Trojan.Win32.SwrortProxy_b715786b3b
Trojan.Win32.Iconomon.FD, VirTool.Win32.DelfInject.FD, GenericEmailWorm.YR, TrojanSwrortProxy.YR (Lavasoft MAS)
Behaviour: Trojan, Worm, EmailWorm, VirTool
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Requires JavaScript enabled! |
---|
MD5: b715786b3b3e8e86ab2885effdc2a9c2
SHA1: c0b6e99dcbad64bead8e385931ed9d15664fd331
SHA256: e4d69f917c0ca84cb25a72e1241b1d39b0496da0431ed9fdf546f8045b81d000
SSDeep: 393216:DK7gY3FJXNQUGu1qsaemOFmxxnN3V1GylJtLJxT Bdg:wgyFNp/SemCmNXG2tTeg
Size: 16531128 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPXv0896v102v105v122Delphistub, UPolyXv05_v6
Company: no certificate found
Created at: 2016-05-13 11:03:35
Analyzed on: Windows7 SP1 32-bit
Summary:
Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Payload
Behaviour | Description |
---|---|
EmailWorm | Worm can send e-mails. |
Process activity
The Trojan creates the following process(es):
iobituninstaller.tmp:3956
%original file name%.exe:1828
iobituninstaller.exe:2500
60e55700152b6a96e00148bb935f45e3136bd24c.del:3744
The Trojan injects its code into the following process(es):
Setup.exe:1068
Mutexes
The following mutexes were created/opened:
No objects were found.
File activity
The process Setup.exe:1068 makes changes in the file system.
The Trojan deletes the following file(s):
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Setup.madExcept (0 bytes)
The process iobituninstaller.tmp:3956 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-GHOVR.tmp\RdZone.dll (673 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-GHOVR.tmp\Setup.exe (33248 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-GHOVR.tmp\_isetup\_shfoldr.dll (47 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-GHOVR.tmp\IUInstaller\Setup.exe (33248 bytes)
The process %original file name%.exe:1828 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
C:\ProgramData\COMODOCPSP\cwsguard\CwsGuard32.dll (10 bytes)
C:\ProgramData\COMODOCPSP\cwsguard\CwsGuard64.dll (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarDE50.tmp (2712 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabDE4F.tmp (53 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\wrapped.sandboxed\60e55700152b6a96e00148bb935f45e3136bd24c.del (84360 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D84E548583BE1EE7DB5A935821009D26_5B98B6CD6E69202676965CF5B0E2A7A7 (1552 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D84E548583BE1EE7DB5A935821009D26_5B98B6CD6E69202676965CF5B0E2A7A7 (1 bytes)
C:\ProgramData\COMODOCPSP\cwsguard\GuardConfig.ini (113 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\wrapped.sandboxed\cis_temp_82c7a4.exe (1944 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EA618097E393409AFA316F0F87E2C202_71BF8055C056FCBA449EB93F604FD873 (1 bytes)
C:\ProgramData\COMODOCPSP\cwsguard\NewestGuardConfig.ini (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EA618097E393409AFA316F0F87E2C202_71BF8055C056FCBA449EB93F604FD873 (1496 bytes)
The Trojan deletes the following file(s):
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarDE50.tmp (0 bytes)
C:\ProgramData\COMODOCPSP\cwsguard\NewestGuardConfig.ini (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabDE4F.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\wrapped.sandboxed\cis_temp_82c7a4.exe (0 bytes)
The process iobituninstaller.exe:2500 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-GVCM7.tmp\iobituninstaller.tmp (50 bytes)
The Trojan deletes the following file(s):
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-GVCM7.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-GVCM7.tmp\iobituninstaller.tmp (0 bytes)
The process 60e55700152b6a96e00148bb935f45e3136bd24c.del:3744 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
C:\iobituninstaller.exe (5823 bytes)
C:\%original file name%.exe (2040823 bytes)
The Trojan deletes the following file(s):
C:\%original file name%.exe_82f7d8 (0 bytes)
Registry activity
The process iobituninstaller.tmp:3956 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
"UNCAsIntranet" = "0"
The Trojan deletes the following value(s) in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"
The process %original file name%.exe:1828 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Tracing\b715786b3b3e8e86ab2885effdc2a9c2_RASAPI32]
"MaxFileSize" = "1048576"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
[HKLM\SOFTWARE\Microsoft\Tracing\b715786b3b3e8e86ab2885effdc2a9c2_RASMANCS]
"ConsoleTracingMask" = "4294901760"
[HKLM\SOFTWARE\Microsoft\Tracing\b715786b3b3e8e86ab2885effdc2a9c2_RASAPI32]
"FileDirectory" = "%windir%\tracing"
[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ose00000.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\wrapped.sandboxed\60e55700152b6a96e00148bb935f45e3136bd24c.del,"
[HKLM\SOFTWARE\Microsoft\Tracing\b715786b3b3e8e86ab2885effdc2a9c2_RASMANCS]
"EnableConsoleTracing" = "0"
[HKLM\SOFTWARE\Microsoft\Tracing\b715786b3b3e8e86ab2885effdc2a9c2_RASAPI32]
"EnableFileTracing" = "0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"
[HKLM\SOFTWARE\Microsoft\Tracing\b715786b3b3e8e86ab2885effdc2a9c2_RASMANCS]
"MaxFileSize" = "1048576"
"FileDirectory" = "%windir%\tracing"
[HKLM\SOFTWARE\Microsoft\Tracing\b715786b3b3e8e86ab2885effdc2a9c2_RASAPI32]
"ConsoleTracingMask" = "4294901760"
[HKLM\SOFTWARE\Microsoft\Tracing\b715786b3b3e8e86ab2885effdc2a9c2_RASMANCS]
"EnableFileTracing" = "0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 41 00 00 00 09 00 00 00 00 00 00 00"
[HKLM\SOFTWARE\Microsoft\Tracing\b715786b3b3e8e86ab2885effdc2a9c2_RASMANCS]
"FileTracingMask" = "4294901760"
[HKCU\Software\Classes\Local Settings\MuiCache\66\52C64B7E]
"LanguageList" = "en-US, en"
