Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
08/05/2024, 22:52
Behavioral task
behavioral1
Sample
87a6b83edcd21aada024742f33ef47e0_NEIKI.dll
Resource
win7-20240508-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
87a6b83edcd21aada024742f33ef47e0_NEIKI.dll
Resource
win10v2004-20240226-en
1 signatures
150 seconds
General
-
Target
87a6b83edcd21aada024742f33ef47e0_NEIKI.dll
-
Size
192KB
-
MD5
87a6b83edcd21aada024742f33ef47e0
-
SHA1
1aafbb8f357abb31146a34f7ff95cfe6d1e3e5cb
-
SHA256
2fbd5855cd139711a4d1a7d7514c189d446201f0c5a6cd4f2a5efbe30eb84a7a
-
SHA512
8bd8f8bfbb766e22f1134a3e69c299c23938189183621cfdda0e3d35a7231fe2ae9cbbaab7af0fcfd70097af11d7a3b0bb02528ed15184fb3d2355c65763a5f8
-
SSDEEP
3072:480J8IMILmCa3yx6oFEdgVXnFtNmRggfxm3:4okmCaiEoFEd+FHYxm
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4820 wrote to memory of 4552 4820 rundll32.exe 92 PID 4820 wrote to memory of 4552 4820 rundll32.exe 92 PID 4820 wrote to memory of 4552 4820 rundll32.exe 92 PID 4552 wrote to memory of 2252 4552 rundll32.exe 93 PID 4552 wrote to memory of 2252 4552 rundll32.exe 93 PID 4552 wrote to memory of 2252 4552 rundll32.exe 93 PID 2252 wrote to memory of 3536 2252 rundll32.exe 94 PID 2252 wrote to memory of 3536 2252 rundll32.exe 94 PID 2252 wrote to memory of 3536 2252 rundll32.exe 94 PID 3536 wrote to memory of 3032 3536 rundll32.exe 95 PID 3536 wrote to memory of 3032 3536 rundll32.exe 95 PID 3536 wrote to memory of 3032 3536 rundll32.exe 95 PID 3032 wrote to memory of 2208 3032 rundll32.exe 96 PID 3032 wrote to memory of 2208 3032 rundll32.exe 96 PID 3032 wrote to memory of 2208 3032 rundll32.exe 96 PID 2208 wrote to memory of 656 2208 rundll32.exe 97 PID 2208 wrote to memory of 656 2208 rundll32.exe 97 PID 2208 wrote to memory of 656 2208 rundll32.exe 97 PID 656 wrote to memory of 1116 656 rundll32.exe 98 PID 656 wrote to memory of 1116 656 rundll32.exe 98 PID 656 wrote to memory of 1116 656 rundll32.exe 98 PID 1116 wrote to memory of 3400 1116 rundll32.exe 99 PID 1116 wrote to memory of 3400 1116 rundll32.exe 99 PID 1116 wrote to memory of 3400 1116 rundll32.exe 99 PID 3400 wrote to memory of 3604 3400 rundll32.exe 100 PID 3400 wrote to memory of 3604 3400 rundll32.exe 100 PID 3400 wrote to memory of 3604 3400 rundll32.exe 100 PID 3604 wrote to memory of 1980 3604 rundll32.exe 101 PID 3604 wrote to memory of 1980 3604 rundll32.exe 101 PID 3604 wrote to memory of 1980 3604 rundll32.exe 101 PID 1980 wrote to memory of 208 1980 rundll32.exe 102 PID 1980 wrote to memory of 208 1980 rundll32.exe 102 PID 1980 wrote to memory of 208 1980 rundll32.exe 102 PID 208 wrote to memory of 3656 208 rundll32.exe 103 PID 208 wrote to memory of 3656 208 rundll32.exe 103 PID 208 wrote to memory of 3656 208 rundll32.exe 103 PID 3656 wrote to memory of 3584 3656 rundll32.exe 104 PID 3656 wrote to memory of 3584 3656 rundll32.exe 104 PID 3656 wrote to memory of 3584 3656 rundll32.exe 104 PID 3584 wrote to memory of 2940 3584 rundll32.exe 105 PID 3584 wrote to memory of 2940 3584 rundll32.exe 105 PID 3584 wrote to memory of 2940 3584 rundll32.exe 105 PID 2940 wrote to memory of 1988 2940 rundll32.exe 106 PID 2940 wrote to memory of 1988 2940 rundll32.exe 106 PID 2940 wrote to memory of 1988 2940 rundll32.exe 106 PID 1988 wrote to memory of 2320 1988 rundll32.exe 107 PID 1988 wrote to memory of 2320 1988 rundll32.exe 107 PID 1988 wrote to memory of 2320 1988 rundll32.exe 107 PID 2320 wrote to memory of 3064 2320 rundll32.exe 108 PID 2320 wrote to memory of 3064 2320 rundll32.exe 108 PID 2320 wrote to memory of 3064 2320 rundll32.exe 108 PID 3064 wrote to memory of 5056 3064 rundll32.exe 109 PID 3064 wrote to memory of 5056 3064 rundll32.exe 109 PID 3064 wrote to memory of 5056 3064 rundll32.exe 109 PID 5056 wrote to memory of 1256 5056 rundll32.exe 110 PID 5056 wrote to memory of 1256 5056 rundll32.exe 110 PID 5056 wrote to memory of 1256 5056 rundll32.exe 110 PID 1256 wrote to memory of 4532 1256 rundll32.exe 111 PID 1256 wrote to memory of 4532 1256 rundll32.exe 111 PID 1256 wrote to memory of 4532 1256 rundll32.exe 111 PID 4532 wrote to memory of 1380 4532 rundll32.exe 112 PID 4532 wrote to memory of 1380 4532 rundll32.exe 112 PID 4532 wrote to memory of 1380 4532 rundll32.exe 112 PID 1380 wrote to memory of 1684 1380 rundll32.exe 113
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#14⤵
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#15⤵
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#16⤵
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#17⤵
- Suspicious use of WriteProcessMemory
PID:656 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#18⤵
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#19⤵
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#110⤵
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#111⤵
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#112⤵
- Suspicious use of WriteProcessMemory
PID:208 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#113⤵
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#114⤵
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#115⤵
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#116⤵
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#117⤵
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#118⤵
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#119⤵
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#120⤵
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#121⤵
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#122⤵
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#123⤵PID:1684
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#124⤵PID:4056
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#125⤵PID:1636
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#126⤵PID:5096
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#127⤵PID:1932
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#128⤵PID:4576
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#129⤵PID:548
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#130⤵PID:1652
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#131⤵PID:3572
