Overview
overview
8Static
static
Process La...er.exe
windows7-x64
1Process La...er.exe
windows10-2004-x64
1Process La...ts.exe
windows7-x64
1Process La...ts.exe
windows10-2004-x64
1Process La...er.exe
windows7-x64
1Process La...er.exe
windows10-2004-x64
1Process La...er.exe
windows7-x64
1Process La...er.exe
windows10-2004-x64
1Process La...or.exe
windows7-x64
1Process La...or.exe
windows10-2004-x64
1Process La...so.exe
windows7-x64
3Process La...so.exe
windows10-2004-x64
3Process La...er.exe
windows7-x64
3Process La...er.exe
windows10-2004-x64
7Process La...de.exe
windows7-x64
8Process La...de.exe
windows10-2004-x64
8Process La...er.exe
windows7-x64
1Process La...er.exe
windows10-2004-x64
1Process La...er.exe
windows7-x64
1Process La...er.exe
windows10-2004-x64
1Process La...ms.exe
windows7-x64
1Process La...ms.exe
windows10-2004-x64
1Process La...nt.exe
windows7-x64
1Process La...nt.exe
windows10-2004-x64
1Process La...pl.cmd
windows7-x64
8Process La...pl.cmd
windows10-2004-x64
8Process La...an.dll
windows7-x64
1Process La...an.dll
windows10-2004-x64
1Process La...se.dll
windows7-x64
1Process La...se.dll
windows10-2004-x64
1Process La...al.dll
windows7-x64
1Process La...al.dll
windows10-2004-x64
1Analysis
- max time kernel
151s - max time network
50s - platform
windows7_x64 - resource
win7-20220901-en - resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system - submitted
14/10/2022, 14:47
Static task
static1
Behavioral task
behavioral1
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/CPUEater.exe
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/CPUEater.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/Insights.exe
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral4
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/Insights.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/InstallHelper.exe
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral6
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/InstallHelper.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/LogViewer.exe
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral8
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/LogViewer.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/ProcessGovernor.exe
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral10
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/ProcessGovernor.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/ProcessLasso.exe
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral12
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/ProcessLasso.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/ProcessLassoLauncher.exe
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral14
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/ProcessLassoLauncher.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/QuickUpgrade.exe
Resource
win7-20220901-en
windows7-x64
Behavioral task
behavioral16
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/QuickUpgrade.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/ThreadRacer.exe
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral18
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/ThreadRacer.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/TweakScheduler.exe
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral20
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/TweakScheduler.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/bitsumms.exe
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral22
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/bitsumms.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/bitsumsessionagent.exe
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral24
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/bitsumsessionagent.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/pl.cmd
Resource
win7-20220901-en
windows7-x64
Behavioral task
behavioral26
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/pl.cmd
Resource
win10v2004-20220901-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/pl_rsrc_bulgarian.dll
Resource
win7-20220901-en
windows7-x64
Behavioral task
behavioral28
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/pl_rsrc_bulgarian.dll
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/pl_rsrc_chinese.dll
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral30
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/pl_rsrc_chinese.dll
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/pl_rsrc_chinese_traditional.dll
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral32
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/pl_rsrc_chinese_traditional.dll
Resource
win10v2004-20220812-en
windows10-2004-x64
General
- Target Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/pl.cmd
- Size 77B