[HKLM\SOFTWARE\Microsoft\Tracing\b715786b3b3e8e86ab2885effdc2a9c2_RASAPI32]
"EnableConsoleTracing" = "0"
"FileTracingMask" = "4294901760"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"AutoConfigURL"
The process 60e55700152b6a96e00148bb935f45e3136bd24c.del:3744 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Tracing\60e55700152b6a96e00148bb935f45e3136bd24c_RASAPI32]
"EnableConsoleTracing" = "0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
[HKLM\SOFTWARE\Microsoft\Tracing\60e55700152b6a96e00148bb935f45e3136bd24c_RASAPI32]
"FileDirectory" = "%windir%\tracing"
"EnableFileTracing" = "0"
[HKLM\SOFTWARE\Microsoft\Tracing\60e55700152b6a96e00148bb935f45e3136bd24c_RASMANCS]
"ConsoleTracingMask" = "4294901760"
"FileDirectory" = "%windir%\tracing"
[HKLM\SOFTWARE\Microsoft\Tracing\60e55700152b6a96e00148bb935f45e3136bd24c_RASAPI32]
"FileTracingMask" = "4294901760"
"MaxFileSize" = "1048576"
[HKLM\SOFTWARE\Microsoft\Tracing\60e55700152b6a96e00148bb935f45e3136bd24c_RASMANCS]
"MaxFileSize" = "1048576"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 42 00 00 00 09 00 00 00 00 00 00 00"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"
[HKLM\SOFTWARE\Microsoft\Tracing\60e55700152b6a96e00148bb935f45e3136bd24c_RASMANCS]
"FileTracingMask" = "4294901760"
"EnableFileTracing" = "0"
[HKLM\SOFTWARE\Microsoft\Tracing\60e55700152b6a96e00148bb935f45e3136bd24c_RASAPI32]
"ConsoleTracingMask" = "4294901760"
[HKLM\SOFTWARE\Microsoft\Tracing\60e55700152b6a96e00148bb935f45e3136bd24c_RASMANCS]
"EnableConsoleTracing" = "0"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"AutoConfigURL"
Dropped PE files
MD5 | File path |
---|---|
4b3cf9fdaa563a413f2bfbd22f25848f | c:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-GHOVR.tmp\IUInstaller\Setup.exe |
5e21f7b2d3915a7eae80037743b706f4 | c:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-GHOVR.tmp\RdZone.dll |
4b3cf9fdaa563a413f2bfbd22f25848f | c:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-GHOVR.tmp\Setup.exe |
92dc6ef532fbb4a5c3201469a5b5eb63 | c:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-GHOVR.tmp\_isetup\_shfoldr.dll |
01d19141fd51d1a49fd60724a5b57f3b | c:\Users\"%CurrentUserName%"\AppData\Local\Temp\wrapped.sandboxed\60e55700152b6a96e00148bb935f45e3136bd24c.del |
c8bbb86223586d5129de9b7468ca701a | c:\iobituninstaller.exe |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
VersionInfo
Company Name: IObit
Product Name: IObit Uninstaller
Product Version: 7.1.0.19
Legal Copyright: Copyright(c) 2012-2017
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 7.1.0.19
File Description: IObit Uninstaller
Comments: This installation was built with Inno Setup.
Language: German (Germany)
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
UPX0 | 4096 | 1150976 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
UPX1 | 1155072 | 626688 | 626176 | 5.4792 | 6ca062015913ae7a19554d620b92a2f7 |
.rsrc | 1781760 | 32768 | 32768 | 4.12027 | d0678656c42dee4102919c658db4ff1f |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
URLs
URL | IP |
---|---|
hxxp://download.comodo.com/cpsp/cwsguard/GuardConfig.ini | ![]() |
hxxp://download.comodo.com/cpsp/cwsguard/CwsGuard32.dll | ![]() |
hxxp://download.comodo.com/cpsp/cwsguard/CwsGuard64.dll | ![]() |
hxxp://e8218.dscb1.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQe6LNDJdqx+JOp7hVgTeaGFJ/CQgQUljtT8Hkzl699g+8uK8zKt4YecmYCEEVKbNLh5jyp1ULf2rUY/tk= | ![]() |
hxxp://e8218.dscb1.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRi82PVYYKWGJWdgVNyePy5kYTdqQQUX5r1blzMzHSa1N197z/b7EyALt0CEA7P9DjI/r81bgTYapgbGlA= | ![]() |
fls.security.comodo.com | ![]() |
ts-ocsp.ws.symantec.com | ![]() |
sv.symcd.com | ![]() |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRi82PVYYKWGJWdgVNyePy5kYTdqQQUX5r1blzMzHSa1N197z/b7EyALt0CEA7P9DjI/r81bgTYapgbGlA= HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ts-ocsp.ws.symantec.com
HTTP/1.1 200 OK
Server: nginx/1.12.2
Content-Type: application/ocsp-response
Content-Length: 1469
content-transfer-encoding: binary
Cache-Control: max-age=511398, public, no-transform, must-revalidate
Last-Modified: Thu, 8 Feb 2018 10:45:38 GMT
Expires: Thu, 15 Feb 2018 10:45:38 GMT
Date: Fri, 09 Feb 2018 12:43:11 GMT
Connection: keep-alive0..........0..... .....0......0...0..........1.Q....V.......)..2018020
8104538Z0s0q0I0... ........b.c.a......Srx........_..n\..t...}.?..L....
....8...5n..j...P....20180208104538Z....20180215104538Z0...*.H........
.....U.d.6......?tS.-..`.....y..1..D..f~*...$D.}.......2r.!._{.s.4./K.
4M.RX..V...H.. .....R.7.LyR.?d......Q..0c...b...1..7J.....5....R.`.!..
X).........-...Nq}...>.2..~.a.......D.`.^3..n%m....I.H....r.K..K*..
5..R-.....4=...12..>..">.*.P*..I.~.....g5....3......6Q....0...0.
..0..................N.GFs%.#0...*.H........0^1.0...U....US1.0...U....
Symantec Corporation100...U...'Symantec Time Stamping Services CA - G2
0...161213000000Z..211231235959Z0F1D0B..U...;Symantec Time Stamping Se
rvices CA - G2 SHA1 OCSP Responder0.."0...*.H.............0.........E.
<S..<&m*......U....T[.........U*~2...L....SOq...X.9....35..m..z.
.U{.j...i..H....n3.....ii..6*.....|S.f.n....k.....9..o.,_..._..<.1.
z.h.....I.../...sz.$.4..t..Y...9.N....RN..LL.C.G..)..Sl.@^...Y.c.o....
q.5...A/.J .m..a.^.t.5../......a.f.rp...J.B.P.s.............0..0...U..
.....0.0...U.%..0... .......0...U...........0... .....0......0"..U....
0...0.1.0...U....TGV-OFF-690...U..........1.Q....V.......)0...U.#..0..
._..n\..t...}.?..L...0...*.H.............(....J.........FR.}..7/ ..~..
.<.qR.b....7...A.t..z..e{.<q..O..Z.>'8.......0eQ.z.wS.m.....Q
.Yv..M..\..>b.r..k.F$..|.Z...!%...!S^XS....:....A.O1|.....R.i.|.dZ.
..}!#...=..0.V.....,....4...j.../..I.j..r....B......&".....X........=.
