a8953a4b92f49251c774d0f4150be808a9aa834ecbe28ae9a32a1004c4810810

Analysis

max time kernel
149s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 12:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-01_6d831a9b10b467adf7d0fc22805a5861_glassworm_icedid.exe
Size 1018KB
Sample261002-psep2svs8q
SHA256 a8953a4b92f49251c774d0f4150be808a9aa834ecbe28ae9a32a1004c4810810
MD5 6d831a9b10b467adf7d0fc22805a5861
SHA1 ac6f05a9ac74e67fc0fc83574d8a4f60cf28f075
SHA512 a6bc765a3ea18a6fa04879ffbc56d3a8edaa3b0d7c289cc7ee52594439e748b314fe361d131324b50cfb2cc8851b4febf29bad08d4b24460f8efb243eac6236d
SSDEEP 12288:O8e+aJ4dCXzRKX4EcJupbSRi461R1VcrP3224c+iKmDRkRFNBMUFeA+imQ269pR/:OcaJ4dCXzRKX4EcJAD1RrQz
TLSH
T12A25701123E9421AF5F36B79D97502709BB6BE967A38C2CE069474BD0D72BC4C9A0337
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4088	RemoteAssist.exe
4244	RemoteAssist.exe
548	RemoteAssist.exe

Loads dropped DLL 2 IoCs

pid	Process
4244	RemoteAssist.exe
548	RemoteAssist.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RemoteAssist.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RemoteAssist.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RemoteAssist.exe.log	RemoteAssist.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\RemoteAssist\RemoteAssist.exe	2026-10-01_6d831a9b10b467adf7d0fc22805a5861_glassworm_icedid.exe
File opened for modification	C:\Program Files\RemoteAssist\RemoteAssist.exe	2026-10-01_6d831a9b10b467adf7d0fc22805a5861_glassworm_icedid.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4420	sc.exe
2152	sc.exe
4156	sc.exe
3192	sc.exe
1656	sc.exe
1232	sc.exe
4940	sc.exe
3556	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 20 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\EdgeWebView\BLBeacon	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\EdgeWebView\BLBeacon	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\EdgeWebView\BLBeacon	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\EdgeWebView\BLBeacon	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\EdgeWebView	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\EdgeWebView	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\EdgeWebView	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\EdgeWebView	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
4868	2026-10-01_6d831a9b10b467adf7d0fc22805a5861_glassworm_icedid.exe
4088	RemoteAssist.exe
4088	RemoteAssist.exe
4088	RemoteAssist.exe
4088	RemoteAssist.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4868	2026-10-01_6d831a9b10b467adf7d0fc22805a5861_glassworm_icedid.exe
Token: SeDebugPrivilege	4088	RemoteAssist.exe
Token: SeDebugPrivilege	4244	RemoteAssist.exe
Token: SeDebugPrivilege	548	RemoteAssist.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4244	RemoteAssist.exe
4244	RemoteAssist.exe
548	RemoteAssist.exe
548	RemoteAssist.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
4244	RemoteAssist.exe
4244	RemoteAssist.exe
548	RemoteAssist.exe
548	RemoteAssist.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4868 wrote to memory of 4940	4868	2026-10-01_6d831a9b10b467adf7d0fc22805a5861_glassworm_icedid.exe	95
PID 4868 wrote to memory of 3556	4868	2026-10-01_6d831a9b10b467adf7d0fc22805a5861_glassworm_icedid.exe	99
PID 4868 wrote to memory of 4420	4868	2026-10-01_6d831a9b10b467adf7d0fc22805a5861_glassworm_icedid.exe	101
PID 4868 wrote to memory of 2152	4868	2026-10-01_6d831a9b10b467adf7d0fc22805a5861_glassworm_icedid.exe	104
PID 4868 wrote to memory of 4156	4868	2026-10-01_6d831a9b10b467adf7d0fc22805a5861_glassworm_icedid.exe	106
PID 4868 wrote to memory of 3192	4868	2026-10-01_6d831a9b10b467adf7d0fc22805a5861_glassworm_icedid.exe	108
PID 4868 wrote to memory of 1656	4868	2026-10-01_6d831a9b10b467adf7d0fc22805a5861_glassworm_icedid.exe	110
PID 4868 wrote to memory of 1232	4868	2026-10-01_6d831a9b10b467adf7d0fc22805a5861_glassworm_icedid.exe	112
PID 4088 wrote to memory of 4244	4088	RemoteAssist.exe	115
PID 4244 wrote to memory of 2888	4244	RemoteAssist.exe	116
PID 2888 wrote to memory of 4588	2888	msedgewebview2.exe	117
PID 4244 wrote to memory of 1140	4244	RemoteAssist.exe	118
PID 4088 wrote to memory of 548	4088	RemoteAssist.exe	120
PID 548 wrote to memory of 1368	548	RemoteAssist.exe	121
PID 548 wrote to memory of 3488	548	RemoteAssist.exe	123

