f31e99405a3dd500e6845859daf9e5bc1d97e31b8d21cf9043cd1a963372a76c

Analysis

max time kernel
151s
max time network
158s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 08:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f31e99405a3dd500e6845859daf9e5bc1d97e31b8d21cf9043cd1a963372a76c.exe
Size 64.5MB
Sample260820-krnt4scd25
SHA256 f31e99405a3dd500e6845859daf9e5bc1d97e31b8d21cf9043cd1a963372a76c
MD5 6eb57984693009e05dcd0db8a71325b0
SHA1 4f4b7db1c2138a91e50a887183c72d099beb3f92
SHA512 8a1177ab193c48b63d97ec9ffd739a0ad70209ae8bfaa70611f9ea43259a8aa64bbbe7aadc049360bc3bf324418cee533d2e46b2c738af5d6bca24dacb9d9ba0
SSDEEP 393216:z115ar3gQhA5GnUORD49O4lZfoYrb1Hxglb/vE5L5OtsFtHNTac9d44scJPJ0ugg:wDJUOl49x71HCUV5OtsFdtaCs4t
TLSH
T175E7AF15B3D80A06E63FC27DC6638112E7F1B4931352D6CF0558EA992F53BC1AB3B266
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion execution persistence privilege_escalation

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 5 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EmbedHealth-Bootstrap.vbs	f31e99405a3dd500e6845859daf9e5bc1d97e31b8d21cf9043cd1a963372a76c.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EmbedHealth-Bootstrap.vbs	f31e99405a3dd500e6845859daf9e5bc1d97e31b8d21cf9043cd1a963372a76c.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EmbedHealth-Bootstrap.vbs	EmbedHealth.Bootstrap.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EmbedHealth-Bootstrap.vbs	f31e99405a3dd500e6845859daf9e5bc1d97e31b8d21cf9043cd1a963372a76c.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EmbedHealth-Bootstrap.vbs	EmbedHealth.Bootstrap.exe

Executes dropped EXE 2 IoCs

pid	Process
2628	EmbedHealth.Bootstrap.exe
4684	EmbedHealth.Bootstrap.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\EmbedHealth-Bootstrap = "\"C:\\Users\\Admin\\AppData\\Local\\EmbedHealth\\bootstrap\\EmbedHealth.Bootstrap.exe\" --daemon"	EmbedHealth.Bootstrap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\EmbedHealth-Bootstrap = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\f31e99405a3dd500e6845859daf9e5bc1d97e31b8d21cf9043cd1a963372a76c.exe\" --daemon"	f31e99405a3dd500e6845859daf9e5bc1d97e31b8d21cf9043cd1a963372a76c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\EmbedHealth-Bootstrap = "\"C:\\Users\\Admin\\AppData\\Local\\EmbedHealth\\bootstrap\\EmbedHealth.Bootstrap.exe\" --daemon"	EmbedHealth.Bootstrap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\EmbedHealth-Bootstrap = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\f31e99405a3dd500e6845859daf9e5bc1d97e31b8d21cf9043cd1a963372a76c.exe\" --daemon"	f31e99405a3dd500e6845859daf9e5bc1d97e31b8d21cf9043cd1a963372a76c.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Scheduled Task/Job: Scheduled Task 1 TTPs 7 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3280	schtasks.exe
2988	schtasks.exe
5312	schtasks.exe
4372	schtasks.exe
5924	schtasks.exe
1268	schtasks.exe
5696	schtasks.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
6004	powershell.exe
6004	powershell.exe
4848	powershell.exe
4848	powershell.exe
4848	powershell.exe
5164	f31e99405a3dd500e6845859daf9e5bc1d97e31b8d21cf9043cd1a963372a76c.exe
4684	EmbedHealth.Bootstrap.exe
4684	EmbedHealth.Bootstrap.exe
2628	EmbedHealth.Bootstrap.exe
5164	f31e99405a3dd500e6845859daf9e5bc1d97e31b8d21cf9043cd1a963372a76c.exe
5164	f31e99405a3dd500e6845859daf9e5bc1d97e31b8d21cf9043cd1a963372a76c.exe
6040	f31e99405a3dd500e6845859daf9e5bc1d97e31b8d21cf9043cd1a963372a76c.exe
6040	f31e99405a3dd500e6845859daf9e5bc1d97e31b8d21cf9043cd1a963372a76c.exe
2628	EmbedHealth.Bootstrap.exe
4292	f31e99405a3dd500e6845859daf9e5bc1d97e31b8d21cf9043cd1a963372a76c.exe
4684	EmbedHealth.Bootstrap.exe
4292	f31e99405a3dd500e6845859daf9e5bc1d97e31b8d21cf9043cd1a963372a76c.exe
5164	f31e99405a3dd500e6845859daf9e5bc1d97e31b8d21cf9043cd1a963372a76c.exe
5164	f31e99405a3dd500e6845859daf9e5bc1d97e31b8d21cf9043cd1a963372a76c.exe
2628	EmbedHealth.Bootstrap.exe
4684	EmbedHealth.Bootstrap.exe
4684	EmbedHealth.Bootstrap.exe
6040	f31e99405a3dd500e6845859daf9e5bc1d97e31b8d21cf9043cd1a963372a76c.exe
4292	f31e99405a3dd500e6845859daf9e5bc1d97e31b8d21cf9043cd1a963372a76c.exe
4292	f31e99405a3dd500e6845859daf9e5bc1d97e31b8d21cf9043cd1a963372a76c.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	6040	f31e99405a3dd500e6845859daf9e5bc1d97e31b8d21cf9043cd1a963372a76c.exe
Token: SeDebugPrivilege	6004	powershell.exe
Token: SeDebugPrivilege	5164	f31e99405a3dd500e6845859daf9e5bc1d97e31b8d21cf9043cd1a963372a76c.exe
Token: SeDebugPrivilege	4848	powershell.exe
Token: SeIncreaseQuotaPrivilege	6004	powershell.exe
Token: SeSecurityPrivilege	6004	powershell.exe
Token: SeTakeOwnershipPrivilege	6004	powershell.exe
Token: SeLoadDriverPrivilege	6004	powershell.exe
Token: SeSystemProfilePrivilege	6004	powershell.exe
Token: SeSystemtimePrivilege	6004	powershell.exe
Token: SeProfSingleProcessPrivilege	6004	powershell.exe
Token: SeIncBasePriorityPrivilege	6004	powershell.exe
Token: SeCreatePagefilePrivilege	6004	powershell.exe
Token: SeBackupPrivilege	6004	powershell.exe
Token: SeRestorePrivilege	6004	powershell.exe
Token: SeShutdownPrivilege	6004	powershell.exe
Token: SeDebugPrivilege	6004	powershell.exe
Token: SeSystemEnvironmentPrivilege	6004	powershell.exe
Token: SeRemoteShutdownPrivilege	6004	powershell.exe
Token: SeUndockPrivilege	6004	powershell.exe
Token: SeManageVolumePrivilege	6004	powershell.exe
Token: 33	6004	powershell.exe
Token: 34	6004	powershell.exe
Token: 35	6004	powershell.exe
Token: 36	6004	powershell.exe
Token: SeIncreaseQuotaPrivilege	4848	powershell.exe
Token: SeSecurityPrivilege	4848	powershell.exe
Token: SeTakeOwnershipPrivilege	4848	powershell.exe
Token: SeLoadDriverPrivilege	4848	powershell.exe
Token: SeSystemProfilePrivilege	4848	powershell.exe
Token: SeSystemtimePrivilege	4848	powershell.exe
Token: SeProfSingleProcessPrivilege	4848	powershell.exe
Token: SeIncBasePriorityPrivilege	4848	powershell.exe
Token: SeCreatePagefilePrivilege	4848	powershell.exe
Token: SeBackupPrivilege	4848	powershell.exe
Token: SeRestorePrivilege	4848	powershell.exe
Token: SeShutdownPrivilege	4848	powershell.exe
Token: SeDebugPrivilege	4848	powershell.exe
Token: SeSystemEnvironmentPrivilege	4848	powershell.exe
Token: SeRemoteShutdownPrivilege	4848	powershell.exe
Token: SeUndockPrivilege	4848	powershell.exe
Token: SeManageVolumePrivilege	4848	powershell.exe
Token: 33	4848	powershell.exe
Token: 34	4848	powershell.exe
Token: 35	4848	powershell.exe
Token: 36	4848	powershell.exe
Token: SeIncreaseQuotaPrivilege	4848	powershell.exe
Token: SeSecurityPrivilege	4848	powershell.exe
Token: SeTakeOwnershipPrivilege	4848	powershell.exe
Token: SeLoadDriverPrivilege	4848	powershell.exe
Token: SeSystemProfilePrivilege	4848	powershell.exe
Token: SeSystemtimePrivilege	4848	powershell.exe
Token: SeProfSingleProcessPrivilege	4848	powershell.exe
Token: SeIncBasePriorityPrivilege	4848	powershell.exe
Token: SeCreatePagefilePrivilege	4848	powershell.exe
Token: SeBackupPrivilege	4848	powershell.exe
Token: SeRestorePrivilege	4848	powershell.exe
Token: SeShutdownPrivilege	4848	powershell.exe
Token: SeDebugPrivilege	4848	powershell.exe
Token: SeSystemEnvironmentPrivilege	4848	powershell.exe
Token: SeRemoteShutdownPrivilege	4848	powershell.exe
Token: SeUndockPrivilege	4848	powershell.exe
Token: SeManageVolumePrivilege	4848	powershell.exe
Token: 33	4848	powershell.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 6040 wrote to memory of 4108	6040	f31e99405a3dd500e6845859daf9e5bc1d97e31b8d21cf9043cd1a963372a76c.exe	89
PID 6040 wrote to memory of 6004	6040	f31e99405a3dd500e6845859daf9e5bc1d97e31b8d21cf9043cd1a963372a76c.exe	91
PID 5164 wrote to memory of 1160	5164	f31e99405a3dd500e6845859daf9e5bc1d97e31b8d21cf9043cd1a963372a76c.exe	95
PID 5164 wrote to memory of 4848	5164	f31e99405a3dd500e6845859daf9e5bc1d97e31b8d21cf9043cd1a963372a76c.exe	97
PID 6040 wrote to memory of 5312	6040	f31e99405a3dd500e6845859daf9e5bc1d97e31b8d21cf9043cd1a963372a76c.exe	100
PID 5164 wrote to memory of 5500	5164	f31e99405a3dd500e6845859daf9e5bc1d97e31b8d21cf9043cd1a963372a76c.exe	103
PID 5164 wrote to memory of 2884	5164	f31e99405a3dd500e6845859daf9e5bc1d97e31b8d21cf9043cd1a963372a76c.exe	105
PID 2628 wrote to memory of 5796	2628	EmbedHealth.Bootstrap.exe	108
PID 2628 wrote to memory of 4372	2628	EmbedHealth.Bootstrap.exe	111
PID 4684 wrote to memory of 2980	4684	EmbedHealth.Bootstrap.exe	114
PID 4684 wrote to memory of 1704	4684	EmbedHealth.Bootstrap.exe	116
PID 4684 wrote to memory of 4896	4684	EmbedHealth.Bootstrap.exe	118
PID 5164 wrote to memory of 1880	5164	f31e99405a3dd500e6845859daf9e5bc1d97e31b8d21cf9043cd1a963372a76c.exe	120
PID 4684 wrote to memory of 3768	4684	EmbedHealth.Bootstrap.exe	122
PID 4684 wrote to memory of 5924	4684	EmbedHealth.Bootstrap.exe	124
PID 2628 wrote to memory of 1832	2628	EmbedHealth.Bootstrap.exe	126
PID 2628 wrote to memory of 3288	2628	EmbedHealth.Bootstrap.exe	128
PID 2628 wrote to memory of 4904	2628	EmbedHealth.Bootstrap.exe	130
PID 5164 wrote to memory of 1268	5164	f31e99405a3dd500e6845859daf9e5bc1d97e31b8d21cf9043cd1a963372a76c.exe	132
PID 6040 wrote to memory of 2788	6040	f31e99405a3dd500e6845859daf9e5bc1d97e31b8d21cf9043cd1a963372a76c.exe	134
PID 6040 wrote to memory of 2032	6040	f31e99405a3dd500e6845859daf9e5bc1d97e31b8d21cf9043cd1a963372a76c.exe	136
PID 6040 wrote to memory of 3744	6040	f31e99405a3dd500e6845859daf9e5bc1d97e31b8d21cf9043cd1a963372a76c.exe	138
PID 6040 wrote to memory of 5696	6040	f31e99405a3dd500e6845859daf9e5bc1d97e31b8d21cf9043cd1a963372a76c.exe	140
PID 2628 wrote to memory of 3280	2628	EmbedHealth.Bootstrap.exe	142
PID 4292 wrote to memory of 2884	4292	f31e99405a3dd500e6845859daf9e5bc1d97e31b8d21cf9043cd1a963372a76c.exe	145
PID 4292 wrote to memory of 3376	4292	f31e99405a3dd500e6845859daf9e5bc1d97e31b8d21cf9043cd1a963372a76c.exe	147
PID 4292 wrote to memory of 1104	4292	f31e99405a3dd500e6845859daf9e5bc1d97e31b8d21cf9043cd1a963372a76c.exe	149
PID 4292 wrote to memory of 5616	4292	f31e99405a3dd500e6845859daf9e5bc1d97e31b8d21cf9043cd1a963372a76c.exe	151
PID 4292 wrote to memory of 2988	4292	f31e99405a3dd500e6845859daf9e5bc1d97e31b8d21cf9043cd1a963372a76c.exe	153
PID 5164 wrote to memory of 2352	5164	f31e99405a3dd500e6845859daf9e5bc1d97e31b8d21cf9043cd1a963372a76c.exe	155
PID 2628 wrote to memory of 5184	2628	EmbedHealth.Bootstrap.exe	157
PID 4684 wrote to memory of 1160	4684	EmbedHealth.Bootstrap.exe	159
PID 4292 wrote to memory of 3472	4292	f31e99405a3dd500e6845859daf9e5bc1d97e31b8d21cf9043cd1a963372a76c.exe	161