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#132⤵PID:4792
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#133⤵PID:868
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#134⤵PID:4488
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#135⤵PID:2180
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#136⤵PID:4828
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#137⤵PID:5104
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#138⤵PID:1784
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#139⤵PID:2832
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#140⤵PID:3660
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#141⤵PID:4872
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#142⤵PID:2440
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#143⤵PID:1428
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#144⤵PID:2536
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#145⤵PID:3424
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#146⤵PID:380
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#147⤵PID:4124
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#148⤵PID:1080
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#149⤵PID:1964
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#150⤵PID:2952
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#151⤵PID:1452
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#152⤵PID:4936
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#153⤵PID:4768
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#154⤵PID:3636
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#155⤵PID:1712
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#156⤵PID:4732
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#157⤵PID:4804
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#158⤵PID:4500
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#159⤵PID:3576
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#160⤵PID:3092
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#161⤵PID:5020
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#162⤵PID:1124
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#163⤵PID:2480
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#164⤵PID:1128
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#165⤵PID:60
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#166⤵PID:5000
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#167⤵PID:4344
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#168⤵PID:4508
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#169⤵PID:4008
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#170⤵PID:2568
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#171⤵PID:1748
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#172⤵PID:1772
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#173⤵PID:2164
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#174⤵PID:3512
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#175⤵PID:1448
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#176⤵PID:2024
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#177⤵PID:2172
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#178⤵PID:4720
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#179⤵PID:1852
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#180⤵PID:1728
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#181⤵PID:4408
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#182⤵PID:4220
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#183⤵PID:4356
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#184⤵PID:1840
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#185⤵PID:4760
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#186⤵PID:2364
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#187⤵PID:2556
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#188⤵PID:3216
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#189⤵PID:1892
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#190⤵PID:876
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#191⤵PID:404
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#192⤵PID:4564
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#193⤵PID:444
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#194⤵PID:1880
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#195⤵PID:2372
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#196⤵PID:2092
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#197⤵PID:1208
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#198⤵PID:4312
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#199⤵PID:5128
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#1100⤵PID:5144
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#1101⤵PID:5160
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#1102⤵PID:5176
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#1103⤵PID:5192
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#1104⤵PID:5208
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#1105⤵PID:5220
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#1106⤵PID:5232
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#1107⤵PID:5244
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#1108⤵PID:5256
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#1109⤵PID:5268
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#1110⤵PID:5280
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#1111⤵PID:5292
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#1112⤵PID:5304
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#1113⤵PID:5316
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#1114⤵PID:5336
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#1115⤵PID:5348
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#1116⤵PID:5364
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#1117⤵PID:5376
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#1118⤵PID:5388
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#1119⤵PID:5400
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#1120⤵PID:5416
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#1121⤵PID:5428
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#1122⤵PID:5440
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-