a8953a4b92f49251c774d0f4150be808a9aa834ecbe28ae9a32a1004c4810810

Analysis

max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 12:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-01_6d831a9b10b467adf7d0fc22805a5861_glassworm_icedid.exe
Size 1018KB
Sample261002-psep2svs8q
SHA256 a8953a4b92f49251c774d0f4150be808a9aa834ecbe28ae9a32a1004c4810810
MD5 6d831a9b10b467adf7d0fc22805a5861
SHA1 ac6f05a9ac74e67fc0fc83574d8a4f60cf28f075
SHA512 a6bc765a3ea18a6fa04879ffbc56d3a8edaa3b0d7c289cc7ee52594439e748b314fe361d131324b50cfb2cc8851b4febf29bad08d4b24460f8efb243eac6236d
SSDEEP 12288:O8e+aJ4dCXzRKX4EcJupbSRi461R1VcrP3224c+iKmDRkRFNBMUFeA+imQ269pR/:OcaJ4dCXzRKX4EcJAD1RrQz
TLSH
T12A25701123E9421AF5F36B79D97502709BB6BE967A38C2CE069474BD0D72BC4C9A0337
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5112	RemoteAssist.exe
1400	RemoteAssist.exe
4792	RemoteAssist.exe

Loads dropped DLL 2 IoCs

pid	Process
1400	RemoteAssist.exe
4792	RemoteAssist.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RemoteAssist.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RemoteAssist.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\RemoteAssist\RemoteAssist.exe	2026-10-01_6d831a9b10b467adf7d0fc22805a5861_glassworm_icedid.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1744	sc.exe
264	sc.exe
5684	sc.exe
4128	sc.exe
2664	sc.exe
5708	sc.exe
3432	sc.exe
4300	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 20 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\EdgeWebView	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\EdgeWebView	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\EdgeWebView\BLBeacon	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\EdgeWebView\BLBeacon	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\EdgeWebView	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\EdgeWebView	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\EdgeWebView\BLBeacon	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\EdgeWebView\BLBeacon	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
3232	2026-10-01_6d831a9b10b467adf7d0fc22805a5861_glassworm_icedid.exe
5112	RemoteAssist.exe
5112	RemoteAssist.exe
5112	RemoteAssist.exe
5112	RemoteAssist.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3232	2026-10-01_6d831a9b10b467adf7d0fc22805a5861_glassworm_icedid.exe
Token: SeDebugPrivilege	5112	RemoteAssist.exe
Token: SeDebugPrivilege	1400	RemoteAssist.exe
Token: SeDebugPrivilege	4792	RemoteAssist.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1400	RemoteAssist.exe
1400	RemoteAssist.exe
4792	RemoteAssist.exe
4792	RemoteAssist.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
1400	RemoteAssist.exe
1400	RemoteAssist.exe
4792	RemoteAssist.exe
4792	RemoteAssist.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3232 wrote to memory of 4128	3232	2026-10-01_6d831a9b10b467adf7d0fc22805a5861_glassworm_icedid.exe	89
PID 3232 wrote to memory of 2664	3232	2026-10-01_6d831a9b10b467adf7d0fc22805a5861_glassworm_icedid.exe	91
PID 3232 wrote to memory of 5708	3232	2026-10-01_6d831a9b10b467adf7d0fc22805a5861_glassworm_icedid.exe	93
PID 3232 wrote to memory of 3432	3232	2026-10-01_6d831a9b10b467adf7d0fc22805a5861_glassworm_icedid.exe	96
PID 3232 wrote to memory of 4300	3232	2026-10-01_6d831a9b10b467adf7d0fc22805a5861_glassworm_icedid.exe	98
PID 3232 wrote to memory of 1744	3232	2026-10-01_6d831a9b10b467adf7d0fc22805a5861_glassworm_icedid.exe	100
PID 3232 wrote to memory of 264	3232	2026-10-01_6d831a9b10b467adf7d0fc22805a5861_glassworm_icedid.exe	102
PID 3232 wrote to memory of 5684	3232	2026-10-01_6d831a9b10b467adf7d0fc22805a5861_glassworm_icedid.exe	104
PID 5112 wrote to memory of 1400	5112	RemoteAssist.exe	107
PID 1400 wrote to memory of 4228	1400	RemoteAssist.exe	108
PID 4228 wrote to memory of 3844	4228	msedgewebview2.exe	109
PID 1400 wrote to memory of 3664	1400	RemoteAssist.exe	110
PID 5112 wrote to memory of 4792	5112	RemoteAssist.exe	113
PID 4792 wrote to memory of 6076	4792	RemoteAssist.exe	114
PID 4792 wrote to memory of 984	4792	RemoteAssist.exe	116

