Overview
overview
10Static
static
10HMC 2.2.0/...ip.dll
windows7-x64
1HMC 2.2.0/...ip.dll
windows10-2004-x64
1HMC 2.2.0/Entropy.dll
windows7-x64
1HMC 2.2.0/Entropy.dll
windows10-2004-x64
1HMC 2.2.0/HMC.exe
windows7-x64
7HMC 2.2.0/HMC.exe
windows10-2004-x64
8HMC 2.2.0/...ol.dll
windows7-x64
1HMC 2.2.0/...ol.dll
windows10-2004-x64
1HMC 2.2.0/...er.dll
windows7-x64
1HMC 2.2.0/...er.dll
windows10-2004-x64
1HMC 2.2.0/License.dll
windows7-x64
1HMC 2.2.0/License.dll
windows10-2004-x64
1HMC 2.2.0/...ET.dll
windows7-x64
1HMC 2.2.0/...ET.dll
windows10-2004-x64
1HMC 2.2.0/...es.dll
windows7-x64
1HMC 2.2.0/...es.dll
windows10-2004-x64
1HMC 2.2.0/...on.dll
windows7-x64
1HMC 2.2.0/...on.dll
windows10-2004-x64
1HMC 2.2.0/...ta.dll
windows7-x64
1HMC 2.2.0/...ta.dll
windows10-2004-x64
1HMC 2.2.0/...ml.dll
windows7-x64
1HMC 2.2.0/...ml.dll
windows10-2004-x64
1HMC 2.2.0/...er.dll
windows7-x64
1HMC 2.2.0/...er.dll
windows10-2004-x64
1HMC 2.2.0/...ss.dll
windows7-x64
1HMC 2.2.0/...ss.dll
windows10-2004-x64
1HMC 2.2.0/...rs.dll
windows7-x64
1HMC 2.2.0/...rs.dll
windows10-2004-x64
1HMC 2.2.0/...te.dll
windows7-x64
1HMC 2.2.0/...te.dll
windows10-2004-x64
1HMC 2.2.0/...ry.dll
windows7-x64
1HMC 2.2.0/...ry.dll
windows10-2004-x64
1Analysis
-
max time kernel
141s -
max time network
166s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
09-07-2024 12:43
Behavioral task
behavioral1
Sample
HMC 2.2.0/DotNetZip.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
HMC 2.2.0/DotNetZip.dll
Resource
win10v2004-20240708-en
Behavioral task
behavioral3
Sample
HMC 2.2.0/Entropy.dll
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
HMC 2.2.0/Entropy.dll
Resource
win10v2004-20240708-en
Behavioral task
behavioral5
Sample
HMC 2.2.0/HMC.exe
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
HMC 2.2.0/HMC.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral7
Sample
HMC 2.2.0/HandyControl.dll
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
HMC 2.2.0/HandyControl.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral9
Sample
HMC 2.2.0/IpMatcher.dll
Resource
win7-20240705-en
Behavioral task
behavioral10
Sample
HMC 2.2.0/IpMatcher.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral11
Sample
HMC 2.2.0/License.dll
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
HMC 2.2.0/License.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral13
Sample
HMC 2.2.0/MailBee.NET.dll
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
HMC 2.2.0/MailBee.NET.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral15
Sample
HMC 2.2.0/Microsoft.Bcl.AsyncInterfaces.dll
Resource
win7-20240705-en
Behavioral task
behavioral16
Sample
HMC 2.2.0/Microsoft.Bcl.AsyncInterfaces.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral17
Sample
HMC 2.2.0/Newtonsoft.Json.dll
Resource
win7-20240705-en
Behavioral task
behavioral18
Sample
HMC 2.2.0/Newtonsoft.Json.dll
Resource
win10v2004-20240708-en
Behavioral task
behavioral19
Sample
HMC 2.2.0/PresentationFramework-SystemData.dll
Resource
win7-20240704-en
Behavioral task
behavioral20
Sample
HMC 2.2.0/PresentationFramework-SystemData.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral21
Sample
HMC 2.2.0/PresentationFramework-SystemXml.dll
Resource
win7-20240704-en
Behavioral task
behavioral22
Sample
HMC 2.2.0/PresentationFramework-SystemXml.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral23
Sample
HMC 2.2.0/RegexMatcher.dll
Resource
win7-20240705-en
Behavioral task
behavioral24
Sample
HMC 2.2.0/RegexMatcher.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral25
Sample
HMC 2.2.0/SharpCompress.dll
Resource
win7-20240704-en
Behavioral task
behavioral26
Sample
HMC 2.2.0/SharpCompress.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral27
Sample
HMC 2.2.0/System.Buffers.dll
Resource
win7-20240705-en
Behavioral task
behavioral28
Sample
HMC 2.2.0/System.Buffers.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral29
Sample
HMC 2.2.0/System.Data.SQLite.dll
Resource
win7-20240708-en
Behavioral task
behavioral30
Sample
HMC 2.2.0/System.Data.SQLite.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral31
Sample
HMC 2.2.0/System.Memory.dll
Resource
win7-20240705-en
Behavioral task
behavioral32
Sample
HMC 2.2.0/System.Memory.dll
Resource
win10v2004-20240704-en
General
-
Target
HMC 2.2.0/PresentationFramework-SystemXml.dll
-
Size
8KB
-
MD5
160928813e7cafd92bd765bdce4c18db
-
SHA1
85b11c0d7469a9fc8d2c297e35665b41ee73c754
-
SHA256
872673e0e79265978bddeb5b5c410417d553920bd373a9976a33fa1549f4b563
-
SHA512
6de533acef8efd4f15a0a2155279a0143f6c86d91c39a41d7683195a868e48bd1850f750d6d6c635ad33df48da5a8bd152aa5fac29534de9b22f6340cd836380
-
SSDEEP
192:Yy/Rs7qoQh3vcXP+dKsY1tsbCyo+hCkPd2JCWfDW:Yo4TG3k/+StfyoMCkPd20WfDW
