Analysis
- max time kernel
42s - max time network
138s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/08/2026, 10:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-07_1dab5701961b46a594b53a86b0d78b52_elex_wannacry.exe
Resource
win10v2004-20260513-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-07_1dab5701961b46a594b53a86b0d78b52_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
4 signatures
150 seconds
General
- Target 2026-08-07_1dab5701961b46a594b53a86b0d78b52_elex_wannacry.exe
- Size 43KB
- Sample260807-mdzesswtet
- SHA256 96d7fca3a1b562d40d044b9f112c082a72fc75edcd540ea76741cc9160496ec7
- MD5 1dab5701961b46a594b53a86b0d78b52
- SHA1 52a4db2f8f9087c1b16c61ff95ce4b85464578f0
- SHA512 ca1ff67e92841c6081a2f7d502da9d6babddffe0b53654e7578ce538b2fd2ca775cbaf088f27558beca236955670b318ecd2245d91f72a984b4334214b5976bf
- SSDEEP 192:BB+KWZTsj2biHAJvL1+HWIUlI9rPJtgNukUJY+EkBLmnqi87P1oynYJi2wMF:eTiTHAVIOlQENuk+EkBLaqie1SJrz
- TLSH T186139387BEBCDCB2E054027045E7CBB0192978916125AE0B7B70DCAFDC7A353E5B125A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Drops file in Drivers directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\scsi4dos.sys 2026-08-07_1dab5701961b46a594b53a86b0d78b52_elex_wannacry.exe File created C:\Windows\SysWOW64\drivers\scsi4dos.sys scsi4dos.sys File created C:\Windows\SysWOW64\drivers\scsi4dos.sys scsi4dos.sys File created C:\Windows\SysWOW64\drivers\scsi4dos.sys scsi4dos.sys File created C:\Windows\SysWOW64\drivers\scsi4dos.sys scsi4dos.sys File created C:\Windows\SysWOW64\drivers\scsi4dos.sys scsi4dos.sys File created C:\Windows\SysWOW64\drivers\scsi4dos.sys scsi4dos.sys File created C:\Windows\SysWOW64\drivers\scsi4dos.sys scsi4dos.sys File created C:\Windows\SysWOW64\drivers\scsi4dos.sys scsi4dos.sys File created C:\Windows\SysWOW64\drivers\scsi4dos.sys scsi4dos.sys File created C:\Windows\SysWOW64\drivers\scsi4dos.sys Process not Found File created C:\Windows\SysWOW64\drivers\scsi4dos.sys scsi4dos.sys File created C:\Windows\SysWOW64\drivers\scsi4dos.sys scsi4dos.sys File created C:\Windows\SysWOW64\drivers\scsi4dos.sys scsi4dos.sys File created C:\Windows\SysWOW64\drivers\scsi4dos.sys scsi4dos.sys File created C:\Windows\SysWOW64\drivers\scsi4dos.sys scsi4dos.sys File created C:\Windows\SysWOW64\drivers\scsi4dos.sys scsi4dos.sys File created C:\Windows\SysWOW64\drivers\scsi4dos.sys scsi4dos.sys File created C:\Windows\SysWOW64\drivers\scsi4dos.sys scsi4dos.sys File created C:\Windows\SysWOW64\drivers\scsi4dos.sys scsi4dos.sys File created C:\Windows\SysWOW64\drivers\scsi4dos.sys scsi4dos.sys File created C:\Windows\SysWOW64\drivers\scsi4dos.sys scsi4dos.sys File created C:\Windows\SysWOW64\drivers\scsi4dos.sys scsi4dos.sys File created C:\Windows\SysWOW64\drivers\scsi4dos.sys scsi4dos.sys File created C:\Windows\SysWOW64\drivers\scsi4dos.sys scsi4dos.sys File created C:\Windows\SysWOW64\drivers\scsi4dos.sys scsi4dos.sys File created C:\Windows\SysWOW64\drivers\scsi4dos.sys Process not Found File created C:\Windows\SysWOW64\drivers\scsi4dos.sys scsi4dos.sys File created C:\Windows\SysWOW64\drivers\scsi4dos.sys scsi4dos.sys File created C:\Windows\SysWOW64\drivers\scsi4dos.sys scsi4dos.sys File created C:\Windows\SysWOW64\drivers\scsi4dos.sys scsi4dos.sys File created C:\Windows\SysWOW64\drivers\scsi4dos.sys scsi4dos.sys File created C:\Windows\SysWOW64\drivers\scsi4dos.sys scsi4dos.sys File created C:\Windows\SysWOW64\drivers\scsi4dos.sys scsi4dos.sys File created C:\Windows\SysWOW64\drivers\scsi4dos.sys scsi4dos.sys File created C:\Windows\SysWOW64\drivers\scsi4dos.sys scsi4dos.sys File created C:\Windows\SysWOW64\drivers\scsi4dos.sys scsi4dos.sys File created C:\Windows\SysWOW64\drivers\scsi4dos.sys scsi4dos.sys File created C:\Windows\SysWOW64\drivers\scsi4dos.sys scsi4dos.sys File created C:\Windows\SysWOW64\drivers\scsi4dos.sys scsi4dos.sys File created C:\Windows\SysWOW64\drivers\scsi4dos.sys scsi4dos.sys File created C:\Windows\SysWOW64\drivers\scsi4dos.sys scsi4dos.sys File created C:\Windows\SysWOW64\drivers\scsi4dos.sys scsi4dos.sys File created