K.v...t...#.C..&@.....*tU......<<< skipped >>>
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQe6LNDJdqx+JOp7hVgTeaGFJ/CQgQUljtT8Hkzl699g+8uK8zKt4YecmYCEEVKbNLh5jyp1ULf2rUY/tk= HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: sv.symcd.com
HTTP/1.1 200 OK
Server: nginx/1.12.2
Content-Type: application/ocsp-response
Content-Length: 1610
content-transfer-encoding: binary
Cache-Control: max-age=501189, public, no-transform, must-revalidate
Last-Modified: Thu, 8 Feb 2018 07:55:48 GMT
Expires: Thu, 15 Feb 2018 07:55:48 GMT
Date: Fri, 09 Feb 2018 12:43:05 GMT
Connection: keep-alive0..F......?0..;.. .....0.....,0..(0.......4..fM..8.............2018020
8075548Z0s0q0I0... ...........C%.......`M.....B...;S.y3..}... .....rf.
.EJl...<..B..........20180208075548Z....20180215075548Z0...*.H.....
..........`...._.T.....g:....u!....};(.....r..%...9..~?..U.\..GC..HM..
o........t.#n......._g..;...../B.h).!wi..|.... < k.?...E:...z.<.
7..).u.G....a...v......6.q..U.J....c......5...lXR,..<l..W.uE.l..(..
......of..<t\../.^.].5M...|.l.....3n%}..d$F.u......n.M...w.|../...o
0..k0..g0..O.......)..&.%.....h.r..0...*.H........0.1.0...U....US1.0..
.U....Symantec Corporation1.0...U....Symantec Trust Network100...U...'
Symantec Class 3 SHA256 Code Signing CA0...180204000000Z..180505235959
Z0A1?0=..U...6Symantec Class 3 SHA256 Code Signing CA OCSP Responder0.
."0...*.H.............0.........ip.....T[..z....[.........i5[....4[.aD
......;)...h.,I.....j.t...2./.6ui..#....v.'...).ZP.'~..i-*z..Z.....K..
.?a....m....~..:...!u..>..(.?...M.d.-......b.jm.{..y....^;..l%@....
.....=...b..~n..^.s....n.....-..U.....M?..2....L.4.C5.?d..F...$7h...\.
....kt...}.........0...0... .....0......0!..U....0...0.1.0...U....TGV-
F-5390...U.#..0....;S.y3..}... .....rf0...U.......4..fM..8...........0
...U.......0.0n..U. .g0e0c..`.H...E....0T0&.. .........hXXp://VVV.syma
uth.com/cps0*.. .......0... hXXp://VVV.symauth.com/rpa0...U.%..0... .
......0...U...........0...*.H.............|[N:.iN.r...rr.%...1.:.~`...
..Dr........<...:......E.G=>..k..".'..6z.p....F..e..l L..$...n..
.j3.=.....O....4.../...s~....:...G...zo...R.7...Z.).;. ....f.&....<<< skipped >>>
GET /cpsp/cwsguard/GuardConfig.ini HTTP/1.1
User-Agent: lpszAgent
Host: download.comodo.com
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Server: nginx
Date: Fri, 09 Feb 2018 12:42:55 GMT
Content-Type: text/html
Content-Length: 162
Connection: keep-alive
Keep-Alive: timeout=1<html>..<head><title>404 Not Found</title><
/head>..<body bgcolor="white">..<center><h1>404 N
ot Found</h1></center>..<hr><center>nginx</
center>..</body>..</html>......
GET /cpsp/cwsguard/CwsGuard32.dll HTTP/1.1
User-Agent: lpszAgent
Host: download.comodo.com
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Server: nginx
Date: Fri, 09 Feb 2018 12:42:55 GMT
Content-Type: text/html
Content-Length: 162
Connection: keep-alive
Keep-Alive: timeout=1<html>..<head><title>404 Not Found</title><
/head>..<body bgcolor="white">..<center><h1>404 N
ot Found</h1></center>..<hr><center>nginx</
center>..</body>..</html>......
GET /cpsp/cwsguard/CwsGuard64.dll HTTP/1.1
User-Agent: lpszAgent
Host: download.comodo.com
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Server: nginx
Date: Fri, 09 Feb 2018 12:42:55 GMT
Content-Type: text/html
Content-Length: 162
Connection: keep-alive
Keep-Alive: timeout=1<html>..<head><title>404 Not Found</title><
/head>..<body bgcolor="white">..<center><h1>404 N
ot Found</h1></center>..<hr><center>nginx</
center>..</body>..</html>..HTTP/1.1 404 Not Found..Serv
er: nginx..Date: Fri, 09 Feb 2018 12:42:55 GMT..Content-Type: text/htm
l..Content-Length: 162..Connection: keep-alive..Keep-Alive: timeout=1.
.<html>..<head><title>404 Not Found</title><
;/head>..<body bgcolor="white">..<center><h1>404
Not Found</h1></center>..<hr><center>nginx<
/center>..</body>..</html>....
The Trojan connects to the servers at the folowing location(s):
.text
`.itext
`.data
.idata
.edata
@.tls
.rdata
@.reloc
B.rsrc
Windows
;!199{199
;0!8&2{199
"<;=!!%{199
Windows 95
Windows 95 OSR-2
Windows 98
Windows 98 SE
Windows ME
Windows 9x New
Windows NT 3
Windows NT 4
Windows 2000
Windows XP
Windows 2003
Windows Vista
Windows 2008
Windows 7
Windows 2008 R2
Windows 8
Windows 2012
Windows 8.1
Windows 2012 R2
Windows 10
Windows NT New
user.exe
TMsgHandlers
madToolsMsgHandlerWindow
>0';0974&0{199
cmovÌ
setÌ
pop %seg
push %seg
VVV.madshi.net
dbghelp.dll
4.0.14
advapi32.dll
The import table is invalid.
UhÌ
WindowsLogo
ReportLeaks
UploadViaHttp
HttpServer
HttpSsl
HttpPort
HttpAccount
HttpPassword
BugTrPassword
MailAsSmtpServer
MailAsSmtpClient
SmtpServer
SmtpSsl
SmtpTls
SmtpPort
SmtpAccount
SmtpPassword
bugreport.mbr
screenshot.png
ExceptMsg
FrozenMsg
BitFaultMsg
send bug report
save bug report
print bug report
show bug report
%appname%, %exceptMsg%
bug report
please find the bug report attached
Sending bug report...
PrepAttMsg
MxLookMsg
ConnMsg
SendMailMsg
FieldMsg
SendAttMsg
SendFinalMsg
SendFailMsg
Sorry, sending the bug report didn't work.
