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1484_1352425484\json\i18n-notification\fi\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1484_1352425484\json\i18n-notification-shared\de\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1484_1352425484\json\i18n-tokenized-card\nl\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1484_1352425484\Wallet-Checkout\wallet-drawer.bundle.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1484_1352425484\wallet-icon.svg	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1484_1352425484\json\i18n-ec\de\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1484_1352425484\json\i18n-ec\en-GB\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6480_1193642520\_locales\es_419\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6480_1193642520\offscreendocument_main.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6480_1193642520\_locales\lo\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6480_1193642520\_locales\cs\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6480_1193642520\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1484_524682913\hyph-lv.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6480_1193642520\_locales\ca\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6480_1193642520\_locales\uk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6480_1193642520\_locales\cy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6480_1193642520\page_embed_script.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1484_692020839\Filtering Rules-CA	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1484_524682913\hyph-mul-ethi.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1484_524682913\hyph-nb.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1484_524682913\hyph-sl.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1484_1352425484\json\i18n-ec\pl\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1484_1352425484\json\i18n-notification-shared\zh-Hant\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1484_1352425484\json\i18n-shared-components\ar\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1484_1352425484\json\i18n-shared-components\it\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1484_1352425484\json\i18n-shared-components\sv\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1484_1352425484\json\i18n-tokenized-card\es\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1484_1352425484\wallet-webui-101.079f5d74a18127cd9d6a.chunk.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1484_1352425484\wallet-webui-227.bb2c3c84778e2589775f.chunk.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1484_524682913\hyph-bg.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6480_1193642520\_locales\hy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6480_1193642520\_locales\ta\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1484_692020839\Part-ES	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1484_1352425484\json\i18n-hub\zh-Hant\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1484_1352425484\json\i18n-notification\ko\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1484_1352425484\json\i18n-notification-shared\es\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1484_1352425484\json\i18n-notification-shared\nl\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6480_1193642520\_locales\is\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6480_1193642520\_locales\no\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6480_1193642520\_locales\sv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6480_1193642520\_locales\en_GB\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1484_524682913\hyph-ga.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1484_524682913\hyph-hi.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1484_692020839\Part-NL	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1484_1352425484\app-setup.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1484_947767465\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1484_524682913\hyph-kn.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1484_1352425484\bnpl_driver.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1484_1352425484\json\i18n-ec\nl\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1484_1352425484\json\i18n-notification-shared\el\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1484_1352425484\json\i18n-notification-shared\zh-Hans\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1484_1352425484\json\i18n-shared-components\fr-CA\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1484_1352425484\json\i18n-shared-components\th\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6480_1193642520\_locales\vi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6480_1193642520\_locales\mr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1484_524682913\hyph-eu.hyb	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6752	msedge.exe
1856	msedge.exe

Checks processor information in registry 2 TTPs 52 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	Claude.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	Claude.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Claude.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 44 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	cowork-svc.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	cowork-svc.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302832328587663"	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	cowork-svc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	cowork-svc.exe

Modifies registry class 25 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\claude\ = "URL:claude"	Claude.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\claude\shell	Claude.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\claude\shell\open	Claude.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{5AE6E551-EFB5-4216-B2DF-C4C5F5D032FA}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\claude	Claude.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\claude\URL Protocol	Claude.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\claude\shell\open\command	Claude.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{129643E9-FBDE-4961-875A-7EF03F65D3E7}	Claude.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\claude_pzs8sxrjxfjjc\Internet Settings\Cache\Extensible Cache	Claude.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\claude_pzs8sxrjxfjjc\Internet Settings\Cache	Claude.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{2FB3EF68-0274-4EBB-A230-0CC07D6A5E4A}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\claude\shell\open\command\ = "\"C:\\Program Files\\WindowsApps\\Claude_1.24012.11.0_x64__pzs8sxrjxfjjc\\app\\Claude.exe\" \"%1\""	Claude.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{BFE49145-C677-4758-8E63-61CFA55AA02E}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{DB6A42F4-3C92-4E0A-8D4D-102A3C059211}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\claude	Claude.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\claude\URL Protocol	Claude.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\claude\ = "URL:claude"	Claude.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\claude\shell\open\command\ = "\"C:\\Program Files\\WindowsApps\\Claude_1.24012.11.0_x64__pzs8sxrjxfjjc\\app\\Claude.exe\" \"%1\""	Claude.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\claude_pzs8sxrjxfjjc\Internet Settings	Claude.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\claude\shell\open\command	Claude.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
4504	reg.exe
4512	reg.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
804	Claude Setup.exe
804	Claude Setup.exe
920	cowork-svc.exe
920	cowork-svc.exe
6876	Claude.exe
6876	Claude.exe
7388	msedge.exe
7388	msedge.exe
10224	msedge.exe
10224	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
6480	msedge.exe
6480	msedge.exe
6480	msedge.exe
6480	msedge.exe
6480	msedge.exe
6480	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	228	Claude.exe
Token: SeCreatePagefilePrivilege	228	Claude.exe
Token: SeShutdownPrivilege	228	Claude.exe
Token: SeCreatePagefilePrivilege	228	Claude.exe
Token: SeShutdownPrivilege	228	Claude.exe
Token: SeCreatePagefilePrivilege	228	Claude.exe
Token: SeShutdownPrivilege	228	Claude.exe
Token: SeCreatePagefilePrivilege	228	Claude.exe
Token: SeShutdownPrivilege	228	Claude.exe
Token: SeCreatePagefilePrivilege	228	Claude.exe
Token: SeShutdownPrivilege	228	Claude.exe
Token: SeCreatePagefilePrivilege	228	Claude.exe
Token: SeShutdownPrivilege	228	Claude.exe
Token: SeCreatePagefilePrivilege	228	Claude.exe
Token: SeShutdownPrivilege	228	Claude.exe
Token: SeCreatePagefilePrivilege	228	Claude.exe
Token: SeShutdownPrivilege	228	Claude.exe
Token: SeCreatePagefilePrivilege	228	Claude.exe
Token: SeShutdownPrivilege	228	Claude.exe
Token: SeCreatePagefilePrivilege	228	Claude.exe
Token: SeShutdownPrivilege	228	Claude.exe
Token: SeCreatePagefilePrivilege	228	Claude.exe
Token: SeShutdownPrivilege	228	Claude.exe
Token: SeCreatePagefilePrivilege	228	Claude.exe
Token: SeShutdownPrivilege	228	Claude.exe
Token: SeCreatePagefilePrivilege	228	Claude.exe
Token: SeShutdownPrivilege	228	Claude.exe
Token: SeCreatePagefilePrivilege	228	Claude.exe
Token: SeShutdownPrivilege	228	Claude.exe
Token: SeCreatePagefilePrivilege	228	Claude.exe
Token: SeShutdownPrivilege	228	Claude.exe
Token: SeCreatePagefilePrivilege	228	Claude.exe
Token: SeShutdownPrivilege	228	Claude.exe
Token: SeCreatePagefilePrivilege	228	Claude.exe
Token: SeShutdownPrivilege	228	Claude.exe
Token: SeCreatePagefilePrivilege	228	Claude.exe
Token: SeShutdownPrivilege	228	Claude.exe
Token: SeCreatePagefilePrivilege	228	Claude.exe
Token: SeShutdownPrivilege	228	Claude.exe
Token: SeCreatePagefilePrivilege	228	Claude.exe
Token: SeShutdownPrivilege	228	Claude.exe
Token: SeCreatePagefilePrivilege	228	Claude.exe
Token: SeShutdownPrivilege	228	Claude.exe
Token: SeCreatePagefilePrivilege	228	Claude.exe
Token: SeShutdownPrivilege	228	Claude.exe
Token: SeCreatePagefilePrivilege	228	Claude.exe
Token: SeShutdownPrivilege	228	Claude.exe
Token: SeCreatePagefilePrivilege	228	Claude.exe
Token: SeShutdownPrivilege	228	Claude.exe
Token: SeCreatePagefilePrivilege	228	Claude.exe
Token: SeShutdownPrivilege	228	Claude.exe
Token: SeCreatePagefilePrivilege	228	Claude.exe
Token: SeShutdownPrivilege	228	Claude.exe
Token: SeCreatePagefilePrivilege	228	Claude.exe
Token: SeShutdownPrivilege	228	Claude.exe
Token: SeCreatePagefilePrivilege	228	Claude.exe
Token: SeShutdownPrivilege	228	Claude.exe
Token: SeCreatePagefilePrivilege	228	Claude.exe
Token: SeShutdownPrivilege	228	Claude.exe
Token: SeCreatePagefilePrivilege	228	Claude.exe
Token: SeShutdownPrivilege	228	Claude.exe
Token: SeCreatePagefilePrivilege	228	Claude.exe
Token: SeShutdownPrivilege	228	Claude.exe
Token: SeCreatePagefilePrivilege	228	Claude.exe

Suspicious use of FindShellTrayWindow 24 IoCs

pid	Process
228	Claude.exe
228	Claude.exe
228	Claude.exe
228	Claude.exe
228	Claude.exe
228	Claude.exe
228	Claude.exe
228	Claude.exe
228	Claude.exe
228	Claude.exe
228	Claude.exe
228	Claude.exe
6480	msedge.exe
6480	msedge.exe
1484	msedge.exe
228	Claude.exe
228	Claude.exe
228	Claude.exe
228	Claude.exe
228	Claude.exe
228	Claude.exe
228	Claude.exe
228	Claude.exe
228	Claude.exe

Suspicious use of SendNotifyMessage 22 IoCs

pid	Process
228	Claude.exe
228	Claude.exe
228	Claude.exe
228	Claude.exe
228	Claude.exe
228	Claude.exe
228	Claude.exe
228	Claude.exe
228	Claude.exe
228	Claude.exe
228	Claude.exe
228	Claude.exe
228	Claude.exe
228	Claude.exe
228	Claude.exe
228	Claude.exe
228	Claude.exe
228	Claude.exe
228	Claude.exe
228	Claude.exe
228	Claude.exe
228	Claude.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3172 wrote to memory of 804	3172	Claude Setup.exe	94
PID 804 wrote to memory of 5304	804	Claude Setup.exe	104
PID 228 wrote to memory of 1508	228	Claude.exe	110
PID 228 wrote to memory of 3660	228	Claude.exe	112
PID 228 wrote to memory of 3264	228	Claude.exe	113
PID 228 wrote to memory of 4212	228	Claude.exe	114
PID 228 wrote to memory of 2332	228	Claude.exe	115
PID 228 wrote to memory of 4512	228	Claude.exe	117
PID 228 wrote to memory of 4504	228	Claude.exe	118
PID 228 wrote to memory of 5220	228	Claude.exe	121
PID 228 wrote to memory of 4472	228	Claude.exe	122
PID 228 wrote to memory of 4464	228	Claude.exe	123
PID 228 wrote to memory of 5348	228	Claude.exe	124
PID 228 wrote to memory of 6480	228	Claude.exe	130
PID 6480 wrote to memory of 6512	6480	msedge.exe	131
PID 6480 wrote to memory of 6752	6480	msedge.exe	132
PID 6480 wrote to memory of 6760	6480	msedge.exe	133
PID 6480 wrote to memory of 6760	6480	msedge.exe	133
PID 6480 wrote to memory of 6760	6480	msedge.exe	133
PID 6480 wrote to memory of 6808	6480	msedge.exe	134
PID 6480 wrote to memory of 6808	6480	msedge.exe	134
PID 6480 wrote to memory of 6968	6480	msedge.exe	136
PID 6480 wrote to memory of 6968	6480	msedge.exe	136
PID 6480 wrote to memory of 6960	6480	msedge.exe	135
PID 6480 wrote to memory of 6968	6480	msedge.exe	136
PID 6480 wrote to memory of 6960	6480	msedge.exe	135
PID 6480 wrote to memory of 6960	6480	msedge.exe	135
PID 6480 wrote to memory of 8392	6480	msedge.exe	141
PID 6480 wrote to memory of 8392	6480	msedge.exe	141
PID 6480 wrote to memory of 8392	6480	msedge.exe	141
PID 6480 wrote to memory of 7300	6480	msedge.exe	142
PID 6480 wrote to memory of 7300	6480	msedge.exe	142
PID 6480 wrote to memory of 7300	6480	msedge.exe	142
PID 6480 wrote to memory of 7440	6480	msedge.exe	143
PID 6480 wrote to memory of 7440	6480	msedge.exe	143
PID 6480 wrote to memory of 7440	6480	msedge.exe	143
PID 6480 wrote to memory of 7468	6480	msedge.exe	144
PID 6480 wrote to memory of 7476	6480	msedge.exe	145
PID 6480 wrote to memory of 7468	6480	msedge.exe	144
PID 6480 wrote to memory of 7740	6480	msedge.exe	146
PID 6480 wrote to memory of 7740	6480	msedge.exe	146
PID 6480 wrote to memory of 7732	6480	msedge.exe	147
PID 6480 wrote to memory of 7732	6480	msedge.exe	147
PID 6480 wrote to memory of 7936	6480	msedge.exe	149
PID 6480 wrote to memory of 5400	6480	msedge.exe	153
PID 6480 wrote to memory of 2312	6480	msedge.exe	154
PID 6480 wrote to memory of 2952	6480	msedge.exe	155
PID 6480 wrote to memory of 1380	6480	msedge.exe	156
PID 6480 wrote to memory of 1380	6480	msedge.exe	156
PID 6480 wrote to memory of 3624	6480	msedge.exe	157
PID 6480 wrote to memory of 3624	6480	msedge.exe	157
PID 6480 wrote to memory of 4488	6480	msedge.exe	158
PID 6480 wrote to memory of 4488	6480	msedge.exe	158
PID 228 wrote to memory of 6876	228	Claude.exe	159
PID 6480 wrote to memory of 8528	6480	msedge.exe	160
PID 6480 wrote to memory of 8528	6480	msedge.exe	160
PID 6480 wrote to memory of 8704	6480	msedge.exe	163
PID 6480 wrote to memory of 8704	6480	msedge.exe	163
PID 6480 wrote to memory of 7184	6480	msedge.exe	164
PID 6480 wrote to memory of 7184	6480	msedge.exe	164
PID 6480 wrote to memory of 7388	6480	msedge.exe	165
PID 6480 wrote to memory of 7564	6480	msedge.exe	166
PID 6480 wrote to memory of 7564	6480	msedge.exe	166
PID 6480 wrote to memory of 1484	6480	msedge.exe	167

C:\Users\Admin\AppData\Local\Temp\Claude Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Claude Setup.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3172
- C:\Users\Admin\AppData\Local\Temp\Claude Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Claude Setup.exe" --elevated --msix-path "C:\Users\Admin\AppData\Local\Temp\Claude-2867611460.msix" --log-path "C:\Users\Admin\AppData\Local\Temp\ClaudeSetup.log" --all-users
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:804
- - C:\Windows\explorer.exe
    explorer.exe shell:AppsFolder\Claude_pzs8sxrjxfjjc!Claude
    3⤵
    PID:5304

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness
1⤵
PID:3012

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
PID:3352

C:\Program Files\WindowsApps\Claude_1.24012.11.0_x64__pzs8sxrjxfjjc\app\resources\cowork-svc.exe
"C:\Program Files\WindowsApps\Claude_1.24012.11.0_x64__pzs8sxrjxfjjc\app\resources\cowork-svc.exe"
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:920