C:\Windows\SysWOW64\drivers\scsi4dos.sys scsi4dos.sys File created C:\Windows\SysWOW64\drivers\scsi4dos.sys scsi4dos.sys File created C:\Windows\SysWOW64\drivers\scsi4dos.sys Process not Found File created C:\Windows\SysWOW64\drivers\scsi4dos.sys scsi4dos.sys File created C:\Windows\SysWOW64\drivers\scsi4dos.sys scsi4dos.sys File created C:\Windows\SysWOW64\drivers\scsi4dos.sys scsi4dos.sys File created C:\Windows\SysWOW64\drivers\scsi4dos.sys scsi4dos.sys File created C:\Windows\SysWOW64\drivers\scsi4dos.sys scsi4dos.sys File created C:\Windows\SysWOW64\drivers\scsi4dos.sys scsi4dos.sys File created C:\Windows\SysWOW64\drivers\scsi4dos.sys scsi4dos.sys File created C:\Windows\SysWOW64\drivers\scsi4dos.sys scsi4dos.sys File created C:\Windows\SysWOW64\drivers\scsi4dos.sys scsi4dos.sys File created C:\Windows\SysWOW64\drivers\scsi4dos.sys Process not Found File created C:\Windows\SysWOW64\drivers\scsi4dos.sys scsi4dos.sys File created C:\Windows\SysWOW64\drivers\scsi4dos.sys scsi4dos.sys File created C:\Windows\SysWOW64\drivers\scsi4dos.sys scsi4dos.sys File created C:\Windows\SysWOW64\drivers\scsi4dos.sys scsi4dos.sys File created C:\Windows\SysWOW64\drivers\scsi4dos.sys scsi4dos.sys File created C:\Windows\SysWOW64\drivers\scsi4dos.sys scsi4dos.sys File created C:\Windows\SysWOW64\drivers\scsi4dos.sys scsi4dos.sys File created C:\Windows\SysWOW64\drivers\scsi4dos.sys scsi4dos.sys - Executes dropped EXE 64 IoCs
pid Process 2632 scsi4dos.sys 4048 scsi4dos.sys 3636 scsi4dos.sys 2944 scsi4dos.sys 5856 scsi4dos.sys 5640 scsi4dos.sys 2904 scsi4dos.sys 252 scsi4dos.sys 2740 scsi4dos.sys 6044 scsi4dos.sys 2444 scsi4dos.sys 1272 scsi4dos.sys 4092 scsi4dos.sys 5172 scsi4dos.sys 1144 scsi4dos.sys 2404 scsi4dos.sys 3468 scsi4dos.sys 5944 scsi4dos.sys 1160 scsi4dos.sys 1780 scsi4dos.sys 2124 scsi4dos.sys 1128 scsi4dos.sys 5964 scsi4dos.sys 5420 scsi4dos.sys 1620 scsi4dos.sys 4332 scsi4dos.sys 5456 scsi4dos.sys 4204 scsi4dos.sys 4184 scsi4dos.sys 2332 scsi4dos.sys 1008 scsi4dos.sys 3668 scsi4dos.sys 260 scsi4dos.sys 3148 scsi4dos.sys 4408 scsi4dos.sys 5852 scsi4dos.sys 5436 scsi4dos.sys 3496 scsi4dos.sys 1968 scsi4dos.sys 2552 scsi4dos.sys 3360 scsi4dos.sys 1708 scsi4dos.sys 1680 scsi4dos.sys 5132 scsi4dos.sys 3388 scsi4dos.sys 1744 scsi4dos.sys 5432 scsi4dos.sys 1816 scsi4dos.sys 5212 scsi4dos.sys 5124 scsi4dos.sys 2936 scsi4dos.sys 4600 scsi4dos.sys 4924 scsi4dos.sys 5236 scsi4dos.sys 3656 scsi4dos.sys 4292 scsi4dos.sys 1404 scsi4dos.sys 828 scsi4dos.sys 3124 scsi4dos.sys 4556 scsi4dos.sys 5332 scsi4dos.sys 1136 scsi4dos.sys 4980 scsi4dos.sys 4356 scsi4dos.sys - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scsi4dos.sys Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scsi4dos.sys Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scsi4dos.sys Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scsi4dos.sys Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scsi4dos.sys Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scsi4dos.sys Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scsi4dos.sys Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scsi4dos.sys Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scsi4dos.sys Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scsi4dos.sys Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scsi4dos.sys Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scsi4dos.sys Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scsi4dos.sys Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scsi4dos.sys Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scsi4dos.sys Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scsi4dos.sys Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scsi4dos.sys Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scsi4dos.sys Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scsi4dos.sys Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scsi4dos.sys Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scsi4dos.sys Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scsi4dos.sys Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