Skip to main content

Trojan.Win32.Swrort.3_7ea8b386de


Trojan.Win32.Swrort.3.FD, GenericInjector.YR (Lavasoft MAS)Behaviour: Trojan

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: 7ea8b386deb153674ae71fbaac54ab76

SHA1: 17476de7e0d446cf9c7f68b6061016abf4132910

SHA256: f74cbf5b6de88c305c8889455151a4a641fe7070442f5f16d12f1f312164f330

SSDeep: 12288:mlzcNRuu/0zxHGSAsbl/JgisB8SwkbFsVCTKXDtRv2VyGXLL:mU7/GHmOJlCXwkaVzTzvO

Size: 724536 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: UPolyXv05_v6

Company: Catalina Group Ltd.

Created at: 2015-10-24 01:28:22

Analyzed on: WindowsXP SP3 32-bit

Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

CatalinaUpdate.exe:1256
CatalinaUpdate.exe:956
CatalinaUpdate.exe:1572
citrio_48.0.2564.270_1.exe:1144
%original file name%.exe:1964

The Trojan injects its code into the following process(es):

CatalinaUpdate.exe:1352
CatalinaUpdate.exe:1496

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process CatalinaUpdate.exe:1256 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\Install\{091E7932-CF93-4194-B98B-4DF75362EFF0}\citrio_48.0.2564.270_1.exe (453901 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\Download\{92F8A219-E740-49D5-B785-B962AD819724}\48.0.2564.270\citrio_48.0.2564.270_1.exe (449813 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\Install (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{59542433-284A-4EA3-B073-F565EFE689C2}-citrio_48.0.2564.270_1.exe (0 bytes)

The process CatalinaUpdate.exe:1352 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_te.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ca.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ru.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_nl.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_fi.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_pl.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_fr.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\psmachine.dll (673 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_uk.dll (26 bytes)
%WinDir%\Tasks\CatalinaGroupUpdateTaskUserS-1-5-21-1844237615-1960408961-1801674531-1003Core.job (948 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_th.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_zh-TW.dll (19 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_vi.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_es-419.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdate.dll (5873 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_fil.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ta.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_tr.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ar.dll (24 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_sk.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_is.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_mr.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_sw.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_es.dll (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_hr.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ja.dll (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_kn.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_en.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_en-GB.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\psuser.dll (673 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_no.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ml.dll (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\CatalinaUpdateHelper.msi (36 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ur.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_am.dll (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_pt-BR.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\CatalinaUpdate.exe (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_bn.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_sv.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_et.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_gu.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_da.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\CatalinaUpdate.exe (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_fa.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ms.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_sr.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_sl.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_hu.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_cs.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_iw.dll (23 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_lt.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ko.dll (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_el.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_hi.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_lv.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_zh-CN.dll (19 bytes)
%WinDir%\Tasks\CatalinaGroupUpdateTaskUserS-1-5-21-1844237615-1960408961-1801674531-1003UA.job (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_de.dll (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_id.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\CatalinaUpdateOnDemand.exe (58 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_pt-PT.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_bg.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\npCatalinaUpdate3.dll (1281 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\CatalinaUpdateBroker.exe (58 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\CatalinaCrashHandler.exe (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ro.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_it.dll (28 bytes)

The process citrio_48.0.2564.270_1.exe:1144 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\CR_DD852.tmp\CITRIO.PACKED.7Z (114356 bytes)

The process %original file name%.exe:1964 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_sl.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_gu.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUT2.tmp (22433 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_nl.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_te.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_sk.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_el.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ru.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_es-419.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_iw.dll (23 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_no.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_tr.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_sr.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_en-GB.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_da.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ro.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_uk.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_zh-TW.dll (19 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_bn.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ms.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ta.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\CatalinaUpdateBroker.exe (58 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_es.dll (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdate.dll (1990 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_sw.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_de.dll (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_is.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_sv.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_fr.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_en.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_cs.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_mr.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_pt-BR.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_fa.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_kn.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_bg.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_pt-PT.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_id.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_fi.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ja.dll (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\npCatalinaUpdate3.dll (236 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\psuser.dll (161 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ml.dll (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ko.dll (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_th.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ca.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_vi.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_hi.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_zh-CN.dll (19 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_lv.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_hu.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\CatalinaUpdate.exe (130 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ar.dll (24 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_pl.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_hr.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\CatalinaUpdateHelper.msi (36 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_lt.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_et.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_am.dll (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\psmachine.dll (155 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\CatalinaCrashHandler.exe (130 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_it.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_fil.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ur.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\CatalinaUpdateOnDemand.exe (58 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp (0 bytes)

Registry activity

The process CatalinaUpdate.exe:1256 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "88 C5 4F 1D BB AE 1E 00 95 41 A1 AA B8 55 FB 49"

[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"usagestats" = "1"
"brand" = "GGLS"
"InstallTime" = "1461018921"
"referral" = "1:citrio_website"
"lang" = "en"

[HKCU\Software\CatalinaGroup\Update\proxy]
"source" = "IE"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\CatalinaGroup\Update]
"LastInstallerError"

[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"LastInstallerExtraCode1"
"browser"
"LastInstallerError"
"ap"
"LastInstallerSuccessLaunchCmdLine"
"eulaaccepted"
"experiment_labels"

[HKCU\Software\CatalinaGroup\Update]
"LastInstallerResultUIString"

[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"LastInstallerResult"
"LastInstallerResultUIString"
"tttoken"

[HKCU\Software\CatalinaGroup\Update]
"LastInstallerExtraCode1"
"LastInstallerSuccessLaunchCmdLine"
"LastInstallerResult"

[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"iid"

The process CatalinaUpdate.exe:1352 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\MozillaPlugins\@catalinahub.net/CatalinaGroup Update;version=9]
"vendor" = "Catalina Group Ltd."
"ProductName" = "CatalinaGroup Update"

[HKCU\Software\CatalinaGroup\Update\ClientState\{6C598730-F715-407B-A7AE-A8F10D0F8FA7}]
"iid" = "{85C86DCC-5D4F-415D-A40F-706AF37A626A}"

[HKCU\Software\CatalinaGroup\Update]
"UID" = "{95F0392D-22E6-48F3-A529-EFF3D49FE892}"

[HKCU\Software\Classes\MIME\Database\Content Type\application/x-vnd.catalinahub.oneclickctrl.9]
"CLSID" = "{841F4080-C687-4E9C-BD6E-EB5EECF4FAE6}"

[HKCU\Software\Classes\CatalinaGroup.OneClickCtrl.9\CLSID]
"(Default)" = "{841F4080-C687-4E9C-BD6E-EB5EECF4FAE6}"

[HKCU\Software\Classes\CLSID\{841F4080-C687-4E9C-BD6E-EB5EECF4FAE6}]
"(Default)" = "CatalinaGroup Update Plugin"

[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{71216BD6-4D03-4387-BD01-7FE8D9512541}]
"Policy" = "3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Classes\MIME\Database\Content Type\application/x-vnd.catalinahub.update3webcontrol.3]
"CLSID" = "{71216BD6-4D03-4387-BD01-7FE8D9512541}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{841F4080-C687-4E9C-BD6E-EB5EECF4FAE6}]
"AppName" = "CatalinaUpdate.exe"

[HKCU\Software\CatalinaGroup\Update]
"Version" = "1.3.25.223"

[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"usagestats" = "1"

[HKCU\Software\MozillaPlugins\@catalinahub.net/CatalinaGroup Update;version=9]
"Description" = "CatalinaGroup Update"

[HKCU\Software\CatalinaGroup\Update\Clients\{6C598730-F715-407B-A7AE-A8F10D0F8FA7}]
"Name" = "Catalina Update"

[HKCU\Software\CatalinaGroup\Update\ClientState\{6C598730-F715-407B-A7AE-A8F10D0F8FA7}]
"InstallTime" = "1461018835"

[HKCU\Software\Classes\CLSID\{841F4080-C687-4E9C-BD6E-EB5EECF4FAE6}\InprocServer32]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\npCatalinaUpdate3.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Classes\CatalinaGroup.Update3WebControl.3]
"(Default)" = "CatalinaGroup Update Plugin"

[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{841F4080-C687-4E9C-BD6E-EB5EECF4FAE6}]
"Policy" = "3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update]
"CatalinaUpdate.exe" = "CatalinaGroup Update"

[HKCU\Software\Classes\CLSID\{841F4080-C687-4E9C-BD6E-EB5EECF4FAE6}\ProgID]
"(Default)" = "CatalinaGroup.OneClickCtrl.9"

[HKCU\Software\MozillaPlugins\@catalinahub.net/CatalinaGroup Update;version=9]
"Path" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\npCatalinaUpdate3.dll"

[HKCU\Software\Classes\CLSID\{841F4080-C687-4E9C-BD6E-EB5EECF4FAE6}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\MozillaPlugins\@catalinahub.net/CatalinaGroup Update;version=3]
"Description" = "CatalinaGroup Update"
"ProductName" = "CatalinaGroup Update"

[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{841F4080-C687-4E9C-BD6E-EB5EECF4FAE6}]
"AppPath" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update"

[HKCU\Software\MozillaPlugins\@catalinahub.net/CatalinaGroup Update;version=3]
"vendor" = "Catalina Group Ltd."

[HKCU\Software\Classes\CLSID\{71216BD6-4D03-4387-BD01-7FE8D9512541}\InprocServer32]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\npCatalinaUpdate3.dll"

[HKCU\Software\MozillaPlugins\@catalinahub.net/CatalinaGroup Update;version=9]
"Version" = "9"

[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{71216BD6-4D03-4387-BD01-7FE8D9512541}]
"AppPath" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223"

[HKCU\Software\CatalinaGroup\Update\ClientState\{6C598730-F715-407B-A7AE-A8F10D0F8FA7}]
"pv" = "1.3.25.223"

[HKCU\Software\Classes\CatalinaGroup.Update3WebControl.3\CLSID]
"(Default)" = "{71216BD6-4D03-4387-BD01-7FE8D9512541}"

[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{71216BD6-4D03-4387-BD01-7FE8D9512541}]
"AppName" = "CatalinaUpdateOnDemand.exe"

[HKCU\Software\CatalinaGroup\Update]
"Path" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\CatalinaUpdate.exe"

[HKCU\Software\MozillaPlugins\@catalinahub.net/CatalinaGroup Update;version=3]
"Version" = "3"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "07 DF CF 03 EF 3C 4D D5 82 8C BC 73 83 77 AF 1B"

[HKCU\Software\Classes\CLSID\{71216BD6-4D03-4387-BD01-7FE8D9512541}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\CatalinaGroup\Update\Clients\{6C598730-F715-407B-A7AE-A8F10D0F8FA7}]
"pv" = "1.3.25.223"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Classes\CLSID\{71216BD6-4D03-4387-BD01-7FE8D9512541}\ProgID]
"(Default)" = "CatalinaGroup.Update3WebControl.3"

[HKCU\Software\MozillaPlugins\@catalinahub.net/CatalinaGroup Update;version=3]
"Path" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\npCatalinaUpdate3.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Classes\CatalinaGroup.OneClickCtrl.9]
"(Default)" = "CatalinaGroup Update Plugin"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Classes\CLSID\{71216BD6-4D03-4387-BD01-7FE8D9512541}]
"(Default)" = "CatalinaGroup Update Plugin"

[HKCU\Software\CatalinaGroup\Update\ClientState\{6C598730-F715-407B-A7AE-A8F10D0F8FA7}]
"brand" = "GGLS"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"CatalinaGroup Update" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\CatalinaUpdate.exe /c"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\CatalinaGroup\Update]
"eulaaccepted"
"ui"
"LastChecked"

[HKCU\Software\CatalinaGroup\Update\ClientState\{6C598730-F715-407B-A7AE-A8F10D0F8FA7}]
"UpdateAvailableSince"
"UpdateAvailableCount"

The process CatalinaUpdate.exe:956 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BB 89 72 69 91 03 FB 53 CB 60 43 75 BF 43 58 D8"

[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Integers]
"windows_sp_major_version" = "03 00 00 00 00 00 00 00"

[HKCU\Software\CatalinaGroup\Update\proxy]
"source" = "IE"

[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Integers]
"windows_minor_version" = "01 00 00 00 00 00 00 00"

[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Counts]
"goopdate_main" = "02 00 00 00 00 00 00 00"

[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Integers]
"windows_major_version" = "05 00 00 00 00 00 00 00"

[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Counts]
"goopdate_constructor" = "02 00 00 00 00 00 00 00"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\CatalinaGroup\Update\network\secure]
"sk"
"c"

The process CatalinaUpdate.exe:1496 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AC FD 01 D1 5F 80 B9 EB C1 4D C8 E9 03 BE DA 06"

[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"usagestats" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\CatalinaGroup\Update]
"eulaaccepted"

The process CatalinaUpdate.exe:1572 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{13660822-39AC-408C-BA99-702EBEE3EF26}]
"CLSID" = "{13660822-39AC-408C-BA99-702EBEE3EF26}"

[HKCU\Software\Classes\Interface\{A2589E53-1490-4C0A-BFC7-A47B7A88E3D8}]
"(Default)" = "ICatalinaUpdate3WebSecurity"

[HKCU\Software\Classes\CatalinaGroupUpdate.Update3COMClassUser]
"(Default)" = "Update3COMClass"

[HKCU\Software\Classes\Interface\{0E09406F-1420-4BF4-B6EB-F0994674AD68}]
"(Default)" = "IAppBundle"

[HKCU\Software\Classes\Interface\{3EA78C6E-8267-4554-8EC6-8982D5AF539A}]
"(Default)" = "ICoCreateAsyncStatus"

[HKCU\Software\Classes\Interface\{0E09406F-1420-4BF4-B6EB-F0994674AD68}\NumMethods]
"(Default)" = "39"

[HKCU\Software\Classes\CLSID\{F4CBF20B-F634-4095-B64A-2EBCDD9E560E}\InprocServer32]
"ThreadingModel" = "Both"

[HKCU\Software\Classes\Interface\{34F067BE-C79C-4C5F-8E64-622A3CC59055}\ProxyStubClsid32]
"(Default)" = "{3EC095D7-1164-4B7C-B570-92B48F6E82DC}"

