Overview
overview
10Static
static
10HMC 2.2.0/...ip.dll
windows7-x64
1HMC 2.2.0/...ip.dll
windows10-2004-x64
1HMC 2.2.0/Entropy.dll
windows7-x64
1HMC 2.2.0/Entropy.dll
windows10-2004-x64
1HMC 2.2.0/HMC.exe
windows7-x64
7HMC 2.2.0/HMC.exe
windows10-2004-x64
8HMC 2.2.0/...ol.dll
windows7-x64
1HMC 2.2.0/...ol.dll
windows10-2004-x64
1HMC 2.2.0/...er.dll
windows7-x64
1HMC 2.2.0/...er.dll
windows10-2004-x64
1HMC 2.2.0/License.dll
windows7-x64
1HMC 2.2.0/License.dll
windows10-2004-x64
1HMC 2.2.0/...ET.dll
windows7-x64
1HMC 2.2.0/...ET.dll
windows10-2004-x64
1HMC 2.2.0/...es.dll
windows7-x64
1HMC 2.2.0/...es.dll
windows10-2004-x64
1HMC 2.2.0/...on.dll
windows7-x64
1HMC 2.2.0/...on.dll
windows10-2004-x64
1HMC 2.2.0/...ta.dll
windows7-x64
1HMC 2.2.0/...ta.dll
windows10-2004-x64
1HMC 2.2.0/...ml.dll
windows7-x64
1HMC 2.2.0/...ml.dll
windows10-2004-x64
1HMC 2.2.0/...er.dll
windows7-x64
1HMC 2.2.0/...er.dll
windows10-2004-x64
1HMC 2.2.0/...ss.dll
windows7-x64
1HMC 2.2.0/...ss.dll
windows10-2004-x64
1HMC 2.2.0/...rs.dll
windows7-x64
1HMC 2.2.0/...rs.dll
windows10-2004-x64
1HMC 2.2.0/...te.dll
windows7-x64
1HMC 2.2.0/...te.dll
windows10-2004-x64
1HMC 2.2.0/...ry.dll
windows7-x64
1HMC 2.2.0/...ry.dll
windows10-2004-x64
1Analysis
-
max time kernel
143s -
max time network
163s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
09-07-2024 12:43
Behavioral task
behavioral1
Sample
HMC 2.2.0/DotNetZip.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
HMC 2.2.0/DotNetZip.dll
Resource
win10v2004-20240708-en
Behavioral task
behavioral3
Sample
HMC 2.2.0/Entropy.dll
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
HMC 2.2.0/Entropy.dll
Resource
win10v2004-20240708-en
Behavioral task
behavioral5
Sample
HMC 2.2.0/HMC.exe
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
HMC 2.2.0/HMC.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral7
Sample
HMC 2.2.0/HandyControl.dll
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
HMC 2.2.0/HandyControl.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral9
Sample
HMC 2.2.0/IpMatcher.dll
Resource
win7-20240705-en
Behavioral task
behavioral10
Sample
HMC 2.2.0/IpMatcher.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral11
Sample
HMC 2.2.0/License.dll
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
HMC 2.2.0/License.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral13
Sample
HMC 2.2.0/MailBee.NET.dll
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
HMC 2.2.0/MailBee.NET.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral15
Sample
HMC 2.2.0/Microsoft.Bcl.AsyncInterfaces.dll
Resource
win7-20240705-en
Behavioral task
behavioral16
Sample
HMC 2.2.0/Microsoft.Bcl.AsyncInterfaces.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral17
Sample
HMC 2.2.0/Newtonsoft.Json.dll
Resource
win7-20240705-en
Behavioral task
behavioral18
Sample
HMC 2.2.0/Newtonsoft.Json.dll
Resource
win10v2004-20240708-en
Behavioral task
behavioral19
Sample
HMC 2.2.0/PresentationFramework-SystemData.dll
Resource
win7-20240704-en
Behavioral task
behavioral20
Sample
HMC 2.2.0/PresentationFramework-SystemData.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral21
Sample
HMC 2.2.0/PresentationFramework-SystemXml.dll
Resource
win7-20240704-en
Behavioral task
behavioral22
Sample
HMC 2.2.0/PresentationFramework-SystemXml.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral23
Sample
HMC 2.2.0/RegexMatcher.dll
Resource
win7-20240705-en
Behavioral task
behavioral24
Sample
HMC 2.2.0/RegexMatcher.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral25
Sample
HMC 2.2.0/SharpCompress.dll
Resource
win7-20240704-en
Behavioral task
behavioral26
Sample
HMC 2.2.0/SharpCompress.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral27
Sample
HMC 2.2.0/System.Buffers.dll
Resource
win7-20240705-en
Behavioral task
behavioral28
Sample
HMC 2.2.0/System.Buffers.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral29
Sample
HMC 2.2.0/System.Data.SQLite.dll
Resource
win7-20240708-en
Behavioral task
behavioral30
Sample
HMC 2.2.0/System.Data.SQLite.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral31
Sample
HMC 2.2.0/System.Memory.dll
Resource
win7-20240705-en
Behavioral task
behavioral32
Sample
HMC 2.2.0/System.Memory.dll
Resource
win10v2004-20240704-en
General
-
Target
HMC 2.2.0/PresentationFramework-SystemData.dll
-
Size
8KB
-
MD5
dca6f1b8644df5d0890a7dbc6411e86c
-
SHA1
27066bf658df2d398aad6003ae8496dcf015a4d5
-
SHA256
48883bd04158c2456ea1be831b559b594fb86199c0d9618e7c3fde45a986ab26
-
SHA512
046020ad671d37935eb674988186eb6a8a28b093887f572a4604781be3f8fc6d9df96a00580f352789bdb7ea0f8ebaf6ee3cf13c6be5118bd1df290a3487742a
-
SSDEEP
192:cmBvnnwQh8N/UH6AKwBz1o5fDzupoiuhuWHsWYSW:cmVnn98N/Y6m3o5PPiu0WHsWYSW