- Sample221014-r5vm5sdfe7
- SHA256 9af8add66b2bb4a0252b65e0f13238055b601d689e8d29455d5b2c87f901fd7b
- MD5 aa54d58336d2565c369498d035737f8a
- SHA1 c6a8791264081a6f854b30ac11477bdd83a8cbee
- SHA512 82d9eeab7cb95f012b55d531ba7af84546be650702f40ca294c74858eca5eadc0ed7a87bc65122df4093e483dffe1e04e306845871955b2dc4f5113f1cf34838
- MD5 SHA1 SHA512
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1020 ProcessLasso.exe - Loads dropped DLL 4 IoCs
pid Process 1300 ProcessLassoLauncher.exe 1300 ProcessLassoLauncher.exe 1300 ProcessLassoLauncher.exe 1300 ProcessLassoLauncher.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 InstallHelper.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString InstallHelper.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ProcessLasso.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ProcessLasso.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 processgovernor.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString processgovernor.exe - Suspicious behavior: CmdExeWriteProcessMemorySpam 2 IoCs
pid Process 900 InstallHelper.exe 1300 ProcessLassoLauncher.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 900 InstallHelper.exe 900 InstallHelper.exe 900 InstallHelper.exe 900 InstallHelper.exe 900 InstallHelper.exe 900 InstallHelper.exe 900 InstallHelper.exe 900 InstallHelper.exe 900 InstallHelper.exe 900 InstallHelper.exe 900 InstallHelper.exe 900 InstallHelper.exe 900 InstallHelper.exe 900 InstallHelper.exe 900 InstallHelper.exe 900 InstallHelper.exe 900 InstallHelper.exe 900 InstallHelper.exe 900 InstallHelper.exe 900 InstallHelper.exe 900 InstallHelper.exe 900 InstallHelper.exe 900 InstallHelper.exe 900 InstallHelper.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1396 processgovernor.exe 1396 processgovernor.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1396 processgovernor.exe 1396 processgovernor.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1396 processgovernor.exe 1396 processgovernor.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1396 processgovernor.exe - Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 900 InstallHelper.exe Token: SeDebugPrivilege 900 InstallHelper.exe Token: SeChangeNotifyPrivilege 900 InstallHelper.exe Token: SeIncBasePriorityPrivilege 900 InstallHelper.exe Token: SeIncreaseQuotaPrivilege 900 InstallHelper.exe Token: SeProfSingleProcessPrivilege 900 InstallHelper.exe Token: SeAssignPrimaryTokenPrivilege 1020 ProcessLasso.exe Token: SeDebugPrivilege 1020 ProcessLasso.exe Token: SeChangeNotifyPrivilege 1020 ProcessLasso.exe Token: SeIncBasePriorityPrivilege 1020 ProcessLasso.exe Token: SeIncreaseQuotaPrivilege 1020 ProcessLasso.exe Token: SeCreateGlobalPrivilege 1020 ProcessLasso.exe Token: SeProfSingleProcessPrivilege 1020 ProcessLasso.exe Token: SeBackupPrivilege 1020 ProcessLasso.exe Token: SeRestorePrivilege 1020 ProcessLasso.exe Token: SeAssignPrimaryTokenPrivilege 1396 processgovernor.exe Token: SeDebugPrivilege 1396 processgovernor.exe Token: SeChangeNotifyPrivilege 1396 processgovernor.exe Token: SeIncBasePriorityPrivilege 1396 processgovernor.exe Token: SeIncreaseQuotaPrivilege 1396 processgovernor.exe Token: SeProfSingleProcessPrivilege 1396 processgovernor.exe Token: SeCreateGlobalPrivilege 1396 processgovernor.exe Token: SeBackupPrivilege 1396 processgovernor.exe Token: SeRestorePrivilege 1396 processgovernor.exe - Suspicious use of FindShellTrayWindow 55 IoCs
pid Process 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe - Suspicious use of SendNotifyMessage 55 IoCs
pid Process 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe 1020 ProcessLasso.exe - Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 1808 wrote to memory of 900 1808 cmd.exe 28 PID 1808 wrote to memory of 900 1808 cmd.exe 28 PID 1808 wrote to memory of 900 1808 cmd.exe 28 PID 1808 wrote to memory of 900 1808 cmd.exe 28 PID 1808 wrote to memory of 900 1808 cmd.exe 28 PID 1808 wrote to memory of 900 1808 cmd.exe 28 PID 1808 wrote to memory of 900 1808 cmd.exe 28 PID 900 wrote to memory of 2024 900 InstallHelper.exe 29 PID 900 wrote to memory of 2024 900 InstallHelper.exe 29 PID 900 wrote to memory of 2024 900 InstallHelper.exe 29 PID 900 wrote to memory of 2024 900 InstallHelper.exe 29 PID 1808 wrote to memory of 1300 1808 cmd.exe 30 PID 1808 wrote to memory of 1300 1808 cmd.exe 30 PID 1808 wrote to memory of 1300 1808 cmd.exe 30 PID 1808 wrote to memory of 1300 1808 cmd.exe 30 PID 1808 wrote to memory of 1300 1808 cmd.exe 30 PID 1808 wrote to memory of 1300 1808 cmd.exe 30 PID 1808 wrote to memory of 1300 1808 cmd.exe 30 PID 1300 wrote to memory of 1020 1300 ProcessLassoLauncher.exe 31 PID 1300 wrote to memory of 1020 1300 ProcessLassoLauncher.exe 31 PID 1300 wrote to memory of 1020 1300 ProcessLassoLauncher.exe 31 PID 1300 wrote to memory of 1020 1300 ProcessLassoLauncher.exe 31 PID 1300 wrote to memory of 1020 1300 ProcessLassoLauncher.exe 31 PID 1300 wrote to memory of 1020 1300 ProcessLassoLauncher.exe 31 PID 1300 wrote to memory of 1020 1300 ProcessLassoLauncher.exe 31 PID 1020 wrote to memory of 1396 1020 ProcessLasso.exe 32 PID 1020 wrote to memory of 1396 1020 ProcessLasso.exe 32 PID 1020 wrote to memory of 1396 1020 ProcessLasso.exe 32 PID 1020 wrote to memory of 1396 1020 ProcessLasso.exe 32 PID 1020 wrote to memory of 1396 1020 ProcessLasso.exe 32 PID 1020 wrote to memory of 1396 1020 ProcessLasso.exe 32 PID 1020 wrote to memory of 1396 1020 ProcessLasso.exe 32
