Overview

overview

10

Static

static

10

Xworm-V5.6.zip

windows7-x64

1

Xworm-V5.6.zip

windows10-2004-x64

7

Analysis

  • max time kernel
    408s
  • max time network
    303s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-12-2024 19:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Xworm-V5.6.zip

  • Size

    24.5MB

  • MD5

    5a571707a251e4d8e699c60ff96ae47c

  • SHA1

    0f152472dc47d332b726feb39739118508c36d92

  • SHA256

    43f5eb9bcb505db65f82a064c313e2ead7d6556285a1ad7989e0af5e465770e4

  • SHA512

    8ca1482abacee8cb92146514a83e32185e7c4c169c59634f60e82b81db24f9b87284ee8d45b6a3528339bdce83a8021fdccca64d832b169d5d1cbd3d168b8b37

  • SSDEEP

    393216:pyakq5XFeuBc9Q+Fnqsg5q49DC83v7kjAJgAKbqybloQXo50Ko+Y2ToxY3:pyy5XDBYQwqsGLkjiKp1o5Ho+B

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 5 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 15 IoCs
  • Modifies registry class 1 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Xworm-V5.6.zip"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:3620
  • C:\Windows\System32\NOTEPAD.EXE
    "C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Desktop\a.bat
    1⤵
    • Opens file in notepad (likely ransom note)
    PID:4380
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\a.bat" "
    1⤵
      PID:1740
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\a.bat" "
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:4700
      • C:\Windows\system32\Taskmgr.exe
        taskmgr
        2⤵
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:4236
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:4404
      • C:\Users\Admin\Desktop\Xworm-V5.6\Xworm V5.6.exe
        "C:\Users\Admin\Desktop\Xworm-V5.6\Xworm V5.6.exe"
        1⤵
        • Executes dropped EXE
        • Enumerates system info in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2144
      • C:\Windows\system32\wbem\WmiApSrv.exe
        C:\Windows\system32\wbem\WmiApSrv.exe
        1⤵
          PID:4604
        • C:\Windows\system32\AUDIODG.EXE
          C:\Windows\system32\AUDIODG.EXE 0x4e4 0x4a4
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2764
        • C:\Users\Admin\Desktop\Xworm-V5.6\Xworm V5.6.exe
          "C:\Users\Admin\Desktop\Xworm-V5.6\Xworm V5.6.exe"
          1⤵
          • Executes dropped EXE
          • Enumerates system info in registry
          PID:4860
        • C:\Windows\system32\wbem\WmiApSrv.exe
          C:\Windows\system32\wbem\WmiApSrv.exe
          1⤵
            PID:2336
          • C:\Users\Admin\Desktop\hnaorh.exe
            "C:\Users\Admin\Desktop\hnaorh.exe"
            1⤵
              PID:4008
            • C:\Users\Admin\Desktop\hnaorh.exe
              "C:\Users\Admin\Desktop\hnaorh.exe"
              1⤵
                PID:2148
              • C:\Users\Admin\Desktop\hnaorh.exe
                "C:\Users\Admin\Desktop\hnaorh.exe"
                1⤵
                  PID:3056
                • C:\Users\Admin\Desktop\hnaorh.exe
                  "C:\Users\Admin\Desktop\hnaorh.exe"
                  1⤵
                    PID:2176
                  • C:\Users\Admin\Desktop\hnaorh.exe
                    "C:\Users\Admin\Desktop\hnaorh.exe"
                    1⤵
                      PID:3264
                    • C:\Users\Admin\Desktop\hnaorh.exe
                      "C:\Users\Admin\Desktop\hnaorh.exe"
                      1⤵
                        PID:1852
                      • C:\Users\Admin\Desktop\hnaorh.exe
                        "C:\Users\Admin\Desktop\hnaorh.exe"
                        1⤵
                          PID:836
                        • C:\Users\Admin\Desktop\hnaorh.exe
                          "C:\Users\Admin\Desktop\hnaorh.exe"
                          1⤵
                            PID:4904
                          • C:\Users\Admin\Desktop\hnaorh.exe
                            "C:\Users\Admin\Desktop\hnaorh.exe"
                            1⤵
                              PID:5032
                            • C:\Users\Admin\Desktop\hnaorh.exe
                              "C:\Users\Admin\Desktop\hnaorh.exe"
                              1⤵
                                PID:452
                              • C:\Users\Admin\Desktop\hnaorh.exe
                                "C:\Users\Admin\Desktop\hnaorh.exe"
                                1⤵
                                  PID:2164
                                • C:\Users\Admin\Desktop\hnaorh.exe
                                  "C:\Users\Admin\Desktop\hnaorh.exe"
                                  1⤵
                                    PID:1844
                                  • C:\Users\Admin\Desktop\hnaorh.exe
                                    "C:\Users\Admin\Desktop\hnaorh.exe"
                                    1⤵
                                      PID:700
                                    • C:\Users\Admin\Desktop\hnaorh.exe
                                      "C:\Users\Admin\Desktop\hnaorh.exe"
                                      1⤵
                                        PID:2068
                                      • C:\Users\Admin\Desktop\hnaorh.exe
                                        "C:\Users\Admin\Desktop\hnaorh.exe"
                                        1⤵
                                          PID:4700
                                        • C:\Users\Admin\Desktop\hnaorh.exe
                                          "C:\Users\Admin\Desktop\hnaorh.exe"
                                          1⤵
                                            PID:3168
                                          • C:\Users\Admin\Desktop\hnaorh.exe
                                            "C:\Users\Admin\Desktop\hnaorh.exe"
                                            1⤵
                                              PID:3848
                                            • C:\Users\Admin\Desktop\hnaorh.exe
                                              "C:\Users\Admin\Desktop\hnaorh.exe"
                                              1⤵
                                                PID:2288
                                              • C:\Users\Admin\Desktop\hnaorh.exe
                                                "C:\Users\Admin\Desktop\hnaorh.exe"
                                                1⤵
                                                  PID:1576
                                                • C:\Users\Admin\Desktop\hnaorh.exe
                                                  "C:\Users\Admin\Desktop\hnaorh.exe"
                                                  1⤵
                                                    PID:3424
                                                  • C:\Users\Admin\Desktop\hnaorh.exe
                                                    "C:\Users\Admin\Desktop\hnaorh.exe"
                                                    1⤵
                                                      PID:2284
                                                    • C:\Users\Admin\Desktop\hnaorh.exe
                                                      "C:\Users\Admin\Desktop\hnaorh.exe"
                                                      1⤵
                                                        PID:2748
                                                      • C:\Users\Admin\Desktop\hnaorh.exe
                                                        "C:\Users\Admin\Desktop\hnaorh.exe"
                                                        1⤵
                                                          PID:4536
                                                        • C:\Users\Admin\Desktop\hnaorh.exe
                                                          "C:\Users\Admin\Desktop\hnaorh.exe"
                                                          1⤵
                                                            PID:1772
                                                          • C:\Users\Admin\Desktop\hnaorh.exe
                                                            "C:\Users\Admin\Desktop\hnaorh.exe"
                                                            1⤵
                                                              PID:1516
                                                            • C:\Users\Admin\Desktop\hnaorh.exe
                                                              "C:\Users\Admin\Desktop\hnaorh.exe"
                                                              1⤵
                                                                PID:2076
                                                              • C:\Users\Admin\Desktop\hnaorh.exe
                                                                "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                1⤵
                                                                  PID:3452
                                                                • C:\Users\Admin\Desktop\hnaorh.exe
                                                                  "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                  1⤵
                                                                    PID:1108
                                                                  • C:\Users\Admin\Desktop\hnaorh.exe
                                                                    "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                    1⤵
                                                                      PID:3340
                                                                    • C:\Users\Admin\Desktop\hnaorh.exe
                                                                      "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                      1⤵
                                                                        PID:1012
                                                                      • C:\Users\Admin\Desktop\hnaorh.exe
                                                                        "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                        1⤵
                                                                          PID:1436
                                                                        • C:\Users\Admin\Desktop\hnaorh.exe
                                                                          "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                          1⤵
                                                                            PID:3700
                                                                          • C:\Users\Admin\Desktop\hnaorh.exe
                                                                            "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                            1⤵
                                                                              PID:1988
                                                                            • C:\Users\Admin\Desktop\hnaorh.exe
                                                                              "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                              1⤵
                                                                                PID:4600
                                                                              • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                1⤵
                                                                                  PID:3956
                                                                                • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                  "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                  1⤵
                                                                                    PID:688
                                                                                  • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                    "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                    1⤵
                                                                                      PID:1304
                                                                                    • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                      "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                      1⤵
                                                                                        PID:1480
                                                                                      • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                        "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                        1⤵
                                                                                          PID:432