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\f31e99405a3dd500e6845859daf9e5bc1d97e31b8d21cf9043cd1a963372a76c.exe
"C:\Users\Admin\AppData\Local\Temp\f31e99405a3dd500e6845859daf9e5bc1d97e31b8d21cf9043cd1a963372a76c.exe"
1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6040
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Query /TN "EmbedHealth Bootstrap Daemon"
  2⤵
  PID:4108
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAJABhAGMAdABpAG8AbgA9AE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBBAGMAdABpAG8AbgAgAC0ARQB4AGUAYwB1AHQAZQAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABmADMAMQBlADkAOQA0ADAANQBhADMAZABkADUAMAAwAGUANgA4ADQANQA4ADUAOQBkAGEAZgA5AGUANQBiAGMAMQBkADkANwBlADMAMQBiADgAZAAyADEAYwBmADkAMAA0ADMAYwBkADEAYQA5ADYAMwAzADcAMgBhADcANgBjAC4AZQB4AGUAJwAgAC0AQQByAGcAdQBtAGUAbgB0ACAAJwAtAC0AZABhAGUAbQBvAG4AJwA7ACQAbABvAGcAbwBuAD0ATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFQAcgBpAGcAZwBlAHIAIAAtAEEAdABMAG8AZwBPAG4AIAAtAFUAcwBlAHIAIAAnAFUAUwBKAE4AQwBYAEoATABcAEEAZABtAGkAbgAnADsAJAByAGUAcAA9AE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBPAG4AYwBlACAALQBBAHQAIAAoAEcAZQB0AC0ARABhAHQAZQApAC4AQQBkAGQATQBpAG4AdQB0AGUAcwAoADEAKQAgAC0AUgBlAHAAZQB0AGkAdABpAG8AbgBJAG4AdABlAHIAdgBhAGwAIAAoAE4AZQB3AC0AVABpAG0AZQBTAHAAYQBuACAALQBNAGkAbgB1AHQAZQBzACAAMQA1ACkAOwAkAHAAcgBpAG4AYwBpAHAAYQBsAD0ATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFAAcgBpAG4AYwBpAHAAYQBsACAALQBVAHMAZQByAEkAZAAgACcAVQBTAEoATgBDAFgASgBMAFwAQQBkAG0AaQBuACcAIAAtAEwAbwBnAG8AbgBUAHkAcABlACAASQBuAHQAZQByAGEAYwB0AGkAdgBlACAALQBSAHUAbgBMAGUAdgBlAGwAIABMAGkAbQBpAHQAZQBkADsAJABzAGUAdAB0AGkAbgBnAHMAPQBOAGUAdwAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAUwBlAHQAdABpAG4AZwBzAFMAZQB0ACAALQBBAGwAbABvAHcAUwB0AGEAcgB0AEkAZgBPAG4AQgBhAHQAdABlAHIAaQBlAHMAIAAtAEQAbwBuAHQAUwB0AG8AcABJAGYARwBvAGkAbgBnAE8AbgBCAGEAdAB0AGUAcgBpAGUAcwAgAC0AUwB0AGEAcgB0AFcAaABlAG4AQQB2AGEAaQBsAGEAYgBsAGUAIAAtAFIAZQBzAHQAYQByAHQAQwBvAHUAbgB0ACAAMwAgAC0AUgBlAHMAdABhAHIAdABJAG4AdABlAHIAdgBhAGwAIAAoAE4AZQB3AC0AVABpAG0AZQBTAHAAYQBuACAALQBNAGkAbgB1AHQAZQBzACAAMQApACAALQBFAHgAZQBjAHUAdABpAG8AbgBUAGkAbQBlAEwAaQBtAGkAdAAgACgAWwBUAGkAbQBlAFMAcABhAG4AXQA6ADoAWgBlAHIAbwApACAALQBNAHUAbAB0AGkAcABsAGUASQBuAHMAdABhAG4AYwBlAHMAIABJAGcAbgBvAHIAZQBOAGUAdwA7AFIAZQBnAGkAcwB0AGUAcgAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcARQBtAGIAZQBkAEgAZQBhAGwAdABoACAAQgBvAG8AdABzAHQAcgBhAHAAIABEAGEAZQBtAG8AbgAnACAALQBBAGMAdABpAG8AbgAgACQAYQBjAHQAaQBvAG4AIAAtAFQAcgBpAGcAZwBlAHIAIAAkAGwAbwBnAG8AbgAsACQAcgBlAHAAIAAtAFAAcgBpAG4AYwBpAHAAYQBsACAAJABwAHIAaQBuAGMAaQBwAGEAbAAgAC0AUwBlAHQAdABpAG4AZwBzACAAJABzAGUAdAB0AGkAbgBnAHMAIAAtAEQAZQBzAGMAcgBpAHAAdABpAG8AbgAgACcARQBtAGIAZQBkAEgAZQBhAGwAdABoACAAQgBvAG8AdABzAHQAcgBhAHAAIABEAGEAZQBtAG8AbgAgABQgIABhAHUAdABvAC0AbQBhAG4AYQBnAGUAZAAnACAALQBGAG8AcgBjAGUAIAB8ACAATwB1AHQALQBOAHUAbABsAA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6004
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "EmbedHealth Recovery" /XML C:\Users\Admin\AppData\Local\EmbedHealth\state\recovery-task.xml /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5312
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Query /TN "EmbedHealth Bootstrap Daemon"
  2⤵
  PID:2788
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Query /TN "EmbedHealth Bootstrap Daemon"
  2⤵
  PID:2032
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Query /TN "EmbedHealth Bootstrap Daemon"
  2⤵
  PID:3744
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "EmbedHealth Recovery" /XML C:\Users\Admin\AppData\Local\EmbedHealth\state\recovery-task.xml /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5696

