6527418873675308dd93fca64d6c17175a54ed00684a26be11e2dc6224eba7fb

Analysis

max time kernel
149s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 04:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_1eee39855e2a91e21af0c61d62b46020_glassworm_icedid.exe
Size 1018KB
Sample260930-e9sccseg84
SHA256 6527418873675308dd93fca64d6c17175a54ed00684a26be11e2dc6224eba7fb
MD5 1eee39855e2a91e21af0c61d62b46020
SHA1 55d23a65c8dcecc06b351b4d65ecf2690d2a34f7
SHA512 279d7d69df7a050ef7fb0e62c27fd553cada6c5fcfaf4690162718d1b821ee6555a79ac548ff49df7519f6d6908ddfa32fad5c6c9e3bec510770177d3abc7ad6
SSDEEP 12288:78e+aJ4dCXzRKX4EcJupbSRi461R1VcrP3224c+iKmDRkRFNBMUFeA+imQ269pR/:7caJ4dCXzRKX4EcJAD1RrQz
TLSH
T17525701123E9421AF5F36B79D97502709BB6BE967A38C2CE069474BD0D72BC4C9A0337
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3264	RemoteAssist.exe
1216	RemoteAssist.exe
4632	RemoteAssist.exe

Loads dropped DLL 2 IoCs

pid	Process
1216	RemoteAssist.exe
4632	RemoteAssist.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RemoteAssist.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RemoteAssist.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\RemoteAssist\RemoteAssist.exe	2026-09-29_1eee39855e2a91e21af0c61d62b46020_glassworm_icedid.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3748	sc.exe
4524	sc.exe
4928	sc.exe
5548	sc.exe
5144	sc.exe
6104	sc.exe
4832	sc.exe
2436	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 20 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\EdgeWebView	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\EdgeWebView\BLBeacon	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\EdgeWebView\BLBeacon	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\EdgeWebView	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\EdgeWebView	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\EdgeWebView\BLBeacon	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\EdgeWebView\BLBeacon	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\EdgeWebView	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3248	2026-09-29_1eee39855e2a91e21af0c61d62b46020_glassworm_icedid.exe
3248	2026-09-29_1eee39855e2a91e21af0c61d62b46020_glassworm_icedid.exe
3264	RemoteAssist.exe
3264	RemoteAssist.exe
3264	RemoteAssist.exe
3264	RemoteAssist.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3248	2026-09-29_1eee39855e2a91e21af0c61d62b46020_glassworm_icedid.exe
Token: SeDebugPrivilege	3264	RemoteAssist.exe
Token: SeDebugPrivilege	1216	RemoteAssist.exe
Token: SeDebugPrivilege	4632	RemoteAssist.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1216	RemoteAssist.exe
1216	RemoteAssist.exe
4632	RemoteAssist.exe
4632	RemoteAssist.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
1216	RemoteAssist.exe
1216	RemoteAssist.exe
4632	RemoteAssist.exe
4632	RemoteAssist.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3248 wrote to memory of 4832	3248	2026-09-29_1eee39855e2a91e21af0c61d62b46020_glassworm_icedid.exe	91
PID 3248 wrote to memory of 2436	3248	2026-09-29_1eee39855e2a91e21af0c61d62b46020_glassworm_icedid.exe	93
PID 3248 wrote to memory of 3748	3248	2026-09-29_1eee39855e2a91e21af0c61d62b46020_glassworm_icedid.exe	95
PID 3248 wrote to memory of 4524	3248	2026-09-29_1eee39855e2a91e21af0c61d62b46020_glassworm_icedid.exe	98
PID 3248 wrote to memory of 4928	3248	2026-09-29_1eee39855e2a91e21af0c61d62b46020_glassworm_icedid.exe	100
PID 3248 wrote to memory of 5548	3248	2026-09-29_1eee39855e2a91e21af0c61d62b46020_glassworm_icedid.exe	102
PID 3248 wrote to memory of 5144	3248	2026-09-29_1eee39855e2a91e21af0c61d62b46020_glassworm_icedid.exe	104
PID 3248 wrote to memory of 6104	3248	2026-09-29_1eee39855e2a91e21af0c61d62b46020_glassworm_icedid.exe	106
PID 3264 wrote to memory of 1216	3264	RemoteAssist.exe	109
PID 1216 wrote to memory of 2736	1216	RemoteAssist.exe	110
PID 2736 wrote to memory of 2932	2736	msedgewebview2.exe	111
PID 1216 wrote to memory of 4900	1216	RemoteAssist.exe	112
PID 3264 wrote to memory of 4632	3264	RemoteAssist.exe	114
PID 4632 wrote to memory of 476	4632	RemoteAssist.exe	115
PID 4632 wrote to memory of 1660	4632	RemoteAssist.exe	117