                                                                                        • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                          "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                          1⤵
                                                                                            PID:5064
                                                                                          • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                            "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                            1⤵
                                                                                              PID:1168
                                                                                            • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                              "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                              1⤵
                                                                                                PID:1068
                                                                                              • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                1⤵
                                                                                                  PID:3764
                                                                                                • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                  "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                  1⤵
                                                                                                    PID:1240
                                                                                                  • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                    "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                    1⤵
                                                                                                      PID:1844
                                                                                                    • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                      "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                      1⤵
                                                                                                        PID:4644
                                                                                                      • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                        "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                        1⤵
                                                                                                          PID:1864
                                                                                                        • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                          "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                          1⤵
                                                                                                            PID:4360
                                                                                                          • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                            "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                            1⤵
                                                                                                              PID:2328
                                                                                                            • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                              "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                              1⤵
                                                                                                                PID:5076
                                                                                                              • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                1⤵
                                                                                                                  PID:3080
                                                                                                                • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                  "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                  1⤵
                                                                                                                    PID:3712
                                                                                                                  • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                    "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                    1⤵
                                                                                                                      PID:3636
                                                                                                                    • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                      "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                      1⤵
                                                                                                                        PID:2156
                                                                                                                      • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                        "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                        1⤵
                                                                                                                          PID:4732
                                                                                                                        • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                          "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                          1⤵
                                                                                                                            PID:5068
                                                                                                                          • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                            "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                            1⤵
                                                                                                                              PID:4916
                                                                                                                            • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                              "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                              1⤵
                                                                                                                                PID:3840
                                                                                                                              • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                1⤵
                                                                                                                                  PID:1064
                                                                                                                                • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                  "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                  1⤵
                                                                                                                                    PID:3516
                                                                                                                                  • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                    "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                    1⤵
                                                                                                                                      PID:3392
                                                                                                                                    • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                      "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                      1⤵
                                                                                                                                        PID:3340
                                                                                                                                      • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                        "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                        1⤵
                                                                                                                                          PID:4928
                                                                                                                                        • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                          "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                          1⤵
                                                                                                                                            PID:3644
                                                                                                                                          • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                            "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                            1⤵
                                                                                                                                              PID:4792
                                                                                                                                            • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                              "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                              1⤵
                                                                                                                                                PID:4384
                                                                                                                                              • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                1⤵
                                                                                                                                                  PID:2148
                                                                                                                                                • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                  "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                  1⤵
                                                                                                                                                    PID:4540
                                                                                                                                                  • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                    "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                    1⤵
                                                                                                                                                      PID:1092
                                                                                                                                                    • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                      "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                      1⤵
                                                                                                                                                        PID:1304
                                                                                                                                                      • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                        "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                        1⤵
                                                                                                                                                          PID:4604
                                                                                                                                                        • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                          "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                          1⤵