C:\Users\Admin\AppData\Local\Temp\f31e99405a3dd500e6845859daf9e5bc1d97e31b8d21cf9043cd1a963372a76c.exe
"C:\Users\Admin\AppData\Local\Temp\f31e99405a3dd500e6845859daf9e5bc1d97e31b8d21cf9043cd1a963372a76c.exe" --daemon
1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5164
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Query /TN "EmbedHealth Bootstrap Daemon"
  2⤵
  PID:1160
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAJABhAGMAdABpAG8AbgA9AE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBBAGMAdABpAG8AbgAgAC0ARQB4AGUAYwB1AHQAZQAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABmADMAMQBlADkAOQA0ADAANQBhADMAZABkADUAMAAwAGUANgA4ADQANQA4ADUAOQBkAGEAZgA5AGUANQBiAGMAMQBkADkANwBlADMAMQBiADgAZAAyADEAYwBmADkAMAA0ADMAYwBkADEAYQA5ADYAMwAzADcAMgBhADcANgBjAC4AZQB4AGUAJwAgAC0AQQByAGcAdQBtAGUAbgB0ACAAJwAtAC0AZABhAGUAbQBvAG4AJwA7ACQAbABvAGcAbwBuAD0ATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFQAcgBpAGcAZwBlAHIAIAAtAEEAdABMAG8AZwBPAG4AIAAtAFUAcwBlAHIAIAAnAFUAUwBKAE4AQwBYAEoATABcAEEAZABtAGkAbgAnADsAJAByAGUAcAA9AE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBPAG4AYwBlACAALQBBAHQAIAAoAEcAZQB0AC0ARABhAHQAZQApAC4AQQBkAGQATQBpAG4AdQB0AGUAcwAoADEAKQAgAC0AUgBlAHAAZQB0AGkAdABpAG8AbgBJAG4AdABlAHIAdgBhAGwAIAAoAE4AZQB3AC0AVABpAG0AZQBTAHAAYQBuACAALQBNAGkAbgB1AHQAZQBzACAAMQA1ACkAOwAkAHAAcgBpAG4AYwBpAHAAYQBsAD0ATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFAAcgBpAG4AYwBpAHAAYQBsACAALQBVAHMAZQByAEkAZAAgACcAVQBTAEoATgBDAFgASgBMAFwAQQBkAG0AaQBuACcAIAAtAEwAbwBnAG8AbgBUAHkAcABlACAASQBuAHQAZQByAGEAYwB0AGkAdgBlACAALQBSAHUAbgBMAGUAdgBlAGwAIABMAGkAbQBpAHQAZQBkADsAJABzAGUAdAB0AGkAbgBnAHMAPQBOAGUAdwAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAUwBlAHQAdABpAG4AZwBzAFMAZQB0ACAALQBBAGwAbABvAHcAUwB0AGEAcgB0AEkAZgBPAG4AQgBhAHQAdABlAHIAaQBlAHMAIAAtAEQAbwBuAHQAUwB0AG8AcABJAGYARwBvAGkAbgBnAE8AbgBCAGEAdAB0AGUAcgBpAGUAcwAgAC0AUwB0AGEAcgB0AFcAaABlAG4AQQB2AGEAaQBsAGEAYgBsAGUAIAAtAFIAZQBzAHQAYQByAHQAQwBvAHUAbgB0ACAAMwAgAC0AUgBlAHMAdABhAHIAdABJAG4AdABlAHIAdgBhAGwAIAAoAE4AZQB3AC0AVABpAG0AZQBTAHAAYQBuACAALQBNAGkAbgB1AHQAZQBzACAAMQApACAALQBFAHgAZQBjAHUAdABpAG8AbgBUAGkAbQBlAEwAaQBtAGkAdAAgACgAWwBUAGkAbQBlAFMAcABhAG4AXQA6ADoAWgBlAHIAbwApACAALQBNAHUAbAB0AGkAcABsAGUASQBuAHMAdABhAG4AYwBlAHMAIABJAGcAbgBvAHIAZQBOAGUAdwA7AFIAZQBnAGkAcwB0AGUAcgAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcARQBtAGIAZQBkAEgAZQBhAGwAdABoACAAQgBvAG8AdABzAHQAcgBhAHAAIABEAGEAZQBtAG8AbgAnACAALQBBAGMAdABpAG8AbgAgACQAYQBjAHQAaQBvAG4AIAAtAFQAcgBpAGcAZwBlAHIAIAAkAGwAbwBnAG8AbgAsACQAcgBlAHAAIAAtAFAAcgBpAG4AYwBpAHAAYQBsACAAJABwAHIAaQBuAGMAaQBwAGEAbAAgAC0AUwBlAHQAdABpAG4AZwBzACAAJABzAGUAdAB0AGkAbgBnAHMAIAAtAEQAZQBzAGMAcgBpAHAAdABpAG8AbgAgACcARQBtAGIAZQBkAEgAZQBhAGwAdABoACAAQgBvAG8AdABzAHQAcgBhAHAAIABEAGEAZQBtAG8AbgAgABQgIABhAHUAdABvAC0AbQBhAG4AYQBnAGUAZAAnACAALQBGAG8AcgBjAGUAIAB8ACAATwB1AHQALQBOAHUAbABsAA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4848
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Query /TN "EmbedHealth Bootstrap Daemon"
  2⤵
  PID:5500
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Query /TN "EmbedHealth Bootstrap Daemon"
  2⤵
  PID:2884
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Query /TN "EmbedHealth Bootstrap Daemon"
  2⤵
  PID:1880
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "EmbedHealth Recovery" /XML C:\Users\Admin\AppData\Local\EmbedHealth\state\recovery-task.xml /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1268
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Query /TN "EmbedHealth Bootstrap Daemon"
  2⤵
  PID:2352

C:\Users\Admin\AppData\Local\EmbedHealth\bootstrap\EmbedHealth.Bootstrap.exe
C:\Users\Admin\AppData\Local\EmbedHealth\bootstrap\EmbedHealth.Bootstrap.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Query /TN "EmbedHealth Bootstrap Daemon"
  2⤵
  PID:5796
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "EmbedHealth Recovery" /XML C:\Users\Admin\AppData\Local\EmbedHealth\state\recovery-task.xml /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4372
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Query /TN "EmbedHealth Bootstrap Daemon"
  2⤵
  PID:1832
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Query /TN "EmbedHealth Bootstrap Daemon"
  2⤵
  PID:3288
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Query /TN "EmbedHealth Bootstrap Daemon"
  2⤵
  PID:4904
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "EmbedHealth Recovery" /XML C:\Users\Admin\AppData\Local\EmbedHealth\state\recovery-task.xml /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3280
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Query /TN "EmbedHealth Bootstrap Daemon"
  2⤵
  PID:5184

C:\Users\Admin\AppData\Local\EmbedHealth\bootstrap\EmbedHealth.Bootstrap.exe
"C:\Users\Admin\AppData\Local\EmbedHealth\bootstrap\EmbedHealth.Bootstrap.exe" --daemon
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4684
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Query /TN "EmbedHealth Bootstrap Daemon"
  2⤵
  PID:2980
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Query /TN "EmbedHealth Bootstrap Daemon"
  2⤵
  PID:1704
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Query /TN "EmbedHealth Bootstrap Daemon"
  2⤵
  PID:4896
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Query /TN "EmbedHealth Bootstrap Daemon"
  2⤵
  PID:3768
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "EmbedHealth Recovery" /XML C:\Users\Admin\AppData\Local\EmbedHealth\state\recovery-task.xml /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5924
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Query /TN "EmbedHealth Bootstrap Daemon"
  2⤵
  PID:1160

