2a64d62ca6f4f7e86e09dac75ddbbbb86ba71866a8a42841f7afe232758b5ab1

Analysis

max time kernel
149s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/10/2026, 18:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-30_176bcb0c8572b6318184ba28977bf3e7_glassworm_icedid.exe
Size 1.0MB
Sample261001-wt77batglb
SHA256 2a64d62ca6f4f7e86e09dac75ddbbbb86ba71866a8a42841f7afe232758b5ab1
MD5 176bcb0c8572b6318184ba28977bf3e7
SHA1 1b5f4ea95066b0467225309fb18236792954fcf7
SHA512 5f8ed676cba4143f1d4e51ea3e9a00132b91a2aefecb887b347b220df8abe216b9cf098961782c9448a7c5e39ad1d91b565c82bceadf3e6ea85e33293a66021e
SSDEEP 12288:yyeD2J4dCXzRKX4EcJupbSRi461R1VcrP3224c+iKmDRkRFNBMUFeA+imQ269pRQ:y/2J4dCXzRKX4EcJAD1RrQzaW
TLSH
T12525711123E9421AF5F36B79D97502709AB6BE967A78C3CE069470BD0D72BC4C9A0337
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RemoteAssist.exe.log	RemoteAssist.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\RemoteAssist\RemoteAssist.exe	2026-09-30_176bcb0c8572b6318184ba28977bf3e7_glassworm_icedid.exe
File opened for modification	C:\Program Files\RemoteAssist\RemoteAssist.exe	2026-09-30_176bcb0c8572b6318184ba28977bf3e7_glassworm_icedid.exe

Executes dropped EXE 3 IoCs

pid	Process
3144	RemoteAssist.exe
5716	RemoteAssist.exe
2936	RemoteAssist.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5668	sc.exe
3088	sc.exe
2568	sc.exe
6108	sc.exe
3960	sc.exe
5168	sc.exe
860	sc.exe
5132	sc.exe

Loads dropped DLL 2 IoCs

pid	Process
5716	RemoteAssist.exe
2936	RemoteAssist.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RemoteAssist.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RemoteAssist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 20 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\EdgeWebView\BLBeacon	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\EdgeWebView	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\EdgeWebView\BLBeacon	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\EdgeWebView	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\EdgeWebView	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\EdgeWebView	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\EdgeWebView\BLBeacon	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\EdgeWebView\BLBeacon	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1384	2026-09-30_176bcb0c8572b6318184ba28977bf3e7_glassworm_icedid.exe
3144	RemoteAssist.exe
3144	RemoteAssist.exe
3144	RemoteAssist.exe
3144	RemoteAssist.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1384	2026-09-30_176bcb0c8572b6318184ba28977bf3e7_glassworm_icedid.exe
Token: SeDebugPrivilege	3144	RemoteAssist.exe
Token: SeDebugPrivilege	5716	RemoteAssist.exe
Token: SeDebugPrivilege	2936	RemoteAssist.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
5716	RemoteAssist.exe
5716	RemoteAssist.exe
2936	RemoteAssist.exe
2936	RemoteAssist.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
5716	RemoteAssist.exe
5716	RemoteAssist.exe
2936	RemoteAssist.exe
2936	RemoteAssist.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1384 wrote to memory of 5168	1384	2026-09-30_176bcb0c8572b6318184ba28977bf3e7_glassworm_icedid.exe	97
PID 1384 wrote to memory of 860	1384	2026-09-30_176bcb0c8572b6318184ba28977bf3e7_glassworm_icedid.exe	102
PID 1384 wrote to memory of 5132	1384	2026-09-30_176bcb0c8572b6318184ba28977bf3e7_glassworm_icedid.exe	104
PID 1384 wrote to memory of 5668	1384	2026-09-30_176bcb0c8572b6318184ba28977bf3e7_glassworm_icedid.exe	107
PID 1384 wrote to memory of 3088	1384	2026-09-30_176bcb0c8572b6318184ba28977bf3e7_glassworm_icedid.exe	109
PID 1384 wrote to memory of 2568	1384	2026-09-30_176bcb0c8572b6318184ba28977bf3e7_glassworm_icedid.exe	111
PID 1384 wrote to memory of 6108	1384	2026-09-30_176bcb0c8572b6318184ba28977bf3e7_glassworm_icedid.exe	113
PID 1384 wrote to memory of 3960	1384	2026-09-30_176bcb0c8572b6318184ba28977bf3e7_glassworm_icedid.exe	115
PID 3144 wrote to memory of 5716	3144	RemoteAssist.exe	118
PID 5716 wrote to memory of 4976	5716	RemoteAssist.exe	119
PID 4976 wrote to memory of 4592	4976	msedgewebview2.exe	120
PID 5716 wrote to memory of 4616	5716	RemoteAssist.exe	121
PID 3144 wrote to memory of 2936	3144	RemoteAssist.exe	123
PID 2936 wrote to memory of 1872	2936	RemoteAssist.exe	124
PID 2936 wrote to memory of 5736	2936	RemoteAssist.exe	126

