6527418873675308dd93fca64d6c17175a54ed00684a26be11e2dc6224eba7fb

Analysis

max time kernel
149s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 04:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_1eee39855e2a91e21af0c61d62b46020_glassworm_icedid.exe
Size 1018KB
Sample260930-e9sccseg84
SHA256 6527418873675308dd93fca64d6c17175a54ed00684a26be11e2dc6224eba7fb
MD5 1eee39855e2a91e21af0c61d62b46020
SHA1 55d23a65c8dcecc06b351b4d65ecf2690d2a34f7
SHA512 279d7d69df7a050ef7fb0e62c27fd553cada6c5fcfaf4690162718d1b821ee6555a79ac548ff49df7519f6d6908ddfa32fad5c6c9e3bec510770177d3abc7ad6
SSDEEP 12288:78e+aJ4dCXzRKX4EcJupbSRi461R1VcrP3224c+iKmDRkRFNBMUFeA+imQ269pR/:7caJ4dCXzRKX4EcJAD1RrQz
TLSH
T17525701123E9421AF5F36B79D97502709BB6BE967A38C2CE069474BD0D72BC4C9A0337
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3476	RemoteAssist.exe
2752	RemoteAssist.exe
1060	RemoteAssist.exe

Loads dropped DLL 2 IoCs

pid	Process
2752	RemoteAssist.exe
1060	RemoteAssist.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RemoteAssist.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RemoteAssist.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RemoteAssist.exe.log	RemoteAssist.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\RemoteAssist\RemoteAssist.exe	2026-09-29_1eee39855e2a91e21af0c61d62b46020_glassworm_icedid.exe
File created	C:\Program Files\RemoteAssist\RemoteAssist.exe	2026-09-29_1eee39855e2a91e21af0c61d62b46020_glassworm_icedid.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
924	sc.exe
3988	sc.exe
3684	sc.exe
836	sc.exe
3216	sc.exe
4828	sc.exe
2528	sc.exe
3624	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 20 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\EdgeWebView	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\EdgeWebView	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\EdgeWebView	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\EdgeWebView\BLBeacon	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\EdgeWebView\BLBeacon	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\EdgeWebView\BLBeacon	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\EdgeWebView	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\EdgeWebView\BLBeacon	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2544	2026-09-29_1eee39855e2a91e21af0c61d62b46020_glassworm_icedid.exe
3476	RemoteAssist.exe
3476	RemoteAssist.exe
3476	RemoteAssist.exe
3476	RemoteAssist.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2544	2026-09-29_1eee39855e2a91e21af0c61d62b46020_glassworm_icedid.exe
Token: SeDebugPrivilege	3476	RemoteAssist.exe
Token: SeDebugPrivilege	2752	RemoteAssist.exe
Token: SeDebugPrivilege	1060	RemoteAssist.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2752	RemoteAssist.exe
2752	RemoteAssist.exe
1060	RemoteAssist.exe
1060	RemoteAssist.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
2752	RemoteAssist.exe
2752	RemoteAssist.exe
1060	RemoteAssist.exe
1060	RemoteAssist.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2544 wrote to memory of 3988	2544	2026-09-29_1eee39855e2a91e21af0c61d62b46020_glassworm_icedid.exe	94
PID 2544 wrote to memory of 3684	2544	2026-09-29_1eee39855e2a91e21af0c61d62b46020_glassworm_icedid.exe	100
PID 2544 wrote to memory of 836	2544	2026-09-29_1eee39855e2a91e21af0c61d62b46020_glassworm_icedid.exe	102
PID 2544 wrote to memory of 3216	2544	2026-09-29_1eee39855e2a91e21af0c61d62b46020_glassworm_icedid.exe	105
PID 2544 wrote to memory of 4828	2544	2026-09-29_1eee39855e2a91e21af0c61d62b46020_glassworm_icedid.exe	107
PID 2544 wrote to memory of 2528	2544	2026-09-29_1eee39855e2a91e21af0c61d62b46020_glassworm_icedid.exe	109
PID 2544 wrote to memory of 3624	2544	2026-09-29_1eee39855e2a91e21af0c61d62b46020_glassworm_icedid.exe	111
PID 2544 wrote to memory of 924	2544	2026-09-29_1eee39855e2a91e21af0c61d62b46020_glassworm_icedid.exe	113
PID 3476 wrote to memory of 2752	3476	RemoteAssist.exe	116
PID 2752 wrote to memory of 2000	2752	RemoteAssist.exe	117
PID 2000 wrote to memory of 4404	2000	msedgewebview2.exe	118
PID 2752 wrote to memory of 4916	2752	RemoteAssist.exe	119
PID 3476 wrote to memory of 1060	3476	RemoteAssist.exe	120
PID 1060 wrote to memory of 3920	1060	RemoteAssist.exe	121
PID 1060 wrote to memory of 3184	1060	RemoteAssist.exe	122