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4328 wrote to memory of 2712 4328 rundll32.exe 82 PID 4328 wrote to memory of 2712 4328 rundll32.exe 82 PID 4328 wrote to memory of 2712 4328 rundll32.exe 82 PID 2712 wrote to memory of 4984 2712 rundll32.exe 83 PID 2712 wrote to memory of 4984 2712 rundll32.exe 83 PID 2712 wrote to memory of 4984 2712 rundll32.exe 83 PID 4984 wrote to memory of 2784 4984 rundll32.exe 84 PID 4984 wrote to memory of 2784 4984 rundll32.exe 84 PID 4984 wrote to memory of 2784 4984 rundll32.exe 84 PID 2784 wrote to memory of 2616 2784 rundll32.exe 85 PID 2784 wrote to memory of 2616 2784 rundll32.exe 85 PID 2784 wrote to memory of 2616 2784 rundll32.exe 85 PID 2616 wrote to memory of 1288 2616 rundll32.exe 86 PID 2616 wrote to memory of 1288 2616 rundll32.exe 86 PID 2616 wrote to memory of 1288 2616 rundll32.exe 86 PID 1288 wrote to memory of 1760 1288 rundll32.exe 87 PID 1288 wrote to memory of 1760 1288 rundll32.exe 87 PID 1288 wrote to memory of 1760 1288 rundll32.exe 87 PID 1760 wrote to memory of 2056 1760 rundll32.exe 88 PID 1760 wrote to memory of 2056 1760 rundll32.exe 88 PID 1760 wrote to memory of 2056 1760 rundll32.exe 88 PID 2056 wrote to memory of 4664 2056 rundll32.exe 89 PID 2056 wrote to memory of 4664 2056 rundll32.exe 89 PID 2056 wrote to memory of 4664 2056 rundll32.exe 89 PID 4664 wrote to memory of 1988 4664 rundll32.exe 90 PID 4664 wrote to memory of 1988 4664 rundll32.exe 90 PID 4664 wrote to memory of 1988 4664 rundll32.exe 90 PID 1988 wrote to memory of 4980 1988 rundll32.exe 91 PID 1988 wrote to memory of 4980 1988 rundll32.exe 91 PID 1988 wrote to memory of 4980 1988 rundll32.exe 91 PID 4980 wrote to memory of 5072 4980 rundll32.exe 92 PID 4980 wrote to memory of 5072 4980 rundll32.exe 92 PID 4980 wrote to memory of 5072 4980 rundll32.exe 92 PID 5072 wrote to memory of 4348 5072 rundll32.exe 93 PID 5072 wrote to memory of 4348 5072 rundll32.exe 93 PID 5072 wrote to memory of 4348 5072 rundll32.exe 93 PID 4348 wrote to memory of 3956 4348 rundll32.exe 94 PID 4348 wrote to memory of 3956 4348 rundll32.exe 94 PID 4348 wrote to memory of 3956 4348 rundll32.exe 94 PID 3956 wrote to memory of 4164 3956 rundll32.exe 95 PID 3956 wrote to memory of 4164 3956 rundll32.exe 95 PID 3956 wrote to memory of 4164 3956 rundll32.exe 95 PID 4164 wrote to memory of 2856 4164 rundll32.exe 96 PID 4164 wrote to memory of 2856 4164 rundll32.exe 96 PID 4164 wrote to memory of 2856 4164 rundll32.exe 96 PID 2856 wrote to memory of 3660 2856 rundll32.exe 97 PID 2856 wrote to memory of 3660 2856 rundll32.exe 97 PID 2856 wrote to memory of 3660 2856 rundll32.exe 97 PID 3660 wrote to memory of 4392 3660 rundll32.exe 98 PID 3660 wrote to memory of 4392 3660 rundll32.exe 98 PID 3660 wrote to memory of 4392 3660 rundll32.exe 98 PID 4392 wrote to memory of 2200 4392 rundll32.exe 99 PID 4392 wrote to memory of 2200 4392 rundll32.exe 99 PID 4392 wrote to memory of 2200 4392 rundll32.exe 99 PID 2200 wrote to memory of 2740 2200 rundll32.exe 100 PID 2200 wrote to memory of 2740 2200 rundll32.exe 100 PID 2200 wrote to memory of 2740 2200 rundll32.exe 100 PID 2740 wrote to memory of 2060 2740 rundll32.exe 101 PID 2740 wrote to memory of 2060 2740 rundll32.exe 101 PID 2740 wrote to memory of 2060 2740 rundll32.exe 101 PID 2060 wrote to memory of 2620 2060 rundll32.exe 102 PID 2060 wrote to memory of 2620 2060 rundll32.exe 102 PID 2060 wrote to memory of 2620 2060 rundll32.exe 102 PID 2620 wrote to memory of 4916 2620 rundll32.exe 103
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#11⤵
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#12⤵
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#13⤵
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#14⤵
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#15⤵
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#16⤵
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#17⤵
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#18⤵
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#19⤵
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#110⤵
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#111⤵
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#112⤵
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#113⤵
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#114⤵
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#115⤵
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#116⤵
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#117⤵
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#118⤵
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#119⤵
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#120⤵
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#121⤵
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#122⤵
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#123⤵PID:4916
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#124⤵PID:3240
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#125⤵PID:2396
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#126⤵PID:3008
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#127⤵PID:3988
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#128⤵PID:5052
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#129⤵PID:3192
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#130⤵PID:3780
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#131⤵PID:4436
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#132⤵PID:2684
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#133⤵PID:1664
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#134⤵PID:2804
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#135⤵PID:2908
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#136⤵PID:3184
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#137⤵PID:4376
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#138⤵PID:4500
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#139⤵PID:1368
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#140⤵PID:4364
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#141⤵PID:1708
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#142⤵PID:4228