C:\Users\Admin\AppData\Local\Temp\2026-09-29_1eee39855e2a91e21af0c61d62b46020_glassworm_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_1eee39855e2a91e21af0c61d62b46020_glassworm_icedid.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3248
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" stop RemoteAssist
  2⤵
  - Launches sc.exe
  PID:4832
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" delete RemoteAssist
  2⤵
  - Launches sc.exe
  PID:2436
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" stop RemoteAssist
  2⤵
  - Launches sc.exe
  PID:3748
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" delete RemoteAssist
  2⤵
  - Launches sc.exe
  PID:4524
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" create RemoteAssist binPath= "\"C:\Program Files\RemoteAssist\RemoteAssist.exe\" --service" start= auto DisplayName= "RemoteAssist"
  2⤵
  - Launches sc.exe
  PID:4928
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" description RemoteAssist "Tiene disponibile l'assistenza remota, anche prima dell'accesso."
  2⤵
  - Launches sc.exe
  PID:5548
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" failure RemoteAssist reset= 86400 actions= restart/5000/restart/5000/restart/60000
  2⤵
  - Launches sc.exe
  PID:5144
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" start RemoteAssist
  2⤵
  - Launches sc.exe
  PID:6104

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1304

C:\Program Files\RemoteAssist\RemoteAssist.exe
"C:\Program Files\RemoteAssist\RemoteAssist.exe" --service
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3264
- C:\Program Files\RemoteAssist\RemoteAssist.exe
  "C:\Program Files\RemoteAssist\RemoteAssist.exe" --device --autostart --via-service
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1216
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=RemoteAssist.exe --webview-exe-version=1.4.8 --user-data-dir="C:\ProgramData\RemoteAssist\webview\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=1216.3800.9087924736782703900 /pfhostedapp:bb726b28b906169c51134d05e9f499187e541cf0
    3⤵
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:2736
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\ProgramData\RemoteAssist\webview\EBWebView /prefetch:4 /pfhostedapp:bb726b28b906169c51134d05e9f499187e541cf0 --monitor-self-annotation=ptype=crashpad-handler --database=C:\ProgramData\RemoteAssist\webview\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x190,0x194,0x198,0x18c,0x150,0x7ffb89945fd8,0x7ffb89945fe4,0x7ffb89945ff0
      4⤵
      PID:2932
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=RemoteAssist.exe --webview-exe-version=1.4.8 --user-data-dir="C:\ProgramData\RemoteAssist\webview\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=1216.3800.11206783886073725191 /pfhostedapp:bb726b28b906169c51134d05e9f499187e541cf0
    3⤵
    - Modifies data under HKEY_USERS
    PID:4900
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\ProgramData\RemoteAssist\webview\EBWebView /prefetch:4 /pfhostedapp:bb726b28b906169c51134d05e9f499187e541cf0 --monitor-self-annotation=ptype=crashpad-handler --database=C:\ProgramData\RemoteAssist\webview\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x18c,0x190,0x194,0xb0,0x19c,0x7ffb89945fd8,0x7ffb89945fe4,0x7ffb89945ff0
      4⤵
      PID:1224
- C:\Program Files\RemoteAssist\RemoteAssist.exe
  "C:\Program Files\RemoteAssist\RemoteAssist.exe" --device --autostart --via-service
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4632
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=RemoteAssist.exe --webview-exe-version=1.4.8 --user-data-dir="C:\ProgramData\RemoteAssist\webview\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=4632.2192.6895366518245018312 /pfhostedapp:bb726b28b906169c51134d05e9f499187e541cf0
    3⤵
    - Modifies data under HKEY_USERS
    PID:476
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\ProgramData\RemoteAssist\webview\EBWebView /prefetch:4 /pfhostedapp:bb726b28b906169c51134d05e9f499187e541cf0 --monitor-self-annotation=ptype=crashpad-handler --database=C:\ProgramData\RemoteAssist\webview\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x18c,0x190,0x194,0x168,0x1a0,0x7ffb89945fd8,0x7ffb89945fe4,0x7ffb89945ff0
      4⤵
      PID:1484
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=RemoteAssist.exe --webview-exe-version=1.4.8 --user-data-dir="C:\ProgramData\RemoteAssist\webview\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=4632.2192.12219167381297711760 /pfhostedapp:bb726b28b906169c51134d05e9f499187e541cf0
    3⤵
    - Modifies data under HKEY_USERS
    PID:1660
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\ProgramData\RemoteAssist\webview\EBWebView /prefetch:4 /pfhostedapp:bb726b28b906169c51134d05e9f499187e541cf0 --monitor-self-annotation=ptype=crashpad-handler --database=C:\ProgramData\RemoteAssist\webview\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x18c,0x190,0x194,0x168,0x19c,0x7ffb89945fd8,0x7ffb89945fe4,0x7ffb89945ff0
      4⤵
      PID:3972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

