Trojan.Win32.Swrort.3_7c542e0abb

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

CatalinaUpdate.exe:1196
CatalinaUpdate.exe:1072
CatalinaUpdate.exe:352
citrio_50.0.2661.271_1.exe:328
%original file name%.exe:1108

The Trojan injects its code into the following process(es):

CatalinaUpdate.exe:1628
CatalinaUpdate.exe:424

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process CatalinaUpdate.exe:1072 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\Install\{2FEF2209-C78C-4B55-BBBF-5B577A5DB7CF}\citrio_50.0.2661.271_1.exe (449813 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\Download\{92F8A219-E740-49D5-B785-B962AD819724}\50.0.2661.271\citrio_50.0.2661.271_1.exe (449813 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\Install (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{70EEF915-5846-40C2-8A2A-3236CCECD222}-citrio_50.0.2661.271_1.exe (0 bytes)

The process CatalinaUpdate.exe:424 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_te.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ca.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ru.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_nl.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_fi.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_pl.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_fr.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\psmachine.dll (673 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_uk.dll (26 bytes)
%WinDir%\Tasks\CatalinaGroupUpdateTaskUserS-1-5-21-1844237615-1960408961-1801674531-1003Core.job (948 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_th.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_zh-TW.dll (19 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_vi.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_es-419.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdate.dll (5873 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_fil.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ta.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_tr.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ar.dll (24 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_sk.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_is.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_mr.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_sw.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_es.dll (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_hr.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ja.dll (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_kn.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_en.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_en-GB.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\psuser.dll (673 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_no.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ml.dll (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\CatalinaUpdateHelper.msi (36 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ur.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_am.dll (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_pt-BR.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\CatalinaUpdate.exe (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_bn.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_sv.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_et.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_gu.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_da.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\CatalinaUpdate.exe (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_fa.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ms.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_sr.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_sl.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_hu.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_cs.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_iw.dll (23 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_lt.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ko.dll (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_el.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_hi.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_lv.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_zh-CN.dll (19 bytes)
%WinDir%\Tasks\CatalinaGroupUpdateTaskUserS-1-5-21-1844237615-1960408961-1801674531-1003UA.job (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_de.dll (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_id.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\CatalinaUpdateOnDemand.exe (58 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_pt-PT.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_bg.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\npCatalinaUpdate3.dll (1281 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\CatalinaUpdateBroker.exe (58 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\CatalinaCrashHandler.exe (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ro.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_it.dll (28 bytes)

The process citrio_50.0.2661.271_1.exe:328 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\CR_35172.tmp\CITRIO.PACKED.7Z (443233 bytes)

The process %original file name%.exe:1108 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_sl.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_gu.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUT2.tmp (22433 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_nl.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_te.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_sk.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_el.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ru.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_es-419.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_iw.dll (23 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_no.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_tr.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_sr.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_en-GB.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_da.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ro.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_uk.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_zh-TW.dll (19 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_bn.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ms.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ta.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\CatalinaUpdateBroker.exe (58 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_es.dll (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdate.dll (1990 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_sw.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_de.dll (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_is.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_sv.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_fr.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_en.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_cs.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_mr.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_pt-BR.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_fa.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_kn.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_bg.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_pt-PT.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_id.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_fi.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ja.dll (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\npCatalinaUpdate3.dll (236 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\psuser.dll (161 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ml.dll (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ko.dll (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_th.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ca.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_vi.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_hi.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_zh-CN.dll (19 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_lv.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_hu.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\CatalinaUpdate.exe (130 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ar.dll (24 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_pl.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_hr.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\CatalinaUpdateHelper.msi (36 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_lt.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_et.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_am.dll (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\psmachine.dll (155 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\CatalinaCrashHandler.exe (130 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_it.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_fil.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ur.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\CatalinaUpdateOnDemand.exe (58 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp (0 bytes)

Registry activity

The process CatalinaUpdate.exe:1628 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A3 AE 30 74 75 52 F0 D2 48 88 45 5A 3F 04 41 B2"

[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"usagestats" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\CatalinaGroup\Update]
"eulaaccepted"

The process CatalinaUpdate.exe:1196 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "39 E6 8D B6 05 15 FF 56 C6 CF D5 2E AE EB C5 33"

[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Integers]
"windows_sp_major_version" = "03 00 00 00 00 00 00 00"

[HKCU\Software\CatalinaGroup\Update\proxy]
"source" = "IE"

[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Integers]
"windows_minor_version" = "01 00 00 00 00 00 00 00"

[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Counts]
"goopdate_main" = "02 00 00 00 00 00 00 00"

[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Integers]
"windows_major_version" = "05 00 00 00 00 00 00 00"

[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Counts]
"goopdate_constructor" = "02 00 00 00 00 00 00 00"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\CatalinaGroup\Update\network\secure]
"sk"
"c"

The process CatalinaUpdate.exe:1072 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "69 7C B9 28 2B 46 ED 96 67 EB 8C 5B 53 35 84 3D"

[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"usagestats" = "1"
"brand" = "GGLS"
"InstallTime" = "1466806569"
"referral" = "1:citrio_website"
"lang" = "en"

[HKCU\Software\CatalinaGroup\Update\proxy]
"source" = "IE"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\CatalinaGroup\Update]
"LastInstallerError"

[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"LastInstallerExtraCode1"
"browser"
"LastInstallerError"
"ap"
"LastInstallerSuccessLaunchCmdLine"
"eulaaccepted"
"experiment_labels"

[HKCU\Software\CatalinaGroup\Update]
"LastInstallerResultUIString"

[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"LastInstallerResult"
"LastInstallerResultUIString"
"tttoken"

[HKCU\Software\CatalinaGroup\Update]
"LastInstallerExtraCode1"
"LastInstallerSuccessLaunchCmdLine"
"LastInstallerResult"

[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"iid"

The process CatalinaUpdate.exe:424 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\MozillaPlugins\@catalinahub.net/CatalinaGroup Update;version=9]
"vendor" = "Catalina Group Ltd."
"ProductName" = "CatalinaGroup Update"

[HKCU\Software\CatalinaGroup\Update\ClientState\{6C598730-F715-407B-A7AE-A8F10D0F8FA7}]
"iid" = "{E8AFF3B0-E0F0-4E23-88FB-2BC4E61DD1B2}"

[HKCU\Software\CatalinaGroup\Update]
"UID" = "{42A822E6-E430-44A0-800A-9D2632BBAFDB}"

[HKCU\Software\Classes\MIME\Database\Content Type\application/x-vnd.catalinahub.oneclickctrl.9]
"CLSID" = "{841F4080-C687-4E9C-BD6E-EB5EECF4FAE6}"

[HKCU\Software\Classes\CatalinaGroup.OneClickCtrl.9\CLSID]
"(Default)" = "{841F4080-C687-4E9C-BD6E-EB5EECF4FAE6}"

[HKCU\Software\Classes\CLSID\{841F4080-C687-4E9C-BD6E-EB5EECF4FAE6}]
"(Default)" = "CatalinaGroup Update Plugin"

[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{71216BD6-4D03-4387-BD01-7FE8D9512541}]
"Policy" = "3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Classes\MIME\Database\Content Type\application/x-vnd.catalinahub.update3webcontrol.3]
"CLSID" = "{71216BD6-4D03-4387-BD01-7FE8D9512541}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{841F4080-C687-4E9C-BD6E-EB5EECF4FAE6}]
"AppName" = "CatalinaUpdate.exe"

[HKCU\Software\CatalinaGroup\Update]
"Version" = "1.3.25.223"

[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"usagestats" = "1"

[HKCU\Software\MozillaPlugins\@catalinahub.net/CatalinaGroup Update;version=9]
"Description" = "CatalinaGroup Update"

[HKCU\Software\CatalinaGroup\Update\Clients\{6C598730-F715-407B-A7AE-A8F10D0F8FA7}]
"Name" = "Catalina Update"

[HKCU\Software\CatalinaGroup\Update\ClientState\{6C598730-F715-407B-A7AE-A8F10D0F8FA7}]
"InstallTime" = "1466806504"

[HKCU\Software\Classes\CLSID\{841F4080-C687-4E9C-BD6E-EB5EECF4FAE6}\InprocServer32]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\npCatalinaUpdate3.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Classes\CatalinaGroup.Update3WebControl.3]
"(Default)" = "CatalinaGroup Update Plugin"

[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{841F4080-C687-4E9C-BD6E-EB5EECF4FAE6}]
"Policy" = "3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update]
"CatalinaUpdate.exe" = "CatalinaGroup Update"

[HKCU\Software\Classes\CLSID\{841F4080-C687-4E9C-BD6E-EB5EECF4FAE6}\ProgID]
"(Default)" = "CatalinaGroup.OneClickCtrl.9"

[HKCU\Software\MozillaPlugins\@catalinahub.net/CatalinaGroup Update;version=9]
"Path" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\npCatalinaUpdate3.dll"

[HKCU\Software\Classes\CLSID\{841F4080-C687-4E9C-BD6E-EB5EECF4FAE6}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\MozillaPlugins\@catalinahub.net/CatalinaGroup Update;version=3]
"Description" = "CatalinaGroup Update"
"ProductName" = "CatalinaGroup Update"

[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{841F4080-C687-4E9C-BD6E-EB5EECF4FAE6}]
"AppPath" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update"

[HKCU\Software\MozillaPlugins\@catalinahub.net/CatalinaGroup Update;version=3]
"vendor" = "Catalina Group Ltd."