                                                                                                                                                            PID:4904
                                                                                                                                                          • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                            "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                            1⤵
                                                                                                                                                              PID:1148
                                                                                                                                                            • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                              "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                              1⤵
                                                                                                                                                                PID:4460
                                                                                                                                                              • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:2164
                                                                                                                                                                • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                  "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                  1⤵
                                                                                                                                                                    PID:1844
                                                                                                                                                                  • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                    "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                    1⤵
                                                                                                                                                                      PID:4644
                                                                                                                                                                    • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                      "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                      1⤵
                                                                                                                                                                        PID:3592
                                                                                                                                                                      • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                        "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                        1⤵
                                                                                                                                                                          PID:4360
                                                                                                                                                                        • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                          "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                          1⤵
                                                                                                                                                                            PID:2328
                                                                                                                                                                          • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                            "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                            1⤵
                                                                                                                                                                              PID:3600
                                                                                                                                                                            • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                              "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                              1⤵
                                                                                                                                                                                PID:768
                                                                                                                                                                              • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                1⤵
                                                                                                                                                                                  PID:2664
                                                                                                                                                                                • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                  "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                  1⤵
                                                                                                                                                                                    PID:4776
                                                                                                                                                                                  • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                    "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                    1⤵
                                                                                                                                                                                      PID:4452
                                                                                                                                                                                    • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                      "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                      1⤵
                                                                                                                                                                                        PID:2904
                                                                                                                                                                                      • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                        "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                        1⤵
                                                                                                                                                                                          PID:1848
                                                                                                                                                                                        • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                          "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                          1⤵
                                                                                                                                                                                            PID:2952
                                                                                                                                                                                          • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                            "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                            1⤵
                                                                                                                                                                                              PID:2972
                                                                                                                                                                                            • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                              "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                              1⤵
                                                                                                                                                                                                PID:4104
                                                                                                                                                                                              • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                1⤵
                                                                                                                                                                                                  PID:4912
                                                                                                                                                                                                • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                  "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                    PID:4584
                                                                                                                                                                                                  • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                    "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                      PID:2336
                                                                                                                                                                                                    • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                      "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                        PID:1988
                                                                                                                                                                                                      • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                        "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                          PID:3644
                                                                                                                                                                                                        • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                          "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                            PID:4384
                                                                                                                                                                                                          • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                            "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                              PID:4112
                                                                                                                                                                                                            • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                              "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                PID:3264
                                                                                                                                                                                                              • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                  PID:1156
                                                                                                                                                                                                                • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                  "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                    PID:2556
                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                    "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                      PID:4604