C:\Users\Admin\AppData\Local\Temp\f31e99405a3dd500e6845859daf9e5bc1d97e31b8d21cf9043cd1a963372a76c.exe
"C:\Users\Admin\AppData\Local\Temp\f31e99405a3dd500e6845859daf9e5bc1d97e31b8d21cf9043cd1a963372a76c.exe" --daemon
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4292
- C:\Windows\system32\schtasks.exe
  "schtasks.exe" /Query /TN "EmbedHealth Bootstrap Daemon"
  2⤵
  PID:2884
- C:\Windows\system32\schtasks.exe
  "schtasks.exe" /Query /TN "EmbedHealth Bootstrap Daemon"
  2⤵
  PID:3376
- C:\Windows\system32\schtasks.exe
  "schtasks.exe" /Query /TN "EmbedHealth Bootstrap Daemon"
  2⤵
  PID:1104
- C:\Windows\system32\schtasks.exe
  "schtasks.exe" /Query /TN "EmbedHealth Bootstrap Daemon"
  2⤵
  PID:5616
- C:\Windows\system32\schtasks.exe
  "schtasks.exe" /Create /TN "EmbedHealth Recovery" /XML C:\Users\Admin\AppData\Local\EmbedHealth\state\recovery-task.xml /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2988
- C:\Windows\system32\schtasks.exe
  "schtasks.exe" /Query /TN "EmbedHealth Bootstrap Daemon"
  2⤵
  PID:3472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

probe-id.txt

Path C:\Users\Admin\AppData\Local\EmbedHealth\Bootstrap\probe-id.txt
Size 32B
SHA256 fd4f1b6b26facb31dc38696708934692c585a41666b182f4a3cdc8cfe8d12672
MD5 85509f38e8aba7038af2c7621120d199
SHA1 d3224b8d22c1bbd5c5186a1f1ba3b6e804dee763
SHA512 51128d0e5a298692d69f6f5eb16a9de3cf3e242eaf8d21aab7a991b2f8c7b7db63d38745d6d08c9610762034f7c899fefc163e757a1489a2accabb413c34ea86
MD5 SHA1 SHA512

Submit Download

bootstrap.log

Path C:\Users\Admin\AppData\Local\EmbedHealth\state\bootstrap.log
Size 2KB
SHA256 259b41a1cb6e77aa6176d815120e488e3c8d0d241b419703ef959f578805f22b
MD5 7a43b16bda6817315d26c5d58b55df1f
SHA1 f0726d95987e792a362ae0f5e95f32cb217c59e2
SHA512 a3f1e31a86c158b69d82c30edf8d5e085d784b2008a74c811a60833210b7591cf98ebc65f6f72c7432693dddb59744c74a77b7422560543e8425c05e8db3408e
TLSH
T141513312B22488B8EC9BD05B7492732253F1423D8FDB9512A2A3F55F299153FB16393B
MD5 SHA1 SHA512 TLSH

Submit Download

bootstrap.log

Path C:\Users\Admin\AppData\Local\EmbedHealth\state\bootstrap.log
Size 2KB
SHA256 cb6dda5936e747d6949683378f15d173c193d47bb8f439897f535c3f990907fd
MD5 47132376e71596dd1cfdf26a102abe0f
SHA1 7eb261871c30953630573ca4d059c8de849da299
SHA512 1c24ee9913ad1e32f972f8cd661a3bbce36497c32ee0825137837d087045526c0b6ee929a4ad09ec054e8aef05cfea66aae6e6a4704de453268270580af9ae35
TLSH
T163513212B12488B8EC9BD05B7492732253B1423D8BDB9612A2E3F55F299153FB16393B
MD5 SHA1 SHA512 TLSH

Submit Download

bootstrap.log

Path C:\Users\Admin\AppData\Local\EmbedHealth\state\bootstrap.log
Size 3KB
SHA256 ca166bf83785c6205111ef05fe17b21a34305026423dc7c732c6955deee083a7
MD5 93708d6bb29e4c79e1361144d84031cf
SHA1 9a5a01aae98f8d9076ff4cdf6ab48eb03fb8c26d
SHA512 4d7198796f9f0ce97b3b27982c18e16351b4b43b90b884e253f4fe190b2a03fbaf389d1e16d168beee4653f44362f3756e4f44b39c5cc12481a2faf1b5bf7bda
TLSH
T1A1616512B214C878DC8BD05F7452731253F1423D8BDB9602A3E3F55E299152FB66393B
MD5 SHA1 SHA512 TLSH

Submit Download

bootstrap.log

Path C:\Users\Admin\AppData\Local\EmbedHealth\state\bootstrap.log
Size 3KB
SHA256 eb1524897cc588a5174e2ed6c1bb4240f7cfd9479995a146b14b33cf383da448
MD5 bea8b4beb265785821fbc92dc1f40295
SHA1 693c87105f657ca470526e41c808be7b6034e54d
SHA512 ae6e7aced893e86b4f3938975d35faab6986380d0bf867c11a870d170bafbff28f800a2f9c60efa244c02aefde6147095dfa2b1cdd50b02f352713a26fc38caa
TLSH
T176616212B224C8B8EC4BD09B7452731253B142398BDB9502A3E3F55F299652FB66393B
MD5 SHA1 SHA512 TLSH

Submit Download

bootstrap.log

Path C:\Users\Admin\AppData\Local\EmbedHealth\state\bootstrap.log
Size 3KB
SHA256 97600c3fc89f9966b6005ae06d88aaf026d7ff176fbcd423d2d3d33a8e6a2a6e
MD5 d4802ff02f8151f3a7848adc6ec172fa
SHA1 651f1e76f06c87cc6405496df677e5ad174e95a0
SHA512 bf63cbc3abab84a1bac1c6f497b9e72d3370e73f1b167fe0cb60d5d7b81bbf04dfa55101f883432d01ac17813b92dc7eee526f50289908b3b3107bc7b1147b19
TLSH
T187718513B214C478EC4BD09B7452731253B142398BDB9602A3E3F55F299652FB663D3B
MD5 SHA1 SHA512 TLSH

Submit Download

bootstrap.log

Path C:\Users\Admin\AppData\Local\EmbedHealth\state\bootstrap.log
Size 3KB
SHA256 5e3349c3619d37ca3f3369a6f654dab521ac61d9eace1984c097b2c4a9ab8499
MD5 c493f6d5c1097278bbf29ac72315034f
SHA1 def213067c2765dbf7d5ca97b3974b001bc32b4e
SHA512 53b54b4cd976550789880183f8e4348e743a62dbb67ff6533b0e64b28707cd826403a3101e42d493f3204525cc3e14c9075a4c0e0ec5605b25ff7f5cfd3f4697
TLSH
T177717613B1148478ED8B909A7452731153B1433A4BDB9202A2E3F25E299553FB263E2B
MD5 SHA1 SHA512 TLSH

Submit Download

bootstrap.log

Path C:\Users\Admin\AppData\Local\EmbedHealth\state\bootstrap.log
Size 4KB
SHA256 011757922986737fbbd2c4636ede2416731829bd7c423c403ba3ab780e91df74
MD5 eacb13773823dbd3fa45777fe99b6865
SHA1 38eb4bbdbb20c2930266f00503dba3b293a2ad26
SHA512 523d3cc1afb9b922054729264026e495e955bd338fb38b2e59f71bae771f1045bf0f357d9c3dec66e474f60255460a1db733b2fef8758edd94e2f5dc74c604f6
SSDEEP 96:pd7UfmH9Y+TdASY+WPFCHFCWFCQC/FCvoY+43FCdFCQC9x4hx4/:pXTuG+Yd7QMQg874x4hx4/
TLSH
T182918512B1108478ED57809A7456721153B1433A4B9B9112E3E3F65E2CA593EF2B3F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bootstrap.log

Path C:\Users\Admin\AppData\Local\EmbedHealth\state\bootstrap.log
Size 4KB
SHA256 d84b56c7edf7b1f9f4ba4547826ae98d2f8a54a6dabc143d229dde137cf3d57d
MD5 d9cad6035591e266e8e8921f710d7fcb
SHA1 34ec5fb6de83e8eb8a59289dceedc591fe1f4428
SHA512 77692678ce3b2a77efb8f62bf289d250caef93afcfc61f0862cbfe072e5a3a185575ba69c09ed144fb30503c8e4c7985add920a3682149dced6f944427f8fe30
SSDEEP 96:pd7UfmH9Y+TdASY+WPFCHFCWFCQC/FCvoY+43FCdFCQC9x4hx4Ix4/:pXTuG+Yd7QMQg874x4hx4Ix4/
TLSH
T109918622B110847CDD57809A7456722193B1833A4B975112E3E3F65E2CA593EF2B3F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bootstrap.log

Path C:\Users\Admin\AppData\Local\EmbedHealth\state\bootstrap.log
Size 4KB
SHA256 16a21b967498749e812469ff40eafd9f7aea7c8510acb8f6d84955f290a8cbdf
MD5 16dfdc24386e80d487aeabb76c1247a8
SHA1 6e8f262a743a9ea91f11ec147ad57f3fd1c8f04c
SHA512 22090781a8b709ebd35462da6e58f4a781c6d6ed5d5a420565c1447d1705c4f2877f7bea65c6ecc342000712585d49ab2b0810c21cf1f4b0e6fb52741a65544a
SSDEEP 96:pd7UfmH9Y+TdASY+WPFCHFCWFCQC/FCvoY+43FCdFCQC9x4hx4Ix4AWsL:pXTuG+Yd7QMQg874x4hx4Ix4AR
TLSH
T14AA187227114847CDD47819A7416621193F0433A4B975512E3E3F65E2CA593EF3B3F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bootstrap.log

Path C:\Users\Admin\AppData\Local\EmbedHealth\state\bootstrap.log
Size 4KB
SHA256 aa9680466c0a51de300885f00f3b2fb0ec4a1c6e071c486f494bfc43fe1b5aaa
MD5 1175dc52d2fb6c293deab88737fd0358
SHA1 04b554ea53d88afdd13b2fb9a65625160f791d3d
SHA512 426ccfb5b0daee6ae6c2ef5ecf52779c0a205ff6526db4c7e1af2a5bf2dcf783758bdcf430e8e001cbd7a9c4e3abd122b437a8ee9028803dc53bd2f4b90c3913
SSDEEP 96:pd7UfmH9Y+TdASY+WPFCHFCWFCQC/FCvoY+43FCdFCQC9x4hx4Ix4AWsY+4D:pXTuG+Yd7QMQg874x4hx4Ix4AD4
TLSH
T11EA186227210C478DD47819A7816721193F1833A4B9B5502E3E3F65E2DA593EF2B3F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bootstrap.log

