Analysis
- max time kernel
29s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
19/09/2026, 18:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118__a87aba7417b7ea9bd71f1e7c26213154.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target jaffacakes118__a87aba7417b7ea9bd71f1e7c26213154.exe
- Size 78KB
- Sample260919-w5pjcaae43
- SHA256 5e788f3161593834aba1715d21a12cb72ec50f2ebbcadab01db4b8eda23c04cb
- MD5 a87aba7417b7ea9bd71f1e7c26213154
- SHA1 54fb174395a7634aefccd125803352ede4870658
- SHA512 b858ab38eaa5577ecf96f0fec236ecb0c40d4d2834a0e268d2679972b55d763cff8e2467dc7b774fa93185096cbb810a18e88575e6f7a8074b7fb7a6f667a11a
- SSDEEP 1536:OBZ8eLQYyj3GR/CLRvPORdcv5a6/08QJy2mx4sux21LTCTIRa4b+WAEW:CpQYyrUiv2Rivt08b5xbuAuIRaC+WpW
- TLSH T1D07302BB3FE67EB8E8C5867303673C18F57806536B756B1B23161EC974448B0993846E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3260 csrss.exe 4904 csrss.exe 4156 csrss.exe 3140 csrss.exe 5988 csrss.exe 4336 csrss.exe 4548 csrss.exe 4984 csrss.exe 1408 csrss.exe 6104 csrss.exe 4700 csrss.exe 3768 csrss.exe 4860 csrss.exe 1568 csrss.exe 440 csrss.exe 2784 csrss.exe 1844 csrss.exe 5044 csrss.exe 932 csrss.exe 2160 csrss.exe 4620 csrss.exe 3356 csrss.exe 5256 csrss.exe 2752 csrss.exe 3024 csrss.exe 2264 csrss.exe 1804 csrss.exe 1780 csrss.exe 2628 csrss.exe 4888 csrss.exe 1052 csrss.exe 1124 csrss.exe 3508 csrss.exe 1292 csrss.exe 5408 csrss.exe 3060 csrss.exe 4844 csrss.exe 1972 csrss.exe 252 csrss.exe 1208 csrss.exe 4836 csrss.exe 572 csrss.exe 3692 csrss.exe 3012 csrss.exe 4360 csrss.exe 5848 csrss.exe 4872 csrss.exe 6032 csrss.exe 5884 csrss.exe 264 csrss.exe 1072 csrss.exe 1212 csrss.exe 3536 csrss.exe 4280 csrss.exe 1560 csrss.exe 4908 csrss.exe 1036 csrss.exe 5784 csrss.exe 4284 csrss.exe 2624 csrss.exe 5864 csrss.exe 3020 csrss.exe 1128 csrss.exe 988 csrss.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\xlkdvmi csrss.exe File created C:\Windows\SysWOW64\xjpqks\csrss.exe csrss.exe File opened for modification C:\Windows\SysWOW64\mskskugojc csrss.exe File created C:\Windows\SysWOW64\uuikax\csrss.exe csrss.exe File opened for modification C:\Windows\SysWOW64\nkxfuxb csrss.exe File created C:\Windows\SysWOW64\cxxzld\csrss.exe csrss.exe File opened for modification C:\Windows\SysWOW64\uuikax csrss.exe File created C:\Windows\SysWOW64\wkboqws\csrss.exe csrss.exe File opened for modification C:\Windows\SysWOW64\lkrqhe csrss.exe File opened for modification C:\Windows\SysWOW64\ojytnthn\csrss.exe csrss.exe File opened for modification C:\Windows\SysWOW64\bpziokcwyy csrss.exe File opened for modification C:\Windows\SysWOW64\prsbqjska csrss.exe File created C:\Windows\SysWOW64\cefofq\csrss.exe csrss.exe File opened for modification C:\Windows\SysWOW64\mxpazsqt\csrss.exe csrss.exe File opened for modification C:\Windows\SysWOW64\xzhyxse csrss.exe File created C:\Windows\SysWOW64\ssoxbmfhi\csrss.exe csrss.exe File opened for modification C:\Windows\SysWOW64\elvlfspbg csrss.exe File opened for modification C:\Windows\SysWOW64\eytluapips\csrss.exe csrss.exe File created C:\Windows\SysWOW64\gghjoerqfi\csrss.exe csrss.exe File opened for modification C:\Windows\SysWOW64\xgkthl csrss.exe File opened for modification C:\Windows\SysWOW64\eipavqe csrss.exe File created C:\Windows\SysWOW64\vsqmwj\csrss.exe csrss.exe File created C:\Windows\SysWOW64\ctzbjfc\csrss.exe csrss.exe File opened for modification C:\Windows\SysWOW64\rssxtjuz\csrss.exe csrss.exe File created C:\Windows\SysWOW64\wlpbvktwu\csrss.exe csrss.exe File opened for modification