[HKCU\Software\Classes\CLSID\{71216BD6-4D03-4387-BD01-7FE8D9512541}\InprocServer32]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\npCatalinaUpdate3.dll"

[HKCU\Software\MozillaPlugins\@catalinahub.net/CatalinaGroup Update;version=9]
"Version" = "9"

[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{71216BD6-4D03-4387-BD01-7FE8D9512541}]
"AppPath" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223"

[HKCU\Software\CatalinaGroup\Update\ClientState\{6C598730-F715-407B-A7AE-A8F10D0F8FA7}]
"pv" = "1.3.25.223"

[HKCU\Software\Classes\CatalinaGroup.Update3WebControl.3\CLSID]
"(Default)" = "{71216BD6-4D03-4387-BD01-7FE8D9512541}"

[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{71216BD6-4D03-4387-BD01-7FE8D9512541}]
"AppName" = "CatalinaUpdateOnDemand.exe"

[HKCU\Software\CatalinaGroup\Update]
"Path" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\CatalinaUpdate.exe"

[HKCU\Software\MozillaPlugins\@catalinahub.net/CatalinaGroup Update;version=3]
"Version" = "3"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "17 D0 2A 8C 2A CA F4 0A 71 ED 7E 55 5B 02 F7 03"

[HKCU\Software\Classes\CLSID\{71216BD6-4D03-4387-BD01-7FE8D9512541}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\CatalinaGroup\Update\Clients\{6C598730-F715-407B-A7AE-A8F10D0F8FA7}]
"pv" = "1.3.25.223"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Classes\CLSID\{71216BD6-4D03-4387-BD01-7FE8D9512541}\ProgID]
"(Default)" = "CatalinaGroup.Update3WebControl.3"

[HKCU\Software\MozillaPlugins\@catalinahub.net/CatalinaGroup Update;version=3]
"Path" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\npCatalinaUpdate3.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Classes\CatalinaGroup.OneClickCtrl.9]
"(Default)" = "CatalinaGroup Update Plugin"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Classes\CLSID\{71216BD6-4D03-4387-BD01-7FE8D9512541}]
"(Default)" = "CatalinaGroup Update Plugin"

[HKCU\Software\CatalinaGroup\Update\ClientState\{6C598730-F715-407B-A7AE-A8F10D0F8FA7}]
"brand" = "GGLS"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"CatalinaGroup Update" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\CatalinaUpdate.exe /c"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\CatalinaGroup\Update]
"eulaaccepted"
"ui"
"LastChecked"

[HKCU\Software\CatalinaGroup\Update\ClientState\{6C598730-F715-407B-A7AE-A8F10D0F8FA7}]
"UpdateAvailableSince"
"UpdateAvailableCount"

The process CatalinaUpdate.exe:352 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{13660822-39AC-408C-BA99-702EBEE3EF26}]
"CLSID" = "{13660822-39AC-408C-BA99-702EBEE3EF26}"

[HKCU\Software\Classes\Interface\{A2589E53-1490-4C0A-BFC7-A47B7A88E3D8}]
"(Default)" = "ICatalinaUpdate3WebSecurity"

[HKCU\Software\Classes\CatalinaGroupUpdate.Update3COMClassUser]
"(Default)" = "Update3COMClass"

[HKCU\Software\Classes\Interface\{0E09406F-1420-4BF4-B6EB-F0994674AD68}]
"(Default)" = "IAppBundle"

[HKCU\Software\Classes\Interface\{3EA78C6E-8267-4554-8EC6-8982D5AF539A}]
"(Default)" = "ICoCreateAsyncStatus"

[HKCU\Software\Classes\Interface\{0E09406F-1420-4BF4-B6EB-F0994674AD68}\NumMethods]
"(Default)" = "39"

[HKCU\Software\Classes\CLSID\{F4CBF20B-F634-4095-B64A-2EBCDD9E560E}\InprocServer32]
"ThreadingModel" = "Both"

[HKCU\Software\Classes\Interface\{34F067BE-C79C-4C5F-8E64-622A3CC59055}\ProxyStubClsid32]
"(Default)" = "{793865C6-3633-42FA-B959-055A87BF596A}"

[HKCU\Software\Classes\CLSID\{793865C6-3633-42FA-B959-055A87BF596A}]
"(Default)" = "PSFactoryBuffer"

[HKCU\Software\Classes\CLSID\{13660822-39AC-408C-BA99-702EBEE3EF26}\LocalServer32]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\CatalinaUpdateOnDemand.exe"

[HKCU\Software\Classes\Interface\{23185EAB-61B0-4B70-BE89-589585B91392}\NumMethods]
"(Default)" = "8"

[HKCU\Software\Classes\Interface\{C1D8630A-9D2D-4E0E-A4A1-8AA5CA3FAE57}\ProxyStubClsid32]
"(Default)" = "{793865C6-3633-42FA-B959-055A87BF596A}"

[HKCU\Software\Classes\CLSID\{C8362D5A-4303-4E22-8668-BB10D65B95BD}\VersionIndependentProgID]
"(Default)" = "CatalinaGroupUpdate.OnDemandCOMClassUser"

[HKCU\Software\Classes\CLSID\{2823499B-60F3-4940-8042-2C16D5829A39}\VersionIndependentProgID]
"(Default)" = "CatalinaGroupUpdate.Update3WebUser"

[HKCU\Software\Classes\Interface\{7A1A1D82-1E2B-41B8-9FA3-F40D8DD3EEF0}\ProxyStubClsid32]
"(Default)" = "{793865C6-3633-42FA-B959-055A87BF596A}"

[HKCU\Software\Classes\Interface\{263B5A28-834A-4D1B-AB71-A28E882CC59B}\NumMethods]
"(Default)" = "13"

[HKCU\Software\Classes\CatalinaGroupUpdate.CredentialDialogUser]
"(Default)" = "GoogleUpdate CredentialDialog"

[HKCU\Software\Classes\Interface\{7C9F9415-9947-482C-A62B-24A0BD92B8A7}\NumMethods]
"(Default)" = "4"

[HKCU\Software\Classes\Interface\{A2589E53-1490-4C0A-BFC7-A47B7A88E3D8}\ProxyStubClsid32]
"(Default)" = "{793865C6-3633-42FA-B959-055A87BF596A}"

[HKCU\Software\Classes\Interface\{C1D8630A-9D2D-4E0E-A4A1-8AA5CA3FAE57}]
"(Default)" = "ICredentialDialog"

[HKCU\Software\Classes\Interface\{A1E6F38D-8C9E-4BDA-86A2-1940472A8429}]
"(Default)" = "ICatalinaUpdate"

[HKCU\Software\Classes\Interface\{FFC6ECB2-25E8-40EE-BF37-5AA25CBCBA63}\NumMethods]
"(Default)" = "10"

[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Counts]
"goopdate_main" = "01 00 00 00 00 00 00 00"

[HKCU\Software\Classes\Interface\{D085AC3B-E5CC-40C9-8366-C12ADC489967}\ProxyStubClsid32]
"(Default)" = "{793865C6-3633-42FA-B959-055A87BF596A}"

[HKCU\Software\Classes\Interface\{789E3792-8514-4ED5-90F3-5B525275B953}\ProxyStubClsid32]
"(Default)" = "{793865C6-3633-42FA-B959-055A87BF596A}"

[HKCU\Software\Classes\Interface\{FCD277CC-8D3E-4264-80D3-98E7B05E2E8A}\ProxyStubClsid32]
"(Default)" = "{793865C6-3633-42FA-B959-055A87BF596A}"

[HKCU\Software\Classes\CLSID\{3C564FFE-55F7-43AC-886C-7E9E9091CB2A}]
"(Default)" = "Update3COMClass"

[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Integers]
"windows_sp_major_version" = "03 00 00 00 00 00 00 00"

[HKCU\Software\Classes\CLSID\{73436A91-85A6-4850-A7D0-375C4E369A5A}\ProgID]
"(Default)" = "CatalinaGroupUpdate.CredentialDialogUser.1.0"

[HKCU\Software\Classes\CLSID\{8FDC0C15-3A1A-4B3D-B04F-B725F5699C25}\InprocHandler32]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\psuser.dll"

[HKCU\Software\Classes\CLSID\{13660822-39AC-408C-BA99-702EBEE3EF26}]
"(Default)" = "CatalinaGroup.OneClickProcessLauncher"

[HKCU\Software\Classes\Interface\{263B5A28-834A-4D1B-AB71-A28E882CC59B}\ProxyStubClsid32]
"(Default)" = "{793865C6-3633-42FA-B959-055A87BF596A}"

[HKCU\Software\Classes\CLSID\{C8362D5A-4303-4E22-8668-BB10D65B95BD}]
"(Default)" = "Google Update Legacy On Demand"

[HKCU\Software\Classes\CatalinaGroupUpdate.Update3WebUser\CurVer]
"(Default)" = "CatalinaGroupUpdate.Update3WebUser.1.0"

[HKCU\Software\Classes\Interface\{FCD277CC-8D3E-4264-80D3-98E7B05E2E8A}\NumMethods]
"(Default)" = "10"

[HKCU\Software\Classes\Interface\{CBAC6FCC-819A-443D-98BB-E7A122DCCAE3}\NumMethods]
"(Default)" = "4"

[HKCU\Software\Classes\Interface\{7C9F9415-9947-482C-A62B-24A0BD92B8A7}\ProxyStubClsid32]
"(Default)" = "{793865C6-3633-42FA-B959-055A87BF596A}"

[HKCU\Software\Classes\Interface\{0CD725CD-5650-4F13-91DA-E42FAA9687E8}\ProxyStubClsid32]
"(Default)" = "{793865C6-3633-42FA-B959-055A87BF596A}"

[HKCU\Software\Classes\CatalinaGroupUpdate.Update3WebUser\CLSID]
"(Default)" = "{2823499B-60F3-4940-8042-2C16D5829A39}"

[HKCU\Software\Classes\Interface\{FCD277CC-8D3E-4264-80D3-98E7B05E2E8A}]
"(Default)" = "IAppVersionWeb"

[HKCU\Software\Classes\CLSID\{793865C6-3633-42FA-B959-055A87BF596A}\InProcServer32]
"ThreadingModel" = "Both"

[HKCU\Software\Classes\Interface\{84BA4DAC-82EA-4DC8-BCB0-B69DD6E95670}\ProxyStubClsid32]
"(Default)" = "{793865C6-3633-42FA-B959-055A87BF596A}"

[HKCU\Software\Classes\Interface\{F009E353-D4BD-42FE-994E-F6C315055F9B}\ProxyStubClsid32]
"(Default)" = "{793865C6-3633-42FA-B959-055A87BF596A}"

[HKCU\Software\Classes\CatalinaGroupUpdate.Update3COMClassUser\CurVer]
"(Default)" = "CatalinaGroupUpdate.Update3COMClassUser.1.0"

[HKCU\Software\Classes\CLSID\{73436A91-85A6-4850-A7D0-375C4E369A5A}\VersionIndependentProgID]
"(Default)" = "CatalinaGroupUpdate.CredentialDialogUser"

[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Integers]
"windows_minor_version" = "01 00 00 00 00 00 00 00"

[HKCU\Software\Classes\Interface\{CBAC6FCC-819A-443D-98BB-E7A122DCCAE3}]
"(Default)" = "IOneClickProcessLauncher"

