Analysis
- max time kernel
18s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
19/09/2026, 18:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118__a87aba7417b7ea9bd71f1e7c26213154.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target jaffacakes118__a87aba7417b7ea9bd71f1e7c26213154.exe
- Size 78KB
- Sample260919-w5pjcaae43
- SHA256 5e788f3161593834aba1715d21a12cb72ec50f2ebbcadab01db4b8eda23c04cb
- MD5 a87aba7417b7ea9bd71f1e7c26213154
- SHA1 54fb174395a7634aefccd125803352ede4870658
- SHA512 b858ab38eaa5577ecf96f0fec236ecb0c40d4d2834a0e268d2679972b55d763cff8e2467dc7b774fa93185096cbb810a18e88575e6f7a8074b7fb7a6f667a11a
- SSDEEP 1536:OBZ8eLQYyj3GR/CLRvPORdcv5a6/08QJy2mx4sux21LTCTIRa4b+WAEW:CpQYyrUiv2Rivt08b5xbuAuIRaC+WpW
- TLSH T1D07302BB3FE67EB8E8C5867303673C18F57806536B756B1B23161EC974448B0993846E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4764 csrss.exe 5088 csrss.exe 2180 csrss.exe 4316 csrss.exe 4884 csrss.exe 4576 csrss.exe 2256 csrss.exe 624 csrss.exe 3372 csrss.exe 4748 csrss.exe 4688 csrss.exe 4796 csrss.exe 2264 csrss.exe 3292 csrss.exe 3772 csrss.exe 1308 csrss.exe 2884 csrss.exe 3132 csrss.exe 4076 csrss.exe 4460 csrss.exe 1904 csrss.exe 2852 csrss.exe 2580 csrss.exe 3972 csrss.exe 4816 csrss.exe 2960 csrss.exe 4208 csrss.exe 4392 csrss.exe 4300 csrss.exe 3264 csrss.exe 2344 csrss.exe 840 csrss.exe 4644 csrss.exe 956 csrss.exe 884 csrss.exe 3512 csrss.exe 4740 csrss.exe 968 csrss.exe 2940 csrss.exe 2880 csrss.exe 3524 csrss.exe 4296 csrss.exe 3476 csrss.exe 1696 csrss.exe 1824 csrss.exe 532 csrss.exe 220 csrss.exe 4404 csrss.exe 4524 csrss.exe 4804 csrss.exe 4436 csrss.exe 4868 csrss.exe 3440 csrss.exe 4328 csrss.exe 1676 csrss.exe 4368 csrss.exe 4844 csrss.exe 3964 csrss.exe 2620 csrss.exe 2496 csrss.exe 4584 csrss.exe 2532 csrss.exe 4720 csrss.exe 4380 csrss.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\zwghnavx\csrss.exe csrss.exe File created C:\Windows\SysWOW64\xnucphodz\csrss.exe csrss.exe File created C:\Windows\SysWOW64\uwxeax\csrss.exe csrss.exe File created C:\Windows\SysWOW64\mdzkhov\csrss.exe csrss.exe File created C:\Windows\SysWOW64\spgszokprq\csrss.exe csrss.exe File opened for modification C:\Windows\SysWOW64\iosexsh csrss.exe File opened for modification C:\Windows\SysWOW64\fksqzx\csrss.exe csrss.exe File opened for modification C:\Windows\SysWOW64\mpigxc\csrss.exe csrss.exe File created C:\Windows\SysWOW64\zvibgxfruk\csrss.exe csrss.exe File opened for modification C:\Windows\SysWOW64\kgvhhmeoww csrss.exe File opened for modification C:\Windows\SysWOW64\kketext csrss.exe File opened for modification C:\Windows\SysWOW64\sxkbko\csrss.exe csrss.exe File created C:\Windows\SysWOW64\pmdpvoxo\csrss.exe csrss.exe File created C:\Windows\SysWOW64\xgndxbe\csrss.exe csrss.exe File created C:\Windows\SysWOW64\ewkletu\csrss.exe csrss.exe File opened for modification C:\Windows\SysWOW64\tehiwrwz csrss.exe File opened for modification C:\Windows\SysWOW64\dzbkhhe csrss.exe File opened for modification C:\Windows\SysWOW64\itqdzr\csrss.exe csrss.exe File created C:\Windows\SysWOW64\hkcejbgcca\csrss.exe csrss.exe File created C:\Windows\SysWOW64\njkwkmajj\csrss.exe csrss.exe File opened for modification C:\Windows\SysWOW64\csefsrhehc\csrss.exe csrss.exe File opened for modification C:\Windows\SysWOW64\ulioapwiei csrss.exe File opened for modification C:\Windows\SysWOW64\tqufaoaw\csrss.exe csrss.exe File opened for modification C:\Windows\SysWOW64\dkpgqstdlm\csrss.exe csrss.exe File opened for modification C:\Windows\SysWOW64\dxqqzdy\csrss.exe csrss.exe File opened for modification C:\Windows\SysWOW64\tzpdel\csrss.exe csrss.exe File opened for modification