C:\Windows\SysWOW64\varmngn\csrss.exe csrss.exe File opened for modification C:\Windows\SysWOW64\xpicxk\csrss.exe csrss.exe File created C:\Windows\SysWOW64\dxiijqty\csrss.exe csrss.exe File created C:\Windows\SysWOW64\ckuaals\csrss.exe csrss.exe File created C:\Windows\SysWOW64\nyqcbswhj\csrss.exe csrss.exe File created C:\Windows\SysWOW64\lwvtnzazs\csrss.exe csrss.exe File created C:\Windows\SysWOW64\xgkthl\csrss.exe csrss.exe File opened for modification C:\Windows\SysWOW64\swlxzxkkv csrss.exe File created C:\Windows\SysWOW64\cptoerdjt\csrss.exe csrss.exe File opened for modification C:\Windows\SysWOW64\tjzelpwlme\csrss.exe csrss.exe File opened for modification C:\Windows\SysWOW64\qzpcpj csrss.exe File created C:\Windows\SysWOW64\qijksa\csrss.exe csrss.exe File opened for modification C:\Windows\SysWOW64\kxaihd\csrss.exe csrss.exe File opened for modification C:\Windows\SysWOW64\jopdjjd csrss.exe File opened for modification C:\Windows\SysWOW64\blaoydny csrss.exe File created C:\Windows\SysWOW64\abwyzlfsq\csrss.exe csrss.exe File opened for modification C:\Windows\SysWOW64\yrltbrzxmc\csrss.exe csrss.exe File opened for modification C:\Windows\SysWOW64\vshknzcuig csrss.exe File created C:\Windows\SysWOW64\iwfrnpmqoc\csrss.exe csrss.exe File opened for modification C:\Windows\SysWOW64\aulzpjgk csrss.exe File opened for modification C:\Windows\SysWOW64\fngjzn\csrss.exe csrss.exe File opened for modification C:\Windows\SysWOW64\oxtuxd csrss.exe File opened for modification C:\Windows\SysWOW64\vpbyikc\csrss.exe csrss.exe File created C:\Windows\SysWOW64\ajsauyb\csrss.exe csrss.exe File opened for modification C:\Windows\SysWOW64\glisgs csrss.exe File created C:\Windows\SysWOW64\anxhmkwih\csrss.exe csrss.exe File opened for modification C:\Windows\SysWOW64\pnqcwo csrss.exe File opened for modification C:\Windows\SysWOW64\wbyhaztumg csrss.exe File opened for modification C:\Windows\SysWOW64\sgikfbkzii csrss.exe File opened for modification C:\Windows\SysWOW64\fzkipdkf csrss.exe File opened for modification C:\Windows\SysWOW64\datyaeinu csrss.exe File opened for modification C:\Windows\SysWOW64\xotyyrzed csrss.exe File opened for modification C:\Windows\SysWOW64\zmidjdlf\csrss.exe csrss.exe File created C:\Windows\SysWOW64\toyspvg\csrss.exe csrss.exe File opened for modification C:\Windows\SysWOW64\dqyzauomyh csrss.exe File opened for modification C:\Windows\SysWOW64\cgrhou\csrss.exe csrss.exe File created C:\Windows\SysWOW64\dbvcesyelb\csrss.exe csrss.exe File opened for modification C:\Windows\SysWOW64\qprzhze csrss.exe File opened for modification C:\Windows\SysWOW64\esndzoo\csrss.exe csrss.exe - Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3232 cmd.exe 9616 cmd.exe 10316 cmd.exe 6380 cmd.exe 9756 Process not Found 8808 cmd.exe 3324 cmd.exe 6520 cmd.exe 8928 cmd.exe 9452 Process not Found 10216 Process not Found 8976 cmd.exe 6948 cmd.exe 8724 Process not Found 11924 Process not Found 9148 cmd.exe 8780 cmd.exe 5752 cmd.exe 6996 Process not Found 6296 cmd.exe 7300 cmd.exe 1172 cmd.exe 9912 cmd.exe 8652 Process not Found 13104 Process not Found 2796 cmd.exe 6652 cmd.exe 1648 Process not Found 9532 Process not Found 4552 Process not Found 6592 cmd.exe 9540 cmd.exe 11192 cmd.exe 8516 cmd.exe 10692 cmd.exe 8452 cmd.exe 8076 cmd.exe 3328 cmd.exe 8448 Process not Found 11776 Process not Found 6596 cmd.exe 10060 cmd.exe 9844 cmd.exe 7288 cmd.exe 8536 Process not Found 12248 Process not Found 11176 cmd.exe 7964 cmd.exe 8668 Process not Found 6728 cmd.exe 7292 cmd.exe 13744 Process not Found 6240 cmd.exe 