C:\Users\Admin\AppData\Local\Temp\2026-10-01_6d831a9b10b467adf7d0fc22805a5861_glassworm_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-01_6d831a9b10b467adf7d0fc22805a5861_glassworm_icedid.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3232
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" stop RemoteAssist
  2⤵
  - Launches sc.exe
  PID:4128
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" delete RemoteAssist
  2⤵
  - Launches sc.exe
  PID:2664
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" stop RemoteAssist
  2⤵
  - Launches sc.exe
  PID:5708
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" delete RemoteAssist
  2⤵
  - Launches sc.exe
  PID:3432
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" create RemoteAssist binPath= "\"C:\Program Files\RemoteAssist\RemoteAssist.exe\" --service" start= auto DisplayName= "RemoteAssist"
  2⤵
  - Launches sc.exe
  PID:4300
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" description RemoteAssist "Tiene disponibile l'assistenza remota, anche prima dell'accesso."
  2⤵
  - Launches sc.exe
  PID:1744
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" failure RemoteAssist reset= 86400 actions= restart/5000/restart/5000/restart/60000
  2⤵
  - Launches sc.exe
  PID:264
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" start RemoteAssist
  2⤵
  - Launches sc.exe
  PID:5684

C:\Program Files\RemoteAssist\RemoteAssist.exe
"C:\Program Files\RemoteAssist\RemoteAssist.exe" --service
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5112
- C:\Program Files\RemoteAssist\RemoteAssist.exe
  "C:\Program Files\RemoteAssist\RemoteAssist.exe" --device --autostart --via-service
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1400
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=RemoteAssist.exe --webview-exe-version=1.4.8 --user-data-dir="C:\ProgramData\RemoteAssist\webview\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=1400.3192.12519405147726819231 /pfhostedapp:bb726b28b906169c51134d05e9f499187e541cf0
    3⤵
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:4228
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\ProgramData\RemoteAssist\webview\EBWebView /prefetch:4 /pfhostedapp:bb726b28b906169c51134d05e9f499187e541cf0 --monitor-self-annotation=ptype=crashpad-handler --database=C:\ProgramData\RemoteAssist\webview\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x18c,0x190,0x194,0x168,0x19c,0x7ffca9245fd8,0x7ffca9245fe4,0x7ffca9245ff0
      4⤵
      PID:3844
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=RemoteAssist.exe --webview-exe-version=1.4.8 --user-data-dir="C:\ProgramData\RemoteAssist\webview\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=1400.3192.16997055646160212441 /pfhostedapp:bb726b28b906169c51134d05e9f499187e541cf0
    3⤵
    - Modifies data under HKEY_USERS
    PID:3664
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\ProgramData\RemoteAssist\webview\EBWebView /prefetch:4 /pfhostedapp:bb726b28b906169c51134d05e9f499187e541cf0 --monitor-self-annotation=ptype=crashpad-handler --database=C:\ProgramData\RemoteAssist\webview\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x18c,0x190,0x194,0x168,0x1a0,0x7ffca9245fd8,0x7ffca9245fe4,0x7ffca9245ff0
      4⤵
      PID:1484
- C:\Program Files\RemoteAssist\RemoteAssist.exe
  "C:\Program Files\RemoteAssist\RemoteAssist.exe" --device --autostart --via-service
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4792
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=RemoteAssist.exe --webview-exe-version=1.4.8 --user-data-dir="C:\ProgramData\RemoteAssist\webview\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=4792.4796.2554654565643460516 /pfhostedapp:bb726b28b906169c51134d05e9f499187e541cf0
    3⤵
    - Modifies data under HKEY_USERS
    PID:6076
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\ProgramData\RemoteAssist\webview\EBWebView /prefetch:4 /pfhostedapp:bb726b28b906169c51134d05e9f499187e541cf0 --monitor-self-annotation=ptype=crashpad-handler --database=C:\ProgramData\RemoteAssist\webview\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x18c,0x190,0x194,0x168,0x1a0,0x7ffca9245fd8,0x7ffca9245fe4,0x7ffca9245ff0
      4⤵
      PID:1224
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=RemoteAssist.exe --webview-exe-version=1.4.8 --user-data-dir="C:\ProgramData\RemoteAssist\webview\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=4792.4796.12193647908447350502 /pfhostedapp:bb726b28b906169c51134d05e9f499187e541cf0
    3⤵
    - Modifies data under HKEY_USERS
    PID:984
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\ProgramData\RemoteAssist\webview\EBWebView /prefetch:4 /pfhostedapp:bb726b28b906169c51134d05e9f499187e541cf0 --monitor-self-annotation=ptype=crashpad-handler --database=C:\ProgramData\RemoteAssist\webview\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x18c,0x190,0x194,0x168,0x1a0,0x7ffca9245fd8,0x7ffca9245fe4,0x7ffca9245ff0
      4⤵
      PID:1312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