scsi4dos.sys Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scsi4dos.sys Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scsi4dos.sys Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scsi4dos.sys Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scsi4dos.sys Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scsi4dos.sys Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scsi4dos.sys Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scsi4dos.sys Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scsi4dos.sys Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scsi4dos.sys Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scsi4dos.sys Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scsi4dos.sys Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scsi4dos.sys Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scsi4dos.sys Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scsi4dos.sys Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scsi4dos.sys Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scsi4dos.sys Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scsi4dos.sys Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scsi4dos.sys Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scsi4dos.sys Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scsi4dos.sys Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scsi4dos.sys Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scsi4dos.sys Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scsi4dos.sys Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scsi4dos.sys Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scsi4dos.sys Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scsi4dos.sys Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scsi4dos.sys Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scsi4dos.sys Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scsi4dos.sys Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scsi4dos.sys Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scsi4dos.sys Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scsi4dos.sys Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scsi4dos.sys Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scsi4dos.sys Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scsi4dos.sys Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scsi4dos.sys - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5956 wrote to memory of 2632 5956 2026-08-07_1dab5701961b46a594b53a86b0d78b52_elex_wannacry.exe 89 PID 2632 wrote to memory of 4048 2632 scsi4dos.sys 90 PID 4048 wrote to memory of 3636 4048 scsi4dos.sys 91 PID 3636 wrote to memory of 2944 3636 scsi4dos.sys 92 PID 2944 wrote to memory of 5856 2944 scsi4dos.sys 93 PID 5856 wrote to memory of 5640 5856 scsi4dos.sys 94 PID 5640 wrote to memory of 2904 5640 scsi4dos.sys 95 PID 2904 wrote to memory of 252 2904 scsi4dos.sys 96 PID 252 wrote to memory of 2740 252 scsi4dos.sys 97 PID 2740 wrote to memory of 6044 2740 scsi4dos.sys 98 PID 6044 wrote to memory of 2444 6044 scsi4dos.sys 99 PID 2444 wrote to memory of 1272 2444 scsi4dos.sys 101 PID 1272 wrote to memory of 4092 1272 scsi4dos.sys 102 PID 4092 wrote to memory of 5172 4092 scsi4dos.sys 103 PID 5172 wrote to memory of 1144 5172 scsi4dos.sys 104 PID 1144 wrote to memory of 2404 1144 scsi4dos.sys 105 PID 2404 wrote to memory of 3468 2404 scsi4dos.sys 106 PID 3468 wrote to memory of 5944 3468 scsi4dos.sys 107 PID 5944 wrote to memory of 1160 5944 scsi4dos.sys 108 PID 1160 wrote to memory of 1780 1160 scsi4dos.sys 109 PID 1780 wrote to memory of 2124 1780 scsi4dos.sys 110 PID 2124 wrote to memory of 1128 2124 scsi4dos.sys 111 PID 1128 wrote to memory of 5964 1128 scsi4dos.sys 112 PID 5964 wrote to memory of 5420 5964 scsi4dos.sys 113 PID 5420 wrote to memory of 1620 5420 scsi4dos.sys 114 PID 1620 wrote to memory of 4332 1620 scsi4dos.sys 115 PID 4332 wrote to memory of 5456 4332 scsi4dos.sys 116 PID 5456 wrote to memory of 4204 5456 scsi4dos.sys 117 PID 4204 wrote to memory of 4184 4204 scsi4dos.sys 118 PID 4184 wrote to memory