[HKCU\Software\Classes\CLSID\{13660822-39AC-408C-BA99-702EBEE3EF26}\LocalServer32]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\CatalinaUpdateOnDemand.exe"

[HKCU\Software\Classes\Interface\{23185EAB-61B0-4B70-BE89-589585B91392}\NumMethods]
"(Default)" = "8"

[HKCU\Software\Classes\Interface\{C1D8630A-9D2D-4E0E-A4A1-8AA5CA3FAE57}\ProxyStubClsid32]
"(Default)" = "{3EC095D7-1164-4B7C-B570-92B48F6E82DC}"

[HKCU\Software\Classes\CLSID\{C8362D5A-4303-4E22-8668-BB10D65B95BD}\VersionIndependentProgID]
"(Default)" = "CatalinaGroupUpdate.OnDemandCOMClassUser"

[HKCU\Software\Classes\CLSID\{2823499B-60F3-4940-8042-2C16D5829A39}\VersionIndependentProgID]
"(Default)" = "CatalinaGroupUpdate.Update3WebUser"

[HKCU\Software\Classes\Interface\{7A1A1D82-1E2B-41B8-9FA3-F40D8DD3EEF0}\ProxyStubClsid32]
"(Default)" = "{3EC095D7-1164-4B7C-B570-92B48F6E82DC}"

[HKCU\Software\Classes\Interface\{263B5A28-834A-4D1B-AB71-A28E882CC59B}\NumMethods]
"(Default)" = "13"

[HKCU\Software\Classes\CatalinaGroupUpdate.CredentialDialogUser]
"(Default)" = "GoogleUpdate CredentialDialog"

[HKCU\Software\Classes\Interface\{7C9F9415-9947-482C-A62B-24A0BD92B8A7}\NumMethods]
"(Default)" = "4"

[HKCU\Software\Classes\CLSID\{3EC095D7-1164-4B7C-B570-92B48F6E82DC}]
"(Default)" = "PSFactoryBuffer"

[HKCU\Software\Classes\Interface\{A2589E53-1490-4C0A-BFC7-A47B7A88E3D8}\ProxyStubClsid32]
"(Default)" = "{3EC095D7-1164-4B7C-B570-92B48F6E82DC}"

[HKCU\Software\Classes\Interface\{C1D8630A-9D2D-4E0E-A4A1-8AA5CA3FAE57}]
"(Default)" = "ICredentialDialog"

[HKCU\Software\Classes\Interface\{A1E6F38D-8C9E-4BDA-86A2-1940472A8429}]
"(Default)" = "ICatalinaUpdate"

[HKCU\Software\Classes\Interface\{FFC6ECB2-25E8-40EE-BF37-5AA25CBCBA63}\NumMethods]
"(Default)" = "10"

[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Counts]
"goopdate_main" = "01 00 00 00 00 00 00 00"

[HKCU\Software\Classes\Interface\{D085AC3B-E5CC-40C9-8366-C12ADC489967}\ProxyStubClsid32]
"(Default)" = "{3EC095D7-1164-4B7C-B570-92B48F6E82DC}"

[HKCU\Software\Classes\Interface\{789E3792-8514-4ED5-90F3-5B525275B953}\ProxyStubClsid32]
"(Default)" = "{3EC095D7-1164-4B7C-B570-92B48F6E82DC}"

[HKCU\Software\Classes\Interface\{FCD277CC-8D3E-4264-80D3-98E7B05E2E8A}\ProxyStubClsid32]
"(Default)" = "{3EC095D7-1164-4B7C-B570-92B48F6E82DC}"

[HKCU\Software\Classes\CLSID\{3C564FFE-55F7-43AC-886C-7E9E9091CB2A}]
"(Default)" = "Update3COMClass"

[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Integers]
"windows_sp_major_version" = "03 00 00 00 00 00 00 00"

[HKCU\Software\Classes\CLSID\{73436A91-85A6-4850-A7D0-375C4E369A5A}\ProgID]
"(Default)" = "CatalinaGroupUpdate.CredentialDialogUser.1.0"

[HKCU\Software\Classes\CLSID\{13660822-39AC-408C-BA99-702EBEE3EF26}]
"(Default)" = "CatalinaGroup.OneClickProcessLauncher"

[HKCU\Software\Classes\Interface\{263B5A28-834A-4D1B-AB71-A28E882CC59B}\ProxyStubClsid32]
"(Default)" = "{3EC095D7-1164-4B7C-B570-92B48F6E82DC}"

[HKCU\Software\Classes\CLSID\{C8362D5A-4303-4E22-8668-BB10D65B95BD}]
"(Default)" = "Google Update Legacy On Demand"

[HKCU\Software\Classes\CLSID\{EC8AA9F5-22DB-42D4-9E26-0316CBCE7EAA}\InprocHandler32]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\psuser.dll"

[HKCU\Software\Classes\Interface\{FCD277CC-8D3E-4264-80D3-98E7B05E2E8A}\NumMethods]
"(Default)" = "10"

[HKCU\Software\Classes\Interface\{CBAC6FCC-819A-443D-98BB-E7A122DCCAE3}\NumMethods]
"(Default)" = "4"

[HKCU\Software\Classes\Interface\{7C9F9415-9947-482C-A62B-24A0BD92B8A7}\ProxyStubClsid32]
"(Default)" = "{3EC095D7-1164-4B7C-B570-92B48F6E82DC}"

[HKCU\Software\Classes\Interface\{0CD725CD-5650-4F13-91DA-E42FAA9687E8}\ProxyStubClsid32]
"(Default)" = "{3EC095D7-1164-4B7C-B570-92B48F6E82DC}"

[HKCU\Software\Classes\CatalinaGroupUpdate.Update3WebUser\CLSID]
"(Default)" = "{2823499B-60F3-4940-8042-2C16D5829A39}"

[HKCU\Software\Classes\Interface\{FCD277CC-8D3E-4264-80D3-98E7B05E2E8A}]
"(Default)" = "IAppVersionWeb"

[HKCU\Software\Classes\CatalinaGroupUpdate.CredentialDialogUser.1.0]
"(Default)" = "GoogleUpdate CredentialDialog"

[HKCU\Software\Classes\Interface\{84BA4DAC-82EA-4DC8-BCB0-B69DD6E95670}\ProxyStubClsid32]
"(Default)" = "{3EC095D7-1164-4B7C-B570-92B48F6E82DC}"

[HKCU\Software\Classes\Interface\{F009E353-D4BD-42FE-994E-F6C315055F9B}\ProxyStubClsid32]
"(Default)" = "{3EC095D7-1164-4B7C-B570-92B48F6E82DC}"

[HKCU\Software\Classes\CatalinaGroupUpdate.Update3COMClassUser\CurVer]
"(Default)" = "CatalinaGroupUpdate.Update3COMClassUser.1.0"

[HKCU\Software\Classes\CLSID\{73436A91-85A6-4850-A7D0-375C4E369A5A}\VersionIndependentProgID]
"(Default)" = "CatalinaGroupUpdate.CredentialDialogUser"

[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Integers]
"windows_minor_version" = "01 00 00 00 00 00 00 00"

[HKCU\Software\Classes\Interface\{CBAC6FCC-819A-443D-98BB-E7A122DCCAE3}]
"(Default)" = "IOneClickProcessLauncher"

[HKCU\Software\Classes\Interface\{051D14B3-CF0F-4CCA-B8FE-AF9E007ACD43}\NumMethods]
"(Default)" = "4"

[HKCU\Software\Classes\Interface\{051D14B3-CF0F-4CCA-B8FE-AF9E007ACD43}]
"(Default)" = "ICoCreateAsync"

[HKCU\Software\Classes\Interface\{F9F2D675-F172-42F2-A26E-6453B80EA7F1}]
"(Default)" = "ICurrentState"

[HKCU\Software\Classes\CLSID\{3C564FFE-55F7-43AC-886C-7E9E9091CB2A}\ProgID]
"(Default)" = "CatalinaGroupUpdate.Update3COMClassUser.1.0"

[HKCU\Software\Classes\Interface\{789E3792-8514-4ED5-90F3-5B525275B953}]
"(Default)" = "IAppBundleWeb"

[HKCU\Software\Classes\Interface\{D085AC3B-E5CC-40C9-8366-C12ADC489967}]
"(Default)" = "IApp"

[HKCU\Software\Classes\Interface\{A1E6F38D-8C9E-4BDA-86A2-1940472A8429}\NumMethods]
"(Default)" = "5"

[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Integers]
"windows_major_version" = "05 00 00 00 00 00 00 00"

[HKCU\Software\Classes\CatalinaGroup.OneClickProcessLauncherUser\CLSID]
"(Default)" = "{13660822-39AC-408C-BA99-702EBEE3EF26}"

[HKCU\Software\Classes\Interface\{A1E6F38D-8C9E-4BDA-86A2-1940472A8429}\ProxyStubClsid32]
"(Default)" = "{3EC095D7-1164-4B7C-B570-92B48F6E82DC}"

[HKCU\Software\Classes\CatalinaGroupUpdate.CredentialDialogUser\CLSID]
"(Default)" = "{73436A91-85A6-4850-A7D0-375C4E369A5A}"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2D 0B 44 0B 13 82 C0 AC FB D5 92 E4 67 48 EF 98"

[HKCU\Software\Classes\CLSID\{3EC095D7-1164-4B7C-B570-92B48F6E82DC}\InProcServer32]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\psuser.dll"

[HKCU\Software\Classes\Interface\{D085AC3B-E5CC-40C9-8366-C12ADC489967}\NumMethods]
"(Default)" = "44"

[HKCU\Software\Classes\CLSID\{13660822-39AC-408C-BA99-702EBEE3EF26}\VersionIndependentProgID]
"(Default)" = "CatalinaGroup.OneClickProcessLauncherUser"

[HKCU\Software\Classes\CatalinaGroupUpdate.Update3WebUser.1.0]
"(Default)" = "GoogleUpdate Update3Web"

[HKCU\Software\Classes\Interface\{C1D8630A-9D2D-4E0E-A4A1-8AA5CA3FAE57}\NumMethods]
"(Default)" = "4"

[HKCU\Software\Classes\Interface\{0CD725CD-5650-4F13-91DA-E42FAA9687E8}\NumMethods]
"(Default)" = "10"

[HKCU\Software\Classes\Interface\{34F067BE-C79C-4C5F-8E64-622A3CC59055}\NumMethods]
"(Default)" = "9"

[HKCU\Software\Classes\Interface\{EC3867B7-B9EF-494E-B42B-BA009D57D90E}\NumMethods]
"(Default)" = "6"

[HKCU\Software\Classes\Interface\{6B6DE56F-09F2-4343-80AD-28E5D6CB78F9}\ProxyStubClsid32]
"(Default)" = "{3EC095D7-1164-4B7C-B570-92B48F6E82DC}"

[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{13660822-39AC-408C-BA99-702EBEE3EF26}]
"Policy" = "3"

[HKCU\Software\Classes\Interface\{F9F2D675-F172-42F2-A26E-6453B80EA7F1}\ProxyStubClsid32]
"(Default)" = "{3EC095D7-1164-4B7C-B570-92B48F6E82DC}"

[HKCU\Software\Classes\Interface\{0E09406F-1420-4BF4-B6EB-F0994674AD68}\ProxyStubClsid32]
"(Default)" = "{3EC095D7-1164-4B7C-B570-92B48F6E82DC}"

[HKCU\Software\Classes\CatalinaGroupUpdate.Update3WebUser\CurVer]
"(Default)" = "CatalinaGroupUpdate.Update3WebUser.1.0"

[HKCU\Software\Classes\Interface\{6B6DE56F-09F2-4343-80AD-28E5D6CB78F9}\NumMethods]
"(Default)" = "14"

[HKCU\Software\Classes\CLSID\{2823499B-60F3-4940-8042-2C16D5829A39}\ProgID]
"(Default)" = "CatalinaGroupUpdate.Update3WebUser.1.0"

[HKCU\Software\Classes\Interface\{7C9F9415-9947-482C-A62B-24A0BD92B8A7}]
"(Default)" = "ICatalinaUpdateCore"

[HKCU\Software\Classes\Interface\{3EA78C6E-8267-4554-8EC6-8982D5AF539A}\NumMethods]
"(Default)" = "10"

[HKCU\Software\Classes\CLSID\{73436A91-85A6-4850-A7D0-375C4E369A5A}\LocalServer32]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\CatalinaUpdateOnDemand.exe"

[HKCU\Software\Classes\Interface\{051D14B3-CF0F-4CCA-B8FE-AF9E007ACD43}\ProxyStubClsid32]
"(Default)" = "{3EC095D7-1164-4B7C-B570-92B48F6E82DC}"

[HKCU\Software\Classes\CLSID\{EC8AA9F5-22DB-42D4-9E26-0316CBCE7EAA}\InprocHandler32]
"ThreadingModel" = "Both"

[HKCU\Software\Classes\CLSID\{2823499B-60F3-4940-8042-2C16D5829A39}]
"(Default)" = "GoogleUpdate Update3Web"

[HKCU\Software\Classes\CLSID\{13660822-39AC-408C-BA99-702EBEE3EF26}\ProgID]
"(Default)" = "CatalinaGroup.OneClickProcessLauncherUser.1.0"

[HKCU\Software\Classes\Interface\{CBAC6FCC-819A-443D-98BB-E7A122DCCAE3}\ProxyStubClsid32]
"(Default)" = "{3EC095D7-1164-4B7C-B570-92B48F6E82DC}"

[HKCU\Software\Classes\CatalinaGroup.OneClickProcessLauncherUser\CurVer]
"(Default)" = "CatalinaGroup.OneClickProcessLauncherUser.1.0"

[HKCU\Software\Classes\CLSID\{2823499B-60F3-4940-8042-2C16D5829A39}\LocalServer32]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\CatalinaUpdateOnDemand.exe"

[HKCU\Software\Classes\Interface\{FFC6ECB2-25E8-40EE-BF37-5AA25CBCBA63}\ProxyStubClsid32]
"(Default)" = "{3EC095D7-1164-4B7C-B570-92B48F6E82DC}"

[HKCU\Software\Classes\Interface\{84BA4DAC-82EA-4DC8-BCB0-B69DD6E95670}\NumMethods]
"(Default)" = "10"

[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Counts]
"goopdate_constructor" = "01 00 00 00 00 00 00 00"