C:\Users\Admin\AppData\Local\Temp\2026-09-30_176bcb0c8572b6318184ba28977bf3e7_glassworm_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-30_176bcb0c8572b6318184ba28977bf3e7_glassworm_icedid.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1384
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" stop RemoteAssist
  2⤵
  - Launches sc.exe
  PID:5168
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" delete RemoteAssist
  2⤵
  - Launches sc.exe
  PID:860
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" stop RemoteAssist
  2⤵
  - Launches sc.exe
  PID:5132
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" delete RemoteAssist
  2⤵
  - Launches sc.exe
  PID:5668
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" create RemoteAssist binPath= "\"C:\Program Files\RemoteAssist\RemoteAssist.exe\" --service" start= auto DisplayName= "RemoteAssist"
  2⤵
  - Launches sc.exe
  PID:3088
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" description RemoteAssist "Tiene disponibile l'assistenza remota, anche prima dell'accesso."
  2⤵
  - Launches sc.exe
  PID:2568
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" failure RemoteAssist reset= 86400 actions= restart/5000/restart/5000/restart/60000
  2⤵
  - Launches sc.exe
  PID:6108
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" start RemoteAssist
  2⤵
  - Launches sc.exe
  PID:3960

C:\Program Files\RemoteAssist\RemoteAssist.exe
"C:\Program Files\RemoteAssist\RemoteAssist.exe" --service
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3144
- C:\Program Files\RemoteAssist\RemoteAssist.exe
  "C:\Program Files\RemoteAssist\RemoteAssist.exe" --device --autostart --via-service
  2⤵
  - Drops file in System32 directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:5716
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=RemoteAssist.exe --webview-exe-version=1.4.10 --user-data-dir="C:\ProgramData\RemoteAssist\webview\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=5716.4032.15803867056773471005
    3⤵
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:4976
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\ProgramData\RemoteAssist\webview\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\ProgramData\RemoteAssist\webview\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x164,0x168,0x16c,0x140,0x174,0x7ffe3047b078,0x7ffe3047b084,0x7ffe3047b090
      4⤵
      PID:4592
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=RemoteAssist.exe --webview-exe-version=1.4.10 --user-data-dir="C:\ProgramData\RemoteAssist\webview\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=5716.4032.6314088935116652738
    3⤵
    - Modifies data under HKEY_USERS
    PID:4616
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\ProgramData\RemoteAssist\webview\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\ProgramData\RemoteAssist\webview\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x170,0x174,0x178,0x14c,0xe8,0x7ffe3047b078,0x7ffe3047b084,0x7ffe3047b090
      4⤵
      PID:2296
- C:\Program Files\RemoteAssist\RemoteAssist.exe
  "C:\Program Files\RemoteAssist\RemoteAssist.exe" --device --autostart --via-service
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2936
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=RemoteAssist.exe --webview-exe-version=1.4.10 --user-data-dir="C:\ProgramData\RemoteAssist\webview\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=2936.5776.15669278374980185110
    3⤵
    - Modifies data under HKEY_USERS
    PID:1872
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\ProgramData\RemoteAssist\webview\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\ProgramData\RemoteAssist\webview\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x164,0x168,0x16c,0x140,0x174,0x7ffe3047b078,0x7ffe3047b084,0x7ffe3047b090
      4⤵
      PID:2356
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=RemoteAssist.exe --webview-exe-version=1.4.10 --user-data-dir="C:\ProgramData\RemoteAssist\webview\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=2936.5776.3628716224361631762
    3⤵
    - Modifies data under HKEY_USERS
    PID:5736
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\ProgramData\RemoteAssist\webview\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\ProgramData\RemoteAssist\webview\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x164,0x168,0x16c,0x140,0x178,0x7ffe3047b078,0x7ffe3047b084,0x7ffe3047b090
      4⤵
      PID:1820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