Path C:\Users\Admin\AppData\Local\EmbedHealth\state\bootstrap.log
Size 4KB
SHA256 165e5fb68914d5bc5697a47dae655e9f436d4f57b2fa50ae02bf4dab5a77313e
MD5 91ebbcab42da876d81624959a64b3255
SHA1 21370e2bda4266db4583ec74da1f134d161cb399
SHA512 1d9d0a1af72794bf2275021f6dd47c63b58be3d8cce573d71494233208ab229d4a041b9f27b89a8ec1800a2ee8e3221e623a86c926ca06301a41343c7a749449
SSDEEP 96:pd7UfmH9Y+TdASY+WPFCHFCWFCQC/FCvoY+43FCdFCQC9x4hx4Ix4AWsY+4XT:pXTuG+Yd7QMQg874x4hx4Ix4ADC
TLSH
T171B176227210C478DD47819A7416621193F1833A4B9B5502E3E3F65E3DA593EF2B3F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bootstrap.log

Path C:\Users\Admin\AppData\Local\EmbedHealth\state\bootstrap.log
Size 5KB
SHA256 33a63819e58fcc09e138184d7b78a896c464df3446bc2a25cfef7c52bcae1a5c
MD5 b10407d32a1d5c4954fd60d862f144d5
SHA1 ee223d525191934365c5d1e1294054438c57349a
SHA512 4d44e14352fbb7dccc0fd4e75e59049644081460cac50e3dfd6e995838c66dbe6381b4983db0cbca90071c436b9e8a8b0d820adc6c5c71a4c85bbe9657011203
SSDEEP 96:pd7UfmH9Y+TdASY+WPFCHFCWFCQC/FCvoY+43FCdFCQC9x4hx4Ix4AWsY+4XN:pXTuG+Yd7QMQg874x4hx4Ix4ADk
TLSH
T1BBB16422B210C478DD47819A7416721193F1823A4B9B5502E3E7F65E3C9693EF2B3F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bootstrap.log

Path C:\Users\Admin\AppData\Local\EmbedHealth\state\bootstrap.log
Size 5KB
SHA256 46305350171c46f76c5cc93ae30b4d185b677b768ebe7192e66887681040ccb3
MD5 4392c3ed90382f8fd4a4dfe84bc9c31c
SHA1 8fd6974a53aa04a8a84dc838d0d2f8edfac1f9e0
SHA512 66614b1c7cdb3d865a3809948346cb5654df3229778bb7be330a9e6be5c610cb2ee2da4b57bd71909cd2ef74efd61c33635535fa513dadedf7e3791d92508391
SSDEEP 96:pd7UfmH9Y+TdASY+WPFCHFCWFCQC/FCvoY+43FCdFCQC9x4hx4Ix4AWsY+4XmFCc:pXTuG+Yd7QMQg874x4hx4Ix4ADhr
TLSH
T17EB16422B110C478DD47819A7416721193F0833A4B9B5102E3E3F65E3CA693EF2A3F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bootstrap.log

Path C:\Users\Admin\AppData\Local\EmbedHealth\state\bootstrap.log
Size 5KB
SHA256 cf18c87a24cf8cdeea0788c80e2a8b8bc53b00f5d93b749020d642894b79395a
MD5 736ddf85a3fbd2adc632b808103dd885
SHA1 1f9a798409de18b2a19e8dabdf3d7bc6f00b17a3
SHA512 7ef4b09d94092ff6f971441d0f1475602400858e6a81d31b733ddfcfee9783f77882137c491d43b997a65e24d618af0dfb9a267c8ff5bb2ccbe43624f13cfdd3
SSDEEP 96:pd7UfmH9Y+TdASY+WPFCHFCWFCQC/FCvoY+43FCdFCQC9x4hx4Ix4AWsY+4XmFCj:pXTuG+Yd7QMQg874x4hx4Ix4ADh87r
TLSH
T135C155227110C478DE57819A7416621153F1833A4B9B5212E3E3F65E3CA593EF2A3F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bootstrap.log

Path C:\Users\Admin\AppData\Local\EmbedHealth\state\bootstrap.log
Size 5KB
SHA256 0c9bd2c2d1616833c8e41ced592d7cf13a7c0097870f3f61306df82e95a16b26
MD5 b5dec634d924bfa208b91ec8a7f24089
SHA1 4ce710ea524ad649b79223fd155c1fd16480a3fd
SHA512 febd2871fd0102e46f2d7b4110a27baef2e304480b59787eba469a5f2ca0a7971ceaf55dcde0a1c2e3c9b59d10826ce5025ee1e7062bcfb294af8881bf76fd6d
SSDEEP 96:pd7UfmH9Y+TdASY+WPFCHFCWFCQC/FCvoY+43FCdFCQC9x4hx4Ix4AWsY+4XmFCS:pXTuG+Yd7QMQg874x4hx4Ix4ADh87Qr
TLSH
T190C1662271108478DE97819A7416621153F1833A4B9B5212E2E3F65E3CA593EF2A3F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bootstrap.log

Path C:\Users\Admin\AppData\Local\EmbedHealth\state\bootstrap.log
Size 6KB
SHA256 cde2f54254dfe7b51b0b17ccea7cd2528306b9f3d78340b65695abc0923807a8
MD5 cd13c16535c45a24c799147bd85fb1f2
SHA1 1f286c095536c63d3f7df18c001253fe02d88cd8
SHA512 6263978d7cb407d5b6cef1f946ff29a8842a9b4ab9559c08054d8fb095e313f26438d401f64f18f6597e7849159b69dc6a36c27ce70c5a308d19b3c849c64d2e
SSDEEP 192:pXTuG+Yd7QMQg874x4hx4Ix4ADh87QM8L:8FYd7Qm874x4hx4Ix4a87QD
TLSH
T1ABD166227210C478DD47819A7456721153F0833A4B9B5212E3E3F65E3DA593EF2A3F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bootstrap.log

Path C:\Users\Admin\AppData\Local\EmbedHealth\state\bootstrap.log
Size 6KB
SHA256 505b16fe10e443e5a9efb3f54643d7dad87b916f76fe829f4bc24d54b75d1cb9
MD5 1e13d98360841ad2e5f65e12233bd6f8
SHA1 45845b7256caf550c7d73b500c7d8793648dcb14
SHA512 fac55f0b51013bade810ef7b4bf4846942d7d9308e73d4885d2032ffdfca93d5507f488442787a147931a8a32272534f61ce75f71448aa70d4d445b34ef8043d
SSDEEP 192:pXTuG+Yd7QMQg874x4hx4Ix4ADh87QM8Mx4/:8FYd7Qm874x4hx4Ix4a87QUx4/
TLSH
T1CED176227210C478DE4781DA7416621193F0833A4B975202E3E3F61E3DA593EF2A3F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bootstrap.log

Path C:\Users\Admin\AppData\Local\EmbedHealth\state\bootstrap.log
Size 6KB
SHA256 39dfcd5ba3eca016f78be11b2191345a0d03ecd8aa0bfb8386ec4dc5cc677392
MD5 3e7b6168ed6cd20f2ebe02137d2cf878
SHA1 9d5fd6d0595894952057940a84b209f02ac0efb8
SHA512 5192da932fd59e8d8de7a6667af6e5a42718decc650a394a1d9b662a5389f9291d707fcd2fe5e6f190d3fd130b8d38f16a918806407ead284165907b72eddd47
SSDEEP 192:pXTuG+Yd7QMQg874x4hx4Ix4ADh87QM8Mx4AhY:8FYd7Qm874x4hx4Ix4a87QUx4t
TLSH
T13EE177227210C478DE4781DA7856621193F0833A4B975602E3E3F65E3D6593EF2A3F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bootstrap.log

Path C:\Users\Admin\AppData\Local\EmbedHealth\state\bootstrap.log
Size 7KB
SHA256 ed82348775ddd09cd3a42341ac61ef7c5e99ad1b34081754afc77614f3eb0e92
MD5 c94f2a4ddb218f8b0bd7fc7455b5b116
SHA1 10ba1d6de2f5237d5c81883f10b1cddd1c652023
SHA512 221f7e6544da7dddbd4e164a4cf43081c6cd4c22d6a150f46e436f22b295d7606324b3b3571c31f59d583434eb8c6be572383cfe92b1467ff425390be4cd1fcf
SSDEEP 192:pXTuG+Yd7QMQg874x4hx4Ix4ADh87QM8Mx4Ahy:8FYd7Qm874x4hx4Ix4a87QUx4d
TLSH
T1A3E175227210C478DE4781DA7856B21193B1823A4B975502E3E3F61E3DA593EF2B3F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bootstrap.log

Path C:\Users\Admin\AppData\Local\EmbedHealth\state\bootstrap.log
Size 7KB
SHA256 46e7fcfea780224f0b8706ddcca26397d18ba39a6811f9fa66c2a1f1b6963543
MD5 0a5e1c9f228acde6a5889a3be2523195
SHA1 f768f117587adc95562945eba1846f909dab6f55
SHA512 ce04f58423ea6b68cd2666ea83093fe6f4d2b4069f4e0e8b9729fb28928acbd01db33efc337a2035fdd80057bfc2fdc811b2b8a72c028a3352f88c94888985f9
SSDEEP 192:pXTuG+Yd7QMQg874x4hx4Ix4ADh87QM8Mx4Ahl:8FYd7Qm874x4hx4Ix4a87QUx4+
TLSH
T162E17422B210C478DD4781DA7856B21192B1823A4BD75502E3E3F61E3D6593EF2B3F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bootstrap.log

