Trojan.Win32.Swrort.3.FD, GenericInjector.YR (Lavasoft MAS)Behaviour: Trojan
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 7c542e0abb7e8700e5a0d4f50c941136
SHA1: dbc958d58d7e5bfdbfe1f8fff9b5d296041da49b
SHA256: 23c1558ba4f15f54496801a758daf2f3ee8dac707424cef5a1ab6aa0af8eb161
SSDeep: 12288:Qlv0A4LO7qkVlufsb2 MwzRbINA3VKduYWHJdyfa1L1n93tVXu0uJGXLL:QV0A4aPufsb22b3VOYuaX9dtPh
Size: 724536 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: Catalina Group Ltd.
Created at: 2016-05-26 20:24:07
Analyzed on: WindowsXP SP3 32-bit
Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The Trojan creates the following process(es):
CatalinaUpdate.exe:1196
CatalinaUpdate.exe:1072
CatalinaUpdate.exe:352
citrio_50.0.2661.271_1.exe:328
%original file name%.exe:1108
The Trojan injects its code into the following process(es):
CatalinaUpdate.exe:1628
CatalinaUpdate.exe:424
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process CatalinaUpdate.exe:1072 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\Install\{2FEF2209-C78C-4B55-BBBF-5B577A5DB7CF}\citrio_50.0.2661.271_1.exe (449813 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\Download\{92F8A219-E740-49D5-B785-B962AD819724}\50.0.2661.271\citrio_50.0.2661.271_1.exe (449813 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\Install (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{70EEF915-5846-40C2-8A2A-3236CCECD222}-citrio_50.0.2661.271_1.exe (0 bytes)
The process CatalinaUpdate.exe:424 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_te.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ca.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ru.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_nl.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_fi.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_pl.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_fr.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\psmachine.dll (673 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_uk.dll (26 bytes)
%WinDir%\Tasks\CatalinaGroupUpdateTaskUserS-1-5-21-1844237615-1960408961-1801674531-1003Core.job (948 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_th.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_zh-TW.dll (19 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_vi.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_es-419.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdate.dll (5873 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_fil.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ta.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_tr.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ar.dll (24 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_sk.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_is.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_mr.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_sw.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_es.dll (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_hr.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ja.dll (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_kn.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_en.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_en-GB.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\psuser.dll (673 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_no.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ml.dll (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\CatalinaUpdateHelper.msi (36 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ur.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_am.dll (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_pt-BR.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\CatalinaUpdate.exe (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_bn.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_sv.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_et.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_gu.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_da.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\CatalinaUpdate.exe (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_fa.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ms.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_sr.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_sl.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_hu.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_cs.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_iw.dll (23 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_lt.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ko.dll (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_el.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_hi.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_lv.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_zh-CN.dll (19 bytes)
%WinDir%\Tasks\CatalinaGroupUpdateTaskUserS-1-5-21-1844237615-1960408961-1801674531-1003UA.job (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_de.dll (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_id.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\CatalinaUpdateOnDemand.exe (58 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_pt-PT.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_bg.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\npCatalinaUpdate3.dll (1281 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\CatalinaUpdateBroker.exe (58 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\CatalinaCrashHandler.exe (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ro.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_it.dll (28 bytes)
The process citrio_50.0.2661.271_1.exe:328 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\CR_35172.tmp\CITRIO.PACKED.7Z (443233 bytes)
The process %original file name%.exe:1108 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_sl.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_gu.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUT2.tmp (22433 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_nl.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_te.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_sk.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_el.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ru.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_es-419.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_iw.dll (23 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_no.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_tr.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_sr.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_en-GB.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_da.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ro.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_uk.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_zh-TW.dll (19 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_bn.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ms.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ta.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\CatalinaUpdateBroker.exe (58 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_es.dll (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdate.dll (1990 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_sw.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_de.dll (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_is.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_sv.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_fr.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_en.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_cs.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_mr.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_pt-BR.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_fa.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_kn.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_bg.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_pt-PT.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_id.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_fi.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ja.dll (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\npCatalinaUpdate3.dll (236 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\psuser.dll (161 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ml.dll (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ko.dll (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_th.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ca.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_vi.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_hi.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_zh-CN.dll (19 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_lv.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_hu.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\CatalinaUpdate.exe (130 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ar.dll (24 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_pl.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_hr.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\CatalinaUpdateHelper.msi (36 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_lt.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_et.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_am.dll (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\psmachine.dll (155 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\CatalinaCrashHandler.exe (130 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_it.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_fil.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ur.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\CatalinaUpdateOnDemand.exe (58 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp (0 bytes)
Registry activity
The process CatalinaUpdate.exe:1628 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A3 AE 30 74 75 52 F0 D2 48 88 45 5A 3F 04 41 B2"
[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"usagestats" = "1"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\CatalinaGroup\Update]
"eulaaccepted"
The process CatalinaUpdate.exe:1196 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "39 E6 8D B6 05 15 FF 56 C6 CF D5 2E AE EB C5 33"
[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Integers]
"windows_sp_major_version" = "03 00 00 00 00 00 00 00"
[HKCU\Software\CatalinaGroup\Update\proxy]
"source" = "IE"
[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Integers]
"windows_minor_version" = "01 00 00 00 00 00 00 00"
[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Counts]
"goopdate_main" = "02 00 00 00 00 00 00 00"
[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Integers]
"windows_major_version" = "05 00 00 00 00 00 00 00"
[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Counts]
"goopdate_constructor" = "02 00 00 00 00 00 00 00"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\CatalinaGroup\Update\network\secure]
"sk"
"c"
The process CatalinaUpdate.exe:1072 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "69 7C B9 28 2B 46 ED 96 67 EB 8C 5B 53 35 84 3D"
[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"usagestats" = "1"
"brand" = "GGLS"
"InstallTime" = "1466806569"
"referral" = "1:citrio_website"
"lang" = "en"
[HKCU\Software\CatalinaGroup\Update\proxy]
"source" = "IE"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\CatalinaGroup\Update]
"LastInstallerError"
[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"LastInstallerExtraCode1"
"browser"
"LastInstallerError"
"ap"
"LastInstallerSuccessLaunchCmdLine"
"eulaaccepted"
"experiment_labels"
[HKCU\Software\CatalinaGroup\Update]
"LastInstallerResultUIString"
[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"LastInstallerResult"
"LastInstallerResultUIString"
"tttoken"
[HKCU\Software\CatalinaGroup\Update]
"LastInstallerExtraCode1"
"LastInstallerSuccessLaunchCmdLine"
"LastInstallerResult"
[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"iid"
The process CatalinaUpdate.exe:424 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\MozillaPlugins\@catalinahub.net/CatalinaGroup Update;version=9]
"vendor" = "Catalina Group Ltd."
"ProductName" = "CatalinaGroup Update"
[HKCU\Software\CatalinaGroup\Update\ClientState\{6C598730-F715-407B-A7AE-A8F10D0F8FA7}]
"iid" = "{E8AFF3B0-E0F0-4E23-88FB-2BC4E61DD1B2}"
[HKCU\Software\CatalinaGroup\Update]
"UID" = "{42A822E6-E430-44A0-800A-9D2632BBAFDB}"
[HKCU\Software\Classes\MIME\Database\Content Type\application/x-vnd.catalinahub.oneclickctrl.9]
"CLSID" = "{841F4080-C687-4E9C-BD6E-EB5EECF4FAE6}"
[HKCU\Software\Classes\CatalinaGroup.OneClickCtrl.9\CLSID]
"(Default)" = "{841F4080-C687-4E9C-BD6E-EB5EECF4FAE6}"
[HKCU\Software\Classes\CLSID\{841F4080-C687-4E9C-BD6E-EB5EECF4FAE6}]
"(Default)" = "CatalinaGroup Update Plugin"
[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{71216BD6-4D03-4387-BD01-7FE8D9512541}]
"Policy" = "3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKCU\Software\Classes\MIME\Database\Content Type\application/x-vnd.catalinahub.update3webcontrol.3]
"CLSID" = "{71216BD6-4D03-4387-BD01-7FE8D9512541}"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{841F4080-C687-4E9C-BD6E-EB5EECF4FAE6}]
"AppName" = "CatalinaUpdate.exe"
[HKCU\Software\CatalinaGroup\Update]
"Version" = "1.3.25.223"
[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"usagestats" = "1"
[HKCU\Software\MozillaPlugins\@catalinahub.net/CatalinaGroup Update;version=9]
"Description" = "CatalinaGroup Update"
[HKCU\Software\CatalinaGroup\Update\Clients\{6C598730-F715-407B-A7AE-A8F10D0F8FA7}]
"Name" = "Catalina Update"
[HKCU\Software\CatalinaGroup\Update\ClientState\{6C598730-F715-407B-A7AE-A8F10D0F8FA7}]
"InstallTime" = "1466806504"
[HKCU\Software\Classes\CLSID\{841F4080-C687-4E9C-BD6E-EB5EECF4FAE6}\InprocServer32]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\npCatalinaUpdate3.dll"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Classes\CatalinaGroup.Update3WebControl.3]
"(Default)" = "CatalinaGroup Update Plugin"
[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{841F4080-C687-4E9C-BD6E-EB5EECF4FAE6}]
"Policy" = "3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update]
"CatalinaUpdate.exe" = "CatalinaGroup Update"
[HKCU\Software\Classes\CLSID\{841F4080-C687-4E9C-BD6E-EB5EECF4FAE6}\ProgID]
"(Default)" = "CatalinaGroup.OneClickCtrl.9"
[HKCU\Software\MozillaPlugins\@catalinahub.net/CatalinaGroup Update;version=9]
"Path" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\npCatalinaUpdate3.dll"
[HKCU\Software\Classes\CLSID\{841F4080-C687-4E9C-BD6E-EB5EECF4FAE6}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\MozillaPlugins\@catalinahub.net/CatalinaGroup Update;version=3]
"Description" = "CatalinaGroup Update"
"ProductName" = "CatalinaGroup Update"
[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{841F4080-C687-4E9C-BD6E-EB5EECF4FAE6}]
"AppPath" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update"
[HKCU\Software\MozillaPlugins\@catalinahub.net/CatalinaGroup Update;version=3]
"vendor" = "Catalina Group Ltd."
[HKCU\Software\Classes\CLSID\{71216BD6-4D03-4387-BD01-7FE8D9512541}\InprocServer32]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\npCatalinaUpdate3.dll"
[HKCU\Software\MozillaPlugins\@catalinahub.net/CatalinaGroup Update;version=9]
"Version" = "9"
[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{71216BD6-4D03-4387-BD01-7FE8D9512541}]
"AppPath" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223"
[HKCU\Software\CatalinaGroup\Update\ClientState\{6C598730-F715-407B-A7AE-A8F10D0F8FA7}]
"pv" = "1.3.25.223"
[HKCU\Software\Classes\CatalinaGroup.Update3WebControl.3\CLSID]
"(Default)" = "{71216BD6-4D03-4387-BD01-7FE8D9512541}"
[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{71216BD6-4D03-4387-BD01-7FE8D9512541}]
"AppName" = "CatalinaUpdateOnDemand.exe"
[HKCU\Software\CatalinaGroup\Update]
"Path" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\CatalinaUpdate.exe"
[HKCU\Software\MozillaPlugins\@catalinahub.net/CatalinaGroup Update;version=3]
"Version" = "3"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "17 D0 2A 8C 2A CA F4 0A 71 ED 7E 55 5B 02 F7 03"
[HKCU\Software\Classes\CLSID\{71216BD6-4D03-4387-BD01-7FE8D9512541}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\CatalinaGroup\Update\Clients\{6C598730-F715-407B-A7AE-A8F10D0F8FA7}]
"pv" = "1.3.25.223"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKCU\Software\Classes\CLSID\{71216BD6-4D03-4387-BD01-7FE8D9512541}\ProgID]
"(Default)" = "CatalinaGroup.Update3WebControl.3"
[HKCU\Software\MozillaPlugins\@catalinahub.net/CatalinaGroup Update;version=3]
"Path" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\npCatalinaUpdate3.dll"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Classes\CatalinaGroup.OneClickCtrl.9]
"(Default)" = "CatalinaGroup Update Plugin"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Classes\CLSID\{71216BD6-4D03-4387-BD01-7FE8D9512541}]
"(Default)" = "CatalinaGroup Update Plugin"
[HKCU\Software\CatalinaGroup\Update\ClientState\{6C598730-F715-407B-A7AE-A8F10D0F8FA7}]
"brand" = "GGLS"
To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"CatalinaGroup Update" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\CatalinaUpdate.exe /c"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\CatalinaGroup\Update]
"eulaaccepted"
"ui"
"LastChecked"
[HKCU\Software\CatalinaGroup\Update\ClientState\{6C598730-F715-407B-A7AE-A8F10D0F8FA7}]
"UpdateAvailableSince"
"UpdateAvailableCount"
The process CatalinaUpdate.exe:352 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{13660822-39AC-408C-BA99-702EBEE3EF26}]
"CLSID" = "{13660822-39AC-408C-BA99-702EBEE3EF26}"
[HKCU\Software\Classes\Interface\{A2589E53-1490-4C0A-BFC7-A47B7A88E3D8}]
"(Default)" = "ICatalinaUpdate3WebSecurity"
[HKCU\Software\Classes\CatalinaGroupUpdate.Update3COMClassUser]
"(Default)" = "Update3COMClass"
[HKCU\Software\Classes\Interface\{0E09406F-1420-4BF4-B6EB-F0994674AD68}]
"(Default)" = "IAppBundle"
[HKCU\Software\Classes\Interface\{3EA78C6E-8267-4554-8EC6-8982D5AF539A}]
"(Default)" = "ICoCreateAsyncStatus"
[HKCU\Software\Classes\Interface\{0E09406F-1420-4BF4-B6EB-F0994674AD68}\NumMethods]
"(Default)" = "39"
[HKCU\Software\Classes\CLSID\{F4CBF20B-F634-4095-B64A-2EBCDD9E560E}\InprocServer32]
"ThreadingModel" = "Both"
[HKCU\Software\Classes\Interface\{34F067BE-C79C-4C5F-8E64-622A3CC59055}\ProxyStubClsid32]
"(Default)" = "{793865C6-3633-42FA-B959-055A87BF596A}"
[HKCU\Software\Classes\CLSID\{793865C6-3633-42FA-B959-055A87BF596A}]
"(Default)" = "PSFactoryBuffer"
[HKCU\Software\Classes\CLSID\{13660822-39AC-408C-BA99-702EBEE3EF26}\LocalServer32]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\CatalinaUpdateOnDemand.exe"
[HKCU\Software\Classes\Interface\{23185EAB-61B0-4B70-BE89-589585B91392}\NumMethods]
"(Default)" = "8"
[HKCU\Software\Classes\Interface\{C1D8630A-9D2D-4E0E-A4A1-8AA5CA3FAE57}\ProxyStubClsid32]
"(Default)" = "{793865C6-3633-42FA-B959-055A87BF596A}"
[HKCU\Software\Classes\CLSID\{C8362D5A-4303-4E22-8668-BB10D65B95BD}\VersionIndependentProgID]
"(Default)" = "CatalinaGroupUpdate.OnDemandCOMClassUser"
[HKCU\Software\Classes\CLSID\{2823499B-60F3-4940-8042-2C16D5829A39}\VersionIndependentProgID]
"(Default)" = "CatalinaGroupUpdate.Update3WebUser"
[HKCU\Software\Classes\Interface\{7A1A1D82-1E2B-41B8-9FA3-F40D8DD3EEF0}\ProxyStubClsid32]
"(Default)" = "{793865C6-3633-42FA-B959-055A87BF596A}"
[HKCU\Software\Classes\Interface\{263B5A28-834A-4D1B-AB71-A28E882CC59B}\NumMethods]
"(Default)" = "13"
[HKCU\Software\Classes\CatalinaGroupUpdate.CredentialDialogUser]
"(Default)" = "GoogleUpdate CredentialDialog"
[HKCU\Software\Classes\Interface\{7C9F9415-9947-482C-A62B-24A0BD92B8A7}\NumMethods]
"(Default)" = "4"
[HKCU\Software\Classes\Interface\{A2589E53-1490-4C0A-BFC7-A47B7A88E3D8}\ProxyStubClsid32]
"(Default)" = "{793865C6-3633-42FA-B959-055A87BF596A}"
[HKCU\Software\Classes\Interface\{C1D8630A-9D2D-4E0E-A4A1-8AA5CA3FAE57}]
"(Default)" = "ICredentialDialog"
[HKCU\Software\Classes\Interface\{A1E6F38D-8C9E-4BDA-86A2-1940472A8429}]
"(Default)" = "ICatalinaUpdate"
[HKCU\Software\Classes\Interface\{FFC6ECB2-25E8-40EE-BF37-5AA25CBCBA63}\NumMethods]
"(Default)" = "10"
[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Counts]
"goopdate_main" = "01 00 00 00 00 00 00 00"
[HKCU\Software\Classes\Interface\{D085AC3B-E5CC-40C9-8366-C12ADC489967}\ProxyStubClsid32]
"(Default)" = "{793865C6-3633-42FA-B959-055A87BF596A}"
[HKCU\Software\Classes\Interface\{789E3792-8514-4ED5-90F3-5B525275B953}\ProxyStubClsid32]
"(Default)" = "{793865C6-3633-42FA-B959-055A87BF596A}"
[HKCU\Software\Classes\Interface\{FCD277CC-8D3E-4264-80D3-98E7B05E2E8A}\ProxyStubClsid32]
"(Default)" = "{793865C6-3633-42FA-B959-055A87BF596A}"
[HKCU\Software\Classes\CLSID\{3C564FFE-55F7-43AC-886C-7E9E9091CB2A}]
"(Default)" = "Update3COMClass"
[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Integers]
"windows_sp_major_version" = "03 00 00 00 00 00 00 00"
[HKCU\Software\Classes\CLSID\{73436A91-85A6-4850-A7D0-375C4E369A5A}\ProgID]
"(Default)" = "CatalinaGroupUpdate.CredentialDialogUser.1.0"
[HKCU\Software\Classes\CLSID\{8FDC0C15-3A1A-4B3D-B04F-B725F5699C25}\InprocHandler32]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\psuser.dll"
[HKCU\Software\Classes\CLSID\{13660822-39AC-408C-BA99-702EBEE3EF26}]
"(Default)" = "CatalinaGroup.OneClickProcessLauncher"
[HKCU\Software\Classes\Interface\{263B5A28-834A-4D1B-AB71-A28E882CC59B}\ProxyStubClsid32]
"(Default)" = "{793865C6-3633-42FA-B959-055A87BF596A}"
[HKCU\Software\Classes\CLSID\{C8362D5A-4303-4E22-8668-BB10D65B95BD}]
"(Default)" = "Google Update Legacy On Demand"
[HKCU\Software\Classes\CatalinaGroupUpdate.Update3WebUser\CurVer]
"(Default)" = "CatalinaGroupUpdate.Update3WebUser.1.0"
[HKCU\Software\Classes\Interface\{FCD277CC-8D3E-4264-80D3-98E7B05E2E8A}\NumMethods]
"(Default)" = "10"
[HKCU\Software\Classes\Interface\{CBAC6FCC-819A-443D-98BB-E7A122DCCAE3}\NumMethods]
"(Default)" = "4"
[HKCU\Software\Classes\Interface\{7C9F9415-9947-482C-A62B-24A0BD92B8A7}\ProxyStubClsid32]
"(Default)" = "{793865C6-3633-42FA-B959-055A87BF596A}"
[HKCU\Software\Classes\Interface\{0CD725CD-5650-4F13-91DA-E42FAA9687E8}\ProxyStubClsid32]
"(Default)" = "{793865C6-3633-42FA-B959-055A87BF596A}"
[HKCU\Software\Classes\CatalinaGroupUpdate.Update3WebUser\CLSID]
"(Default)" = "{2823499B-60F3-4940-8042-2C16D5829A39}"
[HKCU\Software\Classes\Interface\{FCD277CC-8D3E-4264-80D3-98E7B05E2E8A}]
"(Default)" = "IAppVersionWeb"
[HKCU\Software\Classes\CLSID\{793865C6-3633-42FA-B959-055A87BF596A}\InProcServer32]
"ThreadingModel" = "Both"
[HKCU\Software\Classes\Interface\{84BA4DAC-82EA-4DC8-BCB0-B69DD6E95670}\ProxyStubClsid32]
"(Default)" = "{793865C6-3633-42FA-B959-055A87BF596A}"
[HKCU\Software\Classes\Interface\{F009E353-D4BD-42FE-994E-F6C315055F9B}\ProxyStubClsid32]
"(Default)" = "{793865C6-3633-42FA-B959-055A87BF596A}"
[HKCU\Software\Classes\CatalinaGroupUpdate.Update3COMClassUser\CurVer]
"(Default)" = "CatalinaGroupUpdate.Update3COMClassUser.1.0"
[HKCU\Software\Classes\CLSID\{73436A91-85A6-4850-A7D0-375C4E369A5A}\VersionIndependentProgID]
"(Default)" = "CatalinaGroupUpdate.CredentialDialogUser"
[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Integers]
"windows_minor_version" = "01 00 00 00 00 00 00 00"
[HKCU\Software\Classes\Interface\{CBAC6FCC-819A-443D-98BB-E7A122DCCAE3}]
"(Default)" = "IOneClickProcessLauncher"
[HKCU\Software\Classes\Interface\{051D14B3-CF0F-4CCA-B8FE-AF9E007ACD43}\NumMethods]
"(Default)" = "4"
[HKCU\Software\Classes\Interface\{051D14B3-CF0F-4CCA-B8FE-AF9E007ACD43}]
"(Default)" = "ICoCreateAsync"
[HKCU\Software\Classes\Interface\{F9F2D675-F172-42F2-A26E-6453B80EA7F1}]
"(Default)" = "ICurrentState"
[HKCU\Software\Classes\CLSID\{3C564FFE-55F7-43AC-886C-7E9E9091CB2A}\ProgID]
"(Default)" = "CatalinaGroupUpdate.Update3COMClassUser.1.0"
[HKCU\Software\Classes\Interface\{789E3792-8514-4ED5-90F3-5B525275B953}]
"(Default)" = "IAppBundleWeb"
[HKCU\Software\Classes\Interface\{D085AC3B-E5CC-40C9-8366-C12ADC489967}]
"(Default)" = "IApp"
[HKCU\Software\Classes\Interface\{A1E6F38D-8C9E-4BDA-86A2-1940472A8429}\NumMethods]
"(Default)" = "5"
[HKCU\Software\Classes\CLSID\{8FDC0C15-3A1A-4B3D-B04F-B725F5699C25}\InprocHandler32]
"ThreadingModel" = "Both"
[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Integers]
"windows_major_version" = "05 00 00 00 00 00 00 00"
[HKCU\Software\Classes\CatalinaGroup.OneClickProcessLauncherUser\CLSID]
"(Default)" = "{13660822-39AC-408C-BA99-702EBEE3EF26}"
[HKCU\Software\Classes\Interface\{A1E6F38D-8C9E-4BDA-86A2-1940472A8429}\ProxyStubClsid32]
"(Default)" = "{793865C6-3633-42FA-B959-055A87BF596A}"
[HKCU\Software\Classes\CatalinaGroupUpdate.CredentialDialogUser\CLSID]
"(Default)" = "{73436A91-85A6-4850-A7D0-375C4E369A5A}"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BB 0F 1C E2 0F 58 24 D2 69 02 69 7E FB B3 AA 1D"
[HKCU\Software\Classes\Interface\{D085AC3B-E5CC-40C9-8366-C12ADC489967}\NumMethods]
"(Default)" = "44"
[HKCU\Software\Classes\CLSID\{13660822-39AC-408C-BA99-702EBEE3EF26}\VersionIndependentProgID]
"(Default)" = "CatalinaGroup.OneClickProcessLauncherUser"
[HKCU\Software\Classes\CatalinaGroupUpdate.Update3WebUser.1.0]
"(Default)" = "GoogleUpdate Update3Web"
[HKCU\Software\Classes\Interface\{C1D8630A-9D2D-4E0E-A4A1-8AA5CA3FAE57}\NumMethods]
"(Default)" = "4"
[HKCU\Software\Classes\Interface\{0CD725CD-5650-4F13-91DA-E42FAA9687E8}\NumMethods]
"(Default)" = "10"
[HKCU\Software\Classes\Interface\{34F067BE-C79C-4C5F-8E64-622A3CC59055}\NumMethods]
"(Default)" = "9"
[HKCU\Software\Classes\Interface\{EC3867B7-B9EF-494E-B42B-BA009D57D90E}\NumMethods]
"(Default)" = "6"
[HKCU\Software\Classes\Interface\{6B6DE56F-09F2-4343-80AD-28E5D6CB78F9}\ProxyStubClsid32]
"(Default)" = "{793865C6-3633-42FA-B959-055A87BF596A}"
[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{13660822-39AC-408C-BA99-702EBEE3EF26}]
"Policy" = "3"
[HKCU\Software\Classes\Interface\{F9F2D675-F172-42F2-A26E-6453B80EA7F1}\ProxyStubClsid32]
"(Default)" = "{793865C6-3633-42FA-B959-055A87BF596A}"
[HKCU\Software\Classes\Interface\{0E09406F-1420-4BF4-B6EB-F0994674AD68}\ProxyStubClsid32]
"(Default)" = "{793865C6-3633-42FA-B959-055A87BF596A}"
[HKCU\Software\Classes\Interface\{6B6DE56F-09F2-4343-80AD-28E5D6CB78F9}\NumMethods]
"(Default)" = "14"
[HKCU\Software\Classes\CLSID\{2823499B-60F3-4940-8042-2C16D5829A39}\ProgID]
"(Default)" = "CatalinaGroupUpdate.Update3WebUser.1.0"
[HKCU\Software\Classes\Interface\{7C9F9415-9947-482C-A62B-24A0BD92B8A7}]
"(Default)" = "ICatalinaUpdateCore"
[HKCU\Software\Classes\Interface\{3EA78C6E-8267-4554-8EC6-8982D5AF539A}\NumMethods]
"(Default)" = "10"
[HKCU\Software\Classes\CLSID\{73436A91-85A6-4850-A7D0-375C4E369A5A}\LocalServer32]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\CatalinaUpdateOnDemand.exe"
[HKCU\Software\Classes\Interface\{051D14B3-CF0F-4CCA-B8FE-AF9E007ACD43}\ProxyStubClsid32]
"(Default)" = "{793865C6-3633-42FA-B959-055A87BF596A}"
[HKCU\Software\Classes\CatalinaGroup.OneClickProcessLauncherUser.1.0]
"(Default)" = "CatalinaGroup.OneClickProcessLauncher"
[HKCU\Software\Classes\CLSID\{2823499B-60F3-4940-8042-2C16D5829A39}]
"(Default)" = "GoogleUpdate Update3Web"
[HKCU\Software\Classes\CLSID\{13660822-39AC-408C-BA99-702EBEE3EF26}\ProgID]
"(Default)" = "CatalinaGroup.OneClickProcessLauncherUser.1.0"
[HKCU\Software\Classes\Interface\{CBAC6FCC-819A-443D-98BB-E7A122DCCAE3}\ProxyStubClsid32]
"(Default)" = "{793865C6-3633-42FA-B959-055A87BF596A}"
[HKCU\Software\Classes\CatalinaGroup.OneClickProcessLauncherUser\CurVer]
"(Default)" = "CatalinaGroup.OneClickProcessLauncherUser.1.0"