TDABugReportCallback
TDABugReportCallbackOO
VVV.google.com
SMTP:
A.ROOT-SERVERS.NET
K.ROOT-SERVERS.NET
VVV.madshi.net_multipart_boundary
TSmtpU
LOGIN
AUTH LOGIN
TWinHttp
/api.xml
<url>
password
?cmd=
/xmlrpc.cgi
Bugzilla.version
Product.get_enterable_products
Product.get
Bug.fields
Bugzilla_login
Bugzilla_password
Bug.create
Bug.add_attachment
/api/soap/mantisconnect.php
<?xml version="1.0" encoding="UTF-8"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="hXXp://schemas.xmlsoap.org/soap/envelope/"><SOAP-ENV:Body><ns1:
</username><password xsi:type="xsd:string">
</password>
*.txt
TSendBugReportExRec
kernel32.dll
user32.dll
coreide120.bpl
FaultRep.dll
internal error. please notify bug@madshi.net
HardWareKey
ENoMonitorSupportException
.uvCOu
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
EVariantBadIndexError
ssShift
htKeyword
EInvalidOperation
EInvalidGraphicOperation
PasswordChar
OnKeyDown
OnKeyPress
OnKeyUp
ssHorizontal
TCustomButton.TButtonStyle
Uh%UK
Proportional
AutoHotkeys
AutoHotkeys$!L
TKeyEvent
TKeyPressEvent
HelpKeyword
ssHotTrack
TWindowState
poProportional
TWMKey
KeyPreview\
WindowState #L
tagMSG
Uh.tP
TMonochromeLookup
comctl32.dll
OnActionExecute,/N
TEnumerator<System.TGUID>
TEnumerator<System.Cardinal>
TEnumerator<System.Single>
TGPArray<TGPRectF>.TEnumerator
TGPArray<TGPRect>.TEnumerator
:TGPArray<System.TGUID>.:1
TGPArray<System.TGUID>
"TGPArray<System.TGUID>.TEnumerator
:TGPArray<System.Cardinal>.:1
TGPArray<System.Cardinal>
%TGPArray<System.Cardinal>.TEnumerator
%TGPArray<IGPPropertyItem>.TEnumerator
:TGPArray<System.Single>.:1
TGPArray<System.Single>
#TGPArray<System.Single>.TEnumerator
TGPArray<IGPRegion>.TEnumeratorGdipAlloc
GdiplusShutdown
GdipSetPenLineJoin
GdipGetPenLineJoin
GdipSetCustomLineCapStrokeJoin
GdipGetCustomLineCapStrokeJoin
GdipSetImageAttributesColorKeys
GdipSetStringFormatHotkeyPrefix
GdipGetStringFormatHotkeyPrefix
EIdCanNotBindPortInRange
EIdInvalidPortRange
TIdSocketListWindows
TIdStackWindowsU
Uh.sW
EIdIPVersionUnsupported
ftpTransfer
ftpReady
ftpAborted
ClientPortMin
ClientPortMax
Port
EIdPortRequired
EIdTCPConnectionError
EIdObjectTypeNotSupported
Portl
"EIdTransparentProxyUDPNotSupported
TIdTCPClientCustom
IdTCPClient
TIdTCPClient
TIdTCPClientl
BoundPortl
%EIdSocksUDPNotSupportedBySOCKSVersion
saUsernamePassword
Password
PortL
BoundPort
DefaultPortL
TIdTCPConnection
TIdTCPConnectiontWX
IdTCPConnection
IdHTTPHeaderInfo
ProxyPasswordl
ProxyPort
sslvrfFailIfNoPeerCert
TPasswordEvent
Certificate
RootCertFile
CertFile
KeyFile
OnGetPassword`
EIdOSSLLoadingRootCertError`
EIdOSSLLoadingCertError
EIdOSSLLoadingKeyError
TIdHTTPOption
IdHTTP
TIdHTTPOptions
TIdHTTPProtocolVersion
IdHTTP0
TIdHTTPOnRedirectEvent
TIdHTTPOnHeadersAvailable
TIdHTTPResponse
TIdHTTPResponseh
TIdHTTPRequest
TIdHTTPRequest,
TIdHTTPProtocol`
TIdCustomHTTP
TIdCustomHTTP`
TIdHTTPd
TIdHTTP
HTTPOptions
EIdHTTPProtocolException
-2147483648
TNTLM_Msg2_Info
EHttpContentCodingExceptiont
THttpContentCoding
THttpCCodIdentity
THttpCCodStar
THttpContCodItem
THttpContCodHandler
TIcsMsgMap
wsoTcpNoDelay
LocalPort
SocksPort
SocksPassword
255.255.255.255
0.0.0.1
EHttpException
THttpRequest
httpABORT
httpGET
httpPOST
httpPUT
httpHEAD
httpCLOSE
OverbyteIcsHttpProt
THttpAuthType
httpAuthNone
httpAuthBasic
httpAuthNtlm
httpAuthDigest
THttpBeforeAuthEvent
THttpRequestDone
THttpCliOption
httpoNoBasicAuth
httpoNoNTLMAuth
httpoBandwidthControl
httpoEnableContentCoding
httpoUseQuality
httpoNoDigestAuth
THttpCliOptions
THttpCli
OverbyteIcsHttpProtD
ProxyPassword
6666666666666666
1.2.3
deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly
inflate 1.2.3 Copyright 1995-2005 Mark Adler
<4,$?7/'
(3-!0,1'8"5.*2$
?456789:;<=
!"#$%&'()* ,-./0123
)4."1-2(
*5/#2.3)
",71@5 &
3'627-"(
1 '-7#&0
1&,#84 .'*
- 8!3(.%
7&-3!),6%
#5*0' 8$2 .
8'.4"*-7& 0#
("2%!&8-3*#
/5,%!)703
(03!,&6)%* 17.'#
$/6 *25#.(8 ',"3
&18",47%0*
'2, / 0&7!4-)1#8
.AUi|
LRap
!$'*-147
"$') -02469;=?
"$&( -/1468:
!$&(*-/135
!#&(*,.1
!"#%&'(* ,-/01345689:;=>?@
!"#$&'(* ,-.01245678:;<>?
!"#$&'() ,-.012346789;<=
"#$%'()*,-./12345789:<
!#$%&()* -./02345689:
!#$%&')* ,./01245679
!"$%&'(* ,-/0123567
!"#%&'(* ,-.012346
!"#$&'() ,-./1234
!"#$%'()*,-./023
!"#$%'()* ,./01
"#$%&()* ,-/0
!#$%&')* ,-.
