Source: Xworm V5.6.exe |
Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE |
Source: |
Binary string: System.pdbL$0H source: WERB03A.tmp.dmp.4.dr |
Source: |
Binary string: Microsoft.VisualBasic.ni.pdb source: WERB03A.tmp.dmp.4.dr |
Source: |
Binary string: System.Runtime.Remoting.ni.pdbRSDS-L source: WERB03A.tmp.dmp.4.dr |
Source: |
Binary string: System.Xml.ni.pdb source: WERB03A.tmp.dmp.4.dr |
Source: |
Binary string: System.ni.pdbRSDS source: WERB03A.tmp.dmp.4.dr |
Source: |
Binary string: System.Windows.Forms.pdbMZ@ source: WERB03A.tmp.dmp.4.dr |
Source: |
Binary string: System.Core.pdbX source: WERB03A.tmp.dmp.4.dr |
Source: |
Binary string: PC:\Windows\Microsoft.VisualBasic.pdb0 source: Xworm V5.6.exe, 00000000.00000002.1964421526.0000003617300000.00000004.00000010.00020000.00000000.sdmp |
Source: |
Binary string: System.Windows.Forms.ni.pdb source: WERB03A.tmp.dmp.4.dr |
Source: |
Binary string: System.Drawing.ni.pdb source: WERB03A.tmp.dmp.4.dr |
Source: |
Binary string: .pdb- source: Xworm V5.6.exe, 00000000.00000002.1964421526.0000003617300000.00000004.00000010.00020000.00000000.sdmp |
Source: |
Binary string: System.Configuration.ni.pdb source: WERB03A.tmp.dmp.4.dr |
Source: |
Binary string: System.Xml.pdbX source: WERB03A.tmp.dmp.4.dr |
Source: |
Binary string: mscorlib.ni.pdbRSDS7^3l source: WERB03A.tmp.dmp.4.dr |
Source: |
Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WERB03A.tmp.dmp.4.dr |
Source: |
Binary string: System.Runtime.Remoting.pdb source: WERB03A.tmp.dmp.4.dr |
Source: |
Binary string: System.Configuration.pdb source: WERB03A.tmp.dmp.4.dr |
Source: |
Binary string: System.Drawing.ni.pdbRSDS source: WERB03A.tmp.dmp.4.dr |
Source: |
Binary string: System.Xml.pdb source: WERB03A.tmp.dmp.4.dr |
Source: |
Binary string: System.pdb source: WERB03A.tmp.dmp.4.dr |
Source: |
Binary string: System.Runtime.Remoting.ni.pdb source: WERB03A.tmp.dmp.4.dr |
Source: |
Binary string: System.Xml.ni.pdbRSDS# source: WERB03A.tmp.dmp.4.dr |
Source: |
Binary string: \??\C:\Windows\dll\Microsoft.VisualBasic.pdbtACtl source: Xworm V5.6.exe, 00000000.00000002.1972683689.000001B337B00000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: \??\C:\Windows\Microsoft.VisualBasic.pdb source: Xworm V5.6.exe, 00000000.00000002.1972683689.000001B337B00000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb source: Xworm V5.6.exe, 00000000.00000002.1965231552.000001B31B404000.00000004.00000020.00020000.00000000.sdmp, Xworm V5.6.exe, 00000000.00000002.1972683689.000001B337B00000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: System.Core.ni.pdb source: WERB03A.tmp.dmp.4.dr |
Source: |
Binary string: Microsoft.VisualBasic.pdb source: WERB03A.tmp.dmp.4.dr |
Source: |
Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.pdbfig source: Xworm V5.6.exe, 00000000.00000002.1972683689.000001B337B00000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: System.Windows.Forms.pdb source: WERB03A.tmp.dmp.4.dr |