9168 cmd.exe 9888 cmd.exe 9940 cmd.exe 11808 Process not Found 10528 Process not Found 12784 Process not Found 8148 cmd.exe 9076 cmd.exe 8168 cmd.exe 9476 cmd.exe 6992 Process not Found - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe - System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 64 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 6388 PING.EXE 6552 PING.EXE 9852 PING.EXE 6684 PING.EXE 11052 PING.EXE 1412 Process not Found 7704 Process not Found 10532 Process not Found 7076 PING.EXE 7356 PING.EXE 6652 PING.EXE 8724 PING.EXE 7304 Process not Found 11520 Process not Found 12232 Process not Found 14320 Process not Found 9208 PING.EXE 8524 PING.EXE 7912 PING.EXE 9444 PING.EXE 1880 PING.EXE 10976 Process not Found 12532 Process not Found 13360 Process not Found 11168 Process not Found 8260 Process not Found 1156 Process not Found 6484 PING.EXE 6724 PING.EXE 8004 PING.EXE 7428 PING.EXE 5932 PING.EXE 9648 Process not Found 676 Process not Found 6256 Process not Found 9020 PING.EXE 6836 Process not Found 7052 Process not Found 10068 PING.EXE 10724 PING.EXE 9248 PING.EXE 9720 PING.EXE 9220 Process not Found 4464 Process not Found 13584 Process not Found 7064 PING.EXE 5352 PING.EXE 364 PING.EXE 3808 PING.EXE 9360 PING.EXE 11040 Process not Found 3852 PING.EXE 9152 PING.EXE 9200 PING.EXE 8148 PING.EXE 8440 PING.EXE 4556 PING.EXE 4800 Process not Found 1884 PING.EXE 2680 PING.EXE 9884 PING.EXE 11168 PING.EXE 10200 Process not Found 14236 Process not Found - Runs ping.exe 1 TTPs 64 IoCs
pid Process 2796 PING.EXE 6784 PING.EXE 8376 PING.EXE 476 PING.EXE 9444 Process not Found 12676 Process not Found 12876 Process not Found 12696 Process not Found 760 PING.EXE 9884 PING.EXE 9712 PING.EXE 7532 PING.EXE 4192 PING.EXE 10096 Process not Found 7364 Process not Found 13352 Process not Found 7620 PING.EXE 7912 PING.EXE 11168 Process not Found 13012 Process not Found 9488 Process not Found 7964 PING.EXE 8336 PING.EXE 7284 PING.EXE 7388 Process not Found 6484 PING.EXE 7136 PING.EXE 5372 PING.EXE 3292 PING.EXE 9980 PING.EXE 10248 PING.EXE 3528 PING.EXE 7052 Process not Found 1384 PING.EXE 3788 PING.EXE 3328 PING.EXE 10448 PING.EXE 9444 PING.EXE 9484 PING.EXE 7252 Process not Found 4624 Process not Found 8848 PING.EXE 6652 PING.EXE 5076 PING.EXE 7912 PING.EXE 9360 PING.EXE 9248 PING.EXE 7380 PING.EXE 7428 Process not Found 2356 PING.EXE 6148 PING.EXE 7064 PING.EXE 5084 PING.EXE 7868 PING.EXE 8644 PING.EXE 9020 PING.EXE 9648 Process not Found 7652 PING.EXE 6284 PING.EXE 7760 PING.EXE 9568 PING.EXE 11144 PING.EXE 3312 PING.EXE 10764 PING.EXE - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 5868 jaffacakes118__a87aba7417b7ea9bd71f1e7c26213154.exe 3260 csrss.exe 4904 csrss.exe 4156 csrss.exe 3140 csrss.exe 5988 csrss.exe 4336 csrss.exe 4548 csrss.exe 4984 csrss.exe 1408 csrss.exe 6104 csrss.exe 4700 csrss.exe 3768 csrss.exe 4860 csrss.exe 1568 csrss.exe 440 csrss.exe 2784 csrss.exe 1844 csrss.exe 5044 csrss.exe 932 csrss.exe 2160 csrss.exe 4620 csrss.exe 3356 csrss.exe 5256 csrss.exe 2752 csrss.exe 3024 csrss.exe 2264 csrss.exe 1804 csrss.exe 1780 csrss.exe 2628 csrss.exe 4888 csrss.exe 1052 csrss.exe 1124 csrss.exe 3508 csrss.exe 1292 csrss.exe 5408 csrss.exe 3060 csrss.exe 4844 csrss.exe 1972 csrss.exe 252 csrss.exe 1208 csrss.exe 4836 csrss.exe 572 csrss.exe 3692 csrss.exe 3012 csrss.exe 4360 csrss.exe 5848 csrss.exe 4872 csrss.exe 6032 csrss.exe 5884 csrss.exe 264 csrss.exe 1072 csrss.exe 1212 csrss.exe 3536 csrss.exe 4280 csrss.exe 1560 csrss.exe 4908 csrss.exe 1036 csrss.exe 5784 csrss.exe 4284 csrss.exe 2624 csrss.exe 5864 csrss.exe 3020 csrss.exe 1128 csrss.