[HKCU\Software\Classes\Interface\{051D14B3-CF0F-4CCA-B8FE-AF9E007ACD43}\NumMethods]
"(Default)" = "4"

[HKCU\Software\Classes\Interface\{051D14B3-CF0F-4CCA-B8FE-AF9E007ACD43}]
"(Default)" = "ICoCreateAsync"

[HKCU\Software\Classes\Interface\{F9F2D675-F172-42F2-A26E-6453B80EA7F1}]
"(Default)" = "ICurrentState"

[HKCU\Software\Classes\CLSID\{3C564FFE-55F7-43AC-886C-7E9E9091CB2A}\ProgID]
"(Default)" = "CatalinaGroupUpdate.Update3COMClassUser.1.0"

[HKCU\Software\Classes\Interface\{789E3792-8514-4ED5-90F3-5B525275B953}]
"(Default)" = "IAppBundleWeb"

[HKCU\Software\Classes\Interface\{D085AC3B-E5CC-40C9-8366-C12ADC489967}]
"(Default)" = "IApp"

[HKCU\Software\Classes\Interface\{A1E6F38D-8C9E-4BDA-86A2-1940472A8429}\NumMethods]
"(Default)" = "5"

[HKCU\Software\Classes\CLSID\{8FDC0C15-3A1A-4B3D-B04F-B725F5699C25}\InprocHandler32]
"ThreadingModel" = "Both"

[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Integers]
"windows_major_version" = "05 00 00 00 00 00 00 00"

[HKCU\Software\Classes\CatalinaGroup.OneClickProcessLauncherUser\CLSID]
"(Default)" = "{13660822-39AC-408C-BA99-702EBEE3EF26}"

[HKCU\Software\Classes\Interface\{A1E6F38D-8C9E-4BDA-86A2-1940472A8429}\ProxyStubClsid32]
"(Default)" = "{793865C6-3633-42FA-B959-055A87BF596A}"

[HKCU\Software\Classes\CatalinaGroupUpdate.CredentialDialogUser\CLSID]
"(Default)" = "{73436A91-85A6-4850-A7D0-375C4E369A5A}"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BB 0F 1C E2 0F 58 24 D2 69 02 69 7E FB B3 AA 1D"

[HKCU\Software\Classes\Interface\{D085AC3B-E5CC-40C9-8366-C12ADC489967}\NumMethods]
"(Default)" = "44"

[HKCU\Software\Classes\CLSID\{13660822-39AC-408C-BA99-702EBEE3EF26}\VersionIndependentProgID]
"(Default)" = "CatalinaGroup.OneClickProcessLauncherUser"

[HKCU\Software\Classes\CatalinaGroupUpdate.Update3WebUser.1.0]
"(Default)" = "GoogleUpdate Update3Web"

[HKCU\Software\Classes\Interface\{C1D8630A-9D2D-4E0E-A4A1-8AA5CA3FAE57}\NumMethods]
"(Default)" = "4"

[HKCU\Software\Classes\Interface\{0CD725CD-5650-4F13-91DA-E42FAA9687E8}\NumMethods]
"(Default)" = "10"

[HKCU\Software\Classes\Interface\{34F067BE-C79C-4C5F-8E64-622A3CC59055}\NumMethods]
"(Default)" = "9"

[HKCU\Software\Classes\Interface\{EC3867B7-B9EF-494E-B42B-BA009D57D90E}\NumMethods]
"(Default)" = "6"

[HKCU\Software\Classes\Interface\{6B6DE56F-09F2-4343-80AD-28E5D6CB78F9}\ProxyStubClsid32]
"(Default)" = "{793865C6-3633-42FA-B959-055A87BF596A}"

[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{13660822-39AC-408C-BA99-702EBEE3EF26}]
"Policy" = "3"

[HKCU\Software\Classes\Interface\{F9F2D675-F172-42F2-A26E-6453B80EA7F1}\ProxyStubClsid32]
"(Default)" = "{793865C6-3633-42FA-B959-055A87BF596A}"

[HKCU\Software\Classes\Interface\{0E09406F-1420-4BF4-B6EB-F0994674AD68}\ProxyStubClsid32]
"(Default)" = "{793865C6-3633-42FA-B959-055A87BF596A}"

[HKCU\Software\Classes\Interface\{6B6DE56F-09F2-4343-80AD-28E5D6CB78F9}\NumMethods]
"(Default)" = "14"

[HKCU\Software\Classes\CLSID\{2823499B-60F3-4940-8042-2C16D5829A39}\ProgID]
"(Default)" = "CatalinaGroupUpdate.Update3WebUser.1.0"

[HKCU\Software\Classes\Interface\{7C9F9415-9947-482C-A62B-24A0BD92B8A7}]
"(Default)" = "ICatalinaUpdateCore"

[HKCU\Software\Classes\Interface\{3EA78C6E-8267-4554-8EC6-8982D5AF539A}\NumMethods]
"(Default)" = "10"

[HKCU\Software\Classes\CLSID\{73436A91-85A6-4850-A7D0-375C4E369A5A}\LocalServer32]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\CatalinaUpdateOnDemand.exe"

[HKCU\Software\Classes\Interface\{051D14B3-CF0F-4CCA-B8FE-AF9E007ACD43}\ProxyStubClsid32]
"(Default)" = "{793865C6-3633-42FA-B959-055A87BF596A}"

[HKCU\Software\Classes\CatalinaGroup.OneClickProcessLauncherUser.1.0]
"(Default)" = "CatalinaGroup.OneClickProcessLauncher"

[HKCU\Software\Classes\CLSID\{2823499B-60F3-4940-8042-2C16D5829A39}]
"(Default)" = "GoogleUpdate Update3Web"

[HKCU\Software\Classes\CLSID\{13660822-39AC-408C-BA99-702EBEE3EF26}\ProgID]
"(Default)" = "CatalinaGroup.OneClickProcessLauncherUser.1.0"

[HKCU\Software\Classes\Interface\{CBAC6FCC-819A-443D-98BB-E7A122DCCAE3}\ProxyStubClsid32]
"(Default)" = "{793865C6-3633-42FA-B959-055A87BF596A}"

[HKCU\Software\Classes\CatalinaGroup.OneClickProcessLauncherUser\CurVer]
"(Default)" = "CatalinaGroup.OneClickProcessLauncherUser.1.0"

[HKCU\Software\Classes\CLSID\{2823499B-60F3-4940-8042-2C16D5829A39}\LocalServer32]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\CatalinaUpdateOnDemand.exe"

[HKCU\Software\Classes\Interface\{FFC6ECB2-25E8-40EE-BF37-5AA25CBCBA63}\ProxyStubClsid32]
"(Default)" = "{793865C6-3633-42FA-B959-055A87BF596A}"

[HKCU\Software\Classes\Interface\{84BA4DAC-82EA-4DC8-BCB0-B69DD6E95670}\NumMethods]
"(Default)" = "10"

[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Counts]
"goopdate_constructor" = "01 00 00 00 00 00 00 00"

[HKCU\Software\Classes\Interface\{FFC6ECB2-25E8-40EE-BF37-5AA25CBCBA63}]
"(Default)" = "ICatalinaUpdate3"

[HKCU\Software\Classes\Interface\{263B5A28-834A-4D1B-AB71-A28E882CC59B}]
"(Default)" = "IJobObserver"

[HKCU\Software\Classes\Interface\{0CD725CD-5650-4F13-91DA-E42FAA9687E8}]
"(Default)" = "IAppVersion"

[HKCU\Software\Classes\CatalinaGroupUpdate.OnDemandCOMClassUser.1.0]
"(Default)" = "Google Update Legacy On Demand"

[HKCU\Software\Classes\Interface\{F009E353-D4BD-42FE-994E-F6C315055F9B}]
"(Default)" = "ICatalinaUpdate3Web"

[HKCU\Software\Classes\Interface\{F009E353-D4BD-42FE-994E-F6C315055F9B}\NumMethods]
"(Default)" = "8"

[HKCU\Software\Classes\Interface\{A2589E53-1490-4C0A-BFC7-A47B7A88E3D8}\NumMethods]
"(Default)" = "4"

[HKCU\Software\Classes\Interface\{23185EAB-61B0-4B70-BE89-589585B91392}\ProxyStubClsid32]
"(Default)" = "{793865C6-3633-42FA-B959-055A87BF596A}"

[HKCU\Software\Classes\Interface\{EC3867B7-B9EF-494E-B42B-BA009D57D90E}\ProxyStubClsid32]
"(Default)" = "{793865C6-3633-42FA-B959-055A87BF596A}"

[HKCU\Software\Classes\CLSID\{3C564FFE-55F7-43AC-886C-7E9E9091CB2A}\VersionIndependentProgID]
"(Default)" = "CatalinaGroupUpdate.Update3COMClassUser"

[HKCU\Software\Classes\CatalinaGroupUpdate.OnDemandCOMClassUser\CLSID]
"(Default)" = "{C8362D5A-4303-4E22-8668-BB10D65B95BD}"

[HKCU\Software\Classes\Interface\{7A1A1D82-1E2B-41B8-9FA3-F40D8DD3EEF0}]
"(Default)" = "IBrowserHttpRequest2"

[HKCU\Software\Classes\CLSID\{F4CBF20B-F634-4095-B64A-2EBCDD9E560E}\InprocServer32]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\psuser.dll"

[HKCU\Software\Classes\CatalinaGroupUpdate.CredentialDialogUser.1.0]
"(Default)" = "GoogleUpdate CredentialDialog"

[HKCU\Software\Classes\CatalinaGroupUpdate.Update3WebUser.1.0\CLSID]
"(Default)" = "{2823499B-60F3-4940-8042-2C16D5829A39}"

[HKCU\Software\Classes\CatalinaGroupUpdate.Update3COMClassUser.1.0]
"(Default)" = "Update3COMClass"

[HKCU\Software\Classes\Interface\{789E3792-8514-4ED5-90F3-5B525275B953}\NumMethods]
"(Default)" = "24"

[HKCU\Software\Classes\Interface\{84BA4DAC-82EA-4DC8-BCB0-B69DD6E95670}]
"(Default)" = "IPackage"

[HKCU\Software\Classes\Interface\{7A1A1D82-1E2B-41B8-9FA3-F40D8DD3EEF0}\NumMethods]
"(Default)" = "4"

[HKCU\Software\Classes\CLSID\{C8362D5A-4303-4E22-8668-BB10D65B95BD}\LocalServer32]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\CatalinaUpdateOnDemand.exe"

