Overview
overview
8Static
static
Process La...er.exe
windows7-x64
1Process La...er.exe
windows10-2004-x64
1Process La...ts.exe
windows7-x64
1Process La...ts.exe
windows10-2004-x64
1Process La...er.exe
windows7-x64
1Process La...er.exe
windows10-2004-x64
1Process La...er.exe
windows7-x64
1Process La...er.exe
windows10-2004-x64
1Process La...or.exe
windows7-x64
1Process La...or.exe
windows10-2004-x64
1Process La...so.exe
windows7-x64
3Process La...so.exe
windows10-2004-x64
3Process La...er.exe
windows7-x64
3Process La...er.exe
windows10-2004-x64
7Process La...de.exe
windows7-x64
8Process La...de.exe
windows10-2004-x64
8Process La...er.exe
windows7-x64
1Process La...er.exe
windows10-2004-x64
1Process La...er.exe
windows7-x64
1Process La...er.exe
windows10-2004-x64
1Process La...ms.exe
windows7-x64
1Process La...ms.exe
windows10-2004-x64
1Process La...nt.exe
windows7-x64
1Process La...nt.exe
windows10-2004-x64
1Process La...pl.cmd
windows7-x64
8Process La...pl.cmd
windows10-2004-x64
8Process La...an.dll
windows7-x64
1Process La...an.dll
windows10-2004-x64
1Process La...se.dll
windows7-x64
1Process La...se.dll
windows10-2004-x64
1Process La...al.dll
windows7-x64
1Process La...al.dll
windows10-2004-x64
1Analysis
- max time kernel
150s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20220901-en - resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system - submitted
14/10/2022, 14:47
Static task
static1
Behavioral task
behavioral1
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/CPUEater.exe
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/CPUEater.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/Insights.exe
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral4
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/Insights.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/InstallHelper.exe
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral6
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/InstallHelper.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/LogViewer.exe
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral8
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/LogViewer.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/ProcessGovernor.exe
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral10
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/ProcessGovernor.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/ProcessLasso.exe
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral12
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/ProcessLasso.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/ProcessLassoLauncher.exe
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral14
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/ProcessLassoLauncher.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/QuickUpgrade.exe
Resource
win7-20220901-en
windows7-x64
Behavioral task
behavioral16
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/QuickUpgrade.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/ThreadRacer.exe
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral18
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/ThreadRacer.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/TweakScheduler.exe
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral20
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/TweakScheduler.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/bitsumms.exe
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral22
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/bitsumms.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/bitsumsessionagent.exe
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral24
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/bitsumsessionagent.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/pl.cmd
Resource
win7-20220901-en
windows7-x64
Behavioral task
behavioral26
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/pl.cmd
Resource
win10v2004-20220901-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/pl_rsrc_bulgarian.dll
Resource
win7-20220901-en
windows7-x64
Behavioral task
behavioral28
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/pl_rsrc_bulgarian.dll
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/pl_rsrc_chinese.dll
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral30
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/pl_rsrc_chinese.dll
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/pl_rsrc_chinese_traditional.dll
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral32
Sample
Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/pl_rsrc_chinese_traditional.dll
Resource
win10v2004-20220812-en
windows10-2004-x64
General
- Target Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)/App/ProcessLasso/pl.cmd
- Size 77B
- Sample221014-r5vm5sdfe7
- SHA256 9af8add66b2bb4a0252b65e0f13238055b601d689e8d29455d5b2c87f901fd7b
- MD5 aa54d58336d2565c369498d035737f8a
- SHA1 c6a8791264081a6f854b30ac11477bdd83a8cbee
- SHA512 82d9eeab7cb95f012b55d531ba7af84546be650702f40ca294c74858eca5eadc0ed7a87bc65122df4093e483dffe1e04e306845871955b2dc4f5113f1cf34838
- MD5 SHA1 SHA512