Source: |
Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdbent1n source: Xworm V5.6.exe, 00000000.00000002.1972683689.000001B337B00000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: mscorlib.pdb source: WERB03A.tmp.dmp.4.dr |
Source: |
Binary string: System.Windows.Forms.ni.pdbRSDS source: WERB03A.tmp.dmp.4.dr |
Source: |
Binary string: System.Drawing.pdb source: WERB03A.tmp.dmp.4.dr |
Source: |
Binary string: C:\Windows\Microsoft.VisualBasic.pdbpdbsic.pdbY}W source: Xworm V5.6.exe, 00000000.00000002.1972683689.000001B337B00000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: mscorlib.ni.pdb source: WERB03A.tmp.dmp.4.dr |
Source: |
Binary string: System.Core.pdb source: WERB03A.tmp.dmp.4.dr |
Source: |
Binary string: \??\C:\Windows\dll\Microsoft.VisualBasic.pdbnA source: Xworm V5.6.exe, 00000000.00000002.1972683689.000001B337B00000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdbisualBasic.pdb source: Xworm V5.6.exe, 00000000.00000002.1964421526.0000003617300000.00000004.00000010.00020000.00000000.sdmp |
Source: |
Binary string: System.Configuration.ni.pdbRSDScUN source: WERB03A.tmp.dmp.4.dr |
Source: |
Binary string: symbols\dll\Microsoft.VisualBasic.pdb` source: Xworm V5.6.exe, 00000000.00000002.1964421526.0000003617300000.00000004.00000010.00020000.00000000.sdmp |
Source: |
Binary string: System.ni.pdb source: WERB03A.tmp.dmp.4.dr |
Source: |
Binary string: System.Drawing.pdb) source: WERB03A.tmp.dmp.4.dr |
Source: |
Binary string: System.Core.ni.pdbRSDS source: WERB03A.tmp.dmp.4.dr |
Source: Yara match |
File source: Xworm V5.6.exe, type: SAMPLE |
Source: Xworm V5.6.exe |
String found in binary or memory: http://exmple.com |
Source: Xworm V5.6.exe |
String found in binary or memory: http://ip-api.com/csv/?fields=status |
Source: Xworm V5.6.exe |
String found in binary or memory: http://ip-api.com/line/?fields=hosting |
Source: Xworm V5.6.exe, 00000000.00000002.1966059097.000001B31D0B2000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name |
Source: Amcache.hve.4.dr |
String found in binary or memory: http://upx.sf.net |
Source: Xworm V5.6.exe, 00000000.00000002.1971612501.000001B337142000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0 |
Source: Xworm V5.6.exe, 00000000.00000002.1971612501.000001B337142000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.carterandcone.coml |
Source: Xworm V5.6.exe, 00000000.00000002.1971612501.000001B337142000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.fontbureau.com |
Source: Xworm V5.6.exe, 00000000.00000002.1971612501.000001B337142000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.fontbureau.com/designers |
Source: Xworm V5.6.exe, 00000000.00000002.1971612501.000001B337142000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.fontbureau.com/designers/? |
Source: Xworm V5.6.exe, 00000000.00000002.1971612501.000001B337142000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN |
Source: Xworm V5.6.exe, 00000000.00000002.1971612501.000001B337142000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html |
Source: Xworm V5.6.exe, 00000000.00000002.1971612501.000001B337142000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.fontbureau.com/designers8 |
Source: Xworm V5.6.exe, 00000000.00000002.1971612501.000001B337142000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.fontbureau.com/designers? |
Source: Xworm V5.6.exe, 00000000.00000002.1971612501.000001B337142000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.fontbureau.com/designersG |
Source: Xworm V5.6.exe, 00000000.00000002.1971612501.000001B337142000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.fonts.com |
Source: Xworm V5.6.exe, 00000000.00000002.1971612501.000001B337142000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.founder.com.cn/cn |
Source: Xworm V5.6.exe, 00000000.00000002.1971612501.000001B337142000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.founder.com.cn/cn/bThe |
Source: Xworm V5.6.exe, 00000000.00000002.1971612501.000001B337142000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.founder.com.cn/cn/cThe |
Source: Xworm V5.6.exe, 00000000.00000002.1971612501.000001B337142000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.galapagosdesign.com/DPlease |
Source: Xworm V5.6.exe, 00000000.00000002.1971612501.000001B337142000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm |
Source: Xworm V5.6.exe, 00000000.00000002.1971612501.000001B337142000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.goodfont.co.kr |
Source: Xworm V5.6.exe, 00000000.00000002.1971612501.000001B337142000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.jiyu-kobo.co.jp/ |
Source: Xworm V5.6.exe, 00000000.00000002.1971612501.000001B337142000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.sajatypeworks.com |
Source: Xworm V5.6.exe, 00000000.00000002.1971612501.000001B337142000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.sakkal.com |
Source: Xworm V5.6.exe, 00000000.00000002.1971612501.000001B337142000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.sandoll.co.kr |
Source: Xworm V5.6.exe, 00000000.00000002.1971612501.000001B337142000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.tiro.com |
Source: Xworm V5.6.exe, 00000000.00000002.1971612501.000001B337142000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.typography.netD |
Source: Xworm V5.6.exe, 00000000.00000002.1971612501.000001B337142000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.urwpp.deDPlease |
Source: Xworm V5.6.exe, 00000000.00000002.1971612501.000001B337142000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.zhongyicts.com.cn |
Source: Xworm V5.6.exe |
String found in binary or memory: https://api.telegram.org/bot |
Source: Xworm V5.6.exe |
String found in binary or memory: https://bin.equinox.io/c/bNyj1mQVY4c/ngrok-v3-stable-windows-386.zip |
Source: Xworm V5.6.exe |
String found in binary or memory: https://evilcoder.mysellix.io |