[HKCU\Software\Classes\CLSID\{2823499B-60F3-4940-8042-2C16D5829A39}\LocalServer32]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\CatalinaUpdateOnDemand.exe"
[HKCU\Software\Classes\Interface\{FFC6ECB2-25E8-40EE-BF37-5AA25CBCBA63}\ProxyStubClsid32]
"(Default)" = "{793865C6-3633-42FA-B959-055A87BF596A}"
[HKCU\Software\Classes\Interface\{84BA4DAC-82EA-4DC8-BCB0-B69DD6E95670}\NumMethods]
"(Default)" = "10"
[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Counts]
"goopdate_constructor" = "01 00 00 00 00 00 00 00"
[HKCU\Software\Classes\Interface\{FFC6ECB2-25E8-40EE-BF37-5AA25CBCBA63}]
"(Default)" = "ICatalinaUpdate3"
[HKCU\Software\Classes\Interface\{263B5A28-834A-4D1B-AB71-A28E882CC59B}]
"(Default)" = "IJobObserver"
[HKCU\Software\Classes\Interface\{0CD725CD-5650-4F13-91DA-E42FAA9687E8}]
"(Default)" = "IAppVersion"
[HKCU\Software\Classes\CatalinaGroupUpdate.OnDemandCOMClassUser.1.0]
"(Default)" = "Google Update Legacy On Demand"
[HKCU\Software\Classes\Interface\{F009E353-D4BD-42FE-994E-F6C315055F9B}]
"(Default)" = "ICatalinaUpdate3Web"
[HKCU\Software\Classes\Interface\{F009E353-D4BD-42FE-994E-F6C315055F9B}\NumMethods]
"(Default)" = "8"
[HKCU\Software\Classes\Interface\{A2589E53-1490-4C0A-BFC7-A47B7A88E3D8}\NumMethods]
"(Default)" = "4"
[HKCU\Software\Classes\Interface\{23185EAB-61B0-4B70-BE89-589585B91392}\ProxyStubClsid32]
"(Default)" = "{793865C6-3633-42FA-B959-055A87BF596A}"
[HKCU\Software\Classes\Interface\{EC3867B7-B9EF-494E-B42B-BA009D57D90E}\ProxyStubClsid32]
"(Default)" = "{793865C6-3633-42FA-B959-055A87BF596A}"
[HKCU\Software\Classes\CLSID\{3C564FFE-55F7-43AC-886C-7E9E9091CB2A}\VersionIndependentProgID]
"(Default)" = "CatalinaGroupUpdate.Update3COMClassUser"
[HKCU\Software\Classes\CatalinaGroupUpdate.OnDemandCOMClassUser\CLSID]
"(Default)" = "{C8362D5A-4303-4E22-8668-BB10D65B95BD}"
[HKCU\Software\Classes\Interface\{7A1A1D82-1E2B-41B8-9FA3-F40D8DD3EEF0}]
"(Default)" = "IBrowserHttpRequest2"
[HKCU\Software\Classes\CLSID\{F4CBF20B-F634-4095-B64A-2EBCDD9E560E}\InprocServer32]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\psuser.dll"
[HKCU\Software\Classes\CatalinaGroupUpdate.CredentialDialogUser.1.0]
"(Default)" = "GoogleUpdate CredentialDialog"
[HKCU\Software\Classes\CatalinaGroupUpdate.Update3WebUser.1.0\CLSID]
"(Default)" = "{2823499B-60F3-4940-8042-2C16D5829A39}"
[HKCU\Software\Classes\CatalinaGroupUpdate.Update3COMClassUser.1.0]
"(Default)" = "Update3COMClass"
[HKCU\Software\Classes\Interface\{789E3792-8514-4ED5-90F3-5B525275B953}\NumMethods]
"(Default)" = "24"
[HKCU\Software\Classes\Interface\{84BA4DAC-82EA-4DC8-BCB0-B69DD6E95670}]
"(Default)" = "IPackage"
[HKCU\Software\Classes\Interface\{7A1A1D82-1E2B-41B8-9FA3-F40D8DD3EEF0}\NumMethods]
"(Default)" = "4"
[HKCU\Software\Classes\CLSID\{C8362D5A-4303-4E22-8668-BB10D65B95BD}\LocalServer32]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\CatalinaUpdateOnDemand.exe"
[HKCU\Software\Classes\Interface\{3EA78C6E-8267-4554-8EC6-8982D5AF539A}\ProxyStubClsid32]
"(Default)" = "{793865C6-3633-42FA-B959-055A87BF596A}"
[HKCU\Software\Classes\CLSID\{3C564FFE-55F7-43AC-886C-7E9E9091CB2A}\LocalServer32]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\CatalinaUpdate.exe"
[HKCU\Software\Classes\CatalinaGroupUpdate.Update3COMClassUser.1.0\CLSID]
"(Default)" = "{3C564FFE-55F7-43AC-886C-7E9E9091CB2A}"
[HKCU\Software\Classes\Interface\{6B6DE56F-09F2-4343-80AD-28E5D6CB78F9}]
"(Default)" = "IAppWeb"
[HKCU\Software\Classes\CatalinaGroupUpdate.OnDemandCOMClassUser.1.0\CLSID]
"(Default)" = "{C8362D5A-4303-4E22-8668-BB10D65B95BD}"
[HKCU\Software\Classes\CatalinaGroupUpdate.Update3WebUser]
"(Default)" = "GoogleUpdate Update3Web"
[HKCU\Software\Classes\CatalinaGroup.OneClickProcessLauncherUser]
"(Default)" = "CatalinaGroup.OneClickProcessLauncher"
[HKCU\Software\Classes\Interface\{F9F2D675-F172-42F2-A26E-6453B80EA7F1}\NumMethods]
"(Default)" = "24"
[HKCU\Software\Classes\CatalinaGroup.OneClickProcessLauncherUser.1.0\CLSID]
"(Default)" = "{13660822-39AC-408C-BA99-702EBEE3EF26}"
[HKCU\Software\Classes\Interface\{EC3867B7-B9EF-494E-B42B-BA009D57D90E}]
"(Default)" = "IProcessLauncher"
[HKCU\Software\Classes\CLSID\{793865C6-3633-42FA-B959-055A87BF596A}\InProcServer32]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\psuser.dll"
[HKCU\Software\Classes\CatalinaGroupUpdate.OnDemandCOMClassUser\CurVer]
"(Default)" = "CatalinaGroupUpdate.OnDemandCOMClassUser.1.0"
[HKCU\Software\Classes\CLSID\{C8362D5A-4303-4E22-8668-BB10D65B95BD}\ProgID]
"(Default)" = "CatalinaGroupUpdate.OnDemandCOMClassUser.1.0"
[HKCU\Software\Classes\CatalinaGroupUpdate.Update3COMClassUser\CLSID]
"(Default)" = "{3C564FFE-55F7-43AC-886C-7E9E9091CB2A}"
[HKCU\Software\Classes\CatalinaGroupUpdate.CredentialDialogUser\CurVer]
"(Default)" = "CatalinaGroupUpdate.CredentialDialogUser.1.0"
[HKCU\Software\Classes\Interface\{34F067BE-C79C-4C5F-8E64-622A3CC59055}]
"(Default)" = "IProgressWndEvents"
[HKCU\Software\Classes\CatalinaGroupUpdate.OnDemandCOMClassUser]
"(Default)" = "Google Update Legacy On Demand"
[HKCU\Software\Classes\CLSID\{73436A91-85A6-4850-A7D0-375C4E369A5A}]
"(Default)" = "GoogleUpdate CredentialDialog"
[HKCU\Software\Classes\CatalinaGroupUpdate.CredentialDialogUser.1.0\CLSID]
"(Default)" = "{73436A91-85A6-4850-A7D0-375C4E369A5A}"
[HKCU\Software\Classes\Interface\{23185EAB-61B0-4B70-BE89-589585B91392}]
"(Default)" = "IRegistrationUpdateHook"
The Trojan deletes the following registry key(s):
[HKCU\Software\Classes\CLSID\{F4CBF20B-F634-4095-B64A-2EBCDD9E560E}]
[HKCU\Software\Classes\CLSID\{F4CBF20B-F634-4095-B64A-2EBCDD9E560E}\InprocServer32]
[HKCU\Software\Classes\CLSID\{8FDC0C15-3A1A-4B3D-B04F-B725F5699C25}\InprocHandler32]
[HKCU\Software\Classes\CLSID\{8FDC0C15-3A1A-4B3D-B04F-B725F5699C25}]
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\CatalinaGroup\Update\network\secure]
"sk"
"c"
The process citrio_50.0.2661.271_1.exe:328 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"ap" = "-full"
The process %original file name%.exe:1108 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D7 BB E0 17 45 D9 08 C9 9E B3 18 24 16 31 AF F0"
Dropped PE files
MD5 | File path |
---|---|
e804d667fc7abcfc05eb2bc93ee1ac5a | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\CatalinaCrashHandler.exe |
e804d667fc7abcfc05eb2bc93ee1ac5a | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\CatalinaUpdate.exe |
f46d035a3d41f509215a4a6a054d62c5 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\CatalinaUpdateBroker.exe |
ef4bd74a3a1e27f55612d82828b54a66 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\CatalinaUpdateOnDemand.exe |
33e3e0647ecb247ba6c9678c7f3106c4 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdate.dll |
b04ac5b67a28fba2eeda758fa5056090 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_am.dll |
b45b5c8181c06e4a9a8292fcbe461376 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ar.dll |
e15ff28dbc07cd04580dc0165bbab0e5 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_bg.dll |
c3fc447c2d64eb2907f6e85ec3a9613a | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_bn.dll |
0eb04f42603e3aa5b14f1a23a2728b6c | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ca.dll |
9e09a5c6800eb6dca0fce66462eb70ea | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_cs.dll |
edfd46610eb8f4b3b77520e6050632f2 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_da.dll |
456deb466770b29dee0b24d530c3930f | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_de.dll |
21b73e160b86383db9d5e78866d5bd88 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_el.dll |
339b763c56db1adcfacdf3a86983d372 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_en-GB.dll |
6a1ecf71c6382008ed94a70327a398d9 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_en.dll |
a8b1739e56e9e693db3125bd94edd194 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_es-419.dll |
c66cd658d2d8e6d51f91cfa84308cea6 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_es.dll |
3fabec03eb476a2dc75c0159770592ee | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_et.dll |
fbb99671180e8b7e725c5a5631abc65d | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_fa.dll |
78c68553bc5d677ca422b11267bdb73f | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_fi.dll |
5c6a3abf5b6f015f546b2c02d0d551dd | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_fil.dll |
ba43eaf442354846f582c36ea75e09f4 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_fr.dll |
56820a1f1cfa0ecf05846ce16c2465e6 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_gu.dll |
5cba748b78049673cd1280e85c2d4a6c | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_hi.dll |
d96300329afef9234b8bcda7866b4719 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_hr.dll |
14b5952a14c29f6143e9c384ab07ac9f | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_hu.dll |
0080d6d01643fbc2ee7f9f66472022d0 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_id.dll |
3bd2efee1bc372eb4fdddbe9f7060204 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_is.dll |
4aee5c17bdada1bd6701d97d26d64d0d | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_it.dll |
cc3c8586c03eb9d17dfbc39558e83c34 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_iw.dll |
c843df4045c3f08ee066a49680e0d48f | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ja.dll |
ca3e9333d4a2b373134af5e75d04a6b5 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_kn.dll |
4fcf1b3e802523ac6780b7ef0ad7c724 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ko.dll |
1d74d6d8de31416ddda0f063cf9d22f6 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_lt.dll |
003f7d1f302a4d95640d2ccf2d4d7ff9 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_lv.dll |
07f6e52fd0795d8ebbdb58999bc14975 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ml.dll |
8b94ca8e02fca67e0f38ed23cccb92a8 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_mr.dll |
a3ddf76547430568bc82c017cf4a49a3 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ms.dll |
a21c5f36e4fa3cd46fa6941aec2c3114 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_nl.dll |
817c526108ca2567eec893d9ccb3df86 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_no.dll |
01d54c66c7a96de385af06760bdd72f7 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_pl.dll |
0da985a4fce9b14149d405778a584bae | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_pt-BR.dll |
f7c56af0099a65bc657c6959ce4e174c | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_pt-PT.dll |
10499fad163999e1eb296e519ac20333 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ro.dll |
55e4f50693dde59ec338cb4b2fd913ea | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ru.dll |
ed62ffe4abd0c184da4f0149c1a2bce6 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_sk.dll |
d4fb59e9ea349a524ccd82160e4f9deb | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_sl.dll |
6cf2723180bf2d0fb654cb94b44bad1b | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_sr.dll |
9df2715a928e3c9f8dc2c0e9c7d50397 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_sv.dll |
001425320abd233273669f8499caa285 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_sw.dll |
88ad58f66fd84c0de908a693f3ee5671 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ta.dll |
0f91559e4ec85bc73a06ef7551f65a0f | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_te.dll |
c46ef3bf330ad342b3560b85f4d25ce1 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_th.dll |
ce490924d9411fabbc4005586039f6ac | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_tr.dll |
551e6c07882613c111ea79849de82ea5 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_uk.dll |
4d7521c9ae8292a9477f8dd65f9e54ed | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ur.dll |
ca186db47369a2f7f106ab29ebe94f74 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_vi.dll |
05767ca3a5e010d3ea7e1dfb7acab83c | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_zh-CN.dll |
a8b3228adb046f4d4439ff8865587dbf | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_zh-TW.dll |
451b2314970a36e6ba24d7141943dbf8 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\npCatalinaUpdate3.dll |
605941f4b00bd86b67904174c191e787 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\psmachine.dll |
b1d0e4cb304f83f0f4c98d81ec247f3e | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\psuser.dll |
e804d667fc7abcfc05eb2bc93ee1ac5a | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\CatalinaUpdate.exe |
01e811c9ffdda4ea362d5b7c7005789f | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\Download\{92F8A219-E740-49D5-B785-B962AD819724}\50.0.2661.271\citrio_50.0.2661.271_1.exe |
e804d667fc7abcfc05eb2bc93ee1ac5a | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\CatalinaCrashHandler.exe |
e804d667fc7abcfc05eb2bc93ee1ac5a | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\CatalinaUpdate.exe |
f46d035a3d41f509215a4a6a054d62c5 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\CatalinaUpdateBroker.exe |
ef4bd74a3a1e27f55612d82828b54a66 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\CatalinaUpdateOnDemand.exe |
33e3e0647ecb247ba6c9678c7f3106c4 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdate.dll |
b04ac5b67a28fba2eeda758fa5056090 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_am.dll |
b45b5c8181c06e4a9a8292fcbe461376 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_ar.dll |
e15ff28dbc07cd04580dc0165bbab0e5 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_bg.dll |
c3fc447c2d64eb2907f6e85ec3a9613a | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_bn.dll |
0eb04f42603e3aa5b14f1a23a2728b6c | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_ca.dll |
9e09a5c6800eb6dca0fce66462eb70ea | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_cs.dll |
edfd46610eb8f4b3b77520e6050632f2 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_da.dll |
456deb466770b29dee0b24d530c3930f | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_de.dll |
21b73e160b86383db9d5e78866d5bd88 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_el.dll |
339b763c56db1adcfacdf3a86983d372 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_en-GB.dll |
6a1ecf71c6382008ed94a70327a398d9 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_en.dll |
a8b1739e56e9e693db3125bd94edd194 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_es-419.dll |
c66cd658d2d8e6d51f91cfa84308cea6 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_es.dll |
3fabec03eb476a2dc75c0159770592ee | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_et.dll |
fbb99671180e8b7e725c5a5631abc65d | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_fa.dll |
78c68553bc5d677ca422b11267bdb73f | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_fi.dll |
5c6a3abf5b6f015f546b2c02d0d551dd | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_fil.dll |
ba43eaf442354846f582c36ea75e09f4 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_fr.dll |
56820a1f1cfa0ecf05846ce16c2465e6 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_gu.dll |
5cba748b78049673cd1280e85c2d4a6c | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_hi.dll |
d96300329afef9234b8bcda7866b4719 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_hr.dll |
14b5952a14c29f6143e9c384ab07ac9f | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_hu.dll |
0080d6d01643fbc2ee7f9f66472022d0 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_id.dll |
3bd2efee1bc372eb4fdddbe9f7060204 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_is.dll |
4aee5c17bdada1bd6701d97d26d64d0d | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_it.dll |
cc3c8586c03eb9d17dfbc39558e83c34 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_iw.dll |
c843df4045c3f08ee066a49680e0d48f | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_ja.dll |
ca3e9333d4a2b373134af5e75d04a6b5 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_kn.dll |
4fcf1b3e802523ac6780b7ef0ad7c724 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_ko.dll |
1d74d6d8de31416ddda0f063cf9d22f6 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_lt.dll |
003f7d1f302a4d95640d2ccf2d4d7ff9 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_lv.dll |
07f6e52fd0795d8ebbdb58999bc14975 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_ml.dll |
8b94ca8e02fca67e0f38ed23cccb92a8 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_mr.dll |
a3ddf76547430568bc82c017cf4a49a3 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_ms.dll |
a21c5f36e4fa3cd46fa6941aec2c3114 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_nl.dll |
817c526108ca2567eec893d9ccb3df86 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_no.dll |
01d54c66c7a96de385af06760bdd72f7 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_pl.dll |
0da985a4fce9b14149d405778a584bae | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_pt-BR.dll |
f7c56af0099a65bc657c6959ce4e174c | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_pt-PT.dll |
10499fad163999e1eb296e519ac20333 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_ro.dll |
55e4f50693dde59ec338cb4b2fd913ea | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_ru.dll |
ed62ffe4abd0c184da4f0149c1a2bce6 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_sk.dll |
d4fb59e9ea349a524ccd82160e4f9deb | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_sl.dll |
6cf2723180bf2d0fb654cb94b44bad1b | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_sr.dll |
9df2715a928e3c9f8dc2c0e9c7d50397 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_sv.dll |
001425320abd233273669f8499caa285 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_sw.dll |
88ad58f66fd84c0de908a693f3ee5671 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_ta.dll |
0f91559e4ec85bc73a06ef7551f65a0f | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_te.dll |
c46ef3bf330ad342b3560b85f4d25ce1 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_th.dll |
ce490924d9411fabbc4005586039f6ac | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_tr.dll |
551e6c07882613c111ea79849de82ea5 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_uk.dll |
4d7521c9ae8292a9477f8dd65f9e54ed | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_ur.dll |
ca186db47369a2f7f106ab29ebe94f74 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_vi.dll |
05767ca3a5e010d3ea7e1dfb7acab83c | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_zh-CN.dll |
a8b3228adb046f4d4439ff8865587dbf | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_zh-TW.dll |
451b2314970a36e6ba24d7141943dbf8 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\npCatalinaUpdate3.dll |
605941f4b00bd86b67904174c191e787 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\psmachine.dll |
b1d0e4cb304f83f0f4c98d81ec247f3e | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\psuser.dll |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
CatalinaUpdate.exe:1196
CatalinaUpdate.exe:1072
CatalinaUpdate.exe:352
citrio_50.0.2661.271_1.exe:328
%original file name%.exe:1108 - Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\Install\{2FEF2209-C78C-4B55-BBBF-5B577A5DB7CF}\citrio_50.0.2661.271_1.exe (449813 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\Download\{92F8A219-E740-49D5-B785-B962AD819724}\50.0.2661.271\citrio_50.0.2661.271_1.exe (449813 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_te.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ca.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ru.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_nl.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_fi.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_pl.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_fr.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\psmachine.dll (673 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_uk.dll (26 bytes)
%WinDir%\Tasks\CatalinaGroupUpdateTaskUserS-1-5-21-1844237615-1960408961-1801674531-1003Core.job (948 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_th.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_zh-TW.dll (19 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_vi.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_es-419.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdate.dll (5873 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_fil.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ta.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_tr.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ar.dll (24 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_sk.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_is.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_mr.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_sw.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_es.dll (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_hr.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ja.dll (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_kn.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_en.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_en-GB.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\psuser.dll (673 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_no.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ml.dll (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\CatalinaUpdateHelper.msi (36 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ur.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_am.dll (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_pt-BR.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\CatalinaUpdate.exe (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_bn.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_sv.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_et.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_gu.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_da.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\CatalinaUpdate.exe (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_fa.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ms.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_sr.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_sl.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_hu.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_cs.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_iw.dll (23 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_lt.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ko.dll (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_el.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_hi.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_lv.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_zh-CN.dll (19 bytes)
%WinDir%\Tasks\CatalinaGroupUpdateTaskUserS-1-5-21-1844237615-1960408961-1801674531-1003UA.job (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_de.dll (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_id.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\CatalinaUpdateOnDemand.exe (58 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_pt-PT.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_bg.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\npCatalinaUpdate3.dll (1281 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\CatalinaUpdateBroker.exe (58 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\CatalinaCrashHandler.exe (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ro.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_it.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\CR_35172.tmp\CITRIO.PACKED.7Z (443233 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_sl.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_gu.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUT2.tmp (22433 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_nl.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_te.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_sk.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_el.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ru.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_es-419.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_iw.dll (23 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_no.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_tr.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_sr.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_en-GB.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_da.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ro.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_uk.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_zh-TW.dll (19 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_bn.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ms.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ta.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\CatalinaUpdateBroker.exe (58 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_es.dll (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdate.dll (1990 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_sw.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_de.dll (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_is.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_sv.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_fr.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_en.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_cs.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_mr.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_pt-BR.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_fa.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_kn.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_bg.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_pt-PT.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_id.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_fi.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ja.dll (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\npCatalinaUpdate3.dll (236 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\psuser.dll (161 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ml.dll (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ko.dll (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_th.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ca.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_vi.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_hi.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_zh-CN.dll (19 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_lv.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_hu.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\CatalinaUpdate.exe (130 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ar.dll (24 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_pl.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_hr.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\CatalinaUpdateHelper.msi (36 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_lt.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_et.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_am.dll (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\psmachine.dll (155 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\CatalinaCrashHandler.exe (130 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_it.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_fil.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ur.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\CatalinaUpdateOnDemand.exe (58 bytes) - Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"CatalinaGroup Update" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\CatalinaUpdate.exe /c" - Reboot the computer.