RemoteAssist.exe

Path C:\Program Files\RemoteAssist\RemoteAssist.exe
Size 1.0MB
SHA256 2a64d62ca6f4f7e86e09dac75ddbbbb86ba71866a8a42841f7afe232758b5ab1
MD5 176bcb0c8572b6318184ba28977bf3e7
SHA1 1b5f4ea95066b0467225309fb18236792954fcf7
SHA512 5f8ed676cba4143f1d4e51ea3e9a00132b91a2aefecb887b347b220df8abe216b9cf098961782c9448a7c5e39ad1d91b565c82bceadf3e6ea85e33293a66021e
SSDEEP 12288:yyeD2J4dCXzRKX4EcJupbSRi461R1VcrP3224c+iKmDRkRFNBMUFeA+imQ269pRQ:y/2J4dCXzRKX4EcJAD1RrQzaW
TLSH
T12525711123E9421AF5F36B79D97502709AB6BE967A78C3CE069470BD0D72BC4C9A0337
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebView2Loader.dll

Path C:\ProgramData\RemoteAssist\WebView2Loader.dll
Size 159KB
SHA256 c66e4a92fdc7a216118e43b7a5024ea2200e8c43f9310bf20d96a0084f82c5bc
MD5 0243cb84351c92ddea3fc0334f3a52ae
SHA1 d80c01c98f0ed8af1be111abefcbbf6c9f3938bf
SHA512 74314c87eed82b1c9415462be3259a6626599047a18821cadc73c0c0c62cbd54948d6311ad4de9955fc2d4f2098ccb17aebeee8929ac2741bafc38ceb51a9585
SSDEEP 3072:d94EUQHTN8gVEeemaXpNbVf7W5AOVU9dPTwnhrEtJe6ub9VY/3A:3dzeDZNbbVf7W+cnhEtJC3H
TLSH
T194F35C57B3E500BBE1B7C234C9634A56E776B8115B609AEF03A4427A1F13BD0AE3D760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

service.log

Path C:\ProgramData\RemoteAssist\service.log
Size 1KB
SHA256 9bce77b627fa72ff5cd1a16ff1d8d13787ba248230df91ab19f4eb99ebcf753a
MD5 45e0f7d3c1f7b6db58efd3e578f6762b
SHA1 040c2ea6119d85469e75334ee1e450cd4e2c5de4
SHA512 236cd87f157fc5d07bd78d4c5a053871a1163e32646f1b9f83006de0abd2e5026b49f119d20a8b4190262affd1025f5f8472a082c742687dde0b0cd07819c86d
TLSH
T1C0317B890ACB47AD0DFB700B9173E9B0634AC15D1138231132FE26A95FEE85F9752D59
MD5 SHA1 SHA512 TLSH

Submit Download

service.log

Path C:\ProgramData\RemoteAssist\service.log
Size 1KB
SHA256 69bc79efeff12846d1d3ce9764c56323c0e7470858df8437667d1931237d0ad6
MD5 9e8d71b171afb29cab173ebd8478f87a
SHA1 2e54f0d12146f005acf4e7b20002672ed9a9570f
SHA512 9a56e1bb52c0c77e424413046d56c0228e2dfe09936e3f85062eaa69d888e6488b8ed117a03bdde52ef08471bb4092a942594efd6955c74a25fe3d8ba60858f3
TLSH
T10D31ADC90ACB87A84DFB700B9073E5B0635AC05D1138231132FE2AA96FEE85E9742D59
MD5 SHA1 SHA512 TLSH