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4036 wrote to memory of 2296 4036 rundll32.exe 82 PID 4036 wrote to memory of 2296 4036 rundll32.exe 82 PID 4036 wrote to memory of 2296 4036 rundll32.exe 82 PID 2296 wrote to memory of 3500 2296 rundll32.exe 83 PID 2296 wrote to memory of 3500 2296 rundll32.exe 83 PID 2296 wrote to memory of 3500 2296 rundll32.exe 83 PID 3500 wrote to memory of 3724 3500 rundll32.exe 84 PID 3500 wrote to memory of 3724 3500 rundll32.exe 84 PID 3500 wrote to memory of 3724 3500 rundll32.exe 84 PID 3724 wrote to memory of 3152 3724 rundll32.exe 85 PID 3724 wrote to memory of 3152 3724 rundll32.exe 85 PID 3724 wrote to memory of 3152 3724 rundll32.exe 85 PID 3152 wrote to memory of 2368 3152 rundll32.exe 86 PID 3152 wrote to memory of 2368 3152 rundll32.exe 86 PID 3152 wrote to memory of 2368 3152 rundll32.exe 86 PID 2368 wrote to memory of 3620 2368 rundll32.exe 87 PID 2368 wrote to memory of 3620 2368 rundll32.exe 87 PID 2368 wrote to memory of 3620 2368 rundll32.exe 87 PID 3620 wrote to memory of 3676 3620 rundll32.exe 88 PID 3620 wrote to memory of 3676 3620 rundll32.exe 88 PID 3620 wrote to memory of 3676 3620 rundll32.exe 88 PID 3676 wrote to memory of 3208 3676 rundll32.exe 89 PID 3676 wrote to memory of 3208 3676 rundll32.exe 89 PID 3676 wrote to memory of 3208 3676 rundll32.exe 89 PID 3208 wrote to memory of 2060 3208 rundll32.exe 90 PID 3208 wrote to memory of 2060 3208 rundll32.exe 90 PID 3208 wrote to memory of 2060 3208 rundll32.exe 90 PID 2060 wrote to memory of 2976 2060 rundll32.exe 91 PID 2060 wrote to memory of 2976 2060 rundll32.exe 91 PID 2060 wrote to memory of 2976 2060 rundll32.exe 91 PID 2976 wrote to memory of 4440 2976 rundll32.exe 92 PID 2976 wrote to memory of 4440 2976 rundll32.exe 92 PID 2976 wrote to memory of 4440 2976 rundll32.exe 92 PID 4440 wrote to memory of 3288 4440 rundll32.exe 93 PID 4440 wrote to memory of 3288 4440 rundll32.exe 93 PID 4440 wrote to memory of 3288 4440 rundll32.exe 93 PID 3288 wrote to memory of 3040 3288 rundll32.exe 94 PID 3288 wrote to memory of 3040 3288 rundll32.exe 94 PID 3288 wrote to memory of 3040 3288 rundll32.exe 94 PID 3040 wrote to memory of 2552 3040 rundll32.exe 95 PID 3040 wrote to memory of 2552 3040 rundll32.exe 95 PID 3040 wrote to memory of 2552 3040 rundll32.exe 95 PID 2552 wrote to memory of 3644 2552 rundll32.exe 96 PID 2552 wrote to memory of 3644 2552 rundll32.exe 96 PID 2552 wrote to memory of 3644 2552 rundll32.exe 96 PID 3644 wrote to memory of 4856 3644 rundll32.exe 97 PID 3644 wrote to memory of 4856 3644 rundll32.exe 97 PID 3644 wrote to memory of 4856 3644 rundll32.exe 97 PID 4856 wrote to memory of 848 4856 rundll32.exe 98 PID 4856 wrote to memory of 848 4856 rundll32.exe 98 PID 4856 wrote to memory of 848 4856 rundll32.exe 98 PID 848 wrote to memory of 4892 848 rundll32.exe 99 PID 848 wrote to memory of 4892 848 rundll32.exe 99 PID 848 wrote to memory of 4892 848 rundll32.exe 99 PID 4892 wrote to memory of 3552 4892 rundll32.exe 100 PID 4892 wrote to memory of 3552 4892 rundll32.exe 100 PID 4892 wrote to memory of 3552 4892 rundll32.exe 100 PID 3552 wrote to memory of 4888 3552 rundll32.exe 101 PID 3552 wrote to memory of 4888 3552 rundll32.exe 101 PID 3552 wrote to memory of 4888 3552 rundll32.exe 101 PID 4888 wrote to memory of 2504 4888 rundll32.exe 102 PID 4888 wrote to memory of 2504 4888 rundll32.exe 102 PID 4888 wrote to memory of 2504 4888 rundll32.exe 102 PID 2504 wrote to memory of 4340 2504 rundll32.exe 103
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#11⤵
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#12⤵
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#13⤵
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#14⤵
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#15⤵
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#16⤵
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#17⤵
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#18⤵
- Suspicious use of WriteProcessMemory
PID:3676 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#19⤵
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#110⤵
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#111⤵
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#112⤵
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#113⤵
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#114⤵
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#115⤵
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#116⤵
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#117⤵
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#118⤵
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#119⤵
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#120⤵
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#121⤵
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#122⤵
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#123⤵PID:4340
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#124⤵PID:4764
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#125⤵PID:1748
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#126⤵PID:496
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#127⤵PID:2412
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#128⤵PID:2240
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#129⤵PID:2560
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#130⤵PID:2904
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#131⤵PID:3220
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#132⤵PID:1144
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#133⤵PID:4056
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#134⤵PID:1792
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#135⤵PID:5048
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#136⤵PID:4200
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#137⤵PID:1136
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#138⤵PID:2448
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#139⤵PID:2040
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#140⤵PID:2744
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#141⤵PID:4264
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#142⤵PID:1904