C:\Program Files\WindowsApps\Claude_1.24012.11.0_x64__pzs8sxrjxfjjc\app\Claude.exe
"C:\Program Files\WindowsApps\Claude_1.24012.11.0_x64__pzs8sxrjxfjjc\app\Claude.exe"
1⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:228
- C:\Program Files\WindowsApps\Claude_1.24012.11.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.24012.11.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\Claude /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\Claude\Crashpad --url=https://f.a.k/e --annotation=_productName=Claude --annotation=_version=1.24012.11 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=42.7.0 --initial-client-data=0x490,0x494,0x498,0x48c,0x49c,0x7ff76389d188,0x7ff76389d198,0x7ff76389d1a8
  2⤵
  PID:1508
- C:\Program Files\WindowsApps\Claude_1.24012.11.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.24012.11.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2076,i,12200080098551315057,1513021395938509017,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2080,i,7341649456865549119,7027234189615821608,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:3660
- C:\Program Files\WindowsApps\Claude_1.24012.11.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.24012.11.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --field-trial-handle=2076,i,12200080098551315057,1513021395938509017,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2080,i,7341649456865549119,7027234189615821608,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  PID:3264
- C:\Program Files\WindowsApps\Claude_1.24012.11.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.24012.11.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --app-path="C:\Program Files\WindowsApps\Claude_1.24012.11.0_x64__pzs8sxrjxfjjc\app\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1785808968996941 --launch-time-ticks=579161071 --field-trial-handle=2076,i,12200080098551315057,1513021395938509017,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2080,i,7341649456865549119,7027234189615821608,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2996 --desktop-enterprise-config="{\"forceLoginOrgUUIDs\":null,\"loginSsoOrgDomain\":null,\"disableEssentialTelemetry\":false,\"disableNonessentialTelemetry\":false,\"disableMobileSimulatorTools\":false,\"banner\":null}" /prefetch:1
  2⤵
  PID:4212
- C:\Program Files\WindowsApps\Claude_1.24012.11.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.24012.11.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --app-path="C:\Program Files\WindowsApps\Claude_1.24012.11.0_x64__pzs8sxrjxfjjc\app\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1785808968996941 --launch-time-ticks=579226686 --field-trial-handle=2076,i,12200080098551315057,1513021395938509017,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2080,i,7341649456865549119,7027234189615821608,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3360 --desktop-features="{\"launch\":{\"status\":\"supported\"},\"artifactsPane\":{\"status\":\"unavailable\"},\"nativeQuickEntry\":{\"status\":\"unavailable\"},\"quickEntryDictation\":{\"status\":\"unavailable\"},\"quickEntryGlobalShortcut\":{\"status\":\"supported\"},\"customQuickEntryDictationShortcut\":{\"status\":\"supported\"},\"ultrareviewErrorCategories\":{\"status\":\"supported\"},\"plushRaccoon\":{\"status\":\"unavailable\"},\"quietPenguin\":{\"status\":\"unavailable\"},\"chillingSlothFeat\":{\"status\":\"supported\"},\"chillingSlothSshShell\":{\"status\":\"supported\"},\"chillingSlothEnterprise\":{\"status\":\"supported\"},\"chillingSlothLocal\":{\"status\":\"supported\"},\"chillingSlothPool\":{\"status\":\"unavailable\"},\"yukonSilver\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute\",\"unsupportedCode\":\"hcs_not_available\"},\"yukonSilverGems\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute\",\"unsupportedCode\":\"hcs_not_available\"},\"yukonSilverGemsCache\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute\",\"unsupportedCode\":\"hcs_not_available\"},\"wakeScheduler\":{\"status\":\"unavailable\"},\"desktopTopBar\":{\"status\":\"supported\"},\"ccdPlugins\":{\"status\":\"supported\"},\"computerUse\":{\"status\":\"supported\"},\"computerUseAppScoped\":{\"status\":\"unsupported\",\"reason\":\"Background app-scoped mode is macOS-only\",\"unsupportedCode\":\"unsupported_platform\"},\"coworkWatchRecord\":{\"status\":\"unsupported\",\"reason\":\"Watch-record is not available on this platform\",\"unsupportedCode\":\"unsupported_platform\"},\"coworkWatchers\":{\"status\":\"unavailable\"},\"coworkKappa\":{\"status\":\"unavailable\"},\"coworkArtifacts\":{\"status\":\"unavailable\"},\"coworkAutoModeAlwaysAllowOverride\":{\"status\":\"unavailable\"},\"framebufferPreview\":{\"status\":\"unavailable\"},\"iosSimulator\":{\"status\":\"unsupported\",\"reason\":\"iOS Simulator panel requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"androidEmulator\":{\"status\":\"unsupported\",\"reason\":\"Android emulator is disabled by its rollout flag\",\"unsupportedCode\":\"unknown\"},\"iosSimulatorH264\":{\"status\":\"unsupported\",\"reason\":\"iOS Simulator panel requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"grandPrix\":{\"status\":\"unavailable\"},\"tearOffHalo\":{\"status\":\"unsupported\",\"reason\":\"Tear-off halo overlay requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"coworkArtifactPopout\":{\"status\":\"supported\"},\"claudeDesignWindow\":{\"status\":\"supported\"},\"coworkRemoteSessionSpaces\":{\"status\":\"supported\"},\"spaceMemoryBridge\":{\"status\":\"unavailable\"},\"grandPrixRequest\":{\"status\":\"unavailable\"},\"coworkBranchSession\":{\"status\":\"supported\"},\"coworkScheduledTaskProjects\":{\"status\":\"supported\"},\"coworkLocalSessionProjects\":{\"status\":\"supported\"},\"bootstrapConfig\":{\"status\":\"supported\"},\"chatIn3p\":{\"status\":\"supported\"},\"builtinMcpPresets\":{\"status\":\"supported\"},\"surfaceTogglesPreview\":{\"status\":\"unavailable\"},\"chatTab\":{\"status\":\"unavailable\"},\"chatCodeExecution\":{\"status\":\"unavailable\"},\"mcpPersistentAlwaysAllow\":{\"status\":\"supported\"},\"epitaxyMcpApps\":{\"status\":\"unavailable\"}}" --desktop-enterprise-config="{\"forceLoginOrgUUIDs\":null,\"loginSsoOrgDomain\":null,\"disableEssentialTelemetry\":false,\"disableNonessentialTelemetry\":false,\"disableMobileSimulatorTools\":false,\"banner\":null}" --desktop-telemetry-config="{\"deploymentMode\":\"1p\",\"appVersion\":\"1.24012.11\",\"cookielessOrigin\":false}" /prefetch:1
  2⤵
  PID:2332
- C:\Windows\System32\reg.exe
  C:\Windows\System32\reg.exe query HKLM\SOFTWARE\Policies\ClaudeCode /v Settings
  2⤵
  - Modifies registry key
  PID:4512
- C:\Windows\System32\reg.exe
  C:\Windows\System32\reg.exe query HKCU\SOFTWARE\Policies\ClaudeCode /v Settings
  2⤵
  - Modifies registry key
  PID:4504
- C:\Program Files\WindowsApps\Claude_1.24012.11.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.24012.11.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --app-path="C:\Program Files\WindowsApps\Claude_1.24012.11.0_x64__pzs8sxrjxfjjc\app\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1785808968996941 --launch-time-ticks=579993724 --field-trial-handle=2076,i,12200080098551315057,1513021395938509017,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2080,i,7341649456865549119,7027234189615821608,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3704 --desktop-features="{\"launch\":{\"status\":\"supported\"},\"artifactsPane\":{\"status\":\"unavailable\"},\"nativeQuickEntry\":{\"status\":\"unavailable\"},\"quickEntryDictation\":{\"status\":\"unavailable\"},\"quickEntryGlobalShortcut\":{\"status\":\"supported\"},\"customQuickEntryDictationShortcut\":{\"status\":\"supported\"},\"ultrareviewErrorCategories\":{\"status\":\"supported\"},\"plushRaccoon\":{\"status\":\"unavailable\"},\"quietPenguin\":{\"status\":\"unavailable\"},\"chillingSlothFeat\":{\"status\":\"supported\"},\"chillingSlothSshShell\":{\"status\":\"supported\"},\"chillingSlothEnterprise\":{\"status\":\"supported\"},\"chillingSlothLocal\":{\"status\":\"supported\"},\"chillingSlothPool\":{\"status\":\"unavailable\"},\"yukonSilver\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute\",\"unsupportedCode\":\"hcs_not_available\"},\"yukonSilverGems\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute\",\"unsupportedCode\":\"hcs_not_available\"},\"yukonSilverGemsCache\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute\",\"unsupportedCode\":\"hcs_not_available\"},\"wakeScheduler\":{\"status\":\"unavailable\"},\"desktopTopBar\":{\"status\":\"supported\"},\"ccdPlugins\":{\"status\":\"supported\"},\"computerUse\":{\"status\":\"supported\"},\"computerUseAppScoped\":{\"status\":\"unsupported\",\"reason\":\"Background app-scoped mode is macOS-only\",\"unsupportedCode\":\"unsupported_platform\"},\"coworkWatchRecord\":{\"status\":\"unsupported\",\"reason\":\"Watch-record is not available on this platform\",\"unsupportedCode\":\"unsupported_platform\"},\"coworkWatchers\":{\"status\":\"unavailable\"},\"coworkKappa\":{\"status\":\"unavailable\"},\"coworkArtifacts\":{\"status\":\"unavailable\"},\"coworkAutoModeAlwaysAllowOverride\":{\"status\":\"unavailable\"},\"framebufferPreview\":{\"status\":\"unavailable\"},\"iosSimulator\":{\"status\":\"unsupported\",\"reason\":\"iOS Simulator panel requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"androidEmulator\":{\"status\":\"unsupported\",\"reason\":\"Android emulator is disabled by its rollout flag\",\"unsupportedCode\":\"unknown\"},\"iosSimulatorH264\":{\"status\":\"unsupported\",\"reason\":\"iOS Simulator panel requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"grandPrix\":{\"status\":\"unavailable\"},\"tearOffHalo\":{\"status\":\"unsupported\",\"reason\":\"Tear-off halo overlay requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"coworkArtifactPopout\":{\"status\":\"supported\"},\"claudeDesignWindow\":{\"status\":\"supported\"},\"coworkRemoteSessionSpaces\":{\"status\":\"supported\"},\"spaceMemoryBridge\":{\"status\":\"unavailable\"},\"grandPrixRequest\":{\"status\":\"unavailable\"},\"coworkBranchSession\":{\"status\":\"supported\"},\"coworkScheduledTaskProjects\":{\"status\":\"supported\"},\"coworkLocalSessionProjects\":{\"status\":\"supported\"},\"bootstrapConfig\":{\"status\":\"supported\"},\"chatIn3p\":{\"status\":\"supported\"},\"builtinMcpPresets\":{\"status\":\"supported\"},\"surfaceTogglesPreview\":{\"status\":\"unavailable\"},\"chatTab\":{\"status\":\"unavailable\"},\"chatCodeExecution\":{\"status\":\"unavailable\"},\"mcpPersistentAlwaysAllow\":{\"status\":\"supported\"},\"epitaxyMcpApps\":{\"status\":\"unavailable\"}}" --desktop-enterprise-config="{\"forceLoginOrgUUIDs\":null,\"loginSsoOrgDomain\":null,\"disableEssentialTelemetry\":false,\"disableNonessentialTelemetry\":false,\"disableMobileSimulatorTools\":false,\"banner\":null}" --desktop-telemetry-config="{\"deploymentMode\":\"1p\",\"appVersion\":\"1.24012.11\",\"cookielessOrigin\":false}" /prefetch:1
  2⤵
  PID:5220
- C:\Program Files\WindowsApps\Claude_1.24012.11.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.24012.11.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --app-path="C:\Program Files\WindowsApps\Claude_1.24012.11.0_x64__pzs8sxrjxfjjc\app\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --time-ticks-at-unix-epoch=-1785808968996941 --launch-time-ticks=584217630 --field-trial-handle=2076,i,12200080098551315057,1513021395938509017,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2080,i,7341649456865549119,7027234189615821608,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=4636 --desktop-features="{\"launch\":{\"status\":\"supported\"},\"artifactsPane\":{\"status\":\"unavailable\"},\"nativeQuickEntry\":{\"status\":\"unavailable\"},\"quickEntryDictation\":{\"status\":\"unavailable\"},\"quickEntryGlobalShortcut\":{\"status\":\"supported\"},\"customQuickEntryDictationShortcut\":{\"status\":\"supported\"},\"ultrareviewErrorCategories\":{\"status\":\"supported\"},\"plushRaccoon\":{\"status\":\"unavailable\"},\"quietPenguin\":{\"status\":\"unavailable\"},\"chillingSlothFeat\":{\"status\":\"supported\"},\"chillingSlothSshShell\":{\"status\":\"supported\"},\"chillingSlothEnterprise\":{\"status\":\"supported\"},\"chillingSlothLocal\":{\"status\":\"supported\"},\"chillingSlothPool\":{\"status\":\"unavailable\"},\"yukonSilver\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute\",\"unsupportedCode\":\"hcs_not_available\"},\"yukonSilverGems\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute\",\"unsupportedCode\":\"hcs_not_available\"},\"yukonSilverGemsCache\":{\"status\":\"unsupported\",\"reason\":\"Missing HCS services: HNS, vmcompute\",\"unsupportedCode\":\"hcs_not_available\"},\"wakeScheduler\":{\"status\":\"unavailable\"},\"desktopTopBar\":{\"status\":\"supported\"},\"ccdPlugins\":{\"status\":\"supported\"},\"computerUse\":{\"status\":\"supported\"},\"computerUseAppScoped\":{\"status\":\"unsupported\",\"reason\":\"Background app-scoped mode is macOS-only\",\"unsupportedCode\":\"unsupported_platform\"},\"coworkWatchRecord\":{\"status\":\"unsupported\",\"reason\":\"Watch-record is not available on this platform\",\"unsupportedCode\":\"unsupported_platform\"},\"coworkWatchers\":{\"status\":\"unavailable\"},\"coworkKappa\":{\"status\":\"unavailable\"},\"coworkArtifacts\":{\"status\":\"unavailable\"},\"coworkAutoModeAlwaysAllowOverride\":{\"status\":\"unavailable\"},\"framebufferPreview\":{\"status\":\"unavailable\"},\"iosSimulator\":{\"status\":\"unsupported\",\"reason\":\"iOS Simulator panel requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"androidEmulator\":{\"status\":\"unsupported\",\"reason\":\"Android emulator is disabled by its rollout flag\",\"unsupportedCode\":\"unknown\"},\"iosSimulatorH264\":{\"status\":\"unsupported\",\"reason\":\"iOS Simulator panel requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"grandPrix\":{\"status\":\"unavailable\"},\"tearOffHalo\":{\"status\":\"unsupported\",\"reason\":\"Tear-off halo overlay requires macOS\",\"unsupportedCode\":\"unsupported_platform\"},\"coworkArtifactPopout\":{\"status\":\"supported\"},\"claudeDesignWindow\":{\"status\":\"supported\"},\"coworkRemoteSessionSpaces\":{\"status\":\"supported\"},\"spaceMemoryBridge\":{\"status\":\"unavailable\"},\"grandPrixRequest\":{\"status\":\"unavailable\"},\"coworkBranchSession\":{\"status\":\"supported\"},\"coworkScheduledTaskProjects\":{\"status\":\"supported\"},\"coworkLocalSessionProjects\":{\"status\":\"supported\"},\"bootstrapConfig\":{\"status\":\"supported\"},\"chatIn3p\":{\"status\":\"supported\"},\"builtinMcpPresets\":{\"status\":\"supported\"},\"surfaceTogglesPreview\":{\"status\":\"unavailable\"},\"chatTab\":{\"status\":\"unavailable\"},\"chatCodeExecution\":{\"status\":\"unavailable\"},\"mcpPersistentAlwaysAllow\":{\"status\":\"supported\"},\"epitaxyMcpApps\":{\"status\":\"unavailable\"}}" --desktop-enterprise-config="{\"forceLoginOrgUUIDs\":null,\"loginSsoOrgDomain\":null,\"disableEssentialTelemetry\":false,\"disableNonessentialTelemetry\":false,\"disableMobileSimulatorTools\":false,\"banner\":null}" --desktop-telemetry-config="{\"deploymentMode\":\"1p\",\"appVersion\":\"1.24012.11\",\"cookielessOrigin\":false}" /prefetch:1
  2⤵
  PID:4472
- C:\Program Files\WindowsApps\Claude_1.24012.11.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.24012.11.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --field-trial-handle=2076,i,12200080098551315057,1513021395938509017,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2080,i,7341649456865549119,7027234189615821608,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=4748 /prefetch:8
  2⤵
  - Modifies registry class
  PID:4464
- C:\Program Files\WindowsApps\Claude_1.24012.11.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.24012.11.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --field-trial-handle=2076,i,12200080098551315057,1513021395938509017,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2080,i,7341649456865549119,7027234189615821608,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=4512 /prefetch:8
  2⤵
  PID:5348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://claude.com/cai/login/app-google-auth?open_in_browser=1
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:6480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2e8,0x7ffc3212c188,0x7ffc3212c194,0x7ffc3212c1a0
    3⤵
    PID:6512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,10360453671492275232,411831719744602736,524288 --field-trial-handle=2136,i,2114735891368666352,11905883094376792258,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:3
    3⤵
    - System Time Discovery
    PID:6752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1752,i,16477532736092811538,3736321766826714231,262144 --field-trial-handle=2136,i,2114735891368666352,11905883094376792258,262144 --variations-seed-version --mojo-platform-channel-handle=2132 /prefetch:2
    3⤵
    PID:6760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2632,i,6352382175002609956,11674579030170490056,524288 --field-trial-handle=2136,i,2114735891368666352,11905883094376792258,262144 --variations-seed-version --mojo-platform-channel-handle=2760 /prefetch:8
    3⤵
    PID:6808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3404,i,17697708525245850224,9804909065419873898,2097152 --field-trial-handle=2136,i,2114735891368666352,11905883094376792258,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
    3⤵
    PID:6960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,2551776099420117918,4694559447715383188,2097152 --field-trial-handle=2136,i,2114735891368666352,11905883094376792258,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
    3⤵
    PID:6968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4900,i,8999750307521374966,13416140585308422966,2097152 --field-trial-handle=2136,i,2114735891368666352,11905883094376792258,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:1
    3⤵
    PID:8392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5240,i,14075921584920226823,15000980862228332425,2097152 --field-trial-handle=2136,i,2114735891368666352,11905883094376792258,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:1
    3⤵
    PID:7300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3660,i,4293843274111669485,1891993896067188004,2097152 --field-trial-handle=2136,i,2114735891368666352,11905883094376792258,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
    3⤵
    PID:7440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3548,i,16567613721239732788,6308659582914520298,524288 --field-trial-handle=2136,i,2114735891368666352,11905883094376792258,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:8
    3⤵
    PID:7468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3512,i,10276499063698293725,11561822921259151914,524288 --field-trial-handle=2136,i,2114735891368666352,11905883094376792258,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:8
    3⤵
    - Modifies registry class
    PID:7476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5624,i,17630341210974126040,4565929350559509873,524288 --field-trial-handle=2136,i,2114735891368666352,11905883094376792258,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:8
    3⤵
    PID:7740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5628,i,18143172383985930127,6220188902398090202,524288 --field-trial-handle=2136,i,2114735891368666352,11905883094376792258,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:8
    3⤵
    PID:7732
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,1218659005091264859,1981853385327211106,524288 --field-trial-handle=2136,i,2114735891368666352,11905883094376792258,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:8
    3⤵
    PID:7928
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,1218659005091264859,1981853385327211106,524288 --field-trial-handle=2136,i,2114735891368666352,11905883094376792258,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:8
    3⤵
    PID:7936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6536,i,13502845696160409401,8191210336904642493,524288 --field-trial-handle=2136,i,2114735891368666352,11905883094376792258,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:8
    3⤵
    PID:5400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6532,i,11079581990545418506,4734384466656039463,524288 --field-trial-handle=2136,i,2114735891368666352,11905883094376792258,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:8
    3⤵
    PID:2312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,7137456627610071558,11268795501174567508,524288 --field-trial-handle=2136,i,2114735891368666352,11905883094376792258,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:8
    3⤵
    PID:2952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6680,i,5205325932442794336,16867663893991379230,524288 --field-trial-handle=2136,i,2114735891368666352,11905883094376792258,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:8
    3⤵
    PID:1380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6784,i,1814379295352933641,8244653529335037809,524288 --field-trial-handle=2136,i,2114735891368666352,11905883094376792258,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:8
    3⤵
    PID:3624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4088,i,6689801215498799540,962485434087375770,524288 --field-trial-handle=2136,i,2114735891368666352,11905883094376792258,262144 --variations-seed-version --mojo-platform-channel-handle=2872 /prefetch:8
    3⤵
    PID:4488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5748,i,12005858976620764454,9207250382692590036,524288 --field-trial-handle=2136,i,2114735891368666352,11905883094376792258,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:8
    3⤵
    PID:8528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,9467333945234334969,1380184564532133502,524288 --field-trial-handle=2136,i,2114735891368666352,11905883094376792258,262144 --variations-seed-version --mojo-platform-channel-handle=6948 /prefetch:8
    3⤵
    PID:8704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6928,i,13083134777108784114,2535674137359337130,524288 --field-trial-handle=2136,i,2114735891368666352,11905883094376792258,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:8
    3⤵
    PID:7184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7024,i,8561436519827400635,13516135031573120858,262144 --field-trial-handle=2136,i,2114735891368666352,11905883094376792258,262144 --variations-seed-version --mojo-platform-channel-handle=6996 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:7388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7012,i,4630049769269699754,12446941266830538619,524288 --field-trial-handle=2136,i,2114735891368666352,11905883094376792258,262144 --variations-seed-version --mojo-platform-channel-handle=7016 /prefetch:8
    3⤵
    PID:7564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Drops file in Program Files directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    PID:1484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffc3212c188,0x7ffc3212c194,0x7ffc3212c1a0
      4⤵
      PID:4512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,12309660469110529697,9744464813235815733,524288 --field-trial-handle=2316,i,8918176282422168939,10831018846364377949,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:3
      4⤵
      System Time Discovery
      PID:1856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,3321423842630730772,11972686171305792362,262144 --field-trial-handle=2316,i,8918176282422168939,10831018846364377949,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
      4⤵
      PID:5292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2564,i,17592479305243521492,4232363746119153804,524288 --field-trial-handle=2316,i,8918176282422168939,10831018846364377949,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:8
      4⤵
      PID:5296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4524,i,3827572583214079436,17641882727881806413,524288 --field-trial-handle=2316,i,8918176282422168939,10831018846364377949,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:8
      4⤵
      PID:4776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4524,i,3827572583214079436,17641882727881806413,524288 --field-trial-handle=2316,i,8918176282422168939,10831018846364377949,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:8
      4⤵
      PID:4680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4908,i,746382772778861344,1511818355179923670,2097152 --field-trial-handle=2316,i,8918176282422168939,10831018846364377949,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:1
      4⤵
      PID:8992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=4912,i,6347772483447497140,1729222624848220291,2097152 --field-trial-handle=2316,i,8918176282422168939,10831018846364377949,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:1
      4⤵
      PID:7080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,8715452463251236048,5804860942737234985,524288 --field-trial-handle=2316,i,8918176282422168939,10831018846364377949,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:8
      4⤵
      PID:9028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5456,i,7111258212989236115,9292222223312560672,524288 --field-trial-handle=2316,i,8918176282422168939,10831018846364377949,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:8
      4⤵
      PID:9024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5912,i,12608528075433023155,16939017606653873420,2097152 --field-trial-handle=2316,i,8918176282422168939,10831018846364377949,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:1
      4⤵
      PID:9156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5048,i,13045082182310391998,8533934381513895063,2097152 --field-trial-handle=2316,i,8918176282422168939,10831018846364377949,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:1
      4⤵
      PID:7684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5792,i,6013847006912588798,3701501074687575053,2097152 --field-trial-handle=2316,i,8918176282422168939,10831018846364377949,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:1
      4⤵
      PID:4628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,14407894737892173536,12833889426480270838,524288 --field-trial-handle=2316,i,8918176282422168939,10831018846364377949,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:8
      4⤵
      PID:3316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,11031406137540971295,4549868546553008222,524288 --field-trial-handle=2316,i,8918176282422168939,10831018846364377949,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:8
      4⤵
      Modifies registry class
      PID:7888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6728,i,11775746381582303861,17356803374586249507,524288 --field-trial-handle=2316,i,8918176282422168939,10831018846364377949,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:8
      4⤵
      PID:5264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6648,i,136938431785455257,17229027429387528186,524288 --field-trial-handle=2316,i,8918176282422168939,10831018846364377949,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:8
      4⤵
      PID:2440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6656,i,2026274174384770162,2139216107088351369,524288 --field-trial-handle=2316,i,8918176282422168939,10831018846364377949,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:8
      4⤵
      PID:1432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3148,i,1626878704795639259,6211282809419443783,524288 --field-trial-handle=2316,i,8918176282422168939,10831018846364377949,262144 --variations-seed-version --mojo-platform-channel-handle=3124 /prefetch:8
      4⤵
      PID:6952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2100,i,7817808812478960107,12139209823042605251,524288 --field-trial-handle=2316,i,8918176282422168939,10831018846364377949,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:8
      4⤵
      PID:7544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6648,i,2291623671222214454,10905245646193509521,524288 --field-trial-handle=2316,i,8918176282422168939,10831018846364377949,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:8
      4⤵
      PID:8560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5652,i,271747418146845867,8876658301696313428,524288 --field-trial-handle=2316,i,8918176282422168939,10831018846364377949,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:8
      4⤵
      PID:6684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4188,i,9421243303215232815,6873095657900814170,524288 --field-trial-handle=2316,i,8918176282422168939,10831018846364377949,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:8
      4⤵
      PID:5492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=784,i,10518682806557866516,6179716356604473927,524288 --field-trial-handle=2316,i,8918176282422168939,10831018846364377949,262144 --variations-seed-version --mojo-platform-channel-handle=780 /prefetch:8
      4⤵
      PID:9716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5600,i,2261440372512784142,12281420685485403431,262144 --field-trial-handle=2316,i,8918176282422168939,10831018846364377949,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:10224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6596,i,15539402868806714295,6045798034921186759,524288 --field-trial-handle=2316,i,8918176282422168939,10831018846364377949,262144 --variations-seed-version --mojo-platform-channel-handle=6912 /prefetch:8
      4⤵
      PID:10020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6848,i,14830769550440574437,6656283582053796644,524288 --field-trial-handle=2316,i,8918176282422168939,10831018846364377949,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:8
      4⤵
      PID:8460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=6592,i,16225146147274889464,8797199346562746232,2097152 --field-trial-handle=2316,i,8918176282422168939,10831018846364377949,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:1
      4⤵
      PID:4656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=5160,i,1788969573175327727,10181066780198907722,2097152 --field-trial-handle=2316,i,8918176282422168939,10831018846364377949,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:1
      4⤵
      PID:5052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=5968,i,4441703862545756691,16448511801690481399,2097152 --field-trial-handle=2316,i,8918176282422168939,10831018846364377949,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:1
      4⤵
      PID:9532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,15374438446914680287,4704262091553137664,524288 --field-trial-handle=2316,i,8918176282422168939,10831018846364377949,262144 --variations-seed-version --mojo-platform-channel-handle=4092 /prefetch:8
      4⤵
      PID:9456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,5353088085565739798,1376827960126650637,524288 --field-trial-handle=2316,i,8918176282422168939,10831018846364377949,262144 --variations-seed-version --mojo-platform-channel-handle=1820 /prefetch:8
      4⤵
      PID:2324
  - - C:\Program Files\WindowsApps\Claude_1.24012.11.0_x64__pzs8sxrjxfjjc\app\Claude.exe
      "C:\Program Files\WindowsApps\Claude_1.24012.11.0_x64__pzs8sxrjxfjjc\app\Claude.exe" "claude://login/google-auth?code=4%2F0AXEQxIAh8HIRjM8BKDejrP4IkcsFLrQtaU-_PBWmYlgiby1o8pmW5_gePZwTEXw0FPHWhQ"
      4⤵
      Checks processor information in registry
      Modifies registry class
      PID:7012
    - - C:\Program Files\WindowsApps\Claude_1.24012.11.0_x64__pzs8sxrjxfjjc\app\Claude.exe
        
        "C:\Program Files\WindowsApps\Claude_1.24012.11.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\Claude /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\Claude\Crashpad --url=https://f.a.k/e --annotation=_productName=Claude --annotation=_version=1.24012.11 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=42.7.0 --initial-client-data=0x4a8,0x4ac,0x4b0,0x4a4,0x4b4,0x7ff76389d188,0x7ff76389d198,0x7ff76389d1a8
        5⤵
        
        PID:8544
    - - C:\Program Files\WindowsApps\Claude_1.24012.11.0_x64__pzs8sxrjxfjjc\app\Claude.exe
        
        "C:\Program Files\WindowsApps\Claude_1.24012.11.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2004,i,2729362983339843757,4626047791909933227,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2008,i,351232302002108737,4720211662349198082,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2000 /prefetch:2
        5⤵
        
        PID:2572
    - - C:\Program Files\WindowsApps\Claude_1.24012.11.0_x64__pzs8sxrjxfjjc\app\Claude.exe
        
        "C:\Program Files\WindowsApps\Claude_1.24012.11.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --standard-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app --secure-schemes=cowork-artifact,cowork-file,claude-media,claude-simulator,app,sentry-ipc --bypasscsp-schemes=claude-media,claude-simulator,sentry-ipc --cors-schemes=claude-simulator,sentry-ipc --fetch-schemes=cowork-artifact,cowork-file,claude-simulator,app,sentry-ipc --service-worker-schemes=app --streaming-schemes=cowork-file,claude-media,claude-simulator --field-trial-handle=2004,i,2729362983339843757,4626047791909933227,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2008,i,351232302002108737,4720211662349198082,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2352 /prefetch:3
        5⤵
        
        PID:6288
- C:\Program Files\WindowsApps\Claude_1.24012.11.0_x64__pzs8sxrjxfjjc\app\Claude.exe
  "C:\Program Files\WindowsApps\Claude_1.24012.11.0_x64__pzs8sxrjxfjjc\app\Claude.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\Claude" --gpu-preferences=SAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAEIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2076,i,12200080098551315057,1513021395938509017,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2080,i,7341649456865549119,7027234189615821608,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=1260 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://claude.com/cai/login/app-google-auth?open_in_browser=1
  2⤵
  PID:8936

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x44c 0x498
1⤵
PID:2772

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:7152

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5588

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:404

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

notification_fast.bundle.js.LICENSE.txt

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1484_1352425484\Notification\notification_fast.bundle.js.LICENSE.txt
Size 551B
SHA256 38ed54eb53300fdb6e997c39c9fc83a224a1fd9fa06a0b6d200aa12ea278c179
MD5 7bf61e84e614585030a26b0b148f4d79
SHA1 c4ffbc5c6aa599e578d3f5524a59a99228eea400
SHA512 ca5f2d3a4f200371927c265b9fb91b8bcd0fbad711559f796f77b695b9038638f763a040024ed185e67be3a7b58fab22a6f8114e73fdbd1cccdda6ef94ff88f3
TLSH
T108F08B5A31E12673416285A1270B52DE7F0C10BDB0AF39779444C3386C348EE82D0EE1
MD5 SHA1 SHA512 TLSH

Submit Download

tokenized-card.bundle.js.LICENSE.txt

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1484_1352425484\Tokenized-Card\tokenized-card.bundle.js.LICENSE.txt
Size 1KB
SHA256 363f376ab7893c808866a830fafbcd96ae6be93ec7a85fabf52246273cf56831
MD5 8595bdd96ab7d24cc60eb749ce1b8b82
SHA1 3b612cc3d05e372c5ac91124f3756bbf099b378d
SHA512 555c0c384b6fcfc2311b47c0b07f8e34243de528cf1891e74546b6f4cda338d75c2e2392827372dc39e668ed4c2fd1a02112d8136d2364f9cab9ee4fa1bd87f5
TLSH
T1A2313A5B32F53673416245A1670B52DEBF0C24AEB56F38B79495C3387C388ED82D1DA1
MD5 SHA1 SHA512 TLSH

Submit Download

strings.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1484_1352425484\json\i18n-tokenized-card\fr-CA\strings.json
Size 2KB
SHA256 c67b555372582b07df86a6ce3329a854e349ba9525d7be0672517bab0ac14db5
MD5 cd247582beb274ca64f720aa588ffbc0
SHA1 4aaeef0905e67b490d4a9508ed5d4a406263ed9c
SHA512 bf8fa4bd7c84038fae9eddb483ae4a31d847d5d47b408b3ea84d46d564f15dfc2bae6256eac4a852dd1c4ad8e58bc542e3df30396be05f30ed07e489ebe52895
TLSH
T17251EE3D88F4489B60C7921B6B1142D7C9704E36D704F3848A63828A035BDEFB0BF69D
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1484_1352425484\manifest.json
Size 121B
SHA256 cd25cc1afcc03514d978f0a90692454e810c3cc81763074e0ea5ac504255335a
MD5 8083caaf7f5bc5f01ede464e68db1c7e
SHA1 ed6cf18f79c4ee2968adfffe7bf1bce163ef3873
SHA512 60924bd5617ac5f994805f9a871999764ba93c6adda79c501a0b692dce51b9db6f6531a5e25129bc424ae7c4de868ba6e5a976d6bcfbac2bb8bd192c5513c7ee
TLSH
T10CB0922289429D300469079809B486A6E230674BE406F0397B7041CC8B785B8A4A2A94
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1484_173844600\data.txt
Size 150KB
SHA256 e589f794c343744314bb92dc03cb87b0aabe1a0e4df61bd77327638125d6e1a3
MD5 67a2e4e53750b6b992e203c4e98608bd
SHA1 f84203baa2f63c3dd4e3e6378e9d74faaa27a35b
SHA512 86c77bc809e6e9d80b1e1c16ad97f6a3e9fad6b010f322e0e1146c8cccbb9c0f71146a87e1e6094034c0adb5c2e5f9229a90551bea00b9df975a4a6c05246a6c
SSDEEP 3072:0PAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEEn1dm//OKXXJ1RxGfI:YX1aI5aZoKzMJ07NC1d81xGg
TLSH
T11BE3F210CAC41FECDEA4262C60FE0F1D6790C78D883B6A89D7A7FE4A5F9750895274C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1484_173844600\manifest.json
Size 53B
SHA256 551c5f7ed9a2139eab8089f6fd9724b0b38d226b369209cb2ac295b3884571d3
MD5 1bd4aa2766777b47a4fc061677395793
SHA1 5e88d6015511963e10083771e9747459117b0eba
SHA512 0d7d7b5d8f5ea16308268e5ac5986195d5238bf5f30465fc541c70de8dcf8b3f87bb1e2bc38e837119df1d52a78072088d5c822836d04490027a8e071f52db0a
TLSH
T1519002604424951716C10F5065B0BC819391765995850D1D0545155902A546CE054298
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1484_284478527\manifest.json
Size 1002B
SHA256 dca3cd7a673d0776a085c0b8958a85bdd8392923db21a0b55f4d37210f752322
MD5 9be87722ce3608a2d38a79079feaa394
SHA1 34ed541044567272d5402b30fa99eff29d70e9b9
SHA512 d4d22a3c277a9cc3325f4f6f15f18c56efc6945ce8abccae32d66158b9f35039b347e93d0f1002b66336fbef2d750f78184e6a4b72644cb71a2ef944af52388d
TLSH
T10B119B00CC388DD322D4BAA21CC6580A93621DAF4CC23E84339E161D8F1C8AB927366C
MD5 SHA1 SHA512 TLSH