of 2332 4184 scsi4dos.sys 119 PID 2332 wrote to memory of 1008 2332 scsi4dos.sys 120 PID 1008 wrote to memory of 3668 1008 scsi4dos.sys 121 PID 3668 wrote to memory of 260 3668 scsi4dos.sys 122 PID 260 wrote to memory of 3148 260 scsi4dos.sys 123 PID 3148 wrote to memory of 4408 3148 scsi4dos.sys 124 PID 4408 wrote to memory of 5852 4408 scsi4dos.sys 125 PID 5852 wrote to memory of 5436 5852 scsi4dos.sys 126 PID 5436 wrote to memory of 3496 5436 scsi4dos.sys 127 PID 3496 wrote to memory of 1968 3496 scsi4dos.sys 128 PID 1968 wrote to memory of 2552 1968 scsi4dos.sys 129 PID 2552 wrote to memory of 3360 2552 scsi4dos.sys 130 PID 3360 wrote to memory of 1708 3360 scsi4dos.sys 131 PID 1708 wrote to memory of 1680 1708 scsi4dos.sys 132 PID 1680 wrote to memory of 5132 1680 scsi4dos.sys 133 PID 5132 wrote to memory of 3388 5132 scsi4dos.sys 134 PID 3388 wrote to memory of 1744 3388 scsi4dos.sys 135 PID 1744 wrote to memory of 5432 1744 scsi4dos.sys 136 PID 5432 wrote to memory of 1816 5432 scsi4dos.sys 137 PID 1816 wrote to memory of 5212 1816 scsi4dos.sys 138 PID 5212 wrote to memory of 5124 5212 scsi4dos.sys 139 PID 5124 wrote to memory of 2936 5124 scsi4dos.sys 140 PID 2936 wrote to memory of 4600 2936 scsi4dos.sys 141 PID 4600 wrote to memory of 4924 4600 scsi4dos.sys 142 PID 4924 wrote to memory of 5236 4924 scsi4dos.sys 143 PID 5236 wrote to memory of 3656 5236 scsi4dos.sys 144 PID 3656 wrote to memory of 4292 3656 scsi4dos.sys 145 PID 4292 wrote to memory of 1404 4292 scsi4dos.sys 146 PID 1404 wrote to memory of 828 1404 scsi4dos.sys 147 PID 828 wrote to memory of 3124 828 scsi4dos.sys 148 PID 3124 wrote to memory of 4556 3124 scsi4dos.sys 149 PID 4556 wrote to memory of 5332 4556 scsi4dos.sys 150 PID 5332 wrote to memory of 1136 5332 scsi4dos.sys 151 PID 1136 wrote to memory of 4980 1136 scsi4dos.sys 152 PID 4980 wrote to memory of 4356 4980 scsi4dos.sys 153
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_1dab5701961b46a594b53a86b0d78b52_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-07_1dab5701961b46a594b53a86b0d78b52_elex_wannacry.exe"1⤵
- Drops file in Drivers directory
- Suspicious use of WriteProcessMemory
PID:5956 -
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Users\Admin\AppData\Local\Temp\2026-08-07_1dab5701961b46a594b53a86b0d78b52_elex_wannacry.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5856 -
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5640 -
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:252 -
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6044 -
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5172 -
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys17⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5944 -
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5964 -
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5420 -
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys28⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5456 -
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys32⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:260 -
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5852 -
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5436 -
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys45⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5132 -
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys47⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5432 -
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5212 -
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5124 -
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5236 -
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5332 -
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys65⤵
- Executes dropped EXE
PID:4356 -
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys66⤵PID:3472
-
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys67⤵PID:3020
-
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys68⤵PID:1016
-
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys69⤵PID:2008
-