Path C:\Users\Admin\AppData\Local\EmbedHealth\state\bootstrap.log
Size 7KB
SHA256 c03cef035fcdef0db8bbf702893ce0bedb1893e07b03fd72bacfcc715d2df5b1
MD5 57a98b5f76492de2b2180f995a986c18
SHA1 16ca3b1f79c4bf151a46ea8b524e8bd4c89dc665
SHA512 e39d12b5aa6b1906a9ac0f9437e51f6113b0130bb9ad5683361604de2cb58923b50d641d260802f83ad4340591412383f5c7ff8ab9ee5cea4df01f0ed195967e
SSDEEP 192:pXTuG+Yd7QMQg874x4hx4Ix4ADh87QM8Mx4Ahi7r:8FYd7Qm874x4hx4Ix4a87QUx4B7r
TLSH
T1D8F164227210C478DE47819A7456B21192B1833A4B975602E2E3F21E3DA593EF2B7F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bootstrap.log

Path C:\Users\Admin\AppData\Local\EmbedHealth\state\bootstrap.log
Size 7KB
SHA256 5f53ebea3a50454a5d44c0a2cd266b22aca2db32e868870ccb440d84c55078d5
MD5 22314697986a0f11c4e960b0b1d5a8ee
SHA1 a10c125a069454a469147b0091a0f49cab1f101b
SHA512 b616636bddc4e684aa2610375aeadc18c05d071621b5b0a3d449b617d6feb3e53467646d1b3b03b76aed4ef86dea3904ee9e12f77dfb772a8a37f7cf772372b5
SSDEEP 192:pXTuG+Yd7QMQg874x4hx4Ix4ADh87QM8Mx4Ahi787r:8FYd7Qm874x4hx4Ix4a87QUx4B787r
TLSH
T13CF166227210C478DE87819A7456721193B1833A4B975602E2E3F21E3DA593EF2B7F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bootstrap.log

Path C:\Users\Admin\AppData\Local\EmbedHealth\state\bootstrap.log
Size 7KB
SHA256 c16be9a453b4d3bc2e240d71156cb41cb0b04965b03de2045788d0d8b9732c89
MD5 a4efa01c4829746e0f4161650573d5a9
SHA1 73bf1655db0193fb0b835c1ed5d2e98955fd8787
SHA512 d9a9e5c0672ba663ad0eee85ac0f8c546cfbd27a0c74482b58cc6148187adc57502466c3a233a5aaf2b6ad192859631089fdbc14db8bb3e7d2c57257fa275226
SSDEEP 192:pXTuG+Yd7QMQg874x4hx4Ix4ADh87QM8Mx4Ahi787w:8FYd7Qm874x4hx4Ix4a87QUx4B787w
TLSH
T15FF167227210C478DE8781DA7456721192B1833A4B975602E2E3F21E3DA593EF2B7F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bootstrap.log

Path C:\Users\Admin\AppData\Local\EmbedHealth\state\bootstrap.log
Size 7KB
SHA256 dfd8fe7f58e214c152c1bdb5299b6654bea63420b200271c5231dfa18bc7ad2a
MD5 e35e0bcf85000c1e3a5b2a9b97cff287
SHA1 895811ef70ef427994a1b98a5c5def73ec0a528b
SHA512 c51f5c3a083db857f731743aee0bd1fd73d33e03de3d3e9ab3ec345d63fb1e2bcd2d192f11910a90707247555a05d1b0e2c2ba176fe245029b074f1deb3fe89a
SSDEEP 192:pXTuG+Yd7QMQg874x4hx4Ix4ADh87QM8Mx4Ahi787b:8FYd7Qm874x4hx4Ix4a87QUx4B787b
TLSH
T18FF157227210C478DE4781DA7456721192B1833A4B975602E2E3F21E3DA593EF2B7F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bootstrap.log

Path C:\Users\Admin\AppData\Local\EmbedHealth\state\bootstrap.log
Size 8KB
SHA256 54ecdcae93e761fbc86304e926a50e7a5471c8e6302ade71e732a5f0ed30c1b7
MD5 24680c97af437347de1ae43f8874e87a
SHA1 f2a2226061b58856f2b3d0fc112ba8bd57729d1d
SHA512 2dad2f12c33c595182f93ce4cf5fcb70fe143e511ad11c54c0fe075da44544163a452ea0e1fccce6f5de5057fb383c1f242aadaeedc98b03a4a3cd979c4cda0c
SSDEEP 192:pXTuG+Yd7QMQg874x4hx4Ix4ADh87QM8Mx4Ahi787Aw:8FYd7Qm874x4hx4Ix4a87QUx4B787Aw
TLSH
T1A70256227210C478DE8781DA7456721192B1833A4B975602E2E3F21E3DA593EF2B7F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bootstrap.log

Path C:\Users\Admin\AppData\Local\EmbedHealth\state\bootstrap.log
Size 8KB
SHA256 aa7950653d4da5712a665920fdc0f95b4908db073883241eda6f04eaa419f70b
MD5 7c19ade116c9d71457e570a5af4733ed
SHA1 881c01e9d58851724729c5c40ad2f080a84ed38a
SHA512 3b11b06e792901abfaa3cf47db180be540766b898c236ff55aeb7b52e4686434c5967e93c71c5feac61675f68bc0f4d1eb733d93f56d1050286cde525bb2e5b1
SSDEEP 192:pXTuG+Yd7QMQg874x4hx4Ix4ADh87QM8Mx4Ahi787ALx4/:8FYd7Qm874x4hx4Ix4a87QUx4B787ALA
TLSH
T1B90255227110C478DE8741DA7456721192B1833A4B975602E2E3F21E3DA593EF2F7F9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bootstrap.log

Path C:\Users\Admin\AppData\Local\EmbedHealth\state\bootstrap.log
Size 9KB
SHA256 0075ec6b09fa7c5e55c7443244fced32f4bc80484f8a2345ad3de3479d2079f7
MD5 80218575189184582c1ff42b73baf937
SHA1 afaa53d16467986f23b5dc10b7d2769fd905d2be
SHA512 8137f0dd9dfe3d62a35078f735a88894540ea769b70e7d1f4f3595c8e03d9b43cf968252f98d627f32b239cae118e68bad61eb88130d24488c3f0033c5bbe5a1
SSDEEP 192:pXTuG+Yd7QMQg874x4hx4Ix4ADh87QM8Mx4Ahi787ALx4MMEw+r:8FYd7Qm874x4hx4Ix4a87QUx4B787AL/
TLSH
T1C31277227210C478DE4741DA7456721192B1833A4B975602E2F3F21E3D6593DF2B3F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bootstrap.log

Path C:\Users\Admin\AppData\Local\EmbedHealth\state\bootstrap.log
Size 9KB
SHA256 fa528ac67fb22a06d9834fbc9deb776c501b2356f4fac54ffeea7e7274f8afcc
MD5 8fcb6d4bdd527a49028b1e0d5de9cb1b
SHA1 0757cd73035622fc5a08cc82221b233292e41f04
SHA512 370f7cc2059d54ed5b535c3fd6d509b83a1ff74f0316b124071937868ce75c7d835d2c36502a68de45bed9c6946f36a998ea6bd917c8820aa1b53056325d1927
SSDEEP 192:pXTuG+Yd7QMQg874x4hx4Ix4ADh87QM8Mx4Ahi787ALx4MMEw+87r:8FYd7Qm874x4hx4Ix4a87QUx4B787ALM
TLSH
T1781255267110C4789E8741DA74567211A2B1833A4BA75602E2F3F21E3DA993DF2B3F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bootstrap.log

Path C:\Users\Admin\AppData\Local\EmbedHealth\state\bootstrap.log
Size 9KB
SHA256 72fb3c66c3339a1ed0d92d8688553716cc25f55ade29bc2801d32825f94a75a4
MD5 8f38801b89cd85a736b08188c38f61e6
SHA1 27319047b1ab0df1af55b609e0bec1a42e76cb7d
SHA512 0246fb1c96aa6466ad0a1a1726c7464856bc65f1816960a6d32209d1d02337c5385121924d62fcb5780a81ecc69023e3df1321b456fbb452547435cbaba1aff7
SSDEEP 192:pXTuG+Yd7QMQg874x4hx4Ix4ADh87QM8Mx4Ahi787ALx4MMEw+87QM:8FYd7Qm874x4hx4Ix4a87QUx4B787ALa
TLSH
T18E1255267110C4789E8741DA74567211A2B1833A4BA75602E2F3F21E3DA993DF2A3F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bootstrap.log

Path C:\Users\Admin\AppData\Local\EmbedHealth\state\bootstrap.log
Size 9KB
SHA256 ace4ab607478f9f95aaef92571fa4e0d90d59d2c946a4df499585685b232e136
MD5 0a78970c4b97ec893a30f2942937bf96
SHA1 f37c3a3acb1efd54150bffc9017bd0f2f78e4039
SHA512 f845adb92b751fb5ca3e55e139d0284034ebe82a1109d79d94802711845d9edc907583773921fa12efaa65a5a23f938a3df5e877fc0b5b272ac166c1c85f62b2
SSDEEP 192:pXTuG+Yd7QMQg874x4hx4Ix4ADh87QM8Mx4Ahi787ALx4MMEw+87Q2:8FYd7Qm874x4hx4Ix4a87QUx4B787ALw
TLSH
T1331256267110C4789E8741EA74567211A2B1833A4BA75602E2F3F21E3DA593DF2E3F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bootstrap.log