[HKCU\Software\Classes\Interface\{3EA78C6E-8267-4554-8EC6-8982D5AF539A}\ProxyStubClsid32]
"(Default)" = "{793865C6-3633-42FA-B959-055A87BF596A}"

[HKCU\Software\Classes\CLSID\{3C564FFE-55F7-43AC-886C-7E9E9091CB2A}\LocalServer32]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\CatalinaUpdate.exe"

[HKCU\Software\Classes\CatalinaGroupUpdate.Update3COMClassUser.1.0\CLSID]
"(Default)" = "{3C564FFE-55F7-43AC-886C-7E9E9091CB2A}"

[HKCU\Software\Classes\Interface\{6B6DE56F-09F2-4343-80AD-28E5D6CB78F9}]
"(Default)" = "IAppWeb"

[HKCU\Software\Classes\CatalinaGroupUpdate.OnDemandCOMClassUser.1.0\CLSID]
"(Default)" = "{C8362D5A-4303-4E22-8668-BB10D65B95BD}"

[HKCU\Software\Classes\CatalinaGroupUpdate.Update3WebUser]
"(Default)" = "GoogleUpdate Update3Web"

[HKCU\Software\Classes\CatalinaGroup.OneClickProcessLauncherUser]
"(Default)" = "CatalinaGroup.OneClickProcessLauncher"

[HKCU\Software\Classes\Interface\{F9F2D675-F172-42F2-A26E-6453B80EA7F1}\NumMethods]
"(Default)" = "24"

[HKCU\Software\Classes\CatalinaGroup.OneClickProcessLauncherUser.1.0\CLSID]
"(Default)" = "{13660822-39AC-408C-BA99-702EBEE3EF26}"

[HKCU\Software\Classes\Interface\{EC3867B7-B9EF-494E-B42B-BA009D57D90E}]
"(Default)" = "IProcessLauncher"

[HKCU\Software\Classes\CLSID\{793865C6-3633-42FA-B959-055A87BF596A}\InProcServer32]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\psuser.dll"

[HKCU\Software\Classes\CatalinaGroupUpdate.OnDemandCOMClassUser\CurVer]
"(Default)" = "CatalinaGroupUpdate.OnDemandCOMClassUser.1.0"

[HKCU\Software\Classes\CLSID\{C8362D5A-4303-4E22-8668-BB10D65B95BD}\ProgID]
"(Default)" = "CatalinaGroupUpdate.OnDemandCOMClassUser.1.0"

[HKCU\Software\Classes\CatalinaGroupUpdate.Update3COMClassUser\CLSID]
"(Default)" = "{3C564FFE-55F7-43AC-886C-7E9E9091CB2A}"

[HKCU\Software\Classes\CatalinaGroupUpdate.CredentialDialogUser\CurVer]
"(Default)" = "CatalinaGroupUpdate.CredentialDialogUser.1.0"

[HKCU\Software\Classes\Interface\{34F067BE-C79C-4C5F-8E64-622A3CC59055}]
"(Default)" = "IProgressWndEvents"

[HKCU\Software\Classes\CatalinaGroupUpdate.OnDemandCOMClassUser]
"(Default)" = "Google Update Legacy On Demand"

[HKCU\Software\Classes\CLSID\{73436A91-85A6-4850-A7D0-375C4E369A5A}]
"(Default)" = "GoogleUpdate CredentialDialog"

[HKCU\Software\Classes\CatalinaGroupUpdate.CredentialDialogUser.1.0\CLSID]
"(Default)" = "{73436A91-85A6-4850-A7D0-375C4E369A5A}"

[HKCU\Software\Classes\Interface\{23185EAB-61B0-4B70-BE89-589585B91392}]
"(Default)" = "IRegistrationUpdateHook"

The Trojan deletes the following registry key(s):

[HKCU\Software\Classes\CLSID\{F4CBF20B-F634-4095-B64A-2EBCDD9E560E}]
[HKCU\Software\Classes\CLSID\{F4CBF20B-F634-4095-B64A-2EBCDD9E560E}\InprocServer32]
[HKCU\Software\Classes\CLSID\{8FDC0C15-3A1A-4B3D-B04F-B725F5699C25}\InprocHandler32]
[HKCU\Software\Classes\CLSID\{8FDC0C15-3A1A-4B3D-B04F-B725F5699C25}]

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\CatalinaGroup\Update\network\secure]
"sk"
"c"

The process citrio_50.0.2661.271_1.exe:328 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"ap" = "-full"

The process %original file name%.exe:1108 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D7 BB E0 17 45 D9 08 C9 9E B3 18 24 16 31 AF F0"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):

   CatalinaUpdate.exe:1196
   CatalinaUpdate.exe:1072
   CatalinaUpdate.exe:352
   citrio_50.0.2661.271_1.exe:328
   %original file name%.exe:1108

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:

   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\Install\{2FEF2209-C78C-4B55-BBBF-5B577A5DB7CF}\citrio_50.0.2661.271_1.exe (449813 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\Download\{92F8A219-E740-49D5-B785-B962AD819724}\50.0.2661.271\citrio_50.0.2661.271_1.exe (449813 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_te.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ca.dll (27 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ru.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_nl.dll (28 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_fi.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_pl.dll (28 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_fr.dll (28 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\psmachine.dll (673 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_uk.dll (26 bytes)
   %WinDir%\Tasks\CatalinaGroupUpdateTaskUserS-1-5-21-1844237615-1960408961-1801674531-1003Core.job (948 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_th.dll (25 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_zh-TW.dll (19 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_vi.dll (25 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_es-419.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdate.dll (5873 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_fil.dll (28 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ta.dll (28 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_tr.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ar.dll (24 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_sk.dll (27 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_is.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_mr.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_sw.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_es.dll (29 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_hr.dll (27 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ja.dll (22 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_kn.dll (27 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_en.dll (25 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_en-GB.dll (25 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\psuser.dll (673 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_no.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ml.dll (29 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\CatalinaUpdateHelper.msi (36 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ur.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_am.dll (22 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_pt-BR.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\CatalinaUpdate.exe (601 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_bn.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_sv.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_et.dll (25 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_gu.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_da.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\CatalinaUpdate.exe (601 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_fa.dll (25 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ms.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_sr.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_sl.dll (27 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_hu.dll (27 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_cs.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_iw.dll (23 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_lt.dll (25 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ko.dll (21 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_el.dll (28 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_hi.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_lv.dll (28 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_zh-CN.dll (19 bytes)
   %WinDir%\Tasks\CatalinaGroupUpdateTaskUserS-1-5-21-1844237615-1960408961-1801674531-1003UA.job (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_de.dll (29 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_id.dll (25 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\CatalinaUpdateOnDemand.exe (58 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_pt-PT.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_bg.dll (28 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\npCatalinaUpdate3.dll (1281 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\CatalinaUpdateBroker.exe (58 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\CatalinaCrashHandler.exe (601 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ro.dll (27 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_it.dll (28 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\CR_35172.tmp\CITRIO.PACKED.7Z (443233 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_sl.dll (27 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_gu.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUT2.tmp (22433 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_nl.dll (28 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_te.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_sk.dll (27 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_el.dll (28 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ru.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_es-419.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_iw.dll (23 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_no.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_tr.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_sr.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_en-GB.dll (25 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_da.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ro.dll (27 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_uk.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_zh-TW.dll (19 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_bn.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ms.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ta.dll (28 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\CatalinaUpdateBroker.exe (58 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_es.dll (29 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdate.dll (1990 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_sw.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_de.dll (29 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_is.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_sv.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_fr.dll (28 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_en.dll (25 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_cs.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_mr.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_pt-BR.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_fa.dll (25 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_kn.dll (27 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_bg.dll (28 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_pt-PT.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_id.dll (25 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_fi.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ja.dll (22 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\npCatalinaUpdate3.dll (236 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\psuser.dll (161 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ml.dll (29 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ko.dll (21 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_th.dll (25 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ca.dll (27 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_vi.dll (25 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_hi.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_zh-CN.dll (19 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_lv.dll (28 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_hu.dll (27 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\CatalinaUpdate.exe (130 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ar.dll (24 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_pl.dll (28 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_hr.dll (27 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\CatalinaUpdateHelper.msi (36 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_lt.dll (25 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_et.dll (25 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_am.dll (22 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\psmachine.dll (155 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\CatalinaCrashHandler.exe (130 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_it.dll (28 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_fil.dll (28 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ur.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\CatalinaUpdateOnDemand.exe (58 bytes)

4. Delete the following value(s) in the autorun key (How to Work with System Registry):

   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   "CatalinaGroup Update" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\CatalinaUpdate.exe /c"

5. Reboot the computer.
   

Static Analysis

VersionInfo

Company Name: Catalina Group Ltd.
Product Name: CatalinaGroup Update
Product Version: 1.3.25.223
Legal Copyright: Copyright 2013 Catalina Group Ltd.
Legal Trademarks:
Original Filename: CatalinaUpdateSetup.exe
Internal Name: CatalinaGroup Update Setup
File Version: 1.3.25.223
File Description: CatalinaGroup Update Setup
Comments:
Language: English (United States)

Company Name: Catalina Group Ltd.Product Name: CatalinaGroup UpdateProduct Version: 1.3.25.223Legal Copyright: Copyright 2013 Catalina Group Ltd.Legal Trademarks: Original Filename: CatalinaUpdateSetup.exeInternal Name: CatalinaGroup Update SetupFile Version: 1.3.25.223File Description: CatalinaGroup Update SetupComments: Language: English (United States)

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 28
3c2f29dbac5842ca1a35747628ac2ed0
77911c759cafed5c84f6d819fbaf2069
fee2556c48f72e91e121554e539b09e9
f11489e2c77aaccce5be36cd0f412374
7ea8b386deb153674ae71fbaac54ab76
a2c0406aaba834c74f68561c73936587
f286dd4df05f245669a2369d48418cfe
6e2f2e4552821e74da372e828fded288
d3d0d8a0a4ad6f659968ec9597c5904c
8d07d2af1cacca9b155f9aa57b7785d7
d6e7032cc47d7701b3dc9d7e2b5fd5c3
fdc6075e6b90d49d20adc410eed07268
fad048a52261ed893caba84d3a40025f
c82aec98008a83e1505e59ca14243728
47a7a872690644a8db4aec4424c1593e
47f16121bb7e85ae2624b94c5d9ae4d4
1f3f192bcc3cb6bdddaad57c3c2659af
0602ef8c76f9ac40345b392b13062eca
09e1b9accbe3bc53af1dd8b6c055f3f9
3626022326bfb0f10fca5336e8b96834
adfa089ac6508c4d2baddc86f4ec6893
2a00121697147dd6b26a950569e65577
687ece4bb3ecc5276d27dd1f30fe3900
904b9c4b0cb8a924f98f4b199efdd88b
fb95e4647b9b6c56fc314f0ae1644e35

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_1108:

.text

.text

`.rdata

`.rdata

@.data

@.data

.rsrc

.rsrc

@.reloc

@.reloc

Please contact the application's support team for more information.