[HKCU\Software\Classes\Interface\{FFC6ECB2-25E8-40EE-BF37-5AA25CBCBA63}]
"(Default)" = "ICatalinaUpdate3"

[HKCU\Software\Classes\CatalinaGroup.OneClickProcessLauncherUser.1.0]
"(Default)" = "CatalinaGroup.OneClickProcessLauncher"

[HKCU\Software\Classes\Interface\{263B5A28-834A-4D1B-AB71-A28E882CC59B}]
"(Default)" = "IJobObserver"

[HKCU\Software\Classes\Interface\{0CD725CD-5650-4F13-91DA-E42FAA9687E8}]
"(Default)" = "IAppVersion"

[HKCU\Software\Classes\CatalinaGroupUpdate.OnDemandCOMClassUser.1.0]
"(Default)" = "Google Update Legacy On Demand"

[HKCU\Software\Classes\Interface\{F009E353-D4BD-42FE-994E-F6C315055F9B}]
"(Default)" = "ICatalinaUpdate3Web"

[HKCU\Software\Classes\Interface\{F009E353-D4BD-42FE-994E-F6C315055F9B}\NumMethods]
"(Default)" = "8"

[HKCU\Software\Classes\Interface\{A2589E53-1490-4C0A-BFC7-A47B7A88E3D8}\NumMethods]
"(Default)" = "4"

[HKCU\Software\Classes\Interface\{23185EAB-61B0-4B70-BE89-589585B91392}\ProxyStubClsid32]
"(Default)" = "{3EC095D7-1164-4B7C-B570-92B48F6E82DC}"

[HKCU\Software\Classes\Interface\{EC3867B7-B9EF-494E-B42B-BA009D57D90E}\ProxyStubClsid32]
"(Default)" = "{3EC095D7-1164-4B7C-B570-92B48F6E82DC}"

[HKCU\Software\Classes\CLSID\{3C564FFE-55F7-43AC-886C-7E9E9091CB2A}\VersionIndependentProgID]
"(Default)" = "CatalinaGroupUpdate.Update3COMClassUser"

[HKCU\Software\Classes\CatalinaGroupUpdate.OnDemandCOMClassUser\CLSID]
"(Default)" = "{C8362D5A-4303-4E22-8668-BB10D65B95BD}"

[HKCU\Software\Classes\Interface\{7A1A1D82-1E2B-41B8-9FA3-F40D8DD3EEF0}]
"(Default)" = "IBrowserHttpRequest2"

[HKCU\Software\Classes\CLSID\{F4CBF20B-F634-4095-B64A-2EBCDD9E560E}\InprocServer32]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\psuser.dll"

[HKCU\Software\Classes\CatalinaGroupUpdate.Update3WebUser.1.0\CLSID]
"(Default)" = "{2823499B-60F3-4940-8042-2C16D5829A39}"

[HKCU\Software\Classes\CatalinaGroupUpdate.Update3COMClassUser.1.0]
"(Default)" = "Update3COMClass"

[HKCU\Software\Classes\Interface\{789E3792-8514-4ED5-90F3-5B525275B953}\NumMethods]
"(Default)" = "24"

[HKCU\Software\Classes\Interface\{84BA4DAC-82EA-4DC8-BCB0-B69DD6E95670}]
"(Default)" = "IPackage"

[HKCU\Software\Classes\Interface\{7A1A1D82-1E2B-41B8-9FA3-F40D8DD3EEF0}\NumMethods]
"(Default)" = "4"

[HKCU\Software\Classes\CLSID\{C8362D5A-4303-4E22-8668-BB10D65B95BD}\LocalServer32]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\CatalinaUpdateOnDemand.exe"

[HKCU\Software\Classes\Interface\{3EA78C6E-8267-4554-8EC6-8982D5AF539A}\ProxyStubClsid32]
"(Default)" = "{3EC095D7-1164-4B7C-B570-92B48F6E82DC}"

[HKCU\Software\Classes\CLSID\{3C564FFE-55F7-43AC-886C-7E9E9091CB2A}\LocalServer32]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\CatalinaUpdate.exe"

[HKCU\Software\Classes\CatalinaGroupUpdate.Update3COMClassUser.1.0\CLSID]
"(Default)" = "{3C564FFE-55F7-43AC-886C-7E9E9091CB2A}"

[HKCU\Software\Classes\Interface\{6B6DE56F-09F2-4343-80AD-28E5D6CB78F9}]
"(Default)" = "IAppWeb"

[HKCU\Software\Classes\CatalinaGroupUpdate.OnDemandCOMClassUser.1.0\CLSID]
"(Default)" = "{C8362D5A-4303-4E22-8668-BB10D65B95BD}"

[HKCU\Software\Classes\CatalinaGroupUpdate.Update3WebUser]
"(Default)" = "GoogleUpdate Update3Web"

[HKCU\Software\Classes\CatalinaGroup.OneClickProcessLauncherUser]
"(Default)" = "CatalinaGroup.OneClickProcessLauncher"

[HKCU\Software\Classes\Interface\{F9F2D675-F172-42F2-A26E-6453B80EA7F1}\NumMethods]
"(Default)" = "24"

[HKCU\Software\Classes\CatalinaGroup.OneClickProcessLauncherUser.1.0\CLSID]
"(Default)" = "{13660822-39AC-408C-BA99-702EBEE3EF26}"

[HKCU\Software\Classes\Interface\{EC3867B7-B9EF-494E-B42B-BA009D57D90E}]
"(Default)" = "IProcessLauncher"

[HKCU\Software\Classes\CatalinaGroupUpdate.OnDemandCOMClassUser\CurVer]
"(Default)" = "CatalinaGroupUpdate.OnDemandCOMClassUser.1.0"

[HKCU\Software\Classes\CLSID\{C8362D5A-4303-4E22-8668-BB10D65B95BD}\ProgID]
"(Default)" = "CatalinaGroupUpdate.OnDemandCOMClassUser.1.0"

[HKCU\Software\Classes\CatalinaGroupUpdate.Update3COMClassUser\CLSID]
"(Default)" = "{3C564FFE-55F7-43AC-886C-7E9E9091CB2A}"

[HKCU\Software\Classes\CatalinaGroupUpdate.CredentialDialogUser\CurVer]
"(Default)" = "CatalinaGroupUpdate.CredentialDialogUser.1.0"

[HKCU\Software\Classes\CLSID\{3EC095D7-1164-4B7C-B570-92B48F6E82DC}\InProcServer32]
"ThreadingModel" = "Both"

[HKCU\Software\Classes\Interface\{34F067BE-C79C-4C5F-8E64-622A3CC59055}]
"(Default)" = "IProgressWndEvents"

[HKCU\Software\Classes\CatalinaGroupUpdate.OnDemandCOMClassUser]
"(Default)" = "Google Update Legacy On Demand"

[HKCU\Software\Classes\CLSID\{73436A91-85A6-4850-A7D0-375C4E369A5A}]
"(Default)" = "GoogleUpdate CredentialDialog"

[HKCU\Software\Classes\CatalinaGroupUpdate.CredentialDialogUser.1.0\CLSID]
"(Default)" = "{73436A91-85A6-4850-A7D0-375C4E369A5A}"

[HKCU\Software\Classes\Interface\{23185EAB-61B0-4B70-BE89-589585B91392}]
"(Default)" = "IRegistrationUpdateHook"

The Trojan deletes the following registry key(s):

[HKCU\Software\Classes\CLSID\{F4CBF20B-F634-4095-B64A-2EBCDD9E560E}]
[HKCU\Software\Classes\CLSID\{EC8AA9F5-22DB-42D4-9E26-0316CBCE7EAA}\InprocHandler32]
[HKCU\Software\Classes\CLSID\{F4CBF20B-F634-4095-B64A-2EBCDD9E560E}\InprocServer32]
[HKCU\Software\Classes\CLSID\{EC8AA9F5-22DB-42D4-9E26-0316CBCE7EAA}]

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\CatalinaGroup\Update\network\secure]
"sk"
"c"

The process citrio_48.0.2564.270_1.exe:1144 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"ap" = "-full"

The process %original file name%.exe:1964 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "18 36 DE 03 90 6B 8D A2 A7 95 5D 30 7A 10 8E 32"

Dropped PE files

MD5 File path
17a70cbefd0c97da5b5154bcc2c6135ac:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\CatalinaCrashHandler.exe
17a70cbefd0c97da5b5154bcc2c6135ac:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\CatalinaUpdate.exe
f1344174407b31ebf73a1b757730e7b9c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\CatalinaUpdateBroker.exe
d97a494f356a9b87a9de70f94deac0fdc:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\CatalinaUpdateOnDemand.exe
ddba4ef4336eab079a05d50cae1d78adc:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdate.dll
9679f1b877f59885a1cb0dc781f6f5a9c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_am.dll
e978743b5e83e6d8d56ef8eec9e95895c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ar.dll
632bf3bf2c7c43de40e14e180d450aa4c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_bg.dll
f9b49228bdb016a10ee484d00d20c56dc:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_bn.dll
750e817cff45df02c6219fd7f8629306c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ca.dll
befa1de1a499caf2dd8c849d307ea022c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_cs.dll
64a3b9bd31048d1474be89bf8b759a6bc:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_da.dll
124b5b534765959135d7e5e8387e42d4c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_de.dll
7c9392a39aa7af12ba9516108461396cc:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_el.dll
5a72210a08f840c981a22a30eae6bfd5c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_en-GB.dll
de806ca7439b321cb5b9ed465bfff53cc:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_en.dll
ce161f171dede65306ae260f2daed707c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_es-419.dll
6804fe6306170c2e03e67a9a6912e44dc:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_es.dll
1f27b6a0f1239dc5a0ad99ebb9f266b1c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_et.dll
362caadf56cbb795429cb414d7526249c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_fa.dll
980c0b9460aebcd0e6c26597ebbbe405c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_fi.dll
8d0545918a67993b61d41e37ddf0a448c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_fil.dll
00c69aa9c97e7adecebbabeb9d62c1e5c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_fr.dll
5bf66f20dec62b4fba86cc774e30f42dc:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_gu.dll
0e0d1132eff66a2408379b417b95ec23c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_hi.dll
d12036e6329b12ae75e288669b2fc0afc:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_hr.dll
d467c0c1a4d788d0905393dfaf485135c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_hu.dll
63468abea9a361c189a52329f26cc88dc:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_id.dll
f88e2998a5136c6015b320e30260ec4ec:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_is.dll
bcd98fb11a392837a3a6699335e89a9dc:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_it.dll
b798ad9f420015dcff3fe32d9731aef9c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_iw.dll
fdeea71e5153722ddce94417c3e80ce5c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ja.dll
82c275cbb0ba0d37128e7c77b0e540e7c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_kn.dll
6c041119591f741151f508b6b691e03ac:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ko.dll
26fa6e3a970fb0a5c63ae57d45198327c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_lt.dll
ac5751840335dedbf1e8dd1a87d12682c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_lv.dll
9e325dcb01d553307dd6ef773f3f475ec:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ml.dll
28d3149dc5e5410f66a1935f1dda41d6c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_mr.dll
606a92ebf1a461a2ba5ddd2b15bf2ed4c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ms.dll
10bf4f168b43efe576660cf340c9cd44c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_nl.dll
6053f5753647853fc4830829724469d4c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_no.dll
eead3f9d5abb707b01c87121f591c8e9c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_pl.dll
5dfeab4174bf0228faf838a29df7713ec:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_pt-BR.dll
64046abd01dccbc734f7b5c1b64678f6c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_pt-PT.dll
bae8f1473a25a4b3211e66ef365cc7b7c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ro.dll
839fd225d791d571349676b747e28395c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ru.dll
d46def9b2394e5f015707534463847a0c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_sk.dll
d48a353ecb8e92c8ccdfff936e46ba87c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_sl.dll
422ba3343eec0f6b27ac2ae49d660e33c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_sr.dll
e73a1377dfa148fab829f0c5c8808a63c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_sv.dll
405d4703ec5f16199eba427de348aca2c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_sw.dll
ecd6fab6f8cddc32adb706da61eab103c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ta.dll
fffa3bef66e32c82e0c73568dff849bec:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_te.dll
560d84e7c8d683dbff92d57e1a399f51c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_th.dll
ba00b2fb66629db19348a84b980d18e0c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_tr.dll
2a65fe2d121400d813a82eab20a939e3c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_uk.dll
5583d364750bb7d81f14c94e5c7436d0c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ur.dll
b2ca11171e5a17aa8056c180b24cf666c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_vi.dll
91c54079cc80835aad5556fb920d03fac:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_zh-CN.dll
d6d9fb241c73daa86742c054bd5d2a9ec:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_zh-TW.dll
1d68f6707885426f86311c25e3ffe412c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\npCatalinaUpdate3.dll
0338eb214377352a1a4064b4d82caa01c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\psmachine.dll
6de2e660635cc112929517ca85f068a2c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\psuser.dll
17a70cbefd0c97da5b5154bcc2c6135ac:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\CatalinaUpdate.exe
17a70cbefd0c97da5b5154bcc2c6135ac:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\CatalinaCrashHandler.exe
17a70cbefd0c97da5b5154bcc2c6135ac:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\CatalinaUpdate.exe
f1344174407b31ebf73a1b757730e7b9c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\CatalinaUpdateBroker.exe
d97a494f356a9b87a9de70f94deac0fdc:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\CatalinaUpdateOnDemand.exe
ddba4ef4336eab079a05d50cae1d78adc:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdate.dll
9679f1b877f59885a1cb0dc781f6f5a9c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_am.dll
e978743b5e83e6d8d56ef8eec9e95895c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_ar.dll
632bf3bf2c7c43de40e14e180d450aa4c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_bg.dll
f9b49228bdb016a10ee484d00d20c56dc:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_bn.dll
750e817cff45df02c6219fd7f8629306c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_ca.dll
befa1de1a499caf2dd8c849d307ea022c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_cs.dll
64a3b9bd31048d1474be89bf8b759a6bc:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_da.dll
124b5b534765959135d7e5e8387e42d4c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_de.dll
7c9392a39aa7af12ba9516108461396cc:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_el.dll
5a72210a08f840c981a22a30eae6bfd5c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_en-GB.dll
de806ca7439b321cb5b9ed465bfff53cc:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_en.dll
ce161f171dede65306ae260f2daed707c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_es-419.dll
6804fe6306170c2e03e67a9a6912e44dc:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_es.dll
1f27b6a0f1239dc5a0ad99ebb9f266b1c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_et.dll
362caadf56cbb795429cb414d7526249c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_fa.dll
980c0b9460aebcd0e6c26597ebbbe405c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_fi.dll
8d0545918a67993b61d41e37ddf0a448c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_fil.dll
00c69aa9c97e7adecebbabeb9d62c1e5c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_fr.dll
5bf66f20dec62b4fba86cc774e30f42dc:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_gu.dll
0e0d1132eff66a2408379b417b95ec23c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_hi.dll
d12036e6329b12ae75e288669b2fc0afc:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_hr.dll
d467c0c1a4d788d0905393dfaf485135c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_hu.dll
63468abea9a361c189a52329f26cc88dc:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_id.dll
f88e2998a5136c6015b320e30260ec4ec:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_is.dll
bcd98fb11a392837a3a6699335e89a9dc:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_it.dll
b798ad9f420015dcff3fe32d9731aef9c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_iw.dll
fdeea71e5153722ddce94417c3e80ce5c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_ja.dll
82c275cbb0ba0d37128e7c77b0e540e7c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_kn.dll
6c041119591f741151f508b6b691e03ac:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_ko.dll
26fa6e3a970fb0a5c63ae57d45198327c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_lt.dll
ac5751840335dedbf1e8dd1a87d12682c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_lv.dll
9e325dcb01d553307dd6ef773f3f475ec:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_ml.dll
28d3149dc5e5410f66a1935f1dda41d6c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_mr.dll
606a92ebf1a461a2ba5ddd2b15bf2ed4c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_ms.dll
10bf4f168b43efe576660cf340c9cd44c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_nl.dll
6053f5753647853fc4830829724469d4c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_no.dll
eead3f9d5abb707b01c87121f591c8e9c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_pl.dll
5dfeab4174bf0228faf838a29df7713ec:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_pt-BR.dll
64046abd01dccbc734f7b5c1b64678f6c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_pt-PT.dll
bae8f1473a25a4b3211e66ef365cc7b7c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_ro.dll
839fd225d791d571349676b747e28395c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_ru.dll
d46def9b2394e5f015707534463847a0c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_sk.dll
d48a353ecb8e92c8ccdfff936e46ba87c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_sl.dll
422ba3343eec0f6b27ac2ae49d660e33c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_sr.dll
e73a1377dfa148fab829f0c5c8808a63c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_sv.dll
405d4703ec5f16199eba427de348aca2c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_sw.dll
ecd6fab6f8cddc32adb706da61eab103c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_ta.dll
fffa3bef66e32c82e0c73568dff849bec:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_te.dll
560d84e7c8d683dbff92d57e1a399f51c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_th.dll
ba00b2fb66629db19348a84b980d18e0c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_tr.dll
2a65fe2d121400d813a82eab20a939e3c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_uk.dll
5583d364750bb7d81f14c94e5c7436d0c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_ur.dll
b2ca11171e5a17aa8056c180b24cf666c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_vi.dll
91c54079cc80835aad5556fb920d03fac:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_zh-CN.dll
d6d9fb241c73daa86742c054bd5d2a9ec:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\goopdateres_zh-TW.dll
1d68f6707885426f86311c25e3ffe412c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\npCatalinaUpdate3.dll
0338eb214377352a1a4064b4d82caa01c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\psmachine.dll
6de2e660635cc112929517ca85f068a2c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM1.tmp\psuser.dll