!"$%&'(* ,-
!"#%&'()*,
!"#$&'()*
!"#$%'()
@43434343
DBv}.Bv
CEw.AEw
oleaut32.dll
RegOpenKeyExW
RegCloseKey
GetKeyboardType
UnhookWindowsHookEx
SetWindowsHookExW
MsgWaitForMultipleObjectsEx
MsgWaitForMultipleObjects
MapVirtualKeyW
LoadKeyboardLayoutW
GetKeyboardState
GetKeyboardLayoutNameW
GetKeyboardLayoutList
GetKeyboardLayout
GetKeyState
GetKeyNameTextW
EnumWindows
EnumThreadWindows
EnumChildWindows
ActivateKeyboardLayout
msimg32.dll
gdi32.dll
SetViewportOrgEx
GetViewportOrgEx
version.dll
GetWindowsDirectoryA
GetWindowsDirectoryW
GetCPInfo
CreatePipe
RegQueryInfoKeyA
RegOpenKeyExA
RegFlushKey
RegEnumKeyA
RegCreateKeyExA
RegCreateKeyExW
wsock32.dll
shell32.dll
ShellExecuteExA
ShellExecuteExW
ShellExecuteA
ShellExecuteW
ole32.dll
comdlg32.dll
winspool.drv
winmm.dll
Kernel32.dll
wtsapi32.dll
Setup.exe
:":*:2:::\:|:
2%4x455>6C6p6
<!<,<;<@<
45j5z5
6)6/676<6<8
1#1'1 1/131
6m6
9 9$9(9,909
$090@0|0
: :$:(:,:0:
<&<.<?<]<
>#>'> >/>3>
=&>0>:>?>
9 9$9(9,9094989<9
4 4$4(4,4044484<4@4
4-4D4f4}4
? ?$?(?,?:?\?|?
5 5$5(5,5054585<5@5
0 0,0:0{0
8 8$8(8,8084888<8@8\8|8
1 1$1(1,10141`1
=!=*=3=<=
3 3$3(3,3034383
:5:=:]:|:
;!;@;_;~;
?#?@?]?|?
<$< <5<:<
> >0>\>`>
3 3$3(3,3034383<3`3
0f0z0
9%9-959=9
4-454X4}4
;!;%;);-;
?!?0?:???
11D1U1Z1n1
8 8$8(8,8084888<8
(0,0004080
VVV.madshi.netq
7jO`%d
RX.yN
.sIIB
h|m.us
hp~%x
:%-%fi
CrtJ
q#u-0}
H%s6:
%u8X,
333333333333333333
33333833
3333339
3333333333333338
:*"*"$3338
3333333
33333333
33333333333
3333333333338
33338?383
333333333333
:*3:"$3338
333333333333333
H%%xa11
KWindows
UrlMon
0OverbyteIcsHttpProt
&OverbyteIcsUrl
OverbyteIcsHttpContCod
'OverbyteIcsNtlmMsgs
IdStackWindows
IdTCPServer
IdCustomTCPServer
0IdHTTPHeaderInfo
Generics.Collections
CGenerics.Defaults
Font.Charset
Font.Color
Font.Height
Font.Name
Font.Style
GlassFrame.Enabled
GlassFrame.Left
GlassFrame.Top
GlassFrame.Right
GlassFrame.Bottom
ImageNormal.Data
iTXtXML:com.adobe.xmp
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:8c911c46-241f-d44e-973a-f05a28e9f8a3" xmpMM:DocumentID="xmp.did:897D47E3259811E7BD14C0B58456A6A4" xmpMM:InstanceID="xmp.iid:897D47E2259811E7BD14C0B58456A6A4" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:84639324-4852-9343-a81c-f2f6b6eaa219" stRef:documentID="adobe:docid:photoshop:e0c40997-1681-11e6-a10a-cf6b968ecd68"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>k{o}
ImageDown.Data
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:8c911c46-241f-d44e-973a-f05a28e9f8a3" xmpMM:DocumentID="xmp.did:96A4EF7C259811E7BD14C0B58456A6A4" xmpMM:InstanceID="xmp.iid:95D6C711259811E7BD14C0B58456A6A4" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:84639324-4852-9343-a81c-f2f6b6eaa219" stRef:documentID="adobe:docid:photoshop:e0c40997-1681-11e6-a10a-cf6b968ecd68"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
ImageOver.Data
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:8c911c46-241f-d44e-973a-f05a28e9f8a3" xmpMM:DocumentID="xmp.did:9092961D259811E7BD14C0B58456A6A4" xmpMM:InstanceID="xmp.iid:9092961C259811E7BD14C0B58456A6A4" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:84639324-4852-9343-a81c-f2f6b6eaa219" stRef:documentID="adobe:docid:photoshop:e0c40997-1681-11e6-a10a-cf6b968ecd68"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
ImageOption.Left
ImageOption.Top
ImageOption.Right
ImageOption.Bottom
SubCaptionFont.Charset
SubCaptionFont.Color
SubCaptionFont.Height
SubCaptionFont.Name
SubCaptionFont.Style
SubCaptionDataFont.Charset
SubCaptionDataFont.Color
SubCaptionDataFont.Height
SubCaptionDataFont.Name
SubCaptionDataFont.Style
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:8c911c46-241f-d44e-973a-f05a28e9f8a3" xmpMM:DocumentID="xmp.did:88288854259811E7BD14C0B58456A6A4" xmpMM:InstanceID="xmp.iid:88288853259811E7BD14C0B58456A6A4" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:84639324-4852-9343-a81c-f2f6b6eaa219" stRef:documentID="adobe:docid:photoshop:e0c40997-1681-11e6-a10a-cf6b968ecd68"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:8c911c46-241f-d44e-973a-f05a28e9f8a3" xmpMM:DocumentID="xmp.did:943B879C259811E7BD14C0B58456A6A4" xmpMM:InstanceID="xmp.iid:943B879B259811E7BD14C0B58456A6A4" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:84639324-4852-9343-a81c-f2f6b6eaa219" stRef:documentID="adobe:docid:photoshop:e0c40997-1681-11e6-a10a-cf6b968ecd68"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:8c911c46-241f-d44e-973a-f05a28e9f8a3" xmpMM:DocumentID="xmp.did:8F2237D7259811E7BD14C0B58456A6A4" xmpMM:InstanceID="xmp.iid:8F2237D6259811E7BD14C0B58456A6A4" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:84639324-4852-9343-a81c-f2f6b6eaa219" stRef:documentID="adobe:docid:photoshop:e0c40997-1681-11e6-a10a-cf6b968ecd68"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>)
ImageDisabled.Data
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:8c911c46-241f-d44e-973a-f05a28e9f8a3" xmpMM:DocumentID="xmp.did:9DEE94EE259811E7BD14C0B58456A6A4" xmpMM:InstanceID="xmp.iid:9D32BC47259811E7BD14C0B58456A6A4" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:84639324-4852-9343-a81c-f2f6b6eaa219" stRef:documentID="adobe:docid:photoshop:e0c40997-1681-11e6-a10a-cf6b968ecd68"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>o`r
Picture.Data
viTXtXML:com.adobe.xmp