RemoteAssist.exe

Path C:\Program Files\RemoteAssist\RemoteAssist.exe
Size 1018KB
SHA256 6527418873675308dd93fca64d6c17175a54ed00684a26be11e2dc6224eba7fb
MD5 1eee39855e2a91e21af0c61d62b46020
SHA1 55d23a65c8dcecc06b351b4d65ecf2690d2a34f7
SHA512 279d7d69df7a050ef7fb0e62c27fd553cada6c5fcfaf4690162718d1b821ee6555a79ac548ff49df7519f6d6908ddfa32fad5c6c9e3bec510770177d3abc7ad6
SSDEEP 12288:78e+aJ4dCXzRKX4EcJupbSRi461R1VcrP3224c+iKmDRkRFNBMUFeA+imQ269pR/:7caJ4dCXzRKX4EcJAD1RrQz
TLSH
T17525701123E9421AF5F36B79D97502709BB6BE967A38C2CE069474BD0D72BC4C9A0337
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebView2Loader.dll

Path C:\ProgramData\RemoteAssist\WebView2Loader.dll
Size 159KB
SHA256 c66e4a92fdc7a216118e43b7a5024ea2200e8c43f9310bf20d96a0084f82c5bc
MD5 0243cb84351c92ddea3fc0334f3a52ae
SHA1 d80c01c98f0ed8af1be111abefcbbf6c9f3938bf
SHA512 74314c87eed82b1c9415462be3259a6626599047a18821cadc73c0c0c62cbd54948d6311ad4de9955fc2d4f2098ccb17aebeee8929ac2741bafc38ceb51a9585
SSDEEP 3072:d94EUQHTN8gVEeemaXpNbVf7W5AOVU9dPTwnhrEtJe6ub9VY/3A:3dzeDZNbbVf7W+cnhEtJC3H
TLSH
T194F35C57B3E500BBE1B7C234C9634A56E776B8115B609AEF03A4427A1F13BD0AE3D760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

service.log

Path C:\ProgramData\RemoteAssist\service.log
Size 1KB
SHA256 5136d52a71e0ff32e05c10b5a99393a59f452096f2cd84924cc0880abfbe2280
MD5 0903bdc03314d9b58dd0f3b757dcb2b7
SHA1 d2f2c5c0671384f6e96e9793db9bab5cecbab5d1
SHA512 1d417477914c7297f16ffa10df9a3b0206ac48ccb251939acc07416fe1d40b6998bdab88425b50b95258946c0ddd16ed27bb385d49437f2566b5d6f6e3a4bfb8
TLSH
T1FE317B890E8703A82BF7B40F9453E6B0634CC15A223C631036ED26D65FEEC5BE697C55
MD5 SHA1 SHA512 TLSH