Submit Download

service.log

Path C:\ProgramData\RemoteAssist\service.log
Size 1KB
SHA256 502f0579d944b2257ac89f1bb24e35e013c68aafd9925c27dfece8c4429deada
MD5 43a25614c89f126cccb9d891b895d69f
SHA1 66e3ee8b76af826cd2e075f464967b65e181ad15
SHA512 42581a166cb7a2ba298ff3cb81490c15420b313e8f7cb394ad8f99551864b2c938a64d67f3d9b659047accfce77fdc7171aa370c884ef75d4dbd96bad4af225b
TLSH
T1DC31DFC90FCB87A84DFB700B9073E5B0634AC05D1138231133EE2AA96FEE81E9742D59
MD5 SHA1 SHA512 TLSH

Submit Download

service.log

Path C:\ProgramData\RemoteAssist\service.log
Size 1KB
SHA256 fa1fd7a35cb9a0cbbc2c1d84df78245ac7ccf949dbbce456f09915992be256d4
MD5 492171d1c7fbd52d79ceff4607d05651
SHA1 7f59050effd54fff24781bd76e3cf5b6fea74967
SHA512 6df1c7d7ff47a25ae6975fd173e50e7e2299208b8be96c3e030d5e540233278fece15374671437c1353e65de529c7fa85642bca7b520535ca0906341c6d8cf9b
TLSH
T15C41DECA0BCB87AC4DFB700B9173E5B0635BC05D1178131132EE6AA96FDE81EA742D59
MD5 SHA1 SHA512 TLSH

Submit Download

service.log

Path C:\ProgramData\RemoteAssist\service.log
Size 2KB
SHA256 9b1914be4003fe6f6b271050cb36476fd20e295354664744c3088ab5734d2580
MD5 1852de48c883e4aef13bf105c6a8e6c2
SHA1 f585a42d28af5376cc0371fe17d62e09a49c9318
SHA512 f3231736285a50ccd80b161a5214bb8c05da664ab3671d9d149d069f25ced40ba5158ee8af52a95aed2f51ae76b4fa9811b787717198c7ea90c0b50aa04c7e8a
TLSH
T1D341F0CA1BCB87A84CFB31078173E5B0631BC05D1178131132EE5A996FDE81EA741D59
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\ProgramData\RemoteAssist\webview\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 551ca589299bef17bc04816d28c13ffc47b045185fb2d9a6a27cab45f1731f3a
MD5 13f1cbc4921336cb2c7289dc63090b24
SHA1 abc7ce59553323ac00a557a3a8862be910593257
SHA512 113af604b3762f70accab0445b3c732d11c2aa703dcf8d681c5341863af1845e3613a3bf5a8fc15942d6cd37f281f9b04a11197d08a5d60df97e6a64803614bc
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\ProgramData\RemoteAssist\webview\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

RemoteAssist.exe.log

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RemoteAssist.exe.log
Size 1KB
SHA256 921f822373146927ef9c9b9b23eb4eadae594140ee51e76989201d1a835cb84e
MD5 ffef03bd1b084269a19004cb502cfa0e
SHA1 c343646c77edf5dc99676dd54b55a4354c5fd795
SHA512 ce00fc96bf0d48ccf8851f24cdc53b9d9014c671e648b28f3a48da21374689e8dcd9159d506ac2f1b09dd62e23a3b7ac45faa715bb4ad563e54d32626d838d91
TLSH
T18D31AF712276E1E849162F421D5D2A8407FF0739BA549E1CB6E8725EED2601B5F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1384-8-0x000000001E340000-0x000000001E390000-memory.dmp

Download

memory/1384-9-0x0000000020C90000-0x0000000020E52000-memory.dmp

Download

memory/1384-0-0x0000000000860000-0x0000000000962000-memory.dmp

Download

memory/1384-5-0x000000001C6C0000-0x000000001C6D0000-memory.dmp

Download

memory/1384-3-0x000000001C6C0000-0x000000001C6D0000-memory.dmp

Download

memory/1384-2-0x000000001C6C0000-0x000000001C6D0000-memory.dmp

Download

memory/5716-32-0x000000001C890000-0x000000001C93E000-memory.dmp

Download

memory/5716-31-0x0000000001830000-0x000000000183E000-memory.dmp

Download