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5868 wrote to memory of 3260 5868 jaffacakes118__a87aba7417b7ea9bd71f1e7c26213154.exe 88 PID 3260 wrote to memory of 4904 3260 csrss.exe 89 PID 4904 wrote to memory of 4156 4904 csrss.exe 90 PID 4156 wrote to memory of 3140 4156 csrss.exe 91 PID 3140 wrote to memory of 5988 3140 csrss.exe 92 PID 5988 wrote to memory of 4336 5988 csrss.exe 93 PID 4336 wrote to memory of 4548 4336 csrss.exe 94 PID 4548 wrote to memory of 4984 4548 csrss.exe 95 PID 4984 wrote to memory of 1408 4984 csrss.exe 96 PID 1408 wrote to memory of 6104 1408 csrss.exe 97 PID 6104 wrote to memory of 4700 6104 csrss.exe 98 PID 4700 wrote to memory of 3768 4700 csrss.exe 99 PID 3768 wrote to memory of 4860 3768 csrss.exe 100 PID 4860 wrote to memory of 1568 4860 csrss.exe 101 PID 1568 wrote to memory of 440 1568 csrss.exe 102 PID 440 wrote to memory of 2784 440 csrss.exe 103 PID 2784 wrote to memory of 1844 2784 csrss.exe 104 PID 1844 wrote to memory of 5044 1844 csrss.exe 105 PID 5044 wrote to memory of 932 5044 csrss.exe 106 PID 932 wrote to memory of 2160 932 csrss.exe 107 PID 2160 wrote to memory of 4620 2160 csrss.exe 108 PID 4620 wrote to memory of 3356 4620 csrss.exe 109 PID 3356 wrote to memory of 5256 3356 csrss.exe 110 PID 5256 wrote to memory of 2752 5256 csrss.exe 111 PID 2752 wrote to memory of 3024 2752 csrss.exe 112 PID 3024 wrote to memory of 2264 3024 csrss.exe 113 PID 2264 wrote to memory of 1804 2264 csrss.exe 114 PID 1804 wrote to memory of 1780 1804 csrss.exe 115 PID 1780 wrote to memory of 2628 1780 csrss.exe 116 PID 2628 wrote to memory of 4888 2628 csrss.exe 117 PID 4888 wrote to memory of 1052 4888 csrss.exe 118 PID 1052 wrote to memory of 1124 1052 csrss.exe 119 PID 1124 wrote to memory of 3508 1124 csrss.exe 120 PID 3508 wrote to memory of 1292 3508 csrss.exe 121 PID 1292 wrote to memory of 5408 1292 csrss.exe 122 PID 5408 wrote to memory of 3060 5408 csrss.exe 123 PID 3060 wrote to memory of 4844 3060 csrss.exe 124 PID 4844 wrote to memory of 1972 4844 csrss.exe 125 PID 1972 wrote to memory of 252 1972 csrss.exe 126 PID 252 wrote to memory of 1208 252 csrss.exe 127 PID 1208 wrote to memory of 4836 1208 csrss.exe 128 PID 4836 wrote to memory of 572 4836 csrss.exe 129 PID 572 wrote to memory of 3692 572 csrss.exe 130 PID 3692 wrote to memory of 3012 3692 csrss.exe 131 PID 3012 wrote to memory of 4360 3012 csrss.exe 132 PID 4360 wrote to memory of 5848 4360 csrss.exe 133 PID 5848 wrote to memory of 4872 5848 csrss.exe 134 PID 4872 wrote to memory of 6032 4872 csrss.exe 135 PID 6032 wrote to memory of 5884 6032 csrss.exe 136 PID 5884 wrote to memory of 264 5884 csrss.exe 137 PID 264 wrote to memory of 1072 264 csrss.exe 138 PID 1072 wrote to memory of 1212 1072 csrss.exe 139 PID 1212 wrote to memory of 3536 1212 csrss.exe 140 PID 3536 wrote to memory of 4280 3536 csrss.exe 141 PID 4280 wrote to memory of 1560 4280 csrss.exe 142 PID 1560 wrote to memory of 4908 1560 csrss.exe 143 PID 4908 wrote to memory of 1036 4908 csrss.exe 144 PID 1036 wrote to memory of 5784 1036 csrss.exe 145 PID 5784 wrote to memory of 4284 5784 csrss.exe 146 PID 4284 wrote to memory of 2624 4284 csrss.exe 147 PID 2624 wrote to memory of 5864 2624 csrss.exe 148 PID 5864 wrote to memory of 3020 5864 csrss.exe 149 PID 3020 wrote to memory of 1128 3020 csrss.exe 150 PID 1128 wrote to memory of 988 1128 csrss.exe 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118__a87aba7417b7ea9bd71f1e7c26213154.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__a87aba7417b7ea9bd71f1e7c26213154.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5868 -