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.

Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):

    CatalinaUpdate.exe:1256
    CatalinaUpdate.exe:956
    CatalinaUpdate.exe:1572
    citrio_48.0.2564.270_1.exe:1144
    %original file name%.exe:1964

  2. Delete the original Trojan file.
  3. Delete or disinfect the following files created/modified by the Trojan:

    %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\Install\{091E7932-CF93-4194-B98B-4DF75362EFF0}\citrio_48.0.2564.270_1.exe (453901 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\Download\{92F8A219-E740-49D5-B785-B962AD819724}\48.0.2564.270\citrio_48.0.2564.270_1.exe (449813 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_te.dll (26 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ca.dll (27 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ru.dll (26 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_nl.dll (28 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_fi.dll (26 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_pl.dll (28 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_fr.dll (28 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\psmachine.dll (673 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_uk.dll (26 bytes)
    %WinDir%\Tasks\CatalinaGroupUpdateTaskUserS-1-5-21-1844237615-1960408961-1801674531-1003Core.job (948 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_th.dll (25 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_zh-TW.dll (19 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_vi.dll (25 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_es-419.dll (26 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdate.dll (5873 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_fil.dll (28 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ta.dll (28 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_tr.dll (26 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ar.dll (24 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_sk.dll (27 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_is.dll (26 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_mr.dll (26 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_sw.dll (26 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_es.dll (29 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_hr.dll (27 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ja.dll (22 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_kn.dll (27 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_en.dll (25 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_en-GB.dll (25 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\psuser.dll (673 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_no.dll (26 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ml.dll (29 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\CatalinaUpdateHelper.msi (36 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ur.dll (26 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_am.dll (22 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_pt-BR.dll (26 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\CatalinaUpdate.exe (601 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_bn.dll (26 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_sv.dll (26 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_et.dll (25 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_gu.dll (26 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_da.dll (26 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\CatalinaUpdate.exe (601 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_fa.dll (25 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ms.dll (26 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_sr.dll (26 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_sl.dll (27 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_hu.dll (27 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_cs.dll (26 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_iw.dll (23 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_lt.dll (25 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ko.dll (21 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_el.dll (28 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_hi.dll (26 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_lv.dll (28 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_zh-CN.dll (19 bytes)
    %WinDir%\Tasks\CatalinaGroupUpdateTaskUserS-1-5-21-1844237615-1960408961-1801674531-1003UA.job (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_de.dll (29 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_id.dll (25 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\CatalinaUpdateOnDemand.exe (58 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_pt-PT.dll (26 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_bg.dll (28 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\npCatalinaUpdate3.dll (1281 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\CatalinaUpdateBroker.exe (58 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\CatalinaCrashHandler.exe (601 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ro.dll (27 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_it.dll (28 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\CR_DD852.tmp\CITRIO.PACKED.7Z (114356 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_sl.dll (27 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_gu.dll (26 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUT2.tmp (22433 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_nl.dll (28 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_te.dll (26 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_sk.dll (27 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_el.dll (28 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ru.dll (26 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_es-419.dll (26 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_iw.dll (23 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_no.dll (26 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_tr.dll (26 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_sr.dll (26 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_en-GB.dll (25 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_da.dll (26 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ro.dll (27 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_uk.dll (26 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_zh-TW.dll (19 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_bn.dll (26 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ms.dll (26 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ta.dll (28 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\CatalinaUpdateBroker.exe (58 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_es.dll (29 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdate.dll (1990 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_sw.dll (26 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_de.dll (29 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_is.dll (26 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_sv.dll (26 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_fr.dll (28 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_en.dll (25 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_cs.dll (26 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_mr.dll (26 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_pt-BR.dll (26 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_fa.dll (25 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_kn.dll (27 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_bg.dll (28 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_pt-PT.dll (26 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_id.dll (25 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_fi.dll (26 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ja.dll (22 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\npCatalinaUpdate3.dll (236 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\psuser.dll (161 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ml.dll (29 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ko.dll (21 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_th.dll (25 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ca.dll (27 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_vi.dll (25 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_hi.dll (26 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_zh-CN.dll (19 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_lv.dll (28 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_hu.dll (27 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\CatalinaUpdate.exe (130 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ar.dll (24 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_pl.dll (28 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_hr.dll (27 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\CatalinaUpdateHelper.msi (36 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_lt.dll (25 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_et.dll (25 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_am.dll (22 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\psmachine.dll (155 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\CatalinaCrashHandler.exe (130 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_it.dll (28 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_fil.dll (28 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ur.dll (26 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\CatalinaUpdateOnDemand.exe (58 bytes)

  4. Delete the following value(s) in the autorun key (How to Work with System Registry):

    [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
    "CatalinaGroup Update" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\CatalinaUpdate.exe /c"

  5. Reboot the computer.
*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: Catalina Group Ltd.
Product Name: CatalinaGroup Update
Product Version: 1.3.25.223
Legal Copyright: Copyright 2013 Catalina Group Ltd.
Legal Trademarks:
Original Filename: CatalinaUpdateSetup.exe
Internal Name: CatalinaGroup Update Setup
File Version: 1.3.25.223
File Description: CatalinaGroup Update Setup
Comments:
Language: Language Neutral

Company Name: Catalina Group Ltd.Product Name: CatalinaGroup UpdateProduct Version: 1.3.25.223Legal Copyright: Copyright 2013 Catalina Group Ltd.Legal Trademarks: Original Filename: CatalinaUpdateSetup.exeInternal Name: CatalinaGroup Update SetupFile Version: 1.3.25.223File Description: CatalinaGroup Update SetupComments: Language: Language Neutral

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
.text409647535476164.636352752a1441fa592610b94de20c1f02a58
.rdata5324810788112643.70626137b135f165828e6808d51b0f23fe651
.data65536646035841.723688e425fbedc6927dfabb8fdfaaf8e8d97
.rsrc737286513486517765.29810fb9c02329234fd0800211194980c94c
.reloc729088559856322.6496617957bd86fff892742280f82a0bf537a

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:


Total found: 24
3c2f29dbac5842ca1a35747628ac2ed0
a2c0406aaba834c74f68561c73936587
f286dd4df05f245669a2369d48418cfe
6e2f2e4552821e74da372e828fded288
d3d0d8a0a4ad6f659968ec9597c5904c
8d07d2af1cacca9b155f9aa57b7785d7
d6e7032cc47d7701b3dc9d7e2b5fd5c3
fdc6075e6b90d49d20adc410eed07268
fad048a52261ed893caba84d3a40025f
c82aec98008a83e1505e59ca14243728
47a7a872690644a8db4aec4424c1593e
47f16121bb7e85ae2624b94c5d9ae4d4
1f3f192bcc3cb6bdddaad57c3c2659af
0602ef8c76f9ac40345b392b13062eca
09e1b9accbe3bc53af1dd8b6c055f3f9
3626022326bfb0f10fca5336e8b96834
adfa089ac6508c4d2baddc86f4ec6893
2a00121697147dd6b26a950569e65577
687ece4bb3ecc5276d27dd1f30fe3900
904b9c4b0cb8a924f98f4b199efdd88b
fb95e4647b9b6c56fc314f0ae1644e35
5ab29226960d52d4b668ed47d5d504e9
4f9647e1386c25bb92c71fb9794a4d16
20516f4cb222bcca954a27f96344c4eb

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_1964:

.text

.text

`.rdata

`.rdata

@.data

@.data

.rsrc

.rsrc

@.reloc

@.reloc

Please contact the application's support team for more information.

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- CRT not initialized

- floating point support not loaded

- floating point support not loaded

GetProcessWindowStation

GetProcessWindowStation

USER32.DLL

USER32.DLL

operator

operator

mi_exe_stub.pdb

mi_exe_stub.pdb

GetCPInfo

GetCPInfo

KERNEL32.dll

KERNEL32.dll

SHLWAPI.dll

SHLWAPI.dll

GetProcessHeap

GetProcessHeap

ole32.dll

ole32.dll

USER32.dll

USER32.dll

c:\%original file name%.exe

c:\%original file name%.exe

Z>.Lv&

Z>.Lv&

~.pIC

~.pIC

@?.lK

@?.lK

k.sq_

k.sq_

%uo:BTs

%uo:BTs

_.OV

_.OV

WEbg]

WEbg]

.gMgk

.gMgk

kEyF

kEyF

v(s

v(s

wtPý

wtPý

fNke%D

fNke%D

CN}.VH1

CN}.VH1

3/?/.Xl

3/?/.Xl

y.RYk

y.RYk

w\%X'b

w\%X'b

-y'I|A~.ZW

-y'I|A~.ZW

*h

*h

.rIkX

.rIkX

R]%.s

R]%.s

`%FX&r

`%FX&r

*B.jp5cW

*B.jp5cW

.jQ}9

.jQ}9

=.Fp/

=.Fp/

@ù#1

@ù#1

4.ib}

4.ib}

q

q

%Fo;k

%Fo;k

.ZX`T

.ZX`T

;^M(.pS

;^M(.pS

%X23%K;

%X23%K;

L15.Mo_I

L15.Mo_I

%xJ80

%xJ80

G=`FD.MK

G=`FD.MK

O.mA|C

O.mA|C

bp.IL

bp.IL

bb{.Xk

bb{.Xk

p:\k)

p:\k)

9A>%f

9A>%f

*WC{

*WC{

q-o%x

q-o%x

STa%F

STa%F

k.lhx

k.lhx

pK.gJ

pK.gJ

:sssh

:sssh

7:

7:

: :%:/:=:}:

: :%:/:=:}:

3'3,30343]3

3'3,30343]3

mscoree.dll

mscoree.dll

KERNEL32.DLL

KERNEL32.DLL

appguid={92F8A219-E740-49D5-B785-B962AD819724}&installerargs=--make-chrome-default

appguid={92F8A219-E740-49D5-B785-B962AD819724}&installerargs=--make-chrome-default

Windows 2000 Service Pack 4

Windows 2000 Service Pack 4

Windows 2000

Windows 2000

lador de %1!s! requereix Windows 2000 amb Service Pack 4 o una versi

lador de %1!s! requereix Windows 2000 amb Service Pack 4 o una versi

m Windows 2000 Service Pack 4 nebo nov

m Windows 2000 Service Pack 4 nebo nov

ver Windows 2000 Service Pack 4 eller bedre.

ver Windows 2000 Service Pack 4 eller bedre.

r den %1!s!-Installer wird Windows 2000 Service Pack 4 oder h

r den %1!s!-Installer wird Windows 2000 Service Pack 4 oder h

Unknown Installer ErrorTInstallation failed. %1!s! Installer requires Windows 2000 Service Pack 4 or better.

Unknown Installer ErrorTInstallation failed. %1!s! Installer requires Windows 2000 Service Pack 4 or better.

Windows 2000 Service Pack 4:n tai uudemman.