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#143⤵PID:3968
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#144⤵PID:1316
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#145⤵PID:4276
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#146⤵PID:2472
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#147⤵PID:2348
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#148⤵PID:4772
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#149⤵PID:2604
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#150⤵PID:1148
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#151⤵PID:4932
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#152⤵PID:224
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#153⤵PID:2144
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#154⤵PID:2264
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#155⤵PID:2340
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#156⤵PID:668
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#157⤵PID:3472
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#158⤵PID:4940
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#159⤵PID:1472
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#160⤵PID:4116
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#161⤵PID:1720
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#162⤵PID:3900
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#163⤵PID:1648
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#164⤵PID:4624
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#165⤵PID:4512
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#166⤵PID:4148
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#167⤵PID:1760
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#168⤵PID:1972
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#169⤵PID:4852
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#170⤵PID:1624
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#171⤵PID:1200
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#172⤵PID:2316
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#173⤵PID:3036
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#174⤵PID:4252
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#175⤵PID:3232
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#176⤵PID:3896
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#177⤵PID:1836
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#178⤵PID:3960
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#179⤵PID:4360
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#180⤵PID:4924
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#181⤵PID:3184
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#182⤵PID:3892
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#183⤵PID:3484
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#184⤵PID:1552
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#185⤵PID:2416
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#186⤵PID:3268
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#187⤵PID:3628
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#188⤵PID:3888
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#189⤵PID:456
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#190⤵PID:4104
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#191⤵PID:3764
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#192⤵PID:2548
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#193⤵PID:436
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#194⤵PID:1388
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#195⤵PID:4204
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#196⤵PID:2600
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#197⤵PID:4944
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#198⤵PID:4464
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#199⤵PID:2464
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#1100⤵PID:4128
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#1101⤵PID:4628
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#1102⤵PID:2936
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#1103⤵PID:3328
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#1104⤵PID:3008
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#1105⤵PID:4720
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#1106⤵PID:3460
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#1107⤵PID:1140
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#1108⤵PID:2452
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#1109⤵PID:3616
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#1110⤵PID:4020
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#1111⤵PID:1868
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#1112⤵PID:4164
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#1113⤵PID:1996
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#1114⤵PID:3768
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#1115⤵PID:4240
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#1116⤵PID:3648
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#1117⤵PID:4480
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#1118⤵PID:4348
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#1119⤵PID:2440
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#1120⤵PID:5132
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#1121⤵PID:5148
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\HMC 2.2.0\PresentationFramework-SystemXml.dll",#1122⤵PID:5164
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-