C:\Windows\SysWOW64\nimqdj\csrss.exe csrss.exe File opened for modification C:\Windows\SysWOW64\viqqwbmlvi csrss.exe File opened for modification C:\Windows\SysWOW64\dvvzyftqly csrss.exe File opened for modification C:\Windows\SysWOW64\wzfefvtzhs csrss.exe File created C:\Windows\SysWOW64\fmmiawk\csrss.exe csrss.exe File created C:\Windows\SysWOW64\hajzboww\csrss.exe csrss.exe File opened for modification C:\Windows\SysWOW64\opibac csrss.exe File opened for modification C:\Windows\SysWOW64\gsqiwr\csrss.exe csrss.exe File created C:\Windows\SysWOW64\yvtpajer\csrss.exe csrss.exe File opened for modification C:\Windows\SysWOW64\onybkvca\csrss.exe csrss.exe File created C:\Windows\SysWOW64\esgtrb\csrss.exe csrss.exe File opened for modification C:\Windows\SysWOW64\euyrvp\csrss.exe csrss.exe File opened for modification C:\Windows\SysWOW64\rzduhzea csrss.exe File opened for modification C:\Windows\SysWOW64\toalirryi\csrss.exe csrss.exe File opened for modification C:\Windows\SysWOW64\fmmiawk csrss.exe File opened for modification C:\Windows\SysWOW64\toaneegfnh csrss.exe File opened for modification C:\Windows\SysWOW64\uxkxnomyvw csrss.exe File created C:\Windows\SysWOW64\pcjljnc\csrss.exe csrss.exe File opened for modification C:\Windows\SysWOW64\wejxrniiui\csrss.exe csrss.exe File opened for modification C:\Windows\SysWOW64\sivtpmki csrss.exe File created C:\Windows\SysWOW64\zxzpytk\csrss.exe csrss.exe File created C:\Windows\SysWOW64\iiimmqm\csrss.exe csrss.exe File opened for modification C:\Windows\SysWOW64\xxogbhjcyt csrss.exe File opened for modification C:\Windows\SysWOW64\upmfqvwlmm csrss.exe File created C:\Windows\SysWOW64\phvymmitn\csrss.exe csrss.exe File opened for modification C:\Windows\SysWOW64\mjpvgxa\csrss.exe csrss.exe File opened for modification C:\Windows\SysWOW64\vzpyhlhfzn csrss.exe File opened for modification C:\Windows\SysWOW64\uncfaob\csrss.exe csrss.exe File opened for modification C:\Windows\SysWOW64\oxyzgpwmey\csrss.exe csrss.exe File opened for modification C:\Windows\SysWOW64\uuikax\csrss.exe csrss.exe File opened for modification C:\Windows\SysWOW64\nvszie csrss.exe File opened for modification C:\Windows\SysWOW64\njkwkmajj\csrss.exe csrss.exe File opened for modification C:\Windows\SysWOW64\kketext\csrss.exe csrss.exe File created C:\Windows\SysWOW64\ulhtlhw\csrss.exe csrss.exe File opened for modification C:\Windows\SysWOW64\jvyiap\csrss.exe csrss.exe File opened for modification C:\Windows\SysWOW64\eniupdp\csrss.exe csrss.exe File opened for modification C:\Windows\SysWOW64\knmyfv\csrss.exe csrss.exe File created C:\Windows\SysWOW64\kjnglaolfv\csrss.exe csrss.exe - Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 9956 Process not Found 6288 cmd.exe 9396 Process not Found 11380 Process not Found 13320 Process not Found 16356 Process not Found 7376 cmd.exe 8800 Process not Found 13828 Process not Found 8112 Process not Found 10076 Process not Found 10972 Process not Found 19356 Process not Found 8056 cmd.exe 9148 Process not Found 18012 Process not Found 628 cmd.exe 7880 cmd.exe 9048 Process not Found 11440 Process not Found 15604 Process not Found 14036 Process not Found 12736 Process not Found 12948 Process not Found 18428 Process not Found 7056 cmd.exe 1408 Process not Found 12680 Process not Found 6656 cmd.exe 4232 Process not Found 11692 Process not Found 14860 Process not Found 3776 cmd.exe 9556 cmd.exe 1076 Process not Found 20280 Process not Found 10168 cmd.exe 216 Process not Found 14836 Process not Found 16540 Process not Found 6324 cmd.exe 13624 Process not Found 5292 Process not Found 10648 Process not Found 20288 Process not Found 2240 cmd.exe 2224 Process not Found 17404 Process