Windows 2000 Service Pack 4:n tai uudemman.

cessite Windows

cessite Windows

je Windows 2000 Service Pack 4-et vagy frissebb verzi

je Windows 2000 Service Pack 4-et vagy frissebb verzi

krefst Windows 2000

krefst Windows 2000

Google#Programma di installazione di %1!s!!Errore sconosciuto dell'installertInstallazione non riuscita. Il programma di installazione di %1!s! richiede Windows 2000 Service Pack 4 o superiore.

Google#Programma di installazione di %1!s!!Errore sconosciuto dell'installertInstallazione non riuscita. Il programma di installazione di %1!s! richiede Windows 2000 Service Pack 4 o superiore.

Installatieprogramma van %1!s!'Onbekende fout van installatieprogrammasDe installatie is mislukt. Voor het installatieprogramma van %1!s! is Windows 2000 Service Pack 4 of hoger vereist.

Installatieprogramma van %1!s!'Onbekende fout van installatieprogrammasDe installatie is mislukt. Voor het installatieprogramma van %1!s! is Windows 2000 Service Pack 4 of hoger vereist.

Ukjent installasjonsfeilgInstallasjonen mislyktes. %1!s! installasjonsprogrammet krever Windows 2000 Service Pack 4 eller nyere.

Ukjent installasjonsfeilgInstallasjonen mislyktes. %1!s! installasjonsprogrammet krever Windows 2000 Service Pack 4 eller nyere.

. Instalator %1!s! wymaga systemu Windows 2000 z dodatkiem Service Pack 4 lub nowszego.

. Instalator %1!s! wymaga systemu Windows 2000 z dodatkiem Service Pack 4 lub nowszego.

o. O instalador do %1!s! requer o Windows 2000 Service Pack 4 ou posterior.

o. O instalador do %1!s! requer o Windows 2000 Service Pack 4 ou posterior.

it. %1!s! Programul de instalare are nevoie de Windows 2000 Service Pack 4 sau de o versiune superioar

it. %1!s! Programul de instalare are nevoie de Windows 2000 Service Pack 4 sau de o versiune superioar

ka alata za instalacijulInstalacija nije uspjela. Za instalacijski program %1!s! potreban je Windows 2000 Service Pack 4 ili noviji.

ka alata za instalacijulInstalacija nije uspjela. Za instalacijski program %1!s! potreban je Windows 2000 Service Pack 4 ili noviji.

m Windows 2000 Service Pack 4 alebo nov

m Windows 2000 Service Pack 4 alebo nov

ver Windows 2000 Service Pack 4 eller b

ver Windows 2000 Service Pack 4 eller b

kleyicisi Windows 2000 Hizmet Paketi 4 veya sonras

kleyicisi Windows 2000 Hizmet Paketi 4 veya sonras

Program pemasang %1!s!!Kesalahan Installer Tak DiketahuiePemasangan gagal. Program pemasang %1!s! memerlukan Windows 2000 Service Pack 4 atau yang lebih baik.

Program pemasang %1!s!!Kesalahan Installer Tak DiketahuiePemasangan gagal. Program pemasang %1!s! memerlukan Windows 2000 Service Pack 4 atau yang lebih baik.

na. Za namestitveni program za %1!s! potrebujete Windows 2000 s servisnim paketom SP 4 ali novej

na. Za namestitveni program za %1!s! potrebujete Windows 2000 s servisnim paketom SP 4 ali novej

uab rakendust Windows 2000 hoolduspakett 4 v

uab rakendust Windows 2000 hoolduspakett 4 v

ama Windows

ama Windows

Windows 2000

Windows 2000

u Windows 2000 G

u Windows 2000 G

Pemasang %1!s!#Ralat Pemasang yang Tidak Diketahui]Pemasangan gagal. Pemasang %1!s! memerlukan Windows 2000 Service Pack 4 atau yang lebih baik.

Pemasang %1!s!#Ralat Pemasang yang Tidak Diketahui]Pemasangan gagal. Pemasang %1!s! memerlukan Windows 2000 Service Pack 4 atau yang lebih baik.

Kisakinishi cha %1!s!%Hitilafu ya Kisakinishi Isiyojulikana_Usakinishaji haukufaulu. Kisakinishi cha %1!s! kinahitaji Windows 2000 Service Pack 4 au zaidi.

Kisakinishi cha %1!s!%Hitilafu ya Kisakinishi Isiyojulikana_Usakinishaji haukufaulu. Kisakinishi cha %1!s! kinahitaji Windows 2000 Service Pack 4 au zaidi.

. Windows 2000

. Windows 2000

Installer ng %1!s! Hindi Alam na Error ng InstallerlNabigo ang pag-install. Nangangailangan ang Installer ng %1!s! ng Windows 2000 Service Pack 4 o mas mahusay.

Installer ng %1!s! Hindi Alam na Error ng InstallerlNabigo ang pag-install. Nangangailangan ang Installer ng %1!s! ng Windows 2000 Service Pack 4 o mas mahusay.

n. %1!s! El instalador requiere Windows 2000 Service Pack 4 o superior.

n. %1!s! El instalador requiere Windows 2000 Service Pack 4 o superior.

o %1!s! necessita do Windows 2000 Service Pack 4 ou superior.

o %1!s! necessita do Windows 2000 Service Pack 4 ou superior.

n. %1!s! Installer requiere Windows 2000 Service Pack 4 o versiones posteriores.

n. %1!s! Installer requiere Windows 2000 Service Pack 4 o versiones posteriores.

1.3.25.223

1.3.25.223

CatalinaUpdateSetup.exe

CatalinaUpdateSetup.exe

CatalinaUpdate.exe_1352:

.text

.text

`.data

`.data

.text/DE

.text/DE

@.rsrc

@.rsrc

@.reloc

@.reloc

SHELL32.dll

SHELL32.dll

USER32.dll

USER32.dll

SHLWAPI.dll

SHLWAPI.dll

Please contact the application's support team for more information.

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- CRT not initialized

- floating point support not loaded

- floating point support not loaded

GetProcessWindowStation

GetProcessWindowStation

USER32.DLL

USER32.DLL

operator

operator

CatalinaUpdate_unsigned.pdb

CatalinaUpdate_unsigned.pdb

RegOpenKeyExW

RegOpenKeyExW

ADVAPI32.dll

ADVAPI32.dll

KERNEL32.dll

KERNEL32.dll

ole32.dll

ole32.dll

GetProcessHeap

GetProcessHeap

GetCPInfo

GetCPInfo

GetConsoleOutputCP

GetConsoleOutputCP

name="Microsoft.Windows.Common-Controls"

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

publicKeyToken="6595b64144ccf1df"

###7777_{

###7777_{

###____777

###____777

###````87{

###````87{

2 2$2(2,20242~2

2 2$2(2,20242~2

4 4$4(4,4

4 4$4(4,4

?$?(?,?4?

?$?(?,?4?

> >@>\>`>

> >@>\>`>

? ?@?\?`?

? ?@?\?`?

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\GUM1.tmp\CatalinaUpdate.exe

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\GUM1.tmp\CatalinaUpdate.exe

KERNEL32.DLL

KERNEL32.DLL

mscoree.dll

mscoree.dll

goopdate.dll

goopdate.dll

CatalinaUpdate.exe

CatalinaUpdate.exe

Software\CatalinaGroup\Update\Clients\{6C598730-F715-407B-A7AE-A8F10D0F8FA7}

Software\CatalinaGroup\Update\Clients\{6C598730-F715-407B-A7AE-A8F10D0F8FA7}

1.3.25.223

1.3.25.223

2007-2010

2007-2010

2007-2010

2007-2010

CatalinaUpdate.exe_1496:

.text

.text

`.data

`.data

.text/DE

.text/DE

@.rsrc

@.rsrc

@.reloc

@.reloc

SHELL32.dll

SHELL32.dll

USER32.dll

USER32.dll

SHLWAPI.dll

SHLWAPI.dll

Please contact the application's support team for more information.

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- CRT not initialized

- floating point support not loaded

- floating point support not loaded

GetProcessWindowStation

GetProcessWindowStation

USER32.DLL

USER32.DLL

operator

operator

CatalinaUpdate_unsigned.pdb

CatalinaUpdate_unsigned.pdb

RegOpenKeyExW

RegOpenKeyExW

ADVAPI32.dll

ADVAPI32.dll

KERNEL32.dll

KERNEL32.dll

ole32.dll

ole32.dll

GetProcessHeap

GetProcessHeap

GetCPInfo

GetCPInfo

GetConsoleOutputCP

GetConsoleOutputCP

name="Microsoft.Windows.Common-Controls"

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

publicKeyToken="6595b64144ccf1df"

###7777_{

###7777_{

###____777

###____777

###````87{

###````87{

2 2$2(2,20242~2

2 2$2(2,20242~2

4 4$4(4,4

4 4$4(4,4

?$?(?,?4?

?$?(?,?4?

> >@>\>`>

> >@>\>`>

? ?@?\?`?

? ?@?\?`?

%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\CatalinaUpdate.exe

%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\CatalinaUpdate.exe

KERNEL32.DLL

KERNEL32.DLL

mscoree.dll

mscoree.dll

goopdate.dll

goopdate.dll

CatalinaUpdate.exe

CatalinaUpdate.exe

Software\CatalinaGroup\Update\Clients\{6C598730-F715-407B-A7AE-A8F10D0F8FA7}

Software\CatalinaGroup\Update\Clients\{6C598730-F715-407B-A7AE-A8F10D0F8FA7}

1.3.25.223

1.3.25.223

2007-2010

2007-2010

2007-2010

2007-2010

CatalinaUpdate.exe_1256:

.text

.text

`.data

`.data

.text/DE

.text/DE

@.rsrc

@.rsrc

@.reloc

@.reloc

SHELL32.dll

SHELL32.dll

USER32.dll

USER32.dll

SHLWAPI.dll

SHLWAPI.dll

Please contact the application's support team for more information.

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- CRT not initialized

- floating point support not loaded

- floating point support not loaded

GetProcessWindowStation

GetProcessWindowStation

USER32.DLL

USER32.DLL

operator

operator

CatalinaUpdate_unsigned.pdb

CatalinaUpdate_unsigned.pdb

RegOpenKeyExW

RegOpenKeyExW

ADVAPI32.dll

ADVAPI32.dll

KERNEL32.dll

KERNEL32.dll

ole32.dll

ole32.dll

GetProcessHeap

GetProcessHeap

GetCPInfo

GetCPInfo

GetConsoleOutputCP

GetConsoleOutputCP

name="Microsoft.Windows.Common-Controls"

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

publicKeyToken="6595b64144ccf1df"

###7777_{

###7777_{

###____777

###____777

###````87{

###````87{

2 2$2(2,20242~2

2 2$2(2,20242~2

4 4$4(4,4

4 4$4(4,4

?$?(?,?4?

?$?(?,?4?

> >@>\>`>

> >@>\>`>

? ?@?\?`?

? ?@?\?`?

%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\CatalinaUpdate.exe

%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\CatalinaUpdate.exe

KERNEL32.DLL

KERNEL32.DLL

mscoree.dll

mscoree.dll

goopdate.dll

goopdate.dll

CatalinaUpdate.exe

CatalinaUpdate.exe

Software\CatalinaGroup\Update\Clients\{6C598730-F715-407B-A7AE-A8F10D0F8FA7}

Software\CatalinaGroup\Update\Clients\{6C598730-F715-407B-A7AE-A8F10D0F8FA7}

1.3.25.223

1.3.25.223

2007-2010

2007-2010

2007-2010

2007-2010

setup.exe_452:

.text

.text

`.rdata

`.rdata

@.data

@.data

.rsrc

.rsrc

@.reloc

@.reloc

SHA256 block transform for x86, CRYPTOGAMS by

SHA256 block transform for x86, CRYPTOGAMS by

PSSSSSSh

PSSSSSSh

:.texu

:.texu

j.Yf;

j.Yf;

_tcPVj@

_tcPVj@

.PjRW

.PjRW

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\setup\archive_patch_helper.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\setup\archive_patch_helper.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\setup\install.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\setup\install.cc

Adding Chrome to Media player list at

Adding Chrome to Media player list at

Could not add Chrome to media player inclusion list.

Could not add Chrome to media player inclusion list.

Square150x150Logo='%ls\Logo.png'

Square150x150Logo='%ls\Logo.png'

Square70x70Logo='%ls\SmallLogo.png'

Square70x70Logo='%ls\SmallLogo.png'

Registering Chrome as browser:

Registering Chrome as browser:

Failed to reinstall Active Setup keys.

Failed to reinstall Active Setup keys.

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\setup\install_worker.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\setup\install_worker.cc

Chrome Frame in use. Copying to new_citrio.exe

Chrome Frame in use. Copying to new_citrio.exe

FUnexpected result creating CommandExecuteImpl; hr=0x

FUnexpected result creating CommandExecuteImpl; hr=0x

Adding unregistration items for DelegateExecute verb handler in

Adding unregistration items for DelegateExecute verb handler in

Not operating on Chrome while migrating to single-install.

Not operating on Chrome while migrating to single-install.

No multi-install Chrome found to migrate to single-install.

No multi-install Chrome found to migrate to single-install.

No DelegateExecute verb handler processing to do for

No DelegateExecute verb handler processing to do for

Adding registration items for DelegateExecute verb handler.

Adding registration items for DelegateExecute verb handler.

not supported.

not supported.

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\setup\setup_main.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\setup\setup_main.cc

Renaming of executables failed. Rolling back any changes.

Renaming of executables failed. Rolling back any changes.

Upgrading existing Chrome browser in multi-install mode.

Upgrading existing Chrome browser in multi-install mode.

Launching existing system-level chrome instead.

Launching existing system-level chrome instead.

RepairChrome: Failed to open Chrome's ClientState key.

RepairChrome: Failed to open Chrome's ClientState key.

RepairChrome: Failed to read Chrome's UninstallArguments.

RepairChrome: Failed to read Chrome's UninstallArguments.

RepairChrome: Not repairing single-install Chrome.

RepairChrome: Not repairing single-install Chrome.

RepairChrome: Failed to read Chrome's UninstallString.

RepairChrome: Failed to read Chrome's UninstallString.