C:\Users\Admin\AppData\Local\Temp\2026-09-29_1eee39855e2a91e21af0c61d62b46020_glassworm_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_1eee39855e2a91e21af0c61d62b46020_glassworm_icedid.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2544
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" stop RemoteAssist
  2⤵
  - Launches sc.exe
  PID:3988
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" delete RemoteAssist
  2⤵
  - Launches sc.exe
  PID:3684
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" stop RemoteAssist
  2⤵
  - Launches sc.exe
  PID:836
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" delete RemoteAssist
  2⤵
  - Launches sc.exe
  PID:3216
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" create RemoteAssist binPath= "\"C:\Program Files\RemoteAssist\RemoteAssist.exe\" --service" start= auto DisplayName= "RemoteAssist"
  2⤵
  - Launches sc.exe
  PID:4828
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" description RemoteAssist "Tiene disponibile l'assistenza remota, anche prima dell'accesso."
  2⤵
  - Launches sc.exe
  PID:2528
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" failure RemoteAssist reset= 86400 actions= restart/5000/restart/5000/restart/60000
  2⤵
  - Launches sc.exe
  PID:3624
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" start RemoteAssist
  2⤵
  - Launches sc.exe
  PID:924

C:\Program Files\RemoteAssist\RemoteAssist.exe
"C:\Program Files\RemoteAssist\RemoteAssist.exe" --service
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3476
- C:\Program Files\RemoteAssist\RemoteAssist.exe
  "C:\Program Files\RemoteAssist\RemoteAssist.exe" --device --autostart --via-service
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2752
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=RemoteAssist.exe --webview-exe-version=1.4.8 --user-data-dir="C:\ProgramData\RemoteAssist\webview\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=2752.2784.1104243386627088291
    3⤵
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:2000
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\ProgramData\RemoteAssist\webview\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\ProgramData\RemoteAssist\webview\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x164,0x168,0x16c,0x140,0x174,0x7ffa1c11b078,0x7ffa1c11b084,0x7ffa1c11b090
      4⤵
      PID:4404
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=RemoteAssist.exe --webview-exe-version=1.4.8 --user-data-dir="C:\ProgramData\RemoteAssist\webview\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=2752.2784.4021559909371174540
    3⤵
    - Modifies data under HKEY_USERS
    PID:4916
- C:\Program Files\RemoteAssist\RemoteAssist.exe
  "C:\Program Files\RemoteAssist\RemoteAssist.exe" --device --autostart --via-service
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1060
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=RemoteAssist.exe --webview-exe-version=1.4.8 --user-data-dir="C:\ProgramData\RemoteAssist\webview\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=1060.3324.13800414908378620805
    3⤵
    - Modifies data under HKEY_USERS
    PID:3920
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=RemoteAssist.exe --webview-exe-version=1.4.8 --user-data-dir="C:\ProgramData\RemoteAssist\webview\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=1060.3324.15366525928184074989
    3⤵
    - Modifies data under HKEY_USERS
    PID:3184
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\ProgramData\RemoteAssist\webview\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\ProgramData\RemoteAssist\webview\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x164,0x168,0x16c,0x140,0x178,0x7ffa1b76b078,0x7ffa1b76b084,0x7ffa1b76b090
      4⤵
      PID:4920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