not Found 15412 Process not Found 2836 Process not Found 14824 Process not Found 12168 Process not Found 2856 cmd.exe 7144 cmd.exe 7152 Process not Found 3484 cmd.exe 7416 Process not Found 10444 Process not Found 8448 Process not Found 8172 Process not Found 7360 Process not Found 5624 Process not Found 19912 Process not Found 10488 Process not Found - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe - System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 64 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 10828 Process not Found 15200 Process not Found 17644 Process not Found 6396 PING.EXE 7120 PING.EXE 4848 Process not Found 4396 Process not Found 13924 Process not Found 18340 Process not Found 18824 Process not Found 21104 Process not Found 5040 PING.EXE 11944 Process not Found 13136 Process not Found 12048 Process not Found 11948 Process not Found 17932 Process not Found 1020 PING.EXE 7892 PING.EXE 8448 Process not Found 7736 PING.EXE 8152 PING.EXE 9296 Process not Found 10588 Process not Found 6216 Process not Found 11608 Process not Found 13124 Process not Found 3976 Process not Found 16312 Process not Found 15492 Process not Found 19380 Process not Found 17856 Process not Found 7000 PING.EXE 12508 Process not Found 14376 Process not Found 3652 Process not Found 10324 Process not Found 13884 Process not Found 16016 Process not Found 14800 Process not Found 11496 Process not Found 10504 Process not Found 10512 Process not Found 14748 Process not Found 5700 Process not Found 19408 Process not Found 2088 PING.EXE 10896 Process not Found 19572 Process not Found 7920 PING.EXE 7868 PING.EXE 13356 Process not Found 14480 Process not Found 13036 Process not Found 18684 Process not Found 7444 PING.EXE 7576 PING.EXE 9172 Process not Found 13684 Process not Found 12504 Process not Found 12612 Process not Found 11744 Process not Found 14124 Process not Found 13016 Process not Found - Runs ping.exe 1 TTPs 64 IoCs
pid Process 10048 Process not Found 13260 Process not Found 16976 Process not Found 17980 Process not Found 8484 PING.EXE 8252 PING.EXE 4332 Process not Found 3288 Process not Found 14172 Process not Found 7756 Process not Found 14800 Process not Found 12368 Process not Found 7000 PING.EXE 8120 PING.EXE 11248 Process not Found 1036 Process not Found 13284 Process not Found 14500 Process not Found 16704 Process not Found 4196 Process not Found 8908 Process not Found 12376 Process not Found 14820 Process not Found 12936 Process not Found 18776 Process not Found 12976 Process not Found 11788 Process not Found 12828 Process not Found 14516 Process not Found 14028 Process not Found 17388 Process not Found 18824 Process not Found 5656 PING.EXE 4936 Process not Found 10476 Process not Found 8768 Process not Found 17884 Process not Found 12264 Process not Found 12188 Process not Found 19488 Process not Found 12524 Process not Found 12168 Process not Found 11788 Process not Found 8888 Process not Found 8480 Process not Found 9788 Process not Found 8260 Process not Found 11132 Process not Found 17224 Process not Found 1316 Process not Found 8560 Process not Found 9608 Process not Found 10504 Process not Found 14000 Process not Found 4240 Process not Found 14480 Process not Found 18596 Process not Found 8060 Process not Found 11468 Process not Found 15772 Process not Found 12056 Process not Found 3820 Process not Found 17076 Process not Found 12544 Process not Found - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1160 jaffacakes118__a87aba7417b7ea9bd71f1e7c26213154.exe 4764 csrss.exe 5088 csrss.exe 2180 csrss.exe 4316 csrss.exe 4884 csrss.exe 4576 csrss.exe 2256 csrss.exe 624 csrss.exe 3372 csrss.exe 