RemoteAssist.exe

Path C:\Program Files\RemoteAssist\RemoteAssist.exe
Size 1018KB
SHA256 a8953a4b92f49251c774d0f4150be808a9aa834ecbe28ae9a32a1004c4810810
MD5 6d831a9b10b467adf7d0fc22805a5861
SHA1 ac6f05a9ac74e67fc0fc83574d8a4f60cf28f075
SHA512 a6bc765a3ea18a6fa04879ffbc56d3a8edaa3b0d7c289cc7ee52594439e748b314fe361d131324b50cfb2cc8851b4febf29bad08d4b24460f8efb243eac6236d
SSDEEP 12288:O8e+aJ4dCXzRKX4EcJupbSRi461R1VcrP3224c+iKmDRkRFNBMUFeA+imQ269pR/:OcaJ4dCXzRKX4EcJAD1RrQz
TLSH
T12A25701123E9421AF5F36B79D97502709BB6BE967A38C2CE069474BD0D72BC4C9A0337
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebView2Loader.dll

Path C:\ProgramData\RemoteAssist\WebView2Loader.dll
Size 159KB
SHA256 c66e4a92fdc7a216118e43b7a5024ea2200e8c43f9310bf20d96a0084f82c5bc
MD5 0243cb84351c92ddea3fc0334f3a52ae
SHA1 d80c01c98f0ed8af1be111abefcbbf6c9f3938bf
SHA512 74314c87eed82b1c9415462be3259a6626599047a18821cadc73c0c0c62cbd54948d6311ad4de9955fc2d4f2098ccb17aebeee8929ac2741bafc38ceb51a9585
SSDEEP 3072:d94EUQHTN8gVEeemaXpNbVf7W5AOVU9dPTwnhrEtJe6ub9VY/3A:3dzeDZNbbVf7W+cnhEtJC3H
TLSH
T194F35C57B3E500BBE1B7C234C9634A56E776B8115B609AEF03A4427A1F13BD0AE3D760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

service.log

Path C:\ProgramData\RemoteAssist\service.log
Size 1KB
SHA256 db61e05e0724ce984caed324680823a38ede4e15f922be4427afd0f196330dd8
MD5 8aec1ece88491f5650f37d8b511c6b3f
SHA1 7abb75b38412fe1b4fff6fc88bf42e436d750b92
SHA512 e7fd642e82f4aae593dfd9a765249c85057305f67a145ac390870b8a92ee082ba0b45a55633618f7f410afa6877365d508ece1413145fe35ca7e082166a34f83
TLSH
T1DF31AC8D0DC647EE59FB700B9153E6B06358C02A1138A31032EE2AA51FFF86BDA57C59
MD5 SHA1 SHA512 TLSH

Submit Download

service.log

Path C:\ProgramData\RemoteAssist\service.log
Size 1KB
SHA256 49763d35556721f45ca3e4d1e145d3bb7288e767003727945ad17489bdb53be8
MD5 f1ac52dec8ae472aee6d1e3767b354b5
SHA1 10dc81ada920e6d00971d44db316a668a00974a7
SHA512 33408db4282ef3b95bfbcb12bb61649fd425cf6ff70f1ba42243c10cd9e683c1458107ca7625881e6e0666db77b592043e02fdcdfe9786d826785d6d2623036a
TLSH
T12631A0890CC647EE49FB700B9163E5B0635DC42E1138A31032EE1AA52FFF86BDA57C59
MD5 SHA1 SHA512 TLSH