C:\Windows\SysWOW64\qlqslxj\csrss.exeC:\Windows\system32\qlqslxj\csrss.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Windows\SysWOW64\vpbyikc\csrss.exeC:\Windows\system32\vpbyikc\csrss.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Windows\SysWOW64\uhmfzybhr\csrss.exeC:\Windows\system32\uhmfzybhr\csrss.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Windows\SysWOW64\zyvbnap\csrss.exeC:\Windows\system32\zyvbnap\csrss.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Windows\SysWOW64\ecghloj\csrss.exeC:\Windows\system32\ecghloj\csrss.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5988 -
C:\Windows\SysWOW64\xfubyktz\csrss.exeC:\Windows\system32\xfubyktz\csrss.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Windows\SysWOW64\fumuly\csrss.exeC:\Windows\system32\fumuly\csrss.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Windows\SysWOW64\xrvlhvywz\csrss.exeC:\Windows\system32\xrvlhvywz\csrss.exe9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Windows\SysWOW64\rhkqebo\csrss.exeC:\Windows\system32\rhkqebo\csrss.exe10⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Windows\SysWOW64\eojlnw\csrss.exeC:\Windows\system32\eojlnw\csrss.exe11⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6104 -
C:\Windows\SysWOW64\jrurkk\csrss.exeC:\Windows\system32\jrurkk\csrss.exe12⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Windows\SysWOW64\rgmkxyzsw\csrss.exeC:\Windows\system32\rgmkxyzsw\csrss.exe13⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Windows\SysWOW64\gsqiwr\csrss.exeC:\Windows\system32\gsqiwr\csrss.exe14⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Windows\SysWOW64\jrwlcgdz\csrss.exeC:\Windows\system32\jrwlcgdz\csrss.exe15⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Windows\SysWOW64\jbklbh\csrss.exeC:\Windows\system32\jbklbh\csrss.exe16⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:440 -
C:\Windows\SysWOW64\wijgkb\csrss.exeC:\Windows\system32\wijgkb\csrss.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Windows\SysWOW64\lhppsfuix\csrss.exeC:\Windows\system32\lhppsfuix\csrss.exe18⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Windows\SysWOW64\ynokbaexz\csrss.exeC:\Windows\system32\ynokbaexz\csrss.exe19⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Windows\SysWOW64\attnsy\csrss.exeC:\Windows\system32\attnsy\csrss.exe20⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:932 -
C:\Windows\SysWOW64\mzsiat\csrss.exeC:\Windows\system32\mzsiat\csrss.exe21⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Windows\SysWOW64\rddoxg\csrss.exeC:\Windows\system32\rddoxg\csrss.exe22⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Windows\SysWOW64\asvhkvamu\csrss.exeC:\Windows\system32\asvhkvamu\csrss.exe23⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Windows\SysWOW64\dqbjqk\csrss.exeC:\Windows\system32\dqbjqk\csrss.exe24⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5256 -
