home

csrss.exe

RKSOFT- Web-Filter RK

Rksoft Softwares

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘wfmaster’.
Publisher:
Rksoft Softwares Ltda  (signed by Rksoft Softwares)

Product:
RKSOFT- Web-Filter RK

Description:
Filtro de conteúdo da web

Version:
4.08.0002

MD5:
427b85067578089a11f0597eef3ba41d

SHA-1:
878c8169984a8d94ee0044765bccc28774c5dd28

SHA-256:
253213219bdaff55db470d24813f123bbe438af19c81d011c09796ac2c825229

Scanner detections:
1 / 68

Status:
Inconclusive  (not enough data for an accurate detection)

Analysis date:
2/26/2025 1:02:41 AM UTC  (today)

Scan engine
Detection
Engine version

F-Prot
W32/VB-Wird-based
4.6.5.141

File size:
4.1 MB (4,332,616 bytes)

Product version:
4.08.0002

Copyright:
RKSOFT SOFTWARES

Original file name:
csrss.exe

File type:
Executable application (Win32 EXE)

Language:
Brazilian Portuguese

Common path:
C:\Program Files\rksoft\wf\csrss.exe

Digital Signature
Signed by:
Rksoft Softwares

Authority:
COMODO CA Limited

Valid from:
10/7/2014 9:00:00 PM

Valid to:
10/8/2015 8:59:59 PM

Subject:
CN=Rksoft Softwares, O=Rksoft Softwares, STREET="Rua Nova Jerusalém, 339", L=São Paulo, S=São Paulo, PostalCode=03510-000, C=BR

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
520B59FADEE780205ADA17B215F3C160

File PE Metadata
Compilation timestamp:
6/19/2015 3:02:24 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

Entry address:
0x53D4

Entry point:
68, 88, 6E, 6D, 00, E8, F0, FF, FF, FF, 00, 00, 48, 00, 00, 00, 30, 00, 00, 00, 40, 00, 00, 00, 00, 00, 00, 00, E2, 1A, 17, F9, 8C, BE, 45, 47, A3, F5, AA, 0A, 75, 10, 82, AD, 00, 00, 00, 00, 00, 00, 01, 00, 00, 00, 00, 00, 00, 00, 00, 00, 57, 65, 62, 46, 69, 6C, 74, 65, 72, 52, 6B, 00, 20, C1, 40, 00, 00, C1, 40, 00, D8, C0, 40, 00, B8, 00, 00, 00, 90, 00, 00, 00, 00, 00, 00, 00, 02, 00, 00, 00, 18, 00, 00, 00, C2, 92, 64, 00, 12, CC, 09, 42, 94, 84, 01, 03, 64, A4, C6, 83, 01, 00, 00, 00, 98, 00, 00, 00...
 
[+]

Developed / compiled with:
Microsoft Visual Basic v5.0

Code size:
4.1 MB (4,300,800 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
wfmaster

Command:
C:\Program Files\rksoft\wf\csrss.exe run


Scan csrss.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.