Submit Download

service.log

Path C:\ProgramData\RemoteAssist\service.log
Size 1KB
SHA256 6e887ad254cbb33f5eba0fdae1363cc4ef14893a1cf625d785324bd71b03ffec
MD5 f2dcfb58a9c8a1494e60980879f87d66
SHA1 3c5026b8a2aac8355932d73e00612595a0143a83
SHA512 e44f05e50d7819ef84ae3bd2105e693cd4b4aa702d59e896ae1c59ff606d8a551c7a29b61c1d9045da4ab10daaffa1bfde83c2a2ffaba6c4ecf0ef713c203571
TLSH
T18931C1891CC647EE59F7700B9563E5B0635CC42B1138A31033EE1AA52FEF85B9A47C59
MD5 SHA1 SHA512 TLSH

Submit Download

service.log

Path C:\ProgramData\RemoteAssist\service.log
Size 1KB
SHA256 bf040ef1208517f45de4fdc78912348dfacc80b2a6c35b0159df9994ff79fde7
MD5 670e8a139fc9ea8ff2748005172d2d9a
SHA1 3d5f0f128416c3b314f6e6f8b433fa205e6ebe9b
SHA512 7afd239649ac3f0aee3c8bf32a73ae83ded5d86bad56785948617d83cf6b6fe431139c05c748a6f1a39f9674514533d53e1108bd2494229fdd2e3e978c6657c3
TLSH
T1224101890CC607EE49F7300B9163F5B0635DC42A1138A31032EE1A652FEF86AAB47C5A
MD5 SHA1 SHA512 TLSH

Submit Download

service.log

Path C:\ProgramData\RemoteAssist\service.log
Size 2KB
SHA256 ce2f93fb53a6ad3f9283f065d9e983f6dfd72ce03894f63cc9e958e9c3ec6d80
MD5 682c4e394775a34f45a0b2edc4fe388b
SHA1 9038f2aba1e0e6bc79fcca3e9b956de803a1f8a4
SHA512 574f882bc1161a4bd73132de9fa404de5f1cabf00f76fe4fb5a9f6dd1b81f31b092228f227358731a43d38a7e95d2d99d4289ce477947034d31c72063ca0a039
TLSH
T19441F1891CC607EE48F7300B9567F1B0631DC42A1138A31036EE5AA56FEF85AA747C59
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\ProgramData\RemoteAssist\webview\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 b51b1fdef2236b014117da5e2954232c9f79696d031a3043ad0369ed63506744
MD5 12255d3d175691817b60d77fc73cffc7
SHA1 1b1555e26113e40638d6c2bc96e4911d47cfdfe2
SHA512 6e3b30d73208712570f5643f68a1289219715667f803eaa15733daeb1a6495afeb4a1564dd5e7847b3d08146e84e351416cd54091c915a04a508237545b49415
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\ProgramData\RemoteAssist\webview\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

memory/1400-33-0x000000001C630000-0x000000001C6DE000-memory.dmp

Download

memory/1400-32-0x0000000001830000-0x000000000183E000-memory.dmp

Download

memory/3232-19-0x00007FFCAE260000-0x00007FFCAEC04000-memory.dmp

Download

memory/3232-35-0x00007FFCAE260000-0x00007FFCAEC04000-memory.dmp

Download

memory/3232-17-0x00007FFCAE260000-0x00007FFCAEC04000-memory.dmp

Download

memory/3232-13-0x0000000020C50000-0x0000000020E12000-memory.dmp

Download

memory/3232-12-0x0000000020A30000-0x0000000020A80000-memory.dmp

Download

memory/3232-9-0x00007FFCAE260000-0x00007FFCAEC04000-memory.dmp

Download

memory/3232-34-0x00007FFCAE260000-0x00007FFCAEC04000-memory.dmp

Download

memory/3232-1-0x00000000002B0000-0x00000000003B2000-memory.dmp

Download

memory/3232-8-0x00007FFCAE260000-0x00007FFCAEC04000-memory.dmp

Download

memory/3232-7-0x00007FFCAE260000-0x00007FFCAEC04000-memory.dmp

Download

memory/3232-6-0x00007FFCAE260000-0x00007FFCAEC04000-memory.dmp

Download

memory/3232-5-0x00007FFCAE260000-0x00007FFCAEC04000-memory.dmp

Download

memory/3232-46-0x00007FFCAE260000-0x00007FFCAEC04000-memory.dmp

Download

memory/3232-4-0x00007FFCAE260000-0x00007FFCAEC04000-memory.dmp

Download

memory/3232-3-0x00007FFCAE260000-0x00007FFCAEC04000-memory.dmp

Download

memory/3232-0-0x00007FFCAE3EF000-0x00007FFCAE3F0000-memory.dmp

Download