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- CRT not initialized

- floating point support not loaded

- floating point support not loaded

GetProcessWindowStation

GetProcessWindowStation

USER32.DLL

USER32.DLL

operator

operator

mi_exe_stub.pdb

mi_exe_stub.pdb

GetCPInfo

GetCPInfo

KERNEL32.dll

KERNEL32.dll

SHLWAPI.dll

SHLWAPI.dll

GetProcessHeap

GetProcessHeap

ole32.dll

ole32.dll

USER32.dll

USER32.dll

c:\%original file name%.exe

c:\%original file name%.exe

.eyV}

.eyV}

.Pl_Iy

.Pl_Iy

.YZ9'

.YZ9'

MrsqLa

MrsqLa

cK?%X

cK?%X

9d.os

9d.os

bpCH.Ob

bpCH.Ob

%FYzE

%FYzE

;`-

;`-

úL u

úL u

cMdi

cMdi

[:\%c

[:\%c

&k%sa

&k%sa

%fH`2

%fH`2

.ZB#I

.ZB#I

9IqI.If

9IqI.If

K%U35R

K%U35R

ZO\0:%UO7

ZO\0:%UO7

p7.HV&

p7.HV&

%xDyE

%xDyE

d/y.Sw

d/y.Sw

U%xbqq!GR-

U%xbqq!GR-

a1g.ZI

a1g.ZI

lp.JR^

lp.JR^

Ya.Ev

Ya.Ev

Z9%x;

Z9%x;

.GB|@zr

.GB|@zr

.whDs

.whDs

T;K[uO%F

T;K[uO%F

j'G.Fw

j'G.Fw

].TrJ

].TrJ

Q.rW#

Q.rW#

"B.ia

"B.ia

g!.Uh

g!.Uh

k.lhx

k.lhx

pK.gJ

pK.gJ

:sssh

:sssh

7:

7:

: :%:/:=:}:

: :%:/:=:}:

3'3,30343]3

3'3,30343]3

mscoree.dll

mscoree.dll

KERNEL32.DLL

KERNEL32.DLL

appguid={92F8A219-E740-49D5-B785-B962AD819724}&installerargs=--make-chrome-default

appguid={92F8A219-E740-49D5-B785-B962AD819724}&installerargs=--make-chrome-default

Windows 2000 Service Pack 4

Windows 2000 Service Pack 4

Windows 2000

Windows 2000

lador de %1!s! requereix Windows 2000 amb Service Pack 4 o una versi

lador de %1!s! requereix Windows 2000 amb Service Pack 4 o una versi

m Windows 2000 Service Pack 4 nebo nov

m Windows 2000 Service Pack 4 nebo nov

ver Windows 2000 Service Pack 4 eller bedre.

ver Windows 2000 Service Pack 4 eller bedre.

r den %1!s!-Installer wird Windows 2000 Service Pack 4 oder h

r den %1!s!-Installer wird Windows 2000 Service Pack 4 oder h

Unknown Installer ErrorTInstallation failed. %1!s! Installer requires Windows 2000 Service Pack 4 or better.

Unknown Installer ErrorTInstallation failed. %1!s! Installer requires Windows 2000 Service Pack 4 or better.

Windows 2000 Service Pack 4:n tai uudemman.

Windows 2000 Service Pack 4:n tai uudemman.

cessite Windows

cessite Windows

je Windows 2000 Service Pack 4-et vagy frissebb verzi

je Windows 2000 Service Pack 4-et vagy frissebb verzi

krefst Windows 2000

krefst Windows 2000

Google#Programma di installazione di %1!s!!Errore sconosciuto dell'installertInstallazione non riuscita. Il programma di installazione di %1!s! richiede Windows 2000 Service Pack 4 o superiore.

Google#Programma di installazione di %1!s!!Errore sconosciuto dell'installertInstallazione non riuscita. Il programma di installazione di %1!s! richiede Windows 2000 Service Pack 4 o superiore.

Installatieprogramma van %1!s!'Onbekende fout van installatieprogrammasDe installatie is mislukt. Voor het installatieprogramma van %1!s! is Windows 2000 Service Pack 4 of hoger vereist.

Installatieprogramma van %1!s!'Onbekende fout van installatieprogrammasDe installatie is mislukt. Voor het installatieprogramma van %1!s! is Windows 2000 Service Pack 4 of hoger vereist.

Ukjent installasjonsfeilgInstallasjonen mislyktes. %1!s! installasjonsprogrammet krever Windows 2000 Service Pack 4 eller nyere.

Ukjent installasjonsfeilgInstallasjonen mislyktes. %1!s! installasjonsprogrammet krever Windows 2000 Service Pack 4 eller nyere.

. Instalator %1!s! wymaga systemu Windows 2000 z dodatkiem Service Pack 4 lub nowszego.

. Instalator %1!s! wymaga systemu Windows 2000 z dodatkiem Service Pack 4 lub nowszego.

o. O instalador do %1!s! requer o Windows 2000 Service Pack 4 ou posterior.

o. O instalador do %1!s! requer o Windows 2000 Service Pack 4 ou posterior.

it. %1!s! Programul de instalare are nevoie de Windows 2000 Service Pack 4 sau de o versiune superioar

it. %1!s! Programul de instalare are nevoie de Windows 2000 Service Pack 4 sau de o versiune superioar

ka alata za instalacijulInstalacija nije uspjela. Za instalacijski program %1!s! potreban je Windows 2000 Service Pack 4 ili noviji.

ka alata za instalacijulInstalacija nije uspjela. Za instalacijski program %1!s! potreban je Windows 2000 Service Pack 4 ili noviji.

m Windows 2000 Service Pack 4 alebo nov

m Windows 2000 Service Pack 4 alebo nov

ver Windows 2000 Service Pack 4 eller b

ver Windows 2000 Service Pack 4 eller b

kleyicisi Windows 2000 Hizmet Paketi 4 veya sonras

kleyicisi Windows 2000 Hizmet Paketi 4 veya sonras

Program pemasang %1!s!!Kesalahan Installer Tak DiketahuiePemasangan gagal. Program pemasang %1!s! memerlukan Windows 2000 Service Pack 4 atau yang lebih baik.

Program pemasang %1!s!!Kesalahan Installer Tak DiketahuiePemasangan gagal. Program pemasang %1!s! memerlukan Windows 2000 Service Pack 4 atau yang lebih baik.

na. Za namestitveni program za %1!s! potrebujete Windows 2000 s servisnim paketom SP 4 ali novej

na. Za namestitveni program za %1!s! potrebujete Windows 2000 s servisnim paketom SP 4 ali novej

uab rakendust Windows 2000 hoolduspakett 4 v

uab rakendust Windows 2000 hoolduspakett 4 v

ama Windows

ama Windows

Windows 2000

Windows 2000

u Windows 2000 G

u Windows 2000 G

Pemasang %1!s!#Ralat Pemasang yang Tidak Diketahui]Pemasangan gagal. Pemasang %1!s! memerlukan Windows 2000 Service Pack 4 atau yang lebih baik.

Pemasang %1!s!#Ralat Pemasang yang Tidak Diketahui]Pemasangan gagal. Pemasang %1!s! memerlukan Windows 2000 Service Pack 4 atau yang lebih baik.

Kisakinishi cha %1!s!%Hitilafu ya Kisakinishi Isiyojulikana_Usakinishaji haukufaulu. Kisakinishi cha %1!s! kinahitaji Windows 2000 Service Pack 4 au zaidi.

Kisakinishi cha %1!s!%Hitilafu ya Kisakinishi Isiyojulikana_Usakinishaji haukufaulu. Kisakinishi cha %1!s! kinahitaji Windows 2000 Service Pack 4 au zaidi.

. Windows 2000

. Windows 2000

Installer ng %1!s! Hindi Alam na Error ng InstallerlNabigo ang pag-install. Nangangailangan ang Installer ng %1!s! ng Windows 2000 Service Pack 4 o mas mahusay.

Installer ng %1!s! Hindi Alam na Error ng InstallerlNabigo ang pag-install. Nangangailangan ang Installer ng %1!s! ng Windows 2000 Service Pack 4 o mas mahusay.

n. %1!s! El instalador requiere Windows 2000 Service Pack 4 o superior.

n. %1!s! El instalador requiere Windows 2000 Service Pack 4 o superior.

o %1!s! necessita do Windows 2000 Service Pack 4 ou superior.

o %1!s! necessita do Windows 2000 Service Pack 4 ou superior.

n. %1!s! Installer requiere Windows 2000 Service Pack 4 o versiones posteriores.

n. %1!s! Installer requiere Windows 2000 Service Pack 4 o versiones posteriores.

1.3.25.223

1.3.25.223

CatalinaUpdateSetup.exe

CatalinaUpdateSetup.exe

CatalinaUpdate.exe_424:

.text

.text

`.data

`.data

.text/DE

.text/DE

@.rsrc

@.rsrc

@.reloc

@.reloc

SHELL32.dll

SHELL32.dll

USER32.dll

USER32.dll

SHLWAPI.dll

SHLWAPI.dll

Please contact the application's support team for more information.

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- CRT not initialized

- floating point support not loaded

- floating point support not loaded

GetProcessWindowStation

GetProcessWindowStation

USER32.DLL

USER32.DLL

operator

operator

CatalinaUpdate_unsigned.pdb

CatalinaUpdate_unsigned.pdb

RegOpenKeyExW

RegOpenKeyExW

ADVAPI32.dll

ADVAPI32.dll

KERNEL32.dll

KERNEL32.dll

ole32.dll

ole32.dll

GetProcessHeap

GetProcessHeap

GetCPInfo

GetCPInfo

GetConsoleOutputCP

GetConsoleOutputCP

name="Microsoft.Windows.Common-Controls"

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

publicKeyToken="6595b64144ccf1df"

###7777_{

###7777_{

###____777

###____777

###````87{

###````87{

2 2$2(2,20242~2

2 2$2(2,20242~2

4 4$4(4,4

4 4$4(4,4

?$?(?,?4?