C:\Windows\SysWOW64\gciwgkveg\csrss.exeC:\Windows\system32\gciwgkveg\csrss.exe25⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Windows\SysWOW64\kzqtfwows\csrss.exeC:\Windows\system32\kzqtfwows\csrss.exe26⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Windows\SysWOW64\yzthveeidk\csrss.exeC:\Windows\system32\yzthveeidk\csrss.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Windows\SysWOW64\nkxfuxb\csrss.exeC:\Windows\system32\nkxfuxb\csrss.exe28⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Windows\SysWOW64\kxfdniyi\csrss.exeC:\Windows\system32\kxfdniyi\csrss.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Windows\SysWOW64\datyaeinu\csrss.exeC:\Windows\system32\datyaeinu\csrss.exe30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Windows\SysWOW64\qgttjytb\csrss.exeC:\Windows\system32\qgttjytb\csrss.exe31⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Windows\SysWOW64\abnvuob\csrss.exeC:\Windows\system32\abnvuob\csrss.exe32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Windows\SysWOW64\ezvsta\csrss.exeC:\Windows\system32\ezvsta\csrss.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Windows\SysWOW64\xpicxk\csrss.exeC:\Windows\system32\xpicxk\csrss.exe34⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Windows\SysWOW64\pmtnmeh\csrss.exeC:\Windows\system32\pmtnmeh\csrss.exe35⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Windows\SysWOW64\uqetjrb\csrss.exeC:\Windows\system32\uqetjrb\csrss.exe36⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5408 -
C:\Windows\SysWOW64\tkbklp\csrss.exeC:\Windows\system32\tkbklp\csrss.exe37⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Windows\SysWOW64\xblgzsofmj\csrss.exeC:\Windows\system32\xblgzsofmj\csrss.exe38⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Windows\SysWOW64\pywrolxjjs\csrss.exeC:\Windows\system32\pywrolxjjs\csrss.exe39⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Windows\SysWOW64\yomqid\csrss.exeC:\Windows\system32\yomqid\csrss.exe40⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:252 -
C:\Windows\SysWOW64\zfdaggasq\csrss.exeC:\Windows\system32\zfdaggasq\csrss.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Windows\SysWOW64\huutsugf\csrss.exeC:\Windows\system32\huutsugf\csrss.exe42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Windows\SysWOW64\eingdutkp\csrss.exeC:\Windows\system32\eingdutkp\csrss.exe43⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:572 -
C:\Windows\SysWOW64\oqjsyvhvn\csrss.exeC:\Windows\system32\oqjsyvhvn\csrss.exe44⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Windows\SysWOW64\bxingqrjq\csrss.exeC:\Windows\system32\bxingqrjq\csrss.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\SysWOW64\eipavqe\csrss.exeC:\Windows\system32\eipavqe\csrss.exe46⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Windows\SysWOW64\dooagzib\csrss.exeC:\Windows\system32\dooagzib\csrss.exe47⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5848 -
C:\Windows\SysWOW64\gnudmpqzkz\csrss.exeC:\Windows\system32\gnudmpqzkz\csrss.exe48⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Windows\SysWOW64\nwjmbbvm\csrss.exeC:\Windows\system32\nwjmbbvm\csrss.exe49⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6032 -
C:\Windows\SysWOW64\sausypp\csrss.exeC:\Windows\system32\sausypp\csrss.exe50⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5884 -
C:\Windows\SysWOW64\lqhdczu\csrss.exeC:\Windows\system32\lqhdczu\csrss.exe51⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:264 -