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#143⤵PID:1992
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#144⤵PID:1452
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#145⤵PID:3004
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#146⤵PID:2172
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#147⤵PID:4116
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#148⤵PID:2588
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#149⤵PID:2772
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#150⤵PID:3944
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#151⤵PID:3016
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#152⤵PID:4484
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#153⤵PID:408
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#154⤵PID:856
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#155⤵PID:4880
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#156⤵PID:3996
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#157⤵PID:4996
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#158⤵PID:4448
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#159⤵PID:3176
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#160⤵PID:3196
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#161⤵PID:732
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#162⤵PID:3948
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#163⤵PID:2808
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#164⤵PID:5076
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#165⤵PID:4452
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#166⤵PID:1128
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#167⤵PID:2916
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#168⤵PID:452
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#169⤵PID:4744
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#170⤵PID:440
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#171⤵PID:3596
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#172⤵PID:1104
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#173⤵PID:1092
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#174⤵PID:2372
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#175⤵PID:1084
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#176⤵PID:4940
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#177⤵PID:3308
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#178⤵PID:1448
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#179⤵PID:976
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#180⤵PID:4204
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#181⤵PID:2612
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#182⤵PID:2252
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#183⤵PID:4052
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#184⤵PID:2204
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#185⤵PID:1648
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#186⤵PID:3288
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#187⤵PID:1160
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#188⤵PID:1900
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#189⤵PID:1632
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#190⤵PID:4524
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#191⤵PID:4496
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#192⤵PID:4472
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#193⤵PID:1132
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#194⤵PID:3284
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#195⤵PID:3576
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#196⤵PID:4536
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#197⤵PID:4832
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#198⤵PID:4708
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#199⤵PID:1208
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#1100⤵PID:3156
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#1101⤵PID:2716
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#1102⤵PID:704
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#1103⤵PID:2236
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#1104⤵PID:692
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#1105⤵PID:5000
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#1106⤵PID:336
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#1107⤵PID:1180
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#1108⤵PID:4352
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#1109⤵PID:4408
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#1110⤵PID:4356
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#1111⤵PID:5128
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#1112⤵PID:5140
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#1113⤵PID:5152
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#1114⤵PID:5164
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#1115⤵PID:5180
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#1116⤵PID:5192
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#1117⤵PID:5208
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#1118⤵PID:5220
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#1119⤵PID:5236
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#1120⤵PID:5252
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#1121⤵PID:5264
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemData.dll",#1122⤵PID:5280
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-