                                                                                                                                                                                                                    • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                      "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                        PID:2116
                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                        "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                          PID:3952
                                                                                                                                                                                                                        • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                          "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                            PID:1244
                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                            "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                              PID:3156
                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                              "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                PID:4796
                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                  PID:3476
                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                    PID:3488
                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                      PID:5076
                                                                                                                                                                                                                                    • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                        PID:1120
                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                          PID:2664
                                                                                                                                                                                                                                        • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                            PID:384
                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                              PID:408
                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                PID:3976
                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                  PID:3676
                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                    PID:1108
                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                      PID:3472
                                                                                                                                                                                                                                                    • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                        PID:2244
                                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                          PID:4532
                                                                                                                                                                                                                                                        • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                            PID:3136
                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                              PID:2964
                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                PID:4528
                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                  PID:4164
                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                    PID:116
                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                      PID:3552
                                                                                                                                                                                                                                                                    • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                        PID:1864
                                                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                          PID:4068
                                                                                                                                                                                                                                                                        • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                            PID:1012
                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                              PID:3344
                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                PID:2836
                                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                  PID:956
                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                    PID:2460
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                      PID:3640
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                        PID:3112
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                          PID:3264
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                            PID:1092
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                              PID:5028
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                PID:760
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                  PID:1228
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                    PID:4312
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                      PID:4644
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                        PID:3168
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                          PID:4360
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                            PID:3476
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                              PID:3424
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                PID:2284
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                  PID:2664
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                    PID:3240
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                      PID:408
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                        PID:3108
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                          PID:1356
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                            PID:1108
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                              PID:2096
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                PID:2144
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                  PID:1984
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                    PID:3252
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                      PID:4352
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                        PID:4228
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                          PID:1608
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                            PID:2944
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                              PID:4104
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                PID:3392
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                  PID:1172
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                    PID:2480
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                      PID:4384
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                        PID:3056
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                          PID:5104
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                            PID:2128
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                              PID:4904
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                PID:1068
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:2464
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:2116
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:1692
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:3868
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:2288
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:1320
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:3712
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:2284
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:4496
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:1848
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:2192
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:2924
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:2124
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:1452
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:2244
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:5032
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:4632
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:4592
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:3552
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:1908
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:2224
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:4584
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:3876
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:688
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2908
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1304
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:452
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3536
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1168
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1368
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4716
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4312
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4360
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1448
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4776
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4408
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2156
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3840
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3452
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3988
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2096
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2840
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3136
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4256
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4228
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1420
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3000
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1040
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2284
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2156
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3020
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1908
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1488
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3980
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1236
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:688
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2288
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1120
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4688
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2288
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1120
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4416
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\hnaorh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\Desktop\hnaorh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\Xworm-V5.6\Xworm V5.6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\Desktop\Xworm-V5.6\Xworm V5.6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\Xworm-V5.6\XWorm V5.6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\Desktop\Xworm-V5.6\XWorm V5.6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\Xworm-V5.6\XWorm V5.6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\Desktop\Xworm-V5.6\XWorm V5.6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2708