C:\Windows\SysWOW64\icpbvkrc\csrss.exeC:\Windows\system32\icpbvkrc\csrss.exe52⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Windows\SysWOW64\cfdvigchl\csrss.exeC:\Windows\system32\cfdvigchl\csrss.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Windows\SysWOW64\laxxuwku\csrss.exeC:\Windows\system32\laxxuwku\csrss.exe54⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Windows\SysWOW64\pzdaamrsjp\csrss.exeC:\Windows\system32\pzdaamrsjp\csrss.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Windows\SysWOW64\swlxzxkkv\csrss.exeC:\Windows\system32\swlxzxkkv\csrss.exe56⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Windows\SysWOW64\vvrzfn\csrss.exeC:\Windows\system32\vvrzfn\csrss.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Windows\SysWOW64\dxiijqty\csrss.exeC:\Windows\system32\dxiijqty\csrss.exe58⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Windows\SysWOW64\mmabve\csrss.exeC:\Windows\system32\mmabve\csrss.exe59⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5784 -
C:\Windows\SysWOW64\ztawey\csrss.exeC:\Windows\system32\ztawey\csrss.exe60⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Windows\SysWOW64\aldpmmq\csrss.exeC:\Windows\system32\aldpmmq\csrss.exe61⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Windows\SysWOW64\zfbgnkp\csrss.exeC:\Windows\system32\zfbgnkp\csrss.exe62⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5864 -
C:\Windows\SysWOW64\huszaywlpx\csrss.exeC:\Windows\system32\huszaywlpx\csrss.exe63⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Windows\SysWOW64\ubsuisgzrk\csrss.exeC:\Windows\system32\ubsuisgzrk\csrss.exe64⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Windows\SysWOW64\rnasbeeqrl\csrss.exeC:\Windows\system32\rnasbeeqrl\csrss.exe65⤵
- Executes dropped EXE
PID:988 -
C:\Windows\SysWOW64\umguhtl\csrss.exeC:\Windows\system32\umguhtl\csrss.exe66⤵PID:4092
-
C:\Windows\SysWOW64\hsijikgwg\csrss.exeC:\Windows\system32\hsijikgwg\csrss.exe67⤵PID:2004
-
C:\Windows\SysWOW64\kdpwyktr\csrss.exeC:\Windows\system32\kdpwyktr\csrss.exe68⤵PID:2900
-
C:\Windows\SysWOW64\obvzeabpso\csrss.exeC:\Windows\system32\obvzeabpso\csrss.exe69⤵PID:4796
-
C:\Windows\SysWOW64\bhwofqw\csrss.exeC:\Windows\system32\bhwofqw\csrss.exe70⤵PID:5540
-
C:\Windows\SysWOW64\jxmmzis\csrss.exeC:\Windows\system32\jxmmzis\csrss.exe71⤵PID:2944
-
C:\Windows\SysWOW64\mvujyuk\csrss.exeC:\Windows\system32\mvujyuk\csrss.exe72⤵PID:5260
-
C:\Windows\SysWOW64\qgcwovxenn\csrss.exeC:\Windows\system32\qgcwovxenn\csrss.exe73⤵PID:2780
-
C:\Windows\SysWOW64\teizukf\csrss.exeC:\Windows\system32\teizukf\csrss.exe74⤵PID:2464
-
C:\Windows\SysWOW64\idnhco\csrss.exeC:\Windows\system32\idnhco\csrss.exe75⤵
- Drops file in System32 directory
PID:6000 -
C:\Windows\SysWOW64\abwyzlfsq\csrss.exeC:\Windows\system32\abwyzlfsq\csrss.exe76⤵PID:4956
-
C:\Windows\SysWOW64\dmdlols\csrss.exeC:\Windows\system32\dmdlols\csrss.exe77⤵PID:6028
-
C:\Windows\SysWOW64\giyydnlw\csrss.exeC:\Windows\system32\giyydnlw\csrss.exe78⤵PID:3196
-
C:\Windows\SysWOW64\okphgqmnnm\csrss.exeC:\Windows\system32\okphgqmnnm\csrss.exe79⤵PID:5356
-
C:\Windows\SysWOW64\djsvxx\csrss.exeC:\Windows\system32\djsvxx\csrss.exe80⤵PID:3552
-
C:\Windows\SysWOW64\vgdgmrm\csrss.exeC:\Windows\system32\vgdgmrm\csrss.exe81⤵PID:2584
-
C:\Windows\SysWOW64\pjrbzmxh\csrss.exeC:\Windows\system32\pjrbzmxh\csrss.exe82⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4916 -
C:\Windows\SysWOW64\yrltbrzxmc\csrss.exeC:\Windows\system32\yrltbrzxmc\csrss.exe83⤵PID:1984
-
C:\Windows\SysWOW64\dvvzyftqly\csrss.exeC:\Windows\system32\dvvzyftqly\csrss.exe84⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4124 -
C:\Windows\SysWOW64\vshknzcuig\csrss.exeC:\Windows\system32\vshknzcuig\csrss.exe85⤵
- Drops file in System32 directory
PID:3172 -
C:\Windows\SysWOW64\xlkdvmi\csrss.exeC:\Windows\system32\xlkdvmi\csrss.exe86⤵
- Drops file in System32 directory
PID:1116 -
C:\Windows\SysWOW64\ajsauyb\csrss.exeC:\Windows\system32\ajsauyb\csrss.exe87⤵PID:4832
-