Source: Xworm V5.6.exe |
String found in binary or memory: https://pastebin.com/raw/H3wFXmEi |
Source: Xworm V5.6.exe |
String found in binary or memory: https://t.me/XCoderGroup |
Source: Xworm V5.6.exe |
String found in binary or memory: https://www.google.com/maps/place/)icons8-letter-16.png |
Source: Xworm V5.6.exe, type: SAMPLE |
Matched rule: Detects AsyncRAT Author: ditekSHen |
Source: 00000000.00000000.1746007824.000001B31AB66000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY |
Matched rule: Detects AsyncRAT Author: ditekSHen |
Source: Process Memory Space: Xworm V5.6.exe PID: 6780, type: MEMORYSTR |
Matched rule: Detects AsyncRAT Author: ditekSHen |
Source: Xworm V5.6.exe, SplashScreen.cs |
Long String: Length: 913540 |
Source: C:\Users\user\Desktop\Xworm V5.6.exe |
Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6780 -s 1360 |
Source: Xworm V5.6.exe, 00000000.00000000.1751201148.000001B31B122000.00000002.00000001.01000000.00000003.sdmp |
Binary or memory string: OriginalFilenameXWorm.exe, vs Xworm V5.6.exe |
Source: Xworm V5.6.exe, 00000000.00000000.1746007824.000001B31AB66000.00000002.00000001.01000000.00000003.sdmp |
Binary or memory string: OriginalFilename7z.exe, vs Xworm V5.6.exe |
Source: Xworm V5.6.exe, 00000000.00000000.1746007824.000001B31AB66000.00000002.00000001.01000000.00000003.sdmp |
Binary or memory string: OriginalFilename vs Xworm V5.6.exe |
Source: Xworm V5.6.exe, 00000000.00000000.1746007824.000001B31AB66000.00000002.00000001.01000000.00000003.sdmp |
Binary or memory string: teTEexe dll sysPEVFT2_FONT_TRUETYPEVFT2_FONT_VECTORVFT2_FONT_RASTERVERSIONED_PRINTERINPUTMETHODCOMMSOUNDINSTALLABLESYSTEMNETWORKMOUSEDISPLAYLANGUAGEKEYBOARDPRINTERVFT_STATIC_LIB0x6VFT_VXDVFT_FONTVFT_DRVVFT_DLLVFT_APPVFT_UNKNOWNVOS__WINDOWS32VOS__PM32VOS__PM16VOS__WINDOWS16VOS__BASEVOS_WINCEVOS_NTVOS_OS232VOS_OS216VOS_DOSVOS_UNKNOWNVOS_NT_WINDOWS32VOS_OS232_PM32VOS_OS216_PM16VOS_DOS_WINDOWS32VOS_DOS_WINDOWS16SPECIALBUILDINFOINFERREDPRIVATEBUILDPATCHEDPRERELEASEImage BaseHeap CommitHeap ReserveStack CommitStack ReserveDLL CharacteristicsSubsystemSubsystem VersionImage VersionOS VersionLinker VersionUninitialized Data SizeInitialized Data SizeCode SizeFile AlignmentSection AlignmentImage SizeMANIFESTHTMLANIICONANICURSORVXDPLUGPLAYDLGINCLUDEVERSIONGROUP_ICONGROUP_CURSORMESSAGETABLERCDATAACCELERATORFONTFONTDIRSTRINGDIALOGMENUICONBITMAPCURSORXBOXEFI ROMEFI RuntimeEFI BootWindows CEPosixWindows CUIWindows GUINativeCEEM32RCEFTriCoreMIPS-FPU16MIPS-FPUAlpha-64MIPS-16PPC-FPPPCAM33ARM-NTARM-ThumbSH5SH4SH3ESH3-DSPSH3MIPS-V2MIPS-R10000MIPS-R4000MIPS-R3000I860SharedNotPagedNotCachedDiscardableExtendedRelocationsGPCOMDATRemoveCommentsUninitializedDataInitializedDataCodeNoPadTerminalServerAwareWDMNoBindNoSEHNoIsolationNX-CompatibleIntegrityRelocatedBig-EndianLittle-EndianUniCPUSystemNetRunRemovableRunNoDebugInfoAggressiveWsTrimNoLocalSymsNoLineNumsNoRelocsLargeAddress32-bitDLLExecutableChecksum errorefi[].ico.bmpversion.txtstring.txt.debugVFT2_DRV_FILESUBTYPE FILETYPE FILEOS VS_FF_ | FILEFLAGS FILEFLAGSMASK ProductVersionFileVersionPRODUCTVERSION FILEVERSION .rsrc_1StringFileInfo, TranslationVALUEVarFileInfoBLOCKVS_VERSION_INFOFileVersionFileDescriptionOriginalFilename: _winzip_.rsrcCOFF_SYMBOLSCERTIFICATE vs Xworm V5.6.exe |