4748 csrss.exe 4688 csrss.exe 4796 csrss.exe 2264 csrss.exe 3292 csrss.exe 3772 csrss.exe 1308 csrss.exe 2884 csrss.exe 3132 csrss.exe 4076 csrss.exe 4460 csrss.exe 1904 csrss.exe 2852 csrss.exe 2580 csrss.exe 3972 csrss.exe 4816 csrss.exe 2960 csrss.exe 4208 csrss.exe 4392 csrss.exe 4300 csrss.exe 3264 csrss.exe 2344 csrss.exe 840 csrss.exe 4644 csrss.exe 956 csrss.exe 884 csrss.exe 3512 csrss.exe 4740 csrss.exe 968 csrss.exe 2940 csrss.exe 2880 csrss.exe 3524 csrss.exe 4296 csrss.exe 3476 csrss.exe 1696 csrss.exe 1824 csrss.exe 532 csrss.exe 220 csrss.exe 4404 csrss.exe 4524 csrss.exe 4804 csrss.exe 4436 csrss.exe 4868 csrss.exe 3440 csrss.exe 4328 csrss.exe 1676 csrss.exe 4368 csrss.exe 4844 csrss.exe 3964 csrss.exe 2620 csrss.exe 2496 csrss.exe 4584 csrss.exe 2532 csrss.exe 4720 csrss.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1160 wrote to memory of 4764 1160 jaffacakes118__a87aba7417b7ea9bd71f1e7c26213154.exe 86 PID 4764 wrote to memory of 5088 4764 csrss.exe 87 PID 5088 wrote to memory of 2180 5088 csrss.exe 88 PID 2180 wrote to memory of 4316 2180 csrss.exe 89 PID 4316 wrote to memory of 4884 4316 csrss.exe 90 PID 4884 wrote to memory of 4576 4884 csrss.exe 91 PID 4576 wrote to memory of 2256 4576 csrss.exe 92 PID 2256 wrote to memory of 624 2256 csrss.exe 93 PID 624 wrote to memory of 3372 624 csrss.exe 94 PID 3372 wrote to memory of 4748 3372 csrss.exe 95 PID 4748 wrote to memory of 4688 4748 csrss.exe 96 PID 4688 wrote to memory of 4796 4688 csrss.exe 97 PID 4796 wrote to memory of 2264 4796 csrss.exe 98 PID 2264 wrote to memory of 3292 2264 csrss.exe 99 PID 3292 wrote to memory of 3772 3292 csrss.exe 100 PID 3772 wrote to memory of 1308 3772 csrss.exe 101 PID 1308 wrote to memory of 2884 1308 csrss.exe 103 PID 2884 wrote to memory of 3132 2884 csrss.exe 104 PID 3132 wrote to memory of 4076 3132 csrss.exe 106 PID 4076 wrote to memory of 4460 4076 csrss.exe 107 PID 4460 wrote to memory of 1904 4460 csrss.exe 108 PID 1904 wrote to memory of 2852 1904 csrss.exe 109 PID 2852 wrote to memory of 2580 2852 csrss.exe 110 PID 2580 wrote to memory of 3972 2580 csrss.exe 111 PID 3972 wrote to memory of 4816 3972 csrss.exe 113 PID 4816 wrote to memory of 2960 4816 csrss.exe 114 PID 2960 wrote to memory of 4208 2960 csrss.exe 115 PID 4208 wrote to memory of 4392 4208 csrss.exe 116 PID 4392 wrote to memory of 4300 4392 csrss.exe 117 PID 4300 wrote to memory of 3264 4300 csrss.exe 118 PID 3264 wrote to memory of 2344 3264 csrss.exe 119 PID 2344 wrote to memory of 840 2344 csrss.exe 120 PID 840 wrote to memory of 4644 840 csrss.exe 121 PID 4644 wrote to memory of 956 4644 csrss.exe 122 PID 956 wrote to memory of 884 956 csrss.exe 123 PID 884 wrote to memory of 3512 884 csrss.exe 124 PID 3512 wrote to memory of 4740 3512 csrss.exe 125 PID 4740 wrote to memory of 968 4740 csrss.exe 126 PID 968 wrote to memory of 2940 968 csrss.exe 127 PID 2940 wrote to memory of 2880 2940 csrss.exe 128 PID 2880 wrote to memory of 3524 2880 csrss.exe 129 PID 3524 wrote to memory of 4296 3524 csrss.exe 130 PID 4296 wrote to memory of 3476 4296 csrss.exe 131 PID 3476 wrote to memory of 1696 3476 csrss.exe 132 PID 1696 wrote to memory of 1824 1696 csrss.exe 135 PID 1824 wrote to memory of 532 1824 csrss.exe 136 PID 532 wrote to memory of 220 532 csrss.exe 137 PID 220 wrote to memory of 4404 220 csrss.exe 138 PID 4404 wrote to memory of 4524 4404 csrss.exe 139 PID 4524 wrote to memory of 4804 4524 csrss.exe 140 PID 4804 wrote to memory of 4436 4804 csrss.exe 141 PID 4436 wrote to memory of 4868 4436 csrss.exe 142 PID 4868 wrote to memory of 3440 4868 csrss.exe 143 PID 3440 wrote to memory of 4328 3440 csrss.exe 144 PID 4328 wrote to memory of 1676 4328 csrss.exe 145 PID 1676 wrote to memory of 4368 1676 csrss.exe 146 PID 4368 wrote to memory of 4844 4368 csrss.exe 147 PID 4844 wrote to memory of 3964 4844 csrss.exe 148 PID 3964 wrote to memory of 2620 3964 csrss.exe 150 PID 2620 wrote to memory of 2496 2620 csrss.exe 151 PID 2496 wrote to memory of 4584 2496 csrss.exe 152 PID 4584 wrote to memory of 2532 4584 csrss.exe 153 PID 2532 wrote to memory of 4720 2532 csrss.exe 154 PID 4720 wrote to memory of 4380 4720 csrss.exe 156