Submit Download

edge_checkout_page_validator.js

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1484_333861795\edge_checkout_page_validator.js
Size 1016KB
SHA256 86208bb3500717034023380e5d9e9c3c0ebfe3cd5adfad3963b9796f3765efc6
MD5 b9f59640dff40afd5a815660d7547e3b
SHA1 0e47c4972840a7ca2aaec3bf75bccde7b206ed6c
SHA512 421cdc2761dd29c581e8676f075123352c09eb0781a28943d09c653580ba69a207cae674a6e300d6a1ddc26c6f52c55d972b669248f902276557f89429acf639
SSDEEP 24576:c14wmRAbskvG7kVKApnuQ+N4aETI/VMXK4/0YMtQZ8O9vaRS/vzHEiJsfamM1A9n:c14wmRAgkvG7kVKApnuQ+N4aETI/VMXM
TLSH
T19F252B84E1E2253466D748B960B7D2C4B5DC04583399F1E8FA6C68CADB0FD4723F663A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1484_333861795\manifest.json
Size 146B
SHA256 aeefe4f81560fcaff3291ea907bb7a77361e90e68b866a3e30305edb239c8034
MD5 b5198ae671d9790681e5f5531b056679
SHA1 b53dd9270669ddcc2e53dcbde5add5baa165e29d
SHA512 9107edede2dfc2fd54b2dd11f434457dfcbc79d859172b6bec71afc97bef626e751bf3c5fb671c3f605d07e56f86d222586e4801ec7b7a2357f9067f069611c8
TLSH
T132C02B33C831AC30053007D408F08741EB34134BF500B0163730008D0B3C4706030AD0
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-as.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1484_524682913\hyph-as.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-hi.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1484_524682913\hyph-hi.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nb.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1484_524682913\hyph-nb.hyb
Size 141KB
SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
MD5 677edd1a17d50f0bd11783f58725d0e7
SHA1 98fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA512 c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgk:p73HEUP8dsiinTThjy90VKk
TLSH
T1CCE319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1484_524682913\manifest.json
Size 82B
SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
MD5 2617c38bed67a4190fc499142b6f2867
SHA1 a37f0251cd6be0a6983d9a04193b773f86d31da1
SHA512 b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0
TLSH
T137A022A0BC0880333E8803A8023E83E3C3BE3E0A20003C0002A33C8022EC33B3038E2C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1484_692020839\manifest.json
Size 116B
SHA256 181a1631374b5ac1fff89559f7e23498ad9ee4796885d7b956d5e7d5f9c3f8c7
MD5 daf93729356a67ea1f849554827fdab1
SHA1 17dad0cbc82d5e04fb068896a5832f983e124c01
SHA512 473d9d608f2f3324d5db6eddeb4554a7271df4a6b62377820d935c001a8a2376479aa4d3e3b80ffbfdd3ba80f56fe72f1bc9dd020bcb396182b753353b883a30
TLSH
T1FBB09262A8084633249523F4A2639363CBA86D4A91346606091B9480659E73B22A5219
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1484_947767465\manifest.json
Size 118B
SHA256 a50a524184b2420fa2d050e10c7ecc90ff3ddddbc1d39dd7f6ee65aea7e89904
MD5 0839dbc235945a441183b3b1c54e7cff
SHA1 7d50cc09092601adbdfb99927ad0cea8f9b5be01
SHA512 5ef438077e1f23aa36d9abd6639769eedbdffdda85ee368f386638c288893a1b80c8ecac9eb9659b5559296a189c77fc24a7b716bb7914868e6744a30e7bd50e
TLSH
T1EBB092B00C0AA03B22819B60ECA0668683F81218E8029B1A088036482F8817880362F2
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping6480_102807806\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping6480_1157358167\manifest.json
Size 78B
SHA256 c7e506687caffcf3906916ad3fc190a19212d67a2535479241096bd0d4418b03
MD5 259f068207f60fb9d4448c02c27b74ba
SHA1 99131d95cce94750a928738a99caa5c710bbc924
SHA512 fa41eac9d1ca244d06083e3d4230dd94700861155359722c1d815d0d9933dcd39c113b6f0f6ea02ff7ee1acd2fbc6ed40267d557afde16f417e80b678e8136bd
TLSH
T173A02230AC02E23320C803B002B083C383A02C02302A388C0B0320A232C823BE2F323C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 110d3f52d5ee708e756475c42c9d7696a9f600de79d860a23196205019c54e9e
MD5 91d4e9de75d02eed75be1e704645d7f0
SHA1 d2e4f69a97b4cf6daaa2b363bfbcd0264f01b808
SHA512 469a7fd01e674783f481c9ad0d98d20f9afdc148ecb0a22e7831f840a2bf0931adb051c36568c96641584525b796852be513a5fb749693d1f60dee1ea4ac60a7
TLSH
T131D097F8691AB2A0E03D083260204600B22C06A228A3A306E1AD180CDDB800062CAAC9
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 406e7c7edcfff381dae0011c6c736d968f75ef9fe94379575d6e7d534fef8a28
MD5 79c1fb19453a711f80a76228aa029ddf
SHA1 cc58c6b526aa44fbf712bd49a5b3d6b3629387cd
SHA512 2b533049efc6deefdf16676e9b78ce0a9da1e25ee089a31db9602002415956d2a0ddd2ffd8374c39023ba7a264569a0e38288723c0eecf7fca83f200c19fd673
TLSH
T136D0A7F8A746A260D12E09316824A610B76946A038A7D722D079680DA99D028A2EE189
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5f4b8c7ef94f92966eadd78c8f7fef1dcd3f4fc4d95c6a380bed809139e3fc66
MD5 575d3e8d2a5579eae9a4e0a10f7dc4a7
SHA1 98e5d6048b1cfb8f106445c87113a4d3709e04f4
SHA512 8da140524ef053b64b97ea068954b18b3ab50fec2ceec94e6c35515032ecd8b4efdafd6b831b57c9351f3e6754d41df1ca10c703fff73efb87e8a5651f7ff1d9
TLSH
T138D0A7F4A746A360D11E09316864A610B76946A138A7D726D079680DB99C038A2EE189
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 dabff0743388ed2af42c9dee8fd13cba97e67fc1446a31bdd40c9d9a6b00a32c
MD5 de0b12ae19c554fd7c058849e8031cb8
SHA1 a75fbf725c3a5773722f33ed9eb79dde4cd8a47d
SHA512 05f3bf531f0cb5dc2259eaee73d75ff7fc4eee7df863219e299b02ea1ce6510f3506c18df9098fddbaa6a41ffceccbf09ad861dd7c5479c0bf4058ad16c21d3f
TLSH
T173E0269884C8CAAEB604A4C7A274434CC2C0368EAFC8E98E176088CD3045484A7C6AB8
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 80245d6cd500a8d0806d07540a5b6d82a9d6a628007605312a7945eb9c743dcd
MD5 94d867113203a147d3c19ac678ca5d52
SHA1 5cb266047f92e78e3fd44719883fd1d5df27e32d
SHA512 467aefec2a2e7f650890e1ed71fd3f4379da4816bcab7af747b1382e6cd9328cf03d34f933e9f47e3a532509da120ddad0fc95def4c983470da40e3fa4a3f3cc
TLSH
T1F0E0269405C8C72ED680A8C7A264430CE2C1760EDEC8EA8A1F54848DF082040B7D29A8
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 4b56f0fdcf5cb0394891cfa114e04f74016c6777c16276df2f782cea2c770fe1
MD5 f6166903c311181bf24517504c2392f8
SHA1 b96f092c7c7f0e15a0e13872545bd186b3bb5c42
SHA512 e89780ed4c2fadc1e96096c252ef88585f56ceeeb2fe9a9b068ff80d07b623f570ff3b3b9514916081102abf39ca8aad005d43937c926421c709a6fc1abdcb67
TLSH
T14CE02B76C822EC670CFD0758A0198646E70013172680895F3A3C91088FB472B89C599C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000086

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000086
Size 131KB
SHA256 bbf8eca9e62d19234596cf0b9d22525ca165d870de425a1721bf9b4ed4290e37
MD5 fb51c880bfe2c39e76d714f3db58a682
SHA1 a1950544db3f722d18ea73a4361c33cf05553009
SHA512 03c4b449e3633d7a54b3564d6e9cb8404cf6495e85c0ef96b2a9ed6342c9308df265cd5591ec27279f979fbe09e8ccf1afbd6b49ac4440d83c514235c0f2ce8f
SSDEEP 3072:T1To4uA4va9RYUq97GueltEBvpTDqLLa/dYhhwAbAXyYatIK:3Gar60uI67oL0Yhm9K
TLSH
T13AD312740AD37378B4C7873A444A7E546D898F884BDBFD40C7CD1A958A2179E421B8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008b
Size 216KB
SHA256 0e9e7e58b737cda643c7b4014072e8d91bdcec2e5ddddc8e8eaca3d7bf9873c6
MD5 1aeaf8cd4420fee5acb455c58cf6c098
SHA1 e9d17b3e797f4882973ec3768a7baa93092d09c7
SHA512 0450ee6719ccf4704fd1ccf15a648c8809f7bffdf8a98b4bcdb3c73834f706a121e93828b8ab897d8d6b7a69f906b902c72417ffd5d4e59f302cd8db21dfda89
SSDEEP 6144:OXuTKFi4b4lKQgiMqHQ48Bx3eUFQ46R60ZgVJKCfXiVGhcag4Nle2IQjp:OQ4b4MuMqHQlx3eGQ4YxWVJHX8EeUjp
TLSH
T14E2423664B30AF26B0976F03FAA9D6DD5B5E11B4BC4933430D3E3FABB17815129CA580
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008f
Size 115KB
SHA256 542f0e8bf7a27f2300f4cfb4b8ad168bc4cf7dc1eeeb8471cac66802f58e137c
MD5 7a850d86ff15b9b0492932b4ba1683fa
SHA1 2a44e862bb72f65b4d4ecaec9a912ef198266466
SHA512 7da247188904e72250106b62b90603650deb6250b134e91a67350000e2ed99a1f4bee91236e645f9e38e2357353709a2b8a8a313b4f46634d574cc69655b65fa
SSDEEP 3072:5Z59gNgxI5alNDkzyct2u4oC/TZfAdhGxgL:5ZPrwc+zi3bbZ8n
TLSH
T16CB3120949ED4DC27FBC6128684E879C459BE35F09844B68FD697EB0760E6467CC0F8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000095

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000095
Size 88KB
SHA256 e4645a301fe2eb0580347570edfc5dca76b6fe7b18cb072c0d9b31ab07a563fd
MD5 e980239b30651e317c369c7937600eae
SHA1 821aec642d2d1f09e2d32facaaa055249527d3d1
SHA512 77d72dc3a1d32d2e87037d167475ab4f6ce1a76b76f7a72f0b39a23f9ca5f750c1d891a4d95507ab7388e4e9af8fec1f2c4b4e139b2a6e2ab678c2623b42ecbb
SSDEEP 1536:7dnkZUv66FN76SnO3GJ4uanlzQohWWqlyDQqCIASDWcrrw3gb/zvSPX:Ojo6SOE4uanNLWWqQ0HSDWcrrw3gn+
TLSH
T18E930125A2DA873EC5C937E40A5784D9C06F605DA6DD582B8A3FD47AFC10E1DE48C82F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000097

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000097
Size 161KB
SHA256 ac9c19c70558c5152b92119f83ca37dded627b524d75552a26fcda015d4106be
MD5 dab57ae7cf0db75b5cdf1c9cced17e3c
SHA1 d23d0ce705d1ef3e31db575f42ae573f1392ff50
SHA512 4d1a7eeedb83091b9c642a9b9abb3f9fea00ec6d25bcda5befe99eb423abbbe8d5fa6b9bb68213d5110fb0402bd8e92f02d059eab53022529a71fb51404c2688
SSDEEP 3072:KmZaVy4Q3YkOzHt47O2K7WNi8YmOnPWWdpP1rJHvlwci6Fa6m6Qxz:KmUF8OzH+K2Zi8snP9fP1r/w1GRQd
TLSH
T124F3233F202417C4365D623D98CD1353E078BBCAE655F9AA49A4F932381D30DA69D3B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 ac695100748134a2a86782be0df45222e4d10455efd1b59a23db7d34fc536e7f
MD5 bb4cd7da8135d0ff248e354eea1319a4
SHA1 39a94add86521ea501634c8658d8d769c6a093a4
SHA512 4e6c5269c2a63cc98a7c209540f4139a2c25f5805023677d52b5ec5c615e465efe5a1715687a8be969b6b68c42ecc9698ee190b41f8da6175c77e092ec312d35
SSDEEP 96:GSILenp+PeFrn9ip/PTxWjXo3bKZMHVUS50b/C0mh:GSILenUPmnYxQSKG1UL/C0C
TLSH
T1B6E16E3D48E35811EB196CBA54E72A6534FEE1E4FA0B8ED1C118B5FA1C1FB464354227
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 1194bf77b3c15c5a0bba2bb4ebf723a3fca3c1f40171085d184247cfbf5adc62
MD5 e8ee8405638080b3a96202f528749f70
SHA1 ee486cf216674a65f80f6e46ae1469d6a0bb539f
SHA512 fa24b110031eb2e4a7a7c715e7b7af7c99bd91e18c94ddce58b1f2b8c76bd1b1fa00e4bacebc45f1e17b36b6aa9b7fdbae9bc6757f4252f2e41b0fe660c15901
SSDEEP 96:BfSILenp+PeF54Kip/PTxWjXo3bKZMHVUS50b/C0mG:BSILenUPg43xQSKG1UL/C0h
TLSH
T113E16E3D48E35C11EB296CBA44E72A6534FEE1E4FA0B8ED1C118B5FA1C1FB4A4354227
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 1268561048f6eb0e8284e7e0e9050516b9490ebffeee34dc124baa59381e88c8
MD5 6d0761e46eb54483f90adb0e0ae26e28
SHA1 003e264b6ba861e37823cbdd5a6f247875700707
SHA512 9093dfe0ff7bf82aa3a28a84dc3255a8401bbed9d868a3049b5906bedd4a67165a82850ef85afd8c37b7a5c9932eec677028e28097b825fb27652bf7a7cd4289
SSDEEP 96:9uKWrnqpbykwwGCXgIxKvk54Xo7bpX3CM5sPSKoCXb/ENY/:9uKWrn0yTwG5jxqJ3LmPbFr/ENy
TLSH
T114F1C87E54D24C12DB186CBA04E36A6139FEE5E9F50B8F82C018B9F61C8F7A64B14213
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 b2995c0ad34736529ed3fcbe1535acf27730bfeaa44a7174b015127546a71103
MD5 98b5e01574660f320ccc074dc7e2acff
SHA1 48107a00e3a410cb6ea495b7b809b61f7d632969
SHA512 d197f0206111ed7d02557b0c34e3350cafce1140bc0a2bcf17082cb6a46e2d2171e0046c0a98cb45dc7d73bfcb2490a863f59a9ea8596f9dad1a54b61e3d057f
SSDEEP 48:9QDa0vl/bkl/eW3jAZRutWUxblkE2ift31vhXkShyoQefBWuMctgZi66VwBB1599:9Q1t/bklgQWUxbGEBuU5LtI79OXz6B
TLSH
T158B1383E06019C50D716BCBA54D2396878FEF2C9FA5BDEE4C51431B22D2E70B8366247
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 431fffe2535c63241f87f5ea9dcb82e63126306e7e610b6e0c43d2d73ca72468
MD5 fb9f5a3beeadb1ef2c290745bbd1def8
SHA1 b2f4aac22f61fbf68dc917873a97a23a6aefc9b0
SHA512 423f41a9397b917cf67c47ffa578ba95f5638ee1215c8292500fef0d56639dc8afc90c41e27c37fc9ef474911f18eee82263ee21792251c6f865d14060754eba
SSDEEP 96:ySILenp+PeF5wGKip/PTxWjXo3bKZMHzUSK0b/C0mX:ySILenUPgwG3xQSKGTUk/C0E
TLSH
T102E17E3D49E34C11EB196CBA44E72A6534FEE1E4FA0B8ED5C018B1FA1C1FB4A8354227
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 679c3734fb03b18554367ac85a8a514e96cf36652628b347fb1a29640159b14f
MD5 cff5f35f56ffb44acd121de7b39f7653
SHA1 5378eb2f6c8f6286a01a17b637c2916479fdd4d3
SHA512 25f74961e7d70b0139e16651c5e855c962942ff509bfc85a1cf8abc1c8cf5d5b2bddb2e01bf4e13ee2fc00aa25ae7dc3200bdef6c37963e2a0682e83bce8f971
SSDEEP 48:uQDa0vl/bkl/eW3jAZRutWUxblkE2ift31vhXkShyoQefBWuMcv66VwBB159HXzL:uQ1t/bklgQWUxbGEBuU5LY79HXz6M
TLSH
T1AFB1283E05019C50D716BCBA54E2796878FEF2C9FA5BDEE4C12531B22D2E70B4365247
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5ac8ef.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5ac8ef.TMP
Size 3KB
SHA256 acbe6145a164bb9910e9b322a7b482e69662235ce32fa3e2f21b61e6947e21a6
MD5 90fa2b80ab71439f4f6506d27e705066
SHA1 6719f0d60981dfc87ae6a003b86b79a1eafbcd6c
SHA512 cbc6d2f5b84df1c7abbf88ce58ca168149aa59dd017769b19cb3b04644248c502a519dd244ac46d4079ed33c73d142832c59fb8f89ea552b8452286cddf4380a
TLSH
T16E712A3E05016C60E7257CF5A8E37639B8BEC5C9FA1BDE54C50035375E1B35B4329288
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 399B
SHA256 55f8fa21c3f0d42c973aedf538f1ade32563ae4a1e7107c939ab82b4a4d7859a
MD5 a15ac2782bb6b4407d11979316f678fd
SHA1 b64eaf0810e180d99b83bba8e366b2e3416c5881
SHA512 370b43c7e434c6cc9328d266c1c9db327621e2c95ad13d953c4d63457a141fbf2be0b35072de96becc29048224d3646535a149229fc2ba367c7903d3e3e79bdb
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 b01a9cf00d79e671f62de10a19cf66f2f0ecf9d37748c6d1f13915beb21d21fa
MD5 b9b7bd695a3db2a4f68da59336c2c156
SHA1 5188bf04ab69138d06c81a4844388bdae698a14b
SHA512 3e781b31e69fb99703881496e731331d615889414ee9eef46d5191612eb7a1ddd0a5a117d0931dbd581baa2b9aac1e4a396aab778553206dff5050f5b47dda1e
TLSH
T104E0268804C8C129E4146CD392B8630D87D8349EAF88F9421788EC486182641E3AE6AC
MD5 SHA1 SHA512 TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.108.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 36KB
SHA256 c92afa08f0caeaaf2a96f685e55678317431361e48c8a0934ec6f7432dbb9626
MD5 d619f8f87b44a1b7d3ec51a375328ba2
SHA1 a98361cac9ca4923bce176c486f3efd8b1b1cb49
SHA512 2c8c159143f1908afeab8e9e7f7d7d0da9473efe40fdd2c100b2d73678c061d6dde0e6fb9025c52514420d7d3cff73c277f350410fcb55fbad40de2ef1083fc9
SSDEEP 384:CdqivEiIXCujyWjih8iHyWjihSqivAitjiifMB8itjiifD:0R81eWeHSWeWdtepteg
TLSH
T12AF27EDB7E6C3D21C7448EB21215FD25A67BA4AC4FA97C18787480972CF5E5300CB6AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 0d8d2eefa859eca8b34cc1de7b84c1895ab08730f9a2ec856cf32309a0330bf3
MD5 445f98e0f094cf5a734dc494a3677100
SHA1 d596956bd80633afdd71632f8e9760b1607831f8
SHA512 aafb4d9bbfa0f6c03749753a61beb736f4427c590bffc54c7b2589229cd248329b1c0cfec718da534b44e5c700e6e58bcfcfe748520c316910418e68011cf52c
SSDEEP 768:SWeRptTBBVtS7SWe9eU3GeqWe6kSWeote:PePtS7Pe9eU3Ge3e6kPeote
TLSH
T11024199F6F643721CE6C81B569A7A8672E6EF03F875579983C7000A5CCE2F52108D4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_claude.ai_0.indexeddb.leveldb\LOG
Size 382B
SHA256 df1af46699b3ae0f02c7d26afcd27e638151512cb2049280cbe2bcfee07bca12
MD5 2b5a72155aa79117622a5270f7dd806e
SHA1 e2350948c5d1f2efb58433af3779266828c4cc7d
SHA512 efd5fbea838a67618231bd5a11072f5b04f7658e3cf9e2f7616511f5560016ee245b19d0eb050aec870e85ae315b484278499d999a34b4872d93186458249e2c
TLSH
T1FCE022A181CEC36F611820D7B2347B4EE3E3350F9E88ED816B42CD1CF849452EAAD560
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_claude.ai_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