RepairChrome: Launched repair command "

RepairChrome: Launched repair command "

RepairChrome: Failed launching repair command "

RepairChrome: Failed launching repair command "

RepairChrome: Will retry without breakaway.

RepairChrome: Will retry without breakaway.

Tried and failed to launch Metro Chrome.

Tried and failed to launch Metro Chrome.

was found, as a last resort (if the product is not present in Add/Remove Programs), try executing:

was found, as a last resort (if the product is not present in Add/Remove Programs), try executing:

Aborting operation: another installation of

Aborting operation: another installation of

setup.exe patching failed.

setup.exe patching failed.

chrome_install:

chrome_install:

Can't register browser - Chrome distribution not found

Can't register browser - Chrome distribution not found

Chrome product not found.

Chrome product not found.

Chrome Installer

Chrome Installer

Uninstalling multi-install Chrome Frame.

Uninstalling multi-install Chrome Frame.

Uninstallation of Chrome Frame returned status

Uninstallation of Chrome Frame returned status

Chrome Frame not found for uninstall.

Chrome Frame not found for uninstall.

Installing Chrome from compressed archive

Installing Chrome from compressed archive

Cannot install Chrome without an uncompressed archive.

Cannot install Chrome without an uncompressed archive.

Chrome only supports Windows XP or later.

Chrome only supports Windows XP or later.

Non admin user can not install system level Chrome.

Non admin user can not install system level Chrome.

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\setup\setup_util.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\setup\setup_util.cc

Looking for Chrome version folder under

Looking for Chrome version folder under

0.0.0.0

0.0.0.0

chrome-frame

chrome-frame

migrate-chrome-frame

migrate-chrome-frame

Failed to delete subkey

Failed to delete subkey

Failed to delete empty key

Failed to delete empty key

in key

in key

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\setup\uninstall.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\setup\uninstall.cc

DeleteChromeFilesAndFolders: no installation destination

DeleteChromeFilesAndFolders: no installation destination

Launching Chrome to do uninstall tasks.

Launching Chrome to do uninstall tasks.

citrio.exe launched for uninstall confirmation returned:

citrio.exe launched for uninstall confirmation returned:

Failed to launch citrio.exe for uninstall confirmation.

Failed to launch citrio.exe for uninstall confirmation.

Uninstall per-user Active Setup keys.

Uninstall per-user Active Setup keys.

Uninstalling Active Setup key for

Uninstalling Active Setup key for

NTUSER.DAT

NTUSER.DAT

Failed to delete key at

Failed to delete key at

Retargeting user-generated Chrome shortcuts.

Retargeting user-generated Chrome shortcuts.

Retarget failed: system-level Chrome not found.

Retarget failed: system-level Chrome not found.

Closing the Chrome Frame helper process

Closing the Chrome Frame helper process

Uninstallation complete. Launching post-uninstall operations.

Uninstallation complete. Launching post-uninstall operations.

setup.exe is not in target path. Skipping installer cleanup.

setup.exe is not in target path. Skipping installer cleanup.

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\setup\update_active_setup_version_work_item.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\setup\update_active_setup_version_work_item.cc

googlechrome

googlechrome

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\install_util.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\install_util.cc

CHROME_PROBED_PROGRAM_FILES_PATH

CHROME_PROBED_PROGRAM_FILES_PATH

Deleting registry key

Deleting registry key

Failed to delete registry key:

Failed to delete registry key:

Failed to parse an executable name from command line: "

Failed to parse an executable name from command line: "

chrome

chrome

chrome-sxs

chrome-sxs

do-not-launch-chrome

do-not-launch-chrome

make-chrome-default

make-chrome-default

new-setup-exe

new-setup-exe

register-chrome-browser

register-chrome-browser

register-chrome-browser-suffix

register-chrome-browser-suffix

register-dev-chrome

register-dev-chrome

register-url-protocol

register-url-protocol

rename-chrome-exe

rename-chrome-exe

remove-chrome-registration

remove-chrome-registration

update-setup-exe

update-setup-exe

toast-results-key

toast-results-key

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\lzma_util.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\lzma_util.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\shell_util.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\shell_util.cc

DefaultBrowser.ActivateSettings.ErrorHresult

DefaultBrowser.ActivateSettings.ErrorHresult

Could not make Chrome default browser (XP/current user).

Could not make Chrome default browser (XP/current user).

Could not make Chrome default browser (XP/system level).

Could not make Chrome default browser (XP/system level).

Registering Chrome as default browser on Vista.

Registering Chrome as default browser on Vista.

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\product.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\product.cc

Failed to Open or Write MSI value to client state key. error:

Failed to Open or Write MSI value to client state key. error:

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\installer_state.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\installer_state.cc

It seems that chrome is being installed for the first time.

It seems that chrome is being installed for the first time.

It seems that chrome is being over installed.

It seems that chrome is being over installed.

Failed opening key

Failed opening key

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\master_preferences.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\master_preferences.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\set_reg_value_work_item.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\set_reg_value_work_item.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\delete_after_reboot_helper.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\delete_after_reboot_helper.cc

Failed to open session manager key for writing.

Failed to open session manager key for writing.

do_not_launch_chrome

do_not_launch_chrome

make_chrome_default

make_chrome_default

make_chrome_default_for_user

make_chrome_default_for_user

launch_chrome_after_update

launch_chrome_after_update

Cannot initialize an AppCommand from an invalid key.

Cannot initialize an AppCommand from an invalid key.

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\app_command.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\app_command.cc

creating AppCommand registry key

creating AppCommand registry key

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\conditional_work_item_list.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\conditional_work_item_list.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\google_update_settings.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\google_update_settings.cc

Failed to write to application's ClientState key

Failed to write to application's ClientState key

Removed incremental installer failure key; switching to channel:

Removed incremental installer failure key; switching to channel:

Removed multi-install failure key; switching to channel:

Removed multi-install failure key; switching to channel:

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\google_update_util.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\google_update_util.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\installation_validator.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\installation_validator.cc

be web accessible

be web accessible

Chrome Binaries are missing "-multi" in channel name: "

Chrome Binaries are missing "-multi" in channel name: "

Chrome Binaries are missing "chrome" in channel name:

Chrome Binaries are missing "chrome" in channel name:

Chrome Binaries have "-chrome" in channel name, yet Chrome is not installed: "

Chrome Binaries have "-chrome" in channel name, yet Chrome is not installed: "

Chrome Binaries are missing "-chromeframe" in channel name: "

Chrome Binaries are missing "-chromeframe" in channel name: "

Chrome Binaries have "-chromeframe" in channel name, yet Chrome Frame is not installed multi: "

Chrome Binaries have "-chromeframe" in channel name, yet Chrome Frame is not installed multi: "

Chrome Binaries are present with no other products.

Chrome Binaries are present with no other products.

Chrome Binaries are present yet Chrome is not multi-install.

Chrome Binaries are present yet Chrome is not multi-install.

Chrome Binaries are present without Chrome, yet Chrome Frame

Chrome Binaries are present without Chrome, yet Chrome Frame

without Chrome Binaries.

without Chrome Binaries.

) does not match that of Chrome Binaries (

) does not match that of Chrome Binaries (

has an unsupported usagestats value (

has an unsupported usagestats value (

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\self_cleaning_temp_dir.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\self_cleaning_temp_dir.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\user_experiment.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\user_experiment.cc

Experiment qualification bypass

Experiment qualification bypass

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\channel_info.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\channel_info.cc

googlechromeframe

googlechromeframe

iexplore.exe

iexplore.exe

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\language_selector.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\language_selector.cc

Cannot initialize AppCommands from an invalid key.

Cannot initialize AppCommands from an invalid key.

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\app_commands.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\app_commands.cc

Failed to open key "

Failed to open key "

Skipping over key "

Skipping over key "

item execution failed

item execution failed

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\work_item_list.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\work_item_list.cc

list execution succeeded

list execution succeeded

NoRollbackWorkItemList: item execution failed

NoRollbackWorkItemList: item execution failed

NoRollbackWorkItemList: list execution succeeded

NoRollbackWorkItemList: list execution succeeded

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\copy_tree_work_item.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\copy_tree_work_item.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\create_dir_work_item.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\create_dir_work_item.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\create_reg_key_work_item.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\create_reg_key_work_item.cc

no key to create

no key to create

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\delete_tree_work_item.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\delete_tree_work_item.cc

Acquired exclusive lock for key file:

Acquired exclusive lock for key file:

Could not exclusively hold all key files.

Could not exclusively hold all key files.

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\delete_reg_key_work_item.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\delete_reg_key_work_item.cc

Failed to backup destination for registry key copy.

Failed to backup destination for registry key copy.

Failed to restore key in rollback.

Failed to restore key in rollback.

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\delete_reg_value_work_item.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\delete_reg_value_work_item.cc

(delete value) Key:

(delete value) Key:

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\move_tree_work_item.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\move_tree_work_item.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\self_reg_work_item.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\self_reg_work_item.cc

0xX

0xX

COM registration export function not found

COM registration export function not found

Failed getting info of key to backup, result:

Failed getting info of key to backup, result:

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\registry_key_backup.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\registry_key_backup.cc

Failed getting name of subkey

Failed getting name of subkey

Failed opening subkey "

Failed opening subkey "

Failed backing up subkey "

Failed backing up subkey "

Failed creating subkey "

Failed creating subkey "

Failed writing subkey "

Failed writing subkey "

Failed to backup key at

Failed to backup key at

Failed to open key at

Failed to open key at

Failed to create destination key at

Failed to create destination key at

Failed to write key data.

Failed to write key data.

CHROME_HEADLESS

CHROME_HEADLESS

widevinecdmadapter.dll

widevinecdmadapter.dll

try-chrome-again

try-chrome-again

session.startup_urls

session.startup_urls

session.urls_to_restore_on_startup

session.urls_to_restore_on_startup

%s\%s

%s\%s

user_experience_metrics.reporting_enabled

user_experience_metrics.reporting_enabled

c:\jenkins\workspace\citrio-dev-clone\browser\src\crypto\secure_hash_openssl.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\crypto\secure_hash_openssl.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\courgette\assembly_program.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\courgette\assembly_program.cc

32 bit executables are not supported by this disassembler

32 bit executables are not supported by this disassembler

Resource-only executables are not yet supported

Resource-only executables are not yet supported

.relocs outside image

.relocs outside image

.relocs block outside image

.relocs block outside image

64 bit executables are not supported by this disassembler

64 bit executables are not supported by this disassembler

Not an executable file or shared library

Not an executable file or shared library

Not a supported architecture

Not a supported architecture

c:\jenkins\workspace\citrio-dev-clone\browser\src\courgette\disassembler_elf_32.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\courgette\disassembler_elf_32.cc

Skipping relocation entry for unsupported section:

Skipping relocation entry for unsupported section:

CITRIO_BREAKPAD_PIPE_NAME

CITRIO_BREAKPAD_PIPE_NAME

c:\jenkins\workspace\citrio-dev-clone\browser\src\components\crash\content\app\breakpad_win.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\components\crash\content\app\breakpad_win.cc

NTDLL.DLL

NTDLL.DLL

SHELL32.dll

SHELL32.dll

GetProcessWindowStation

GetProcessWindowStation

function not supported

function not supported

operation canceled

operation canceled

address_family_not_supported

address_family_not_supported

operation_in_progress

operation_in_progress

operation_not_supported

operation_not_supported

protocol_not_supported

protocol_not_supported

operation_would_block

operation_would_block

address family not supported

address family not supported

broken pipe

broken pipe

inappropriate io control operation

inappropriate io control operation

not supported

not supported

operation in progress

operation in progress

operation not permitted

operation not permitted

operation not supported

operation not supported

operation would block

operation would block

protocol not supported

protocol not supported

operator

operator

(0x%X)

(0x%X)

Error (0x%X) while retrieving error. (0x%X)

Error (0x%X) while retrieving error. (0x%X)

RegDeleteKeyExW

RegDeleteKeyExW

advapi32.dll

advapi32.dll

%s-%Iu

%s-%Iu

c:\jenkins\workspace\citrio-dev-clone\browser\src\base\process\memory_win.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\base\process\memory_win.cc

PlatformFile.UnknownErrors.Windows

PlatformFile.UnknownErrors.Windows

Windows NT

Windows NT

%d.%d

%d.%d

user32.dll

user32.dll

Histogram: %s recorded %d samples

Histogram: %s recorded %d samples

(flags = 0x%x)

(flags = 0x%x)

(%d = %3.1f%%)

(%d = %3.1f%%)

0123456789

0123456789

Dictionary keys must be quoted.

Dictionary keys must be quoted.

Unsupported encoding. JSON must be UTF-8.

Unsupported encoding. JSON must be UTF-8.

Line: %i, column: %i, %s

Line: %i, column: %i, %s

full-memory-crash-report

full-memory-crash-report

c:\jenkins\workspace\Citrio-Dev-Clone\browser\src\out\Release\setup.exe.pdb

c:\jenkins\workspace\Citrio-Dev-Clone\browser\src\out\Release\setup.exe.pdb

ShellExecuteExW

ShellExecuteExW

ShellExecuteW

ShellExecuteW

setup.exe

setup.exe

ClearBreakpadPipeEnvironmentVariable

ClearBreakpadPipeEnvironmentVariable

ClearCrashKeyValueImpl

ClearCrashKeyValueImpl

SetCrashKeyValueImpl

SetCrashKeyValueImpl

VERSION.dll

VERSION.dll

WS2_32.dll

WS2_32.dll

WINMM.dll

WINMM.dll

UrlCanonicalizeW

UrlCanonicalizeW

SHLWAPI.dll

SHLWAPI.dll

RegEnumKeyExW

RegEnumKeyExW

RegLoadKeyW

RegLoadKeyW

RegUnLoadKeyW

RegUnLoadKeyW

RegQueryInfoKeyW

RegQueryInfoKeyW

RegCreateKeyExW

RegCreateKeyExW

RegDeleteKeyW

RegDeleteKeyW

RegOpenKeyExW

RegOpenKeyExW

RegCloseKey

RegCloseKey

ADVAPI32.dll

ADVAPI32.dll

GetWindowsDirectoryW

GetWindowsDirectoryW

GetProcessHeap

GetProcessHeap

SetNamedPipeHandleState

SetNamedPipeHandleState

TransactNamedPipe

TransactNamedPipe

WaitNamedPipeW

WaitNamedPipeW

KERNEL32.dll

KERNEL32.dll

ole32.dll

ole32.dll

OLEAUT32.dll

OLEAUT32.dll

SetWindowsHookExW

SetWindowsHookExW

UnhookWindowsHookEx

UnhookWindowsHookEx

USER32.dll

USER32.dll

CreateURLMonikerEx

CreateURLMonikerEx

urlmon.dll

urlmon.dll

WTSAPI32.dll

WTSAPI32.dll

USERENV.dll

USERENV.dll

PeekNamedPipe

PeekNamedPipe

GetCPInfo

GetCPInfo

zcÁ

zcÁ

k.lhx

k.lhx

pK.gJ

pK.gJ

:sssh

:sssh

7:

7:

444.44...4

444.44...4

4.4....4.