Static Analysis
VersionInfo
Company Name: Catalina Group Ltd.
Product Name: CatalinaGroup Update
Product Version: 1.3.25.223
Legal Copyright: Copyright 2013 Catalina Group Ltd.
Legal Trademarks:
Original Filename: CatalinaUpdateSetup.exe
Internal Name: CatalinaGroup Update Setup
File Version: 1.3.25.223
File Description: CatalinaGroup Update Setup
Comments:
Language: English (United States)
Company Name: Catalina Group Ltd.Product Name: CatalinaGroup UpdateProduct Version: 1.3.25.223Legal Copyright: Copyright 2013 Catalina Group Ltd.Legal Trademarks: Original Filename: CatalinaUpdateSetup.exeInternal Name: CatalinaGroup Update SetupFile Version: 1.3.25.223File Description: CatalinaGroup Update SetupComments: Language: English (United States)
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
.text | 4096 | 47535 | 47616 | 4.63635 | 2752a1441fa592610b94de20c1f02a58 |
.rdata | 53248 | 10788 | 11264 | 3.70549 | 5352c340dd892d26a2f208dafa497046 |
.data | 65536 | 6460 | 3584 | 1.72368 | 8e425fbedc6927dfabb8fdfaaf8e8d97 |
.rsrc | 73728 | 651520 | 651776 | 5.29858 | 18e399b6705b04720ed28fe90118c8a6 |
.reloc | 729088 | 5598 | 5632 | 2.64966 | 17957bd86fff892742280f82a0bf537a |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Total found: 28
3c2f29dbac5842ca1a35747628ac2ed0
77911c759cafed5c84f6d819fbaf2069
fee2556c48f72e91e121554e539b09e9
f11489e2c77aaccce5be36cd0f412374
7ea8b386deb153674ae71fbaac54ab76
a2c0406aaba834c74f68561c73936587
f286dd4df05f245669a2369d48418cfe
6e2f2e4552821e74da372e828fded288
d3d0d8a0a4ad6f659968ec9597c5904c
8d07d2af1cacca9b155f9aa57b7785d7
d6e7032cc47d7701b3dc9d7e2b5fd5c3
fdc6075e6b90d49d20adc410eed07268
fad048a52261ed893caba84d3a40025f
c82aec98008a83e1505e59ca14243728
47a7a872690644a8db4aec4424c1593e
47f16121bb7e85ae2624b94c5d9ae4d4
1f3f192bcc3cb6bdddaad57c3c2659af
0602ef8c76f9ac40345b392b13062eca
09e1b9accbe3bc53af1dd8b6c055f3f9
3626022326bfb0f10fca5336e8b96834
adfa089ac6508c4d2baddc86f4ec6893
2a00121697147dd6b26a950569e65577
687ece4bb3ecc5276d27dd1f30fe3900
904b9c4b0cb8a924f98f4b199efdd88b
fb95e4647b9b6c56fc314f0ae1644e35
Network Activity
URLs
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
Map
The Trojan connects to the servers at the folowing location(s):
Strings from Dumps
%original file name%.exe_1108:
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
@.reloc
@.reloc
Please contact the application's support team for more information.
Please contact the application's support team for more information.
- Attempt to initialize the CRT more than once.
- Attempt to initialize the CRT more than once.
- CRT not initialized
- CRT not initialized
- floating point support not loaded
- floating point support not loaded
GetProcessWindowStation
GetProcessWindowStation
USER32.DLL
USER32.DLL
operator
operator
mi_exe_stub.pdb
mi_exe_stub.pdb
GetCPInfo
GetCPInfo
KERNEL32.dll
KERNEL32.dll
SHLWAPI.dll
SHLWAPI.dll
GetProcessHeap
GetProcessHeap
ole32.dll
ole32.dll
USER32.dll
USER32.dll
c:\%original file name%.exe
c:\%original file name%.exe
.eyV}
.eyV}
.Pl_Iy
.Pl_Iy
.YZ9'
.YZ9'
MrsqLa
MrsqLa
cK?%X
cK?%X
9d.os
9d.os
bpCH.Ob
bpCH.Ob
%FYzE
%FYzE
;`-
;`-
úL u
úL u
cMdi
cMdi
[:\%c
[:\%c
&k%sa
&k%sa
%fH`2
%fH`2
.ZB#I
.ZB#I
9IqI.If
9IqI.If
K%U35R
K%U35R
ZO\0:%UO7
ZO\0:%UO7
p7.HV&
p7.HV&
%xDyE
%xDyE
d/y.Sw
d/y.Sw
U%xbqq!GR-
U%xbqq!GR-
a1g.ZI
a1g.ZI
lp.JR^
lp.JR^
Ya.Ev
Ya.Ev
Z9%x;
Z9%x;
.GB|@zr
.GB|@zr
.whDs
.whDs
T;K[uO%F
T;K[uO%F
j'G.Fw
j'G.Fw
].TrJ
].TrJ
Q.rW#
Q.rW#
"B.ia
"B.ia
g!.Uh
g!.Uh
k.lhx
k.lhx
pK.gJ
pK.gJ
:sssh
:sssh
7:
7:
: :%:/:=:}:
: :%:/:=:}:
3'3,30343]3
3'3,30343]3
mscoree.dll
mscoree.dll
KERNEL32.DLL
KERNEL32.DLL
appguid={92F8A219-E740-49D5-B785-B962AD819724}&installerargs=--make-chrome-default
appguid={92F8A219-E740-49D5-B785-B962AD819724}&installerargs=--make-chrome-default
Windows 2000 Service Pack 4
Windows 2000 Service Pack 4
Windows 2000
Windows 2000
lador de %1!s! requereix Windows 2000 amb Service Pack 4 o una versi
lador de %1!s! requereix Windows 2000 amb Service Pack 4 o una versi
m Windows 2000 Service Pack 4 nebo nov
m Windows 2000 Service Pack 4 nebo nov
ver Windows 2000 Service Pack 4 eller bedre.
ver Windows 2000 Service Pack 4 eller bedre.
r den %1!s!-Installer wird Windows 2000 Service Pack 4 oder h
r den %1!s!-Installer wird Windows 2000 Service Pack 4 oder h
Unknown Installer ErrorTInstallation failed. %1!s! Installer requires Windows 2000 Service Pack 4 or better.
Unknown Installer ErrorTInstallation failed. %1!s! Installer requires Windows 2000 Service Pack 4 or better.
Windows 2000 Service Pack 4:n tai uudemman.
Windows 2000 Service Pack 4:n tai uudemman.
cessite Windows
cessite Windows
je Windows 2000 Service Pack 4-et vagy frissebb verzi
je Windows 2000 Service Pack 4-et vagy frissebb verzi
krefst Windows 2000
krefst Windows 2000
Google#Programma di installazione di %1!s!!Errore sconosciuto dell'installertInstallazione non riuscita. Il programma di installazione di %1!s! richiede Windows 2000 Service Pack 4 o superiore.
Google#Programma di installazione di %1!s!!Errore sconosciuto dell'installertInstallazione non riuscita. Il programma di installazione di %1!s! richiede Windows 2000 Service Pack 4 o superiore.
Installatieprogramma van %1!s!'Onbekende fout van installatieprogrammasDe installatie is mislukt. Voor het installatieprogramma van %1!s! is Windows 2000 Service Pack 4 of hoger vereist.
Installatieprogramma van %1!s!'Onbekende fout van installatieprogrammasDe installatie is mislukt. Voor het installatieprogramma van %1!s! is Windows 2000 Service Pack 4 of hoger vereist.
Ukjent installasjonsfeilgInstallasjonen mislyktes. %1!s! installasjonsprogrammet krever Windows 2000 Service Pack 4 eller nyere.
Ukjent installasjonsfeilgInstallasjonen mislyktes. %1!s! installasjonsprogrammet krever Windows 2000 Service Pack 4 eller nyere.
. Instalator %1!s! wymaga systemu Windows 2000 z dodatkiem Service Pack 4 lub nowszego.
. Instalator %1!s! wymaga systemu Windows 2000 z dodatkiem Service Pack 4 lub nowszego.
o. O instalador do %1!s! requer o Windows 2000 Service Pack 4 ou posterior.
o. O instalador do %1!s! requer o Windows 2000 Service Pack 4 ou posterior.
it. %1!s! Programul de instalare are nevoie de Windows 2000 Service Pack 4 sau de o versiune superioar
it. %1!s! Programul de instalare are nevoie de Windows 2000 Service Pack 4 sau de o versiune superioar
ka alata za instalacijulInstalacija nije uspjela. Za instalacijski program %1!s! potreban je Windows 2000 Service Pack 4 ili noviji.
ka alata za instalacijulInstalacija nije uspjela. Za instalacijski program %1!s! potreban je Windows 2000 Service Pack 4 ili noviji.
m Windows 2000 Service Pack 4 alebo nov
m Windows 2000 Service Pack 4 alebo nov
ver Windows 2000 Service Pack 4 eller b
ver Windows 2000 Service Pack 4 eller b
kleyicisi Windows 2000 Hizmet Paketi 4 veya sonras
kleyicisi Windows 2000 Hizmet Paketi 4 veya sonras
Program pemasang %1!s!!Kesalahan Installer Tak DiketahuiePemasangan gagal. Program pemasang %1!s! memerlukan Windows 2000 Service Pack 4 atau yang lebih baik.
Program pemasang %1!s!!Kesalahan Installer Tak DiketahuiePemasangan gagal. Program pemasang %1!s! memerlukan Windows 2000 Service Pack 4 atau yang lebih baik.
na. Za namestitveni program za %1!s! potrebujete Windows 2000 s servisnim paketom SP 4 ali novej
na. Za namestitveni program za %1!s! potrebujete Windows 2000 s servisnim paketom SP 4 ali novej
uab rakendust Windows 2000 hoolduspakett 4 v
uab rakendust Windows 2000 hoolduspakett 4 v
ama Windows
ama Windows
Windows 2000
Windows 2000
u Windows 2000 G
u Windows 2000 G
Pemasang %1!s!#Ralat Pemasang yang Tidak Diketahui]Pemasangan gagal. Pemasang %1!s! memerlukan Windows 2000 Service Pack 4 atau yang lebih baik.
Pemasang %1!s!#Ralat Pemasang yang Tidak Diketahui]Pemasangan gagal. Pemasang %1!s! memerlukan Windows 2000 Service Pack 4 atau yang lebih baik.
Kisakinishi cha %1!s!%Hitilafu ya Kisakinishi Isiyojulikana_Usakinishaji haukufaulu. Kisakinishi cha %1!s! kinahitaji Windows 2000 Service Pack 4 au zaidi.
Kisakinishi cha %1!s!%Hitilafu ya Kisakinishi Isiyojulikana_Usakinishaji haukufaulu. Kisakinishi cha %1!s! kinahitaji Windows 2000 Service Pack 4 au zaidi.
. Windows 2000
. Windows 2000
Installer ng %1!s! Hindi Alam na Error ng InstallerlNabigo ang pag-install. Nangangailangan ang Installer ng %1!s! ng Windows 2000 Service Pack 4 o mas mahusay.
Installer ng %1!s! Hindi Alam na Error ng InstallerlNabigo ang pag-install. Nangangailangan ang Installer ng %1!s! ng Windows 2000 Service Pack 4 o mas mahusay.
n. %1!s! El instalador requiere Windows 2000 Service Pack 4 o superior.
n. %1!s! El instalador requiere Windows 2000 Service Pack 4 o superior.
o %1!s! necessita do Windows 2000 Service Pack 4 ou superior.
o %1!s! necessita do Windows 2000 Service Pack 4 ou superior.
n. %1!s! Installer requiere Windows 2000 Service Pack 4 o versiones posteriores.
n. %1!s! Installer requiere Windows 2000 Service Pack 4 o versiones posteriores.
1.3.25.223
1.3.25.223
CatalinaUpdateSetup.exe
CatalinaUpdateSetup.exe
CatalinaUpdate.exe_424:
.text
.text
`.data
`.data
.text/DE
.text/DE
@.rsrc
@.rsrc
@.reloc
@.reloc
SHELL32.dll
SHELL32.dll
USER32.dll
USER32.dll
SHLWAPI.dll
SHLWAPI.dll
Please contact the application's support team for more information.
Please contact the application's support team for more information.
- Attempt to initialize the CRT more than once.
- Attempt to initialize the CRT more than once.
- CRT not initialized
- CRT not initialized
- floating point support not loaded
- floating point support not loaded
GetProcessWindowStation
GetProcessWindowStation
USER32.DLL
USER32.DLL
operator
operator
CatalinaUpdate_unsigned.pdb
CatalinaUpdate_unsigned.pdb
RegOpenKeyExW
RegOpenKeyExW
ADVAPI32.dll
ADVAPI32.dll
KERNEL32.dll
KERNEL32.dll
ole32.dll
ole32.dll
GetProcessHeap
GetProcessHeap
GetCPInfo
GetCPInfo
GetConsoleOutputCP
GetConsoleOutputCP
name="Microsoft.Windows.Common-Controls"
name="Microsoft.Windows.Common-Controls"
version="6.0.0.0"
version="6.0.0.0"
publicKeyToken="6595b64144ccf1df"
publicKeyToken="6595b64144ccf1df"
###7777_{
###7777_{
###____777
###____777
###````87{
###````87{
2 2$2(2,20242~2
2 2$2(2,20242~2
4 4$4(4,4
4 4$4(4,4
?$?(?,?4?
?$?(?,?4?
> >@>\>`>
> >@>\>`>
? ?@?\?`?
? ?@?\?`?
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\GUM1.tmp\CatalinaUpdate.exe
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\GUM1.tmp\CatalinaUpdate.exe
KERNEL32.DLL
KERNEL32.DLL
mscoree.dll
mscoree.dll
goopdate.dll
goopdate.dll
CatalinaUpdate.exe
CatalinaUpdate.exe
Software\CatalinaGroup\Update\Clients\{6C598730-F715-407B-A7AE-A8F10D0F8FA7}
Software\CatalinaGroup\Update\Clients\{6C598730-F715-407B-A7AE-A8F10D0F8FA7}
1.3.25.223
1.3.25.223
2007-2010
2007-2010
2007-2010
2007-2010
CatalinaUpdate.exe_1628:
.text
.text
`.data
`.data
.text/DE
.text/DE
@.rsrc
@.rsrc
@.reloc
@.reloc
SHELL32.dll
SHELL32.dll
USER32.dll
USER32.dll
SHLWAPI.dll
SHLWAPI.dll
Please contact the application's support team for more information.
Please contact the application's support team for more information.
- Attempt to initialize the CRT more than once.
- Attempt to initialize the CRT more than once.
- CRT not initialized
- CRT not initialized
- floating point support not loaded
- floating point support not loaded
GetProcessWindowStation
GetProcessWindowStation
USER32.DLL
USER32.DLL
operator
operator
CatalinaUpdate_unsigned.pdb
CatalinaUpdate_unsigned.pdb
RegOpenKeyExW
RegOpenKeyExW
ADVAPI32.dll
ADVAPI32.dll
KERNEL32.dll
KERNEL32.dll
ole32.dll
ole32.dll
GetProcessHeap
GetProcessHeap
GetCPInfo
GetCPInfo
GetConsoleOutputCP
GetConsoleOutputCP
name="Microsoft.Windows.Common-Controls"
name="Microsoft.Windows.Common-Controls"
version="6.0.0.0"
version="6.0.0.0"
publicKeyToken="6595b64144ccf1df"
publicKeyToken="6595b64144ccf1df"
###7777_{
###7777_{
###____777
###____777
###````87{
###````87{
2 2$2(2,20242~2
2 2$2(2,20242~2
4 4$4(4,4
4 4$4(4,4
?$?(?,?4?
?$?(?,?4?
> >@>\>`>
> >@>\>`>
? ?@?\?`?
? ?@?\?`?
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\CatalinaUpdate.exe
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\CatalinaUpdate.exe
KERNEL32.DLL
KERNEL32.DLL
mscoree.dll
mscoree.dll
goopdate.dll
goopdate.dll
CatalinaUpdate.exe
CatalinaUpdate.exe
Software\CatalinaGroup\Update\Clients\{6C598730-F715-407B-A7AE-A8F10D0F8FA7}
Software\CatalinaGroup\Update\Clients\{6C598730-F715-407B-A7AE-A8F10D0F8FA7}
1.3.25.223
1.3.25.223
2007-2010
2007-2010
2007-2010
2007-2010
CatalinaUpdate.exe_1072:
.text
.text
`.data
`.data
.text/DE
.text/DE
@.rsrc
@.rsrc
@.reloc
@.reloc
SHELL32.dll
SHELL32.dll
USER32.dll
USER32.dll
SHLWAPI.dll
SHLWAPI.dll
Please contact the application's support team for more information.
Please contact the application's support team for more information.
- Attempt to initialize the CRT more than once.
- Attempt to initialize the CRT more than once.
- CRT not initialized
- CRT not initialized
- floating point support not loaded
- floating point support not loaded
GetProcessWindowStation
GetProcessWindowStation
USER32.DLL
USER32.DLL
operator
operator
CatalinaUpdate_unsigned.pdb
CatalinaUpdate_unsigned.pdb
RegOpenKeyExW
RegOpenKeyExW
ADVAPI32.dll
ADVAPI32.dll
KERNEL32.dll
KERNEL32.dll
ole32.dll
ole32.dll
GetProcessHeap
GetProcessHeap
GetCPInfo
GetCPInfo
GetConsoleOutputCP
GetConsoleOutputCP
name="Microsoft.Windows.Common-Controls"
name="Microsoft.Windows.Common-Controls"
version="6.0.0.0"
version="6.0.0.0"
publicKeyToken="6595b64144ccf1df"
publicKeyToken="6595b64144ccf1df"
###7777_{
###7777_{
###____777
###____777
###````87{
###````87{
2 2$2(2,20242~2
2 2$2(2,20242~2
4 4$4(4,4
4 4$4(4,4
?$?(?,?4?
?$?(?,?4?
> >@>\>`>
> >@>\>`>
? ?@?\?`?
? ?@?\?`?
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\CatalinaUpdate.exe
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\CatalinaUpdate.exe
KERNEL32.DLL
KERNEL32.DLL
mscoree.dll
mscoree.dll
goopdate.dll
goopdate.dll
CatalinaUpdate.exe
CatalinaUpdate.exe
Software\CatalinaGroup\Update\Clients\{6C598730-F715-407B-A7AE-A8F10D0F8FA7}
Software\CatalinaGroup\Update\Clients\{6C598730-F715-407B-A7AE-A8F10D0F8FA7}
1.3.25.223
1.3.25.223
2007-2010
2007-2010
2007-2010
2007-2010
setup.exe_1608:
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
@.reloc
@.reloc
SHA256 block transform for x86, CRYPTOGAMS by
SHA256 block transform for x86, CRYPTOGAMS by
PSSSSSSh
PSSSSSSh
:.texu
:.texu
j.Yf;
j.Yf;
_tcPVj@
_tcPVj@
.PjRW
.PjRW
c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\setup\archive_patch_helper.cc
c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\setup\archive_patch_helper.cc
c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\setup\install.cc
c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\setup\install.cc
Adding Chrome to Media player list at
Adding Chrome to Media player list at
Could not add Chrome to media player inclusion list.
Could not add Chrome to media player inclusion list.
Square150x150Logo='%ls\Logo.png'
Square150x150Logo='%ls\Logo.png'
Square70x70Logo='%ls\SmallLogo.png'
Square70x70Logo='%ls\SmallLogo.png'
Registering Chrome as browser:
Registering Chrome as browser:
Failed to reinstall Active Setup keys.
Failed to reinstall Active Setup keys.
c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\setup\install_worker.cc
c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\setup\install_worker.cc
Chrome Frame in use. Copying to new_citrio.exe
Chrome Frame in use. Copying to new_citrio.exe
FUnexpected result creating CommandExecuteImpl; hr=0x
FUnexpected result creating CommandExecuteImpl; hr=0x
Adding unregistration items for DelegateExecute verb handler in
Adding unregistration items for DelegateExecute verb handler in
Not operating on Chrome while migrating to single-install.
Not operating on Chrome while migrating to single-install.
No multi-install Chrome found to migrate to single-install.
No multi-install Chrome found to migrate to single-install.
No DelegateExecute verb handler processing to do for
No DelegateExecute verb handler processing to do for
Adding registration items for DelegateExecute verb handler.
Adding registration items for DelegateExecute verb handler.
not supported.
not supported.
c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\setup\setup_main.cc
c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\setup\setup_main.cc
Renaming of executables failed. Rolling back any changes.
Renaming of executables failed. Rolling back any changes.
Upgrading existing Chrome browser in multi-install mode.
Upgrading existing Chrome browser in multi-install mode.
Launching existing system-level chrome instead.
Launching existing system-level chrome instead.
RepairChrome: Failed to open Chrome's ClientState key.
RepairChrome: Failed to open Chrome's ClientState key.
RepairChrome: Failed to read Chrome's UninstallArguments.
RepairChrome: Failed to read Chrome's UninstallArguments.
RepairChrome: Not repairing single-install Chrome.
RepairChrome: Not repairing single-install Chrome.
RepairChrome: Failed to read Chrome's UninstallString.
RepairChrome: Failed to read Chrome's UninstallString.
RepairChrome: Launched repair command "
RepairChrome: Launched repair command "
RepairChrome: Failed launching repair command "
RepairChrome: Failed launching repair command "
RepairChrome: Will retry without breakaway.
RepairChrome: Will retry without breakaway.
Tried and failed to launch Metro Chrome.
Tried and failed to launch Metro Chrome.
was found, as a last resort (if the product is not present in Add/Remove Programs), try executing:
was found, as a last resort (if the product is not present in Add/Remove Programs), try executing:
Aborting operation: another installation of
Aborting operation: another installation of
setup.exe patching failed.
setup.exe patching failed.
chrome_install:
chrome_install:
Can't register browser - Chrome distribution not found
Can't register browser - Chrome distribution not found
Chrome product not found.
Chrome product not found.
Chrome Installer
Chrome Installer
Uninstalling multi-install Chrome Frame.
Uninstalling multi-install Chrome Frame.