?$?(?,?4?

> >@>\>`>

> >@>\>`>

? ?@?\?`?

? ?@?\?`?

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\GUM1.tmp\CatalinaUpdate.exe

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\GUM1.tmp\CatalinaUpdate.exe

KERNEL32.DLL

KERNEL32.DLL

mscoree.dll

mscoree.dll

goopdate.dll

goopdate.dll

CatalinaUpdate.exe

CatalinaUpdate.exe

Software\CatalinaGroup\Update\Clients\{6C598730-F715-407B-A7AE-A8F10D0F8FA7}

Software\CatalinaGroup\Update\Clients\{6C598730-F715-407B-A7AE-A8F10D0F8FA7}

1.3.25.223

1.3.25.223

2007-2010

2007-2010

2007-2010

2007-2010

CatalinaUpdate.exe_1628:

.text

.text

`.data

`.data

.text/DE

.text/DE

@.rsrc

@.rsrc

@.reloc

@.reloc

SHELL32.dll

SHELL32.dll

USER32.dll

USER32.dll

SHLWAPI.dll

SHLWAPI.dll

Please contact the application's support team for more information.

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- CRT not initialized

- floating point support not loaded

- floating point support not loaded

GetProcessWindowStation

GetProcessWindowStation

USER32.DLL

USER32.DLL

operator

operator

CatalinaUpdate_unsigned.pdb

CatalinaUpdate_unsigned.pdb

RegOpenKeyExW

RegOpenKeyExW

ADVAPI32.dll

ADVAPI32.dll

KERNEL32.dll

KERNEL32.dll

ole32.dll

ole32.dll

GetProcessHeap

GetProcessHeap

GetCPInfo

GetCPInfo

GetConsoleOutputCP

GetConsoleOutputCP

name="Microsoft.Windows.Common-Controls"

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

publicKeyToken="6595b64144ccf1df"

###7777_{

###7777_{

###____777

###____777

###````87{

###````87{

2 2$2(2,20242~2

2 2$2(2,20242~2

4 4$4(4,4

4 4$4(4,4

?$?(?,?4?

?$?(?,?4?

> >@>\>`>

> >@>\>`>

? ?@?\?`?

? ?@?\?`?

%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\CatalinaUpdate.exe

%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\CatalinaUpdate.exe

KERNEL32.DLL

KERNEL32.DLL

mscoree.dll

mscoree.dll

goopdate.dll

goopdate.dll

CatalinaUpdate.exe

CatalinaUpdate.exe

Software\CatalinaGroup\Update\Clients\{6C598730-F715-407B-A7AE-A8F10D0F8FA7}

Software\CatalinaGroup\Update\Clients\{6C598730-F715-407B-A7AE-A8F10D0F8FA7}

1.3.25.223

1.3.25.223

2007-2010

2007-2010

2007-2010

2007-2010

CatalinaUpdate.exe_1072:

.text

.text

`.data

`.data

.text/DE

.text/DE

@.rsrc

@.rsrc

@.reloc

@.reloc

SHELL32.dll

SHELL32.dll

USER32.dll

USER32.dll

SHLWAPI.dll

SHLWAPI.dll

Please contact the application's support team for more information.

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- CRT not initialized

- floating point support not loaded

- floating point support not loaded

GetProcessWindowStation

GetProcessWindowStation

USER32.DLL

USER32.DLL

operator

operator

CatalinaUpdate_unsigned.pdb

CatalinaUpdate_unsigned.pdb

RegOpenKeyExW

RegOpenKeyExW

ADVAPI32.dll

ADVAPI32.dll

KERNEL32.dll

KERNEL32.dll

ole32.dll

ole32.dll

GetProcessHeap

GetProcessHeap

GetCPInfo

GetCPInfo

GetConsoleOutputCP

GetConsoleOutputCP

name="Microsoft.Windows.Common-Controls"

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

publicKeyToken="6595b64144ccf1df"

###7777_{

###7777_{

###____777

###____777

###````87{

###````87{

2 2$2(2,20242~2

2 2$2(2,20242~2

4 4$4(4,4

4 4$4(4,4

?$?(?,?4?

?$?(?,?4?

> >@>\>`>

> >@>\>`>

? ?@?\?`?

? ?@?\?`?

%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\CatalinaUpdate.exe

%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\CatalinaUpdate.exe

KERNEL32.DLL

KERNEL32.DLL

mscoree.dll

mscoree.dll

goopdate.dll

goopdate.dll

CatalinaUpdate.exe

CatalinaUpdate.exe

Software\CatalinaGroup\Update\Clients\{6C598730-F715-407B-A7AE-A8F10D0F8FA7}

Software\CatalinaGroup\Update\Clients\{6C598730-F715-407B-A7AE-A8F10D0F8FA7}

1.3.25.223

1.3.25.223

2007-2010

2007-2010

2007-2010

2007-2010

setup.exe_1608:

.text

.text

`.rdata

`.rdata

@.data

@.data

.rsrc

.rsrc

@.reloc

@.reloc

SHA256 block transform for x86, CRYPTOGAMS by

SHA256 block transform for x86, CRYPTOGAMS by

PSSSSSSh

PSSSSSSh

:.texu

:.texu

j.Yf;

j.Yf;

_tcPVj@

_tcPVj@

.PjRW

.PjRW

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\setup\archive_patch_helper.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\setup\archive_patch_helper.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\setup\install.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\setup\install.cc

Adding Chrome to Media player list at

Adding Chrome to Media player list at

Could not add Chrome to media player inclusion list.

Could not add Chrome to media player inclusion list.

Square150x150Logo='%ls\Logo.png'

Square150x150Logo='%ls\Logo.png'

Square70x70Logo='%ls\SmallLogo.png'

Square70x70Logo='%ls\SmallLogo.png'

Registering Chrome as browser:

Registering Chrome as browser:

Failed to reinstall Active Setup keys.

Failed to reinstall Active Setup keys.

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\setup\install_worker.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\setup\install_worker.cc

Chrome Frame in use. Copying to new_citrio.exe

Chrome Frame in use. Copying to new_citrio.exe

FUnexpected result creating CommandExecuteImpl; hr=0x

FUnexpected result creating CommandExecuteImpl; hr=0x

Adding unregistration items for DelegateExecute verb handler in

Adding unregistration items for DelegateExecute verb handler in

Not operating on Chrome while migrating to single-install.

Not operating on Chrome while migrating to single-install.

No multi-install Chrome found to migrate to single-install.

No multi-install Chrome found to migrate to single-install.

No DelegateExecute verb handler processing to do for

No DelegateExecute verb handler processing to do for

Adding registration items for DelegateExecute verb handler.

Adding registration items for DelegateExecute verb handler.

not supported.

not supported.

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\setup\setup_main.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\setup\setup_main.cc

Renaming of executables failed. Rolling back any changes.

Renaming of executables failed. Rolling back any changes.

Upgrading existing Chrome browser in multi-install mode.

Upgrading existing Chrome browser in multi-install mode.

Launching existing system-level chrome instead.

Launching existing system-level chrome instead.

RepairChrome: Failed to open Chrome's ClientState key.

RepairChrome: Failed to open Chrome's ClientState key.

RepairChrome: Failed to read Chrome's UninstallArguments.

RepairChrome: Failed to read Chrome's UninstallArguments.

RepairChrome: Not repairing single-install Chrome.

RepairChrome: Not repairing single-install Chrome.

RepairChrome: Failed to read Chrome's UninstallString.

RepairChrome: Failed to read Chrome's UninstallString.

RepairChrome: Launched repair command "

RepairChrome: Launched repair command "

RepairChrome: Failed launching repair command "

RepairChrome: Failed launching repair command "

RepairChrome: Will retry without breakaway.

RepairChrome: Will retry without breakaway.

Tried and failed to launch Metro Chrome.

Tried and failed to launch Metro Chrome.

was found, as a last resort (if the product is not present in Add/Remove Programs), try executing:

was found, as a last resort (if the product is not present in Add/Remove Programs), try executing:

Aborting operation: another installation of

Aborting operation: another installation of

setup.exe patching failed.

setup.exe patching failed.

chrome_install:

chrome_install:

Can't register browser - Chrome distribution not found

Can't register browser - Chrome distribution not found

Chrome product not found.

Chrome product not found.

Chrome Installer

Chrome Installer

Uninstalling multi-install Chrome Frame.

Uninstalling multi-install Chrome Frame.

Uninstallation of Chrome Frame returned status

Uninstallation of Chrome Frame returned status

Chrome Frame not found for uninstall.

Chrome Frame not found for uninstall.

Installing Chrome from compressed archive

Installing Chrome from compressed archive

Cannot install Chrome without an uncompressed archive.

Cannot install Chrome without an uncompressed archive.

Chrome only supports Windows XP or later.

Chrome only supports Windows XP or later.

Non admin user can not install system level Chrome.

Non admin user can not install system level Chrome.

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\setup\setup_util.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\setup\setup_util.cc

Looking for Chrome version folder under

Looking for Chrome version folder under

0.0.0.0

0.0.0.0

chrome-frame

chrome-frame

migrate-chrome-frame

migrate-chrome-frame

Failed to delete subkey

Failed to delete subkey

Failed to delete empty key

Failed to delete empty key

in key

in key

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\setup\uninstall.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\setup\uninstall.cc

DeleteChromeFilesAndFolders: no installation destination

DeleteChromeFilesAndFolders: no installation destination

Launching Chrome to do uninstall tasks.

Launching Chrome to do uninstall tasks.

citrio.exe launched for uninstall confirmation returned:

citrio.exe launched for uninstall confirmation returned:

Failed to launch citrio.exe for uninstall confirmation.

Failed to launch citrio.exe for uninstall confirmation.

Uninstall per-user Active Setup keys.

Uninstall per-user Active Setup keys.

Uninstalling Active Setup key for

Uninstalling Active Setup key for

NTUSER.DAT

NTUSER.DAT

Failed to delete key at

Failed to delete key at

Retargeting user-generated Chrome shortcuts.

Retargeting user-generated Chrome shortcuts.

Retarget failed: system-level Chrome not found.

Retarget failed: system-level Chrome not found.

Closing the Chrome Frame helper process

Closing the Chrome Frame helper process

Uninstallation complete. Launching post-uninstall operations.