86f88af0-9cb5-4e3a-b172-278b57ef086e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\86f88af0-9cb5-4e3a-b172-278b57ef086e.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 2e3a813abd04464489b8627cd3a093a80854d4ca9fb484ee1474c314c13a8dca
MD5 d465a93e1e320e9ff2b652e87494c714
SHA1 16a2333361230197ca488ebeb92f88ec96c60ba0
SHA512 42e3ef691f61e0e768e31e8a964daf507eb3ce59fff3bd0aec6a5924c896c9fe6d9f9320525f56be63de2a6e492e2e1d45f228d5c8a6d8b28334f244d29f1d28
SSDEEP 192:DW11t9wG+aij6eD1LbhHpHuq/7yabZ76g/:DW11t9wG+aiGeD1LbhHpHuq/7yabZ76s
TLSH
T112D19CF7C3E9812DCA1156F4AB156F1FCE1D0A24432C3D2AC8D8AE5B97E2871E20165F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 c5922e5a55e30b138b8007df784f5e597efc15062b12665dba368d1e94ec3497
MD5 bf039fd0b12b5e431043b56ea999012c
SHA1 1d52100e0b6139d85bbfaecda18043f5052c7b55
SHA512 8eae08a5291627b8ecb746a51373e7dd4843dd1ded5d1610d14e0fd71c7c65f97e721518634992c5733251e76344eefb0c2c94eca6eadc10b23cd1bcc5809a3e
SSDEEP 192:DW1DimVHtlJaij67V7ya9YdAlkKy7pHuQwslIEF1x:DW1DimVHtlJaiG7V7yaqdUkR7pHuQwsn
TLSH
T1E2E19AF7C3E9822DCA1156F4AB146F1FCE1D0624432C3D2A88D8AE5B97E2871E20165F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 e48eed2d7e55890e111a0e731ee86d74cbbcfb74c14d267a485206bb909423a7
MD5 2039c94e4c360ef65b3f435fae7bc0af
SHA1 764ec584636ff6534a3997d48b6fcb9557f75866
SHA512 c4154867fbefd963784c2bdd3c7d376cf46bc291f45ef198d0c4ba5d1c7800c94cdbf90668515d4c432c8a42260456ef4d99720af9b5ea7e8cf87e86bab4d19f
SSDEEP 192:DW1zqlxTsXuM5aij67V7ya9Ydwrkkjkat07pI/y3HQ1x:DW1zqlxTsXuM5aiG7V7yaqdwrkkjkatd
TLSH
T186F1ABF7C3E9822DCA1156F4AB156F1FCE1D0624432C3D2A88D8EE5BD7E2871E21165E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 a238a977ed8ab2bf46f34295785389814b3db11075d0bb5e67d45e560cf300a2
MD5 102e8ac21032576242da437dd8959bd9
SHA1 a5960a356da48092670834da0d3ef816d5f851cb
SHA512 5fc91a71dfd66e59c6db895f350f4c9a1b6421ddcc004ac7f5d6cb9093e7d9a27d15f5bd7c7f8ebc8a9aef8a6e0bf3b12ca620519ec30e74100b7745c1ff83d6
SSDEEP 192:DW11t9wG+aij6eD1LbhHpHuQqZhPTQyWmT:DW11t9wG+aiGeD1LbhHpHuQqZhPTQyWc
TLSH
T1D0D19CF7C3E9812DCA1156F4AB156F1FCE1D0624432C3D2AC8D9AE5B97E2871E20165F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 87720db580a7db3f94ad7963057020702179495d2c7752ef61602a10b5767d7b
MD5 7d258d572213d98837714c5ec0ce4ecc
SHA1 9cf505c8055a1549c2389e7ec1526e5d0f0f027a
SHA512 fcf0656ff3f660eccf303911e52b7e039b44306ec08b1cb7bd16ecba1b963004a152e25b5e0ab17c85dc85900fca730e0f39dd7822c65aac94fe0df592825e81
SSDEEP 384:sxZMRqcy/fysjWvqozIKYY7HbT4OpB/p+g2K:sE4cy/f9YqozpHbVTQC
TLSH
T138820A0AA674597BCDE7D219FA44FB67D2F9012291905E44AAFCCE1C04E7BEC620381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 762e2f9fa6d15d5943358cd1cd87923b8459326e76722fb013e8ce1366fec5ee
MD5 e4d4ff271fe486e85a427b90d13ed2a7
SHA1 8715c448b0be28d95dc5465dca3cb80b31b63e0f
SHA512 c70332aa182acd9beca56857ccd154bc6fea1b20c448d4d99e90688c72420295ee10137f98da9f295ff05135c97ba56d12c0eb40ff33851a12dd50bc113acb84
SSDEEP 384:sxZ8mqCy/fysKWvwozIKYHgHbT47DfBYB/2c:sUpCy/f8YwozHHbkCL
TLSH
T1AF820A0AA574597BCDE7D219FA44FB63D6F9002292905E54AAFCCE0C00E7BEC620381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 7db26879d67288bb4aa7d52311780ec707b7f0e1ccabb9679c66d57cff6bfdde
MD5 191ea09a0323668b9af2c7e9f9c21812
SHA1 c88000ef88b3320382cc1ef0d930dd9034417483
SHA512 f94157dc8294004ef5bfb6dd80279c0484662acc4d0183eeb8078a9411ec7cfde7fdc59a29830d948d29a5ed6c0ff3391263e1f5e9cd2ce02169045b69cf02ca
SSDEEP 384:sxZNmqcy/fysKWvwozIKYHgHbT4rpfBCB/2K:slpcy/f8YwozHHb6wF
TLSH
T126821A0AA674597BCDE7D219FA45FB63D6F9002291905E54AAFCCE1C00E7BEC620381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 7c754b0facd1265e72d00f296c81cb1c3cec8ae12314ba479b2bef241432818e
MD5 90d8fc6ddcdf62697f807cdca5146e4b
SHA1 882a3437e1bddd6ab7d455597a4b6431d7fdd4fa
SHA512 602073b92cad8bab19c0f2704e32b8eac17d02192bb6678fe9a3b93f05647582de9bd7dee64858a207943f433b3a6d1ea310b03eaa66c9903c69b12a7bfcc6ed
SSDEEP 192:sxZMREyMqZjK1Ml8UQfjy/fysnoZdIaRuvlzodpTUG3fHW6+WNqiKmljcC/BmM9X:sxZMRq7y/fysnozIKYu7HbPpB/phzUK
TLSH
T1F482FA0AAA745977CDD7D219FA44FB57D2F9112291904E58AAFCCE0C04E7BEC620782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 4b9e008395234c8030ba4bf358a1ff5223ac88f6bccf93092cfd69e5944abc8e
MD5 1e743c8ba0f708f376436887ebd9ded0
SHA1 c0115442f79707a9b9daf2726d73f5910519612c
SHA512 ec8f3f621f82715150c86a9957ebb785187eb73a0098c8ec4313093bbdf826004dac99a6e524b9ce68a688c3a54d7036b9a2482884221954fdda044f9574eb0d
SSDEEP 192:sxZMREyMqZjK1Ml8Mjy/fysnoZdIaRuvlzodpTUG3fHW6+WNqiK6RvcC/BmvtkVN:sxZMR7y/fysnozIKYu7HbPpl/JzUK
TLSH
T18B72F90AAA745977CDD7D219FA44BB57D2F91122A1904E58AAFCCE0C04D7BEC620782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 87903ecc000d70e81498342d4da5ae0a9a87d0b87387968fedbfb557dbb60b09
MD5 7ce9703abb2719c772b0a976182bdff3
SHA1 e940671db8851c0bad6467adca5e7d844ae53c64
SHA512 bdbcef7a6cf2f196b55956e62f8d2ea92d3d544ae44fae4f7e11ae2145153064cdaed7eecc5eb0a59e97c2885bf877a3a4512dabe86830568d2c0768f755dee3
SSDEEP 192:sxZsREyMqZjK1Ml8Mjy/fyssOqaZdIaRuvlzodpTUG3fHW6+WNqiycC/Bmv4ukXh:sxZsR7y/fyssOqazIKYu7HbPM/XzjJ
TLSH
T1C372F906AA745D7BCDD7D219FA45BB57D3F9112291904E48AAFCCA0C05E7BEC620382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 e48d5e92c3fdf806940faaa359f80ffc3b820368abae5ba42c69de7b7740e727
MD5 0f59907f921a735e4f0ac9dfcc12a3ed
SHA1 2700f1ec83ebc1be2657021cc3b8be2410350dd8
SHA512 12a48bc01aa0b4a075f2eec5daa0fe7740e7a4e99ae503398ffabbc719e69703863319270f427bd8fceccba6bacc3dc53d15a82db73a4c9ecfe1323cf7a39513
SSDEEP 768:ZYsv8OdnsF7pLuLfWhWvFvQX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYysy10LlEez:eY8OdsTEfWhWvFvQXu1jakt10Lm2NuGd
TLSH
T113F2EB3B6C0CCF7A4F844E9CEC2A6F8A6DE802CB5698895447F9844C02C76EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 7ca17739163cb7870bb5a9c3bdb463dd2f3311d91135e6f521fd8d28775bccf1
MD5 dd4e8dc4087aa6aaacd80d4fdcc0fe37
SHA1 0451ad80efd432fd79f478e7271fb20a3e5333b2
SHA512 5282988906f0a0eec3019cbb75e73912f0c7169bd80dc4e30f356c3fbe10ed3b3b5f90750146aa054ab0c6a47a0e1a0faf1d1814d7c7adffabee3d75996a840a
SSDEEP 768:ZYsv8OdF6ssi7pLuLnFhWvFvQX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhysy10LlX:eY8Od/HEnFhWvFvQXu1jaRt10Lm2Nuw1
TLSH
T169F2FB3B6C0CCB7E4F844E9CEC2A7F8A6DE802CB5698895447FA844C02C76EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 d975df4cd7172a8dc242e3c76f07fb0a0536b40260cb019cf352954c1d50e09d
MD5 1e111240f32a2fae92c0c326f47810a1
SHA1 efba6087f652e4f3caccdede5e4cb4b2ec5f44d2
SHA512 ce30e7562a978edd03b4ba9173b86f056adf30a14e670c9ef8935dab865f4ad99a2a305d9de955585bbcb0e1633be044147746cec5dcb56d7d4ebc2653d3864a
TLSH
T1A5E0263406C8D17D6015A48B12B9A30CC2F8F48FDEC8BD422FC0CEA87242504B3A65AA
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 a99df54e906e4225e51b1e3a372a9db71f321037db2725d65e0ff8c9b6e601ce
MD5 b34d065afb2286dd29f80499893ee6e4
SHA1 2f58c083ec04e634fb182e71b04684047b107eca
SHA512 d428b0e5a72d532b9f7f391615ae6b43dc018465c11d0c834ca379d594cd6161f1289531d44ac4603684b039a028e5e531cdce25a65c0fdd0ff028e47a0484a3
TLSH
T139B0124037524236DCC84D3501586FC17315E40312070F07CC748F348EAA6A83F4D9C0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 ca506e65bd8a65cbcc3185dd8d386e725cafb1977bbb301d5e984f1770244df1
MD5 de9867cfda0b7b7b117951092208ad59
SHA1 9c8e4794d4d3f887fad75a2028128b93437ede43
SHA512 d3413c5b2021658f9d35ef527bb157b25c76d3d15a7984933146338654a04ce2f23e1e49e15e63f722ce96edc6f21a33c7fef0c672e6064ea6747593b9d4f37c
TLSH
T17EE0D86455C9C22E6585A09BB268E708D2F3B44ADEDDA9522B48DA88B2062407397551
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 587da622f659c23bed6c15cee2449ec9c52f90a83676a6a0b7335f3cff22d03c
MD5 9b4a230d5bee26f0456c83e201a898f5
SHA1 3e9e99cc5de6a31932edde42f66f6f3d9997de3d
SHA512 cd18366abe7f43fa05c6066eef0025552bddcf102eadd7e23f7056cdb92e50c04b2604e29ea94686bcbc28fdec3c9446455f6db2cc04586e2dbf8596223bb436
TLSH
T19FE026B445C8C23D985064D3A2B8AB1C92F8780ADFCCFE8257489448E102200F3BE990
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 559cf30ae5bd1330cdefff24ba443eaa3d0073a096f2b59a59c0b1a80a7d4f26
MD5 f754543175457af3263aec22176dfef3
SHA1 9a8651e75b4d324053c26fa69aa53925685da894
SHA512 351adcd2428b4b42521f36c256bccccbf2abfc921ed5f353163a71c0d1bb2390765475dc5e8f3e01253a338f7ab1ca03f2e409f1807f3eb9c4a9c195f3516bbe
SSDEEP 768:0LppY93PBZJPtN53ATy3jJlZEdQ3bvV7RMrbAxzdl:0LppY93PBZJPtN53Dbl
TLSH
T13CB2585A703E0211397E298CB39696364F4235A37058E4AF7FB814A14F67E224CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

afd58b3f-8c5c-4872-9c1e-b596b32fbbbd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\afd58b3f-8c5c-4872-9c1e-b596b32fbbbd.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 b0bde8da6ab0ddd14c8727e63855259978e23e32c4bfb7bd1d8e4eb956baeae1
MD5 7db7b80c582b798aea061fa974bf6039
SHA1 dd088a39057c18b8abfdeff8a5767bbd38ba613d
SHA512 0ab3006ce2c568e903bacec9854a5a2bb44d7a02d6485abd41a71c64b9abfaacde0830e4d687499027b12593a8dbf0fb712b1dc29e0f1ce2920e3380acf2b634
TLSH
T12FE07D54AAC8C3EFB415E48F21B47B0893E5380FFED8AAC61F44CC4CB141100B3B6592
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 9e72a48b3bb2f1ba346703a2f29a6e0cd440630caa078ef9bbe2e36b2bfeb664
MD5 9902aecfb8c02490e757eae2dfc7bc94
SHA1 3431d0b700243264392ea8624dedecf95716c8fb
SHA512 8c5e0431b8f2b63b3cf35aebf7e479cbcc056328c9158472240e7a0ab071eaa332a7ea2e23c15633f96dc78955b28917cd948442d526ba0ebfb82aff117d51b7
TLSH
T1EA219D55F320C159E18E863AA46B9B261378E8129FBCEC0F847D24352D72E045E8B6E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 e436d1c8d6c4ff501afd914c07b25b7fe7fd87c521f5a742e25afefc66705b7c
MD5 2f5b96269e74b376918d66c346ccb4a7
SHA1 3eb4442a398a58926d6eea3085bf71473efc6f8a
SHA512 cd49e7ea72a6cdc34361b3a34b57e6a8d8c38dc4870f483e1e1c608b2524d78f88b321b95cf354f8821b0079e553b05f59c2a5386856156981f9e23e96efcb89
TLSH
T1FBE02014E5C4C2DF6015A48F11B4BB4882E63C0FEED46E811F40CD4C51411417356552
MD5 SHA1 SHA512 TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
Size 9KB
SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
MD5 30719122f9edf4e23019a3b74e4f4325
SHA1 6707d64052797b9c5f1a5ccf016e5859c8ef898b
SHA512 ec2e1a33fcd1301f282512ffafb611ea705dc5df09d9aee014276909c1b62b0c73600121d94e9b6d9e160296672b41f2cb8c3ba23f121244ad2ea6521680723c
SSDEEP 96:DdQ/JJvwjyUsrdfsysVsnQfbJNZidYusysXYs2sFsdv12XvlRT07s/DkhcrHPglW:D7d7mfgiIWRcV4sobxezQd1Y
TLSH
T11512BB3BC4B49F229AB060659705E244F13C43BF5600C6FF76B9829C1F366ECA58E1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wallet-checkout-eligible-sites.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-checkout-eligible-sites.json
Size 23KB
SHA256 2abefae3d72e7c4f5cdc94eb0ee552612d843a26faf4a7bd061c73839e19d7eb
MD5 ed22bc3ded6df0109b9e594867473559
SHA1 ee39eb80dc23f7fd764199cbe4a153c4edc2e768
SHA512 fb337c0a0107dc37a3067bcd6f60ffb8f63ee892a0ff729dcdf67c7a21fec95a742a274853e8947489108d7543c13b9479e02574f490bc217e8a182f08543aa3
SSDEEP 384:rQR5dkrKzmQWgFlhpyZv8CTi8I6kxAvh0mD:reKrMP8d5JIVAvhV
TLSH
T18CB21064C9210DE11FE4412B6878224B1A3C951B8F90FAFE3B6D928C1F5E06F61B95FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wallet-notification-config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-notification-config.json
Size 804B
SHA256 bb26ce6fe9416918e9f92fcc4a6fe8a641eceea54985356637991cf6d768f9fd
MD5 4cdefd9eb040c2755db20aa8ea5ee8f7
SHA1 f649fcd1c12c26fb90906c4c2ec0a9127af275f4
SHA512 7e23b91eab88c472eec664f7254c5513fc5de78e2e0151b0bcc86c3cd0bf2cb5d8bb0345d27afdd9f8fcb10be96feaa753f09e301fa92b8d76f4300600577209
TLSH
T1AB0189EEC8800EB216C24A3A163985C31A3756576C953D147FC9741C2F5D62F22FB98D
MD5 SHA1 SHA512 TLSH

Submit Download

wallet-stable.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-stable.json
Size 81KB
SHA256 c1611bb1872456d5ba656cacea801b833ea43126a6ad7e43e143d52cba9d9597
MD5 46ca0b1726448d9c7ed48735c246336f
SHA1 8e26f1f1c6f909f2f3d34c17e042e579f3b2b449
SHA512 c9ec0465c2c0eb0bc0316163f9a2dab9332c372dfc4ebedb0ef4139fe1195efdd8aa34367155c29e659d97d5a27e2395ce2f6012c115ef5791bad270de26bb28
SSDEEP 768:r7PEXSl9cv2tlNnqSBBoCJkQgXzwb7XARjMLVF2CYgYHFkJ/Eqajvapznp+9l:08W27jLgX2ZLSgYHFkJ/EqajvWnAf
TLSH
T1F283DB29C9120DB11FA4001A28BA290B297C960B4F55FAFD7B6C938D1F0E45F61F59FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wallet-tokenization-config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-tokenization-config.json
Size 34KB
SHA256 0088d5ebd8360ad66bd7bcc80b9754939775d4118cb7605fc1f514c707f0e20d
MD5 ae3bd0f89f8a8cdeb1ea6eea1636cbdd
SHA1 1801bc211e260ba8f8099727ea820ecf636c684a
SHA512 69aff97091813d9d400bb332426c36e6b133a4b571b521e8fb6ad1a2b8124a3c5da8f3a9c52b8840152cf7adbd2ac653102aa2210632aa64b129cf7704d5b4fa
SSDEEP 192:0NOKnK+QXzpTYaDEqIyVZ5mxzrIAfrXKoNKExGI+MmsMR6Q9GMKPrZnfB4FXZ8N:SOKK+QXzpTYaDEq/e5EAfrRoRI+B9wC0
TLSH
T1A3F2FCB1D9009C932F58850A20BA9505376C52237F86F9FA736D424E9F9F58F2530EEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 e896e6e0dec01d817950cd5f16ee0713860cea939d3aefa2c5a32b2a252adb9b
MD5 2e9dc3e3475d3c4580e51de251df0501
SHA1 5bec4a8e22d1e254fddf38dc43ca4a00de61a5a9
SHA512 6f26ca20b72c4c18ae83a65013dcab990dc716ef0b5bf6dc9f2e371b1f74d346d9c6078cb1ca7e5ab7f5c1272a88e441f397ea512c20f5025ec4599e64ed3299
SSDEEP 768:poFccps3bwgbkUBkoGpENdwj2NEI8p0KS:Ws3VMHOjEI8p05
TLSH
T17EB25B36E858DEABEDE74F89B74E7A07DEE0122785DC59D8DAD85D0D009319C430BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 676208493e5aab9222f95b8152dd239f166b6b7d331a4fd864d3536df64bf1fb
MD5 d2cafb1e3f2b4677ac9c794b9f2abb67
SHA1 3591353da5d329d7dd03ba57b6a5ed06feb67814
SHA512 ed48827f04b7b70e3157b163df1fcd3e58e1ca898d6a1cb8db73777da8e5d12985a2f802f7f9d4c13fcd3c629411d7789b7f93ee5c38a598ee400afdd1d52bd3
SSDEEP 768:p7Fccps3fwgbkU62oGpENdwjn1NrI8p0KS:Bs3pVHOsrI8p05
TLSH
T1BFC26B32E898DEABECD74F99B74A3947DEE01173898C9AD8D9D85D0D00831DD470F82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 d0c1e2cd9f39ed778170eec9dd25d64378687ddd3256ab470ba98ff04044bfad
MD5 efa8d1007d39f74f9f80a8b5a2f1b920
SHA1 232f9208c1d6a8362c15d0259479b8f85aa34dbb
SHA512 13ac93e32b13b58edd7c03c08e9b482b812175dabe98bf6f7b1a35c80aa68443e26af3d57e661a7b460c45036ea0554b2f3335db05194661d732a029f23c3332
SSDEEP 768:VFTmTWwgckU+qNsGpENdwjnvITjKgqmUsR:HmTtZDOjigRUsR
TLSH
T10FF2B2F598D79977E8AE4B87A77D2D429AFCC013B4885994B7D85D0CCC421BFC30A819
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 0b2afc5cb6c5bbadc81370abe0a4d59fcb48ed6c23cfec28a7f4e8478ebce802
MD5 899b2f5cbebf3a64c8c7fbc91a5c92d0
SHA1 e57a900d5755b1fe312e3d7855dffd13d780ce6f
SHA512 ae302a53ed06c8dcc2f05faeaad736cce6b57915135a60206e72c7919e350d0f4607411b2855be4dad6dbb0f3202d089c6fb634255eb3df3c0c248e5d0886a9d
SSDEEP 768:VFQ7PwgTk6+sNoGpENdwjnWNrTjKgqmUsD:k7ljHOnrigRUsD
TLSH
T12EF2C3F194D79977E8AE4B87A77D2E429AFCC013B4885A94B7D85D0CCC421BFC30A919
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 1758b5fce4a503a8ebe312ee690437c737d74bf9ed1d0423787f86386741f13b
MD5 b7ebdf5927c4b11dd8e98c8d0bb53e61
SHA1 2a9da2883e5cd0d2d0d257f91d2011f45760bfe4
SHA512 e7fde02e83a678203449cefead6f92951718d5d3aa1444dc0c5ee01ef53085e73419a1fb8224ce6d4292fd3ab740cab1ab8157e19d160dec52e5c4d77cb5b6b0
SSDEEP 768:pgFccpfPwgbkzNoGpENdwjnfNrTjKgqmUsy:ufxOHOArigRUsy
TLSH
T11FD25B35D8A8DEA7ECEB5FC9B75A3A87DEE00163C9889ED8D5D85D0C008718D530F91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 27e3b1b37dd458dbf432e3ed8df9e930c3b186e3c1f63aa933b1d79f19450d4b
MD5 3cc26222750be63a35b1f636068279cf
SHA1 1761d161d0674ea196f34e6619b46dd5d9df4073
SHA512 96f73f0c477121399adad8f87f8444e4c23413cb9430135dac44479cb09f5fba39d56474e8d9a8bafc7ff2c01cfc959f45964b7b88f0effbfa4c1b0d7ae608a2
SSDEEP 768:8FTmTWwgckU+qNUGpENdwjnwITjKgqmUsR:wmTtZbOEigRUsR
TLSH
T1C6F2C2F598D79977E8AE4B87A77D2D429AFCC013B4885994B7D85D0CCC421BFC30A819
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 a85d0defbf49ecb513702208bfd4f50781552a4c48e680be9212571acd36c5a1
MD5 678b9493af64f7719833a3536e62eac2
SHA1 ad00285903dd9fbff5e3e119715e3a8aefd7d768
SHA512 4691cec3742e9b917ea50a17829fa58c6dcf38027e07f90682878de9560a45c91a1692db0a3ec708c016e0d0eb14f1fee2751cd2c6e21fc9bbe6735698a69c03
SSDEEP 384:nriFiZcI0SsNq8TUNTUlI4IQckCrGU+uphiftGfFmmEEXIQ/4dWnjnnNrBeRs9J9:GFQBPwgTkCNoGpENdwjnnNrTjKgqmUsD
TLSH
T133D25A31D8A4DA77ECEB5FC5B74A3A47EEF40123C9989AD8E5D89D0C008319D130BD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 358dae50aa29a70752123f7d5510f6e5ce49a18770d0350645b8b8940d91d450
MD5 5ebf11e38d98776eafa3f813857a30d9
SHA1 dd702924f40ec2420d7c41d9ff67ab532b95f34d
SHA512 7683fe5d1f14ebb391e767aaea9acbe4a0aa5d69a73c069a06f98a35eb9acfcc2a0775660ee3228505753ccc254184d40c63ec78cce3f3f09f99252b296f620d
SSDEEP 768:VFUJ/wgck1+QNVoGpENdwjnzITjKgqmUsR:gJ6qlOHigRUsR
TLSH
T156F2B1F598D79977E8AE4B87A77D2D429AFCC013B4884A94B7D85D0CCC421BFD30A819
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 0d19d2fc9208bedc10ceae86ee15368d9a4b5e62296fe576f54facee526456cd
MD5 d16dc03583983a315b4bb55a23f05a19
SHA1 5a30f659721f1e5c72799fd65508c8b1b95f8502
SHA512 fd8109a71a8bc2f00fac3df8d7619ceb3652a783cf8d3c65864cd9d5ae1e79bf58d06650ae6e0d4b928732f5027f266e2b06ed66f25ed8c3d787ded27dede625
SSDEEP 768:VFY7TgwgTkx+8NUGpENdwjnpYrq1AKRbhefTjKgqmUsD:c7TAIbOi1AKZhiigRUsD
TLSH
T10C038EF184D799B6D89E8BC7577DAD0269BCC123B5885988B3E86C2DEC4B0BFC306415
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 4ebd189a880a83e075fead5b08b3c32c1b8723440e87e7c227fb07b1735de88a
MD5 7feb16f780cec09be0fb30335b8bedca
SHA1 53e267f88f7679195cf60b48eb4a42d58b8b62b1
SHA512 9b0ea83ed5e7fb4a3aad9297c259d83bd8fbca0cc88663efd9cf6fbfd5a3c4b28f954bf644f421a12dc3495341e18f204b123cc44b1dd214ff2626bc05089b88
SSDEEP 768:VFY7TgwgTkO+8NUGpENdwjnpYrq1AKRbhefTjKgqmUsD:c7TAvbOi1AKZhiigRUsD
TLSH
T104138EF184D799B6D89E8BC7576DAD0269BCC123B5885988B3E86C2DEC4B0BFC306415
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 f813bced12f9d3c948184fbf263b5107339e57863e2e9b8d1c47d909b1c847dc
MD5 3b0a6c54e61eee98eb68a93048ff7b33
SHA1 a70d7166ce9bc6e5d88de774c2bf8a8ba9e1f16a
SHA512 23d9f1e0dee24be7ab3f53c5e981f1ec1f3b6917aa53abce47f9b0755805ff38c51f15d4b42ced4af0b9c7f712a591583b05bbd6605c6d19bbca39982cde62b3
SSDEEP 768:pgFQBPwgbkCNoGpENdwjnnNrTjKgqmUsD:3BxpHOWrigRUsD
TLSH
T186D25A31D8A8DA77ECEB5FC5B74A3A47DEF40123C9989AD8E5D89D0C008319D130B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

campaign_history

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history
Size 20KB
SHA256 63c81d586007c36d2f543cd896ebc80ccb72c3d8352761ca46c8e39145ab7da5
MD5 0ea20172fdb999a1f0a32e7193a9421c
SHA1 d76024ba8651afb02299ed433c0a876590071743
SHA512 d648c5c22d8b1034409d9cff6e7c3b847419599797dc1d771145c67a942880735952ab64d010d43efe17e65164bb3bd1aec68c63d891c7cbb94f9fbe31d9f5bd
SSDEEP 12:TLyeSjPFUxOUDaaWZXiDiIF8izX4fhhdWeci2oesJa/Si3isZQQtydZ/qzQdJU9N:TLyT5UOl0afDdWec9sJX/ZB5fc
TLSH
T12792AC276D252033ECDA8B3AB98349D10EBC125EC9A7B844DDD049620DA1BC1A6991FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 70beb58c41e8ac703aa6fe80c0440e47c3850e524c7d6a115d38da7c77c73226
MD5 60a6bbb3fe66bc8ba86941a1a31f90b1
SHA1 9088081c4136882ec2024d4bd42e739498eaaa06
SHA512 bfe68da32d10b6b9b3139d9d88dd9da77f0eb135e60b93d17e8af0e9df0c32575921a5dc9ecd9b191403a8188897e7b6e1c211ab109da2eb0ce56efac51b2682
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 14b4c40d4fd3036e8b321748ee151611eda172927775d7f9372f787c071f6b2c
MD5 02683f94776b76bcee6883e93fa8a68f
SHA1 857a93db7b499da86e191c5039d7c96a1a0e5922
SHA512 c39b8823a50901fb37beabcca05d8c0483618993774eaf8d2ff05c6a67c009950899d1de74bd78fe6b6cc4f14dbd16b88c8273749bf3d65033425fd7d2a0af0a
TLSH
T12AE00143E30005B9C0A8133416931F626ED386754AF1120A4F7105AE7C337183E34F80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 f8e0b0913454cabfd72285f47b1a258574750a26a65415415267b22c2fa62868
MD5 05a716a483d2f724dd354b3578edff29
SHA1 1e1593544fcebdd9b92fc850c42a50482cf1ad08
SHA512 6f910d2af5e7985ffda381e9e475a416fae38766561b3e7778c4f852002db641c50249481e6124748eb5d1d13a630c9064cbdd617d0feed25ae27944bc5ccbbd
TLSH
T166E00143930005B4C0A8123416131F605FC2826549F013064F70058E6C337143D24F40
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 817ee02cf8b705355f42bff71c7586b9d13c899ce631e2669e1ac6ba1ca06a1f
MD5 fe5825f335671d7fc5d511903b4ea057
SHA1 5c61568dbfaf14cdde0bf73870a96155c2e50100
SHA512 b62becbbb377595bd9861fc17cdfa9b4839c642cb04b0b95036e3c281bb2ff7677ce8615d5f44130848e52336a36683dbce0a7987bf9944773a1da11ae9d806f
TLSH
T132E00203930001B0C09D133412031F505FC3827415F003154F70054D2C333103C20F00
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 a14df4a0696a73026cf65a335765807a6e8ade7f8db45a384d601092cd438cd9
MD5 cbf491f0fce94f2b2ca8139605041bf0
SHA1 9e5cd8d8c0be4c20963a77fe09d8c7c1db686e81
SHA512 5a8882d490eccba79cd4d81b1faf0f2c4ae5738f500fd0b47a36ba58ae1f7faa18d2b687ff18b082397c257d1ba395f309bbc99e47fc4acef60473fa3828f3d7
SSDEEP 3:MsEllllkEthXllkl2zEjlj7bWu:/M/xT02zMb
TLSH
T17D44040D7FD04405D53110704515C35053F0D430055777433C51D453FDC5D445C00405
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Filtering Rules