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:34363c80-3870-1d45-833a-39df2339997d" xmpMM:DocumentID="xmp.did:8AF2BD946B6411E790EEEA7D47CF1AB2" xmpMM:InstanceID="xmp.iid:8AF2BD936B6411E790EEEA7D47CF1AB2" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:eb6b41fa-f7f8-074e-bcce-fe25c4819dfa" stRef:documentID="xmp.did:34363c80-3870-1d45-833a-39df2339997d"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>P
Constraints.MaxWidth
Constraints.MinWidth
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:34363c80-3870-1d45-833a-39df2339997d" xmpMM:DocumentID="xmp.did:8E4CA37F6B6411E790EEEA7D47CF1AB2" xmpMM:InstanceID="xmp.iid:8E4CA37E6B6411E790EEEA7D47CF1AB2" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:eb6b41fa-f7f8-074e-bcce-fe25c4819dfa" stRef:documentID="xmp.did:34363c80-3870-1d45-833a-39df2339997d"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:34363c80-3870-1d45-833a-39df2339997d" xmpMM:DocumentID="xmp.did:8F1F11C16B6411E790EEEA7D47CF1AB2" xmpMM:InstanceID="xmp.iid:8E4CA3866B6411E790EEEA7D47CF1AB2" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:eb6b41fa-f7f8-074e-bcce-fe25c4819dfa" stRef:documentID="xmp.did:34363c80-3870-1d45-833a-39df2339997d"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>#
LN.nO
LN.nEc
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:34363c80-3870-1d45-833a-39df2339997d" xmpMM:DocumentID="xmp.did:8E4CA3836B6411E790EEEA7D47CF1AB2" xmpMM:InstanceID="xmp.iid:8E4CA3826B6411E790EEEA7D47CF1AB2" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:eb6b41fa-f7f8-074e-bcce-fe25c4819dfa" stRef:documentID="xmp.did:34363c80-3870-1d45-833a-39df2339997d"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>^w0W
KEEE%S
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:34363c80-3870-1d45-833a-39df2339997d" xmpMM:DocumentID="xmp.did:8F1F11C56B6411E790EEEA7D47CF1AB2" xmpMM:InstanceID="xmp.iid:8F1F11C46B6411E790EEEA7D47CF1AB2" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:eb6b41fa-f7f8-074e-bcce-fe25c4819dfa" stRef:documentID="xmp.did:34363c80-3870-1d45-833a-39df2339997d"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>1
_8-55}
Constraints.MaxHeight
Constraints.MinHeight
Lines.Strings
FontHover.Color
ImgBackground.Data
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:34363c80-3870-1d45-833a-39df2339997d" xmpMM:DocumentID="xmp.did:951EF4556B6411E790EEEA7D47CF1AB2" xmpMM:InstanceID="xmp.iid:951EF4546B6411E790EEEA7D47CF1AB2" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:eb6b41fa-f7f8-074e-bcce-fe25c4819dfa" stRef:documentID="xmp.did:34363c80-3870-1d45-833a-39df2339997d"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
ImgBar.Data
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:34363c80-3870-1d45-833a-39df2339997d" xmpMM:DocumentID="xmp.did:951EF4516B6411E790EEEA7D47CF1AB2" xmpMM:InstanceID="xmp.iid:951EF4506B6411E790EEEA7D47CF1AB2" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:eb6b41fa-f7f8-074e-bcce-fe25c4819dfa" stRef:documentID="xmp.did:34363c80-3870-1d45-833a-39df2339997d"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:34363c80-3870-1d45-833a-39df2339997d" xmpMM:DocumentID="xmp.did:93ADABAC6B6411E790EEEA7D47CF1AB2" xmpMM:InstanceID="xmp.iid:93ADABAB6B6411E790EEEA7D47CF1AB2" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:eb6b41fa-f7f8-074e-bcce-fe25c4819dfa" stRef:documentID="xmp.did:34363c80-3870-1d45-833a-39df2339997d"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>o
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:34363c80-3870-1d45-833a-39df2339997d" xmpMM:DocumentID="xmp.did:93ADABB06B6411E790EEEA7D47CF1AB2" xmpMM:InstanceID="xmp.iid:93ADABAF6B6411E790EEEA7D47CF1AB2" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:eb6b41fa-f7f8-074e-bcce-fe25c4819dfa" stRef:documentID="xmp.did:34363c80-3870-1d45-833a-39df2339997d"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>9Cq
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:34363c80-3870-1d45-833a-39df2339997d" xmpMM:DocumentID="xmp.did:A42B2787775011E7A0E2E80C9DD6E7A8" xmpMM:InstanceID="xmp.iid:A42B2786775011E7A0E2E80C9DD6E7A8" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:65969413-198a-a04a-a3c0-141101bb536f" stRef:documentID="xmp.did:34363c80-3870-1d45-833a-39df2339997d"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>-
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:34363c80-3870-1d45-833a-39df2339997d" xmpMM:DocumentID="xmp.did:8AF2BD906B6411E790EEEA7D47CF1AB2" xmpMM:InstanceID="xmp.iid:8AF2BD8F6B6411E790EEEA7D47CF1AB2" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:eb6b41fa-f7f8-074e-bcce-fe25c4819dfa" stRef:documentID="xmp.did:34363c80-3870-1d45-833a-39df2339997d"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
4Still writing down your passwords? <a\>Not safe!</a>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:f9bbd417-8833-684b-ab32-b6cae740bc11" xmpMM:DocumentID="xmp.did:279AE096684211E7AFF9E1610D20AADA" xmpMM:InstanceID="xmp.iid:279AE095684211E7AFF9E1610D20AADA" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:0de57547-5d9a-be40-896c-b6f09310e771" stRef:documentID="adobe:docid:photoshop:98760514-65fc-11e7-b84d-85577357eb5e"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
XDashlane's secure password manager is trusted by <a>over 7 million people</a> worldwide.