Source: Xworm V5.6.exe, 00000000.00000000.1746007824.000001B31AB66000.00000002.00000001.01000000.00000003.sdmp |
Binary or memory string: OriginalFilename7z.dll, vs Xworm V5.6.exe |
Source: Xworm V5.6.exe |
Binary or memory string: OriginalFilename7z.exe, vs Xworm V5.6.exe |
Source: Xworm V5.6.exe |
Binary or memory string: OriginalFilename vs Xworm V5.6.exe |
Source: Xworm V5.6.exe |
Binary or memory string: teTEexe dll sysPEVFT2_FONT_TRUETYPEVFT2_FONT_VECTORVFT2_FONT_RASTERVERSIONED_PRINTERINPUTMETHODCOMMSOUNDINSTALLABLESYSTEMNETWORKMOUSEDISPLAYLANGUAGEKEYBOARDPRINTERVFT_STATIC_LIB0x6VFT_VXDVFT_FONTVFT_DRVVFT_DLLVFT_APPVFT_UNKNOWNVOS__WINDOWS32VOS__PM32VOS__PM16VOS__WINDOWS16VOS__BASEVOS_WINCEVOS_NTVOS_OS232VOS_OS216VOS_DOSVOS_UNKNOWNVOS_NT_WINDOWS32VOS_OS232_PM32VOS_OS216_PM16VOS_DOS_WINDOWS32VOS_DOS_WINDOWS16SPECIALBUILDINFOINFERREDPRIVATEBUILDPATCHEDPRERELEASEImage BaseHeap CommitHeap ReserveStack CommitStack ReserveDLL CharacteristicsSubsystemSubsystem VersionImage VersionOS VersionLinker VersionUninitialized Data SizeInitialized Data SizeCode SizeFile AlignmentSection AlignmentImage SizeMANIFESTHTMLANIICONANICURSORVXDPLUGPLAYDLGINCLUDEVERSIONGROUP_ICONGROUP_CURSORMESSAGETABLERCDATAACCELERATORFONTFONTDIRSTRINGDIALOGMENUICONBITMAPCURSORXBOXEFI ROMEFI RuntimeEFI BootWindows CEPosixWindows CUIWindows GUINativeCEEM32RCEFTriCoreMIPS-FPU16MIPS-FPUAlpha-64MIPS-16PPC-FPPPCAM33ARM-NTARM-ThumbSH5SH4SH3ESH3-DSPSH3MIPS-V2MIPS-R10000MIPS-R4000MIPS-R3000I860SharedNotPagedNotCachedDiscardableExtendedRelocationsGPCOMDATRemoveCommentsUninitializedDataInitializedDataCodeNoPadTerminalServerAwareWDMNoBindNoSEHNoIsolationNX-CompatibleIntegrityRelocatedBig-EndianLittle-EndianUniCPUSystemNetRunRemovableRunNoDebugInfoAggressiveWsTrimNoLocalSymsNoLineNumsNoRelocsLargeAddress32-bitDLLExecutableChecksum errorefi[].ico.bmpversion.txtstring.txt.debugVFT2_DRV_FILESUBTYPE FILETYPE FILEOS VS_FF_ | FILEFLAGS FILEFLAGSMASK ProductVersionFileVersionPRODUCTVERSION FILEVERSION .rsrc_1StringFileInfo, TranslationVALUEVarFileInfoBLOCKVS_VERSION_INFOFileVersionFileDescriptionOriginalFilename: _winzip_.rsrcCOFF_SYMBOLSCERTIFICATE vs Xworm V5.6.exe |
Source: Xworm V5.6.exe |
Binary or memory string: OriginalFilename7z.dll, vs Xworm V5.6.exe |
Source: Xworm V5.6.exe |
Binary or memory string: OriginalFilenameXWorm.exe, vs Xworm V5.6.exe |
Source: Xworm V5.6.exe, type: SAMPLE |
Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT |
Source: 00000000.00000000.1746007824.000001B31AB66000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY |
Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT |
Source: Process Memory Space: Xworm V5.6.exe PID: 6780, type: MEMORYSTR |
Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT |
Source: Xworm V5.6.exe, Helper.cs |
Cryptographic APIs: 'TransformFinalBlock' |
Source: Xworm V5.6.exe, Helper.cs |
Cryptographic APIs: 'TransformFinalBlock' |
Source: Xworm V5.6.exe, ToolsBox.cs |
Cryptographic APIs: 'TransformFinalBlock' |
Source: Xworm V5.6.exe, Builder.cs |
Cryptographic APIs: 'TransformFinalBlock' |
Source: Xworm V5.6.exe, SplashScreen.cs |
Base64 encoded string: 'iVBORw0KGgoAAAANSUhEUgAAB4AAAAQ4CAIAAABnsVYUAAAAAXNSR0IB2cksfwAAAAlwSFlzAAALEwAACxMBAJqcGAAKdAZJREFUeJzsneuS2zjPredGpiMn+X7uN31y5v7vbMtNmwYPC8IiQVt2swo1ldbIEokTwUcS+c/y+U7J4eODkuXjLcjh8/3n8WOV9d8/3l/XP6PEc8JplPz6OEl5XGn/8v4e5NrId9ivtamy8aG168EgscHx4OHzJJUeJZc9RgmXLYXVAyuhbbJ3tXZW7JjJz8/PoMAfb29RFH3S0tHHUqXRTNde4/vKbl4tbomR9bJRPl8LKZrq1N/MvmV8KfZFsto3mDgGTjCxxV49cQ0F+eclqDP59fHRIJXrfwIBfXx5+3OKjuPHr7+fIemdz2HzZ5qmYuLKMtj1COsnQGQWOrf87fUkbPtRjGRu+ZXJf76//fioy8v76yrh3zLKVvWef/735KhBCdFjKzHllZdIP0QyvD1nRxXKP76u8uPzz0kSJb+vktlI5tL1v+c0eDHB8vnOxgvdfjaHOOjqJC/vq8uddRL+r8yEhBR+niXnWwvpt3Q+AXUCe50wRsvfnjMSqX9Zqpkak9o6jncvr6+hsIkxe1YR9vP42/CTn+t/33i7Axtt9jd2ecNeOD9nEirtmIR/pHaR40WSsYEdoTkG50OkhzBMV0Y9p7hDcaHXkMtFmZnO7dePdW85VanbBbQHjcv3she0IzkfLK2c6arwUrWed2p/KT9FKbv+OyST5fU1NjILea98zsrPtR778qIQ/i9ptVAKspf0sR7+gKQczfXxHZZwhtqmp/5Bes7gQz6Ltwu+dZWToDHIq74NRddJUcfVkT7Xf/w4DTpvaJz99+31VKEdP3/+Pa6y/mP9MxysCsqZXv7P1j9wns7f91CMxfp9XfqOZtCn1LRWO29vIVldjxv4STLuXIqu6EuWOrziKoIGhHNkbT9uPErqxtRYJRNQ8jP0Kxy81UBG9QC8LylVN1Z87B/6BqTBZGueDECXhUvsV6VHlYufALTXhI2VWLXkQ9eWHfMCd2cAulRgOanYssv1vvHkTQBdVktPA6DLRKbZ1ymuoeCE61IAeQHoEFkyabTp/14AuuxXyLQsYLUPVDqARhOSCKBPqr4AaC2HDPYfVj/s9en2TABN6+ojTHuuk5YeE5AF2XBh/f9O7aza3QVAG/Xz0ADaHjJKfs4k5P8qDM3emUhyNbAjjOvB+ZByPMc4RfUz1P9gAA3tslXfTgB9n3q+yDwhKcVG7gRAB7+Nj6B0+rzsAEBf0UzTA+YJoH2FBdDx/ACg4/nfEEAreUxvZ1eXzc5ziQWSadb87aEB9DVFFxB5AugBBUeaHx8OQKPAjgczvgl7pF7fnrC8JFYt+dBFtnNvABpNwGCC3rpvvJQOoOUbmgmGfnAAnSW1CaCNADrL7yHjNQCUewHo7COPteW/P08iwzwL+aEAGo1NJYCuvJ5/Q/95FAB9lsQo+ZlSb48CoHv0DGO8x15kQTZaaP+8VzudACUNZMWLNjGiJYDOI31nALraTQVMKPk5EwVAZ7IJoB3t2xCP9TbX3pR3jFNUP0P93wNAK/4wGkCz+Qf197YA2hC5Xv5TzFj3CaCXGjs+4AcbdwTQ0vGyg4TfTgDtKpfXIPJXATYBdAasvxuAxl/kb7ezq8s4vqKksUAyzSZ/2yGAjr+9pugCIjeMd0rwVgP5+wJomSKtxahB7gWgw7/RohmVHqFAnUtwuAY8+uQWvcluuW+8ziaAlgw6VE4TQPsO8Ja29RRJXgBaKiGWAidayuu87OPh4xYAOuvXmmbvCKDjhHxJP/FeVbpcZtprLqqvD3ND/6EBX0c8mtozAXQTgI7zmVi8biw9hIQsyEYL7Z/3aqcToGzznyyiUWGz7A9Al1fQ60klP2fyrQD0UH9OBOl/GIAuT7b4wwTQ7i5BSfn5xXk8ElO5PQDo8i0cWbmVcl8AnWXUCaCrIYmC1C0nC5kAuq0x2cgVc4KlnV1dxvFVrt6pzAehPDiATurG1C5X/Yv4ov0KB281kL8dgEYFkFcwjAbQegsryLjI1LrjTgDtHPBOABo9UWDv++gAmh4AnOIaiqGdiSBwDGR3ABrYUZ84EX4CRPr/OdLfT8tAs4CPBdAwzxQL6QStxq+5w9vl9fxj8B/Wr2g/vBOArmhAXb8SwaMJoCeANl2fnICx12z2H3lBpb6qU+b35Hgys9oZgGarRx3MJRng/ST6OWdJ8zznGzfNhJW2RQ/xrcPZuMgW79o8X7m+/HfzC0Dw+k52YfMPas+jA2jUzrgngaRy65HYyJ0A6HJ1Sj2O7gWg7RlV90+U65BNvfLV3gC0V30r3VtHz7I2M1mq8P8R0c3m+QXM7xruW4abMZ939XdL5NtCL7Y9tFC8ENG6JwB9bXBKA8oxtCU/4+CtBjILo |