4.4....4.

..44.44@4

..44.44@4

4@444@4.

4@444@4.

.4@4@@4.

.4@4@@4.

}.GnO

}.GnO

{oG

{oG

5G%8gG

5G%8gG

wG

wG

!)%)%)%sN

!)%)%)%sN

00l0}0

00l0}0

;#;);/;3;8;?;

;#;);/;3;8;?;

11d1v1

11d1v1

'020@0_0

'020@0_0

>$?/?5?\?

>$?/?5?\?

0 0$0(0,0004080

0 0$0(0,0004080

9 9$9(9,9

9 9$9(9,9

: :$:(:,:0:4:8:<:>

: :$:(:,:0:4:8:<:>

= =$=(=,=8=

= =$=(=,=8=

app_host.exe

app_host.exe

=hXXp://citrio.com/service/updatemessage/

=hXXp://citrio.com/service/updatemessage/

"hXXp://VVV.facebook.com"

"hXXp://VVV.facebook.com"

"hXXp://VVV.youtube.com"

"hXXp://VVV.youtube.com"

"hXXps://chrome.google.com/webstore/"

"hXXps://chrome.google.com/webstore/"

Open Chrome Web Store

Open Chrome Web Store

Chrome Web Store

Chrome Web Store

Ihttp

Ihttp

https

https

{A1326E5F-95B3-49FB-8C1F-610F27E0C5BE}

{A1326E5F-95B3-49FB-8C1F-610F27E0C5BE}

Software\Classes\Interface\{90E75134-C82F-4273-831F-13F6FB52BA1B}

Software\Classes\Interface\{90E75134-C82F-4273-831F-13F6FB52BA1B}

Software\Classes\TypeLib\{5405A76A-9F6D-44E3-91CE-72179B379953}

Software\Classes\TypeLib\{5405A76A-9F6D-44E3-91CE-72179B379953}

Software\Classes\CLSID\{8BF2F61B-E8C2-4A67-85D0-D6A69F9FD948}

Software\Classes\CLSID\{8BF2F61B-E8C2-4A67-85D0-D6A69F9FD948}

ServerExecutable

ServerExecutable

.CommandExecuteImpl Class

.CommandExecuteImpl Class

.StubPath

.StubPath

ieframe.dll

ieframe.dll

0.0.0.0-devel

0.0.0.0-devel

MetricsReportingEnabled

MetricsReportingEnabled

citrio.packed.7z

citrio.packed.7z

chrome.VisualElementsManifest.xml

chrome.VisualElementsManifest.xml

wow_helper.exe

wow_helper.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\%ls\Products\%ls\InstallProperties

SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\%ls\Products\%ls\InstallProperties

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{%ls}

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{%ls}

{92F8A219-E740-49D5-B785-B962AD819724}

{92F8A219-E740-49D5-B785-B962AD819724}

{F0B50D5A-4BBA-4514-AD2C-EBA50C29C460}

{F0B50D5A-4BBA-4514-AD2C-EBA50C29C460}

%SystemRoot%\System32\rundll32.exe

%SystemRoot%\System32\rundll32.exe

..htm

..htm

.html

.html

.xhtml

.xhtml

Software\Microsoft\Windows NT\CurrentVersion\ProfileList\

Software\Microsoft\Windows NT\CurrentVersion\ProfileList\

.DEFAULT\

.DEFAULT\

{3599E25E-6314-4BE9-AE14-E51877342426}

{3599E25E-6314-4BE9-AE14-E51877342426}

{675046A3-9F4F-4805-A81C-CBF753FE3428}

{675046A3-9F4F-4805-A81C-CBF753FE3428}

Browse the web

Browse the web

Software\Microsoft\Windows\CurrentVersion\Uninstall\Citrio

Software\Microsoft\Windows\CurrentVersion\Uninstall\Citrio

registering_chrome

registering_chrome

uninstalling_chrome_frame

uninstalling_chrome_frame

.HTML

.HTML

IDR_OEMPG_EN.HTML

IDR_OEMPG_EN.HTML

chrmstp.exe

chrmstp.exe

{0105EA02-802D-4B37-8161-4ED25C493266}

{0105EA02-802D-4B37-8161-4ED25C493266}

citrio.dll

citrio.dll

citrio.exe

citrio.exe

npchrome_frame.dll

npchrome_frame.dll

chrome_frame_helper.dll

chrome_frame_helper.dll

chrome_frame_helper.exe

chrome_frame_helper.exe

ChromeFrameHelperWindowClass

ChromeFrameHelperWindowClass

new_citrio.exe

new_citrio.exe

old_citrio.exe

old_citrio.exe

delegate_execute.exe

delegate_execute.exe

nacl64.exe

nacl64.exe

chrome.exe

chrome.exe

new_chrome.exe

new_chrome.exe

old_chrome.exe

old_chrome.exe

InstallerSuccessLaunchCmdLine

InstallerSuccessLaunchCmdLine

Software\Microsoft\Windows\CurrentVersion\App Paths

Software\Microsoft\Windows\CurrentVersion\App Paths

.shtml

.shtml

.webp

.webp

webcal

webcal

.webm

.webm

.flac

.flac

.torrent

.torrent

URL Protocol

URL Protocol

\.exe

\.exe

DelegateExecute

DelegateExecute

Browser.Launch

Browser.Launch

\URLAssociations

\URLAssociations

\shell\open\ddeexec

\shell\open\ddeexec

windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel

windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel

" -- "%1"

" -- "%1"

.Software\CatalinaGroup\Citrio

.Software\CatalinaGroup\Citrio

PendingFileRenameOperations

PendingFileRenameOperations

UninstallCmdLine

UninstallCmdLine

WebAccessible

WebAccessible

EMSHTML.DLL

EMSHTML.DLL

chrome_installer.log

chrome_installer.log

hXXp://VVV.citrio.com/welcome.html?intl=$1

hXXp://VVV.citrio.com/welcome.html?intl=$1

-chrome

-chrome

-chromeframe

-chromeframe

GoogleChromeAutoLaunch

GoogleChromeAutoLaunch

{DE28A2EA-77FA-4F2B-8252-C3B5844F6455}

{DE28A2EA-77FA-4F2B-8252-C3B5844F6455}

FGoogle Chrome Frame

FGoogle Chrome Frame

Chrome in a Frame.

Chrome in a Frame.

Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome Frame

Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome Frame

Google Chrome binaries

Google Chrome binaries

F{92F8A219-E740-49D5-B785-B962AD819724}

F{92F8A219-E740-49D5-B785-B962AD819724}

{8BF2F61B-E8C2-4A67-85D0-D6A69F9FD948}

{8BF2F61B-E8C2-4A67-85D0-D6A69F9FD948}

AhXXp://VVV.citrio.com/goodbye.html?intl=$1&survey_id=%ls

AhXXp://VVV.citrio.com/goodbye.html?intl=$1&survey_id=%ls

%d.%d.%d

%d.%d.%d

{E9F24A7C-13CA-42FB-A4D9-79C3C9D21B28}

{E9F24A7C-13CA-42FB-A4D9-79C3C9D21B28}

ChromeCanary

ChromeCanary

ChromeSSHTM

ChromeSSHTM

Chrome Canary HTML Document

Chrome Canary HTML Document

{1BEAC3E3-B852-44F4-B468-8906C062422E}

{1BEAC3E3-B852-44F4-B468-8906C062422E}

AGoogle Chrome Canary

AGoogle Chrome Canary

Opens all ports for Citrio embedded bittorrent client

Opens all ports for Citrio embedded bittorrent client

%u-%u

%u-%u

Crash Reports

Crash Reports

script.log

script.log

resources.pak

resources.pak

pepflashplayer.dll

pepflashplayer.dll

version.json

version.json

NPSWF32.dll

NPSWF32.dll

shell32.dll

shell32.dll

s{A946A6A9-917E-4949-B9BC-6BADA8C7FD63}

s{A946A6A9-917E-4949-B9BC-6BADA8C7FD63}

\\.\pipe\CatalinaGroupCrashServices\

\\.\pipe\CatalinaGroupCrashServices\

\\.\pipe\CitrioCrashServices

\\.\pipe\CitrioCrashServices

error %u

error %u

hunspecified-crash-key

hunspecified-crash-key

dbghelp.dll

dbghelp.dll

rpcrt4.dll

rpcrt4.dll

%s\%s.dmp

%s\%s.dmp

x-x-x-xx-xxxxxx

x-x-x-xx-xxxxxx

Kmscoree.dll

Kmscoree.dll

- floating point support not loaded

- floating point support not loaded

- CRT not initialized

- CRT not initialized

- Attempt to initialize the CRT more than once.

- Attempt to initialize the CRT more than once.

USER32.DLL

USER32.DLL

portuguese-brazilian

portuguese-brazilian

Ndebug.log

Ndebug.log

kernel32.dll

kernel32.dll

\StringFileInfo\xx\%ls

\StringFileInfo\xx\%ls

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Run

ntdll.dll

ntdll.dll

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\CR_DD852.tmp\setup.exe

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\CR_DD852.tmp\setup.exe

48.0.2564.270

48.0.2564.270

nsit de mDNS.KPravidlo p

nsit de mDNS.KPravidlo p

mDNS..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic.4Regla entrante para que Citrio permita tr

mDNS..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic.4Regla entrante para que Citrio permita tr

mDNS.BCitrioin saapuvien yhteyksien s

mDNS.BCitrioin saapuvien yhteyksien s

, joka sallii mDNS-liikenteen.GInbound na panuntunan para sa Citrio upang payagan ang trapiko ng mDNS.=R

, joka sallii mDNS-liikenteen.GInbound na panuntunan para sa Citrio upang payagan ang trapiko ng mDNS.=R

.3Ulazno pravilo kako bi Citrio dopustio mDNS promet.CBej

.3Ulazno pravilo kako bi Citrio dopustio mDNS promet.CBej

iamas mDNS srautas.IIen

iamas mDNS srautas.IIen

.:Peraturan masuk bagi Citrio untuk membolehkan trafik mDNS.3Inkomende regel zodat Citrio mDNS-verkeer toestaat.CRegel om innkommende trafikk for Citrio for

.:Peraturan masuk bagi Citrio untuk membolehkan trafik mDNS.3Inkomende regel zodat Citrio mDNS-verkeer toestaat.CRegel om innkommende trafikk for Citrio for

tillate mDNS-trafikk.BRegu

tillate mDNS-trafikk.BRegu

fego mDNS.:Regra de importa

fego mDNS.:Regra de importa

.Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic.

.Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic.

.lInstallation failed due to unspecified error. If Citrio is currently running, please close it and try again.lInstallation failed due to unspecified error. If Citrio is currently running, please close it and try again.zLa instalaci

.lInstallation failed due to unspecified error. If Citrio is currently running, please close it and try again.lInstallation failed due to unspecified error. If Citrio is currently running, please close it and try again.zLa instalaci

rralo e intenta nuevamente.kInstallimine eba

rralo e intenta nuevamente.kInstallimine eba

.uAsennus ep

.uAsennus ep

.tInstalacija nije uspjela zbog nepoznate pogre

.tInstalacija nije uspjela zbog nepoznate pogre

ajte ponovo.iA telep

ajte ponovo.iA telep

jra.oPemasangan gagal karena kesalahan yang tidak diketahui. Jika Citrio sedang berjalan, tutup, lalu ulang kembali.kInstallazione non riuscita a causa di un errore imprecisato. Se Citrio

jra.oPemasangan gagal karena kesalahan yang tidak diketahui. Jika Citrio sedang berjalan, tutup, lalu ulang kembali.kInstallazione non riuscita a causa di un errore imprecisato. Se Citrio

.kDiegimas nepavyko d

.kDiegimas nepavyko d

naujo.jInstal

naujo.jInstal

.sPemasangan gagal disebabkan ralat yang tidak dinyatakan. Jika Citrio sedang dijalankan, sila tutup dan cuba semula.

.sPemasangan gagal disebabkan ralat yang tidak dinyatakan. Jika Citrio sedang dijalankan, sila tutup dan cuba semula.