C:\Users\Admin\AppData\Local\Temp\2026-10-01_6d831a9b10b467adf7d0fc22805a5861_glassworm_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-01_6d831a9b10b467adf7d0fc22805a5861_glassworm_icedid.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4868
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" stop RemoteAssist
  2⤵
  - Launches sc.exe
  PID:4940
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" delete RemoteAssist
  2⤵
  - Launches sc.exe
  PID:3556
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" stop RemoteAssist
  2⤵
  - Launches sc.exe
  PID:4420
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" delete RemoteAssist
  2⤵
  - Launches sc.exe
  PID:2152
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" create RemoteAssist binPath= "\"C:\Program Files\RemoteAssist\RemoteAssist.exe\" --service" start= auto DisplayName= "RemoteAssist"
  2⤵
  - Launches sc.exe
  PID:4156
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" description RemoteAssist "Tiene disponibile l'assistenza remota, anche prima dell'accesso."
  2⤵
  - Launches sc.exe
  PID:3192
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" failure RemoteAssist reset= 86400 actions= restart/5000/restart/5000/restart/60000
  2⤵
  - Launches sc.exe
  PID:1656
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" start RemoteAssist
  2⤵
  - Launches sc.exe
  PID:1232

C:\Program Files\RemoteAssist\RemoteAssist.exe
"C:\Program Files\RemoteAssist\RemoteAssist.exe" --service
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4088
- C:\Program Files\RemoteAssist\RemoteAssist.exe
  "C:\Program Files\RemoteAssist\RemoteAssist.exe" --device --autostart --via-service
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4244
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=RemoteAssist.exe --webview-exe-version=1.4.8 --user-data-dir="C:\ProgramData\RemoteAssist\webview\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=4244.3864.12677581291710455924
    3⤵
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:2888
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\ProgramData\RemoteAssist\webview\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\ProgramData\RemoteAssist\webview\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x168,0x16c,0x170,0x144,0x10c,0x7ff82453b078,0x7ff82453b084,0x7ff82453b090
      4⤵
      PID:4588
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=RemoteAssist.exe --webview-exe-version=1.4.8 --user-data-dir="C:\ProgramData\RemoteAssist\webview\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=4244.3864.5878927257579483722
    3⤵
    - Modifies data under HKEY_USERS
    PID:1140
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\ProgramData\RemoteAssist\webview\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\ProgramData\RemoteAssist\webview\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x164,0x168,0x16c,0x140,0x178,0x7ff82453b078,0x7ff82453b084,0x7ff82453b090
      4⤵
      PID:2468
- C:\Program Files\RemoteAssist\RemoteAssist.exe
  "C:\Program Files\RemoteAssist\RemoteAssist.exe" --device --autostart --via-service
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:548
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=RemoteAssist.exe --webview-exe-version=1.4.8 --user-data-dir="C:\ProgramData\RemoteAssist\webview\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=548.3712.185624701538847179
    3⤵
    - Modifies data under HKEY_USERS
    PID:1368
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\ProgramData\RemoteAssist\webview\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\ProgramData\RemoteAssist\webview\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x168,0x16c,0x170,0x144,0x84,0x7ff82453b078,0x7ff82453b084,0x7ff82453b090
      4⤵
      PID:4736
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=RemoteAssist.exe --webview-exe-version=1.4.8 --user-data-dir="C:\ProgramData\RemoteAssist\webview\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=548.3712.7998824657670599436
    3⤵
    - Modifies data under HKEY_USERS
    PID:3488
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\ProgramData\RemoteAssist\webview\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\ProgramData\RemoteAssist\webview\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x164,0x168,0x16c,0x140,0x174,0x7ff82453b078,0x7ff82453b084,0x7ff82453b090
      4⤵
      PID:2396