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Network

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Xworm V5.6.exe.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2d2a235f1b0f4b608c5910673735494b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    23a63f6529bfdf917886ab8347092238db0423a0

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    c897436c82fda9abf08b29fe05c42f4e59900116bbaf8bfd5b85ef3c97ab7884

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    10684245497f1a115142d49b85000075eb36f360b59a0501e2f352c9f1d767c447c6c44c53a3fb3699402a15a8017bdbd2edd72d8599fdd4772e9e7cb67f3086

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zE42EB57A8\Xworm-V5.6\Icons\icon (15).ico
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    361KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    e3143e8c70427a56dac73a808cba0c79

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    63556c7ad9e778d5bd9092f834b5cc751e419d16

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    b2f57a23ecc789c1bbf6037ac0825bf98babc7bf0c5d438af5e2767a27a79188

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    74e0f4b55625df86a87b9315e4007be8e05bbecca4346a6ea06ef5b1528acb5a8bb636ef3e599a3820dbddcf69563a0a22e2c1062c965544fd75ec96fd9803fc

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\Xworm-V5.6\GeoIP.dat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8ef41798df108ce9bd41382c9721b1c9

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1e6227635a12039f4d380531b032bf773f0e6de0

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    bc07ff22d4ee0b6fafcc12482ecf2981c172a672194c647cedf9b4d215ad9740

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4c62af04d4a141b94eb3e1b0dbf3669cb53fe9b942072ed7bea6a848d87d8994cff5a5f639ab70f424eb79a4b7adabdde4da6d2f02f995bd8d55db23ce99f01b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\Xworm-V5.6\Guna.UI2.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    bcc0fe2b28edd2da651388f84599059b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    44d7756708aafa08730ca9dbdc01091790940a4f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    c6264665a882e73eb2262a74fea2c29b1921a9af33180126325fb67a851310ef

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3bfc3d27c095dde988f779021d0479c8c1de80a404454813c6cae663e3fe63dc636bffa7de1094e18594c9d608fa7420a0651509544722f2a00288f0b7719cc8

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\Xworm-V5.6\Sounds\Intro.wav
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    238KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ad3b4fae17bcabc254df49f5e76b87a6

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1683ff029eebaffdc7a4827827da7bb361c8747e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    e3e5029bf5f29fa32d2f6cdda35697cd8e6035d5c78615f64d0b305d1bd926cf

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3d6ecc9040b5079402229c214cb5f9354315131a630c43d1da95248edc1b97627fb9ba032d006380a67409619763fb91976295f8d22ca91894c88f38bb610cd3

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\Xworm-V5.6\Xworm V5.6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    14.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    56ccb739926a725e78a7acf9af52c4bb

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5b01b90137871c3c8f0d04f510c4d56b23932cbc

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    90f58865f265722ab007abb25074b3fc4916e927402552c6be17ef9afac96405

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2fee662bc4a1a36ce7328b23f991fa4a383b628839e403d6eb6a9533084b17699a6c939509867a86e803aafef2f9def98fa9305b576dad754aa7f599920c19a1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\Xworm-V5.6\Xworm V5.6.exe.config
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    183B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    66f09a3993dcae94acfe39d45b553f58

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    9d09f8e22d464f7021d7f713269b8169aed98682

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    7ea08548c23bd7fd7c75ca720ac5a0e8ca94cb51d06cd45ebf5f412e4bbdd7d7

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    c8ea53ab187a720080bd8d879704e035f7e632afe1ee93e7637fad6bb7e40d33a5fe7e5c3d69134209487d225e72d8d944a43a28dc32922e946023e89abc93ed

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\a.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    20B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4eb90d3d3d90ff9932d1df441348c2b7

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    a2309149220e29c3b91db601f7b9075975ddec42

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    395d3df46baf82a08f73df3726e17301066e5a2d68a3920b1150bf2bfac14273

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    7aa7d460e16a09936e251f0f84f744e4bf4c8f91b1333d0a22a12eb978a82f58677716c9903c47e5f0e1254ecba2cd6cd9dd2dd7d55f0d788d9f62314cc121b1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\a.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    24B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    61ae0dd1abad69e98ade1f1ca35f565b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    9b0389195890916def6f2f2317624198798abdf3

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    d30f54b356a331760522f8dc809913a4ea7cd16c00bf67670392689108c6dcb5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    c7ffe7f92b3d62c0fe9076f66d3759d0ebf001fce0dd942f054f572dd95e5641226bc179b4a39c647a3f5205c2cba95720aad96f84f618beb2363451f811c6fb

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2144-262-0x0000020800200000-0x00000208003F4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2.0MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2144-260-0x00000207FE2E0000-0x00000207FF1C8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    14.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4236-246-0x0000023308C00000-0x0000023308C01000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4236-250-0x0000023308C00000-0x0000023308C01000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4236-251-0x0000023308C00000-0x0000023308C01000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4236-252-0x0000023308C00000-0x0000023308C01000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4236-253-0x0000023308C00000-0x0000023308C01000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4236-254-0x0000023308C00000-0x0000023308C01000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4236-255-0x0000023308C00000-0x0000023308C01000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4236-256-0x0000023308C00000-0x0000023308C01000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4236-245-0x0000023308C00000-0x0000023308C01000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4236-244-0x0000023308C00000-0x0000023308C01000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download