Uninstallation of Chrome Frame returned status
Uninstallation of Chrome Frame returned status
Chrome Frame not found for uninstall.
Chrome Frame not found for uninstall.
Installing Chrome from compressed archive
Installing Chrome from compressed archive
Cannot install Chrome without an uncompressed archive.
Cannot install Chrome without an uncompressed archive.
Chrome only supports Windows XP or later.
Chrome only supports Windows XP or later.
Non admin user can not install system level Chrome.
Non admin user can not install system level Chrome.
c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\setup\setup_util.cc
c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\setup\setup_util.cc
Looking for Chrome version folder under
Looking for Chrome version folder under
0.0.0.0
0.0.0.0
chrome-frame
chrome-frame
migrate-chrome-frame
migrate-chrome-frame
Failed to delete subkey
Failed to delete subkey
Failed to delete empty key
Failed to delete empty key
in key
in key
c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\setup\uninstall.cc
c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\setup\uninstall.cc
DeleteChromeFilesAndFolders: no installation destination
DeleteChromeFilesAndFolders: no installation destination
Launching Chrome to do uninstall tasks.
Launching Chrome to do uninstall tasks.
citrio.exe launched for uninstall confirmation returned:
citrio.exe launched for uninstall confirmation returned:
Failed to launch citrio.exe for uninstall confirmation.
Failed to launch citrio.exe for uninstall confirmation.
Uninstall per-user Active Setup keys.
Uninstall per-user Active Setup keys.
Uninstalling Active Setup key for
Uninstalling Active Setup key for
NTUSER.DAT
NTUSER.DAT
Failed to delete key at
Failed to delete key at
Retargeting user-generated Chrome shortcuts.
Retargeting user-generated Chrome shortcuts.
Retarget failed: system-level Chrome not found.
Retarget failed: system-level Chrome not found.
Closing the Chrome Frame helper process
Closing the Chrome Frame helper process
Uninstallation complete. Launching post-uninstall operations.
Uninstallation complete. Launching post-uninstall operations.
setup.exe is not in target path. Skipping installer cleanup.
setup.exe is not in target path. Skipping installer cleanup.
c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\setup\update_active_setup_version_work_item.cc
c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\setup\update_active_setup_version_work_item.cc
googlechrome
googlechrome
c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\install_util.cc
c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\install_util.cc
CHROME_PROBED_PROGRAM_FILES_PATH
CHROME_PROBED_PROGRAM_FILES_PATH
Deleting registry key
Deleting registry key
Failed to delete registry key:
Failed to delete registry key:
Failed to parse an executable name from command line: "
Failed to parse an executable name from command line: "
chrome
chrome
chrome-sxs
chrome-sxs
do-not-launch-chrome
do-not-launch-chrome
make-chrome-default
make-chrome-default
new-setup-exe
new-setup-exe
register-chrome-browser
register-chrome-browser
register-chrome-browser-suffix
register-chrome-browser-suffix
register-dev-chrome
register-dev-chrome
register-url-protocol
register-url-protocol
rename-chrome-exe
rename-chrome-exe
remove-chrome-registration
remove-chrome-registration
update-setup-exe
update-setup-exe
toast-results-key
toast-results-key
c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\lzma_util.cc
c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\lzma_util.cc
c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\shell_util.cc
c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\shell_util.cc
DefaultBrowser.ActivateSettings.ErrorHresult
DefaultBrowser.ActivateSettings.ErrorHresult
Could not make Chrome default browser (XP/current user).
Could not make Chrome default browser (XP/current user).
Could not make Chrome default browser (XP/system level).
Could not make Chrome default browser (XP/system level).
Registering Chrome as default browser on Vista.
Registering Chrome as default browser on Vista.
c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\product.cc
c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\product.cc
Failed to Open or Write MSI value to client state key. error:
Failed to Open or Write MSI value to client state key. error:
c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\installer_state.cc
c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\installer_state.cc
It seems that chrome is being installed for the first time.
It seems that chrome is being installed for the first time.
It seems that chrome is being over installed.
It seems that chrome is being over installed.
Failed opening key
Failed opening key
c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\master_preferences.cc
c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\master_preferences.cc
c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\set_reg_value_work_item.cc
c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\set_reg_value_work_item.cc
c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\delete_after_reboot_helper.cc
c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\delete_after_reboot_helper.cc
Failed to open session manager key for writing.
Failed to open session manager key for writing.
do_not_launch_chrome
do_not_launch_chrome
make_chrome_default
make_chrome_default
make_chrome_default_for_user
make_chrome_default_for_user
launch_chrome_after_update
launch_chrome_after_update
Cannot initialize an AppCommand from an invalid key.
Cannot initialize an AppCommand from an invalid key.
c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\app_command.cc
c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\app_command.cc
creating AppCommand registry key
creating AppCommand registry key
c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\conditional_work_item_list.cc
c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\conditional_work_item_list.cc
c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\google_update_settings.cc
c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\google_update_settings.cc
Failed to write to application's ClientState key
Failed to write to application's ClientState key
Removed incremental installer failure key; switching to channel:
Removed incremental installer failure key; switching to channel:
Removed multi-install failure key; switching to channel:
Removed multi-install failure key; switching to channel:
c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\google_update_util.cc
c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\google_update_util.cc
c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\installation_validator.cc
c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\installation_validator.cc
be web accessible
be web accessible
Chrome Binaries are missing "-multi" in channel name: "
Chrome Binaries are missing "-multi" in channel name: "
Chrome Binaries are missing "chrome" in channel name:
Chrome Binaries are missing "chrome" in channel name:
Chrome Binaries have "-chrome" in channel name, yet Chrome is not installed: "
Chrome Binaries have "-chrome" in channel name, yet Chrome is not installed: "
Chrome Binaries are missing "-chromeframe" in channel name: "
Chrome Binaries are missing "-chromeframe" in channel name: "
Chrome Binaries have "-chromeframe" in channel name, yet Chrome Frame is not installed multi: "
Chrome Binaries have "-chromeframe" in channel name, yet Chrome Frame is not installed multi: "
Chrome Binaries are present with no other products.
Chrome Binaries are present with no other products.
Chrome Binaries are present yet Chrome is not multi-install.
Chrome Binaries are present yet Chrome is not multi-install.
Chrome Binaries are present without Chrome, yet Chrome Frame
Chrome Binaries are present without Chrome, yet Chrome Frame
without Chrome Binaries.
without Chrome Binaries.
) does not match that of Chrome Binaries (
) does not match that of Chrome Binaries (
has an unsupported usagestats value (
has an unsupported usagestats value (
c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\self_cleaning_temp_dir.cc
c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\self_cleaning_temp_dir.cc
c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\user_experiment.cc
c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\user_experiment.cc
Experiment qualification bypass
Experiment qualification bypass
c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\channel_info.cc
c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\channel_info.cc
googlechromeframe
googlechromeframe
iexplore.exe
iexplore.exe
c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\language_selector.cc
c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\language_selector.cc
Cannot initialize AppCommands from an invalid key.
Cannot initialize AppCommands from an invalid key.
c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\app_commands.cc
c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\app_commands.cc
Failed to open key "
Failed to open key "
Skipping over key "
Skipping over key "
item execution failed
item execution failed
c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\work_item_list.cc
c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\work_item_list.cc
list execution succeeded
list execution succeeded
NoRollbackWorkItemList: item execution failed
NoRollbackWorkItemList: item execution failed
NoRollbackWorkItemList: list execution succeeded
NoRollbackWorkItemList: list execution succeeded
c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\copy_tree_work_item.cc
c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\copy_tree_work_item.cc
c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\create_dir_work_item.cc
c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\create_dir_work_item.cc
c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\create_reg_key_work_item.cc
c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\create_reg_key_work_item.cc
no key to create
no key to create
c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\delete_tree_work_item.cc
c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\delete_tree_work_item.cc
Acquired exclusive lock for key file:
Acquired exclusive lock for key file:
Could not exclusively hold all key files.
Could not exclusively hold all key files.
c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\delete_reg_key_work_item.cc
c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\delete_reg_key_work_item.cc
Failed to backup destination for registry key copy.
Failed to backup destination for registry key copy.
Failed to restore key in rollback.
Failed to restore key in rollback.
c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\delete_reg_value_work_item.cc
c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\delete_reg_value_work_item.cc
(delete value) Key:
(delete value) Key:
c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\move_tree_work_item.cc
c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\move_tree_work_item.cc
c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\self_reg_work_item.cc
c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\self_reg_work_item.cc
0xX
0xX
COM registration export function not found
COM registration export function not found
Failed getting info of key to backup, result:
Failed getting info of key to backup, result:
c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\registry_key_backup.cc
c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\registry_key_backup.cc
Failed getting name of subkey
Failed getting name of subkey
Failed opening subkey "
Failed opening subkey "
Failed backing up subkey "
Failed backing up subkey "
Failed creating subkey "
Failed creating subkey "
Failed writing subkey "
Failed writing subkey "
Failed to backup key at
Failed to backup key at
Failed to open key at
Failed to open key at
Failed to create destination key at
Failed to create destination key at
Failed to write key data.
Failed to write key data.
CHROME_HEADLESS
CHROME_HEADLESS
widevinecdmadapter.dll
widevinecdmadapter.dll
try-chrome-again
try-chrome-again
session.startup_urls
session.startup_urls
session.urls_to_restore_on_startup
session.urls_to_restore_on_startup
%s\%s
%s\%s
user_experience_metrics.reporting_enabled
user_experience_metrics.reporting_enabled
c:\jenkins\workspace\citrio-dev-clone\browser\src\crypto\secure_hash_openssl.cc
c:\jenkins\workspace\citrio-dev-clone\browser\src\crypto\secure_hash_openssl.cc
c:\jenkins\workspace\citrio-dev-clone\browser\src\courgette\assembly_program.cc
c:\jenkins\workspace\citrio-dev-clone\browser\src\courgette\assembly_program.cc
32 bit executables are not supported by this disassembler
32 bit executables are not supported by this disassembler
Resource-only executables are not yet supported
Resource-only executables are not yet supported
.relocs outside image
.relocs outside image
.relocs block outside image
.relocs block outside image
64 bit executables are not supported by this disassembler
64 bit executables are not supported by this disassembler
Not an executable file or shared library
Not an executable file or shared library
Not a supported architecture
Not a supported architecture
c:\jenkins\workspace\citrio-dev-clone\browser\src\courgette\disassembler_elf_32.cc
c:\jenkins\workspace\citrio-dev-clone\browser\src\courgette\disassembler_elf_32.cc
Skipping relocation entry for unsupported section:
Skipping relocation entry for unsupported section:
CITRIO_BREAKPAD_PIPE_NAME
CITRIO_BREAKPAD_PIPE_NAME
c:\jenkins\workspace\citrio-dev-clone\browser\src\components\crash\content\app\breakpad_win.cc
c:\jenkins\workspace\citrio-dev-clone\browser\src\components\crash\content\app\breakpad_win.cc
NTDLL.DLL
NTDLL.DLL
SHELL32.dll
SHELL32.dll
GetProcessWindowStation
GetProcessWindowStation
function not supported
function not supported
operation canceled
operation canceled
address_family_not_supported
address_family_not_supported
operation_in_progress
operation_in_progress
operation_not_supported
operation_not_supported
protocol_not_supported
protocol_not_supported
operation_would_block
operation_would_block
address family not supported
address family not supported
broken pipe
broken pipe
inappropriate io control operation
inappropriate io control operation
not supported
not supported
operation in progress
operation in progress
operation not permitted
operation not permitted
operation not supported
operation not supported
operation would block
operation would block
protocol not supported
protocol not supported
operator
operator
(0x%X)
(0x%X)
Error (0x%X) while retrieving error. (0x%X)
Error (0x%X) while retrieving error. (0x%X)
RegDeleteKeyExW
RegDeleteKeyExW
advapi32.dll
advapi32.dll
%s-%Iu
%s-%Iu
c:\jenkins\workspace\citrio-dev-clone\browser\src\base\process\memory_win.cc
c:\jenkins\workspace\citrio-dev-clone\browser\src\base\process\memory_win.cc
PlatformFile.UnknownErrors.Windows
PlatformFile.UnknownErrors.Windows
Windows NT
Windows NT
%d.%d
%d.%d
user32.dll
user32.dll
Histogram: %s recorded %d samples
Histogram: %s recorded %d samples
(flags = 0x%x)
(flags = 0x%x)
(%d = %3.1f%%)
(%d = %3.1f%%)
0123456789
0123456789
Dictionary keys must be quoted.
Dictionary keys must be quoted.
Unsupported encoding. JSON must be UTF-8.
Unsupported encoding. JSON must be UTF-8.
Line: %i, column: %i, %s
Line: %i, column: %i, %s
full-memory-crash-report
full-memory-crash-report
c:\jenkins\workspace\Citrio-Dev-Clone\browser\src\out\Release\setup.exe.pdb
c:\jenkins\workspace\Citrio-Dev-Clone\browser\src\out\Release\setup.exe.pdb
ShellExecuteExW
ShellExecuteExW
ShellExecuteW
ShellExecuteW
setup.exe
setup.exe
ClearBreakpadPipeEnvironmentVariable
ClearBreakpadPipeEnvironmentVariable
ClearCrashKeyValueImpl
ClearCrashKeyValueImpl
SetCrashKeyValueImpl
SetCrashKeyValueImpl
VERSION.dll
VERSION.dll
WS2_32.dll
WS2_32.dll
WINMM.dll
WINMM.dll
UrlCanonicalizeW
UrlCanonicalizeW
SHLWAPI.dll
SHLWAPI.dll
RegEnumKeyExW
RegEnumKeyExW
RegLoadKeyW
RegLoadKeyW
RegUnLoadKeyW
RegUnLoadKeyW
RegQueryInfoKeyW
RegQueryInfoKeyW
RegCreateKeyExW
RegCreateKeyExW
RegDeleteKeyW
RegDeleteKeyW
RegOpenKeyExW
RegOpenKeyExW
RegCloseKey
RegCloseKey
ADVAPI32.dll
ADVAPI32.dll
GetWindowsDirectoryW
GetWindowsDirectoryW
GetProcessHeap
GetProcessHeap
SetNamedPipeHandleState
SetNamedPipeHandleState
TransactNamedPipe
TransactNamedPipe
WaitNamedPipeW
WaitNamedPipeW
KERNEL32.dll
KERNEL32.dll
ole32.dll
ole32.dll
OLEAUT32.dll
OLEAUT32.dll
SetWindowsHookExW
SetWindowsHookExW
UnhookWindowsHookEx
UnhookWindowsHookEx
USER32.dll
USER32.dll
CreateURLMonikerEx
CreateURLMonikerEx
urlmon.dll
urlmon.dll
WTSAPI32.dll
WTSAPI32.dll
USERENV.dll
USERENV.dll
PeekNamedPipe
PeekNamedPipe
GetCPInfo
GetCPInfo
zcÃ
zcÃ
k.lhx
k.lhx
pK.gJ
pK.gJ
:sssh
:sssh
7:
7:
444.44...4
444.44...4
4.4....4.
4.4....4.
..44.44@4
..44.44@4
4@444@4.
4@444@4.
.4@4@@4.
.4@4@@4.
}.GnO
}.GnO
{oG
{oG
5G%8gG
5G%8gG
wG
wG
!)%)%)%sN
!)%)%)%sN
00l0}0
00l0}0
;#;);/;3;8;?;
;#;);/;3;8;?;
11d1v1
11d1v1
'020@0_0
'020@0_0
>$?/?5?\?
>$?/?5?\?
0 0$0(0,0004080
0 0$0(0,0004080
9 9$9(9,9
9 9$9(9,9
: :$:(:,:0:4:8:<:>
: :$:(:,:0:4:8:<:>
= =$=(=,=8=
= =$=(=,=8=
app_host.exe
app_host.exe
=hXXp://citrio.com/service/updatemessage/
=hXXp://citrio.com/service/updatemessage/
"hXXp://VVV.facebook.com"
"hXXp://VVV.facebook.com"
"hXXp://VVV.youtube.com"
"hXXp://VVV.youtube.com"
"hXXps://chrome.google.com/webstore/"
"hXXps://chrome.google.com/webstore/"
Open Chrome Web Store
Open Chrome Web Store
Chrome Web Store
Chrome Web Store
Ihttp
Ihttp
https
https
{A1326E5F-95B3-49FB-8C1F-610F27E0C5BE}
{A1326E5F-95B3-49FB-8C1F-610F27E0C5BE}
Software\Classes\Interface\{90E75134-C82F-4273-831F-13F6FB52BA1B}
Software\Classes\Interface\{90E75134-C82F-4273-831F-13F6FB52BA1B}
Software\Classes\TypeLib\{5405A76A-9F6D-44E3-91CE-72179B379953}
Software\Classes\TypeLib\{5405A76A-9F6D-44E3-91CE-72179B379953}
Software\Classes\CLSID\{8BF2F61B-E8C2-4A67-85D0-D6A69F9FD948}
Software\Classes\CLSID\{8BF2F61B-E8C2-4A67-85D0-D6A69F9FD948}
ServerExecutable
ServerExecutable
.CommandExecuteImpl Class
.CommandExecuteImpl Class
.StubPath
.StubPath
ieframe.dll
ieframe.dll
0.0.0.0-devel
0.0.0.0-devel
MetricsReportingEnabled
MetricsReportingEnabled
citrio.packed.7z
citrio.packed.7z
chrome.VisualElementsManifest.xml
chrome.VisualElementsManifest.xml
wow_helper.exe
wow_helper.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\%ls\Products\%ls\InstallProperties
SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\%ls\Products\%ls\InstallProperties
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{%ls}
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{%ls}
{92F8A219-E740-49D5-B785-B962AD819724}
{92F8A219-E740-49D5-B785-B962AD819724}
{F0B50D5A-4BBA-4514-AD2C-EBA50C29C460}
{F0B50D5A-4BBA-4514-AD2C-EBA50C29C460}
%SystemRoot%\System32\rundll32.exe
%SystemRoot%\System32\rundll32.exe
..htm
..htm
.html
.html
.xhtml
.xhtml
Software\Microsoft\Windows NT\CurrentVersion\ProfileList\
Software\Microsoft\Windows NT\CurrentVersion\ProfileList\
.DEFAULT\
.DEFAULT\
{3599E25E-6314-4BE9-AE14-E51877342426}
{3599E25E-6314-4BE9-AE14-E51877342426}
{675046A3-9F4F-4805-A81C-CBF753FE3428}
{675046A3-9F4F-4805-A81C-CBF753FE3428}
Browse the web
Browse the web
Software\Microsoft\Windows\CurrentVersion\Uninstall\Citrio
Software\Microsoft\Windows\CurrentVersion\Uninstall\Citrio
registering_chrome
registering_chrome
uninstalling_chrome_frame
uninstalling_chrome_frame
.HTML
.HTML
IDR_OEMPG_EN.HTML
IDR_OEMPG_EN.HTML
chrmstp.exe
chrmstp.exe
{0105EA02-802D-4B37-8161-4ED25C493266}
{0105EA02-802D-4B37-8161-4ED25C493266}
citrio.dll
citrio.dll
citrio.exe
citrio.exe
npchrome_frame.dll
npchrome_frame.dll
chrome_frame_helper.dll
chrome_frame_helper.dll
chrome_frame_helper.exe
chrome_frame_helper.exe
ChromeFrameHelperWindowClass
ChromeFrameHelperWindowClass
new_citrio.exe
new_citrio.exe
old_citrio.exe
old_citrio.exe
delegate_execute.exe
delegate_execute.exe
nacl64.exe
nacl64.exe
chrome.exe
chrome.exe
new_chrome.exe
new_chrome.exe
old_chrome.exe
old_chrome.exe
InstallerSuccessLaunchCmdLine
InstallerSuccessLaunchCmdLine
Software\Microsoft\Windows\CurrentVersion\App Paths
Software\Microsoft\Windows\CurrentVersion\App Paths
.shtml
.shtml
.webp
.webp
webcal
webcal
.webm
.webm
.flac
.flac
.torrent
.torrent
URL Protocol
URL Protocol
\.exe
\.exe
DelegateExecute
DelegateExecute
Browser.Launch
Browser.Launch
\URLAssociations
\URLAssociations
\shell\open\ddeexec
\shell\open\ddeexec
windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel
windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel
" -- "%1"
" -- "%1"
.Software\CatalinaGroup\Citrio
.Software\CatalinaGroup\Citrio
PendingFileRenameOperations
PendingFileRenameOperations
UninstallCmdLine
UninstallCmdLine
WebAccessible
WebAccessible
EMSHTML.DLL
EMSHTML.DLL
chrome_installer.log
chrome_installer.log
hXXp://VVV.citrio.com/welcome.html?intl=$1
hXXp://VVV.citrio.com/welcome.html?intl=$1
-chrome
-chrome
-chromeframe
-chromeframe
GoogleChromeAutoLaunch
GoogleChromeAutoLaunch
{DE28A2EA-77FA-4F2B-8252-C3B5844F6455}
{DE28A2EA-77FA-4F2B-8252-C3B5844F6455}
FGoogle Chrome Frame
FGoogle Chrome Frame
Chrome in a Frame.
Chrome in a Frame.
Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome Frame
Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome Frame
Google Chrome binaries
Google Chrome binaries
F{92F8A219-E740-49D5-B785-B962AD819724}
F{92F8A219-E740-49D5-B785-B962AD819724}
{8BF2F61B-E8C2-4A67-85D0-D6A69F9FD948}
{8BF2F61B-E8C2-4A67-85D0-D6A69F9FD948}
AhXXp://VVV.citrio.com/goodbye.html?intl=$1&survey_id=%ls
AhXXp://VVV.citrio.com/goodbye.html?intl=$1&survey_id=%ls
%d.%d.%d
%d.%d.%d
{E9F24A7C-13CA-42FB-A4D9-79C3C9D21B28}
{E9F24A7C-13CA-42FB-A4D9-79C3C9D21B28}
ChromeCanary
ChromeCanary
ChromeSSHTM
ChromeSSHTM
Chrome Canary HTML Document
Chrome Canary HTML Document
{1BEAC3E3-B852-44F4-B468-8906C062422E}
{1BEAC3E3-B852-44F4-B468-8906C062422E}
AGoogle Chrome Canary
AGoogle Chrome Canary
Opens all ports for Citrio embedded bittorrent client
Opens all ports for Citrio embedded bittorrent client
%u-%u
%u-%u
Crash Reports
Crash Reports
script.log
script.log
resources.pak
resources.pak
pepflashplayer.dll
pepflashplayer.dll
version.json
version.json
NPSWF32.dll
NPSWF32.dll
shell32.dll
shell32.dll
s{A946A6A9-917E-4949-B9BC-6BADA8C7FD63}
s{A946A6A9-917E-4949-B9BC-6BADA8C7FD63}
\\.\pipe\CatalinaGroupCrashServices\
\\.\pipe\CatalinaGroupCrashServices\
\\.\pipe\CitrioCrashServices
\\.\pipe\CitrioCrashServices
error %u
error %u
hunspecified-crash-key
hunspecified-crash-key
dbghelp.dll
dbghelp.dll
rpcrt4.dll
rpcrt4.dll
%s\%s.dmp
%s\%s.dmp
x-x-x-xx-xxxxxx
x-x-x-xx-xxxxxx
Kmscoree.dll
Kmscoree.dll
- floating point support not loaded
- floating point support not loaded
- CRT not initialized
- CRT not initialized
- Attempt to initialize the CRT more than once.
- Attempt to initialize the CRT more than once.