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118__a87aba7417b7ea9bd71f1e7c26213154.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__a87aba7417b7ea9bd71f1e7c26213154.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Windows\SysWOW64\nnivmlqf\csrss.exeC:\Windows\system32\nnivmlqf\csrss.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Windows\SysWOW64\hqwpagbkc\csrss.exeC:\Windows\system32\hqwpagbkc\csrss.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Windows\SysWOW64\dfpdkg\csrss.exeC:\Windows\system32\dfpdkg\csrss.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Windows\SysWOW64\xvdhhmdq\csrss.exeC:\Windows\system32\xvdhhmdq\csrss.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Windows\SysWOW64\hpyjsd\csrss.exeC:\Windows\system32\hpyjsd\csrss.exe6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Windows\SysWOW64\uwxeax\csrss.exeC:\Windows\system32\uwxeax\csrss.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Windows\SysWOW64\vzpyhlhfzn\csrss.exeC:\Windows\system32\vzpyhlhfzn\csrss.exe8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Windows\SysWOW64\igptqfstba\csrss.exeC:\Windows\system32\igptqfstba\csrss.exe9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Windows\SysWOW64\mexqorklo\csrss.exeC:\Windows\system32\mexqorklo\csrss.exe10⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Windows\SysWOW64\itqdzr\csrss.exeC:\Windows\system32\itqdzr\csrss.exe11⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Windows\SysWOW64\wzrsaisz\csrss.exeC:\Windows\system32\wzrsaisz\csrss.exe12⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Windows\SysWOW64\zxxvgxaxmk\csrss.exeC:\Windows\system32\zxxvgxaxmk\csrss.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Windows\SysWOW64\mdzkhov\csrss.exeC:\Windows\system32\mdzkhov\csrss.exe14⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Windows\SysWOW64\pogwwoiawu\csrss.exeC:\Windows\system32\pogwwoiawu\csrss.exe15⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Windows\SysWOW64\cvfrfjspy\csrss.exeC:\Windows\system32\cvfrfjspy\csrss.exe16⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Windows\SysWOW64\zxzpytk\csrss.exeC:\Windows\system32\zxzpytk\csrss.exe17⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Windows\SysWOW64\cigbou\csrss.exeC:\Windows\system32\cigbou\csrss.exe18⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\SysWOW64\ggpyngqege\csrss.exeC:\Windows\system32\ggpyngqege\csrss.exe19⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\Windows\SysWOW64\tmotvaasi\csrss.exeC:\Windows\system32\tmotvaasi\csrss.exe20⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Windows\SysWOW64\gsqiwr\csrss.exeC:\Windows\system32\gsqiwr\csrss.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Windows\SysWOW64\tzpdel\csrss.exeC:\Windows\system32\tzpdel\csrss.exe22⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Windows\SysWOW64\osuhpjwjwt\csrss.exeC:\Windows\system32\osuhpjwjwt\csrss.exe23⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\SysWOW64\bztcyegxy\csrss.exeC:\Windows\system32\bztcyegxy\csrss.exe24⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Windows\SysWOW64\ofvrzv\csrss.exeC:\Windows\system32\ofvrzv\csrss.exe25⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Windows\SysWOW64\bmumhp\csrss.exeC:\Windows\system32\bmumhp\csrss.exe26⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Windows\SysWOW64\ekcjgbengd\csrss.exeC:\Windows\system32\ekcjgbengd\csrss.