RemoteAssist.exe

Path C:\Program Files\RemoteAssist\RemoteAssist.exe
Size 1018KB
SHA256 6527418873675308dd93fca64d6c17175a54ed00684a26be11e2dc6224eba7fb
MD5 1eee39855e2a91e21af0c61d62b46020
SHA1 55d23a65c8dcecc06b351b4d65ecf2690d2a34f7
SHA512 279d7d69df7a050ef7fb0e62c27fd553cada6c5fcfaf4690162718d1b821ee6555a79ac548ff49df7519f6d6908ddfa32fad5c6c9e3bec510770177d3abc7ad6
SSDEEP 12288:78e+aJ4dCXzRKX4EcJupbSRi461R1VcrP3224c+iKmDRkRFNBMUFeA+imQ269pR/:7caJ4dCXzRKX4EcJAD1RrQz
TLSH
T17525701123E9421AF5F36B79D97502709BB6BE967A38C2CE069474BD0D72BC4C9A0337
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebView2Loader.dll

Path C:\ProgramData\RemoteAssist\WebView2Loader.dll
Size 159KB
SHA256 c66e4a92fdc7a216118e43b7a5024ea2200e8c43f9310bf20d96a0084f82c5bc
MD5 0243cb84351c92ddea3fc0334f3a52ae
SHA1 d80c01c98f0ed8af1be111abefcbbf6c9f3938bf
SHA512 74314c87eed82b1c9415462be3259a6626599047a18821cadc73c0c0c62cbd54948d6311ad4de9955fc2d4f2098ccb17aebeee8929ac2741bafc38ceb51a9585
SSDEEP 3072:d94EUQHTN8gVEeemaXpNbVf7W5AOVU9dPTwnhrEtJe6ub9VY/3A:3dzeDZNbbVf7W+cnhEtJC3H
TLSH
T194F35C57B3E500BBE1B7C234C9634A56E776B8115B609AEF03A4427A1F13BD0AE3D760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

service.log

Path C:\ProgramData\RemoteAssist\service.log
Size 1KB
SHA256 306302868dfa73b67940fbcea1435980dcfeab1dcded68c3a92de73f5cf8c28b
MD5 978ecffe3b5fc89b33e302102e74f924
SHA1 c50aa9f1c29b5eecbb5749206144828fa7959202
SHA512 ae0d9a21968b136d0cc10bc68fbfe57e12211c5e708322d29cb78e0243f5003715ce019f80eb01933e702a870a37be6bfac6bc416498cab3bd6dd8c17b05265e
TLSH
T12B318F490EC707A92AF7700F9053D5B0635DC15A2238632032FD26E61FEEC5BE697C55
MD5 SHA1 SHA512 TLSH

Submit Download

service.log

Path C:\ProgramData\RemoteAssist\service.log
Size 1KB
SHA256 081746e1c19615ec410f2708f5787b6b9e35a7139f363a42594428c7134907ac
MD5 ba4d9b6fa9ea7d87b0343158e12e99a5
SHA1 23bab589bc2195c5b324e53ca1b5f41813ef152b
SHA512 82e801a197f6d8fbc9053bbd6b036d9ab332f3690fccb323f0a0ec4fbb5a11d5b96fd1834e5774b0292df18b952b280c97f3ca75707ba10ecee1c28bfd49f9b0
TLSH
T16E31B0890DC707A96BF7740F9053E5B0635DC11E2238632031ED5AE62FEEC5AE687C55
MD5 SHA1 SHA512 TLSH