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.84\Filtering Rules
Size 2.1MB
SHA256 5e301c48e6d7290990971e9f0bcb2263c8adba06ed0a2c6db5086949825d999b
MD5 43f62d9f35fa6597cec4e2ad5643e282
SHA1 8dba6404724ffd6a2e89901e8dc6e5e55fed3374
SHA512 91891d23464f89e6769d9ec7a28867e28f77925e6e3b3b75fb628d8672157ba239676c07699c931ac307a21ccc4dae95dd707d410f988ff82be4015103d4d6a3
SSDEEP 49152:ua2qP9SKIrivd04TxN/7Uw+zJEhs6dl61n4Kmq9SL6bbBT0HjTsQc8cxjw:u8d
TLSH
T1BAA55D237518BDF45BB31F3EA44B6D48823962A483E3EDC5EA2BD10ED5E014F79601B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.84\LICENSE
Size 24KB
SHA256 ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d
MD5 aad9405766b20014ab3beb08b99536de
SHA1 486a379bdfeecdc99ed3f4617f35ae65babe9d47
SHA512 bd9bf257306fdaff3f1e3e1fccb1f0d6a3181d436035124bd4953679d1af2cd5b4cc053b0e2ef17745ae44ae919cd8fd9663fbc0cd9ed36607e9b2472c206852
SSDEEP 384:mva5sf5dXrCN7tnBxpxkepTqzazijFgZk231Py9zD6WApYbm9:mvagXreRnTqzazWgj0v6XqK
TLSH
T140B2526EB64903731AF30116AA4B64DBF31ED03F362A4564346CC1481FB6E7443FA6EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keys.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2026.8.3.1\keys.json
Size 8KB
SHA256 3d6c659801f1686ff3ac64bc3b24b1d0ae76ffdd5f0e9c399ba37d1354a15ab4
MD5 ee666d1b2290efa6cdbc89ea3d317333
SHA1 a8bdd2c1d7e76fef48a735a80524243cd453e0bc
SHA512 7b2b577c9a168f626a687ee158cc20fa0ad0f816fb0583abfe45f89222d1762eb4fc619e029856618479fb6096a02eb2f9934cb46334fa781cea5cbcec992ee9
SSDEEP 192:uNtGbR0m0GflPAyR9Pm4lOvMwkoR9PuGMXcy:O7mZpKjA
TLSH
T17F02B6BF14A41182CE7FC16D9F0774B78FB03C066BCA3A83925BEA49484196D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.7.29.1\typosquatting_list.pb
Size 927KB
SHA256 8da21018e6a6063f029ab8f81ef3de28adbd1740594d43934a231e9bc8458496
MD5 21617bc586960af1751aee4ef90d7b7e
SHA1 8e44d591d02917d5470a382ba5ecb31d03f0cec3
SHA512 75afeab96c768f0647940e940d0e842b2ecd422628a9c0adae06442dc6a27020c85ab03580e6f56382cc2dba3c6cca1f3b8b3e42194f5d27c211075a1faffb27
SSDEEP 12288:a6q8A6KIEJiCG5sskil3XYXHm+nQBfjvG605F0:jGskil3XYXHmyQT
TLSH
T1B215B5B9DFC00194DBB8112D20BE71D8181412A540E9EFEAFE7C855F2BC29C977E85E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 5a658b749ac34fb2ab7aea3cf4795c179c75f36ecfeefc6257936ab43d49e1f9
MD5 2915b640fbb77020a167af196b7aea8c
SHA1 c06222d0dd980b0e8b99ebcd5f1a45864804b2d7
SHA512 94b516bdc6e9b7a5d757558658f142d9bb10e562c89bbb99176f3a47624edee7bb91b1460f0b94a67c5e71365abc2cfbd09f9c36625bb54e9027189b76046414
TLSH
T1E14131E04C380AD5C9FC0E7EB48739EC85E8D625F490343978A8EA885A7D61D309483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 072ad143bde3134d2c9762d8aee647ac6fffbabae5b9679270c4cb759f520fa4
MD5 755e5379efa9fbfade18d2903b62cd6f
SHA1 ce4e31918aa9f4f9c5daae9cd3b7dbfd4c63cd90
SHA512 aee5604253f2b5943414d47a771c7f87acd645eeb60f5ffc55fe1ca0f1a267f196ebb00bad7ed40ab3dd5d40a63dd7126c1c9308418a28c303619a3c3f9bf8f5
TLSH
T1FA4130E00C384AD6C5BC0A7EB4C739EC85E8D625F4A0347968A8EA585A7D61D348483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 1590bfb70bcb1751468d24b1bb92fff82735ed9c30a0466a7b7870b414ff929d
MD5 6ddf9a5df6680921794a45d2d8e85d5d
SHA1 c481e8e43ee7bb95ad026d12955611a4ef185daa
SHA512 63381ec233f6d91ec242e48d2fc52c005ad94263810577d7683ff2354c4552f903e8b469bdbd3795435e7343846935eb6d2c1c9983c0cb98bc3b4c8f04a64c6a
TLSH
T1E35150E04C784AD5C5FD0E7EB48738FC85E8D625F4A4347978A8EA485A7D61D308583F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 89eb4ef10601d8d794e5890c9a7cb1b4bd014dd907322880781752ef8a9816c7
MD5 d58083c7adb2bd4a96fb449fc520cd5d
SHA1 6ee9bc1454294d91731ae350f3135755c9e56c61
SHA512 751c3b8f18ede1b361e84f60a9dbe0cb653d787c74c523209cea0c191b915311b2f205c5aab1dd41e15579521459c2b2bc4ec37bbe0afc45c197b9e5806f51ce
TLSH
T1E45140E04C784AD5C4FD0A7EB48738FC85ECD625F8A4347978A8EA485A7961E308583F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 8f133560a2dac0417839d141143a755cad5ad2d6a3ca3a44f8df78f6ce9f5c3d
MD5 ba5e5dd9c6065002d7246a37d3a3efc0
SHA1 c2c6b7e8b8ed41057d93a778441c1c036cb53c99
SHA512 dc03939104114464e1193443cc875e7b55b35418c5af708f8f9fb81a5a756f8fc4d98b373104c7b9e8b78bc9833f7a7fd234d2a534fd1f5ca268cd67739995fa
TLSH
T1394131E00C384AD6C5BC0EBEB4CB39FC85E8D625F49430786898EA585A7D61D349583F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 f2dc07e3481906b4f4289d195d839a1f5fb96741e208da5db41a5eb3b380f00e
MD5 5231028f737ea8c1d5da4e44ecfc5cf0
SHA1 111087b31608e264b80be6a2b6ad807b82c39f8d
SHA512 d8e0f2fa3e888150c7e088eff14fa10bbd639451c58c716c3f520de38c49a6debd08d8be74abf43031c861507d3de50bea9052128b7fc7dd293398e55fd739d2
TLSH
T1B6414FD14C381AD2C4BC0A6EB49B38FC85E8C725F1A4707D6898E9940A3D54E748583F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 9c37f90e35145a97e5c9acf3218ee95b818eab65e76f4f558b1ba4d77e27988c
MD5 b4f311ac88503d6bc6e00daf3aa4f177
SHA1 4f0e8974815b51cb7fccf28c5c493adf6361fd7b
SHA512 db8ac6cff53c7382cfc6bb91aa6707a0fc13df8377e42ce143c5bd4c60766a5d6ef04cdb6d7f86773afad10a3186e76f9dcdc5fdff3719334f17eef979c349c8
TLSH
T1004143D00C384AD2C4FD0E7EB49739FC84E8D625F4A4307828A8DA585A7D50D344583F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 aa00708795980dd39e40dcf72192ae432c9723c4b876d8aa0ee7c09d221ec36d
MD5 b86a7c58ee40356fcb8e3d4a647fb35b
SHA1 a1aff380eca039177f45bf8900772f4cdfd67b5f
SHA512 a8810fb130020ed22dc5e572a3a2567513dffc1534601ff2765cc0c70a5f04631f65a431dc87cb2dccfe29d9a39e8f6784267d29cfebb9f38552e7b41af92e79
TLSH
T174414FD14C380AD2C4BC0EBEB49739FC85E8D726B1E0347D6898E9940A7E54E709583F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 706f44fc94310b8f9e8ce4f3b9bc912fd12a30245f4c80e92d7f23fc3c10f6f9
MD5 3a453591469cf31b306761d3055947d4
SHA1 54bf97722d27c01659cdca31ab2aff0623379d01
SHA512 57aaf6bc8907d19b2dd231518d6febdc433a3aa16641a9f1a42f7a1d053bc6a7675484b7d45c8ec107c70ef870a75c492549c7fc9b6efc1000f08179c070a9f1
TLSH
T198414FD04C380AE6C4BC0E7EB49739FC85E8E725F4A4347C6898E9980A6E50D349183F
MD5 SHA1 SHA512 TLSH

Submit Download

d3d2f1f0-79d8-476f-8476-64c19ae0fc4c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d3d2f1f0-79d8-476f-8476-64c19ae0fc4c.tmp
Size 33KB
SHA256 5f7e27684f45754c2446d40cecb869540278f9fac3c9ce5c5ae89168bc59660c
MD5 1786483f2c4b56c62b0d4399da0c1d1b
SHA1 b13867da1575f208237d7699861d6574c232efef
SHA512 02016403cd542f437d7d7115c3e9c52093447a5159e60d27ab168806df0fe709a3870206f58161da3d306b23cdbfe4d70afb750383169c0d734034cf57bc4f0c
SSDEEP 768:VFHm/wgck7+qNEGpENdwjnSITjKgqmUsR:Dm6iLOWigRUsR
TLSH
T10DF2C2F598D79977E8AE4B87A77D2D429AFCC013B4885A94B7D85D0CCC421BFC30A819
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e818a6a62e451e8fa43df905074516448222c1b53847607349125f01b6e8b955
MD5 2932af0b95850cb2722f103ea2336e90
SHA1 e5ae825ef4f19a29724f0dbb0a618a77fee2b11b
SHA512 328527ff324b101dde6f4496c2fba2d82e2ee4839ec0cbe17c0ac14e67080836a19c5d479d9bd5d0006beda23ff2b3a4720c4f238cd22d52534d1e143ad71073
TLSH
T1C6413858B6ED1158B3B76F4AABF6A86E447FB8772E06D46D10010E4E0722E40CCA2777
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Code Cache\js\index-dir\temp-index
Size 4KB
SHA256 1e45f66c8fb55e835db63f19d11bcc0d751b0529c70ddc1d8f8b4b8f39601fc0
MD5 e8a5b5e7b66f8ab4fc8a0d5aeb41ca30
SHA1 dca04820373f5d00c76f7e6135fcd56fba3f9743
SHA512 231e2345beac9464975b4d4790bd11e4daf808500d918885cfe31709304a1a8d39a295c8bca0a33c6dc075a7bf36580228ed3b4ff18ba423ff53d7abe88cf677
SSDEEP 96:uvq9OyTADtkD9GsuzLR75UM99XAqjLy8y8zIM3VQ++D/McL/TyH1EU6g5pZ0KfM/:uvq9OyGkhGsuz97rrwqjm8yGpVQ++jM0
TLSH
T19C816FBC59B9582FEF6D15B945F018B831FEE4C1850B7FD2A0266231874FB8460D616F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 4a27c9089eb90b67d5c3d038675a90f31d9e9f3a9da6beaef37524bb0b3d64e1
MD5 5f4cc3ac05e13397c68ba9c81c7dfe74
SHA1 98ea22a495fd2061ba931332294160962abce5bc
SHA512 855ee508065071ecbd344d9398fba04ab6550e19a38d597aa23d5442465fe830a6e5fe4952f7fa865286cb430830acff19e0059e4d6d01c7beb13bb42c479a6f
TLSH
T186511ABC49F9582FEF6D15B845B11DB862EEE0C6E50F3F4380266125874F98460E61AF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 bfb8c17dfc8c149835f572ece492ac73525ae6ac0b79a2f6b29c9e980abe3d18
MD5 3fd3d26ac2773e2a7763ad152fe1d044
SHA1 695551272aa7831d6467baa977f4dc87a98f41be
SHA512 eb0fe9af75dd0e6a6ef0ad97403dc6161b5bf9c409dd437e127b3f3a5504bc684e96e57f922f2ab50739530132e3acbb3b0d177f5e6da80168cae8036ba06577
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 6a2c60c7dc4ddd8e7ae536e80baf494ca8c75dcbc6bed4be6e3398ed5a3d92f5
MD5 7d509dcc484269bcf6abd064edb9f76c
SHA1 c2f1981f38e3f8d164ce72090656c9b98f383b55
SHA512 4db9e03354d016785e0004439f31d614f7ab7095a91de088536c597bae73eef19979e03a2a1a482077d0962f0eaa74942719e6a963e3fdf7a41635b0205e2c9c
TLSH
T11C31C7BC490E8862DB9E59F944F1559C31FAF4C6D4031ED0C07B6136C688749A1E727F
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\IndexedDB\https_claude.ai_0.indexeddb.leveldb\LOG
Size 291B
SHA256 300c821bb4b149af36dd481ded55135261853f9f19236552d041a31ad4422830
MD5 1c496932034af305df7cf1ad81b94bf8
SHA1 f2cd36e525dc7eca7d9378730b921ed1f0151048
SHA512 c56097b07915066fb9fb61843e2daca165e2b246623cca20e8bde35dc9cadcc7cca1a96aae66047b65cada65451967f9a885a417125d3db15e29d9bd2226e475
TLSH
T168D0CD6141DA439F526141D377757B5FD7A373899E485D48CF92D96CB0C5005DC5C411
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Network\Network Persistent State
Size 2KB
SHA256 f34ae5471c4c158a6faecf58f5504c128a61f7651c2bc7886b2a05cb4f9d383f
MD5 a842b68e40ca3bd536ed4fdcc4c63a4f
SHA1 f95c36c6bf97e89b4848b7aea4f472a4c0347835
SHA512 1efce13758dc97b26a641214d90b24fa9d9368c6524e26f7e87dfb26b298f3fb236dc58a34e4194665e544850de654facda2995113a375a7a19e3e2f8aa4c6e3
TLSH
T1AD51DCC6C7E90A7EC5632BF52F253963C1BE2A1C93183C0798DAEF8E67E1431561064D
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Network\Network Persistent State
Size 2KB
SHA256 874df0dfcbccdddf43e689427b4f680f2146f025eef27ff36c3fb940c7a8c207
MD5 4d6b82594b256e7681d4c090ded3c192
SHA1 042052c340defcad896be610ff5976413025576e
SHA512 22bb3dff7e87ac111085fdbb83fbecd27713804e4d5dad988d98d939453ba9d31cd130fd1a395b4e6d1e366fe831073fa34a631d1a64aaa35abf270a75df16e3
TLSH
T1CF51CBC6C7E90A7ED5A32BF52F253963C1BF2A1C82187C0798C9EF8E67E1431561164D
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Network\Network Persistent State
Size 1KB
SHA256 f2fe74710d8fc2881b097283bda00c2f4aff8396dc7abab3da147b4220fcefe8
MD5 e058ead2ea16b780620f834ec8d4db09
SHA1 6feb6319ea02cd8534fca3f797f981503128cfc6
SHA512 c5f0e5c39abd8b8c072e274db2f5f7832427133df0d213f3b28e3d7e20bf97462491cd18b6092936b54489a98b369d38b57398566c2601a2a892bc63894d4e41
TLSH
T102317BDAC7F9067E8662ABF12E21BD63C1FE161C4318BC0288C9EF8D97A1432561174D
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Partitions\cowork-file-preview\Code Cache\wasm\index-dir\temp-index
Size 48B
SHA256 316fc795635cd657ecaa099c4f671802652d5b3f76320fa3c1a1b06d063561a9
MD5 f9f06a8a9ae6c4f5eeb4240daa3d0278
SHA1 41afb516dbdc00b6a7d34290a3b44b5f1524f381
SHA512 652f95a68f9a69bdb3a8e305d6596356fa6f49626dbc17b006af7f86337e581fa0bced59855aa9f2debcc9996ad47ac5f75290e6726c36993272cdb3aa173eb0
MD5 SHA1 SHA512

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Partitions\cowork-file-preview\Local Storage\leveldb\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Partitions\cowork-file-preview\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Partitions\launch-preview-static\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

b036b4bc-1c14-4821-9c35-18e1d3ed502c.tmp

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Partitions\launch-preview-static\Network\b036b4bc-1c14-4821-9c35-18e1d3ed502c.tmp
Size 84B
SHA256 712196693e3527ac1131831f1a2108b6c0e5c68967b26d51a452611cdfb86e0c
MD5 32b9dc9cc81d0682e78627c873fdd651
SHA1 46c486386d3e153c3e9b11d54cb52cf0064b71cf
SHA512 f18bc37f8b72411548da247aa1394cc5ac03c3bbd98e82eb8ba290ef239ef5b8625cf4835bd41ce7c52766d0bc3bfe9150dd22dbf62f0f05992ddde5fbfdc811
TLSH
T154A0121490405CFB0308835504146463C3F50002421848A91634318D019209D0004403
MD5 SHA1 SHA512 TLSH

Submit Download

e320828d-7821-4ec5-892c-85220f4a685a.tmp

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Partitions\launch-preview-static\Network\e320828d-7821-4ec5-892c-85220f4a685a.tmp
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Preferences
Size 132B
SHA256 c23c68a74bde0a35290b102b905005fcba3df8e9f3e4eef6a6b083d2f5978ff5
MD5 ad94320e9e28f06c1004ad3972aa9772
SHA1 e8f6578de1397855e3fa420244d062677138819d
SHA512 15c7053145597daea933bdf38054e341abc041ec3838b49d16439d425895897f0eb277ec54210299b3032a823bf08d43affbdbb55a790fcf8c790ed668801025
TLSH
T181C09B56611515768E3FDC13C4465CD75FE506504D0B0E5184D435459D1715E4DC701F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\Preferences
Size 197B
SHA256 1a2b94c75e918c6e1d5e22f31a71397396461181233768e8ab5610ae1deadef6
MD5 7f142350cbbd5aafe13baae0e8b649ec
SHA1 b21c83017edab4cd21bd8853db8f386bf1c9ece5
SHA512 f0b3a0972a1eca0d45bae6499e16c7044bd73aa81b1e5a9504763a64d4c476006be986455667f486bda8d922adf28ac71db41b19e86b38e58fac688f668b8319
TLSH
T1C6D02216203010B3893FCC33880D7CD64BF402004D070A8289D83108891335D0AC700E
MD5 SHA1 SHA512 TLSH

Submit Download

9086ed90-5f46-4dfd-a9d2-0909012f7536.tmp

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\WebStorage\2\CacheStorage\83d8c5e5-4cc3-464c-84f2-f071423a6bdd\index-dir\9086ed90-5f46-4dfd-a9d2-0909012f7536.tmp
Size 48B
SHA256 edac41a26b4d831f984cd27f74e4c7feaa58affc2b4206980774369a50062081
MD5 d5b6d22adeb89a52b3375ffd8f46e506
SHA1 f0debbef8df496d609e3bbc3886b9e289de2d14b
SHA512 b9e83bd29a9b8183500f5ebf32881df42b087124c892bc332896add44a67122e83bcfc576ebb118745cc5b1f3aad5458065c724a7fc93c3534edb658e734518c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\WebStorage\2\CacheStorage\83d8c5e5-4cc3-464c-84f2-f071423a6bdd\index-dir\the-real-index
Size 72B
SHA256 6be85747ddc2d8326a3f34d72cae51b5cc5d085065e6be54912b870352baf9fe
MD5 cb8ea1a808315ca721d6fdda9f97fe54
SHA1 5da60afbca34931a21ae8a60965af75f87dd8a40
SHA512 35282141e8e4e837ba4e243b1e5845a5aaec61c1e1c34b3fd8d13a3920c296a1b90cfea786ac2b94c43e6f53047d3f86ef7c7c1c76d02fdaa30ad648c5580cff
TLSH
T183A00260638D1481D450A676B1550B967310C8504943470348908259CDB02E96A5140D
MD5 SHA1 SHA512 TLSH

Submit Download

d9137a95-a0f6-45c5-95db-19a006ba4175.tmp

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\WebStorage\2\CacheStorage\d9137a95-a0f6-45c5-95db-19a006ba4175.tmp
Size 176B
SHA256 fb9f472f7124962437a2233491de4afcb88952a182a44bd6977d97bc9cbb789d
MD5 14ea97012b23f2772986a09ec7acc55a
SHA1 a3235d7410d7aef6f132497e6557ab41f476608d
SHA512 fc1837ddbbf10790894178af3fc7964bedf58b5433f10dcbd7706ee3ab55b0f5d705afc56ecd8f81095f6e5dbcbf8eb1210da86920a2ab2551436942318dfe7f
TLSH
T1C0C08CBF02A1A6E12E6134FF615332CECA373FE95CC0AA4C863230997334CA95D01D24
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\WebStorage\2\CacheStorage\index.txt
Size 89B
SHA256 92cda5a28f4c1874bcf0aca7ca908e1234751120abf372f5a81cbb33590c3590
MD5 8684fe11e05213691ad78cf380e7c451
SHA1 1c075025a185041ddeb120c2c8e8cc2fe175d82b
SHA512 fd3ede8f008a3407360d649eb6c2c07c14454f2c17e823af53217c15baeb965494074dfff8b87acf24474839cdf9aab03c71be349e434dc6ba89e32b2a57bc55
TLSH
T1B2B002FF014156D15EA135E7100731DEC56376D85CC0EA4CD572105473104AD5401C24
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\WebStorage\2\CacheStorage\index.txt
Size 176B
SHA256 2c826c66620dd226cffc37253411fba5c0adc28ae64cb49d05e778d44b811849
MD5 55c2cfd800f044dccd2f9c6b4139527e
SHA1 0011c5d03a6841c30ca8022393f6b5582822c734
SHA512 5091d75f1891ea98ab3386b484a9cc10f97b0d368f543238694f12dd315770fc8bca73b223a5f8b56a2528b82c5a5d5030a408108a30b87f12ced5514714a2be
TLSH
T1C6C080BF10C1D7812E5564DB210736CDC5767FC85CC0E54C947330547330C594501D14
MD5 SHA1 SHA512 TLSH

Submit Download

claude_desktop_config.json

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\claude_desktop_config.json
Size 228B
SHA256 d7c754f7b4095233b797c159ed69533bc88498a587c32655a6e72501186b656b
MD5 e3671cf71c3231f0bf2c3ecbeacceb46
SHA1 8a2f8a93e85d9afb597b1d84d29002afc9128a6b
SHA512 3fdb2f07856e75a2d537662adf3b55bd63846f70a5a34a00599d33a0d0644751c6ad5973a079c61959da5f99ba6b0b406c1855908570be44acdffba3b7ec4167
TLSH
T10FD0A720D8210EE706F292184D2D8413434179931928742CA55E061C1FCC93C7834452
MD5 SHA1 SHA512 TLSH

Submit Download

claude_desktop_config.json.tmp

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\claude_desktop_config.json.tmp
Size 252B
SHA256 a3a371e0871ab00e3c6849481c5e1ed5d402ba76985b8cfa6e0ef32fff9ff8ad
MD5 2ea1f0047bddbc5a7fdde058bc9045c1
SHA1 84f6ad122ab697cb0dba4ed294a4652a1c093126
SHA512 adb7ef1dd463cc3233c90c0e8190165f10bcdaeb10009443c0a2d6d86587fe31e507da169edd4e1d2c1a2bc91f6dda58c0c0ec67ef1535c7649f4980ac44a9e0
TLSH
T187D0A720DD360EE706F2E22C4D3E845357417A931928742CA65E0A1C2FCCB3C78758D6
MD5 SHA1 SHA512 TLSH

Submit Download

claude_desktop_config.json.tmp

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\claude_desktop_config.json.tmp
Size 739B
SHA256 5901e9dd3f57125658d6e9df0f4603427d3018382749589c0bc95c954a149777
MD5 85d413785806516caebd27b35be3bbed
SHA1 8c3218e77a30fce6c59ec5e45ac294140e51ed3c
SHA512 422edd38d2a2e1ff4a2c15f2af6b207b2b102aaa48831e94515f993a28d7ce722c4cba7fc54c6523a3a3abb732135eaa2d497f81e28ac1e409ac253f93dfcc39
TLSH
T12E014724C9330DB709E5B26D4C3D8607D72175C33A587C283A1E0A4C1FDCA7C91366A5
MD5 SHA1 SHA512 TLSH

Submit Download

claude_desktop_config.json.tmp

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\claude_desktop_config.json.tmp
Size 962B
SHA256 3e6b53ececf7bb9c86c3be19b3cd6f5ae5b75c20408f19b1bf428aeb4b3af8ce
MD5 3be7bb471cc996267c47fdfa866fdc59
SHA1 cc86250b0c7dffe28a260c254c78e36acbe52f82
SHA512 8184b6f65c429f08fa3e5fd548d005f779f76603c5f6de15929439d4b51b31e3e7d79546a7f2278d2f199d3c9d76d4fd3cf7af48d7c6bd2a6cc739b92de5fd3e
TLSH
T1C4115924C5320EB709E5F67D4C3D8643E33165D339587C2C395E454C1F9CA7C907A6A2
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\config.json
Size 165B
SHA256 6e151fa5954d71aee307673be672d9fa40639b9135b3a78b3eef3a7ca802217c
MD5 666d47fd57cfd296926b6274b31cca77
SHA1 f27e4444f8bd4cce89b11d60a24ed1ebe745b907
SHA512 9ea158d1e92201381943c922fd7e4de1c13b0fcf6b62ed8b4e386c2b4210115f91c2efe51c9b1efd785e765482973504b28128ee8bf7db6a7254f6e6714fcd66
TLSH
T13EC08058C12013B6A4544AED4D0841C756850605555F5845CAC1F54BE65537E0C45B63
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\config.json
Size 504B
SHA256 b69aef08975c5a63f64b2c4401c066741af6e5c0a6478bdefc9214b37c6b54a1
MD5 61433a9c1e04b07e93aecd6be869b119
SHA1 eb4939edd8e9ecc4bda5c6ee444529d249d1067b
SHA512 b920efe6700492f09afec0a6f8057722d8b34078466ca0dd84fc48a97d07e06c627c53707fde8f9c04683c265526ec3b3c25cdb75cce57a40eb6537b7ff7c5a9
TLSH
T10FF0C09C437123A3649189FF0C0C028727491A46E41F1445CEA2A607CB963AE8CC4F61
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\config.json
Size 726B
SHA256 89a11237a6b48caca207bda9052fb6f02f743edb0f6fff1361611d24ac4b57fc
MD5 b95de0e24c41392a56785db788d94da6
SHA1 c717ab36685b5b9b7256559fb9fa97ae2b67eec9
SHA512 b11a3bd259f92726551e04a2cd8930737ea60596b5af2a2f2a5717234833c621c0bbd18be1f8e7375acf89191443a2214bbec556248e5a9846b5768f252293d8
TLSH
T1BF01D0E807A113B35491CDFF080C428626195A02BA1F1059DE62A647CE9336E4D83B51
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\config.json
Size 548B
SHA256 cf5632ace2b03cb15f80c1d09a78389dca60ff48c7f03bf538f418a91b8de9c0
MD5 69763d2611ba687ce2cfaa5d666a2d16
SHA1 4f2f38d44d3c3e127fa32e71e6d1dfb3f5337ea3
SHA512 6da9e80b79976defa5e3490eef8c653839e0f79839892810926448bd531759c5ac727c8b11b4a7e236bef00741b99a4d9c2ae29298124ee31495406cfc3821be
TLSH
T18DF0EB9C437123B3289489FF0C0D02CB2B091A02E51F1046CEA2AA0BCFC63AE9CC5F21
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\config.json
Size 43B
SHA256 9f94bf83662c83ff69a001e2967f8b86f5ec060e552d1ac95e2a9ecea1941d00
MD5 f36e143865949979cc2d5c3fb73860b7
SHA1 82e07c95502ae607b757a14973fb80f6b3b214af
SHA512 6d79a245f6ee0740f81ad6814cc63be9b68c68a70e5f8aa9a6664b6e61360ebb6f5ebf34dbbe457bd930868f59cae84ff87c67f1b7f8b4e137372935d32edbb7
MD5 SHA1 SHA512