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

RemoteAssist.exe

Path C:\Program Files\RemoteAssist\RemoteAssist.exe
Size 1018KB
SHA256 a8953a4b92f49251c774d0f4150be808a9aa834ecbe28ae9a32a1004c4810810
MD5 6d831a9b10b467adf7d0fc22805a5861
SHA1 ac6f05a9ac74e67fc0fc83574d8a4f60cf28f075
SHA512 a6bc765a3ea18a6fa04879ffbc56d3a8edaa3b0d7c289cc7ee52594439e748b314fe361d131324b50cfb2cc8851b4febf29bad08d4b24460f8efb243eac6236d
SSDEEP 12288:O8e+aJ4dCXzRKX4EcJupbSRi461R1VcrP3224c+iKmDRkRFNBMUFeA+imQ269pR/:OcaJ4dCXzRKX4EcJAD1RrQz
TLSH
T12A25701123E9421AF5F36B79D97502709BB6BE967A38C2CE069474BD0D72BC4C9A0337
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebView2Loader.dll

Path C:\ProgramData\RemoteAssist\WebView2Loader.dll
Size 159KB
SHA256 c66e4a92fdc7a216118e43b7a5024ea2200e8c43f9310bf20d96a0084f82c5bc
MD5 0243cb84351c92ddea3fc0334f3a52ae
SHA1 d80c01c98f0ed8af1be111abefcbbf6c9f3938bf
SHA512 74314c87eed82b1c9415462be3259a6626599047a18821cadc73c0c0c62cbd54948d6311ad4de9955fc2d4f2098ccb17aebeee8929ac2741bafc38ceb51a9585
SSDEEP 3072:d94EUQHTN8gVEeemaXpNbVf7W5AOVU9dPTwnhrEtJe6ub9VY/3A:3dzeDZNbbVf7W+cnhEtJC3H
TLSH
T194F35C57B3E500BBE1B7C234C9634A56E776B8115B609AEF03A4427A1F13BD0AE3D760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

service.log

Path C:\ProgramData\RemoteAssist\service.log
Size 1KB
SHA256 a90ce999633c1adebef462f74bd91d68a3dc7df8aaa3ad1e9b6d2c2a06ac7b80
MD5 2098cb7d97081d211999a6642435e308
SHA1 df30a5bf29e4cb5ffe2319f163de0cda9b3effbe
SHA512 a71e9689d0425a30c1f4e88c5c9476d4637040e170331411873ed6ad3603b7b05722729c01c2d8b138c9827731c40f1dde269ae41d0a40fa865b4496f11f550f
TLSH
T1F8317C991DC683FE09E7700B9653E6B0635CC02A5038631132EE26A51FEE85BD663C59
MD5 SHA1 SHA512 TLSH

Submit Download

service.log

Path C:\ProgramData\RemoteAssist\service.log
Size 1KB
SHA256 04a5f3f881f239abf6cffff76d73f1af49ff45c4b6ddcdfdb17eca9ae9d889ef
MD5 cd83bedc7a186437e4553814acbf7b4c
SHA1 f55c613388185c17c3b125f35ffbd9a162c73b3b
SHA512 0a6a6d34287781581c9f7f6bdd200743f3bacfc2b048f258415802aede69de145f4c279638b849e306f2f21b04e967b5975cf79c380a142f94bc8caa5453d443
TLSH
T18731A0991DC783EE49F7700B9263E6B0635DC02D1038631032EE5A951FEF86AD663C59
MD5 SHA1 SHA512 TLSH

Submit Download

service.log

Path C:\ProgramData\RemoteAssist\service.log
Size 1KB
SHA256 eb930afe11e999812555147910b686d62c251ae0dc0ee92479beb1899f3e2177
MD5 a8c4bcf5ffd70b5d8b12f7e6ed76ffe1
SHA1 dc5b58dec459f1572d1615e02fb2d1c5553d8c42
SHA512 6a8ddf5f6a39984b13d18ef41e09a8778c677b93e1f7f5675a4d74d8d75de9502e22e11c6deb9e15e01295d6722bf05de7de68ff3f13f567980ce01484e7c194
TLSH
T11031D0991CC783EE49F7700B9663E6B0635CC02E1038631132EE5A952FEF86ED663C59
MD5 SHA1 SHA512 TLSH