Submit Download

service.log

Path C:\ProgramData\RemoteAssist\service.log
Size 1KB
SHA256 2d2a1ccd5a01fc2b56dc272ced5cc803d84a4301fbf98227f0ff38486df90792
MD5 277363120ce1d111aa7ef3332ffa24c7
SHA1 d22a9840ad59246443173c9d878ee6c2d6d45198
SHA512 52c4e603ba1a41ea3bec2701b7bc50d8150ee473c11e0177c660b6155bf8a9c30b56faef621e1fc3df4f4d60a84a5e11c3c2c8282a289f080c2fa0a90dcc6488
TLSH
T11831D3890DC707A86BF7740F9053E5B0635DC11A2238531032ED56D62FEEC5AA687C51
MD5 SHA1 SHA512 TLSH

Submit Download

service.log

Path C:\ProgramData\RemoteAssist\service.log
Size 1KB
SHA256 83712dd4bbe5d1f3c092fcd2c235ee66e0523fab07c924398d101fc15b723a12
MD5 4ef53fa7df61dd632861495c627d9774
SHA1 ec746034ac6d709d33d2e3d9852675a78917a295
SHA512 a0e3a29ae91e96e18b1454e9f7379f918b8ec0b13d5bf97dbe9503165f91df57ac035281ffeeb36cab2bc09f77c56e14664918a9b36b85394b6902adacd2c6ca
TLSH
T1CD41D0890EC707A86BF7340F9063E5B0631DC11A2278532031EE5AD62FEEC5AB787C55
MD5 SHA1 SHA512 TLSH

Submit Download

service.log

Path C:\ProgramData\RemoteAssist\service.log
Size 2KB
SHA256 454f76f92e26a9a6e6276933b1d633396860b5fcbddb293a94d053738d86048e
MD5 464baa4b7bce8f817e2598dd73818326
SHA1 5a7bbaf8d3c1fb615350a616ce1d123f69ac0782
SHA512 33eab287d9d463b925e7544ec4708b6d4251667e8db49020f47ccafe028bd276893933d111ace74341f83097b718aa9982136aba4d31113c5f161d5ce86e9606
TLSH
T14841ED890EC707A877F7340F9467E5B0231DC11A2278532032EE5AD62FDEC1AA687C55
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\ProgramData\RemoteAssist\webview\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 e4b6996ad2a7af09acd3030118664a4d12f63928f10d60f88e1d17a34f0f4664
MD5 285c996a2f7f34020ff5d5516f664775
SHA1 8b3de97d42ad43a267d0c6aec1968eb7a0018064
SHA512 3ffb820697b3b03ff4e88580e3d842571ee879e9e22bc21bab7f02a5dd4ec5897d8966cdb85953d139645a0f64afd73bea82f60fef5b44281203139c1b61d272
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\ProgramData\RemoteAssist\webview\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

RemoteAssist.exe.log

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RemoteAssist.exe.log
Size 1KB
SHA256 921f822373146927ef9c9b9b23eb4eadae594140ee51e76989201d1a835cb84e
MD5 ffef03bd1b084269a19004cb502cfa0e
SHA1 c343646c77edf5dc99676dd54b55a4354c5fd795
SHA512 ce00fc96bf0d48ccf8851f24cdc53b9d9014c671e648b28f3a48da21374689e8dcd9159d506ac2f1b09dd62e23a3b7ac45faa715bb4ad563e54d32626d838d91
TLSH
T18D31AF712276E1E849162F421D5D2A8407FF0739BA549E1CB6E8725EED2601B5F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2544-8-0x000000001F140000-0x000000001F302000-memory.dmp

Download

memory/2544-0-0x0000000000EF0000-0x0000000000FF2000-memory.dmp

Download

memory/2544-7-0x000000001E170000-0x000000001E1C0000-memory.dmp

Download

memory/2544-4-0x000000001CA80000-0x000000001CA90000-memory.dmp

Download

memory/2544-2-0x000000001CA80000-0x000000001CA90000-memory.dmp

Download

memory/2752-30-0x000000001C270000-0x000000001C31E000-memory.dmp

Download

memory/2752-29-0x0000000001190000-0x000000000119E000-memory.dmp

Download