CheckBoxNormalImage.Data
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:8c911c46-241f-d44e-973a-f05a28e9f8a3" xmpMM:DocumentID="xmp.did:CB77BE27259811E7BD14C0B58456A6A4" xmpMM:InstanceID="xmp.iid:CB77BE26259811E7BD14C0B58456A6A4" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:84639324-4852-9343-a81c-f2f6b6eaa219" stRef:documentID="adobe:docid:photoshop:e0c40997-1681-11e6-a10a-cf6b968ecd68"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>V
CheckBoxCheckedImage.Data
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:8c911c46-241f-d44e-973a-f05a28e9f8a3" xmpMM:DocumentID="xmp.did:CB77BE23259811E7BD14C0B58456A6A4" xmpMM:InstanceID="xmp.iid:CB77BE22259811E7BD14C0B58456A6A4" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:84639324-4852-9343-a81c-f2f6b6eaa219" stRef:documentID="adobe:docid:photoshop:e0c40997-1681-11e6-a10a-cf6b968ecd68"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:34363c80-3870-1d45-833a-39df2339997d" xmpMM:DocumentID="xmp.did:8D0B45316B6411E790EEEA7D47CF1AB2" xmpMM:InstanceID="xmp.iid:8D0B45306B6411E790EEEA7D47CF1AB2" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:eb6b41fa-f7f8-074e-bcce-fe25c4819dfa" stRef:documentID="xmp.did:34363c80-3870-1d45-833a-39df2339997d"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
.TWUaKv6
?Try Dashlane for <a>FREE</a> and never forget another password!
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:34363c80-3870-1d45-833a-39df2339997d" xmpMM:DocumentID="xmp.did:8BC070D46B6411E790EEEA7D47CF1AB2" xmpMM:InstanceID="xmp.iid:8BC070D36B6411E790EEEA7D47CF1AB2" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:eb6b41fa-f7f8-074e-bcce-fe25c4819dfa" stRef:documentID="xmp.did:34363c80-3870-1d45-833a-39df2339997d"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>5
ImageOption.StretchMode
0Please read the following important information:
ol</a>, <a>Nederlands</a>, <a>Portugu
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:34363c80-3870-1d45-833a-39df2339997d" xmpMM:DocumentID="xmp.did:8BC070D86B6411E790EEEA7D47CF1AB2" xmpMM:InstanceID="xmp.iid:8BC070D76B6411E790EEEA7D47CF1AB2" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:eb6b41fa-f7f8-074e-bcce-fe25c4819dfa" stRef:documentID="xmp.did:34363c80-3870-1d45-833a-39df2339997d"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>n
a validly licensed copy of the operating system for which the product was designed, for your personal use or for the internal business use of your company. You
Product or attempt to do so. Any supplemental code that IObit may provide you in connection with any support services agreed upon between the parties shall
Section 3. Limited Warranty. IObit warrants and represents to you that the Product will substantially conform to and operate in accordance with its
). This Limited Warranty applies only if the nonconformance is reported to IObit during the Warranty Period and if IObit is able to confirm the substantial
PERFORMANCE AND THE IDENTIFICATION OF DEFECTS. You are advised to safeguard important data, to use caution and not to rely in any way on the correct
Section 7. Export Control. The United States controls the export of products and information. You agree to comply with such restrictions and not to export or
re-export the Product to countries or persons prohibited under the export control laws. By downloading the Product, you are agreeing that you are not in a
country where such export is prohibited or are a person or entity to which such export is prohibited. You are responsible for compliance with the laws of your
Llocal jurisdiction regarding the import, export or re-export of the Product.
s online support center (available at
hXXp://VVV.iobit.com/en/onlinefeedback.php) or by calling our customer service department at the toll-free number IObit has provided you. In the event that
asserted, in order to provide an opportunity to resolve the claim informally or through mediation. Go to hXXp://VVV.iobit.com/en/sampleclaim.php for a sample
previously provided to us, if any, and the license code IObit provided to you, if any. The notice must be sent to customercare@iobit.com. If the claim proceeds
notice, you or IObit may submit the claim to JAMS (1-800-352-5267, jamsadr.com), the American Arbitration Association (
) (1-800-778-7879, adr.org), or
Either you or IObit may delay enforcing or not exercise rights under this Arbitration provision, including the right to arbitrate a claim, without waiving the right to
!exercise or enforce those rights.
arbitrated on a class action basis or on bases involving claims brought in a purported representative capacity on behalf of the general public, other licensees or
The arbitrator's authority is limited to claims between you and IObit alone. Claims may not be joined or consolidated unless you and IObit agree in writing. An
Notwithstanding any other provision and without waiving the right to appeal such decision, if any portion of these limitations on Arbitration is deemed invalid or
You may reject this Arbitration provision by sending a rejection notice to IObit at: customercare@iobit.com. Your rejection notice must be sent within 30 days
This Claims Resolution provision will survive termination of this Agreement or your license to use the Product. If any portion of this Claims Resolution provision,
except as otherwise provided in the Limitations on Arbitration provisions above, is deemed invalid or unenforceable, it will not invalidate the remaining portions
Background.Data
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:34363c80-3870-1d45-833a-39df2339997d" xmpMM:DocumentID="xmp.did:8D0B452D6B6411E790EEEA7D47CF1AB2" xmpMM:InstanceID="xmp.iid:8D0B452C6B6411E790EEEA7D47CF1AB2" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:eb6b41fa-f7f8-074e-bcce-fe25c4819dfa" stRef:documentID="xmp.did:34363c80-3870-1d45-833a-39df2339997d"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
VScrollBar.Left
VScrollBar.Top
VScrollBar.Width
VScrollBar.Height
!VScrollBar.AllSkinImage.AutoArrow
VScrollBar.AllSkinImage.AutoHide
$VScrollBar.AllSkinImage.BtnLeft.Data
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:8c911c46-241f-d44e-973a-f05a28e9f8a3" xmpMM:DocumentID="xmp.did:E229AFF28D3C11E6913D9925CB7D5252" xmpMM:InstanceID="xmp.iid:E229AFF18D3C11E6913D9925CB7D5252" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:6e8ab110-c728-5e4e-b217-426629398fc5" stRef:documentID="adobe:docid:photoshop:3ffa737d-8481-11e6-ab27-bd2c3e838873"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
'VScrollBar.AllSkinImage.BtnLeftHot.Data
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:8c911c46-241f-d44e-973a-f05a28e9f8a3" xmpMM:DocumentID="xmp.did:E229AFF68D3C11E6913D9925CB7D5252" xmpMM:InstanceID="xmp.iid:E229AFF58D3C11E6913D9925CB7D5252" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:6e8ab110-c728-5e4e-b217-426629398fc5" stRef:documentID="adobe:docid:photoshop:3ffa737d-8481-11e6-ab27-bd2c3e838873"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>13
%VScrollBar.AllSkinImage.BtnRight.Data
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:8c911c46-241f-d44e-973a-f05a28e9f8a3" xmpMM:DocumentID="xmp.did:E2F6C6F88D3C11E6913D9925CB7D5252" xmpMM:InstanceID="xmp.iid:E2F6C6F78D3C11E6913D9925CB7D5252" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:6e8ab110-c728-5e4e-b217-426629398fc5" stRef:documentID="adobe:docid:photoshop:3ffa737d-8481-11e6-ab27-bd2c3e838873"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
(VScrollBar.AllSkinImage.BtnRightHot.Data
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:8c911c46-241f-d44e-973a-f05a28e9f8a3" xmpMM:DocumentID="xmp.did:E2F6C6FC8D3C11E6913D9925CB7D5252" xmpMM:InstanceID="xmp.iid:E2F6C6FB8D3C11E6913D9925CB7D5252" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:6e8ab110-c728-5e4e-b217-426629398fc5" stRef:documentID="adobe:docid:photoshop:3ffa737d-8481-11e6-ab27-bd2c3e838873"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
%VScrollBar.AllSkinImage.ScrollBg.Data
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:8c911c46-241f-d44e-973a-f05a28e9f8a3" xmpMM:DocumentID="xmp.did:EA1A887E86E511E6B17AE0289C35ED36" xmpMM:InstanceID="xmp.iid:E983EBA386E511E6B17AE0289C35ED36" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:0882f286-d57e-7940-8902-83d4a5ffc826" stRef:documentID="adobe:docid:photoshop:3ffa737d-8481-11e6-ab27-bd2c3e838873"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>!