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4948 ProcessLasso.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString InstallHelper.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ProcessLasso.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ProcessLasso.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 processgovernor.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString processgovernor.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 InstallHelper.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3236 InstallHelper.exe 3236 InstallHelper.exe 3236 InstallHelper.exe 3236 InstallHelper.exe 3236 InstallHelper.exe 3236 InstallHelper.exe 3236 InstallHelper.exe 3236 InstallHelper.exe 3236 InstallHelper.exe 3236 InstallHelper.exe 3236 InstallHelper.exe 3236 InstallHelper.exe 3236 InstallHelper.exe 3236 InstallHelper.exe 3236 InstallHelper.exe 3236 InstallHelper.exe 3236 InstallHelper.exe 3236 InstallHelper.exe 3236 InstallHelper.exe 3236 InstallHelper.exe 3236 InstallHelper.exe 3236 InstallHelper.exe 3236 InstallHelper.exe 3236 InstallHelper.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4684 processgovernor.exe 4684 processgovernor.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4684 processgovernor.exe 4684 processgovernor.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4684 processgovernor.exe 4684 processgovernor.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4684 processgovernor.exe 4684 processgovernor.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 4684 processgovernor.exe 4948 ProcessLasso.exe - Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 3236 InstallHelper.exe Token: SeDebugPrivilege 3236 InstallHelper.exe Token: SeChangeNotifyPrivilege 3236 InstallHelper.exe Token: SeIncBasePriorityPrivilege 3236 InstallHelper.exe Token: SeIncreaseQuotaPrivilege 3236 InstallHelper.exe Token: SeProfSingleProcessPrivilege 3236 InstallHelper.exe Token: SeAssignPrimaryTokenPrivilege 4948 ProcessLasso.exe Token: SeDebugPrivilege 4948 ProcessLasso.exe Token: SeChangeNotifyPrivilege 4948 ProcessLasso.exe Token: SeIncBasePriorityPrivilege 4948 ProcessLasso.exe Token: SeIncreaseQuotaPrivilege 4948 ProcessLasso.exe Token: SeCreateGlobalPrivilege 4948 ProcessLasso.exe Token: SeProfSingleProcessPrivilege 4948 ProcessLasso.exe Token: SeBackupPrivilege 4948 ProcessLasso.exe Token: SeRestorePrivilege 4948 ProcessLasso.exe Token: SeAssignPrimaryTokenPrivilege 4684 processgovernor.exe Token: SeDebugPrivilege 4684 processgovernor.exe Token: SeChangeNotifyPrivilege 4684 processgovernor.exe Token: SeIncBasePriorityPrivilege 4684 processgovernor.exe Token: SeIncreaseQuotaPrivilege 4684 processgovernor.exe Token: SeProfSingleProcessPrivilege 4684 processgovernor.exe Token: SeCreateGlobalPrivilege 4684 processgovernor.exe Token: SeBackupPrivilege 4684 processgovernor.exe Token: SeRestorePrivilege 4684 processgovernor.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe 4948 ProcessLasso.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 3672 wrote to memory of 3236 3672 cmd.exe 79 PID 3672 wrote to memory of 3236 3672 cmd.exe 79 PID 3672 wrote to memory of 3236 3672 cmd.exe 79 PID 3236 wrote to memory of 4452 3236 InstallHelper.exe 80 PID 3236 wrote to memory of 4452 3236 InstallHelper.exe 80 PID 3236 wrote to memory of 4452 3236 InstallHelper.exe 80 PID 3672 wrote to memory of 2320 3672 cmd.exe 82 PID 3672 wrote to memory of 2320 3672 cmd.exe 82 PID 3672 wrote to memory of 2320 3672 cmd.exe 82 PID 2320 wrote to memory of 4948 2320 ProcessLassoLauncher.exe 83 PID 2320 wrote to memory of 4948 2320 ProcessLassoLauncher.exe 83 PID 2320 wrote to memory of 4948 2320 ProcessLassoLauncher.exe 83 PID 4948 wrote to memory of 4684 4948 ProcessLasso.exe 85 PID 4948 wrote to memory of 4684 4948 ProcessLasso.exe 85 PID 4948 wrote to memory of 4684 4948 ProcessLasso.exe 85
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\pl.cmd"1⤵
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\InstallHelper.exeInstallHelper.exe /terminate2⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\bitsumms.exe"C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\bitsumms.exe" /name:ProcessGovernor /stop3⤵PID:4452
-
-
-
C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\ProcessLassoLauncher.exeProcessLassoLauncher.exe /showwindow2⤵
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\ProcessLasso.exe"C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\ProcessLasso.exe" "ProcessLassoLauncher.exe" "/showwindow"3⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\processgovernor.exe"C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\processgovernor.exe"4⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4684
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\ProcessLasso\config\prolasso.ini
- Size 7KB
- SHA256 cc92b1ffc62962e1e8267a47df08f5817df148be90a20e984e87ccabf67b2ca9
- MD5 736f41d2f35e6848cec5f81a083c32cf
- SHA1 de983b61b0e002f0ae3d7a1e0fd1e7d66e287b15
- SHA512 fd7ea4b7fd497d3052521bb20b92aed29c1317a33119f56627d37d3d29b9c016a66794893db22fe8952568dd98d58306734e5e03ccb5e88186d505b4098f2c92
- SSDEEP 192:tCFchoD6xeEh7Ja5m+zam8ZrWYF/CZiONkM6HiaE9xum:tEchoD7C7Upzam8ZrWYF/KiONkM6HfEd
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\ProcessLasso\logs\processlasso.log
- Size 1KB
- SHA256 6979eab9488ff4f067cbdf5788ec17790ff0ef27624b57466354d1725c8c2bc1
- MD5 6b9bdfab657b837796e8c892b1bce481
- SHA1 926935f6e0e0dbbd622790a0fc4d6db50092fd87
- SHA512 253706c7926e6f24bfd8e4858f12f6bb7e393d86fac5874904f7a34952f606c554b66a32e6cf5e66d3c4e92bfcb178f6cdc1e8ad760ad7007aa92480f502536c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\Process Lasso 11.1.1.26 #soft8 病毒 0 (111.10.14)\App\ProcessLasso\ProcessLasso.exe
- Size 1.5MB
- SHA256 b10f6f81b153bce13fe126e23989aec9b632d8b44699b29797230b00b22c2bf6
- MD5 a61b53c263109b46baba47fc47a91889
- SHA1 9b78e6b39051e9573367de084724eb16984bc291
- SHA512 0f936631fc31dfa9086bf832d79cf96b56385ab0ddcbfc9b3b7d6c544daec04e8567b903644fe5a89c0f9dae7d17081e995c5df11deacee7e2fe1bd72793b4de
- SSDEEP 49152:DXS5A4iJaoc2KwphMB1avC1r6wo2tAAWUc0g1:TS5A4Yc2KwVC1r612t
- MD5 SHA1 SHA512 SSDEEP