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\pl.cmd"1⤵
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\InstallHelper.exeInstallHelper.exe /terminate2⤵
- Checks processor information in registry
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:900 -
C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\bitsumms.exe"C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\bitsumms.exe" /name:ProcessGovernor /stop3⤵PID:2024
-
-
-
C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\ProcessLassoLauncher.exeProcessLassoLauncher.exe /showwindow2⤵
- Loads dropped DLL
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\ProcessLasso.exe"C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\ProcessLasso.exe" "ProcessLassoLauncher.exe" "/showwindow"3⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\processgovernor.exe"C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\processgovernor.exe"4⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1396
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\ProcessLasso\config\prolasso.ini
- Size 7KB
- SHA256 cc92b1ffc62962e1e8267a47df08f5817df148be90a20e984e87ccabf67b2ca9
- MD5 736f41d2f35e6848cec5f81a083c32cf
- SHA1 de983b61b0e002f0ae3d7a1e0fd1e7d66e287b15
- SHA512 fd7ea4b7fd497d3052521bb20b92aed29c1317a33119f56627d37d3d29b9c016a66794893db22fe8952568dd98d58306734e5e03ccb5e88186d505b4098f2c92
- SSDEEP 192:tCFchoD6xeEh7Ja5m+zam8ZrWYF/CZiONkM6HiaE9xum:tEchoD7C7Upzam8ZrWYF/KiONkM6HfEd
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\ProcessLasso\logs\processlasso.log
- Size 1KB
- SHA256 48149f08f099196024737c21f879554205868e362f9ff5e0479e354c6122bfa1
- MD5 55eba4bd5dfa04bcfc36a2237ad9793b
- SHA1 94e1fc06da54cf332a4086aaf04d7db7007d9ff0
- SHA512 b441cc95c866bd859fc49f3c64b1fe606a5a2faa042a5de0db79ecba6a50b93bd4112608e7ebaea61d0d29eaf030e36fb04a2ff49a2892359d0e87f79fdb1def
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\ProcessLasso.exe
- Size 1.5MB
- SHA256 b10f6f81b153bce13fe126e23989aec9b632d8b44699b29797230b00b22c2bf6
- MD5 a61b53c263109b46baba47fc47a91889
- SHA1 9b78e6b39051e9573367de084724eb16984bc291
- SHA512 0f936631fc31dfa9086bf832d79cf96b56385ab0ddcbfc9b3b7d6c544daec04e8567b903644fe5a89c0f9dae7d17081e995c5df11deacee7e2fe1bd72793b4de
- SSDEEP 49152:DXS5A4iJaoc2KwphMB1avC1r6wo2tAAWUc0g1:TS5A4Yc2KwVC1r612t
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\ProcessLasso.exe
- Size 1.5MB
- SHA256 b10f6f81b153bce13fe126e23989aec9b632d8b44699b29797230b00b22c2bf6
- MD5 a61b53c263109b46baba47fc47a91889
- SHA1 9b78e6b39051e9573367de084724eb16984bc291
- SHA512 0f936631fc31dfa9086bf832d79cf96b56385ab0ddcbfc9b3b7d6c544daec04e8567b903644fe5a89c0f9dae7d17081e995c5df11deacee7e2fe1bd72793b4de
- SSDEEP 49152:DXS5A4iJaoc2KwphMB1avC1r6wo2tAAWUc0g1:TS5A4Yc2KwVC1r612t
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\ProcessLasso.exe
- Size 1.5MB
- SHA256 b10f6f81b153bce13fe126e23989aec9b632d8b44699b29797230b00b22c2bf6
- MD5 a61b53c263109b46baba47fc47a91889
- SHA1 9b78e6b39051e9573367de084724eb16984bc291
- SHA512 0f936631fc31dfa9086bf832d79cf96b56385ab0ddcbfc9b3b7d6c544daec04e8567b903644fe5a89c0f9dae7d17081e995c5df11deacee7e2fe1bd72793b4de
- SSDEEP 49152:DXS5A4iJaoc2KwphMB1avC1r6wo2tAAWUc0g1:TS5A4Yc2KwVC1r612t
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\ProcessLasso.exe
- Size 1.5MB
- SHA256 b10f6f81b153bce13fe126e23989aec9b632d8b44699b29797230b00b22c2bf6
- MD5 a61b53c263109b46baba47fc47a91889
- SHA1 9b78e6b39051e9573367de084724eb16984bc291
- SHA512 0f936631fc31dfa9086bf832d79cf96b56385ab0ddcbfc9b3b7d6c544daec04e8567b903644fe5a89c0f9dae7d17081e995c5df11deacee7e2fe1bd72793b4de
- SSDEEP 49152:DXS5A4iJaoc2KwphMB1avC1r6wo2tAAWUc0g1:TS5A4Yc2KwVC1r612t
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\ProcessLasso.exe
- Size 1.5MB
- SHA256 b10f6f81b153bce13fe126e23989aec9b632d8b44699b29797230b00b22c2bf6
- MD5 a61b53c263109b46baba47fc47a91889
- SHA1 9b78e6b39051e9573367de084724eb16984bc291
- SHA512 0f936631fc31dfa9086bf832d79cf96b56385ab0ddcbfc9b3b7d6c544daec04e8567b903644fe5a89c0f9dae7d17081e995c5df11deacee7e2fe1bd72793b4de
- SSDEEP 49152:DXS5A4iJaoc2KwphMB1avC1r6wo2tAAWUc0g1:TS5A4Yc2KwVC1r612t
- MD5 SHA1 SHA512 SSDEEP