(VScrollBar.AllSkinImage.TrackCenter.Data
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:8c911c46-241f-d44e-973a-f05a28e9f8a3" xmpMM:DocumentID="xmp.did:EBDA677E86E511E6B17AE0289C35ED36" xmpMM:InstanceID="xmp.iid:EBDA677D86E511E6B17AE0289C35ED36" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:0882f286-d57e-7940-8902-83d4a5ffc826" stRef:documentID="adobe:docid:photoshop:3ffa737d-8481-11e6-ab27-bd2c3e838873"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
VScrollBar.AllSkinImage.TrackCenterHot.Data
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:8c911c46-241f-d44e-973a-f05a28e9f8a3" xmpMM:DocumentID="xmp.did:ECBBF13186E511E6B17AE0289C35ED36" xmpMM:InstanceID="xmp.iid:ECBBF13086E511E6B17AE0289C35ED36" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:0882f286-d57e-7940-8902-83d4a5ffc826" stRef:documentID="adobe:docid:photoshop:3ffa737d-8481-11e6-ab27-bd2c3e838873"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>d
)VScrollBar.AllSkinImage.Track_Option.Left
*VScrollBar.AllSkinImage.Track_Option.Right
VScrollBar.AutoArrow
VScrollBar.AutoHide
VScrollBar.Max
VScrollBar.PageSize
VScrollBar.LargeChange
VScrollBar.Color
VScrollBar.Caption
VScrollBar.Visible
VScrollBar.ParentColor
HScrollBar.Left
HScrollBar.Top
HScrollBar.Width
HScrollBar.Height
HScrollBar.Kind
sbHorizontal!HScrollBar.AllSkinImage.AutoArrow
"HScrollBar.AllSkinImage.AllowArrow
HScrollBar.AllSkinImage.AutoSize
HScrollBar.AllSkinImage.AutoHide
(HScrollBar.AllSkinImage.TrackCenter.Data
HScrollBar.AllSkinImage.TrackCenterHot.Data
)HScrollBar.AllSkinImage.Track_Option.Left
*HScrollBar.AllSkinImage.Track_Option.Right
HScrollBar.AutoArrow
HScrollBar.AllowArrow
HScrollBar.AutoSize
HScrollBar.AutoHide
HScrollBar.Max
HScrollBar.PageSize
HScrollBar.LargeChange
HScrollBar.SmallChange
HScrollBar.Color
HScrollBar.Caption
HScrollBar.Visible
HScrollBar.ParentColor
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:8c911c46-241f-d44e-973a-f05a28e9f8a3" xmpMM:DocumentID="xmp.did:A4805962259811E7BD14C0B58456A6A4" xmpMM:InstanceID="xmp.iid:A4805961259811E7BD14C0B58456A6A4" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:84639324-4852-9343-a81c-f2f6b6eaa219" stRef:documentID="adobe:docid:photoshop:e0c40997-1681-11e6-a10a-cf6b968ecd68"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>ms
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:8c911c46-241f-d44e-973a-f05a28e9f8a3" xmpMM:DocumentID="xmp.did:EE11E93D86E511E6B17AE0289C35ED36" xmpMM:InstanceID="xmp.iid:EE11E93C86E511E6B17AE0289C35ED36" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:0882f286-d57e-7940-8902-83d4a5ffc826" stRef:documentID="adobe:docid:photoshop:3ffa737d-8481-11e6-ab27-bd2c3e838873"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:8c911c46-241f-d44e-973a-f05a28e9f8a3" xmpMM:DocumentID="xmp.did:EEDE3CF086E511E6B17AE0289C35ED36" xmpMM:InstanceID="xmp.iid:EEDE3CEF86E511E6B17AE0289C35ED36" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:0882f286-d57e-7940-8902-83d4a5ffc826" stRef:documentID="adobe:docid:photoshop:3ffa737d-8481-11e6-ab27-bd2c3e838873"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:8c911c46-241f-d44e-973a-f05a28e9f8a3" xmpMM:DocumentID="xmp.did:ABECC996259811E7BD14C0B58456A6A4" xmpMM:InstanceID="xmp.iid:ABECC995259811E7BD14C0B58456A6A4" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:84639324-4852-9343-a81c-f2f6b6eaa219" stRef:documentID="adobe:docid:photoshop:e0c40997-1681-11e6-a10a-cf6b968ecd68"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:8c911c46-241f-d44e-973a-f05a28e9f8a3" xmpMM:DocumentID="xmp.did:B241AB35259811E7BD14C0B58456A6A4" xmpMM:InstanceID="xmp.iid:B241AB34259811E7BD14C0B58456A6A4" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:84639324-4852-9343-a81c-f2f6b6eaa219" stRef:documentID="adobe:docid:photoshop:e0c40997-1681-11e6-a10a-cf6b968ecd68"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:8c911c46-241f-d44e-973a-f05a28e9f8a3" xmpMM:DocumentID="xmp.did:AE9473ED259811E7BD14C0B58456A6A4" xmpMM:InstanceID="xmp.iid:AE9473EC259811E7BD14C0B58456A6A4" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:84639324-4852-9343-a81c-f2f6b6eaa219" stRef:documentID="adobe:docid:photoshop:e0c40997-1681-11e6-a10a-cf6b968ecd68"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>Ej_
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:ebad007e-ba93-cc44-a7fc-ee045be71f51" xmpMM:DocumentID="xmp.did:BA93F274A1BD11E784CD9418B7EDD0AB" xmpMM:InstanceID="xmp.iid:BA93F273A1BD11E784CD9418B7EDD0AB" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:00312640-7e0a-d847-92b5-ace4c340eb70" stRef:documentID="adobe:docid:photoshop:24c6d5b1-66e2-11e7-95c1-90532fd34a58"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>uCl]
.Kp(J