Uninstallation complete. Launching post-uninstall operations.

setup.exe is not in target path. Skipping installer cleanup.

setup.exe is not in target path. Skipping installer cleanup.

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\setup\update_active_setup_version_work_item.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\setup\update_active_setup_version_work_item.cc

googlechrome

googlechrome

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\install_util.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\install_util.cc

CHROME_PROBED_PROGRAM_FILES_PATH

CHROME_PROBED_PROGRAM_FILES_PATH

Deleting registry key

Deleting registry key

Failed to delete registry key:

Failed to delete registry key:

Failed to parse an executable name from command line: "

Failed to parse an executable name from command line: "

chrome

chrome

chrome-sxs

chrome-sxs

do-not-launch-chrome

do-not-launch-chrome

make-chrome-default

make-chrome-default

new-setup-exe

new-setup-exe

register-chrome-browser

register-chrome-browser

register-chrome-browser-suffix

register-chrome-browser-suffix

register-dev-chrome

register-dev-chrome

register-url-protocol

register-url-protocol

rename-chrome-exe

rename-chrome-exe

remove-chrome-registration

remove-chrome-registration

update-setup-exe

update-setup-exe

toast-results-key

toast-results-key

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\lzma_util.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\lzma_util.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\shell_util.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\shell_util.cc

DefaultBrowser.ActivateSettings.ErrorHresult

DefaultBrowser.ActivateSettings.ErrorHresult

Could not make Chrome default browser (XP/current user).

Could not make Chrome default browser (XP/current user).

Could not make Chrome default browser (XP/system level).

Could not make Chrome default browser (XP/system level).

Registering Chrome as default browser on Vista.

Registering Chrome as default browser on Vista.

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\product.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\product.cc

Failed to Open or Write MSI value to client state key. error:

Failed to Open or Write MSI value to client state key. error:

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\installer_state.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\installer_state.cc

It seems that chrome is being installed for the first time.

It seems that chrome is being installed for the first time.

It seems that chrome is being over installed.

It seems that chrome is being over installed.

Failed opening key

Failed opening key

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\master_preferences.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\master_preferences.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\set_reg_value_work_item.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\set_reg_value_work_item.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\delete_after_reboot_helper.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\delete_after_reboot_helper.cc

Failed to open session manager key for writing.

Failed to open session manager key for writing.

do_not_launch_chrome

do_not_launch_chrome

make_chrome_default

make_chrome_default

make_chrome_default_for_user

make_chrome_default_for_user

launch_chrome_after_update

launch_chrome_after_update

Cannot initialize an AppCommand from an invalid key.

Cannot initialize an AppCommand from an invalid key.

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\app_command.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\app_command.cc

creating AppCommand registry key

creating AppCommand registry key

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\conditional_work_item_list.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\conditional_work_item_list.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\google_update_settings.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\google_update_settings.cc

Failed to write to application's ClientState key

Failed to write to application's ClientState key

Removed incremental installer failure key; switching to channel:

Removed incremental installer failure key; switching to channel:

Removed multi-install failure key; switching to channel:

Removed multi-install failure key; switching to channel:

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\google_update_util.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\google_update_util.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\installation_validator.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\installation_validator.cc

be web accessible

be web accessible

Chrome Binaries are missing "-multi" in channel name: "

Chrome Binaries are missing "-multi" in channel name: "

Chrome Binaries are missing "chrome" in channel name:

Chrome Binaries are missing "chrome" in channel name:

Chrome Binaries have "-chrome" in channel name, yet Chrome is not installed: "

Chrome Binaries have "-chrome" in channel name, yet Chrome is not installed: "

Chrome Binaries are missing "-chromeframe" in channel name: "

Chrome Binaries are missing "-chromeframe" in channel name: "

Chrome Binaries have "-chromeframe" in channel name, yet Chrome Frame is not installed multi: "

Chrome Binaries have "-chromeframe" in channel name, yet Chrome Frame is not installed multi: "

Chrome Binaries are present with no other products.

Chrome Binaries are present with no other products.

Chrome Binaries are present yet Chrome is not multi-install.

Chrome Binaries are present yet Chrome is not multi-install.

Chrome Binaries are present without Chrome, yet Chrome Frame

Chrome Binaries are present without Chrome, yet Chrome Frame

without Chrome Binaries.

without Chrome Binaries.

) does not match that of Chrome Binaries (

) does not match that of Chrome Binaries (

has an unsupported usagestats value (

has an unsupported usagestats value (

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\self_cleaning_temp_dir.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\self_cleaning_temp_dir.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\user_experiment.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\user_experiment.cc

Experiment qualification bypass

Experiment qualification bypass

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\channel_info.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\channel_info.cc

googlechromeframe

googlechromeframe

iexplore.exe

iexplore.exe

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\language_selector.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\language_selector.cc

Cannot initialize AppCommands from an invalid key.

Cannot initialize AppCommands from an invalid key.

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\app_commands.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\app_commands.cc

Failed to open key "

Failed to open key "

Skipping over key "

Skipping over key "

item execution failed

item execution failed

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\work_item_list.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\work_item_list.cc

list execution succeeded

list execution succeeded

NoRollbackWorkItemList: item execution failed

NoRollbackWorkItemList: item execution failed

NoRollbackWorkItemList: list execution succeeded

NoRollbackWorkItemList: list execution succeeded

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\copy_tree_work_item.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\copy_tree_work_item.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\create_dir_work_item.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\create_dir_work_item.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\create_reg_key_work_item.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\create_reg_key_work_item.cc

no key to create

no key to create

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\delete_tree_work_item.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\delete_tree_work_item.cc

Acquired exclusive lock for key file:

Acquired exclusive lock for key file:

Could not exclusively hold all key files.

Could not exclusively hold all key files.

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\delete_reg_key_work_item.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\delete_reg_key_work_item.cc

Failed to backup destination for registry key copy.

Failed to backup destination for registry key copy.

Failed to restore key in rollback.

Failed to restore key in rollback.

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\delete_reg_value_work_item.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\delete_reg_value_work_item.cc

(delete value) Key:

(delete value) Key:

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\move_tree_work_item.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\move_tree_work_item.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\self_reg_work_item.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\self_reg_work_item.cc

0xX

0xX

COM registration export function not found

COM registration export function not found

Failed getting info of key to backup, result:

Failed getting info of key to backup, result:

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\registry_key_backup.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\registry_key_backup.cc

Failed getting name of subkey

Failed getting name of subkey

Failed opening subkey "

Failed opening subkey "

Failed backing up subkey "

Failed backing up subkey "

Failed creating subkey "

Failed creating subkey "

Failed writing subkey "

Failed writing subkey "

Failed to backup key at

Failed to backup key at

Failed to open key at

Failed to open key at

Failed to create destination key at

Failed to create destination key at

Failed to write key data.

Failed to write key data.

CHROME_HEADLESS

CHROME_HEADLESS

widevinecdmadapter.dll

widevinecdmadapter.dll

try-chrome-again

try-chrome-again

session.startup_urls

session.startup_urls

session.urls_to_restore_on_startup

session.urls_to_restore_on_startup

%s\%s

%s\%s

user_experience_metrics.reporting_enabled

user_experience_metrics.reporting_enabled

c:\jenkins\workspace\citrio-dev-clone\browser\src\crypto\secure_hash_openssl.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\crypto\secure_hash_openssl.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\courgette\assembly_program.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\courgette\assembly_program.cc

32 bit executables are not supported by this disassembler

32 bit executables are not supported by this disassembler

Resource-only executables are not yet supported

Resource-only executables are not yet supported

.relocs outside image

.relocs outside image

.relocs block outside image

.relocs block outside image

64 bit executables are not supported by this disassembler

64 bit executables are not supported by this disassembler

Not an executable file or shared library

Not an executable file or shared library

Not a supported architecture

Not a supported architecture

c:\jenkins\workspace\citrio-dev-clone\browser\src\courgette\disassembler_elf_32.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\courgette\disassembler_elf_32.cc

Skipping relocation entry for unsupported section:

Skipping relocation entry for unsupported section:

CITRIO_BREAKPAD_PIPE_NAME

CITRIO_BREAKPAD_PIPE_NAME

c:\jenkins\workspace\citrio-dev-clone\browser\src\components\crash\content\app\breakpad_win.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\components\crash\content\app\breakpad_win.cc

NTDLL.DLL

NTDLL.DLL

SHELL32.dll

SHELL32.dll

GetProcessWindowStation

GetProcessWindowStation

function not supported

function not supported

operation canceled

operation canceled

address_family_not_supported

address_family_not_supported

operation_in_progress

operation_in_progress

operation_not_supported

operation_not_supported

protocol_not_supported

protocol_not_supported

operation_would_block

operation_would_block

address family not supported

address family not supported

broken pipe

broken pipe

inappropriate io control operation

inappropriate io control operation

not supported

not supported

operation in progress

operation in progress

operation not permitted

operation not permitted

operation not supported

operation not supported

operation would block

operation would block

protocol not supported

protocol not supported

operator

operator

(0x%X)

(0x%X)

Error (0x%X) while retrieving error. (0x%X)

Error (0x%X) while retrieving error. (0x%X)

RegDeleteKeyExW

RegDeleteKeyExW

advapi32.dll

advapi32.dll

%s-%Iu

%s-%Iu

c:\jenkins\workspace\citrio-dev-clone\browser\src\base\process\memory_win.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\base\process\memory_win.cc

PlatformFile.UnknownErrors.Windows

PlatformFile.UnknownErrors.Windows

Windows NT

Windows NT

%d.%d

%d.%d

user32.dll

user32.dll

Histogram: %s recorded %d samples

Histogram: %s recorded %d samples

(flags = 0x%x)

(flags = 0x%x)

(%d = %3.1f%%)

(%d = %3.1f%%)

0123456789

0123456789

Dictionary keys must be quoted.

Dictionary keys must be quoted.

Unsupported encoding. JSON must be UTF-8.

Unsupported encoding. JSON must be UTF-8.