Submit Download

service.log

Path C:\ProgramData\RemoteAssist\service.log
Size 1KB
SHA256 040eec6bc6869c8d62687dc326b3101ffeb01ac949f2544ae09434ff7a4507d8
MD5 102de8961be1cd2485e3d94dbfde6443
SHA1 82be0fcacf7e4d0a512866fe309dbd1589dfb816
SHA512 2820948b3c3118268de70bf7b8a432a27685abf36b874e2e29c2efac3f3f9fd1813160b812de9a07de4e5ad7f53f99f931c31ebd975921eaff63ed35926f15dd
TLSH
T19E41DF991CC783EE49F7700B9263E5B0635CC02D1038631132EE6A952FEF85AD663C59
MD5 SHA1 SHA512 TLSH

Submit Download

service.log

Path C:\ProgramData\RemoteAssist\service.log
Size 2KB
SHA256 980e4fe3bd715bd89c17751d85396db7a2d0844b1e1c454ac27892182b2d0e30
MD5 5168b2b3e63bd82e289d70547b934db9
SHA1 3dfcc48a3415c494a766a218c21d384ce7e4932c
SHA512 58f4a7121434e0fadb481cf2d06b9ede3d4036f67d8db79cb1584d76068806dbbc510ada426e548aa35aa8b6e76cf2f06c57c038ab6bd3d84fca2205e951a791
TLSH
T17241FE991CC787EE44F7300B9663F1B0635DC02A1068532136EE5E952FDF86EA763C59
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\ProgramData\RemoteAssist\webview\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 2b24399a33d884944faf60d1a620acf305f6fafc5d6c21775fbf736fc1d77b25
MD5 0b05c89c769a622bed4cd360e13756c7
SHA1 c7a5e54bef17eeaed012df9397cde2ec7dd16dbf
SHA512 b7c00d7487638f79d311d29a6a973c419781c4486af8c253200e951dece93c3e3705973d5d2421e9d95cf4ecf9cf22a21c7dcf7bb15c0ee03f9ed3e5db7f198a
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\ProgramData\RemoteAssist\webview\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

RemoteAssist.exe.log

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RemoteAssist.exe.log
Size 1KB
SHA256 921f822373146927ef9c9b9b23eb4eadae594140ee51e76989201d1a835cb84e
MD5 ffef03bd1b084269a19004cb502cfa0e
SHA1 c343646c77edf5dc99676dd54b55a4354c5fd795
SHA512 ce00fc96bf0d48ccf8851f24cdc53b9d9014c671e648b28f3a48da21374689e8dcd9159d506ac2f1b09dd62e23a3b7ac45faa715bb4ad563e54d32626d838d91
TLSH
T18D31AF712276E1E849162F421D5D2A8407FF0739BA549E1CB6E8725EED2601B5F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

memory/548-54-0x000000001D9E0000-0x000000001DB89000-memory.dmp

Download

memory/4244-31-0x0000000001B00000-0x0000000001B0E000-memory.dmp

Download

memory/4244-32-0x000000001C380000-0x000000001C42E000-memory.dmp

Download

memory/4244-43-0x000000001D880000-0x000000001DA29000-memory.dmp

Download

memory/4868-0-0x0000000000350000-0x0000000000452000-memory.dmp

Download

memory/4868-18-0x000000001C200000-0x000000001C210000-memory.dmp

Download

memory/4868-10-0x000000001F200000-0x000000001F3C2000-memory.dmp

Download

memory/4868-9-0x000000001E230000-0x000000001E280000-memory.dmp

Download

memory/4868-47-0x000000001CCD0000-0x000000001CE79000-memory.dmp

Download

memory/4868-5-0x000000001CCD0000-0x000000001CE79000-memory.dmp

Download

memory/4868-6-0x000000001C200000-0x000000001C210000-memory.dmp

Download

memory/4868-3-0x000000001C200000-0x000000001C210000-memory.dmp

Download

memory/4868-2-0x000000001C200000-0x000000001C210000-memory.dmp

Download