Submit Download

service.log

Path C:\ProgramData\RemoteAssist\service.log
Size 1KB
SHA256 5a6bdae8e52d68e4f82ae8707440ca56e8e5c16aa046fc894d391a696ed24577
MD5 8560fe764085509afa0d3e5eada645bf
SHA1 f624df055b944707e4334fb2bae056154025ac4d
SHA512 9b050c4c29c280a26c3391b47e4eee9e588ed82e55a807e384cd008e5f1522296f76f76340b0aef7009301d9bd95f92d1c98602c0171a5817f22a198e834c106
TLSH
T1B331ACC90EC707A82BF7640F8463E5B0631CC11A2228631036EE1AD66FEEC5AA687C51
MD5 SHA1 SHA512 TLSH

Submit Download

service.log

Path C:\ProgramData\RemoteAssist\service.log
Size 1KB
SHA256 2c8af4847f5cebdf1bf432c0f1a5e4cd9eda469ab64e6eb273aef8cf896b42e5
MD5 c7a19e8c2e0b5fb6315161489ff7364d
SHA1 069932b28c2faae9a1dafb50da958899601e7869
SHA512 6eaa7bb60dba0f0a71bb86dd45b66f7346a673bd748e232da3bba24eb4daa95d41a3e355793c4bfc2d842739e0f92b7cea425d2ee65d6f3ef50752a6c6627718
TLSH
T10B41CBC90EC707A86BF7640F8063E5B0231DC11A2228531035EE5AD66FEED5AA787C52
MD5 SHA1 SHA512 TLSH

Submit Download

service.log

Path C:\ProgramData\RemoteAssist\service.log
Size 2KB
SHA256 07dc04fc1beb363c5ebf21dbafb94dfd0649443d3fc781ee4f0dffcd1e8ebf85
MD5 da85855f0529949e48f04191cfba465e
SHA1 f6fea699fc3f4bbf1936a82e458dd864df91a8a8
SHA512 135d735d5459ac77e167a4073b8bb52a9680307a75acd80d7438a8bcffaa43143825b1182866ee50c5486d634e76f357bb310ee41602be07d522d18f93cc9c03
TLSH
T15141EBC90EC707A86BF7640F8463E5B0231DC11A2328531035EE6AD66FEED1AA687C52
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\ProgramData\RemoteAssist\webview\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 0e40cd0aaf8b98ff685fc132ea2bada9b6acd2e60d7c99efa6e3c05c157fa969
MD5 4693a8e39d04b166b63355ade6c6d566
SHA1 974b7a332c70512af5b6dc12a27e7da924f68c9c
SHA512 3c749b60c91e744b1ec9789ef5072bf980cce7500ba5c18e24a53aaf6f3823ed00acb5db8c138c50248bffa20d4be8617fd5b516bc0f795230fc3726b34b7544
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\ProgramData\RemoteAssist\webview\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

memory/1216-32-0x00000000013D0000-0x000000000147E000-memory.dmp

Download

memory/1216-31-0x00000000013C0000-0x00000000013CE000-memory.dmp

Download

memory/3248-6-0x00007FFB877C0000-0x00007FFB88164000-memory.dmp

Download

memory/3248-18-0x00007FFB877C0000-0x00007FFB88164000-memory.dmp

Download

memory/3248-13-0x0000000020A70000-0x0000000020C32000-memory.dmp

Download

memory/3248-12-0x0000000020850000-0x00000000208A0000-memory.dmp

Download

memory/3248-10-0x00007FFB877C0000-0x00007FFB88164000-memory.dmp

Download

memory/3248-8-0x00007FFB877C0000-0x00007FFB88164000-memory.dmp

Download

memory/3248-7-0x00007FFB877C0000-0x00007FFB88164000-memory.dmp

Download

memory/3248-0-0x00007FFB8794F000-0x00007FFB87950000-memory.dmp

Download

memory/3248-5-0x00007FFB877C0000-0x00007FFB88164000-memory.dmp

Download

memory/3248-4-0x00007FFB877C0000-0x00007FFB88164000-memory.dmp

Download

memory/3248-46-0x00007FFB877C0000-0x00007FFB88164000-memory.dmp

Download

memory/3248-3-0x00007FFB877C0000-0x00007FFB88164000-memory.dmp

Download

memory/3248-1-0x0000000000090000-0x0000000000192000-memory.dmp

Download