Submit Download

config.json

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\config.json
Size 688B
SHA256 17df2163805f8363836f035e8fd253f6f7b251ba4b7d7a4766c15e6929a3b6ac
MD5 f9961091654a3db39094c9cb9577c28f
SHA1 9617a25a648ff63c07b36811c83b877e23409579
SHA512 febcff5139ec3e61d8c166933fee6f8f622bb91ba96a7147739e6f7b8ae9e7fd6d294bc2d60974130dda1d4c8113a8726460341a7d981ed328f8b0571ecebbe4
TLSH
T12201C0F8476213B35491CDFE080D4286260A1612BA1F10599E62A747CED336E4C82A91
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\config.json
Size 76B
SHA256 f54a76b428706a08b8b8362993986677c268212a6b443cfdeb696934dee73cd9
MD5 49325f69a24cc757e9b729a06e9d9631
SHA1 30943bd04a0b19debd67aca2d05c76f529ec538c
SHA512 8a0761b6071cb9fa019c9366a1b5bee1e2483b3b9292e544d6cc8d71ce488a65c9876250e74d0d4e6c9f511e781664528f2e638c621e1954843146c522dd3fd9
TLSH
T187A0222AC0208032E0300BAC0B0822838CCA020C008B8800CB82FB8FE2003FE0E0ABE2
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\config.json
Size 549B
SHA256 542cd1a06c4ec65f08d56371d0341255c8e53fa586e7c0eba7e104b7f72351ee
MD5 25237df1f17e870555c2ae0f2391309c
SHA1 375e9f43370b6d5bcde1392e625986dfe178d4de
SHA512 b51f3b5a4b0dc947d0bb185088a5619e3efaaa921a366c1ee3e4235a048888c790521b04ad57b2e272b141a6e3b2b3064385974fc5e5b18d6a9c6dc48f1dcf79
TLSH
T105F0E19C437113A3249489FF0C0D02C72B051A02E51F1446CEA2A607CFC63AE5C85F61
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\config.json
Size 617B
SHA256 24000994c192242a1b0bd740ce99a6e39a0853b4e8b6489014d955c7af6f53a2
MD5 804d1ef65320af69874607f3d039fce2
SHA1 b2909b742f11fab0b29cfca65ff1fc1f31dd8aef
SHA512 e1ff863b9cba7006d7d8443de0cd931c97988b818e755f5cfe4c0024c04296f8540c067e07da2d94ba3650a10dbb13bb20653de467def72b8aa854c38fc617d7
TLSH
T1B0F07DEC47B113B36495CDFF0C0D42C62B095A12E61F1445CEA2BA47CFD636E4C86B91
MD5 SHA1 SHA512 TLSH

Submit Download

config.json.tmp-5809550742897e11

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\config.json.tmp-5809550742897e11
Size 78B
SHA256 3b748c807f058b0bca793900d9fabba0ab223db8fa4ffed1adcbf29cfe519ebc
MD5 b337c7d3ca216ac9bf0f2cd31284e374
SHA1 03dd2259d78fafd62d46779ed4cf6e31253d3299
SHA512 7cb8b0e72c8737a9dde447273e69732d93f352866c9e51da326576134fe6e876bd8d3a795af1946e8de8946fc763bfad1d7dabdec17ac250beaefab6369af749
TLSH
T11BA022AC82208022CC0E03BC088C00838AEA03CE020B80000080E33FCB00BEC0A0E302
MD5 SHA1 SHA512 TLSH

Submit Download

config.json.tmp-58095511676ed3b1

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\config.json.tmp-58095511676ed3b1
Size 63B
SHA256 9915ade55cfdd39b61fee9b23bd6b658b1af37c613485fefd30626c197581958
MD5 27a31de0a4fb8afd06af88897f8d912b
SHA1 2cf8dc83eb4430a0718220532969f7e65dd0e81f
SHA512 d8453b5b22dd66ef9e78685877751f7569a27a30d5cf2a21969aff7f4521fd11e9a93105efa9cb6140037a3c4709eacf6f3c9e232fb59e7aa9b500b679ff5351
TLSH
T1A0A00228C0219023E01482AC040400C685DA129C660B590686D1B24BC646BFC0A4E756
MD5 SHA1 SHA512 TLSH

Submit Download

config.json.tmp-580955132361b29b

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\config.json.tmp-580955132361b29b
Size 71B
SHA256 4ba55854f740709254a196e563549cb7f3a42e9f6415045632d0ab410bdc4100
MD5 39444b798ecfe07076ac2ea5c4059149
SHA1 cfce5b58578a1102ca10753777e4625f7338bd17
SHA512 28db3598dc7ffc1f489a76a3a5d1fa99b96dd3fb362239b3c08ee0d342d906e138a7740a359bacb4ddb9be1bb4c5d8d4a5894763ab3bcc12546787c3cd40ceeb
TLSH
T114A00278C1258427E454827C100D44CA85FE775D9507400F99E5A24FC745FF86B39F66
MD5 SHA1 SHA512 TLSH

Submit Download

config.json.tmp-58095520340ac1ba

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\config.json.tmp-58095520340ac1ba
Size 96B
SHA256 0c86904e7747c4be22c00aeb0eec8de857d7214539fb51a4d11d633a0f8f214c
MD5 600b25142cb2053c2a0b48bc2d51cabb
SHA1 b3c97ea13a23f5bbe3419f7fd77ae9b764f5c4ef
SHA512 0926abdea47763f02bf4dbe2d76c85d9a32d82e87cf56ec535f1043d2641cc5b8c0215d7ecfaa3de473fe955405c64ebe7cbb62a58619da36dae56549bfa7150
TLSH
T122B01225C0204037902046DC0E0C10C345C50148114F5C01C382F64AD1057BD0D0A792
MD5 SHA1 SHA512 TLSH

Submit Download

config.json.tmp-5809774462ad4f35

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\config.json.tmp-5809774462ad4f35
Size 104B
SHA256 651526cebebb10b2bf641c380b4b5eb912b623b1d2e8f05e69ee79419fbc1162
MD5 8bea87991f819db6c12097d5845b59ec
SHA1 ad0424d1ff56b83bbe0e8249c0dd9e23750958d1
SHA512 b56ed260a94c7f4164c54e90bf61d0f6f5bdf6b26774e2826b157fec1d019226cbdb069953c239d88831f6ee67cfeb37c4bde66870b03845a741b4d8b8ff13e6
TLSH
T1E4B01275C020403AD02046AC0A0D54C745AD2208404B440AC696E64ED204AF95E25FA2
MD5 SHA1 SHA512 TLSH

Submit Download

config.json.tmp-5809950325bca872

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\config.json.tmp-5809950325bca872
Size 259B
SHA256 e59cbba80a4ed8677a86e81b71dc6d5fd0843283b10cdc9da50698c00c1bba8c
MD5 641f673cbfd964cd7f5dc31c6366db1f
SHA1 c486d9d15a81d1a5dbcfa2436038adcd12736d20
SHA512 28bca561768c4441f47b9dbe88170075a9de1a387637692684ad0e37b380e31e1166825de3e9dc3ab65f5d61a35df40bb977c1eb17977faf80839cc4f9225f48
TLSH
T198D02EAC867013BAA8804AFF8C0C00CB2B801615A40F1444CAD1E28BEA823BE0C89F32
MD5 SHA1 SHA512 TLSH

Submit Download

config.json.tmp-5809950608897b52

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\config.json.tmp-5809950608897b52
Size 439B
SHA256 c18f7524526b80d00fe50c31fe86d5545c8c7bb2d3ba208b7e076aa2438982bf
MD5 04397671185d5ab646bdc52ba835dc7e
SHA1 2d04fa2b0172a027f14c75782d71b437dcbec1e2
SHA512 b57660d87c032d14426b12d3cd1b933e762e042ca3fb606471785b7b760cc85f8a1d179d756b98640e2d182219d4bd8c300341515f6d2c7794cf0b0526678290
TLSH
T17EF05CAC437123A7688049FF5D0C02872B441B46E51F1581DEA6AA479E993BE9DC4F62
MD5 SHA1 SHA512 TLSH

Submit Download

config.json.tmp-5809951925386d14

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\config.json.tmp-5809951925386d14
Size 726B
SHA256 c03c0686441d31677162d52651c37d51ee7c0711d76e54334936da09954deb5c
MD5 ca1c2e4864686e5f1ea311b490ac2906
SHA1 7f8671f175da6a31ee73f5318f74ebca2dd932c1
SHA512 dd3084e26eb61b1e349f4d32286d3cc77492e69a5a5812d078c75fd0a59887dd3dfbb6b41248ace0372fd59536f48a2aaa8abd795539dd6c018a71206bc92c85
TLSH
T13C01D0F8076103776496CDFF0C0C42C6276A4611764F101CDE927647DE8335D1C47764
MD5 SHA1 SHA512 TLSH

Submit Download

__init__.py

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\local-agent-mode-sessions\skills-plugin\43988d34-ce1f-446d-ae4e-7ae3bede6904\3ee60964-c581-416b-aa28-c5c349530fe8\skills\docx.tmp.1785809953000\scripts\office\helpers\__init__.py
Size 3KB
SHA256 e62e525673baa71fa2c9f01d637c37b44383146a46c28957ba3d9d41e1a4ba21
MD5 f0de46ca224b079be69e632688e4afbd
SHA1 6b9f62b7eef3cfd670f378deae0992e26d6ad84e
SHA512 c6b7f8aeae703b703e99c127c21258c61f5de5b78b464b2373973e3baa65387748248454e0fe4d206ed012177a468171edeaeade33ee6dd0f796dac17e2bca36
TLSH
T16B61558B95651881D3934FA82CC26622B319BFE34F431D34FECCB6502F44C799AB554C
MD5 SHA1 SHA512 TLSH

Submit Download

pptx_chart.py

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\local-agent-mode-sessions\skills-plugin\43988d34-ce1f-446d-ae4e-7ae3bede6904\3ee60964-c581-416b-aa28-c5c349530fe8\skills\docx.tmp.1785809953000\scripts\office\helpers\pptx_chart.py
Size 5KB
SHA256 47ac266f7d39d11ede6bb0d1f3a19d801394fd2964636f1b48beb701f1832964
MD5 d1828217ed4ee8faf01d67d32b6bd9b2
SHA1 597e4121db75a0ebf9d94becbb369493ef416f5f
SHA512 7f20b190a9c5000723f6bb2894c95c5107d62c272e53e95e8317de464c5b3620bb3c2bb11c3b25b21fd1422041bc79e681ac42ec39ac626c229ddbccca75d796
SSDEEP 96:aP6G/On44sZJFA0uxN/PW6t40F6t46IP3aRYSJhxmcDB+4GKx5SCTswlY:aiGGn44sZJG0mN/Ph8zIPqRYSJhxmaBY
TLSH
T12EC196B5D9371F53E2E6647E0D82530373A9F923E801A458BADC52AD1F4E43983761AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pptx_slide.py

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\local-agent-mode-sessions\skills-plugin\43988d34-ce1f-446d-ae4e-7ae3bede6904\3ee60964-c581-416b-aa28-c5c349530fe8\skills\docx.tmp.1785809953000\scripts\office\helpers\pptx_slide.py
Size 1KB
SHA256 7b9f69b4a5bd6a2d9eabf9e0e3e796d7a421373145f6a8cd11f60b7ba2d6a5d0
MD5 f8e903c1b8fb9afd8ff0fc3a20ee2a2f
SHA1 aebd39cbaff0ea4587cc1498f1b2ebcad722a211
SHA512 62224f5ea366e54842070bd4de0f58824e029946d1c305fe5988513b1273d62a50c5639874b2b49b20f5a7c0b4db81eb13057e3dddcd91cd4bb4cbd7b8a4b263
TLSH
T1FF31109BDC2D0E916AAB31BE2622918D335090675D70FABDF5CC40B61F0F50C19B2CE6
MD5 SHA1 SHA512 TLSH

Submit Download

pptx_theme.py

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\local-agent-mode-sessions\skills-plugin\43988d34-ce1f-446d-ae4e-7ae3bede6904\3ee60964-c581-416b-aa28-c5c349530fe8\skills\docx.tmp.1785809953000\scripts\office\helpers\pptx_theme.py
Size 3KB
SHA256 ebb54c56e9c13807f5f98f0cae22d47cdd0162da8525eaa664e3f2c8c8d6bb03
MD5 c82f7ea56ea2b24c8bdcff0a249e5ad0
SHA1 be70f4dface196cfb6f1e4b7f334fd0160e15934
SHA512 11fedae925d0a78737e6c45c845e2d89c7c332b9fc8b7f01faae1726cdd48bcf944ea4e5ddc5af02b34370addf897643f4a654b7f465b4502331373af88ef10a
TLSH
T1D77131876C3599514FE3BBEE1502A522F35DFAC711851229F89C92401F0737C95F57B8
MD5 SHA1 SHA512 TLSH

Submit Download

dml-chart.xsd

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\local-agent-mode-sessions\skills-plugin\43988d34-ce1f-446d-ae4e-7ae3bede6904\3ee60964-c581-416b-aa28-c5c349530fe8\skills\docx.tmp.1785809953000\scripts\office\schemas\ISO-IEC29500-4_2016\dml-chart.xsd
Size 73KB
SHA256 41b93bd8857cc68b1e43be2806a872d736a9bdd6566900062d8fdb57d7bbb354
MD5 d480bbfc8419bd13a324e5f4a509ba68
SHA1 4c0e6f6c6138b559fb0dab1d5934334c1d770809
SHA512 4cc6915a8a50b1541a3be2ffeedcfaefe586bc3267f7b4c2973aab536fc00246a9056a73705bed6084b2e55c059cd6050d18c4d7a43304d41f381a8130e6136f
SSDEEP 1536:rQ20XGvyDfb6RpfPSO1r0gqfghX6sbYa+zmmUndFIlo636IBnlU3S7uWFabZv4EA:tRpfPSOx0gqfghX6sbYa+zPUndFIlo6j
TLSH
T13973F642B9A1EE1506175C3DD5B1374D3BE5C5B302A8ACA0F5ECAF653B216C224B32B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dml-chartDrawing.xsd

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\local-agent-mode-sessions\skills-plugin\43988d34-ce1f-446d-ae4e-7ae3bede6904\3ee60964-c581-416b-aa28-c5c349530fe8\skills\docx.tmp.1785809953000\scripts\office\schemas\ISO-IEC29500-4_2016\dml-chartDrawing.xsd
Size 6KB
SHA256 3fd0586f2637b98bb9886f0e0b67d89e1cc987c2d158cc7deb5f5b9890ced412
MD5 b1e3c6e50f086960fb06970c76b83d5d
SHA1 2856105c805c355f0b45ff56a891b84b0d817c98
SHA512 7ae28f04c3eb9bb9be2fea3a6a0c8803b8958cb5caa411f5a9ce4c61eb702e5c2294360830a05f82fb0eceb616f8b59a8ff8b918bf8c94f4b2e716c95f7a8bdc
SSDEEP 48:cY0tiCJ032Us9y2fF5R3yCsMzQ0EayCMht25pcT1+spS3HfxWWZgZJwZZgZsrIvS:r0tiC6Q5UIQ0kh8wTlp4HpbFcqMUo+
TLSH
T1C8E15446B4A0DD114A4B0C3DD6A0370E7FA5C1A753A8FDA4F4EC6F652B126C228673F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dml-diagram.xsd

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\local-agent-mode-sessions\skills-plugin\43988d34-ce1f-446d-ae4e-7ae3bede6904\3ee60964-c581-416b-aa28-c5c349530fe8\skills\docx.tmp.1785809953000\scripts\office\schemas\ISO-IEC29500-4_2016\dml-diagram.xsd
Size 50KB
SHA256 29b254ee0d10414a8504b5a08149c7baec35a60d5ff607d6b3f492aa36815f40
MD5 cb2abeeed3213366e06e25923bb4ad09
SHA1 7c6e10149e38998aefe1937acfdf2027e65e6ebb
SHA512 d119f42f564fd930dbf27d64b5f124916176f6302267071fe37f72ee30df022e2968958fd777b4f31ce2b56f3e370ef8f2a42381c7476816730eb1ea6c613254
SSDEEP 1536:a3QuGvUDfNmeQ9rAeqybJCKE/i7gUzaN+jmbhnvaR5gneDKSrrbTbp9eT06UDma8:smeQ9rAeqybJCKE/i7gUzaN+jmbhnvae
TLSH
T184334D41B4E1FD254897183DC2A1275C3B74C4F703686CA8F9ECAF966F2195522B32FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dml-lockedCanvas.xsd

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\local-agent-mode-sessions\skills-plugin\43988d34-ce1f-446d-ae4e-7ae3bede6904\3ee60964-c581-416b-aa28-c5c349530fe8\skills\docx.tmp.1785809953000\scripts\office\schemas\ISO-IEC29500-4_2016\dml-lockedCanvas.xsd
Size 624B
SHA256 5cb76dabd8b97d1e9308a1700b90c20139be4d50792d21a7f09789f5cccd6026
MD5 099b663cecfb444d9878c462e27196f6
SHA1 5a5bc0143e8e5b5ae866c4094aa3685192c2eddb
SHA512 e8d54cbb53e9ca87fcb152dc3f2e015d8ac9b51a91512052de695c007cc439f7e6158336f2813c6549755c28ef97bb7d688ef0f757ad6b7b5679b1335ea5945e
TLSH
T1E8F028C9C514D861B3598865F5F73011BA3094EF06F4CA17F870CEAE71454E539A2BC9
MD5 SHA1 SHA512 TLSH

Submit Download

dml-main.xsd

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\local-agent-mode-sessions\skills-plugin\43988d34-ce1f-446d-ae4e-7ae3bede6904\3ee60964-c581-416b-aa28-c5c349530fe8\skills\docx.tmp.1785809953000\scripts\office\schemas\ISO-IEC29500-4_2016\dml-main.xsd
Size 148KB
SHA256 5375417f0f5394b8dd1a7035b9679151f19a6b65df309dec10cfb4a420cb00e9
MD5 e36b6a6af361a798cd6a355196f3262e
SHA1 a5eeae6513f8f8f3147ddcdedd3a4bfe5b228f8c
SHA512 0d6687035feebe639167c49a3bacb044937ca8bab3e0298be97157081a7754c6382291ad7978c78538f98a4d841d68aaf732259f9ee660019c017f89ffb5df0a
SSDEEP 3072:MSS/Vbf+06HqQT9+8OI7z+CYnLMBVADzuW+ylOeMhO336kImzgnOnDZba9iwnDdS:gF8fh8VqXJP9VF4
TLSH
T161E35D4178E1ED2509871C3DC1A1274D3FB5C4F24364ACA8F5ECAF926F2198526B72FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dml-picture.xsd

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\local-agent-mode-sessions\skills-plugin\43988d34-ce1f-446d-ae4e-7ae3bede6904\3ee60964-c581-416b-aa28-c5c349530fe8\skills\docx.tmp.1785809953000\scripts\office\schemas\ISO-IEC29500-4_2016\dml-picture.xsd
Size 1KB
SHA256 5d389d42befbebd91945d620242347caecd3367f9a3a7cf8d97949507ae1f53c
MD5 8dc2e528b40bc75b897f7cbd74eb533a
SHA1 14b98ecab678c0b1510e36232630c201ed435380
SHA512 fbf902968ca99e39f064d7925beb100f4842558a5906334e67a6c760ffceffe40bda5b07ee87412e068d64fd3378f5d76d723a6f7d55dce2ceac2a71e94b783e
TLSH
T153213A86D440DC51431A4C39D1E6330ABEA5D0A712F8AE65F5BC9F6677116C628123FC
MD5 SHA1 SHA512 TLSH

Submit Download

dml-spreadsheetDrawing.xsd

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\local-agent-mode-sessions\skills-plugin\43988d34-ce1f-446d-ae4e-7ae3bede6904\3ee60964-c581-416b-aa28-c5c349530fe8\skills\docx.tmp.1785809953000\scripts\office\schemas\ISO-IEC29500-4_2016\dml-spreadsheetDrawing.xsd
Size 8KB
SHA256 b4532b6d258832953fbb3ee4c711f4fe25d3faf46a10644b2505f17010d01e88
MD5 89b18e0f4eea89968240d323657ec5ea
SHA1 a488b73acf2f127985bc2cfb351b71f1cc58011d
SHA512 7f49e1f343e5a46b7eb166adefb8d9349cacd7c306f21287a314f73b0fa8154640423f033efaee546b94f9db64608652090d19b65ce8c25853cc98c64c1eadb8
SSDEEP 192:r00mmuCQuBHm5UHF5UnrhCkTlyHItIkJk1:r00m1CQIH3wYkT4HItIYO
TLSH
T1DF024642B4A0DD114A4B0C3DD5A1370E7FA4C1A753A8FD94B5EC6F652F21AC128673F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dml-wordprocessingDrawing.xsd

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\local-agent-mode-sessions\skills-plugin\43988d34-ce1f-446d-ae4e-7ae3bede6904\3ee60964-c581-416b-aa28-c5c349530fe8\skills\docx.tmp.1785809953000\scripts\office\schemas\ISO-IEC29500-4_2016\dml-wordprocessingDrawing.xsd
Size 14KB
SHA256 bdad416b096b61d37b71603b2c949484f9070c830bdaeba93bf35e15c8900614
MD5 3c7a916017612be6dca37ceb300724cd
SHA1 d6ac26600618d60101aa66d4cc9bfe069ac6bcc7
SHA512 32a770306a829ec53d2c6ff7fff71f9a9f05a446063569e53cc4d0d950fa490a4eea795735758fe69e923b1705c61b8c6c518750557c5b6e09c374c7bc9e6e7c
SSDEEP 384:rvU8m2GiCXPHNZ4xlTol0OEdELU++Oe9tQ9JLxLrJ2lT4BTT7pQHc5:rvUD2SXPHNZ4TkletQXxLc+jpQHc5
TLSH
T14D62AC42B0A1DD1549975C3DC5A1370D3FA5C1B703A8AD68F4ECAFA22F166C125B32FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pml.xsd

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\local-agent-mode-sessions\skills-plugin\43988d34-ce1f-446d-ae4e-7ae3bede6904\3ee60964-c581-416b-aa28-c5c349530fe8\skills\docx.tmp.1785809953000\scripts\office\schemas\ISO-IEC29500-4_2016\pml.xsd
Size 81KB
SHA256 d173c3e5d61e42e2e3a97226c632fd2ab7cc481fc4e492365b87024ab546daff
MD5 75f17beb6f1c7b60f5137983cc021d0b
SHA1 d2898e843d4a5cfa6a4ff4e9adf3ab55b4cdfa54
SHA512 0f01a3b22c9d74c04bd8bcdb61081cfb82fa5e0736cdede455678d10f758f261e27718ee09089cc16c5bd28d088f0aa8ad412ba2bdf35c7f07b29f4dceffc56b
SSDEEP 1536:as/QuG/jDf+fCNdBXFBy5746wQS+0W8liodUCaytgLuPOhI02p+1N9k36EkLIRGv:dfC1XFBy5746wQS+0W8liodUCaytgLu8
TLSH
T12D839042B4D1ED250D8B1C3DC2A0274D3FA4C1E64368ADA4F5ECAFA62F1568425772FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

shared-additionalCharacteristics.xsd

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\local-agent-mode-sessions\skills-plugin\43988d34-ce1f-446d-ae4e-7ae3bede6904\3ee60964-c581-416b-aa28-c5c349530fe8\skills\docx.tmp.1785809953000\scripts\office\schemas\ISO-IEC29500-4_2016\shared-additionalCharacteristics.xsd
Size 1KB
SHA256 3c6709101c6aaa82888df5d8795c33f9e857196790eb320d9194e64be2b6bdd8
MD5 962a4bb37f96d530c3bc4b9b95202bdf
SHA1 7745bd039dcf87d35ce8523d96d0c25a259ccc67
SHA512 3405072b6e9e07d955a61fa555f9d52ad633e07664764899d6ed1bf02569280b934027d3fd5131d4a8b998b82982fb2b5938c0d04f910543acea6e74059bab0c
TLSH
T1DB217D82A4D1DD1A8CC7045CD1E1600C7BB1C4E602A95C64FCEC9B9A6F168C06373BEA
MD5 SHA1 SHA512 TLSH