Path C:\Users\Admin\AppData\Local\EmbedHealth\state\bootstrap.log
Size 9KB
SHA256 891533e8365a34f56b50cd0bba6da90978cae4a44dccc74a4faa4ffd627e7e6e
MD5 2808bb8eb996ae34191289d2833c815d
SHA1 e901d8f824af6089362f00aba3f60590700615b9
SHA512 3f54767fef9d5da6ce190d9aa1ebb040c4bf44055feeed082f92339c25e4a879e68dba0cd1610f0d70bd017b41b1b5fcd6dc4eac37f923025007887a44be757d
SSDEEP 192:pXTuG+Yd7QMQg874x4hx4Ix4ADh87QM8Mx4Ahi787ALx4MMEw+87QRr:8FYd7Qm874x4hx4Ix4a87QUx4B787ALH
TLSH
T1A51266267110C4789E8741EA74567211A2B1833A4BA75602E2F3F21E3DA593DF2E3F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bootstrap.log

Path C:\Users\Admin\AppData\Local\EmbedHealth\state\bootstrap.log
Size 10KB
SHA256 11ea5302c2845b2bc2a001bb5bafd01afa1c595ea49460eacbd3f5f13264ebc6
MD5 cd01c67e4f541362a50cbbf142d2d96a
SHA1 3e59dd4c18839bebab528d0c15b4699956dd806c
SHA512 8a1af880b5ea55075194c28a34dd7dbb46228b56de6348ccba3b76b3e766b66424f7bacabba0d0cba6a5ced0469c5cc0a9bbff5d847f891b9f4c2bd0bda6a7d4
SSDEEP 192:pXTuG+Yd7QMQg874x4hx4Ix4ADh87QM8Mx4Ahi787ALx4MMEw+87QRQrx4O:8FYd7Qm874x4hx4Ix4a87QUx4B787ALA
TLSH
T1C622682671108478DE8741EA34567210A2B1833A4BA75602D2F3F61E3D6593DF2E7F9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bootstrap.log

Path C:\Users\Admin\AppData\Local\EmbedHealth\state\bootstrap.log
Size 10KB
SHA256 a905e5d11a55651f37b5b715ccf51a6df897714d612ec6ba08520a339a6cbda1
MD5 49ae0b48c3e54debc3d2b4af4c981224
SHA1 172f4be9fd19f9d33967509d4058a0d8c0d9e8ea
SHA512 4459682b590157523caa6c439a9f529b2b031a2cb5fee63871ed970a375c129abf60e2c4cc86fb9ef04000fdfa2cc38997d3062937ef7815c767e0ab8236ed8f
SSDEEP 192:pXTuG+Yd7QMQg874x4hx4Ix4ADh87QM8Mx4Ahi787ALx4MMEw+87QRQrx4dx4/:8FYd7Qm874x4hx4Ix4a87QUx4B787AL0
TLSH
T1D5226726711084789E8740EA34567110A2B1833A4BA75612D2F3F61E3D6993DF2E7F9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bootstrap.log

Path C:\Users\Admin\AppData\Local\EmbedHealth\state\bootstrap.log
Size 10KB
SHA256 84361a738f45f04dfc0ec65d3d0ef0b5310519ceca24f31a45c208b20f195f54
MD5 9cc346b89ce678d634399ea56a7ce82c
SHA1 3d04d6ef66233f6e1978a9807d9a4aecf8781795
SHA512 aa9ad694ad864ffb23298533fd2e63744baba9cac9531fbf1b5bab45e617ddf0fc6489510a2d771f95375a96e573b30343758486b054a66f13fc4c11a0e51cc0
SSDEEP 192:pXTuG+Yd7QMQg874x4hx4Ix4ADh87QM8Mx4Ahi787ALx4MMEw+87QRQrx4dx4qr:8FYd7Qm874x4hx4Ix4a87QUx4B787ALZ
TLSH
T16C2257267110847C9E8740E934567210A2B1833A4BA75612D2F3F61E3DA993DF2E7F9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bootstrap.log

Path C:\Users\Admin\AppData\Local\EmbedHealth\state\bootstrap.log
Size 1KB
SHA256 22410b9da290750f8a605e4fd3df0478b11899dbbfeeb9fab077ae3d0165808d
MD5 96233f58c5d4fa24aa5055d3dd03da2e
SHA1 c70a50af2b301dd43d6a3ece78ce49338b073265
SHA512 f49daf92bcc29e48a54ee6b2430f8a18ff8ec30e1f1352ea7195f45779e6ecb795a09c64f3545126243c6c1797a2af9624c9f5c7bd7a60132e6ecbca3a36947b
TLSH
T19D116052B32C98B4DC4AE24A395652A347F1403E879FA412A743E56F058291F3293532
MD5 SHA1 SHA512 TLSH

Submit Download

bootstrap.log

Path C:\Users\Admin\AppData\Local\EmbedHealth\state\bootstrap.log
Size 1KB
SHA256 45f0b49caa6bd85020715bceae344ee260662ccc657a60a0929dcaa1c1686081
MD5 f65c32a3ea9c0933c1bf1c7ef7e776a2
SHA1 b0a81ad12067c4b9e96f3564c5011544157f119e
SHA512 3c5905c40a9a0d5a85985f7f481727c9f6673400dc3c12463dc33aa718a1ee2665a0d73debbaed571049a9a3f8fec01893bac7e56883277437072caf88c0def4
TLSH
T10A318550B31C98B8DC0AD24F7957536347F0403C8B9FA802A383F46F168292F3653436
MD5 SHA1 SHA512 TLSH

Submit Download

bootstrap.log

Path C:\Users\Admin\AppData\Local\EmbedHealth\state\bootstrap.log
Size 1KB
SHA256 22e7ed7a9814c868a5f23f06992b4ed362d6305f9a8adecabdf37ecd39a50665
MD5 101321969f53b35152774aa5c0919133
SHA1 7564a757a92c361ead4cc2defb35d276bfcd7216
SHA512 d2d3a13f095a8eac91f45a3a6adc4c7a1f8cce1d3284178618eaff99bafb802636b48acdc1ac8362a807c70945cb2f75b850b64b94390270990e5f85895158a5
TLSH
T1F9319420B318D8F8DC4AD14F7956A36307F1803D8B8FA401A783F5AE168291F3653436
MD5 SHA1 SHA512 TLSH

Submit Download

bootstrap.log

Path C:\Users\Admin\AppData\Local\EmbedHealth\state\bootstrap.log
Size 1KB
SHA256 77cffa565795874f86129a9fb343b68e209e753195069f8e34d88db3f0dd0bca
MD5 c75ec1bad0a8e13cc5b9a0c591711a95
SHA1 dcbc400494a584c68c357faf3f4663adc71e0c9d
SHA512 3668ee37e066ab8546feb7da023dc53a6a510a3c2552fe732ed59f1cfdfaea994c634032587c8bda66cbea2cb4dcb6fb37ae49b442cbbf040db93ee3f88a5cb6
TLSH
T12B414221B318D8B4DC4AD14F7896A36747F1403D8BCBA802A783F56E1A9292F7563936
MD5 SHA1 SHA512 TLSH

Submit Download

bootstrap.log

Path C:\Users\Admin\AppData\Local\EmbedHealth\state\bootstrap.log
Size 2KB
SHA256 42f182679fe69f9cec9e257aefdf412cd04678f26c6e9caeb06edb73b0d26499
MD5 3631abe18f1bf275916b425e0a9e2323
SHA1 bf6cdd626f46a49ca4e4a14dad922c593e05a5bb
SHA512 d145633b91105f3e9760effd6749df62e0a7e4c9ff9d2bba074e89e50b2896935ddda60bbdb635a34847f8465acce8fa524124112a3ff7fbd4a9bb35ada6c403
TLSH
T12E416511B21898B4DC4BD14F7496A36343F1413D8BCFA402A393F56F199292F7563936
MD5 SHA1 SHA512 TLSH

Submit Download

bootstrap.log

Path C:\Users\Admin\AppData\Local\EmbedHealth\state\bootstrap.log
Size 2KB
SHA256 686a4610c00209e6c62de76b609d5ef1184895ec29507175ecdb7501b1c2a484
MD5 f0666a3696d2a4caa202930c338c2e7f
SHA1 4339010a82146740f02523ba7b1bf8f44135237c
SHA512 9e56c64596f3519ce0926ef680f65e95d2263f59ecbb43c25cffe709ec5ba855e804dacab979e09fbf390063bc5a06d934f492e3126bcf775848ae5b0348c5e9
TLSH
T143413312F21898B4DC4AD14F7491B36243E1413D8BCB9807A393F56F299292F7567936
MD5 SHA1 SHA512 TLSH

Submit Download

bootstrap.log

Path C:\Users\Admin\AppData\Local\EmbedHealth\state\bootstrap.log
Size 2KB
SHA256 1599552e2599660271049249e10728f3c28b8d3222aed1903fbc10c74bfc5cdd
MD5 c73e1281f582f5c7113cf180a308a837
SHA1 c4188f1fd8f4bdd1e48137e79a4a3fe2892e3a0e
SHA512 3f852f799818f923d4cccf6a054895e5520ba835457187ca236359936ade6168c2ed7e6dfe10a0474a1c257a377dfd0e97b4e8e755ac16f9b846365f7d44f365
TLSH
T117413312B22498B4DC5BE05F7491B36243E1413D8BCB9403A393F55F299253F756393A
MD5 SHA1 SHA512 TLSH