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Windows\SysWOW64\iiimmqm\csrss.exeC:\Windows\system32\iiimmqm\csrss.exe28⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Windows\SysWOW64\fwdtpm\csrss.exeC:\Windows\system32\fwdtpm\csrss.exe29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Windows\SysWOW64\blwgzlwp\csrss.exeC:\Windows\system32\blwgzlwp\csrss.exe30⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Windows\SysWOW64\ynqdtw\csrss.exeC:\Windows\system32\ynqdtw\csrss.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Windows\SysWOW64\ltssunka\csrss.exeC:\Windows\system32\ltssunka\csrss.exe32⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Windows\SysWOW64\fwfniiuet\csrss.exeC:\Windows\system32\fwfniiuet\csrss.exe33⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Windows\SysWOW64\scfiqdes\csrss.exeC:\Windows\system32\scfiqdes\csrss.exe34⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Windows\SysWOW64\vaneppxk\csrss.exeC:\Windows\system32\vaneppxk\csrss.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Windows\SysWOW64\spgszokprq\csrss.exeC:\Windows\system32\spgszokprq\csrss.exe36⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Windows\SysWOW64\lfvwwvz\csrss.exeC:\Windows\system32\lfvwwvz\csrss.exe37⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Windows\SysWOW64\dnsorsdp\csrss.exeC:\Windows\system32\dnsorsdp\csrss.exe38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Windows\SysWOW64\qurjano\csrss.exeC:\Windows\system32\qurjano\csrss.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Windows\SysWOW64\nimqdj\csrss.exeC:\Windows\system32\nimqdj\csrss.exe40⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Windows\SysWOW64\apmlld\csrss.exeC:\Windows\system32\apmlld\csrss.exe41⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Windows\SysWOW64\dmuikpokpd\csrss.exeC:\Windows\system32\dmuikpokpd\csrss.exe42⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\Windows\SysWOW64\xdhsoztrdj\csrss.exeC:\Windows\system32\xdhsoztrdj\csrss.exe43⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Windows\SysWOW64\rgvnbv\csrss.exeC:\Windows\system32\rgvnbv\csrss.exe44⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Windows\SysWOW64\emwbclye\csrss.exeC:\Windows\system32\emwbclye\csrss.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Windows\SysWOW64\hkcejbgcca\csrss.exeC:\Windows\system32\hkcejbgcca\csrss.exe46⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Windows\SysWOW64\uqetjrb\csrss.exeC:\Windows\system32\uqetjrb\csrss.exe47⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:532 -
C:\Windows\SysWOW64\hxdosm\csrss.exeC:\Windows\system32\hxdosm\csrss.exe48⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Windows\SysWOW64\udfdtdgh\csrss.exeC:\Windows\system32\udfdtdgh\csrss.exe49⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Windows\SysWOW64\hjeybxr\csrss.exeC:\Windows\system32\hjeybxr\csrss.exe50⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Windows\SysWOW64\bmssotba\csrss.exeC:\Windows\system32\bmssotba\csrss.exe51⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Windows\SysWOW64\jzxcrwif\csrss.exeC:\Windows\system32\jzxcrwif\csrss.exe52⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Windows\SysWOW64\mlephx\csrss.exeC:\Windows\system32\mlephx\csrss.exe53⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Windows\SysWOW64\wtyhjcxrr\csrss.exeC:\Windows\system32\wtyhjcxrr\csrss.exe54⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Windows\SysWOW64\jzzwjt\csrss.exeC:\Windows\system32\jzzwjt\csrss.exe55⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Windows\SysWOW64\dcnqxo\csrss.exeC:\Windows\system32\dcnqxo\csrss.exe56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Windows\SysWOW64\nxhsiflswt\csrss.exeC:\Windows\system32\nxhsiflswt\csrss.exe57⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Windows\SysWOW64\jybqcpdu\csrss.exeC:\Windows\system32\jybqcpdu\csrss.exe58⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Windows\SysWOW64\njicsq\csrss.exeC:\Windows\system32\njicsq\csrss.exe59⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Windows\SysWOW64\jlcalbirx\csrss.exeC:\Windows\system32\jlcalbirx\csrss.exe60⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Windows\SysWOW64\gavnwa\csrss.exeC:\Windows\system32\gavnwa\csrss.exe61⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Windows\SysWOW64\doquzwtvhc\csrss.exeC:\Windows\system32\doquzwtvhc\csrss.exe62⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Windows\SysWOW64\qupphqdkjp\csrss.exeC:\Windows\system32\qupphqdkjp\csrss.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Windows\SysWOW64\njkwkmajj\csrss.exeC:\Windows\system32\njkwkmajj\csrss.exe64⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Windows\SysWOW64\kketext\csrss.exeC:\Windows\system32\kketext\csrss.exe65⤵
- Executes dropped EXE
PID:4380 -
C:\Windows\SysWOW64\gzxhowgq\csrss.exeC:\Windows\system32\gzxhowgq\csrss.exe66⤵PID:4520
-
C:\Windows\SysWOW64\icpbvkrc\csrss.exeC:\Windows\system32\icpbvkrc\csrss.exe67⤵PID:3032
-
C:\Windows\SysWOW64\friofkehly\csrss.exeC:\Windows\system32\friofkehly\csrss.exe68⤵PID:912
-
C:\Windows\SysWOW64\cfdvigchl\csrss.exeC:\Windows\system32\cfdvigchl\csrss.exe69⤵PID:3056
-
C:\Windows\SysWOW64\omcqramv\csrss.exeC:\Windows\system32\omcqramv\csrss.exe70⤵
- Drops file in System32 directory
PID:4916 -
C:\Windows\SysWOW64\csefsrhehc\csrss.exeC:\Windows\system32\csefsrhehc\csrss.exe71⤵
- Drops file in System32 directory
PID:4852 -
C:\Windows\SysWOW64\viqqwbmlvi\csrss.exeC:\Windows\system32\viqqwbmlvi\csrss.exe72⤵
- Drops file in System32 directory
PID:5072 -
C:\Windows\SysWOW64\iosexsh\csrss.exeC:\Windows\system32\iosexsh\csrss.exe73⤵PID:3044
-
C:\Windows\SysWOW64\sjmhiiphrm\csrss.exeC:\Windows\system32\sjmhiiphrm\csrss.exe74⤵PID:812
-
C:\Windows\SysWOW64\fqmcqdzwtz\csrss.exeC:\Windows\system32\fqmcqdzwtz\csrss.exe75⤵PID:1112
-
C:\Windows\SysWOW64\fcnmao\csrss.exeC:\Windows\system32\fcnmao\csrss.exe76⤵PID:3144
-
C:\Windows\SysWOW64\javiya\csrss.exeC:\Windows\system32\javiya\csrss.exe77⤵PID:3960
-
C:\Windows\SysWOW64\cdjdmv\csrss.exeC:\Windows\system32\cdjdmv\csrss.exe78⤵PID:4924
-
C:\Windows\SysWOW64\zscqwvuu\csrss.exeC:\Windows\system32\zscqwvuu\csrss.exe79⤵PID:3952
-
C:\Windows\SysWOW64\bvtkdjgh\csrss.exeC:\Windows\system32\bvtkdjgh\csrss.exe80⤵PID:5132
-
C:\Windows\SysWOW64\euznjyoeuy\csrss.exeC:\Windows\system32\euznjyoeuy\csrss.exe81⤵PID:5180
-
C:\Windows\SysWOW64\hsijikgwg\csrss.exeC:\Windows\system32\hsijikgwg\csrss.exe82⤵PID:5224
-
C:\Windows\SysWOW64\xjorgfe\csrss.exeC:\Windows\system32\xjorgfe\csrss.exe83⤵
- Drops file in System32 directory
PID:5272 -
C:\Windows\SysWOW64\ulioapwiei\csrss.exeC:\Windows\system32\ulioapwiei\csrss.exe84⤵PID:5312
-
C:\Windows\SysWOW64\ywpbpqjd\csrss.exeC:\Windows\system32\ywpbpqjd\csrss.exe85⤵PID:5356
-
C:\Windows\SysWOW64\lcrqqhemos\csrss.exeC:\Windows\system32\lcrqqhemos\csrss.exe86⤵PID:5400
-
C:\Windows\SysWOW64\eseaurjtcy\csrss.exeC:\Windows\system32\eseaurjtcy\csrss.exe87⤵PID:5448
-