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys70⤵
- System Location Discovery: System Language Discovery
PID:5020 -
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys71⤵PID:4944
-
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys72⤵PID:6120
-
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys73⤵PID:2528
-
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys74⤵PID:4040
-
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys75⤵PID:5876
-
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys76⤵
- Drops file in Drivers directory
PID:1392 -
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys77⤵PID:5724
-
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys78⤵PID:3032
-
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys79⤵PID:1804
-
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys80⤵PID:4896
-
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys81⤵PID:3164
-
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys82⤵PID:2824
-
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys83⤵PID:1244
-
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys84⤵PID:5940
-
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys85⤵PID:4940
-
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys86⤵PID:3564
-
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys87⤵PID:4520
-
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys88⤵PID:3260
-
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys89⤵PID:1840
-
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys90⤵PID:2376
-
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys91⤵PID:4228
-
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys92⤵PID:4468
-
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys93⤵PID:2968
-
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys94⤵PID:5680
-
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys95⤵
- System Location Discovery: System Language Discovery
PID:2016 -
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys96⤵PID:4704
-
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys97⤵PID:5476
-
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys98⤵PID:6008
-
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys99⤵PID:4984
-
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys100⤵PID:5112
-
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys101⤵PID:1196
-
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys102⤵PID:1548
-
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys103⤵PID:1724
-
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys104⤵PID:4564
-
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys105⤵PID:4196
-
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys106⤵PID:5660
-
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys107⤵PID:3512
-
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys108⤵PID:2348
-
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys109⤵
- Drops file in Drivers directory
PID:4988 -
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys110⤵PID:5352
-
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys111⤵PID:5608
-
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys112⤵PID:2000
-
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys113⤵
- Drops file in Drivers directory
PID:2712 -
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys114⤵PID:2684
-
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys115⤵
- System Location Discovery: System Language Discovery
PID:124 -
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys116⤵PID:4788
-
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys117⤵PID:616
-
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys118⤵PID:3300
-
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys119⤵PID:4056
-
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys120⤵PID:3172
-
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys121⤵PID:2524
-
C:\Windows\SysWOW64\drivers\scsi4dos.sysC:\Windows\SysWOW64\drivers\scsi4dos.sys122⤵
- System Location Discovery: System Language Discovery
PID:2472
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-