USER32.DLL
USER32.DLL
portuguese-brazilian
portuguese-brazilian
Ndebug.log
Ndebug.log
kernel32.dll
kernel32.dll
\StringFileInfo\xx\%ls
\StringFileInfo\xx\%ls
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Run
ntdll.dll
ntdll.dll
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\CR_35172.tmp\setup.exe
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\CR_35172.tmp\setup.exe
50.0.2661.271
50.0.2661.271
nsit de mDNS.KPravidlo p
nsit de mDNS.KPravidlo p
mDNS..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic.4Regla entrante para que Citrio permita tr
mDNS..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic.4Regla entrante para que Citrio permita tr
mDNS.BCitrioin saapuvien yhteyksien s
mDNS.BCitrioin saapuvien yhteyksien s
, joka sallii mDNS-liikenteen.GInbound na panuntunan para sa Citrio upang payagan ang trapiko ng mDNS.=R
, joka sallii mDNS-liikenteen.GInbound na panuntunan para sa Citrio upang payagan ang trapiko ng mDNS.=R
.3Ulazno pravilo kako bi Citrio dopustio mDNS promet.CBej
.3Ulazno pravilo kako bi Citrio dopustio mDNS promet.CBej
iamas mDNS srautas.IIen
iamas mDNS srautas.IIen
.:Peraturan masuk bagi Citrio untuk membolehkan trafik mDNS.3Inkomende regel zodat Citrio mDNS-verkeer toestaat.CRegel om innkommende trafikk for Citrio for
.:Peraturan masuk bagi Citrio untuk membolehkan trafik mDNS.3Inkomende regel zodat Citrio mDNS-verkeer toestaat.CRegel om innkommende trafikk for Citrio for
tillate mDNS-trafikk.BRegu
tillate mDNS-trafikk.BRegu
fego mDNS.:Regra de importa
fego mDNS.:Regra de importa
.Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic.
.Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic.
.lInstallation failed due to unspecified error. If Citrio is currently running, please close it and try again.lInstallation failed due to unspecified error. If Citrio is currently running, please close it and try again.zLa instalaci
.lInstallation failed due to unspecified error. If Citrio is currently running, please close it and try again.lInstallation failed due to unspecified error. If Citrio is currently running, please close it and try again.zLa instalaci
rralo e intenta nuevamente.kInstallimine eba
rralo e intenta nuevamente.kInstallimine eba
.uAsennus ep
.uAsennus ep
.tInstalacija nije uspjela zbog nepoznate pogre
.tInstalacija nije uspjela zbog nepoznate pogre
ajte ponovo.iA telep
ajte ponovo.iA telep
jra.oPemasangan gagal karena kesalahan yang tidak diketahui. Jika Citrio sedang berjalan, tutup, lalu ulang kembali.kInstallazione non riuscita a causa di un errore imprecisato. Se Citrio
jra.oPemasangan gagal karena kesalahan yang tidak diketahui. Jika Citrio sedang berjalan, tutup, lalu ulang kembali.kInstallazione non riuscita a causa di un errore imprecisato. Se Citrio
.kDiegimas nepavyko d
.kDiegimas nepavyko d
naujo.jInstal
naujo.jInstal
.sPemasangan gagal disebabkan ralat yang tidak dinyatakan. Jika Citrio sedang dijalankan, sila tutup dan cuba semula.
.sPemasangan gagal disebabkan ralat yang tidak dinyatakan. Jika Citrio sedang dijalankan, sila tutup dan cuba semula.
De installatie is mislukt wegens een onbekende fout. Als Citrio momenteel actief is, moet je Citrio sluiten en het opnieuw proberen.pInstalleringen mislyktes p
De installatie is mislukt wegens een onbekende fout. Als Citrio momenteel actief is, moet je Citrio sluiten en het opnieuw proberen.pInstalleringen mislyktes p
o especificado. Se o Citrio estiver sendo executado, feche-o e tente novamente.pA instala
o especificado. Se o Citrio estiver sendo executado, feche-o e tente novamente.pA instala
o especificado. Se o Citrio estiver em execu
o especificado. Se o Citrio estiver em execu
ste znova.rNamestitev ni bila izvedena zaradi nedolo
ste znova.rNamestitev ni bila izvedena zaradi nedolo
.rInstallationen misslyckades p
.rInstallationen misslyckades p
k sedan igen.xUsanidi umeshindwa kwa sababu ya hitilafu isiyojulikana. Ikiwa Citrio inaendesha sasa, tafadhali ifunge na ujaribu tena.x
k sedan igen.xUsanidi umeshindwa kwa sababu ya hitilafu isiyojulikana. Ikiwa Citrio inaendesha sasa, tafadhali ifunge na ujaribu tena.x
e tento software nefunguje, odinstalujte Citrio a zkuste to znovu.zComputeren har allerede en nyere version af Citrio. Hvis softwaren ikke virker, skal du afinstallere Citrio og pr
e tento software nefunguje, odinstalujte Citrio a zkuste to znovu.zComputeren har allerede en nyere version af Citrio. Hvis softwaren ikke virker, skal du afinstallere Citrio og pr
s reciente de Citrio. Si el software no funciona, desinstala Citrio y vuelve a intentarlo.kArvutis on juba Citrioi uuem versioon. Kui tarkvara ei t
s reciente de Citrio. Si el software no funciona, desinstala Citrio y vuelve a intentarlo.kArvutis on juba Citrioi uuem versioon. Kui tarkvara ei t
.rOvo ra
.rOvo ra
jra.zKomputer ini sudah memiliki Citrio versi yang lebih anyar. Jika perangkat lunak tidak bekerja, copot Citrio dan coba lagi.uQuesto computer ha gi
jra.zKomputer ini sudah memiliki Citrio versi yang lebih anyar. Jika perangkat lunak tidak bekerja, copot Citrio dan coba lagi.uQuesto computer ha gi
nytt.zNa tym komputerze jest ju
nytt.zNa tym komputerze jest ju
ste to znova.uTa ra
ste to znova.uTa ra
lar aplicacions al sistema. Proveu de tornar a executar l'instal
lar aplicacions al sistema. Proveu de tornar a executar l'instal
lador com a administrador.kNem
lador com a administrador.kNem
.sYou do not have appropriate rights for system-level installation. Try running the installer again as Administrator.nYou do not have appropriate rights for system-level install. Try running the installer again as Administrator.
.sYou do not have appropriate rights for system-level installation. Try running the installer again as Administrator.nYou do not have appropriate rights for system-level install. Try running the installer again as Administrator.
n al nivel del sistema. Intenta ejecutar el instalador nuevamente como Administrador.uTeil ei ole s
n al nivel del sistema. Intenta ejecutar el instalador nuevamente como Administrador.uTeil ei ole s
ajte ponovno pokrenuti program za instalaciju kao administrator.jNincsenek meg a megfelel
ajte ponovno pokrenuti program za instalaciju kao administrator.jNincsenek meg a megfelel
.rNeturite reikiam
.rNeturite reikiam
.rAnda tidak mempunyai hak wajar untuk pemasangan peringkat sistem. Cuba jalankan pemasang semula sebagai Pentadbir.
.rAnda tidak mempunyai hak wajar untuk pemasangan peringkat sistem. Cuba jalankan pemasang semula sebagai Pentadbir.
vel do sistema. Tente executar o instalador novamente como administrador.
vel do sistema. Tente executar o instalador novamente como administrador.
vel do sistema. Tente executar o programa de instala
vel do sistema. Tente executar o programa de instala
.cNem
.cNem
vca.qNimate ustreznih pravic za namestitev na ravni sistema. Poskusite znova zagnati namestitveni program kot skrbnik.
vca.qNimate ustreznih pravic za namestitev na ravni sistema. Poskusite znova zagnati namestitveni program kot skrbnik.
.zDu har inte beh
.zDu har inte beh
r.uHuna haki zifaazo ili kufanya usakinishaji wa kiwango cha mfumo. Jaribu kutumia kisakinishi kama msimamiaji kompyuta.u
r.uHuna haki zifaazo ili kufanya usakinishaji wa kiwango cha mfumo. Jaribu kutumia kisakinishi kama msimamiaji kompyuta.u
lid. Torneu a baixar Citrio.VArchiv instala
lid. Torneu a baixar Citrio.VArchiv instala
m Citrio znovu.HInstallationsarkivet er beskadiget eller ugyldigt. Download Citrio igen.]Das Installationsarchiv ist besch
m Citrio znovu.HInstallationsarkivet er beskadiget eller ugyldigt. Download Citrio igen.]Das Installationsarchiv ist besch
.LThe installer archive is corrupted or invalid. Please download Citrio again.LThe installer archive is corrupted or invalid. Please download Citrio again.PEl archivo de instalaci
.LThe installer archive is corrupted or invalid. Please download Citrio again.LThe installer archive is corrupted or invalid. Please download Citrio again.PEl archivo de instalaci
lido. Vuelve a descargar Citrio.EEl instalador est
lido. Vuelve a descargar Citrio.EEl instalador est
lido. Descarga Citrio nuevamente.EInstalleri arhiiv on rikutud v
lido. Descarga Citrio nuevamente.EInstalleri arhiiv on rikutud v
.7Asennusarkisto on virheellinen. Lataa Citrio uudelleen.PSira o di-wasto ang archive ng installer. Mangyaring i-download muli ang Citrio.oL'archive du programme d'installation est corrompue ou n'est pas valide. Veuillez t
.7Asennusarkisto on virheellinen. Lataa Citrio uudelleen.PSira o di-wasto ang archive ng installer. Mangyaring i-download muli ang Citrio.oL'archive du programme d'installation est corrompue ou n'est pas valide. Veuillez t
.QArhiva programa za instalaciju o
.QArhiva programa za instalaciju o
a. Ponovo preuzmite Citrio.fA telep
a. Ponovo preuzmite Citrio.fA telep
t.9Arsip pemasang rusak atau tidak valid. Unduh Citrio lagi.PL'archivio di installazione
t.9Arsip pemasang rusak atau tidak valid. Unduh Citrio lagi.PL'archivio di installazione
.VDiegimo programos archyvas sugadintas arba negalioja. Atsisi
.VDiegimo programos archyvas sugadintas arba negalioja. Atsisi
.XInstal
.XInstal
.HArkib pemasang rosak atau tidak sah. Sila muat turun Citrio sekali lagi.\Het archief van het installatieprogramma is beschadigd of ongeldig. Download Citrio opnieuw.FInstallasjonsarkivet er skadet eller ugyldig. Last ned Citrio p
.HArkib pemasang rosak atau tidak sah. Sila muat turun Citrio sekali lagi.\Het archief van het installatieprogramma is beschadigd of ongeldig. Download Citrio opnieuw.FInstallasjonsarkivet er skadet eller ugyldig. Last ned Citrio p
nytt.PArchiwum instalatora jest uszkodzone lub nieprawid
nytt.PArchiwum instalatora jest uszkodzone lub nieprawid
a o download do Citrio novamente.bO arquivo do programa de instala
a o download do Citrio novamente.bO arquivo do programa de instala
lido. Transfira novamente o Citrio.YArhiva programului de instalare este deteriorat
lido. Transfira novamente o Citrio.YArhiva programului de instalare este deteriorat
.QArch
.QArch
Citrio znova.SArhiv namestitvenega programa je po
Citrio znova.SArhiv namestitvenega programa je po
.OArkivet f
.OArkivet f
r skadat eller ogiltigt. Ladda ned Citrio igen.PKumbukumbu ya kisakinishi imeharibika au ni batili. Tafadhali pakua Citrio tena.N
r skadat eller ogiltigt. Ladda ned Citrio igen.PKumbukumbu ya kisakinishi imeharibika au ni batili. Tafadhali pakua Citrio tena.N
i torneu-ho a provar.iV syst
i torneu-ho a provar.iV syst
m a zkuste to znovu.qDer er registreret en modstridende installation af Citrio i dit system. Du skal afinstallere denne og pr
m a zkuste to znovu.qDer er registreret en modstridende installation af Citrio i dit system. Du skal afinstallere denne og pr
.`A conflicting installation of Citrio was found on the system. Please uninstall it and try again.`A conflicting installation of Citrio was found on the system. Please uninstall it and try again.hSe ha detectado una instalaci
.`A conflicting installation of Citrio was found on the system. Please uninstall it and try again.`A conflicting installation of Citrio was found on the system. Please uninstall it and try again.hSe ha detectado una instalaci
lala y vuelve a intentarlo.dSe encontr
lala y vuelve a intentarlo.dSe encontr
lala y vuelve a intentarlo.VS
lala y vuelve a intentarlo.VS
uudelleen.bMay nakitang sumasalungat na pag-install ng Citrio sa system. Paki-uninstall ito at subukang muli.pUne installation de Citrio incompatible a
uudelleen.bMay nakitang sumasalungat na pag-install ng Citrio sa system. Paki-uninstall ito at subukang muli.pUne installation de Citrio incompatible a
ajte ponovo.kA Citrio m
ajte ponovo.kA Citrio m
jra.NTerjadi konflik pemasangan Citrio pada sistem. Copot pemasangan dan coba lagi.]Nel sistema
jra.NTerjadi konflik pemasangan Citrio pada sistem. Copot pemasangan dan coba lagi.]Nel sistema
.XSistemoje aptikta nesuderinama
.XSistemoje aptikta nesuderinama
.lSist
.lSist
.\Pemasangan Citrio yang bercanggah telah dijumpai pada sistem. Sila nyahpasang dan cuba lagi.oEr is een conflicterende installatie van Citrio op het systeem gevonden. Verwijder deze en probeer het opnieuw.gDet ble funnet en konfliktskapende installasjon av Citrio p
.\Pemasangan Citrio yang bercanggah telah dijumpai pada sistem. Sila nyahpasang dan cuba lagi.oEr is een conflicterende installatie van Citrio op het systeem gevonden. Verwijder deze en probeer het opnieuw.gDet ble funnet en konfliktskapende installasjon av Citrio p
nytt.sW systemie znaleziono zainstalowan
nytt.sW systemie znaleziono zainstalowan
ste to znova.WV sistemu je bila odkrita namestitev Citrioa v sporu. Odstranite jo in poskusite znova.a
ste to znova.WV sistemu je bila odkrita namestitev Citrioa v sporu. Odstranite jo in poskusite znova.a
.VDet finns en annan installation av Citrio p
.VDet finns en annan installation av Citrio p
k igen.ZUsakinishi tatanishi wa Citrio ulipatikana kwenye mfumo. Tafadhali uondoe na ujaribu tena.yCitrio
k igen.ZUsakinishi tatanishi wa Citrio ulipatikana kwenye mfumo. Tafadhali uondoe na ujaribu tena.yCitrio
.UNebyla nalezena
.UNebyla nalezena
ytynyt.5Walang nakitang pag-install ng Citrio upang i-update..Aucune installation de Citrio
ytynyt.5Walang nakitang pag-install ng Citrio upang i-update..Aucune installation de Citrio
galima atnaujinti.BNetika atrasta neviena Citrio instal
galima atnaujinti.BNetika atrasta neviena Citrio instal
o.HNu s-a g
o.HNu s-a g
t un error en el sistema operatiu durant la instal
t un error en el sistema operatiu durant la instal
. Torneu a baixar Citrio.OB
. Torneu a baixar Citrio.OB
opera
opera
m Citrio znovu.QDer opstod en fejl i operativsystemet under installationen. Download Citrio igen.nW
m Citrio znovu.QDer opstod en fejl i operativsystemet under installationen. Download Citrio igen.nW
.UAn operating system error occurred during installation. Please download Citrio again.UAn operating system error occurred during installation. Please download Citrio again.kSe ha producido un error de sistema operativo durante el proceso de instalaci
.UAn operating system error occurred during installation. Please download Citrio again.UAn operating system error occurred during installation. Please download Citrio again.kSe ha producido un error de sistema operativo durante el proceso de instalaci
n. Vuelve a descargar Citrio.]Se produjo un error del sistema operativo durante la instalaci
n. Vuelve a descargar Citrio.]Se produjo un error del sistema operativo durante la instalaci
n. Descarga Citrio nuevamente.KInstallimisel ilmnes operatsioonis
n. Descarga Citrio nuevamente.KInstallimisel ilmnes operatsioonis
.CAsennuksessa ilmeni k
.CAsennuksessa ilmeni k
virhe. Lataa Citrio uudelleen.jMay naganap na error sa operating system sa panahon ng pag-install. Mangyaring i-download muli ang Citrio.rUne erreur du syst
virhe. Lataa Citrio uudelleen.jMay naganap na error sa operating system sa panahon ng pag-install. Mangyaring i-download muli ang Citrio.rUne erreur du syst
ke operativnog sustava tijekom instalacije. Ponovo preuzmite Citrio.YAz oper
ke operativnog sustava tijekom instalacije. Ponovo preuzmite Citrio.YAz oper
jra a Citrioot.UTerjadi kesalahan pada sistem operasi saat pemasangan berlangsung. Unduh Citrio lagi.aDurante l'installazione si
jra a Citrioot.UTerjadi kesalahan pada sistem operasi saat pemasangan berlangsung. Unduh Citrio lagi.aDurante l'installazione si
verificato un errore del sistema operativo. Scarica di nuovo Citrio.=
verificato un errore del sistema operativo. Scarica di nuovo Citrio.=
.KDiegiant
.KDiegiant
vyko operacin
vyko operacin
.PInstal
.PInstal
.SRalat sistem pengendalian berlaku semasa pemasangan. Sila muat turun Citrio semula.cEr is tijdens de installatie een fout opgetreden in het besturingssysteem. Download Citrio opnieuw.EDet oppsto en systemfeil under installering. Last ned Citrio p
.SRalat sistem pengendalian berlaku semasa pemasangan. Sila muat turun Citrio semula.cEr is tijdens de installatie een fout opgetreden in het besturingssysteem. Download Citrio opnieuw.EDet oppsto en systemfeil under installering. Last ned Citrio p
nytt.OPodczas instalacji wyst
nytt.OPodczas instalacji wyst
d systemu operacyjnego. Pobierz Citrio ponownie.aOcorreu um erro no sistema operacional durante a instala
d systemu operacyjnego. Pobierz Citrio ponownie.aOcorreu um erro no sistema operacional durante a instala
XOcorreu um erro no sistema operativo durante a instala
XOcorreu um erro no sistema operativo durante a instala
o. Transfira novamente o Citrio.YS-a produs o eroare de sistem de operare
o. Transfira novamente o Citrio.YS-a produs o eroare de sistem de operare
cie sa vyskytla chyba opera
cie sa vyskytla chyba opera
Citrio znova.GNapaka v operacijskem sistemu med namestitvijo. Znova prenesite Citrio.T
Citrio znova.GNapaka v operacijskem sistemu med namestitvijo. Znova prenesite Citrio.T
.NEtt operativsystemsfel intr
.NEtt operativsystemsfel intr
;Citrio Windows Vista
;Citrio Windows Vista
Windows XP
Windows XP
Windows Vista
Windows Vista
.ECitrio
.ECitrio
.>Windows Vista
.>Windows Vista
?Citrio requereix Windows Vista o Windows XP amb SP2 o superior.MCitrio vy
?Citrio requereix Windows Vista o Windows XP amb SP2 o superior.MCitrio vy
aduje opera
aduje opera
m Windows Vista nebo Windows XP SP2 nebo vy
m Windows Vista nebo Windows XP SP2 nebo vy
.BCitrio kr
.BCitrio kr
ver Windows Vista eller Windows XP med SP2 eller h
ver Windows Vista eller Windows XP med SP2 eller h
jere.IF
jere.IF
r Citrio ist Windows Vista oder Windows XP SP2 oder h
r Citrio ist Windows Vista oder Windows XP SP2 oder h
.?Citrio requires Windows Vista or Windows XP with SP2 or higher.?Citrio requires Windows Vista or Windows XP with SP2 or higher.JCitrio est
.?Citrio requires Windows Vista or Windows XP with SP2 or higher.?Citrio requires Windows Vista or Windows XP with SP2 or higher.JCitrio est
disponible para Windows Vista o Windows XP con SP2 o superior.RPara usar Citrio Frame, se necesita Windows Vista o Windows XP con SP2 o superior.JCitrio n
disponible para Windows Vista o Windows XP con SP2 o superior.RPara usar Citrio Frame, se necesita Windows Vista o Windows XP con SP2 o superior.JCitrio n
uab Windows Vistat v
uab Windows Vistat v
i Windows XP-d v
i Windows XP-d v
.ZCitrio edellytt
.ZCitrio edellytt
on Windows Vista tai Windows XP SP2 tai uudempi.
on Windows Vista tai Windows XP SP2 tai uudempi.
OKinakailangan ng Citrio ang Windows Vista o Windows XP na may SP2 o mas mataas.OCitrio requiert Windows Vista ou Windows XP avec SP2 ou une version ult
OKinakailangan ng Citrio ang Windows Vista o Windows XP na may SP2 o mas mataas.OCitrio requiert Windows Vista ou Windows XP avec SP2 ou une version ult
rieure.MCitrio
rieure.MCitrio
.ZCitrio zahtijeva sustav Windows Vista ili Windows XP sa servisnim paketom SP2 ili novijim.XA Citrio futtat
.ZCitrio zahtijeva sustav Windows Vista ili Windows XP sa servisnim paketom SP2 ili novijim.XA Citrio futtat
hoz Windows Vista, illetve Windows XP SP2 vagy
hoz Windows Vista, illetve Windows XP SP2 vagy
ges.PCitrio memerlukan Windows Vista atau Windows XP dengan SP2 atau yang lebih baru.ICitrio richiede Windows Vista o Windows XP con SP2 o versioni successive.P
ges.PCitrio memerlukan Windows Vista atau Windows XP dengan SP2 atau yang lebih baru.ICitrio richiede Windows Vista o Windows XP con SP2 o versioni successive.P
Windows XP SP2
Windows XP SP2
.FCitrio
.FCitrio
Windows Vista
Windows Vista
Windows XP
Windows XP
su SP2 ar naujesne versija.vP
su SP2 ar naujesne versija.vP
ma Windows Vista vai Windows XP ar SP2, vai jaun
ma Windows Vista vai Windows XP ar SP2, vai jaun
s versija.cCitrio-
s versija.cCitrio-
.ZCitrio
.ZCitrio
.MCitrio memerlukan Windows Vista atau Windows XP dengan SP2 atau lebih tinggi.DVoor Citrio is Windows Vista of Windows XP met SP2 of hoger vereist.BCitrio krever Windows Vista eller Windows XP med SP2 eller h
.MCitrio memerlukan Windows Vista atau Windows XP dengan SP2 atau lebih tinggi.DVoor Citrio is Windows Vista of Windows XP met SP2 of hoger vereist.BCitrio krever Windows Vista eller Windows XP med SP2 eller h
yere.PCitrio wymaga systemu Windows Vista b
yere.PCitrio wymaga systemu Windows Vista b
Windows XP z dodatkiem SP2 lub nowszym.BO Citrio requer o Windows Vista ou Windows XP com SP2 ou superior.BO Citrio requer o Windows Vista ou Windows XP com SP2 ou superior.NCitrio necesit
Windows XP z dodatkiem SP2 lub nowszym.BO Citrio requer o Windows Vista ou Windows XP com SP2 ou superior.BO Citrio requer o Windows Vista ou Windows XP com SP2 ou superior.NCitrio necesit
Windows Vista sau Windows XP cu SP2 sau o versiune ulterioar
Windows Vista sau Windows XP cu SP2 sau o versiune ulterioar
m Windows Vista alebo Windows XP s bal
m Windows Vista alebo Windows XP s bal
m.kZa Citrio potrebujete operacijski sistem Windows Vista ali Windows XP s servisnim paketom SP2 ali novej
m.kZa Citrio potrebujete operacijski sistem Windows Vista ali Windows XP s servisnim paketom SP2 ali novej
vs Windows Vista eller Windows XP med SP2 eller senare.CCitrio inahitaji Windows Vista au Windows XP iliyo na SP2 au zaidi.UWindows Vista
vs Windows Vista eller Windows XP med SP2 eller senare.CCitrio inahitaji Windows Vista au Windows XP iliyo na SP2 au zaidi.UWindows Vista
.DCitrio
.DCitrio
.CCitrio
.CCitrio
QCitrio; Windows Vista veya Windows XP SP2 ya da daha ileri bir s
QCitrio; Windows Vista veya Windows XP SP2 ya da daha ileri bir s
gerektirir.HCitrio
gerektirir.HCitrio
u Windows Vista ho
u Windows Vista ho
c Windows XP c
c Windows XP c
Windows Vista
Windows Vista
.yThe installer couldn't create a temporary directory. Please check for free disk space and permission to install software.yThe installer couldn't create a temporary directory. Please check for free disk space and permission to install software.