Line: %i, column: %i, %s

Line: %i, column: %i, %s

full-memory-crash-report

full-memory-crash-report

c:\jenkins\workspace\Citrio-Dev-Clone\browser\src\out\Release\setup.exe.pdb

c:\jenkins\workspace\Citrio-Dev-Clone\browser\src\out\Release\setup.exe.pdb

ShellExecuteExW

ShellExecuteExW

ShellExecuteW

ShellExecuteW

setup.exe

setup.exe

ClearBreakpadPipeEnvironmentVariable

ClearBreakpadPipeEnvironmentVariable

ClearCrashKeyValueImpl

ClearCrashKeyValueImpl

SetCrashKeyValueImpl

SetCrashKeyValueImpl

VERSION.dll

VERSION.dll

WS2_32.dll

WS2_32.dll

WINMM.dll

WINMM.dll

UrlCanonicalizeW

UrlCanonicalizeW

SHLWAPI.dll

SHLWAPI.dll

RegEnumKeyExW

RegEnumKeyExW

RegLoadKeyW

RegLoadKeyW

RegUnLoadKeyW

RegUnLoadKeyW

RegQueryInfoKeyW

RegQueryInfoKeyW

RegCreateKeyExW

RegCreateKeyExW

RegDeleteKeyW

RegDeleteKeyW

RegOpenKeyExW

RegOpenKeyExW

RegCloseKey

RegCloseKey

ADVAPI32.dll

ADVAPI32.dll

GetWindowsDirectoryW

GetWindowsDirectoryW

GetProcessHeap

GetProcessHeap

SetNamedPipeHandleState

SetNamedPipeHandleState

TransactNamedPipe

TransactNamedPipe

WaitNamedPipeW

WaitNamedPipeW

KERNEL32.dll

KERNEL32.dll

ole32.dll

ole32.dll

OLEAUT32.dll

OLEAUT32.dll

SetWindowsHookExW

SetWindowsHookExW

UnhookWindowsHookEx

UnhookWindowsHookEx

USER32.dll

USER32.dll

CreateURLMonikerEx

CreateURLMonikerEx

urlmon.dll

urlmon.dll

WTSAPI32.dll

WTSAPI32.dll

USERENV.dll

USERENV.dll

PeekNamedPipe

PeekNamedPipe

GetCPInfo

GetCPInfo

zcÁ

zcÁ

k.lhx

k.lhx

pK.gJ

pK.gJ

:sssh

:sssh

7:

7:

444.44...4

444.44...4

4.4....4.

4.4....4.

..44.44@4

..44.44@4

4@444@4.

4@444@4.

.4@4@@4.

.4@4@@4.

}.GnO

}.GnO

{oG

{oG

5G%8gG

5G%8gG

wG

wG

!)%)%)%sN

!)%)%)%sN

00l0}0

00l0}0

;#;);/;3;8;?;

;#;);/;3;8;?;

11d1v1

11d1v1

'020@0_0

'020@0_0

>$?/?5?\?

>$?/?5?\?

0 0$0(0,0004080

0 0$0(0,0004080

9 9$9(9,9

9 9$9(9,9

: :$:(:,:0:4:8:<:>

: :$:(:,:0:4:8:<:>

= =$=(=,=8=

= =$=(=,=8=

app_host.exe

app_host.exe

=hXXp://citrio.com/service/updatemessage/

=hXXp://citrio.com/service/updatemessage/

"hXXp://VVV.facebook.com"

"hXXp://VVV.facebook.com"

"hXXp://VVV.youtube.com"

"hXXp://VVV.youtube.com"

"hXXps://chrome.google.com/webstore/"

"hXXps://chrome.google.com/webstore/"

Open Chrome Web Store

Open Chrome Web Store

Chrome Web Store

Chrome Web Store

Ihttp

Ihttp

https

https

{A1326E5F-95B3-49FB-8C1F-610F27E0C5BE}

{A1326E5F-95B3-49FB-8C1F-610F27E0C5BE}

Software\Classes\Interface\{90E75134-C82F-4273-831F-13F6FB52BA1B}

Software\Classes\Interface\{90E75134-C82F-4273-831F-13F6FB52BA1B}

Software\Classes\TypeLib\{5405A76A-9F6D-44E3-91CE-72179B379953}

Software\Classes\TypeLib\{5405A76A-9F6D-44E3-91CE-72179B379953}

Software\Classes\CLSID\{8BF2F61B-E8C2-4A67-85D0-D6A69F9FD948}

Software\Classes\CLSID\{8BF2F61B-E8C2-4A67-85D0-D6A69F9FD948}

ServerExecutable

ServerExecutable

.CommandExecuteImpl Class

.CommandExecuteImpl Class

.StubPath

.StubPath

ieframe.dll

ieframe.dll

0.0.0.0-devel

0.0.0.0-devel

MetricsReportingEnabled

MetricsReportingEnabled

citrio.packed.7z

citrio.packed.7z

chrome.VisualElementsManifest.xml

chrome.VisualElementsManifest.xml

wow_helper.exe

wow_helper.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\%ls\Products\%ls\InstallProperties

SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\%ls\Products\%ls\InstallProperties

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{%ls}

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{%ls}

{92F8A219-E740-49D5-B785-B962AD819724}

{92F8A219-E740-49D5-B785-B962AD819724}

{F0B50D5A-4BBA-4514-AD2C-EBA50C29C460}

{F0B50D5A-4BBA-4514-AD2C-EBA50C29C460}

%SystemRoot%\System32\rundll32.exe

%SystemRoot%\System32\rundll32.exe

..htm

..htm

.html

.html

.xhtml

.xhtml

Software\Microsoft\Windows NT\CurrentVersion\ProfileList\

Software\Microsoft\Windows NT\CurrentVersion\ProfileList\

.DEFAULT\

.DEFAULT\

{3599E25E-6314-4BE9-AE14-E51877342426}

{3599E25E-6314-4BE9-AE14-E51877342426}

{675046A3-9F4F-4805-A81C-CBF753FE3428}

{675046A3-9F4F-4805-A81C-CBF753FE3428}

Browse the web

Browse the web

Software\Microsoft\Windows\CurrentVersion\Uninstall\Citrio

Software\Microsoft\Windows\CurrentVersion\Uninstall\Citrio

registering_chrome

registering_chrome

uninstalling_chrome_frame

uninstalling_chrome_frame

.HTML

.HTML

IDR_OEMPG_EN.HTML

IDR_OEMPG_EN.HTML

chrmstp.exe

chrmstp.exe

{0105EA02-802D-4B37-8161-4ED25C493266}

{0105EA02-802D-4B37-8161-4ED25C493266}

citrio.dll

citrio.dll

citrio.exe

citrio.exe

npchrome_frame.dll

npchrome_frame.dll

chrome_frame_helper.dll

chrome_frame_helper.dll

chrome_frame_helper.exe

chrome_frame_helper.exe

ChromeFrameHelperWindowClass

ChromeFrameHelperWindowClass

new_citrio.exe

new_citrio.exe

old_citrio.exe

old_citrio.exe

delegate_execute.exe

delegate_execute.exe

nacl64.exe

nacl64.exe

chrome.exe

chrome.exe

new_chrome.exe

new_chrome.exe

old_chrome.exe

old_chrome.exe

InstallerSuccessLaunchCmdLine

InstallerSuccessLaunchCmdLine

Software\Microsoft\Windows\CurrentVersion\App Paths

Software\Microsoft\Windows\CurrentVersion\App Paths

.shtml

.shtml

.webp

.webp

webcal

webcal

.webm

.webm

.flac

.flac

.torrent

.torrent

URL Protocol

URL Protocol

\.exe

\.exe

DelegateExecute

DelegateExecute

Browser.Launch

Browser.Launch

\URLAssociations

\URLAssociations

\shell\open\ddeexec

\shell\open\ddeexec

windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel

windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel

" -- "%1"

" -- "%1"

.Software\CatalinaGroup\Citrio

.Software\CatalinaGroup\Citrio

PendingFileRenameOperations

PendingFileRenameOperations

UninstallCmdLine

UninstallCmdLine

WebAccessible

WebAccessible

EMSHTML.DLL

EMSHTML.DLL

chrome_installer.log

chrome_installer.log

hXXp://VVV.citrio.com/welcome.html?intl=$1

hXXp://VVV.citrio.com/welcome.html?intl=$1

-chrome

-chrome

-chromeframe

-chromeframe

GoogleChromeAutoLaunch

GoogleChromeAutoLaunch

{DE28A2EA-77FA-4F2B-8252-C3B5844F6455}

{DE28A2EA-77FA-4F2B-8252-C3B5844F6455}

FGoogle Chrome Frame

FGoogle Chrome Frame

Chrome in a Frame.

Chrome in a Frame.

Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome Frame

Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome Frame

Google Chrome binaries

Google Chrome binaries

F{92F8A219-E740-49D5-B785-B962AD819724}

F{92F8A219-E740-49D5-B785-B962AD819724}

{8BF2F61B-E8C2-4A67-85D0-D6A69F9FD948}

{8BF2F61B-E8C2-4A67-85D0-D6A69F9FD948}

AhXXp://VVV.citrio.com/goodbye.html?intl=$1&survey_id=%ls

AhXXp://VVV.citrio.com/goodbye.html?intl=$1&survey_id=%ls

%d.%d.%d

%d.%d.%d

{E9F24A7C-13CA-42FB-A4D9-79C3C9D21B28}

{E9F24A7C-13CA-42FB-A4D9-79C3C9D21B28}

ChromeCanary

ChromeCanary

ChromeSSHTM

ChromeSSHTM

Chrome Canary HTML Document

Chrome Canary HTML Document

{1BEAC3E3-B852-44F4-B468-8906C062422E}

{1BEAC3E3-B852-44F4-B468-8906C062422E}

AGoogle Chrome Canary

AGoogle Chrome Canary

Opens all ports for Citrio embedded bittorrent client

Opens all ports for Citrio embedded bittorrent client

%u-%u

%u-%u

Crash Reports

Crash Reports

script.log

script.log

resources.pak

resources.pak

pepflashplayer.dll

pepflashplayer.dll

version.json

version.json

NPSWF32.dll

NPSWF32.dll

shell32.dll

shell32.dll

s{A946A6A9-917E-4949-B9BC-6BADA8C7FD63}

s{A946A6A9-917E-4949-B9BC-6BADA8C7FD63}

\\.\pipe\CatalinaGroupCrashServices\

\\.\pipe\CatalinaGroupCrashServices\

\\.\pipe\CitrioCrashServices

\\.\pipe\CitrioCrashServices

error %u

error %u

hunspecified-crash-key

hunspecified-crash-key

dbghelp.dll

dbghelp.dll

rpcrt4.dll

rpcrt4.dll

%s\%s.dmp

%s\%s.dmp