Submit Download

pending-events.jsonl

Path C:\Users\Admin\AppData\Local\EmbedHealth\state\pending-events.jsonl
Size 898B
SHA256 41cb71a8295d7d068096f363bf28a33bed06f372b54005049cc0b182e6556c7d
MD5 06d7f84c9028cc8c5627ca8cf254f410
SHA1 81d1bc2f765a9c7eb013ba565558d6b51f0f8ad2
SHA512 19a7f541ad2bdc80e037de86027cd662a704e85084d996203477bcfc415b10c0121606d1bac945e025d523a523ede8700d6cb1f4edd73ba523d9d1dcc849b8b0
TLSH
T1371140C3B3BC5C76EE22834E028E78D99C61755363CB51197ED92FEC0490267E352465
MD5 SHA1 SHA512 TLSH

Submit Download

pending-events.jsonl

Path C:\Users\Admin\AppData\Local\EmbedHealth\state\pending-events.jsonl
Size 1KB
SHA256 df2cf2e9e556b6ece7c5af4e8115300d69be9950c14c7e9e93a652c9eda1ae97
MD5 2ec6ea65e2613a4ed1e25f8571ee4cba
SHA1 85e5f2c83a7362f86474436fefbaba2cf2e490a1
SHA512 da0fbffc9e9ba9feb8e374ba2304ea86aedb540b27e5a3cfe4527f8c6fcf8cac74f0ea08909df716ee0b822a861b7f72126b4457ee0895600d15d3874b5e1388
TLSH
T13E419D8273BC5C75EF22834E468D78D5DC70715353CB5009AE9D3FAC04A42ABE397662
MD5 SHA1 SHA512 TLSH

Submit Download

pending-events.jsonl

Path C:\Users\Admin\AppData\Local\EmbedHealth\state\pending-events.jsonl
Size 2KB
SHA256 4270f2f90c54a13cecbdd7824b3ef976fa8c9d74f280cebd35fe8d3c5958bf14
MD5 3c7d9121769503a86b2e224688af0afa
SHA1 5ba86035fe31baa214b4e8b134f22563392b0292
SHA512 e6b7ea3acf812740c68d581c04fb975ec7dbc1cce1ac5bb1bcd5162167d6e43a7e827ead2fd7ddf967fa3e9b78b23b2578b9a612e33fcf6448ab39024780cd9c
TLSH
T126517D8273BC5C75EF22838E468D78C9DC70755393CA5109AE997FAC04A426BF393562
MD5 SHA1 SHA512 TLSH

Submit Download

pending-events.jsonl

Path C:\Users\Admin\AppData\Local\EmbedHealth\state\pending-events.jsonl
Size 3KB
SHA256 f166e6f434e1240b00ff53c2fa15058fe2e867440c1dc3b7c6ef30449ff2e2ff
MD5 f0194597d394666a497c17c9e24f6b45
SHA1 cb3e643de46674a7af152d0664bed97e641b1f98
SHA512 7d1f20efd33826d6bce7fddcd6a9733820620668f74e7532fbecabe68f94f0f3ee287ba7411c96a813d8937d01d8405e0f0f3d4d59e89cadbc71157c36233e50
TLSH
T173718F8273BC5CB5EF22834E468D78D9DC70706393CA1109AF997FEC049466BE393966
MD5 SHA1 SHA512 TLSH

Submit Download

recovery-task.xml

Path C:\Users\Admin\AppData\Local\EmbedHealth\state\recovery-task.xml
Size 2KB
SHA256 7f0f6fb62472f948abbdd97800cc9675f5ac191bccfa095253ef0b61949d35ae
MD5 1a515f4516b7751bba56feda0108002e
SHA1 2be3573865a06ac3cceb1d97e6acdbffca3f3cc5
SHA512 05ce8b414f55e58ff9f01cc707e7ddf696c89f51e1d733eaa950391ddb0c18cf442eb5974421cb45df80f3c1d1c7f67282b2236c613e9ce0565757c56e75dcd7
TLSH
T182412743A7FE5209F1F76F9CAA7654514EBBBD581C35D87C01AC0A0D0AB3922C960B37
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 0f7ad9abdcd636c2c6889999c25838241b47d0a25155ace08f64e55a25eb3ff9
MD5 7aa40f01332d390a0557187ed788e89f
SHA1 7d7c1a1c58e25749832d6634611c29cc8fabbf19
SHA512 1d9d4d55030ef6e8d1e386e61671f00bc271b8df8179ca19846c2b39cbb2bca110b67b3d4a6d1f200966057f5c6cea3f4dd1ad02d11e42ec7d013c6803954966
SSDEEP 1536:iKLmShYoNz8KMSfKQ1EflJntHY9h4iUxaR40i71Yi68nvwAOdB4V3CNBQkj2jaVP:iKLmShYoNz8KMSfKQ1EflJnpY9qiUaR9
TLSH
T135637292E9204E75E1A66F3EF15622627C30394690F8153211DC25EFA987D930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 df5de984121ab9eb702c2ef1c0716750e770551b5a5551fee347941d5bdfab01
MD5 8c274452b4cefabecd528a1214159e4a
SHA1 59fefbf3c332bed6d778918035ad778fc2d3cad5
SHA512 9bd08a264f82cf86abb106e99d71e24f4c93aac148ef207091e370f242e49fef2bdff11fb29d20b1b6e1001ccf746a6191f571e33772e0eedbd54b1ed1aa3102
TLSH
T1B0217633B3CC8654C899013A10CEAC1036BB87CB409E8E9B6B84D519A42F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_h4wvkvty.tth.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_h4wvkvty.tth.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

EmbedHealth-Bootstrap.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EmbedHealth-Bootstrap.vbs
Size 353B
SHA256 683c9fcaab8e0d121c0244f8a2b0f74148376e5ee9d541205fa1bfd8b23a22ce
MD5 b1334b031af31cc6ce3e03ef41bbfaaa
SHA1 fd83e464baabbddfaa946a11b6252854049861c0
SHA512 d7938a389ed6ded9eaaf94117aa8cfaeb877472f689b392acc513e895df2d474d3ed21179983803906d32b23851eba09cfc4e53af5c35d3c61543e5680982d07
TLSH
T1BBE0C001AF6C56148E6D81D732F5E00787D4500C073542141953A95864CD00F66E8B42
MD5 SHA1 SHA512 TLSH

Submit Download

EmbedHealth-Bootstrap.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EmbedHealth-Bootstrap.vbs
Size 327B
SHA256 e5cc92e46ee9048c81b7abfd62691bc49c0a69c90a2bf90943be1c432e144dda
MD5 15a159aca4d1370bf8cab8fcf518902c
SHA1 32aa238c50e68cd21219705341c0bbf1fd89bb45
SHA512 4147d5e9c906dc6708fd467415506cdb057fc20806aff91986bfad60da9bfd37683c0dc1349bef09ee46ef8156de12e208096a362e32576798cdebbd17547782
TLSH
T1B5E02602EB68C929CE68C5DF31F976078BD4901C852644080B17FA6C218D54F79EAB52
MD5 SHA1 SHA512 TLSH

Submit Download

memory/6004-30-0x000002047F290000-0x000002047F2AE000-memory.dmp

Download

memory/6004-11-0x00007FF80C530000-0x00007FF80CED4000-memory.dmp

Download

memory/6004-3-0x00007FF80C6BF000-0x00007FF80C6C0000-memory.dmp

Download

memory/6004-20-0x00007FF80C530000-0x00007FF80CED4000-memory.dmp

Download

memory/6004-19-0x00007FF80C530000-0x00007FF80CED4000-memory.dmp

Download

memory/6004-27-0x000002047F250000-0x000002047F25A000-memory.dmp

Download

memory/6004-5-0x00007FF80C530000-0x00007FF80CED4000-memory.dmp

Download

memory/6004-26-0x000002047F520000-0x000002047F5D2000-memory.dmp

Download

memory/6004-25-0x000002047F210000-0x000002047F22E000-memory.dmp

Download

memory/6004-8-0x00007FF80C530000-0x00007FF80CED4000-memory.dmp

Download

memory/6004-9-0x000002047F180000-0x000002047F1A2000-memory.dmp

Download

memory/6004-4-0x00007FF80C530000-0x00007FF80CED4000-memory.dmp

Download

memory/6004-22-0x00007FF80C530000-0x00007FF80CED4000-memory.dmp

Download

memory/6004-12-0x00007FF80C530000-0x00007FF80CED4000-memory.dmp

Download

memory/6004-13-0x00007FF80C530000-0x00007FF80CED4000-memory.dmp

Download

memory/6004-14-0x00007FF80C530000-0x00007FF80CED4000-memory.dmp

Download

memory/6004-15-0x00007FF80C530000-0x00007FF80CED4000-memory.dmp

Download

memory/6004-40-0x00007FF80C530000-0x00007FF80CED4000-memory.dmp

Download

memory/6004-34-0x00007FF80C530000-0x00007FF80CED4000-memory.dmp

Download

memory/6004-16-0x00007FF80C530000-0x00007FF80CED4000-memory.dmp

Download

memory/6004-21-0x00007FF80C530000-0x00007FF80CED4000-memory.dmp

Download