.yThe installer couldn't create a temporary directory. Please check for free disk space and permission to install software.yThe installer couldn't create a temporary directory. Please check for free disk space and permission to install software.
El instalador no pudo crear un directorio temporal. Verifique si hay espacio disponible en el disco y cuenta con permiso para instalar software.wInstallija ei suutnud luua ajutist kataloogi. Palun kontrollige vaba kettaruumi ja tarkvara installimise loa olemasolu.e
El instalador no pudo crear un directorio temporal. Verifique si hay espacio disponible en el disco y cuenta con permiso para instalar software.wInstallija ei suutnud luua ajutist kataloogi. Palun kontrollige vaba kettaruumi ja tarkvara installimise loa olemasolu.e
.xPemasang tidak dapat mencipta direktori sementara. Sila semak ruang cakera kosong dan kebenaran untuk memasang perisian.
.xPemasang tidak dapat mencipta direktori sementara. Sila semak ruang cakera kosong dan kebenaran untuk memasang perisian.
lador no ha pogut descomprimir l'arxiu. Torneu a baixar Citrio.RInstala
lador no ha pogut descomprimir l'arxiu. Torneu a baixar Citrio.RInstala
m Citrio znovu.JInstallationsprogrammet kunne ikke pakke arkivet ud. Download Citrio igen.iDas Installationsprogramm konnte das Archiv nicht dekomprimieren. Bitte laden Sie Citrio erneut herunter.Z
m Citrio znovu.JInstallationsprogrammet kunne ikke pakke arkivet ud. Download Citrio igen.iDas Installationsprogramm konnte das Archiv nicht dekomprimieren. Bitte laden Sie Citrio erneut herunter.Z
.IThe installer failed to uncompress archive. Please download Citrio again.IThe installer failed to uncompress archive. Please download Citrio again.[El programa de instalaci
.IThe installer failed to uncompress archive. Please download Citrio again.IThe installer failed to uncompress archive. Please download Citrio again.[El programa de instalaci
n no ha podido descomprimir el archivo. Vuelve a descargar Citrio.JEl instalador no pudo descomprimir el archivo. Descarga Citrio nuevamente.LInstalleril ei
n no ha podido descomprimir el archivo. Vuelve a descargar Citrio.JEl instalador no pudo descomprimir el archivo. Descarga Citrio nuevamente.LInstalleril ei
.NAsennusohjelma ei pystynyt purkamaan arkistotiedostoa. Lataa Citrio uudelleen.VNabigong i-uncompress ng installer ang archive. Mangyaring i-download muli ang Citrio.n
.NAsennusohjelma ei pystynyt purkamaan arkistotiedostoa. Lataa Citrio uudelleen.VNabigong i-uncompress ng installer ang archive. Mangyaring i-download muli ang Citrio.n
.JProgram za instalaciju nije dekomprimirao arhivu. Ponovo preuzmite Citrio.gNem siker
.JProgram za instalaciju nije dekomprimirao arhivu. Ponovo preuzmite Citrio.gNem siker
.NDiegimo programai nepavyko i
.NDiegimo programai nepavyko i
.SInstal
.SInstal
.LPemasang gagal untuk menyahmampat arkib. Sila muat turun Citrio sekali lagi.QHet installatieprogramma kan het archief niet uitpakken. Download Citrio opnieuw.QInstallasjonsprogrammet kunne ikke dekomprimere arkivet. Last ned Citrio p
.LPemasang gagal untuk menyahmampat arkib. Sila muat turun Citrio sekali lagi.QHet installatieprogramma kan het archief niet uitpakken. Download Citrio opnieuw.QInstallasjonsprogrammet kunne ikke dekomprimere arkivet. Last ned Citrio p
nytt.LInstalator nie mo
nytt.LInstalator nie mo
a o download do Citrio novamente.bHouve uma falha no programa de instala
a o download do Citrio novamente.bHouve uma falha no programa de instala
Citrio znova.KNamestitvenemu programu ni uspelo raz
Citrio znova.KNamestitvenemu programu ni uspelo raz
.RDet gick inte att packa upp arkivet med installationsfilen. Ladda ned Citrio igen.JKisakinishi kilishindwa kufinyuza kumbukumbu. Tafadhali pakua Citrio tena.P
.RDet gick inte att packa upp arkivet med installationsfilen. Ladda ned Citrio igen.JKisakinishi kilishindwa kufinyuza kumbukumbu. Tafadhali pakua Citrio tena.P
Navegador web
Navegador web
Webov
Webov
Webbrowser
Webbrowser
Web Browser
Web Browser
Navigateur Web
Navigateur Web
Web-preglednik
Web-preglednik
Browser Web
Browser Web
Browser web
Browser web
Penyemak imbas web
Penyemak imbas web
Navegador da Web
Navegador da Web
Webbl
Webbl
Web Taray
Web Taray
t web
t web
s un navegador web que executa les p
s un navegador web que executa les p
gines web i les aplicacions a gran velocitat.
gines web i les aplicacions a gran velocitat.
Citrio je webov
Citrio je webov
webov
webov
ejte web bezpe
ejte web bezpe
Citrio er en webbrowser, der k
Citrio er en webbrowser, der k
rer websider og applikationer med lynets hast. Den er hurtig, stabil og brugervenlig. Beskyttelse mod malware og phishing er indbygget i Citrio, s
rer websider og applikationer med lynets hast. Den er hurtig, stabil og brugervenlig. Beskyttelse mod malware og phishing er indbygget i Citrio, s
Citrio ist ein Webbrowser, der Webseiten und Apps in Sekundenschnelle l
Citrio ist ein Webbrowser, der Webseiten und Apps in Sekundenschnelle l
Citrio is a web browser that runs webpages and applications with lightning speed. It's fast, stable, and easy to use. Browse the web more safely with malware and phishing protection built into Citrio.
Citrio is a web browser that runs webpages and applications with lightning speed. It's fast, stable, and easy to use. Browse the web more safely with malware and phishing protection built into Citrio.
Citrio es un navegador web que ejecuta p
Citrio es un navegador web que ejecuta p
ginas web y aplicaciones a gran velocidad. Es r
ginas web y aplicaciones a gran velocidad. Es r
cil de utilizar. Citrio te permite navegar en la Web de forma m
cil de utilizar. Citrio te permite navegar en la Web de forma m
ginas web y aplicaciones con la velocidad de la luz. Es r
ginas web y aplicaciones con la velocidad de la luz. Es r
cil de usar. Navega por la Web con seguridad y protecci
cil de usar. Navega por la Web con seguridad y protecci
Ang Citrio ay isang web browser na nagpapatakbo ng mga webpage at application sa bilis ng kidlat. Ito ay mabilis, maaasahan, at madaling gamitin. Mas maingat na mag-browse sa web gamit ang proteksyon ng Citrio laban sa malware at phishing.
Ang Citrio ay isang web browser na nagpapatakbo ng mga webpage at application sa bilis ng kidlat. Ito ay mabilis, maaasahan, at madaling gamitin. Mas maingat na mag-browse sa web gamit ang proteksyon ng Citrio laban sa malware at phishing.
Citrio est un navigateur Web qui ex
Citrio est un navigateur Web qui ex
cute les pages Web et les applications
cute les pages Web et les applications
une vitesse fulgurante. Il est rapide, stable et simple d'utilisation. Naviguez sur le Web en toute s
une vitesse fulgurante. Il est rapide, stable et simple d'utilisation. Naviguez sur le Web en toute s
Citrio je web-preglednik koji munjevitom brzinom prikazuje web-stranice i aplikacije. Brz je, stabilan i jednostavan za upotrebu. Pregledavajte web sigurnije jer je za
Citrio je web-preglednik koji munjevitom brzinom prikazuje web-stranice i aplikacije. Brz je, stabilan i jednostavan za upotrebu. Pregledavajte web sigurnije jer je za
mgyorsan futtatja a weboldalakat
mgyorsan futtatja a weboldalakat
Citrio adalah browser web yang menjalankan laman web dan aplikasi dengan kecepatan kilat. Browser ini cepat, stabil, dan mudah digunakan. Jelajahi web lebih aman dengan perlindungan dari perangkat lunak perusak dan phishing yang tertanam di dalam Citrio.
Citrio adalah browser web yang menjalankan laman web dan aplikasi dengan kecepatan kilat. Browser ini cepat, stabil, dan mudah digunakan. Jelajahi web lebih aman dengan perlindungan dari perangkat lunak perusak dan phishing yang tertanam di dalam Citrio.
un browser web che esegue le pagine web e le applicazioni alla velocit
un browser web che esegue le pagine web e le applicazioni alla velocit
-Citrio.xCitrio
-Citrio.xCitrio
.yCitrio
.yCitrio
Citrio merupakan penyemak imbas yang mengendalikan laman web dan aplikasi dengan kelajuan sepantas kilat. Citrio cepat, stabil dan mudah digunakan. Semak imbas web lebih selamat dengan perlindungan perisian hasad dan pancingan data terbina dalam Citrio.
Citrio merupakan penyemak imbas yang mengendalikan laman web dan aplikasi dengan kelajuan sepantas kilat. Citrio cepat, stabil dan mudah digunakan. Semak imbas web lebih selamat dengan perlindungan perisian hasad dan pancingan data terbina dalam Citrio.
Citrio is een webbrowser die webpagina's en applicaties bliksemsnel uitvoert. Citrio is snel, stabiel en eenvoudig in gebruik. Surf veiliger op internet met de in Citrio ingebouwde beveiliging tegen malware en phishing.
Citrio is een webbrowser die webpagina's en applicaties bliksemsnel uitvoert. Citrio is snel, stabiel en eenvoudig in gebruik. Surf veiliger op internet met de in Citrio ingebouwde beveiliging tegen malware en phishing.
um navegador que executa p
um navegador que executa p
ginas e aplicativos da web com alta velocidade.
ginas e aplicativos da web com alta velocidade.
cil de usar. Navegue na web com mais seguran
cil de usar. Navegue na web com mais seguran
um navegador de internet que executa p
um navegador de internet que executa p
ginas Web e aplica
ginas Web e aplica
cil de utilizar. Navegue na Web com mais seguran
cil de utilizar. Navegue na Web com mais seguran
Citrio este un browser web care ruleaz
Citrio este un browser web care ruleaz
pagini web
pagini web
i pe web
i pe web
a webov
a webov
web bezpe
web bezpe
r en webbl
r en webbl
r webbsidor och appar blixtsnabbt. Den
r webbsidor och appar blixtsnabbt. Den
Citrio, Web sayfalar
Citrio, Web sayfalar
ran bir Web taray
ran bir Web taray
sayesinde Web'de daha g
sayesinde Web'de daha g
t web ch
t web ch
c trang web v
c trang web v
t web nhanh,
t web nhanh,
t web tr
t web tr
o Citrio.KCitrio
o Citrio.KCitrio
executant actualment. Tanqueu Citrio i torneu-ho a provar.qNelze nainstalovat verzi prohl
executant actualment. Tanqueu Citrio i torneu-ho a provar.qNelze nainstalovat verzi prohl
Citrio a zkuste to znovu.jKan ikke installere den samme version af Citrio som den, der k
Citrio a zkuste to znovu.jKan ikke installere den samme version af Citrio som den, der k
.eCan not install the same Citrio version that is currently running. Please close Citrio and try again.eCan not install the same Citrio version that is currently running. Please close Citrio and try again.xNo se puede instalar la misma versi
.eCan not install the same Citrio version that is currently running. Please close Citrio and try again.eCan not install the same Citrio version that is currently running. Please close Citrio and try again.xNo se puede instalar la misma versi
ejecutando actualmente. Cierra Citrio y vuelve a intentarlo.nNo es posible instalar la misma versi
ejecutando actualmente. Cierra Citrio y vuelve a intentarlo.nNo es posible instalar la misma versi
.fCitrioista ei voi asentaa versiota, joka on t
.fCitrioista ei voi asentaa versiota, joka on t
uudelleen.pHindi ma-install ang parehong Bersyon ng Citrio na kasalukuyang tumatakbo. Pakisara ang Citrio at subukang muli.
uudelleen.pHindi ma-install ang parehong Bersyon ng Citrio na kasalukuyang tumatakbo. Pakisara ang Citrio at subukang muli.
.lNe mo
.lNe mo
ajte ponovo.mNem lehet ugyanazt a Citrio-verzi
ajte ponovo.mNem lehet ugyanazt a Citrio-verzi
jra.iTidak dapat memasang Citrio versi yang sama dengan yang sedang Anda jalankan. Tutup Citrio dan coba lagi.eImpossibile installare una versione di Citrio uguale a quella in esecuzione. Chiudi Citrio e riprova.
jra.iTidak dapat memasang Citrio versi yang sama dengan yang sedang Anda jalankan. Tutup Citrio dan coba lagi.eImpossibile installare una versione di Citrio uguale a quella in esecuzione. Chiudi Citrio e riprova.
.sNegalima
.sNegalima
.eNevar instal
.eNevar instal
.kTidak boleh memasang versi Citrio yang sama dengan yang sedang dijalankan. Sila tutup Citrio dan cuba lagi.qKan niet dezelfde Citrio-versie installeren, omdat deze versie nu actief is. Sluit Citrio en probeer het opnieuw.WKan ikke installere den samme Citrio-versjonen som kj
.kTidak boleh memasang versi Citrio yang sama dengan yang sedang dijalankan. Sila tutup Citrio dan cuba lagi.qKan niet dezelfde Citrio-versie installeren, omdat deze versie nu actief is. Sluit Citrio en probeer het opnieuw.WKan ikke installere den samme Citrio-versjonen som kj
nytt.iNie mo
nytt.iNie mo
buj ponownie.lN
buj ponownie.lN
sendo executada. Feche o Citrio e tente novamente.sN
sendo executada. Feche o Citrio e tente novamente.sN
atualmente em execu
atualmente em execu
o. Feche o Citrio e tente novamente.nNu se poate instala aceea
o. Feche o Citrio e tente novamente.nNu se poate instala aceea
ste to znova.eNi mogo
ste to znova.eNi mogo
.iDet g
.iDet g
k igen.pHaiwezi kusakinisha toleo sawia la Citrio ambalo linaendeshwa hivi sasa. Tafadhali funga Citrio na ujaribu tena.a
k igen.pHaiwezi kusakinisha toleo sawia la Citrio ambalo linaendeshwa hivi sasa. Tafadhali funga Citrio na ujaribu tena.a
ha fallat a causa d'un error no especificat. Torneu a baixar Citrio.HInstalace se z nezn
ha fallat a causa d'un error no especificat. Torneu a baixar Citrio.HInstalace se z nezn
m Citrio znovu.SInstallationen mislykkedes p
m Citrio znovu.SInstallationen mislykkedes p
.KInstallation failed due to unspecified error. Please download Citrio again.KInstallation failed due to unspecified error. Please download Citrio again.WLa instalaci
.KInstallation failed due to unspecified error. Please download Citrio again.KInstallation failed due to unspecified error. Please download Citrio again.WLa instalaci
n ha fallado debido a un error no especificado. Vuelve a descargar Citrio.QLa instalaci
n ha fallado debido a un error no especificado. Vuelve a descargar Citrio.QLa instalaci
debido a un error no especificado. Descarga Citrio otra vez.HInstallimine eba
debido a un error no especificado. Descarga Citrio otra vez.HInstallimine eba
.NAsennus ep
.NAsennus ep
.JInstalacija nije uspjela zbog nepoznate pogre
.JInstalacija nije uspjela zbog nepoznate pogre
jra a Citrioot.KPemasangan gagal karena kesalahan yang tidak ditentukan. Unduh Citrio lagi.UInstallazione non riuscita a causa di un errore imprecisato. Scarica di nuovo Citrio.5
jra a Citrioot.KPemasangan gagal karena kesalahan yang tidak ditentukan. Unduh Citrio lagi.UInstallazione non riuscita a causa di un errore imprecisato. Scarica di nuovo Citrio.5
.JNepavyko
.JNepavyko
.UInstal
.UInstal
.WPemasangan gagal disebabkan ralat yang tidak dinyatakan. Sila muat turun semula Citrio.MDe installatie is mislukt wegens een onbekende fout. Download Citrio opnieuw.SInstalleringen mislyktes p
.WPemasangan gagal disebabkan ralat yang tidak dinyatakan. Sila muat turun semula Citrio.MDe installatie is mislukt wegens een onbekende fout. Download Citrio opnieuw.SInstalleringen mislyktes p
a o download do Citrio novamente.UA instala
a o download do Citrio novamente.UA instala
o especificado. Transfira novamente o Citrio .SInstalarea nu a reu
o especificado. Transfira novamente o Citrio .SInstalarea nu a reu
znova.FNamestitev ni uspela zaradi nenavedene napake. Znova prenesite Citrio.H
znova.FNamestitev ni uspela zaradi nenavedene napake. Znova prenesite Citrio.H
.MInstallationen misslyckades p
.MInstallationen misslyckades p
nt fel. Ladda ned Citrio igen.YUsakinishaji ulishindwa kwa sababu ya hitilafu isiyobainika. Tafadhali pakua Citrio tena.Y
nt fel. Ladda ned Citrio igen.YUsakinishaji ulishindwa kwa sababu ya hitilafu isiyobainika. Tafadhali pakua Citrio tena.Y
citrio_50.0.2661.271_1.exe_328:
.text
.text
`.data
`.data
.idata
.idata
@.rsrc
@.rsrc
@.reloc
@.reloc
c:\jenkins\workspace\Citrio-Dev-Clone\browser\src\out\Release\mini_installer.exe.pdb
c:\jenkins\workspace\Citrio-Dev-Clone\browser\src\out\Release\mini_installer.exe.pdb
RegCloseKey
RegCloseKey
RegOpenKeyExW
RegOpenKeyExW
ADVAPI32.dll
ADVAPI32.dll
GetProcessHeap
GetProcessHeap
KERNEL32.dll
KERNEL32.dll
SHELL32.dll
SHELL32.dll
setup.exe
setup.exe
X<.zcm7>
X<.zcm7>
HT.hS
HT.hS
uZ'z.aH
uZ'z.aH
R,ß
R,ß
.sqh}MD
.sqh}MD
t4`%u^
t4`%u^
UW%u5
UW%u5
/P?%F
/P?%F
%dNS3
%dNS3
.RUkF
.RUkF
.Oh$1
.Oh$1
.ayg(
.ayg(
LR.fbZ
LR.fbZ
)L=Y.eD
)L=Y.eD
F"%xk.
F"%xk.
h*ß
h*ß
^*.gc!
^*.gc!
_/.XA
_/.XA
'.JDE
'.JDE
XÜ,,
XÜ,,
@D9%dr-!`b
@D9%dr-!`b
CMdM C
CMdM C
S.xBu
S.xBu
J?.VP
J?.VP
;t..YD
;t..YD
1H.Wk
1H.Wk
.Xc"1I
.Xc"1I
,sr.lu
,sr.lu
u.Sjk
u.Sjk
`ÞhElEpEtExE|E
`ÞhElEpEtExE|E
!3.fyx
!3.fyx
1Y%xP
1Y%xP
0%DIb
0%DIb
t<.kv>
t<.kv>
-Ñio
-Ñio
v'.hz
v'.hz
%u_iW6
%u_iW6
P%Xm2X
P%Xm2X
~_.oZ
~_.oZ
Mh.BF
Mh.BF
L$".CZy
L$".CZy
/EL.cq
/EL.cq
XN..NK1
XN..NK1
z.QF)
z.QF)
.XHV{
.XHV{
.du::
.du::
.rF*TG
.rF*TG
Dq{sSh`
Dq{sSh`
T.oO:
T.oO:
%&^%x
%&^%x
4.hZ(
4.hZ(
="}uydl}%uk
="}uydl}%uk
us.oK
us.oK
.vI83
.vI83
1x%Fp
1x%Fp
k.wr[
k.wr[
!(k) .uW
!(k) .uW
jE.IFqk6
jE.IFqk6
oD%f}
oD%f}
Zl%4u
Zl%4u
.tp@z(WXi(
.tp@z(WXi(
i%XW9]
i%XW9]
U0%xK
U0%xK
Yr%x%
Yr%x%
%SikDQw*
%SikDQw*
<.org>
<.org>
lg*.GO
lg*.GO
N`.HX6
N`.HX6
.Th"up
.Th"up
>Ya.aN
>Ya.aN
{üDPJ
{üDPJ
;.sR9
;.sR9
uD.ay
uD.ay
;%F(^
;%F(^
wd [h.%u3
wd [h.%u3
.sHw|
.sHw|
EA%fW
EA%fW
DlM.eE
DlM.eE
/.zpA
/.zpA
I4-f}{kIU
I4-f}{kIU
mSG2
mSG2
L.Ef{
L.Ef{
ehk%c
ehk%c
l/.AZ
l/.AZ
`j%CP{OU
`j%CP{OU
'Q.VlC
'Q.VlC
FWUD%U
FWUD%U
k.ZT[
k.ZT[
yWZ.Dh
yWZ.Dh
Q.N,$kS.co
Q.N,$kS.co
.ow",U
.ow",U
.jyjI
.jyjI
z%uc%
z%uc%
o%X_R
o%X_R
%s[?Eq
%s[?Eq
T.uEkM
T.uEkM
8K.LHX]
8K.LHX]
)KEy}]`\qU
)KEy}]`\qU
NLxH W.Hp
NLxH W.Hp
O5~
O5~
%dmT!*
%dmT!*
O.rX13
O.rX13
dhK%Xb
dhK%Xb
B1%SE)
B1%SE)
/%4X~u81
/%4X~u81
W_F%C
W_F%C
8.FOB
8.FOB
%D"hU
%D"hU
H.qbR
H.qbR
es.dJ]
es.dJ]
-g%sV
-g%sV
M.ts8
M.ts8
.fXQy#
.fXQy#
Sb?.Snw
Sb?.Snw
~.GT
~.GT
N.nv\
N.nv\
>4ÂD$I
>4ÂD$I
Bb.ws
Bb.ws
;s?H.HX
;s?H.HX
25 '@[@=
25 '@[@=
{.hUT
{.hUT
ev.SH
ev.SH
#o.AE
#o.AE
JZ%uE&
JZ%uE&
ae.nf
ae.nf
v 0%d@f
v 0%d@f
%8uq!
%8uq!
.RU-;k
.RU-;k
D(.bK
D(.bK
'.VW,
'.VW,
B<.zx>
B<.zx>
h>.ds
h>.ds
Wi6.kY6
Wi6.kY6
V-Td}k>$
V-Td}k>$
%S-'s
%S-'s
.pmJ-
.pmJ-
M;\%d#*
M;\%d#*
@.Rsn
@.Rsn
6SO
6SO
.Lp84
.Lp84
39e-p}
39e-p}
.wLYY
.wLYY
3.IG9L
3.IG9L
b"[.Ap
b"[.Ap
j"`
j"`
"X.La
"X.La
7pDq.GA'
7pDq.GA'
Rey(}
Rey(}
~0%FV
~0%FV
-dx%Fm
-dx%Fm
K.Ak]
K.Ak]
C.Sfk
C.Sfk
GÉ.
GÉ.
cMD(Is
cMD(Is
$*.WU
$*.WU
wEbL
wEbL
.kp34
.kp34
mM-Cn}
mM-Cn}
q.Zj\
q.Zj\
B*7j%C
B*7j%C
.R.pf
.R.pf
>.zJmD
>.zJmD
A2%SL.