Submit Download

shared-bibliography.xsd

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\local-agent-mode-sessions\skills-plugin\43988d34-ce1f-446d-ae4e-7ae3bede6904\3ee60964-c581-416b-aa28-c5c349530fe8\skills\docx.tmp.1785809953000\scripts\office\schemas\ISO-IEC29500-4_2016\shared-bibliography.xsd
Size 7KB
SHA256 0b364451dc36a48dd6dae0f3b6ada05fd9b71e5208211f8ee5537d7e51a587e2
MD5 9a78511bf5aa7aff89f46d4ab1ae6a81
SHA1 7bea2f0020f1c9135fa0e1189310dcf4bc29a47f
SHA512 82c9b5576be69773ce2bc5e58bbf3851225f0491536ca43326becda7b2f961e7368240be7a0c18fa0cb32fda61a532f4e796e032c5d6d51ef1ddf829db6af664
SSDEEP 48:c5NdGN+TCNey0N+gPWcV5+vAis/76jx2ZX19bres0hikF/k2gK17wFv9H+lkdG:a7G4C+H2jx2ZX15resA3aVK17wFVelp
TLSH
T11AE1520175F0AC1558270C3ED552394D3F61C6A24379BC98F6EE6F666B3298131A73F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

shared-commonSimpleTypes.xsd

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\local-agent-mode-sessions\skills-plugin\43988d34-ce1f-446d-ae4e-7ae3bede6904\3ee60964-c581-416b-aa28-c5c349530fe8\skills\docx.tmp.1785809953000\scripts\office\schemas\ISO-IEC29500-4_2016\shared-commonSimpleTypes.xsd
Size 6KB
SHA256 e2abacbb9a55ce1365f8961bc1b1395bbc811e512b111000d8c333f98458dece
MD5 365b2284f108314ea702ae73381430e7
SHA1 c533f4b352c765784b66d277eef5c6546b781c6f
SHA512 7cb414f5b2c481be30e6fae66cc68008ca0475a3ffc9b3f8afdc24030f19ca48f1684dbb012a0c928f7f8f81ba9d637569af2899802aa2d4f07443cd03260fb5
SSDEEP 192:a4CWrwBY/BRB9kMohZdOTgECFtpesavZ5:a4CWrwBY/BRB9kMohZdOTgECFtpesav3
TLSH
T1E7D16640B8F0FC5149DB681DD2A6106C7A7484F682385CACFEDDAF426F2183566F36B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

shared-customXmlDataProperties.xsd

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\local-agent-mode-sessions\skills-plugin\43988d34-ce1f-446d-ae4e-7ae3bede6904\3ee60964-c581-416b-aa28-c5c349530fe8\skills\docx.tmp.1785809953000\scripts\office\schemas\ISO-IEC29500-4_2016\shared-customXmlDataProperties.xsd
Size 1KB
SHA256 0ef4bb354ff44b923564c4ddbdda5987919d220225129ec94614a618ceafc281
MD5 f438dac055e2d2f17a4e49eef26927b2
SHA1 17648bc8d47645edcc5e897cd255c62e819b1587
SHA512 3fa543203f7ffb2070e16a7ccded37883e1254e098a44591e091578a03937a99f4bf479679df91fe9df3c9cd5692b31388b1291889991bfa6594affd5b7066f4
TLSH
T13E219D81E551CD268D07187CF6A23109BB60C0AA41F4AE61FCE89B5B6A54AC125277E7
MD5 SHA1 SHA512 TLSH

Submit Download

shared-customXmlSchemaProperties.xsd

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\local-agent-mode-sessions\skills-plugin\43988d34-ce1f-446d-ae4e-7ae3bede6904\3ee60964-c581-416b-aa28-c5c349530fe8\skills\docx.tmp.1785809953000\scripts\office\schemas\ISO-IEC29500-4_2016\shared-customXmlSchemaProperties.xsd
Size 880B
SHA256 0d103b99a4a8652f8871552a69d42d2a3760ac6a5e3ef02d979c4273257ff6a4
MD5 f8c1c3d7b94aa9bb3f64ccda5c397c61
SHA1 7b5d14b42625f15a9fd535e0efaa99ba701f92e4
SHA512 ccb835b1173fbf50149fdd891a6d9b595532e007d12b05fbfc5e2eab982135b637b23e69f4003f9e408e602a8f3fdc1e2c00968c354b549cb2fff5da3f4f666a
TLSH
T10E114889E090DD250DD704ECD2E0220D3A51E0EA23B5ED70F8F5AF9A26069C211663EF
MD5 SHA1 SHA512 TLSH

Submit Download

shared-documentPropertiesCustom.xsd

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\local-agent-mode-sessions\skills-plugin\43988d34-ce1f-446d-ae4e-7ae3bede6904\3ee60964-c581-416b-aa28-c5c349530fe8\skills\docx.tmp.1785809953000\scripts\office\schemas\ISO-IEC29500-4_2016\shared-documentPropertiesCustom.xsd
Size 2KB
SHA256 9c085407751b9061c1f996f6c39ce58451be22a8d334f09175f0e89e42736285
MD5 f1cc4cef27de0b9444ecf2b8e3f913b0
SHA1 39d1d6faacbce3e19b5a245ae745e350c6f8eba8
SHA512 ce70708e97f495f83663bd9159974ecbd794724de5a2a637a1ee4511b1178116b284ebeffc08533e461c751a1f44c74a8d212d05f50353ee068385404d8ff728
TLSH
T1A8519445B2A3A8154DAF087EF19621097F54C2D702B4FD12FEFE5FA95B21A8220177F2
MD5 SHA1 SHA512 TLSH

Submit Download

shared-documentPropertiesExtended.xsd

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\local-agent-mode-sessions\skills-plugin\43988d34-ce1f-446d-ae4e-7ae3bede6904\3ee60964-c581-416b-aa28-c5c349530fe8\skills\docx.tmp.1785809953000\scripts\office\schemas\ISO-IEC29500-4_2016\shared-documentPropertiesExtended.xsd
Size 3KB
SHA256 bc92e36ccd233722d4c5869bec71ddc7b12e2df56059942cce5a39065cc9c368
MD5 4a21906e8f4c407bd513bd78f0dd81e6
SHA1 863afe291fc482016090c1d6e944ec24cd400c79
SHA512 d099dadf5d9ae514ca493d93be98b413252a3175d6d0c37bde88bc38b0853f6f44ab44033eaff8f02ab09a871e996aca136e503c4a1c59e01b857d2e2f57e320
TLSH
T12571D246F192AE200A1A1C79E5E5370D7EE4D4F302E4ACA1B5FC9F7577616C228632F8
MD5 SHA1 SHA512 TLSH

Submit Download

shared-documentPropertiesVariantTypes.xsd

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\local-agent-mode-sessions\skills-plugin\43988d34-ce1f-446d-ae4e-7ae3bede6904\3ee60964-c581-416b-aa28-c5c349530fe8\skills\docx.tmp.1785809953000\scripts\office\schemas\ISO-IEC29500-4_2016\shared-documentPropertiesVariantTypes.xsd
Size 7KB
SHA256 7b5b7413e2c895b1e148e82e292a117d53c7ec65b0696c992edca57b61b4a74b
MD5 170d93029fd232e0a8fc2d6cbccf030c
SHA1 e9f1494bd451d6a588dcd961462cd7025de67a48
SHA512 8446b1480b4d909eed9c32c369b8c12d0b4307d4915f52fd88820447f01525bfae1c08444d05d684037fe2cf12e90d1666939375abcba5a8e7782ff72a705f01
SSDEEP 192:aAJnG4CAJ/lKLR+8N4K+U5XTB1G/qzQ3rLz8N4K0U5XbB12qz3L884cgfEuN4K+w:aA1G4CA5lKLR+8N4K+U5XTB1G/qzQ3rh
TLSH
T186F19D40B6E2AC1544AF1C3EE552245C7B64C1E30324BD46F6EDAFAA6F31D1172B32E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

shared-math.xsd

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\local-agent-mode-sessions\skills-plugin\43988d34-ce1f-446d-ae4e-7ae3bede6904\3ee60964-c581-416b-aa28-c5c349530fe8\skills\docx.tmp.1785809953000\scripts\office\schemas\ISO-IEC29500-4_2016\shared-math.xsd
Size 22KB
SHA256 3213ef1631606250f5010b42cad7ef716f7c59426367798e33c374c0ec391d3a
MD5 3b545bcc146f69dbe0272fe46c0182c5
SHA1 4166e9a07552d03ffd39352aa88811af2001da6c
SHA512 2ddf961c459d73cb517f6520382da6464e8cfe9c5472b49dbd4b1394a4878096d3fcceef50046d4af0a6abd2b650fc9e33d601b997b111e511e0e02a9d916b93
SSDEEP 384:amYlGlCUXqpoapExpvTTdmkMuvAY0kcCEzj9XX6:amYlGgUXqd0ZxxMuvAY0kcCEzj56
TLSH
T1A7A2B741B9A0BE25481B4C7EE6A2374D3B61C0F61368BD50F9EC7F566F21A4120B72F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

shared-relationshipReference.xsd

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\local-agent-mode-sessions\skills-plugin\43988d34-ce1f-446d-ae4e-7ae3bede6904\3ee60964-c581-416b-aa28-c5c349530fe8\skills\docx.tmp.1785809953000\scripts\office\schemas\ISO-IEC29500-4_2016\shared-relationshipReference.xsd
Size 1KB
SHA256 12264f3c03d738311cd9237d212f1c07479e70f0cbe1ae725d29b36539aef637
MD5 54ba24788b69cfb99c4f202c9fd25ba6
SHA1 56dfe36740cb7aff3309f83b49c638deceaafe1a
SHA512 7ed162c2fd6913e839da142eeef223b3d865790848a4afa827bf13927e29ced0f297830f3f631e9b5956c329b39d7b8121fe789220c7bf75058e9ed572bb5fcd
TLSH
T1922110879012DF17CD9345BED571351A76A0C9FC8396A864F4C4AAD3B149CC026A73DF
MD5 SHA1 SHA512 TLSH

Submit Download

sml.xsd

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\local-agent-mode-sessions\skills-plugin\43988d34-ce1f-446d-ae4e-7ae3bede6904\3ee60964-c581-416b-aa28-c5c349530fe8\skills\docx.tmp.1785809953000\scripts\office\schemas\ISO-IEC29500-4_2016\sml.xsd
Size 236KB
SHA256 beffeed56945c22a77440122c8bdc426f3fcbe7f3b12ea0976c770d1f8d54578
MD5 e749fe354be1efa4f5821f15e985bab7
SHA1 09b2d680921696a5846ca0a5c7ad6d088d8e0f52
SHA512 b4cbb8a79d2eb4a114ebbbe9ba37857bd45dd8f5449e658f9a7e89c1c2105c41f76adb5b9ae63e401190b85f379e397660718b252594a708a0f15f8aaf41b796
SSDEEP 3072:CYic1ijpGnkBh8PRROviXRGxEj53MoAiaXbeNEahrfseK6puijuydOjEJqcLwvz9:J5rmH
TLSH
T10234590274D0ED2A0C97187DC6D02A0C7BA4C2EA4369BDA0F5DCAFA66F1558065772FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vml-main.xsd

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\local-agent-mode-sessions\skills-plugin\43988d34-ce1f-446d-ae4e-7ae3bede6904\3ee60964-c581-416b-aa28-c5c349530fe8\skills\docx.tmp.1785809953000\scripts\office\schemas\ISO-IEC29500-4_2016\vml-main.xsd
Size 25KB
SHA256 f5ee623b08b6a66935e5aced2f5d8ad0fc71bf9e8e833cd490150c0fa94b8763
MD5 9500ba4c74862e2ab8e4f38aff1b535f
SHA1 3cdfe27a37cdb2fbd112e4ca528ecd9e39dbfa4d
SHA512 aa9f0a18e78ae01946e1094aca16ea835c5e7b0dbbe88a2472ddce82f6dfbae290ba0cc7161cd39c6f36e227194a51f51580f23a5546f2615c9450370fa9beb3
SSDEEP 768:dqsSG+P7fjWqKsgaCPbpvA8xqRTm17ScOrKn/SHVzq5gN/2cMpewFvvln7X1a7Jx:EsSG+PLKqMCe2NI/P/g/h/IxTyJxxxHl
TLSH
T1FAC2F412A0A1AE2A4CE718BDD190550D3F90C1DE43A8AD75F0DCAFD65F1AA41643B2FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vml-officeDrawing.xsd

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\local-agent-mode-sessions\skills-plugin\43988d34-ce1f-446d-ae4e-7ae3bede6904\3ee60964-c581-416b-aa28-c5c349530fe8\skills\docx.tmp.1785809953000\scripts\office\schemas\ISO-IEC29500-4_2016\vml-officeDrawing.xsd
Size 24KB
SHA256 585bedc1313b40888dcc544cb74cd939a105ee674f3b1d3aa1cc6d34f70ff155
MD5 eb5aff50cecf9539d125affdce694836
SHA1 24d34c4089251b55abf82361bb588f36da7e269e
SHA512 2e466b5a35112cb810fa8badb6f7c8a83655f0d31ed29fc57e4d8f17e3ac056f816794ba2cd61cc13944c4825f8e47579cff8ec90e68f801b64d1280279f4e43
SSDEEP 768:3uGFDk2X2XBrxOl5o62jDWb+x6PLhT1wDuOiq0IxUf:3uGFDOjDWb+x6PLhT1wDuOiq0IxUf
TLSH
T175B27F52A090ED2A4CE718BCC690580D3BA0C5E943696D74F4DCAFA76F1A481647B3FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vml-presentationDrawing.xsd

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\local-agent-mode-sessions\skills-plugin\43988d34-ce1f-446d-ae4e-7ae3bede6904\3ee60964-c581-416b-aa28-c5c349530fe8\skills\docx.tmp.1785809953000\scripts\office\schemas\ISO-IEC29500-4_2016\vml-presentationDrawing.xsd
Size 535B
SHA256 133c9f64a5c5d573b78d0a474122b22506d8eadb5e063f67cdbbb8fa2f161d0e
MD5 19289122ab70b90607d43e890340fe60
SHA1 bb3b9f27e23cd7d2b919cda02e44ddf5fbf2b688
SHA512 63397fbcc586d19445d20d71f284727e68769e6a9e091a74fbe595a920df08d8680cb0a2b243b7c48c7d2f7c7038abbaee3cb83cc00a1302a2e241f9d719e141
TLSH
T180F0E940E640CD179D0B986DE77165083F18D2FA4298EAA0FCC49F9A95676C068663EF
MD5 SHA1 SHA512 TLSH

Submit Download

vml-spreadsheetDrawing.xsd

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\local-agent-mode-sessions\skills-plugin\43988d34-ce1f-446d-ae4e-7ae3bede6904\3ee60964-c581-416b-aa28-c5c349530fe8\skills\docx.tmp.1785809953000\scripts\office\schemas\ISO-IEC29500-4_2016\vml-spreadsheetDrawing.xsd
Size 5KB
SHA256 6bdeb169c3717eb01108853bd9fc5a3750fb1fa5b82abbdd854d49855a40f519
MD5 be1017eb6877758f357e1a9433365460
SHA1 debb347068c1e9e9ff5dccd3b68914e36f306527
SHA512 6db1e45c31a15324dcc5059703d7f0e3b4225ecee4404d8c1d9faf547411da7c6c0bc3e400a40053831948ccad382ec7981fff1e473540da82ab3965a3f74ab4
SSDEEP 48:cSAGN+TTWsmN+g2FxVXBB67Fj8RCREUI0r2i2zzFx51uI:LAG4TzmmHB67d8UBXvwB
TLSH
T186C17944A1D0EC01157B1D7DE482785D7A64DAF20368BC58F1EDAEEBAB3184235B22FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vml-wordprocessingDrawing.xsd

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\local-agent-mode-sessions\skills-plugin\43988d34-ce1f-446d-ae4e-7ae3bede6904\3ee60964-c581-416b-aa28-c5c349530fe8\skills\docx.tmp.1785809953000\scripts\office\schemas\ISO-IEC29500-4_2016\vml-wordprocessingDrawing.xsd
Size 3KB
SHA256 475dcae1e7d1ea46232db6f8481040c15e53a52a3c256831d3df204212b0e831
MD5 846d8c1e1aed9453d57695511d53c9f9
SHA1 c7a9f32e1ce1b911c6ea22710a38bd973f06e525
SHA512 334cb29ef5550b9ecd17f924fe266508a3caaa34ea43ac593151ca98fdada2d3fef3084e7636db4f283c177d7ff758e9c786c6eb2cfb426bbaea8ea437b11efa
TLSH
T15181A780B9E0ED3544C7685ED192446C7B3489F683245C9CF9EDAF83AF2186862F71F6
MD5 SHA1 SHA512 TLSH

Submit Download

wml.xsd

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\local-agent-mode-sessions\skills-plugin\43988d34-ce1f-446d-ae4e-7ae3bede6904\3ee60964-c581-416b-aa28-c5c349530fe8\skills\docx.tmp.1785809953000\scripts\office\schemas\ISO-IEC29500-4_2016\wml.xsd
Size 167KB
SHA256 c2dd9f61f892deae6acd8d20771ea79b12018af25f3bf8d06639c8542d218cfd
MD5 b45ef5819b5a41db79f34f79ee15b686
SHA1 e9eb7a1a6a7255e28107c009265b2f02a440e6c4
SHA512 acb93b14a93f01a2d9d0b632eb3d2b2eb30494f4d30b048254daeb6b5b5c2949afd9982e0887622864824b3a14cc527f1749c16542e1fc621c99e0cc8d076e85
SSDEEP 3072:g09MoSrYAI8tKUWScC08HBVmsF92Q7G7vGRQlb3Oq1/BYrY7X8z6l66mZ+lmwpb6:CNpl
TLSH
T1E9F3384179E0EE2548570C7ED661370C3B65C1F24368ACA4F9ECBF926F21A4521B72FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xml.xsd

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\local-agent-mode-sessions\skills-plugin\43988d34-ce1f-446d-ae4e-7ae3bede6904\3ee60964-c581-416b-aa28-c5c349530fe8\skills\docx.tmp.1785809953000\scripts\office\schemas\ISO-IEC29500-4_2016\xml.xsd
Size 4KB
SHA256 a539aa2fb154fa50e0f5cc97e6ad7cbc66f8ec3e3746f61ec6a8b0d5d15ecdf2
MD5 155084e9211ec2f6585c58750d5dea74
SHA1 3f78fcc43409726ab647cd893e722d5bc9324edd
SHA512 144945e93703afc9dcde0bb03bf4fe11c793288d20d661e4b7c8ad05b7f3c23753616d5e90e6169aa57dace8ffa8e727b5bc9f6ab80bc9f48426b28479977e02
SSDEEP 96:4fWOxWqDWzVfYiYbv9arUA7E470OufQnxzOUOLOW:4fNbaBY9bkrxR77ufQnxzdqB
TLSH
T1EDA162DA5A40D3BB6F4340322439768997A0C0AF63B26656F8CC44768F05D14637BFAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

opc-contentTypes.xsd

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\local-agent-mode-sessions\skills-plugin\43988d34-ce1f-446d-ae4e-7ae3bede6904\3ee60964-c581-416b-aa28-c5c349530fe8\skills\docx.tmp.1785809953000\scripts\office\schemas\ecma\fouth-edition\opc-contentTypes.xsd
Size 1KB
SHA256 9e0b7209fc69ab11987900404540969976000c5ebe4d4f58c43dc3842886bf3a
MD5 3588c10c3d23c1d481143daad438a70a
SHA1 0361ade426d61a07960f3321f69316646a8d3dad
SHA512 c07c7b6919349a3b46c302b77572d058bcc4cd53e27e9bf25615b37bb80552340d45675bc59ef96e87e0ff39d445a5c990987b6106bf5d0712115ee4fe2977c3
TLSH
T1A841EDC4B955CE55092F19F58920760C0AA3E5B70A50BB90F0D8C376C7A01C059FB3FE
MD5 SHA1 SHA512 TLSH

Submit Download

opc-coreProperties.xsd

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\local-agent-mode-sessions\skills-plugin\43988d34-ce1f-446d-ae4e-7ae3bede6904\3ee60964-c581-416b-aa28-c5c349530fe8\skills\docx.tmp.1785809953000\scripts\office\schemas\ecma\fouth-edition\opc-coreProperties.xsd
Size 2KB
SHA256 451958454e8588dfc7cd945981ada142ca06ff3307937f5700df059c2b307fa8
MD5 3d7f4e1f6e7533c4160eefca2b94cc8d
SHA1 5f93259fe2fc4dd1a097ba3ac968144e62cc828e
SHA512 cd2a293ca00f1093d7d2445c6fcb11a409f536c40c6c2ff34d87656dcf93d8226f3eef08c290e7ab1cc4e97806030ffe8299e4b90d61ffd30deb201d943b54bb
TLSH
T182514BC670D2CE100B06993169F2730D7AD6E5B703E46DA2F5D88EB2BB517C128672B5
MD5 SHA1 SHA512 TLSH

Submit Download

opc-digSig.xsd

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\local-agent-mode-sessions\skills-plugin\43988d34-ce1f-446d-ae4e-7ae3bede6904\3ee60964-c581-416b-aa28-c5c349530fe8\skills\docx.tmp.1785809953000\scripts\office\schemas\ecma\fouth-edition\opc-digSig.xsd
Size 2KB
SHA256 6de111e11403f7cd49027400755bae0ea1cabef2815f09bd40a24f0017613b24
MD5 d54f856ce4494f809534b6915a346d74
SHA1 a99fe4663cba1a762512755dad8850d320373c4d
SHA512 3a87923fec56ea853a682a1280a2a3c7426b715fabc172ac22f4abc19704f66e12f09178438c9292a97ea1efbb834538f609858a754a9961a7c0a0bebf33f5cd
TLSH
T147516940DEB9CD6F0A1F0E38E15625193BA2F7E2F65C980CFDDF4A488721AC0055A3E5
MD5 SHA1 SHA512 TLSH

Submit Download

opc-relationships.xsd

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\local-agent-mode-sessions\skills-plugin\43988d34-ce1f-446d-ae4e-7ae3bede6904\3ee60964-c581-416b-aa28-c5c349530fe8\skills\docx.tmp.1785809953000\scripts\office\schemas\ecma\fouth-edition\opc-relationships.xsd
Size 1KB
SHA256 f565adfef5a502044abc3a9153e157edc25af78304d335994afb958874b15e26
MD5 814494fe88be0d0d338fb2e6aaa191cf
SHA1 ff674e6e94aaf9f7cfa63863d1bd0a1b9839bc6c
SHA512 3f2fb80c9528b6c8ec4d10bb63645b32c03a9ea2ceb81d573157b91f4b76c734d9a6080b6ad38b5a959b0a0ac15316298b33a49fa938d76a2e90ecda3aea70e9
TLSH
T123218BC0A0E0DE168C5B067DC1B2240D3E74C4F60376AD64F8EC6B562B6898221777EA
MD5 SHA1 SHA512 TLSH

Submit Download

mc.xsd

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\local-agent-mode-sessions\skills-plugin\43988d34-ce1f-446d-ae4e-7ae3bede6904\3ee60964-c581-416b-aa28-c5c349530fe8\skills\docx.tmp.1785809953000\scripts\office\schemas\mce\mc.xsd
Size 3KB
SHA256 3a37e461ecf5a8670fdec34029703401f8728ab9c96ec1739a6ae58d55212413
MD5 7afc4d2311ae2e584cfbd258d10070dd
SHA1 f6a8b649478d0cbad46521fce8e465564742cb8b
SHA512 99da3af897fd2b1a14ee56f56e841f15086230e031643caaa7536b146a495005631635bb3d18d913b4539a61b0bea50bc157be5cf0c8d8895f9297dfa8bc15bf
TLSH
T1F6510062A08D6E2E0D4B8179E0D17A0B37EED83911B4E870F4FFD57D2785E400275A97
MD5 SHA1 SHA512 TLSH

Submit Download

wml-2010.xsd

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\local-agent-mode-sessions\skills-plugin\43988d34-ce1f-446d-ae4e-7ae3bede6904\3ee60964-c581-416b-aa28-c5c349530fe8\skills\docx.tmp.1785809953000\scripts\office\schemas\microsoft\wml-2010.xsd
Size 25KB
SHA256 568b26ee156cb9549aa439ca2158965f77b7c1602b7e0316f40ac6cf586e35f2
MD5 acfab864f1b78eec5fd9e188c17845a8
SHA1 9dae98f78b071111322f78c6060ee1332e97ec05
SHA512 3bd4252fd396b4ac2921c59da29298e19d31f98183536eaa286d73dad300e03d26dcc8c3fc243a73c5944b32672de665bed8fb2b2723c439474bb70e24eca9ca
SSDEEP 768:BsDvGapjgSDhyDeK/J7iEXpsQaYJRkOOleq0rtl:BsDvGapjgSDhyDeK/J7iEROleTrtl
TLSH
T110C2398128F0BD2508871C6ED1A5115C3F74C4E74338AD98F9ECAF926F2295926B72F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wml-2012.xsd

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\local-agent-mode-sessions\skills-plugin\43988d34-ce1f-446d-ae4e-7ae3bede6904\3ee60964-c581-416b-aa28-c5c349530fe8\skills\docx.tmp.1785809953000\scripts\office\schemas\microsoft\wml-2012.xsd
Size 3KB
SHA256 0fa75578a000439a7988ba0c59fdc69f774bbd416cbacc14d07125b3f686cb74
MD5 e1fdf7c48cedcb8243032f5dd378a7ba
SHA1 4bae12500e750e8d264b03a39522a62c252e7911
SHA512 6d4bb7287f71bc13ca22908aedd01941c43b01957cfefbe7a7b769db76e8e43a260d009c1b5e8ef635185667e23f8213b10d57c29eb16de551de8a5609aeba08
TLSH
T17A715D81F9E0ED1A08670C3DE6A235093770C0B653B4AD64F8EC6B566F15E8134A77EE
MD5 SHA1 SHA512 TLSH

Submit Download

wml-2018.xsd

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\local-agent-mode-sessions\skills-plugin\43988d34-ce1f-446d-ae4e-7ae3bede6904\3ee60964-c581-416b-aa28-c5c349530fe8\skills\docx.tmp.1785809953000\scripts\office\schemas\microsoft\wml-2018.xsd
Size 901B
SHA256 be0ff793a22dd31384650c3a4da14c2fa8062751c2e97b0e5ee852bda13c60ad
MD5 df23463f49c4dede202dd83df2ac3355
SHA1 fc5f36a58d66a171c81fc3e89243ceec1fe1def9
SHA512 4bd22c45ce11e296284350f4b4a4b31b137aa1f315820c045ad4c803b94a1c7e711c84a797b33c007d3a8b0e6c1d813987f426e08bc89c57d050df959b39dcda
TLSH
T1EA1159C9E5A5DD060A57842DF6E072023B7080EB62F4EE61F8ECDB495B45B8530523DA
MD5 SHA1 SHA512 TLSH