C:\Windows\SysWOW64\sgbrquztij\csrss.exeC:\Windows\system32\sgbrquztij\csrss.exe88⤵
- Drops file in System32 directory
PID:6120 -
C:\Windows\SysWOW64\esndzoo\csrss.exeC:\Windows\system32\esndzoo\csrss.exe89⤵
- System Location Discovery: System Language Discovery
PID:5576 -
C:\Windows\SysWOW64\srqspvfi\csrss.exeC:\Windows\system32\srqspvfi\csrss.exe90⤵PID:2476
-
C:\Windows\SysWOW64\uwuvguqcif\csrss.exeC:\Windows\system32\uwuvguqcif\csrss.exe91⤵PID:3944
-
C:\Windows\SysWOW64\sercygkfa\csrss.exeC:\Windows\system32\sercygkfa\csrss.exe92⤵PID:5620
-
C:\Windows\SysWOW64\kbcnnatjx\csrss.exeC:\Windows\system32\kbcnnatjx\csrss.exe93⤵PID:3928
-
C:\Windows\SysWOW64\sqsmispcvh\csrss.exeC:\Windows\system32\sqsmispcvh\csrss.exe94⤵PID:2288
-
C:\Windows\SysWOW64\hcwkhll\csrss.exeC:\Windows\system32\hcwkhll\csrss.exe95⤵PID:5060
-
C:\Windows\SysWOW64\bfkevgwp\csrss.exeC:\Windows\system32\bfkevgwp\csrss.exe96⤵PID:5000
-
C:\Windows\SysWOW64\wbbsqp\csrss.exeC:\Windows\system32\wbbsqp\csrss.exe97⤵PID:2616
-
C:\Windows\SysWOW64\giwekq\csrss.exeC:\Windows\system32\giwekq\csrss.exe98⤵PID:3028
-
C:\Windows\SysWOW64\judrarnxt\csrss.exeC:\Windows\system32\judrarnxt\csrss.exe99⤵
- System Location Discovery: System Language Discovery
PID:5656 -
C:\Windows\SysWOW64\rjtqujjqrj\csrss.exeC:\Windows\system32\rjtqujjqrj\csrss.exe100⤵
- Drops file in System32 directory
PID:6008 -
C:\Windows\SysWOW64\glisgs\csrss.exeC:\Windows\system32\glisgs\csrss.exe101⤵PID:3880
-
C:\Windows\SysWOW64\jjovnhih\csrss.exeC:\Windows\system32\jjovnhih\csrss.exe102⤵PID:1328
-
C:\Windows\SysWOW64\yvstmafqht\csrss.exeC:\Windows\system32\yvstmafqht\csrss.exe103⤵PID:2052
-
C:\Windows\SysWOW64\wcquxj\csrss.exeC:\Windows\system32\wcquxj\csrss.exe104⤵PID:4616
-
C:\Windows\SysWOW64\vjnapwcpi\csrss.exeC:\Windows\system32\vjnapwcpi\csrss.exe105⤵PID:2856
-
C:\Windows\SysWOW64\ngylepltff\csrss.exeC:\Windows\system32\ngylepltff\csrss.exe106⤵
- Drops file in System32 directory
PID:4692 -
C:\Windows\SysWOW64\anxhmkwih\csrss.exeC:\Windows\system32\anxhmkwih\csrss.exe107⤵PID:4712
-
C:\Windows\SysWOW64\dyftckj\csrss.exeC:\Windows\system32\dyftckj\csrss.exe108⤵
- Drops file in System32 directory
PID:1688 -
C:\Windows\SysWOW64\xotyyrzed\csrss.exeC:\Windows\system32\xotyyrzed\csrss.exe109⤵PID:1684
-
C:\Windows\SysWOW64\vvqeresh\csrss.exeC:\Windows\system32\vvqeresh\csrss.exe110⤵PID:2800
-
C:\Windows\SysWOW64\yhxrge\csrss.exeC:\Windows\system32\yhxrge\csrss.exe111⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4568 -
C:\Windows\SysWOW64\cefofq\csrss.exeC:\Windows\system32\cefofq\csrss.exe112⤵PID:2604
-
C:\Windows\SysWOW64\vvsyjadbmx\csrss.exeC:\Windows\system32\vvsyjadbmx\csrss.exe113⤵PID:2316
-
C:\Windows\SysWOW64\ndpqfy\csrss.exeC:\Windows\system32\ndpqfy\csrss.exe114⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1476 -
C:\Windows\SysWOW64\cptoerdjt\csrss.exeC:\Windows\system32\cptoerdjt\csrss.exe115⤵
- Drops file in System32 directory
PID:2412 -
C:\Windows\SysWOW64\mxpazsqt\csrss.exeC:\Windows\system32\mxpazsqt\csrss.exe116⤵PID:2292
-
C:\Windows\SysWOW64\hsgoub\csrss.exeC:\Windows\system32\hsgoub\csrss.exe117⤵PID:4912
-
C:\Windows\SysWOW64\bvuihwr\csrss.exeC:\Windows\system32\bvuihwr\csrss.exe118⤵PID:2912
-
C:\Windows\SysWOW64\zdqpzjlclr\csrss.exeC:\Windows\system32\zdqpzjlclr\csrss.exe119⤵PID:4812
-
C:\Windows\SysWOW64\egbvxxeukm\csrss.exeC:\Windows\system32\egbvxxeukm\csrss.exe120⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2408 -
C:\Windows\SysWOW64\xjpqks\csrss.exeC:\Windows\system32\xjpqks\csrss.exe121⤵PID:1876
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-