A2%SL.
a:%dr0
a:%dr0
N(t:.zf
N(t:.zf
.jlc'
.jlc'
t5J%fx
t5J%fx
M.WeV
M.WeV
udpr
udpr
".Ts7x
".Ts7x
.BP
.BP
8~L%SZ
8~L%SZ
E*5E%S
E*5E%S
i6.gAY0
i6.gAY0
v.HW:
v.HW:
8Q.He
8Q.He
1.dTk
1.dTk
:K.NX*4]
:K.NX*4]
t.Vq~
t.Vq~
R'.iG
R'.iG
%Sw@W|n
%Sw@W|n
9.cH%
9.cH%
dl.wI\
dl.wI\
20.hRl(
20.hRl(
%uYX?
%uYX?
.mE=N
.mE=N
i.MFF
i.MFF
.Sr[r(
.Sr[r(
-uHAs}
-uHAs}
.clpuq
.clpuq
p)%4sno
p)%4sno
.yQNINM4
.yQNINM4
'Lh%F
'Lh%F
a%Sok
a%Sok
.ROpT
.ROpT
-}~URL
-}~URL
P%U&8
P%U&8
P.mw\o
P.mw\o
_6!
_6!
[.KI=
[.KI=
D<.yo>
D<.yo>
;T%sF
;T%sF
~O{cCRT
~O{cCRT
.mmG;e
.mmG;e
g%Uu`
g%Uu`
!o.OD
!o.OD
%s2pd$
%s2pd$
%uK|s
%uK|s
%%DH5
%%DH5
B.eW5CE
B.eW5CE
HT[.QoG
HT[.QoG
/.qTR
/.qTR
cRtS
cRtS
"n.wA
"n.wA
$X.Qs
$X.Qs
y.fl/
y.fl/
NY%Dj
NY%Dj
%.pU7
%.pU7
FG<.hiq>
FG<.hiq>
.BV`{
.BV`{
{9.iG
{9.iG
/aG4.En
/aG4.En
crTU
crTU
Q(.vFTI
Q(.vFTI
X%u{P
X%u{P
f.xTX
f.xTX
O:%C_
O:%C_
X/%XmbU#
X/%XmbU#
.Pe3q
.Pe3q
F0|075.OG]
F0|075.OG]
o4%F#
o4%F#
H"A %D
H"A %D
KL%cj
KL%cj
=v8
=v8
@c.RJ
@c.RJ
z".qO
z".qO
.Ofqz
.Ofqz
HŸxub
HŸxub
ZL) %x}
ZL) %x}
M@Ü
M@Ü
<.uc_>
<.uc_>
%ua^sM
%ua^sM
%XzzG
%XzzG
g.KZg
g.KZg
Âz.T
Âz.T
S.LUrZ
S.LUrZ
Ã@T~
Ã@T~
%F*8
%F*8
r.JrxG
r.JrxG
-ngs}G
-ngs}G
t.hL){
t.hL){
w?.tT
w?.tT
@v{ %D
@v{ %D
A.BO)
A.BO)
T.xLI
T.xLI
.tIU{
.tIU{
.vg&Sg
.vg&Sg
.VpC=
.VpC=
.bBpM
.bBpM
_.SQ
_.SQ
{\.Cc
{\.Cc
w.kp{
w.kp{
V^1.Hapt
V^1.Hapt
e..vV
e..vV
.ub/_
.ub/_
.XG:w
.XG:w
_.lI8
_.lI8
Fz^.Tk
Fz^.Tk
%UZ'%1
%UZ'%1
N-.uXk
N-.uXk
G-c}a
G-c}a
}.okyW
}.okyW
446#/%U
446#/%U
O0.jr
O0.jr
>K,.Mn
>K,.Mn
fG.ye
fG.ye
.Gn?jf
.Gn?jf
]7%f@%
]7%f@%
W.ynQ
W.ynQ
(":,.Or"
(":,.Or"
P
P
H'B.br
H'B.br
.BDMh {
.BDMh {
wEBN{
wEBN{
$.awe
$.awe
%f^f"
%f^f"
W}.oF
W}.oF
?.bKs
?.bKs
&,ß
&,ß
Dz.Bk
Dz.Bk
4].Tr
4].Tr
%S~}gY
%S~}gY
sshjfk
sshjfk
]p.Xs
]p.Xs
w%x_:*
w%x_:*
%Dh=/
%Dh=/
.lg"/
.lg"/
.bID}
.bID}
)`G-pKQ}
)`G-pKQ}
c%F~x
c%F~x
.uhir%
.uhir%
|%STv}
|%STv}
C@.jJlU
C@.jJlU
WS>f(.ef#>
WS>f(.ef#>
.)ot1.CC
.)ot1.CC
B .CK
B .CK
kmcQ.wQG
kmcQ.wQG
eB.Fl
eB.Fl
p.Oi{-@!
p.Oi{-@!
Y%C$/
Y%C$/
7.Ez5
7.Ez5
Nc%C.
Nc%C.
.fN4$
.fN4$
Y%UKM
Y%UKM
5.uc5o
5.uc5o
; .QjT|C
; .QjT|C
&.McU
&.McU
.BN`Q
.BN`Q
!'>%Xd
!'>%Xd
.MdxL
.MdxL
M.nMc
M.nMc
.hk"2
.hk"2
\.LS;1
\.LS;1
7D&.Zj)07d
7D&.Zj)07d
.uA{vL
.uA{vL
zj.wV
zj.wV
pyh,x.da
pyh,x.da
j.keO
j.keO
<.nq->
<.nq->
.nO8=[q-
.nO8=[q-
G4.dFgI%
G4.dFgI%
CRtu
CRtu
A=.Xp
A=.Xp
'%4x)
'%4x)
.fPa>*8.
.fPa>*8.
c;.VY
c;.VY
#IÄ
#IÄ
7.NXB
7.NXB
.mU=F
.mU=F
ex.Cg
ex.Cg
3-%.TgG;
3-%.TgG;
-KiWeB
-KiWeB
.wvzn
.wvzn
b%Xn\
b%Xn\
H^%f=]
H^%f=]
g.srf
g.srf
.QYc~
.QYc~
?U(%f
?U(%f
%F,loU
%F,loU
-M}&G
-M}&G
%C}!p
%C}!p
xae.NW
xae.NW
U%.LWS
U%.LWS
A(.vBi
A(.vBi
m.xG-
m.xG-
{.uRo
{.uRo
#J.Vn
#J.Vn
#5*.BZ9c
#5*.BZ9c
z.SU5
z.SU5
a×{
a×{
.Xw(/
.Xw(/
2HNm:%ubD0q
2HNm:%ubD0q
%xM{O
%xM{O
B.RkZ
B.RkZ
p.SmF
p.SmF
a2%1x
a2%1x
o.KgUh,
o.KgUh,
@.TpM~
@.TpM~
Y%X(6c
Y%X(6c
%5sLr
%5sLr
S)&-l.gZvA
S)&-l.gZvA
%dkkE}
%dkkE}
y.vg\-
y.vg\-
%DR.6I
%DR.6I
[.bsz
[.bsz
Cp%s`
Cp%s`
.KI=x
.KI=x
GNÀ
GNÀ
%CZkv
%CZkv
"hD%u
"hD%u
.Sp"r
.Sp"r
8.cv9
8.cv9
o%X_g
o%X_g
\_!`65>!
\_!`65>!
%C@.-
%C@.-
%S'}w
%S'}w
fk(u%x
fk(u%x
ro.Ff
ro.Ff
sDE%d@
sDE%d@
.Bi-K
.Bi-K
j.xk%
j.xk%
eA%CS
eA%CS
n .OU.
n .OU.
.ZDmO
.ZDmO
d5{%X
d5{%X
[T÷
[T÷
Fj.KX
Fj.KX
H)@q.Wyq
H)@q.Wyq
.Ijq@
.Ijq@
.dZu*
.dZu*
=I.vo
=I.vo
Z*%dS
Z*%dS
|%S6Lo
|%S6Lo
8p.WI
8p.WI
.rxU9
.rxU9
E_Ÿ
E_Ÿ
7&.Ok"
7&.Ok"
`.Pv)
`.Pv)
J.aQZ
J.aQZ
.pHYH
.pHYH
]).rc
]).rc
.SG;x_
.SG;x_
Ts4qn%So
Ts4qn%So
L):.tG
L):.tG
|]4 ,[4*
|]4 ,[4*
n(.AA
n(.AA
,R .Xr
,R .Xr
%d`a|
%d`a|
PP.Ep
PP.Ep
B2=%Cg
B2=%Cg
O-9}f
O-9}f
tO8.OU r
tO8.OU r
1.hA*
1.hA*
%cY ^
%cY ^
y.PDe
y.PDe
"K.hM
"K.hM
6}.uu
6}.uu
P`.BI
P`.BI
dO.iB
dO.iB
-.hf=
-.hf=
2=Q%x
2=Q%x
"%X34R
"%X34R
.bm>]
.bm>]
G&s%U
G&s%U
.wS}a
.wS}a
.Ju4$
.Ju4$
T.iwI}
T.iwI}
ge.aU
ge.aU
|%u`Ts?-
|%u`Ts?-
lz.GL
lz.GL
tMl-\%S
tMl-\%S
jW%xG
jW%xG
t%XY?
t%XY?
`%x:4
`%x:4
t/X%F
t/X%F
aEÞf
aEÞf
SShCyAB
SShCyAB
18_
18_
5mM.bU
5mM.bU
udpE$S
udpE$S
.TCxD
.TCxD
QZ.peu|p
QZ.peu|p
.qPn5
.qPn5
L $%Xyt
L $%Xyt
.LA0s
.LA0s
.jxx-
.jxx-
xH.qB
xH.qB
$.sN>
$.sN>
hd;B.NSo^
hd;B.NSo^
~%x,(sG
~%x,(sG
m.Qau~*
m.Qau~*
{6_%x
{6_%x
.lk|p
.lk|p
4WEB}
4WEB}
s.ow7
s.ow7
.fGci{@G
.fGci{@G
%S
%S
tiJ.Wt
tiJ.Wt
Kwo.CX
Kwo.CX
]<.fn>
]<.fn>
.gRj2
.gRj2
Xz.Bd
Xz.Bd
@OWb
@OWb
ng.)%X
ng.)%X
@.vh/
@.vh/
WI%X_
WI%X_
?_%sB=}
?_%sB=}
E%C`7
E%C`7
W.TOp
W.TOp
'%fz~G
'%fz~G
vp.lK
vp.lK
ow.Oba
ow.Oba
.mgp]M>
.mgp]M>
.As2U
.As2U
q3%X=\
q3%X=\
ym.WFO^
ym.WFO^
[X.AG
[X.AG
A.yG/
A.yG/
z%DU#
z%DU#
keY\=
keY\=
@{.NQ
@{.NQ
nZ%dY
nZ%dY
Xy.Fj
Xy.Fj
7On%d
7On%d
\4.FX/
\4.FX/
]H.Djy*~v
]H.Djy*~v
%SzyW
%SzyW
,.ku:u
,.ku:u
%x0&:
%x0&:
bgU.qo
bgU.qo
.iNik
.iNik
WP.yR%.
WP.yR%.
{.sJq
{.sJq
6.VyJ-
6.VyJ-
F.bMmZ
F.bMmZ
$#%fkb]
$#%fkb]
".nLB
".nLB
%FR2v
%FR2v
%5s9(
%5s9(
:rrC:R.ck
:rrC:R.ck
.oGlu
.oGlu
<.>
<.>
V.Jmd%
V.Jmd%
ti,.Au1
ti,.Au1
Xb%X=#
Xb%X=#
V.UTk
V.UTk
-w.RQT
-w.RQT
eR}.Dy=
eR}.Dy=
W %dO
W %dO
.OZz9
.OZz9
2!.Uq
2!.Uq
%xa%r
%xa%r
|]L%x
|]L%x
%s>[a
%s>[a
e.pXR
e.pXR
QP.XC
QP.XC
NvVJG%su
NvVJG%su
`.aylYjx
`.aylYjx
KÈ;r
KÈ;r
G%uC6
G%uC6
K.mTQ
K.mTQ
{.ep7`
{.ep7`
;q.eO
;q.eO
/%U"c1j
/%U"c1j
k}<.ydzm8>
k}<.ydzm8>
Ugj,.DG
Ugj,.DG
#BK.SW
#BK.SW
.Jgh'
.Jgh'
BtsFP
BtsFP
&Nw%s
&Nw%s
^W%XH
^W%XH
P%U_mB
P%U_mB
cMd/G#k
cMd/G#k
%Cw`zPgwT
%Cw`zPgwT
%Cn{K
%Cn{K
y%DZ\C
y%DZ\C
6%uMg
6%uMg
McmD0
McmD0
.kWngu(
.kWngu(
FTpK_
FTpK_
.hf/CC
.hf/CC
.U$.GM/
.U$.GM/
W.GfP
W.GfP
wR%1ux
wR%1ux
.Pw:Yp
.Pw:Yp
c%C!D
c%C!D
"":
"":
|cF.TLq
|cF.TLq
=T%C!
=T%C!
wsr.sNh
wsr.sNh
%fpb1
%fpb1
.yhma
.yhma
KsM.DQ
KsM.DQ
~.FGBaTf-T.)@'s
~.FGBaTf-T.)@'s
,Èe
,Èe
.pnhW
.pnhW
R^%Cya
R^%Cya
-m}dA
-m}dA
:.fZx
:.fZx
,,d.ve
,,d.ve
dl%fq-
dl%fq-
.pX1jxc
.pX1jxc
tM&z"Ö
tM&z"Ö
%F"IB
%F"IB
|%cH2
|%cH2
z.QEA
z.QEA
.yz}k
.yz}k
s
s
d'E}|.mF
d'E}|.mF
}C %f
}C %f
*%S'K=
*%S'K=
Yp%d-
Yp%d-
ODi.DL
ODi.DL
H](DZ.kX
H](DZ.kX
Ã*B
Ã*B
7%cN@
7%cN@
k.%C#T
k.%C#T
FtPr
FtPr
w
w
%D*E H95
%D*E H95
18l%u!b
18l%u!b
.PWR/
.PWR/
6n.%D
6n.%D
Si .IH
Si .IH
&@.gO
&@.gO
os.nD'P
os.nD'P
%u MH%
%u MH%
pi%4U.y|J
pi%4U.y|J
.raXOG
.raXOG
.ptDv:-w,
.ptDv:-w,
O_l.kK
O_l.kK
%f(Ul
%f(Ul
s4.wB
s4.wB
C.Mo3.:
C.Mo3.:
[%x~1RK
[%x~1RK
iX#%c/
iX#%c/
..KI$
..KI$
djS.Pw
djS.Pw
.aMen
.aMen
E2%Cqnn 9
E2%Cqnn 9
.ZJ}W
.ZJ}W
{..Bt
{..Bt
Z%s$".~C]
Z%s$".~C]
%X3ky,
%X3ky,
%D=pMp
%D=pMp
%usb=
%usb=
[CWeb)'
[CWeb)'
y.RGN
y.RGN
.wqEa
.wqEa
n^.ViR
n^.ViR
q_!%D
q_!%D
.WKc5:
.WKc5:
`%f{U
`%f{U
.LZ_vGC
.LZ_vGC
%x6}/-zL
%x6}/-zL
R%8uw
R%8uw
I O'X .pX
I O'X .pX
6y.xS
6y.xS
x|NM%d
x|NM%d
/*1[/.q.vQ
/*1[/.q.vQ
k-CGZ}
k-CGZ}
n).Ix^
n).Ix^
r.Yt[(
r.Yt[(
O.cnB 7
O.cnB 7
H.xEqxQUU
H.xEqxQUU
.gyWv
.gyWv
l.hEG
l.hEG
{54=.sv
{54=.sv
%fz`q
%fz`q
5k^.Za
5k^.Za
_s.VX
_s.VX
w.gY|
w.gY|
;Iy%U
;Iy%U
%C)G(
%C)G(
s .Et!
s .Et!
Gosql
Gosql
vI)eO}.xj
vI)eO}.xj
\%S!y
\%S!y
`MI*.vf
`MI*.vf
%f pQ
%f pQ
.jnU;S
.jnU;S
%S|K?
%S|K?
1.sXJ
1.sXJ
`.YQd
`.YQd
kE.Ht
kE.Ht
.Tp.P
.Tp.P
8e/.gEJ
8e/.gEJ
F{%cYi
F{%cYi
d%D;hHr
d%D;hHr
%xT06]B0
%xT06]B0
@%cYN
@%cYN
dJw.pC
dJw.pC
8b.KUI
8b.KUI
*%'5%f
*%'5%f
%Uwu;
%Uwu;
x-m}v
x-m}v
B3.SI*
B3.SI*
.bs2^.G
.bs2^.G
r.Cs;H-
r.Cs;H-
bvA%X
bvA%X
!-mL}c
!-mL}c
B-b}"O
B-b}"O
8.gdl
8.gdl
(.SO'
(.SO'
]%C^f
]%C^f
:P.qru
:P.qru
?1a%U
?1a%U
.pYlaF
.pYlaF
o%X4~
o%X4~
?Np%x ;YF
?Np%x ;YF
k|%szia
k|%szia
.aNZWd
.aNZWd
.yAi>x
.yAi>x
A p.ch
A p.ch
e.uFM
e.uFM
*FF.TB
*FF.TB
~%.GPg)
~%.GPg)
*v%UX
*v%UX
3\Ü!
3\Ü!
i`%u$
i`%u$
A.Grgwv
A.Grgwv
<.ck>
<.ck>
-.lN$
-.lN$
>#a%u
>#a%u
.uZPK
.uZPK
\%s%1`ouN
\%s%1`ouN
LV.yL
LV.yL
yp.ay
yp.ay
bP0%fk
bP0%fk
u%x#9
u%x#9
@.iak
@.iak
-F}4l
-F}4l
pgt}%CI|r
pgt}%CI|r
iF9%s%
iF9%s%
iG%f]~__}
iG%f]~__}
.qtDQ
.qtDQ
ZVÃ
ZVÃ
udpSg
udpSg
[b%S^
[b%S^
hH$.Nh3
hH$.Nh3
.zc$OvD
.zc$OvD
uU%x4Ld
uU%x4Ld
.VO5AB
.VO5AB
z.Si)3Y
z.Si)3Y
$.hND
$.hND
D%x/B
D%x/B
%3U%]
%3U%]
xr.kD(
xr.kD(
kIMbuRl-
kIMbuRl-
H.NgQ
H.NgQ
.mf#&
.mf#&
)w%S*}
)w%S*}
)M.IR
)M.IR
~.ZWm
~.ZWm
1`p.UQ
1`p.UQ
y0t.VU
y0t.VU
M.Sy]
M.Sy]
${b-M$Im%U
${b-M$Im%U
U-H}H
U-H}H
K`%XMqA"
K`%XMqA"
.fG[f
.fG[f
{![f3L
{![f3L
0PL.YKi'
0PL.YKi'
3nsC.fhZf
3nsC.fhZf
qLk.jQ
qLk.jQ
d.JMhw
d.JMhw
n.ik=
n.ik=
1Oax.Ai
1Oax.Ai
Jo``?%C
Jo``?%C
.MGH#D
.MGH#D
_.eao
_.eao
Rh%D'
Rh%D'
z.SG>
z.SG>
y6%uI
y6%uI
.DGD3
.DGD3
H.ec-
H.ec-
>.xb2
>.xb2
.pPcww
.pPcww
FQbu%SS
FQbu%SS
Xj%C.I
Xj%C.I
D%F(l5
D%F(l5
.SzNg
.SzNg
d)R.Sy
d)R.Sy
1.eYi7
1.eYi7
S1%u%;
S1%u%;
.qMNc
.qMNc
C|.Dr
C|.Dr
*.VIS
*.VIS
=`BW
=`BW
F|.VC
F|.VC
0r6%F
0r6%F
.PO1_
.PO1_
.IE8 N
.IE8 N
Xr%Sq
Xr%Sq
.tz7!
.tz7!
,%sI[
,%sI[
%3s8^
%3s8^
V×d
V×d
%u"3K.
%u"3K.
fU@%F
fU@%F
1.ieV
1.ieV
.cD316
.cD316
.HG0v
.HG0v
$d.fz
$d.fz
7I]1s.DM!
7I]1s.DM!
(.grS
(.grS
(%X;v}y
(%X;v}y
:p%DQ2n\
:p%DQ2n\
O|E
O|E
.OR0d8
.OR0d8
`Im%f
`Im%f
l@L.kL/
l@L.kL/
].AY8
].AY8
*f.iB/
*f.iB/
Kb.zC(>
Kb.zC(>
-uj}z%
-uj}z%
y.An]T*t
y.An]T*t
1B.IQ
1B.IQ
0z.Ql0
0z.Ql0
%X\T;{
%X\T;{
.asGVj
.asGVj
.CP}-
.CP}-
u?-%X
u?-%X
b%s>C
b%s>C
m.AJ3
m.AJ3
D@.fV!
D@.fV!
...LO]
...LO]
>;u%D*g
>;u%D*g
uZ%D!
uZ%D!
mmr.KP%
mmr.KP%
.TzN*
.TzN*
|ur'd%F
|ur'd%F
&\'9=(/6
&\'9=(/6
%d{{E
%d{{E
Fm9c%D
Fm9c%D
A@.RR
A@.RR
|.wlp
|.wlp
Q.prf
Q.prf
cC f%FlR
cC f%FlR
f.QqjE8
f.QqjE8
xA%Uc1v|a
xA%Uc1v|a
.su`=
.su`=
.jWso1q
.jWso1q
/.=%d\
/.=%d\
& .NJa
& .NJa
JY%U3
JY%U3
BuxSShx
BuxSShx
s(\Jx].RQ(!
s(\Jx].RQ(!
ZÃQ}
ZÃQ}
D|U%S
D|U%S
B"6.wG
B"6.wG
6zG%C
6zG%C
\P/%D
\P/%D
N.Wl[
N.Wl[
gw.jx
gw.jx
1.trb
1.trb
6.TAJh
6.TAJh
!5%xH
!5%xH
z {>%u
z {>%u
wt-ir}
wt-ir}
5^CrT
5^CrT
w.eG2O@X
w.eG2O@X
gYAß
gYAß
s.bXaNS
s.bXaNS
!p.FRL
!p.FRL
'(.yV
'(.yV
W%up0
W%up0
r.fJu
r.fJu
.srDC
.srDC
L4%xs
L4%xs
YdM%fU
YdM%fU
*.MxA
*.MxA
tcpV
tcpV
r.tEa
r.tEa
ÂJk#
ÂJk#
M}J%D^&pb
M}J%D^&pb
.FcM4BF
.FcM4BF
WM.Np
WM.Np
-Ay}Yop
-Ay}Yop
$=Z.%CM
$=Z.%CM
m%Cv8
m%Cv8
.Vu]K
.Vu]K
%ct9!~1
%ct9!~1
z%x=Qj
z%x=Qj
>.ij[
>.ij[
%.DI]
%.DI]
K}%X;j
K}%X;j
%XL{rSf
%XL{rSf
/~/.Ea
/~/.Ea
-4}I4
-4}I4
!W.Cpq
!W.Cpq
y).Wt0p
y).Wt0p
%l%F=
%l%F=
~UÜ
~UÜ
9.rFf
9.rFf
z.OYJVi
z.OYJVi
3yN.kF
3yN.kF
]d.jBZ
]d.jBZ
'.TCxx
'.TCxx
.tP&=
.tP&=
?%D)p
?%D)p
^]-%F
^]-%F
-wY8.kv
-wY8.kv
ZQ.jn
ZQ.jn
y.aCWr
y.aCWr
N.fbH% &=
N.fbH% &=
.HV-9
.HV-9
Ja%u:
Ja%u:
eFh?%XW
eFh?%XW
;V~5.Ud
;V~5.Ud
.eH(g@
.eH(g@
ÆxdYY
ÆxdYY
s.SG~F
s.SG~F
JY.at
JY.at
.TNL=
.TNL=
k\K%s.
k\K%s.