Submit Download

wml-cex-2018.xsd

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\local-agent-mode-sessions\skills-plugin\43988d34-ce1f-446d-ae4e-7ae3bede6904\3ee60964-c581-416b-aa28-c5c349530fe8\skills\docx.tmp.1785809953000\scripts\office\schemas\microsoft\wml-cex-2018.xsd
Size 1KB
SHA256 fddc2b880cabb9005aebbc7e783e53c19fec1c03df7d0e2f2076a33a0fdfd081
MD5 e9b9f117544076d86945962217ef2d68
SHA1 b36dcb8b3c4e5d84bca660bf5d95d5645f5ffdab
SHA512 34765aa3fca3a41da51599f1988a33fc763e434a3db198ad24eda4a1aca103f529f0224220c66e7059d6a63db1dac35ad24d19ae94a38b8bca04aa3a3c5a0dd0
TLSH
T1AE31E0C2D4A4CC120E03947DFAE172023BB080EB02E4AD35F4ED8B596B10FC130A67EA
MD5 SHA1 SHA512 TLSH

Submit Download

wml-cid-2016.xsd

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\local-agent-mode-sessions\skills-plugin\43988d34-ce1f-446d-ae4e-7ae3bede6904\3ee60964-c581-416b-aa28-c5c349530fe8\skills\docx.tmp.1785809953000\scripts\office\schemas\microsoft\wml-cid-2016.xsd
Size 1002B
SHA256 127ca209fa73d7cb708449cb355c871867948a96e4a74f7bf5811ef62d17991d
MD5 0ad82bc5ef974b934ade6f13109b2eb4
SHA1 6e9463abd265d28d84930d057485dcfed30944f3
SHA512 bef9ee43bf3fb9386f91f20ba0be6297d07d21bbb7243358ec4f6e7b82d174e75200055c9196f7c95a32564a23bfbaca93487bda17271fe7b55542a2479bb80b
TLSH
T1BD11ABC0A4D0CD1A0A02587EF6A172063AB0C0AB43E49E75F8EC97169E45F8130A67DE
MD5 SHA1 SHA512 TLSH

Submit Download

wml-sdtdatahash-2020.xsd

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\local-agent-mode-sessions\skills-plugin\43988d34-ce1f-446d-ae4e-7ae3bede6904\3ee60964-c581-416b-aa28-c5c349530fe8\skills\docx.tmp.1785809953000\scripts\office\schemas\microsoft\wml-sdtdatahash-2020.xsd
Size 600B
SHA256 842e7163409c8d74f4d7088a8bc99500d80bc75332681a0980055b08f374a604
MD5 cca381151fe57ef96c929b1239122028
SHA1 ef4714320170e9eba080298ac250ad3094752d1f
SHA512 cbbf388e4b0569a97af28a2d4b97ce6cc749de8fd2656a397f77cf31c5203c3107bdcdb853c9594249a77bba4e205c60cc8c3a1592f7b4c7f9cf0526de68bc46
TLSH
T116F04CC9D095C9610B539969F5E2B102793094EF57F48973F4D0CA4EA0449E9349A3CF
MD5 SHA1 SHA512 TLSH

Submit Download

wml-symex-2015.xsd

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\local-agent-mode-sessions\skills-plugin\43988d34-ce1f-446d-ae4e-7ae3bede6904\3ee60964-c581-416b-aa28-c5c349530fe8\skills\docx.tmp.1785809953000\scripts\office\schemas\microsoft\wml-symex-2015.xsd
Size 745B
SHA256 16f6f8072249f431370723c2cd8974672e0d9c897e00e97dd918079df934871b
MD5 61334714fbd66b85ef04466301795ee0
SHA1 87bceb1091ef7825ab674713aa8f7c13f8b2268e
SHA512 8b1297218fd5ff5355969b57e0fcc2b3eb40a29eac2b66318ba4edee3da97e91a6e010ef7c9cb116d0655db8c116aefb0eb5ce95a77714006866a487123e07ff
TLSH
T1130164C4D490CD250E53882DF6E6B1067A30C0AF02E88AB2F9D4DB4AA945AD130867CF
MD5 SHA1 SHA512 TLSH

Submit Download

soffice.py

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\local-agent-mode-sessions\skills-plugin\43988d34-ce1f-446d-ae4e-7ae3bede6904\3ee60964-c581-416b-aa28-c5c349530fe8\skills\docx.tmp.1785809953000\scripts\office\soffice.py
Size 5KB
SHA256 df2c8d7249c132a4512d744482e4b5ed0ecbe885f0bcfb1295e7e6a7ced0432c
MD5 2508a6df584f00149374b00c25b0b820
SHA1 623cfa7c71b744d2685f7bebe417516d0f51b5d8
SHA512 f786c9a1c54a0029c51febf918ec5bf0a2b618db872b9109f40755fc10c7e820661656c691c718f1265cd947c0d0a94899b396d0749a7828efae6e0cde546f02
SSDEEP 96:UebIMLVxUH8dG9RSrOUKE1RKpOAtPkQQc2Eo+/tBsCsSQoYhRQah/QjwpjqF6fTx:tbIMb9qRS6UKE1RKp9PkQQc2E4CsSQB9
TLSH
T145C12261DCB7B25142F3D33E56966012F568D45B1384E468FC2ECAA02F9313493FEB89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

validate.py

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\local-agent-mode-sessions\skills-plugin\43988d34-ce1f-446d-ae4e-7ae3bede6904\3ee60964-c581-416b-aa28-c5c349530fe8\skills\docx.tmp.1785809953000\scripts\office\validate.py
Size 5KB
SHA256 346a4c89d92fff55e610f11efda48c30228815b29bdb10b987e48f7af70acf1e
MD5 5e0197ec92ed657f8fb6c8df2f566cb1
SHA1 9b4a36b6b0d85d1e60d2eb4817af2d0c27cd828c
SHA512 6be3d028d73dfe904e80fe2ca39a2478327668d48ec83bf5ea6c98792871d610f28d6f43db846127d15b2e264bb8f97ea111f51b2e5df7ca83c88dc41e8b3c2e
SSDEEP 96:ePwqGV59b+nqfM1+Xc4soB8C4abzXT1GXYAGueGaiLgndBfJcZZ2Gi:28f0qfMMXbjB8vabzXcGurLgdBfJcZY7
TLSH
T194C1641B9AC814419FB382ADBEB5EC11672518A30D427A7DB1ED83943F90A75C2F35EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__init__.py

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\local-agent-mode-sessions\skills-plugin\43988d34-ce1f-446d-ae4e-7ae3bede6904\3ee60964-c581-416b-aa28-c5c349530fe8\skills\docx.tmp.1785809953000\scripts\office\validators\__init__.py
Size 336B
SHA256 83e0f035c5abea238d3f2c3968afbd511ed022b527b7c9cb60a9434cc34ff987
MD5 9577920dc811fff9762a96d4095d95e5
SHA1 f3b82b83cd17a455c92544d6391dbbd9e1666395
SHA512 3a8a9f08be8ad12af6238ff179fbe3b23813f08e3a513d33a09a54dc64a52ab2f7261560daa7bfd057e05c2e5831c1dba54043fa73654a765170e4b875176ce0
TLSH
T138E0BF5988366B610DB561FCB122D2961EFF24231E102227F2F543640B847D78B2600C
MD5 SHA1 SHA512 TLSH

Submit Download

base.py

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\local-agent-mode-sessions\skills-plugin\43988d34-ce1f-446d-ae4e-7ae3bede6904\3ee60964-c581-416b-aa28-c5c349530fe8\skills\docx.tmp.1785809953000\scripts\office\validators\base.py
Size 32KB
SHA256 f818ea28c793ba42960fa4498265e2632a62c86f7b5d6aff6fa89dacc02d59ea
MD5 566ce69ba91ff1d61520755ced89a831
SHA1 0ffbb5d197ed18420d405adf97210d512f0d13d9
SHA512 66f8080355571ca226671fc2f97b431fdb5286e1efb7cd82a5cde58b7760fdc1f3c5a31cdac09b2be35f945ecc0b951ea0f420cde588612072665d4503ec7631
SSDEEP 768:e51kGxu5qzs0pqCDOR7qjEnKY1kalKuIAeqjBs+T7U9z9:e51kGxu5qzs0pqCDOR7q4nEdRAfjBs+A
TLSH
T14FE27210DCC55C629BA3C9ADACD3B4037315AC5704282A35BDEC126C6F94A29C6F6FED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

docx.py

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\local-agent-mode-sessions\skills-plugin\43988d34-ce1f-446d-ae4e-7ae3bede6904\3ee60964-c581-416b-aa28-c5c349530fe8\skills\docx.tmp.1785809953000\scripts\office\validators\docx.py
Size 17KB
SHA256 93d3444c0ef3f043d21a2285c46d2cda478426b930dc33dcf3b11265935517b5
MD5 31bad7fef700e94115212e67836cbc6d
SHA1 66d1b5f5e9dbd9fc5e468b24e2c73741eef019e1
SHA512 1add14063220f63442552f4b4bf59025e88fec9dc29f294cf8cb9e27b0b373d5813f7872b71a79ed27bcd8d9687668f669f186ce45ba1067bb811e44bbe9ecfc
SSDEEP 192:8b6baVaCAs8vTPfKpBv3tHE/bpqNau1avJwOvHMH23yi8C686MWlvasSStd38Urr:8b6binwfKvtHWb8au1CwRNSStp
TLSH
T1AE723D219CD45C26EBB3C1AD6CD3F14376682E1714083A39BEEC125CAF90E2191F6D9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pptx.py

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\local-agent-mode-sessions\skills-plugin\43988d34-ce1f-446d-ae4e-7ae3bede6904\3ee60964-c581-416b-aa28-c5c349530fe8\skills\docx.tmp.1785809953000\scripts\office\validators\pptx.py
Size 15KB
SHA256 17eadad2b7a8374ccbe4cda45693bcd6a36f9d61a7d60f9c9ceef9464dec8299
MD5 6363b327129c220296309b4c8fceec4d
SHA1 1de2ced60604f4327b3457a2ae0296f52357c721
SHA512 af7dd4db2552596c094c3869f7964573bd81ea86d05fa9669edb33896093ebecfc30ef747638a196d3292dc6c2a68c9332d79945b333891e363f8caa28ecaa27
SSDEEP 192:8IQb+NaYsYKNEoRSmke++uS4PH8NqIbrU6Jc6Z5beVb8Djrr:8IQb+8pYKbRSmke++uA51dZb/X
TLSH
T15A622301AC515C52CFB39EBD9CD3E50367EAAC17085C3134B9ED22242FA0F1497B6EA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redlining.py

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\local-agent-mode-sessions\skills-plugin\43988d34-ce1f-446d-ae4e-7ae3bede6904\3ee60964-c581-416b-aa28-c5c349530fe8\skills\docx.tmp.1785809953000\scripts\office\validators\redlining.py
Size 12KB
SHA256 2c4edbfdd57d243b580f61c5b1e8981e3fc3bd0a4d7e6abc33c966101746f1f5
MD5 35d1d6ba8530e04ee5bae099ee8db7da
SHA1 535fc391242ff68df275a92bb0161cc16193f5dd
SHA512 6ae4bb9971d8a45c6a8431a77c68909e88efb2932e2b0dff04d478696383a404ef35e28e2916d6d137b90248d5aa0f432aab328a3028b03321ec8dff5cba82b3
SSDEEP 192:8MiPPxSLNzXYJQGSSy4mEcZ4hQWBfh9pU8r18/fIw/uo150Gn2ytr:8MMxSLNXYKYy4LhVhDUm1Lw2o/0Ghl
TLSH
T170428325D859ACA0E3E3852E4193A403B72E19576D0DB874BBED91DC3F8521DC2E9DCC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE.txt

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\local-agent-mode-sessions\skills-plugin\43988d34-ce1f-446d-ae4e-7ae3bede6904\3ee60964-c581-416b-aa28-c5c349530fe8\skills\xlsx.tmp.1785809952889\LICENSE.txt
Size 1KB
SHA256 79f6d8f5b427252fa3b1c11ecdbdb6bf610b944f7530b4de78f770f38741cfaa
MD5 f8515c3694eb11622110ca76c7c15d1b
SHA1 33b3a5817279c18cbdc4143e3b71ed33d728ca06
SHA512 712cf9abc446e1891d691593751b4a5ba14bed49a5062504ad5aa187d2f2a405bf5826032f060d95219113bed3f72a256ebf8f74dbff21aa32d968ce16aa02b7
TLSH
T1A831CB10E35B03B28AC005512A7302C7E778E56B09AB60D3A1A8406C71D3D38D53A639
MD5 SHA1 SHA512 TLSH

Submit Download

scope_v3.json

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\sentry\scope_v3.json
Size 7KB
SHA256 358cca4d444c23844005e2f3197107d0db52b22460ed7e4d39d59ea6797178e9
MD5 3dafee3b497e87d8c97c7749073227dc
SHA1 b5c639f3aeec251f07b765c637338e0d1419d7f4
SHA512 660764b91b21f472a41207cb3891b1e346a94aca6ccfcb7a88b10cc86f0b2a39368f3d4b7f5d0bc5425261fcc4ec62ec2855eac1b555940c6b04b140a0020389
SSDEEP 96:+0+Pz/BlEh6979V4WWNSEWIZqgSEMQ2TWWKSEWI2/QKIvKBHmq+BTE38mK8C:3WiSEWIZzSEMfWVSEWI/YMNJ
TLSH
T184E173721E6C8CBD0F85A38E74C63D8EC67967C289C52C831C25DD3CE99A256680D32E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

session.json

Path C:\Users\Admin\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\sentry\session.json
Size 266B
SHA256 545d86ffd57d05287133785921cecfe735f58880f17480175949d501c41feaf1
MD5 9e1ffa2217cf911decb0dbd277f94915
SHA1 d5cce24ca92e038c890aa31538aa2485ad704e52
SHA512 bb0245c301b1d89d7f0ebbdc15bbe4600ffedb8bb8b1f754bf35d37d16462162d7815d712d6bb329c789380be26321ce7c3fa7d69c5e8ea842a7d7b7b3affe95
TLSH
T1ECD095D285C75022E54310D74D06A541393E2E612C294CC9F87F4D1C4D13340773727D
MD5 SHA1 SHA512 TLSH

Submit Download

APPX.4qvc8pbizc72n6nxm9h_lqqqf.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX.4qvc8pbizc72n6nxm9h_lqqqf.tmp
Size 10KB
SHA256 52f4215c308d24a7bd8ee4a11ce3db4adffbdb4e2855a816197c2b183731b9c3
MD5 c56cf8944d897b65d7b8ab83cd0d79d6
SHA1 773e3f51465a79f9ed366b1c68cd07d9a0e9c41b
SHA512 ce38fef0f176bd54b58603c7c88b65eb495fad915a56ccb1628295ebd20a1b0bbc298fc0da5bc6c3f5767db9a42f3437f43662103ec22bd9709e7fe43dd255dc
SSDEEP 192:MrNyEIYiYF80dmL4pUQaULc8pq8RuX5hz28uNNTPKTWi7pAqsw:MrNyEIYi2mL4/y8RKE7ZoLv
TLSH
T1B8223BA389906C05EE279D50B0D8A936EEB2B2C62DD0C1D2711DC226C7953863BDD2FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

APPX.bg59qbdu8wrksk7elp4en59ig.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX.bg59qbdu8wrksk7elp4en59ig.tmp
Size 7KB
SHA256 e84fdf636741f0ded5d3c6f74df78b9af3e5cab341edfb30f6aef4ab99cb246b
MD5 16fc67eb1dc0cc89c77b7765ddd59afa
SHA1 d78266e4ab6acb5ca1f5cab7660f8e8f05096bfa
SHA512 388e6a2963803df689e30e8b91123ff54cdb3d8654ac75b4309c5535ee035e991428d1c0ceb1f7b332418489b3e700b93f5c4655d832b0b43d9577d48c930f0a
SSDEEP 192:rJG1F4Ra8brotDMq6LYYcwmbTYp+bkk6W+Gkk63:rJG1F4Ra8brotDMTLY/wJ+bkk6W+Gkku
TLSH
T1B2F1F24BD4AD185046B2E1AAEF13D685EB2C099758DE00C0BCDD56532FB265F033BB9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

APPX.e9n9wjpy5cr1s2gldlhga2t6g.tmp

Path C:\Users\Admin\AppData\Local\Temp\APPX.e9n9wjpy5cr1s2gldlhga2t6g.tmp
Size 1007KB
SHA256 a164acc248b0cac6a47952585e72482807c81c9b8471f2026ed4074ac54a921a
MD5 26f7ff4c9f97ca9cb670d918b14574a4
SHA1 27a5bcb4c11106efc19bf970c448c3d5742fa68e
SHA512 9786bcd5dc7f8ff2c076dae682872ec715687e39687c3235c05d023524847d7d13b5c3e4664fc57a6f1d445d0a9015b4f9e646cbe7ab0fcbd3c204e658d8019e
SSDEEP 12288:Sqkhv7aVcZ50DCv8z4GyMlosdv3r16iSUZlZ3Vd1FwHe71mT+9RG1:C9mDDCv8z7yMV93h/SUBL1ie7D/I
TLSH
T15925B5E1513DBE36816D0AAD8F24F5042C35883653376E0E9C6EA2B318BF9725F674E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ClaudeSetup.log

Path C:\Users\Admin\AppData\Local\Temp\ClaudeSetup.log
Size 3KB
SHA256 8695d1a55f5318f4de54e4f4e010d24d53499c441efa9c11239a2120936072ef
MD5 e4b924639fb511030f5a7a610e7216de
SHA1 60ac143a9db6ff9cc6c30128e4787dce83a0af92
SHA512 491ca36144a76aad2590ac3f10fda0339dd924d3f4e58e52d44e1f2b58e86ca41c7ded2795b2c4c94daca370c0a4f20a34dacfc3144a4e494b661b83af626f0f
TLSH
T12B71B861856BA4F40A94C44FF63A8302618F388EBD3DC8A874F41A18D05632DBF59EDF
MD5 SHA1 SHA512 TLSH

Submit Download

download-docx---jLQEJR1OWj.zip

Path C:\Users\Admin\AppData\Local\Temp\download-docx---jLQEJR1OWj.zip
Size 157KB
SHA256 20fcc201ed19c675db621f2aae937e5f8bf15dabc93b593a7944d9e18630196f
MD5 b0280244df7e0098367f0e92af1ba5ba
SHA1 8bff5bc3ac845c4daccdac7964b4bf8e12b0f4cb
SHA512 d6b0e40904dfe923ce1fb12b2b5cdc7fd241606bb2db82492d4978e4c9e073774c27c6c79e8a369910b70b0e489cac2fead53c30b95ad4fb1283d9fe45be69b6
SSDEEP 3072:5C//TjzshqyZLhBneA05NNtMFNBgT9G6T2NV7CknWbn+UHs/R4jxGoXmNj6TMbp:k/P4hhoTiFfWk6TSCknvUM/R4jxdZMbp
TLSH
T1F9F302235E5FF930DF979B7AA8F1600486C84841A574E53E854B66863CAFEACB37C05C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

download-morning-ReB_NRFdcWwn.zip

Path C:\Users\Admin\AppData\Local\Temp\download-morning-ReB_NRFdcWwn.zip
Size 26KB
SHA256 96d6df38e11cf3924136a30d4a3fa626e9ecaa6377deabdbbe59a50a4fc55b02
MD5 d866b713473346ca4326dba738498b5a
SHA1 d3e813b9eebf55aae790f8d43023aeb360fd7432
SHA512 ebafc3f7a879f8fba40c53bd837f0de5ae2391b71414a97f953cc35b11e66fda443bfb26f0fa831e3fec6cd5c0b1b737d7dd14b4b4a9e0aa65ea7c3b5f3628f7
SSDEEP 768:xzmDiJtlQjz2l2e8aoyFE9LUOrhArxPSTtI6:uiujzSJoyJOsFSxI6
TLSH
T192C2D06F7FD72C84C990397D89851C2EC26596323D412B68C1FCDBDD0A6B39188E89BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

download-pdf-fYaXZuuVve3s.zip

Path C:\Users\Admin\AppData\Local\Temp\download-pdf-fYaXZuuVve3s.zip
Size 21KB
SHA256 08030aeabbe2d511def549fde5df02950914305b6610096b2d6250233dbee725
MD5 30895a98f0845d9471639198db5265ca
SHA1 085e6ac74986775211776ca8bc481c2862126123
SHA512 d9702408493ce92ab28feb285b8a1f217a0b4af7174a664d91e9ab10e820e4792dda0491604033cc67053ff2dcb8edb1ff2b5b45c62570a0d0c24951b917fc48
SSDEEP 384:zxVVs9u79PuJXUtprrKyhauBLqzB7alEE1xnKgLkx8j9ktu26BmsKI3:m9u79IIcywuZqzB7gJnKgLFjmtuKsKI3
TLSH
T17CA2D0109E1AE259C9A5D63BF0F3F60B416F595EB037988E9D25DA84F077AC1026B8F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

download-pptx-yBbLbd0XBzin.zip

Path C:\Users\Admin\AppData\Local\Temp\download-pptx-yBbLbd0XBzin.zip
Size 162KB
SHA256 0cce6f9124a26adabb0b57a5c4958dbd68fa56433597e5e72b37205eee82a9b6
MD5 c14dbb6687c89ebcc2ce86facb3d18fe
SHA1 bf133abf24b8fb0f9bf4958655bd688af890e3bb
SHA512 9dfc56bc20a81dd04f88f6e59e679807c5ceafe6d5a202c630fc998b05ebab16d87d930bfd52f51f14253ed31b33547be301d51a3e8bd0b305430b70cf9c3631
SSDEEP 3072:oYCIiuTshvOZLwgneA0ONNdMFNBgT9G6T2v7p4kBWbFoUHsjRijxGoXINV6HMPY:oY2uHhwvEyFfWk6TI4kB7UMjRijxd5Mw
TLSH
T13DF301235E5EE930EFE65BBDF9F2E00454D6C446A875E13F85928602286FE8CB27407C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

download-skill-creator-dU6r3hmdMmhB.zip

Path C:\Users\Admin\AppData\Local\Temp\download-skill-creator-dU6r3hmdMmhB.zip
Size 72KB
SHA256 61c763dc5725e8ae315e09a90d7d278d68761e67746a15d13fd301c486f66850
MD5 eb5615d82d0934b44122fe0548626220
SHA1 11fd8484ee826a01211a9e564773eb42fe5aeba8
SHA512 7df745cfef6ca71b0aaa0735719ff009a8a11da5bdaaa0bfb2dcc0f0f851e1d0ff257faf69fa04ab61c655522dda878e177ff1fbb4bbe8b040adb729a54f0931
SSDEEP 1536:E17wUP7PdkV4q8VZS/4+Rc6RMnJGIxUqrW3zNir1C/Z:E18sZkz4+PMnJGIxUNUrk
TLSH
T101730231D262CD00C5DAF331B6F48D6BEF9E052868B1EE23E449F106B4752CCAF5A625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

download-xlsx-8Y1dLszYoPkM.zip

Path C:\Users\Admin\AppData\Local\Temp\download-xlsx-8Y1dLszYoPkM.zip
Size 150KB
SHA256 85d82b60d6a194656c7f0561bcbb30ba0b13ac3efdcee2bb8eb307293492f0e1
MD5 ac547adbb2bcc147eee9ee9db776abd5
SHA1 c229923f66b700d287e41cda4b0493b29916e68b
SHA512 13ef272b1bd0c5ed32d855767cbee4f75d018c7be2ac292f199a6e65707de24b0e86e8effb56aac3dbf7618783a9e1602030e12fabc8faeac0405e55baa7badd
SSDEEP 3072:7G7IshsKZLn3neA0fNNdMFNBgT9G6T23npQkdWbJ4UHsbRqjxGoXcNZ6LM7e:GzhnO5SFfWk6TEQkdnUMbRqjxdFM7e
TLSH
T1D8E3F1231F5EDC30DF9BABF9D9B3657446C0C486A674F23A85521806189FE8CBAB417C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/2332-244-0x000001D54BCD0000-0x000001D54BD00000-memory.dmp

Download

memory/4212-2276-0x0000017DF6200000-0x0000017DF6230000-memory.dmp

Download

memory/4212-106-0x00007FFC40BA0000-0x00007FFC40BA1000-memory.dmp

Download

memory/4212-107-0x00007FFC41130000-0x00007FFC41131000-memory.dmp

Download

memory/4464-2295-0x0000017C7A840000-0x0000017C7ACD1000-memory.dmp

Download

memory/4472-2294-0x0000025670AD0000-0x0000025670B00000-memory.dmp

Download

memory/5220-2289-0x00000113DD520000-0x00000113DD550000-memory.dmp

Download

memory/6876-3041-0x0000016551990000-0x0000016551991000-memory.dmp

Download

memory/6876-3042-0x0000016551990000-0x0000016551991000-memory.dmp

Download

memory/6876-3043-0x0000016551990000-0x0000016551991000-memory.dmp

Download

memory/6876-3044-0x0000016551990000-0x0000016551991000-memory.dmp

Download

memory/6876-3045-0x0000016551990000-0x0000016551991000-memory.dmp

Download

memory/6876-3033-0x0000016551990000-0x0000016551991000-memory.dmp

Download

memory/6876-3034-0x0000016551990000-0x0000016551991000-memory.dmp

Download

memory/6876-3040-0x0000016551990000-0x0000016551991000-memory.dmp

Download

memory/6876-3035-0x0000016551990000-0x0000016551991000-memory.dmp

Download

memory/6876-3039-0x0000016551990000-0x0000016551991000-memory.dmp

Download