C:\Windows\SysWOW64\iqmxtdblp\csrss.exeC:\Windows\system32\iqmxtdblp\csrss.exe88⤵PID:5488
-
C:\Windows\SysWOW64\btzrhympyb\csrss.exeC:\Windows\system32\btzrhympyb\csrss.exe89⤵PID:5536
-
C:\Windows\SysWOW64\vkmclirwmi\csrss.exeC:\Windows\system32\vkmclirwmi\csrss.exe90⤵
- Drops file in System32 directory
PID:5584 -
C:\Windows\SysWOW64\yvtpajer\csrss.exeC:\Windows\system32\yvtpajer\csrss.exe91⤵
- System Location Discovery: System Language Discovery
PID:5628 -
C:\Windows\SysWOW64\jgebjcsuor\csrss.exeC:\Windows\system32\jgebjcsuor\csrss.exe92⤵PID:5672
-
C:\Windows\SysWOW64\nflepra\csrss.exeC:\Windows\system32\nflepra\csrss.exe93⤵
- System Location Discovery: System Language Discovery
PID:5716 -
C:\Windows\SysWOW64\qdtaods\csrss.exeC:\Windows\system32\qdtaods\csrss.exe94⤵PID:5760
-
C:\Windows\SysWOW64\kfhvcydo\csrss.exeC:\Windows\system32\kfhvcydo\csrss.exe95⤵
- Drops file in System32 directory
PID:5808 -
C:\Windows\SysWOW64\toaneegfnh\csrss.exeC:\Windows\system32\toaneegfnh\csrss.exe96⤵PID:5856
-
C:\Windows\SysWOW64\tabxnp\csrss.exeC:\Windows\system32\tabxnp\csrss.exe97⤵
- Drops file in System32 directory
PID:5904 -
C:\Windows\SysWOW64\dvvzyftqly\csrss.exeC:\Windows\system32\dvvzyftqly\csrss.exe98⤵PID:5952
-
C:\Windows\SysWOW64\xyjtmb\csrss.exeC:\Windows\system32\xyjtmb\csrss.exe99⤵PID:6000
-
C:\Windows\SysWOW64\awrqlmwmhb\csrss.exeC:\Windows\system32\awrqlmwmhb\csrss.exe100⤵PID:6080
-
C:\Windows\SysWOW64\ajsauyb\csrss.exeC:\Windows\system32\ajsauyb\csrss.exe101⤵PID:6128
-
C:\Windows\SysWOW64\zbdhllzb\csrss.exeC:\Windows\system32\zbdhllzb\csrss.exe102⤵PID:5168
-
C:\Windows\SysWOW64\jwxjwb\csrss.exeC:\Windows\system32\jwxjwb\csrss.exe103⤵PID:5236
-
C:\Windows\SysWOW64\mudmdrpm\csrss.exeC:\Windows\system32\mudmdrpm\csrss.exe104⤵
- Drops file in System32 directory
PID:5308 -
C:\Windows\SysWOW64\fksqzx\csrss.exeC:\Windows\system32\fksqzx\csrss.exe105⤵PID:5392
-
C:\Windows\SysWOW64\pfntlonbw\csrss.exeC:\Windows\system32\pfntlonbw\csrss.exe106⤵PID:5468
-
C:\Windows\SysWOW64\jianyjxggr\csrss.exeC:\Windows\system32\jianyjxggr\csrss.exe107⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5544 -
C:\Windows\SysWOW64\tqufaoaw\csrss.exeC:\Windows\system32\tqufaoaw\csrss.exe108⤵PID:5596
-
C:\Windows\SysWOW64\wbbsqp\csrss.exeC:\Windows\system32\wbbsqp\csrss.exe109⤵
- System Location Discovery: System Language Discovery
PID:5680 -
C:\Windows\SysWOW64\giwekq\csrss.exeC:\Windows\system32\giwekq\csrss.exe110⤵PID:5752
-
C:\Windows\SysWOW64\qdrgwhiqf\csrss.exeC:\Windows\system32\qdrgwhiqf\csrss.exe111⤵PID:5836
-
C:\Windows\SysWOW64\buywspm\csrss.exeC:\Windows\system32\buywspm\csrss.exe112⤵
- System Location Discovery: System Language Discovery
PID:5888 -
C:\Windows\SysWOW64\uklhwas\csrss.exeC:\Windows\system32\uklhwas\csrss.exe113⤵
- Drops file in System32 directory
PID:5980 -
C:\Windows\SysWOW64\onybkvca\csrss.exeC:\Windows\system32\onybkvca\csrss.exe114⤵
- Drops file in System32 directory
PID:6072 -
C:\Windows\SysWOW64\esgtrb\csrss.exeC:\Windows\system32\esgtrb\csrss.exe115⤵PID:6140
-
C:\Windows\SysWOW64\bgbaux\csrss.exeC:\Windows\system32\bgbaux\csrss.exe116⤵PID:5144
-
C:\Windows\SysWOW64\vwokyhhndw\csrss.exeC:\Windows\system32\vwokyhhndw\csrss.exe117⤵PID:5300
-
C:\Windows\SysWOW64\yhvxoiuhu\csrss.exeC:\Windows\system32\yhvxoiuhu\csrss.exe118⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5440 -
C:\Windows\SysWOW64\sxkbko\csrss.exeC:\Windows\system32\sxkbko\csrss.exe119⤵
- Drops file in System32 directory
PID:5528 -
C:\Windows\SysWOW64\pmdpvoxo\csrss.exeC:\Windows\system32\pmdpvoxo\csrss.exe120⤵PID:3204
-
C:\Windows\SysWOW64\laxwykv\csrss.exeC:\Windows\system32\laxwykv\csrss.exe121⤵PID:5704
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-