-EÔ
-EÔ
%x0GaE
%x0GaE
S.Fj_R
S.Fj_R
QUyB.XJ
QUyB.XJ
m.ae,
m.ae,
%f Fx
%f Fx
>i.FL
>i.FL
q .Qo
q .Qo
.FnW.L
.FnW.L
.Vm/i
.Vm/i
cH6'k.El
cH6'k.El
4.hRk
4.hRk
h.seT
h.seT
(?.Og
(?.Og
9{.wZ
9{.wZ
,Kt%f
,Kt%f
.fRA3
.fRA3
~M]p%s
~M]p%s
.Ui~2
.Ui~2
%dlp*
%dlp*
/Hu%D
/Hu%D
ib.gt$
ib.gt$
H.fRA\
H.fRA\
zxm%x
zxm%x
R.sNS
R.sNS
$ ÃŽ
$ ÃŽ
@CSo?.cq
@CSo?.cq
i%C)-~
i%C)-~
9%C:9{!
9%C:9{!
^a.vD
^a.vD
.Ylo?
.Ylo?
o"0%F
o"0%F
6C.AF6
6C.AF6
aY:.DB
aY:.DB
ü
ü
-%s>;eq;
-%s>;eq;
xsiK.jP
xsiK.jP
e2.KSl2
e2.KSl2
5.Jp7xK
5.Jp7xK
%GR.cP~
%GR.cP~
g1*%f,
g1*%f,
?.Jr"
?.Jr"
@KB.sc
@KB.sc
-.GGr
-.GGr
P0.Fj
P0.Fj
a.dWf
a.dWf
%U,mp5
%U,mp5
|.bze
|.bze
.vX3|
.vX3|
.tN",
.tN",
%utAj
%utAj
m!.eJR
m!.eJR
.uTpz
.uTpz
>.rc*z
>.rc*z
$*.*m
$*.*m
%D@oS
%D@oS
:Ì?
:Ì?
;.ySr
;.ySr
eh%U3
eh%U3
9K;E%Fs
9K;E%Fs
D.wY/
D.wY/
l%D@^
l%D@^
5.UxGR
5.UxGR
D.tRX5
D.tRX5
_.DF\
_.DF\
5Qr%C
5Qr%C
C.rlGA
C.rlGA
*%SFl
*%SFl
*N.gQ
*N.gQ
N.MIb
N.MIb
vp&Y
vp&Y
,%c'P
,%c'P
b0.eti
b0.eti
,~.Eo.;
,~.Eo.;
.iix~
.iix~
Vd.AO
Vd.AO
?.KR8bi
?.KR8bi
Y%x`jI
Y%x`jI
CCIy-?%u
CCIy-?%u
JG.QB
JG.QB
M
M
%U]Zhj/
%U]Zhj/
.hhD7
.hhD7
bQ.vH[Kl
bQ.vH[Kl
L.rOn}
L.rOn}
(.cGb
(.cGb
`L.ra
`L.ra
Ps %f
Ps %f
JV%uP1P^
JV%uP1P^
b?.BE
b?.BE
$".pq4d
$".pq4d
n%]H%F
n%]H%F
:__.vI
:__.vI
.qw~^
.qw~^
(..fBn
(..fBn
86X.qY
86X.qY
.AN^`#
.AN^`#
%d@f]
%d@f]
Zj%SZ
Zj%SZ
_ÞU
_ÞU
.mL> 2
.mL> 2
W\ .Ph
W\ .Ph
4n_S%d
4n_S%d
wc%X3
wc%X3
B@? a.th
B@? a.th
6%xT.(\r
6%xT.(\r
K5.Fkp*
K5.Fkp*
.fQiE
.fQiE
A4L`M2.PQ
A4L`M2.PQ
.Lg/:
.Lg/:
vÿMWI9
vÿMWI9
uD.QI
uD.QI
.ssb
.ssb
|.JDU
|.JDU
%FYQ2(
%FYQ2(
.mVK5
.mVK5
X.HcN
X.HcN
*.ol1h
*.ol1h
.ZD"O$-
.ZD"O$-
[-8}ReS
[-8}ReS
B%F>;
B%F>;
k:\qz&P
k:\qz&P
j%u%#o
j%u%#o
.h.PV
.h.PV
L0.vJ
L0.vJ
N.%X$dY9w
N.%X$dY9w
!sSN%d
!sSN%d
AT%7U
AT%7U
.-r}`
.-r}`
46.Xtd
46.Xtd
"S.aY:?C
"S.aY:?C
xd.GdQ
xd.GdQ
.sJTu
.sJTu
Mi%U4t
Mi%U4t
H%SI8
H%SI8
g.DlP
g.DlP
aSq%f
aSq%f
.qpRC
.qpRC
NKEY
NKEY
A.kVN
A.kVN
M.kg3
M.kg3
CG%FY
CG%FY
.MOKQ0
.MOKQ0
r.vYp
r.vYp
%sPH-Z
%sPH-Z
$%.X}
$%.X}
.Oav41
.Oav41
l.lX3i c
l.lX3i c
rg.rnd
rg.rnd
.Qe*|>
.Qe*|>
.Ls6.
.Ls6.
.oe >
.oe >
.%CVs
.%CVs
OL6.Jx4
OL6.Jx4
Vc.Gi$
Vc.Gi$
%xla-j
%xla-j
s.ggm
s.ggm
>P.ud.@
>P.ud.@
QTj.XF7
QTj.XF7
%se]*
%se]*
F%Fq@
F%Fq@
R.ewP
R.ewP
e
e
7L.dD
7L.dD
DJR.ka
DJR.ka
.wM_g
.wM_g
F%5Xw
F%5Xw
)&.ZW
)&.ZW
%c] k
%c] k
.XNRLb
.XNRLb
Oy6CrTvI
Oy6CrTvI
.IOLIP
.IOLIP
o|.Mg
o|.Mg
%X*]~
%X*]~
!7G%S
!7G%S
uU.un)xj
uU.un)xj
T6.Au
T6.Au
=.HC*c
=.HC*c
.rX_Gb
.rX_Gb
y4.ua
y4.ua
.ACFA
.ACFA
R3.Yh
R3.Yh
u.jF]
u.jF]
UR.Oq
UR.Oq
.DT$TkNH
.DT$TkNH
H.qQKf
H.qQKf
%UR=yL
%UR=yL
B.nQRT\
B.nQRT\
\o.FO
\o.FO
!.grS
!.grS
XY%sD2
XY%sD2
.md9`f
.md9`f
.di0"
.di0"
.DrFQ
.DrFQ
@d%dZ
@d%dZ
ð'o
ð'o
S].cHEN
S].cHEN
}Ú-'
}Ú-'
9B.Gc
9B.Gc
.sECiu
.sECiu
i@Âg
i@Âg
.tl|R
.tl|R
J.SgkDz
J.SgkDz
9k%x0K[|
9k%x0K[|
Fyx%d
Fyx%d
~R(U5-N}[e
~R(U5-N}[e
.BvmD
.BvmD
[9eXE&
[9eXE&
;o.Wh
;o.Wh
81%uv
81%uv
AH%D
AH%D
Pg.WI9
Pg.WI9
[/%7S
[/%7S
D-ut}{>
D-ut}{>
pR.CsHU
pR.CsHU
.WUB&N_
.WUB&N_
zvF.ua
zvF.ua
Vd.RE
Vd.RE
AwrS%c
AwrS%c
.No]\7*
.No]\7*
.egB~
.egB~
pE.Ji
pE.Ji
/t%Ux
/t%Ux
~f[%D
~f[%D
;.Ts6d
;.Ts6d
`/.YlA
`/.YlA
%Uw?f
%Uw?f
i.Hq]6
i.Hq]6
.DQ8X/
.DQ8X/
J-!.ec
J-!.ec
I0E.Yo
I0E.Yo
|/E4.Ot
|/E4.Ot
jQ.jQ
jQ.jQ
|Øn
|Øn
.RIpL
.RIpL
u%s0 =
u%s0 =
`?{m.Bd
`?{m.Bd
B%SDO
B%SDO
.zT"4
.zT"4
&.HM4
&.HM4
hWuO
hWuO
.xaM!L
.xaM!L
7.JIZ
7.JIZ
-W.xx
-W.xx
^BÛ
^BÛ
A@h%D~
A@h%D~
.xesu
.xesu
.NI|k
.NI|k
?g%.yD
?g%.yD
cMbQ%D
cMbQ%D
oP%%Cl
oP%%Cl
:Zi'.Fd
:Zi'.Fd
j%X$;x
j%X$;x
`‡Cq(
`‡Cq(
NC@%u
NC@%u
E.asg|
E.asg|
qx.Xf
qx.Xf
N6N%X=
N6N%X=
e0sIsx|#%f
e0sIsx|#%f
y6W%C
y6W%C
Þ_}IW
Þ_}IW
oV.&%s
oV.&%s
|dSsh
|dSsh
Pl.Av
Pl.Av
P.Ssg
P.Ssg
.RUJE
.RUJE
W.ypJ
W.ypJ
8..Ub
8..Ub
DdÙ{
DdÙ{
.Jq_T3
.Jq_T3
.DOJK
.DOJK
c'.SU
c'.SU
)%2x.
)%2x.
k[.Ff
k[.Ff
0.edfT?y
0.edfT?y
00uDp
00uDp
%sB4t
%sB4t
}.jd`
}.jd`
.zU?
.zU?
Q.DgZ
Q.DgZ
[rP%fT
[rP%fT
uq@og
uq@og
yfS~%U
yfS~%U
\7%QYvQ.RL
\7%QYvQ.RL
J.KPh
J.KPh
3fm%D
3fm%D
,/.oiB~
,/.oiB~
X?%ShHm
X?%ShHm
r.gyb
r.gyb
%Xz`F
%Xz`F
|IyQ.lDS
|IyQ.lDS
1.Xf>
1.Xf>
Y.sd>
Y.sd>
52%dUI!
52%dUI!
J.gxK
J.gxK
T^6~.BeXo
T^6~.BeXo
-6.Ni
-6.Ni
6.eJE
6.eJE
m>SsH
m>SsH
c;.aZ
c;.aZ
.RWlf
.RWlf
%f=%m1
%f=%m1
?C,CRt
?C,CRt
vR%fgU
vR%fgU
4.IDK|
4.IDK|
;jbl~.vU
;jbl~.vU
.YljS
.YljS
%Xf`X
%Xf`X
%dwv{UR
%dwv{UR
{a-ZS}
{a-ZS}
-T}%D"
-T}%D"
q.qmH
q.qmH
7) `%u
7) `%u
t.cP
t.cP
q%F[7
q%F[7
DtR.qp
DtR.qp
%Dyx_Y
%Dyx_Y
.DyTh
.DyTh
of
of
x-K}c
x-K}c
?~%u
?~%u
q.XPIU
q.XPIU
Y(.GI
Y(.GI
U7"%5x
U7"%5x
:N*%f
:N*%f
B(.Lu
B(.Lu
.Tn@}
.Tn@}
~X%d,
~X%d,
crv-8f}
crv-8f}
.Hg*"
.Hg*"
_Y.wx
_Y.wx
Uh>-7}
Uh>-7}
&.NDZTR5
&.NDZTR5
,r".CpADv
,r".CpADv
.qb9nV
.qb9nV
m$s.PR
m$s.PR
O.hVV
O.hVV
e$Ÿ
e$Ÿ
_&.Js3
_&.Js3
bK.Jn
bK.Jn
i[.dxV
i[.dxV
vp%DR
vp%DR
G.NvNh
G.NvNh
)r.Rr
)r.Rr
p1.gkO
p1.gkO
os.RtK
os.RtK
W'$.pS
W'$.pS
Cq%cQg
Cq%cQg
.SOH&
.SOH&
^0.IX
^0.IX
u x-%D'
u x-%D'
.Wr9s
.Wr9s
).gO.F&z
).gO.F&z
m.mxn|
m.mxn|
.Buu|
.Buu|
dYR .GU
dYR .GU
k.Ri>D
k.Ri>D
|úR
|úR
GW.Sz2
GW.Sz2
:.lp^
:.lp^
}"1J
}"1J
hr%FW
hr%FW
.Br|/)
.Br|/)
#i.Hb]
#i.Hb]
g.wv|`
g.wv|`
qm.Nu
qm.Nu
.km3V^=Q
.km3V^=Q
h02Q`.zF
h02Q`.zF
}5%c
}5%c
%X#k2
%X#k2
0P^%X
0P^%X
=%x.J
=%x.J
t_y$%U
t_y$%U
b%Xz#@/
b%Xz#@/
,~.jM(
,~.jM(
Q'%Ug
Q'%Ug
d.vaC
d.vaC
8%Xat
8%Xat
F.ZX!
F.ZX!
%OQ.gU
%OQ.gU
&]%1S
&]%1S
/ Q\%X mM
/ Q\%X mM
ÊUE
ÊUE
ÃK1
ÃK1
bv/.WW
bv/.WW
>[%DK
>[%DK
.PcxF
.PcxF
%C>u 1OW7)
%C>u 1OW7)
ql1O.eM
ql1O.eM
%F}RX
%F}RX
)C.uB
)C.uB
,su.gG
,su.gG
.qrY!.%8]
.qrY!.%8]
Ht%Xy
Ht%Xy
j.${,%s
j.${,%s
d1.TC
d1.TC
M2.zb
M2.zb
ri.hf=t
ri.hf=t
h%6xu
h%6xu
2%URT
2%URT
V.?|%sSx
V.?|%sSx
:D4.RW
:D4.RW
%1.Wz
%1.Wz
%Dva"
%Dva"
uRLu
uRLu
bh%x,El
bh%x,El
T%CU?Kg
T%CU?Kg
AR:%Dtv1E
AR:%Dtv1E
t%sVo
t%sVo
#i.uH
#i.uH
%Ch.M
%Ch.M
.laQmQ
.laQmQ
.jfG!'
.jfG!'
k.kM&
k.kM&
%cU80WA
%cU80WA
%Uk0%>;
%Uk0%>;
d.EmY
d.EmY
-5%x=4
-5%x=4
.jFW6
.jFW6
kHN%8xh
kHN%8xh
%Upcfj
%Upcfj
~%Ut3o
~%Ut3o
K .Zq
K .Zq
6v.eLD
6v.eLD
.nXO}
.nXO}
#[2%d
#[2%d
L-2Gs}
L-2Gs}
DÔ@
DÔ@
@%d"j9
@%d"j9
k.rZs
k.rZs
%cu#I
%cu#I
.B^.Np#
.B^.Np#
%uEVo`i
%uEVo`i
$:.et
$:.et
-X.kJ
-X.kJ
.mq&.7
.mq&.7
T%u.%
T%u.%
E.DsJ
E.DsJ
e-.ap
e-.ap
*:.Bdj
*:.Bdj
.ZX 6
.ZX 6
e/dL{wlZ.HK
e/dL{wlZ.HK
s.tpp
s.tpp
!.Cdpn
!.Cdpn
.DCfb'
.DCfb'
,3-=]`66
,3-=]`66
.bgjw\
.bgjw\
b#.NR
b#.NR
y`.WH,
y`.WH,
-dc}Q/
-dc}Q/
LH%x.
LH%x.
(Nu%D{
(Nu%D{
4/.yhr
4/.yhr
H %uU
H %uU
jE2%D
jE2%D
.Ek9Q0
.Ek9Q0
crtEx
crtEx
A1@%CG
A1@%CG
MW%Ciy
MW%Ciy
.Gla"(3
.Gla"(3
~HtF>TET%fyo
~HtF>TET%fyo
'fTPA%`
'fTPA%`
s^%U"
s^%U"
C1%s/
C1%s/
.Iv!V
.Iv!V
F]ct.eZ
F]ct.eZ
r.wXU
r.wXU
DO9 U|
DO9 U|
!&!y qoi%X
!&!y qoi%X
%SbzN
%SbzN
%S*Ah*M
%S*Ah*M
`.dL5
`.dL5
.ppe[?
.ppe[?
O2p>.FllQ
O2p>.FllQ
gw.WN
gw.WN
.pwW.)dRZW
.pwW.)dRZW
.dor!
.dor!
@Yp%F
@Yp%F
-.DO`P
-.DO`P
A%x6F
A%x6F
@>.qGI
@>.qGI
O
O
#T.ot
#T.ot
%fRLI
%fRLI
Kk-F}
Kk-F}
j.Hg6N_r1
j.Hg6N_r1
f8n%dG
f8n%dG
@Z@-%D@
@Z@-%D@
`%x3oxA
`%x3oxA
PBMc(V%um
PBMc(V%um
w".av
w".av
5.dYgCA
5.dYgCA
.rYIh
.rYIh
.koZK__/
.koZK__/
$.kq'
$.kq'
rJ.Gy
rJ.Gy
Bqt%cO
Bqt%cO
GEG%5S
GEG%5S
<.swp1p>
<.swp1p>
MG.yZ
MG.yZ
"yo%U
"yo%U
.Ff#
.Ff#
T?%u|q
T?%u|q
.uUHH
.uUHH
%sQA
%sQA
0_9`( %]
0_9`( %]
:1*.\.gw
:1*.\.gw
.rk}c
.rk}c
n~?.qgpbpo
n~?.qgpbpo
aq.fyLt;
aq.fyLt;
M)'vy%Cr
M)'vy%Cr
.BH8J
.BH8J
c9.vG
c9.vG
vsy%U
vsy%U
E:`#%f&
E:`#%f&
LdS.da
LdS.da
nKD:.fZo
nKD:.fZo
%D~M9
%D~M9
}kL.yg
}kL.yg
w=.LE
w=.LE
<.ebr>
<.ebr>
b"%X0
b"%X0
:cRtlN
:cRtlN
M"Ì
M"Ì
6uMo%.jlB
6uMo%.jlB
.|.DFI
.|.DFI
K%Dv_
K%Dv_
.kJmi
.kJmi
9t%5S
9t%5S
.jHdX
.jHdX
.ZfJc
.ZfJc
.jO&\"L&x
.jO&\"L&x
.tb{G
.tb{G
s.bs~
s.bs~
.Fn,Agz/#OUv
.Fn,Agz/#OUv
<.xd>
<.xd>
.jx}D
.jx}D
.qDwz
.qDwz
spc.ft
spc.ft
r'R%d
r'R%d
]%f)L`Db
]%f)L`Db
!.zU(eGOWw
!.zU(eGOWw
X%x{KRw
X%x{KRw
?T^EyH.KO
?T^EyH.KO
y<.sd>
y<.sd>
?CtcP
?CtcP
.Bh` Noy
.Bh` Noy
X.KV
X.KV
%.OS0
%.OS0
aE%Ug
aE%Ug
Y>O.Rp
Y>O.Rp
I.Xy`
I.Xy`
.oR2B
.oR2B
.vlQS
.vlQS
XXo%so
XXo%so
-QT;.mw
-QT;.mw
u&.Geh
u&.Geh
iM%d
iM%d
4-h}x
4-h}x
w-i}$
w-i}$
Q.El3
Q.El3
mJfTP
mJfTP
7.uY:
7.uY:
uiq%X
uiq%X
`V.XV
`V.XV
5n;%U
5n;%U
V:.Kz
V:.Kz
Cn.mZ
Cn.mZ
Jb.ung
Jb.ung
.mUI1
.mUI1
%S`t$
%S`t$
"c.oL
"c.oL
tn%ub
tn%ub
!|ÿp
!|ÿp
E1.Di=,
E1.Di=,
.KsgG
.KsgG
8R.rM:y
8R.rM:y
.TKjT9
.TKjT9
;.XQq9
;.XQq9
7D.cV/W
7D.cV/W
f.QbA
f.QbA
'K.uC
'K.uC
.inK2
.inK2
EÖp
EÖp
.oqJO
.oqJO
}%xi]R
}%xi]R
mnG.Et:
mnG.Et:
5k:.Vk
5k:.Vk
c?
c?
b.UJi
b.UJi
k%.ox`
k%.ox`
}f~F~.hj:tv
}f~F~.hj:tv
'.xT3
'.xT3
PTM%uX
PTM%uX
.gglM
.gglM
.Gf`Mv
.Gf`Mv
mbW.jw^LK
mbW.jw^LK
Q%xx*
Q%xx*
-.Rbz
-.Rbz
{)%xl~
{)%xl~
%xhMv
%xhMv
%c(M)
%c(M)
.Aa=6
.Aa=6
v .re
v .re
`ij.zN
`ij.zN
%S]S*
%S]S*
%Fgh;
%Fgh;
~#x%X#)
~#x%X#)
.AE.\
.AE.\
.yEYOb
.yEYOb
.UROu
.UROu
%SEON
%SEON
aV%x1
aV%x1
)xþ
)xþ
.Ykxg
.Ykxg
j.Bm1
j.Bm1
Oaà d
Oaà d
.HzFt
.HzFt
&.Rl-Y
&.Rl-Y
't%cM|u
't%cM|u
8!%SAB
8!%SAB
l1w4sShm
l1w4sShm
v6.NZ
v6.NZ
]TSFl
]TSFl
=v|?
=v|?
kSsht,5f
kSsht,5f
u.wese1G
u.wese1G
-rp%x|37sA
-rp%x|37sA
#&%sK
#&%sK
.Yetm_
.Yetm_
A.DNN
A.DNN
-K}M[
-K}M[
c].Oi
c].Oi
.JZp4
.JZp4
J.MQ6
J.MQ6
.XR,{a
.XR,{a
afTp
afTp
y.bt.
y.bt.
f%Xq!j
f%Xq!j
%uT7N;
%uT7N;
sÂ~
sÂ~
JP.hH
JP.hH
.wAzAbv
.wAzAbv
%SwU/
%SwU/
,%sFqV
,%sFqV
.wfKL
.wfKL
8:.xZ
8:.xZ
%sbf:d
%sbf:d
%fq%2
%fq%2
iA~Y8%X
iA~Y8%X
[-,%U
[-,%U
Wú|
Wú|
dwf%x
dwf%x
U.Fj"
U.Fj"
0.1%xB
0.1%xB
?%cy`
?%cy`
Fsql
Fsql
d.aD`
d.aD`
1`%fRP
1`%fRP
H&%.c
H&%.c
.BZ
.BZ
..zB@
..zB@
-.aK"
-.aK"
y.yz^
y.yz^
o.Nm}
o.Nm}
q$.BN
q$.BN
rY.mI
rY.mI
;{.gn5
;{.gn5
3:y%D
3:y%D
N5?%chhzU
N5?%chhzU
HbÉ|
HbÉ|
.qx4m
.qx4m
.fietD
.fietD
n.EgN
n.EgN
.aXE7
.aXE7
-kq3}
-kq3}
u%XyU
u%XyU
F.We3@
F.We3@
[<5>
<5>
&
&
&G
&G
&
&
&
&
&
&
&
&
&
&
&
&
&f.vp
&f.vp
&L
&L
&
&
&
&
&
&
&
&
&M
&M
&
&
<.mmej>
<.mmej>
&h3.EK
&h3.EK
<.qv>
<.qv>
&
&
<.at>
<.at>
&
&
&TD
&TD
&
&
&
&
&b
&b
&
&
&
&
&Ih
&Ih
<.yv>
<.yv>
&O.UW
&O.UW
&
&
&
&
&
&
&
&
&
&
&
&
&q
&q
&
&
&tlD
&tlD
<.hob>
<.hob>
&
&
&pÃ
&pÃ
&
&
&
&
&
&
&
&
&
&
&z
&z
&
&
&l.dtI4
&l.dtI4
&T
&T
<.jse>
<.jse>
&X
&X
&
&
&
&
&M
&M
&k.mc
&k.mc
&
&
&
&
&
&
&
&
<.lp>
<.lp>
&
&
&o
&o
&
&
&
&
&
&
&
&
&j.Lb9
&j.Lb9
&
&
&U.Tv
&U.Tv
&
&
<.jqcc>
<.jqcc>
&
&
&
&
&ioo
&ioo
&
&
&Aipm6
&Aipm6
&z
&z
<.jr>
<.jr>
&
&
&w
&w
<.zn->
<.zn->
<.dn>
<.dn>