De installatie is mislukt wegens een onbekende fout. Als Citrio momenteel actief is, moet je Citrio sluiten en het opnieuw proberen.pInstalleringen mislyktes p

De installatie is mislukt wegens een onbekende fout. Als Citrio momenteel actief is, moet je Citrio sluiten en het opnieuw proberen.pInstalleringen mislyktes p

o especificado. Se o Citrio estiver sendo executado, feche-o e tente novamente.pA instala

o especificado. Se o Citrio estiver sendo executado, feche-o e tente novamente.pA instala

o especificado. Se o Citrio estiver em execu

o especificado. Se o Citrio estiver em execu

ste znova.rNamestitev ni bila izvedena zaradi nedolo

ste znova.rNamestitev ni bila izvedena zaradi nedolo

.rInstallationen misslyckades p

.rInstallationen misslyckades p

k sedan igen.xUsanidi umeshindwa kwa sababu ya hitilafu isiyojulikana. Ikiwa Citrio inaendesha sasa, tafadhali ifunge na ujaribu tena.x

k sedan igen.xUsanidi umeshindwa kwa sababu ya hitilafu isiyojulikana. Ikiwa Citrio inaendesha sasa, tafadhali ifunge na ujaribu tena.x

e tento software nefunguje, odinstalujte Citrio a zkuste to znovu.zComputeren har allerede en nyere version af Citrio. Hvis softwaren ikke virker, skal du afinstallere Citrio og pr

e tento software nefunguje, odinstalujte Citrio a zkuste to znovu.zComputeren har allerede en nyere version af Citrio. Hvis softwaren ikke virker, skal du afinstallere Citrio og pr

s reciente de Citrio. Si el software no funciona, desinstala Citrio y vuelve a intentarlo.kArvutis on juba Citrioi uuem versioon. Kui tarkvara ei t

s reciente de Citrio. Si el software no funciona, desinstala Citrio y vuelve a intentarlo.kArvutis on juba Citrioi uuem versioon. Kui tarkvara ei t

.rOvo ra

.rOvo ra

jra.zKomputer ini sudah memiliki Citrio versi yang lebih anyar. Jika perangkat lunak tidak bekerja, copot Citrio dan coba lagi.uQuesto computer ha gi

jra.zKomputer ini sudah memiliki Citrio versi yang lebih anyar. Jika perangkat lunak tidak bekerja, copot Citrio dan coba lagi.uQuesto computer ha gi

nytt.zNa tym komputerze jest ju

nytt.zNa tym komputerze jest ju

ste to znova.uTa ra

ste to znova.uTa ra

lar aplicacions al sistema. Proveu de tornar a executar l'instal

lar aplicacions al sistema. Proveu de tornar a executar l'instal

lador com a administrador.kNem

lador com a administrador.kNem

.sYou do not have appropriate rights for system-level installation. Try running the installer again as Administrator.nYou do not have appropriate rights for system-level install. Try running the installer again as Administrator.

.sYou do not have appropriate rights for system-level installation. Try running the installer again as Administrator.nYou do not have appropriate rights for system-level install. Try running the installer again as Administrator.

n al nivel del sistema. Intenta ejecutar el instalador nuevamente como Administrador.uTeil ei ole s

n al nivel del sistema. Intenta ejecutar el instalador nuevamente como Administrador.uTeil ei ole s

ajte ponovno pokrenuti program za instalaciju kao administrator.jNincsenek meg a megfelel

ajte ponovno pokrenuti program za instalaciju kao administrator.jNincsenek meg a megfelel

.rNeturite reikiam

.rNeturite reikiam

.rAnda tidak mempunyai hak wajar untuk pemasangan peringkat sistem. Cuba jalankan pemasang semula sebagai Pentadbir.

.rAnda tidak mempunyai hak wajar untuk pemasangan peringkat sistem. Cuba jalankan pemasang semula sebagai Pentadbir.

vel do sistema. Tente executar o instalador novamente como administrador.

vel do sistema. Tente executar o instalador novamente como administrador.

vel do sistema. Tente executar o programa de instala

vel do sistema. Tente executar o programa de instala

.cNem

.cNem

vca.qNimate ustreznih pravic za namestitev na ravni sistema. Poskusite znova zagnati namestitveni program kot skrbnik.

vca.qNimate ustreznih pravic za namestitev na ravni sistema. Poskusite znova zagnati namestitveni program kot skrbnik.

.zDu har inte beh

.zDu har inte beh

r.uHuna haki zifaazo ili kufanya usakinishaji wa kiwango cha mfumo. Jaribu kutumia kisakinishi kama msimamiaji kompyuta.u

r.uHuna haki zifaazo ili kufanya usakinishaji wa kiwango cha mfumo. Jaribu kutumia kisakinishi kama msimamiaji kompyuta.u

lid. Torneu a baixar Citrio.VArchiv instala

lid. Torneu a baixar Citrio.VArchiv instala

m Citrio znovu.HInstallationsarkivet er beskadiget eller ugyldigt. Download Citrio igen.]Das Installationsarchiv ist besch

m Citrio znovu.HInstallationsarkivet er beskadiget eller ugyldigt. Download Citrio igen.]Das Installationsarchiv ist besch

.LThe installer archive is corrupted or invalid. Please download Citrio again.LThe installer archive is corrupted or invalid. Please download Citrio again.PEl archivo de instalaci

.LThe installer archive is corrupted or invalid. Please download Citrio again.LThe installer archive is corrupted or invalid. Please download Citrio again.PEl archivo de instalaci

lido. Vuelve a descargar Citrio.EEl instalador est

lido. Vuelve a descargar Citrio.EEl instalador est

lido. Descarga Citrio nuevamente.EInstalleri arhiiv on rikutud v

lido. Descarga Citrio nuevamente.EInstalleri arhiiv on rikutud v

.7Asennusarkisto on virheellinen. Lataa Citrio uudelleen.PSira o di-wasto ang archive ng installer. Mangyaring i-download muli ang Citrio.oL'archive du programme d'installation est corrompue ou n'est pas valide. Veuillez t

.7Asennusarkisto on virheellinen. Lataa Citrio uudelleen.PSira o di-wasto ang archive ng installer. Mangyaring i-download muli ang Citrio.oL'archive du programme d'installation est corrompue ou n'est pas valide. Veuillez t

.QArhiva programa za instalaciju o

.QArhiva programa za instalaciju o

a. Ponovo preuzmite Citrio.fA telep

a. Ponovo preuzmite Citrio.fA telep

t.9Arsip pemasang rusak atau tidak valid. Unduh Citrio lagi.PL'archivio di installazione

t.9Arsip pemasang rusak atau tidak valid. Unduh Citrio lagi.PL'archivio di installazione

.VDiegimo programos archyvas sugadintas arba negalioja. Atsisi

.VDiegimo programos archyvas sugadintas arba negalioja. Atsisi

.XInstal

.XInstal

.HArkib pemasang rosak atau tidak sah. Sila muat turun Citrio sekali lagi.\Het archief van het installatieprogramma is beschadigd of ongeldig. Download Citrio opnieuw.FInstallasjonsarkivet er skadet eller ugyldig. Last ned Citrio p

.HArkib pemasang rosak atau tidak sah. Sila muat turun Citrio sekali lagi.\Het archief van het installatieprogramma is beschadigd of ongeldig. Download Citrio opnieuw.FInstallasjonsarkivet er skadet eller ugyldig. Last ned Citrio p

nytt.PArchiwum instalatora jest uszkodzone lub nieprawid

nytt.PArchiwum instalatora jest uszkodzone lub nieprawid

a o download do Citrio novamente.bO arquivo do programa de instala

a o download do Citrio novamente.bO arquivo do programa de instala

lido. Transfira novamente o Citrio.YArhiva programului de instalare este deteriorat

lido. Transfira novamente o Citrio.YArhiva programului de instalare este deteriorat

.QArch

.QArch

Citrio znova.SArhiv namestitvenega programa je po

Citrio znova.SArhiv namestitvenega programa je po

.OArkivet f

.OArkivet f

r skadat eller ogiltigt. Ladda ned Citrio igen.PKumbukumbu ya kisakinishi imeharibika au ni batili. Tafadhali pakua Citrio tena.N

r skadat eller ogiltigt. Ladda ned Citrio igen.PKumbukumbu ya kisakinishi imeharibika au ni batili. Tafadhali pakua Citrio tena.N

i torneu-ho a provar.iV syst

i torneu-ho a provar.iV syst

m a zkuste to znovu.qDer er registreret en modstridende installation af Citrio i dit system. Du skal afinstallere denne og pr

m a zkuste to znovu.qDer er registreret en modstridende installation af Citrio i dit system. Du skal afinstallere denne og pr

.`A conflicting installation of Citrio was found on the system. Please uninstall it and try again.`A conflicting installation of Citrio was found on the system. Please uninstall it and try again.hSe ha detectado una instalaci

.`A conflicting installation of Citrio was found on the system. Please uninstall it and try again.`A conflicting installation of Citrio was found on the system. Please uninstall it and try again.hSe ha detectado una instalaci

lala y vuelve a intentarlo.dSe encontr

lala y vuelve a intentarlo.dSe encontr

lala y vuelve a intentarlo.VS

lala y vuelve a intentarlo.VS

uudelleen.bMay nakitang sumasalungat na pag-install ng Citrio sa system. Paki-uninstall ito at subukang muli.pUne installation de Citrio incompatible a

uudelleen.bMay nakitang sumasalungat na pag-install ng Citrio sa system. Paki-uninstall ito at subukang muli.pUne installation de Citrio incompatible a

ajte ponovo.kA Citrio m

ajte ponovo.kA Citrio m

jra.NTerjadi konflik pemasangan Citrio pada sistem. Copot pemasangan dan coba lagi.]Nel sistema

jra.NTerjadi konflik pemasangan Citrio pada sistem. Copot pemasangan dan coba lagi.]Nel sistema

.XSistemoje aptikta nesuderinama

.XSistemoje aptikta nesuderinama

.lSist

.lSist

.\Pemasangan Citrio yang bercanggah telah dijumpai pada sistem. Sila nyahpasang dan cuba lagi.oEr is een conflicterende installatie van Citrio op het systeem gevonden. Verwijder deze en probeer het opnieuw.gDet ble funnet en konfliktskapende installasjon av Citrio p

.\Pemasangan Citrio yang bercanggah telah dijumpai pada sistem. Sila nyahpasang dan cuba lagi.oEr is een conflicterende installatie van Citrio op het systeem gevonden. Verwijder deze en probeer het opnieuw.gDet ble funnet en konfliktskapende installasjon av Citrio p

nytt.sW systemie znaleziono zainstalowan

nytt.sW systemie znaleziono zainstalowan

ste to znova.WV sistemu je bila odkrita namestitev Citrioa v sporu. Odstranite jo in poskusite znova.a

ste to znova.WV sistemu je bila odkrita namestitev Citrioa v sporu. Odstranite jo in poskusite znova.a

.VDet finns en annan installation av Citrio p

.VDet finns en annan installation av Citrio p

k igen.ZUsakinishi tatanishi wa Citrio ulipatikana kwenye mfumo. Tafadhali uondoe na ujaribu tena.yCitrio

k igen.ZUsakinishi tatanishi wa Citrio ulipatikana kwenye mfumo. Tafadhali uondoe na ujaribu tena.yCitrio

.UNebyla nalezena

.UNebyla nalezena

ytynyt.5Walang nakitang pag-install ng Citrio upang i-update..Aucune installation de Citrio

ytynyt.5Walang nakitang pag-install ng Citrio upang i-update..Aucune installation de Citrio

galima atnaujinti.BNetika atrasta neviena Citrio instal

galima atnaujinti.BNetika atrasta neviena Citrio instal

o.HNu s-a g

o.HNu s-a g

t un error en el sistema operatiu durant la instal

t un error en el sistema operatiu durant la instal

. Torneu a baixar Citrio.OB

. Torneu a baixar Citrio.OB

opera

opera

m Citrio znovu.QDer opstod en fejl i operativsystemet under installationen. Download Citrio igen.nW

m Citrio znovu.QDer opstod en fejl i operativsystemet under installationen. Download Citrio igen.nW

.UAn operating system error occurred during installation. Please download Citrio again.UAn operating system error occurred during installation. Please download Citrio again.kSe ha producido un error de sistema operativo durante el proceso de instalaci

.UAn operating system error occurred during installation. Please download Citrio again.UAn operating system error occurred during installation. Please download Citrio again.kSe ha producido un error de sistema operativo durante el proceso de instalaci

n. Vuelve a descargar Citrio.]Se produjo un error del sistema operativo durante la instalaci

n. Vuelve a descargar Citrio.]Se produjo un error del sistema operativo durante la instalaci

n. Descarga Citrio nuevamente.KInstallimisel ilmnes operatsioonis

n. Descarga Citrio nuevamente.KInstallimisel ilmnes operatsioonis

.CAsennuksessa ilmeni k

.CAsennuksessa ilmeni k

virhe. Lataa Citrio uudelleen.jMay naganap na error sa operating system sa panahon ng pag-install. Mangyaring i-download muli ang Citrio.rUne erreur du syst

virhe. Lataa Citrio uudelleen.jMay naganap na error sa operating system sa panahon ng pag-install. Mangyaring i-download muli ang Citrio.rUne erreur du syst

ke operativnog sustava tijekom instalacije. Ponovo preuzmite Citrio.YAz oper

ke operativnog sustava tijekom instalacije. Ponovo preuzmite Citrio.YAz oper

jra a Citrioot.UTerjadi kesalahan pada sistem operasi saat pemasangan berlangsung. Unduh Citrio lagi.aDurante l'installazione si

jra a Citrioot.UTerjadi kesalahan pada sistem operasi saat pemasangan berlangsung. Unduh Citrio lagi.aDurante l'installazione si

verificato un errore del sistema operativo. Scarica di nuovo Citrio.=

verificato un errore del sistema operativo. Scarica di nuovo Citrio.=

.KDiegiant

.KDiegiant

vyko operacin

vyko operacin

.PInstal

.PInstal

.SRalat sistem pengendalian berlaku semasa pemasangan. Sila muat turun Citrio semula.cEr is tijdens de installatie een fout opgetreden in het besturingssysteem. Download Citrio opnieuw.EDet oppsto en systemfeil under installering. Last ned Citrio p

.SRalat sistem pengendalian berlaku semasa pemasangan. Sila muat turun Citrio semula.cEr is tijdens de installatie een fout opgetreden in het besturingssysteem. Download Citrio opnieuw.EDet oppsto en systemfeil under installering. Last ned Citrio p

nytt.OPodczas instalacji wyst

nytt.OPodczas instalacji wyst

d systemu operacyjnego. Pobierz Citrio ponownie.aOcorreu um erro no sistema operacional durante a instala

d systemu operacyjnego. Pobierz Citrio ponownie.aOcorreu um erro no sistema operacional durante a instala

XOcorreu um erro no sistema operativo durante a instala

XOcorreu um erro no sistema operativo durante a instala

o. Transfira novamente o Citrio.YS-a produs o eroare de sistem de operare

o. Transfira novamente o Citrio.YS-a produs o eroare de sistem de operare

cie sa vyskytla chyba opera

cie sa vyskytla chyba opera

Citrio znova.GNapaka v operacijskem sistemu med namestitvijo. Znova prenesite Citrio.T

Citrio znova.GNapaka v operacijskem sistemu med namestitvijo. Znova prenesite Citrio.T

.NEtt operativsystemsfel intr

.NEtt operativsystemsfel intr

;Citrio Windows Vista

;Citrio Windows Vista

Windows XP

Windows XP

Windows Vista

Windows Vista

.ECitrio

.ECitrio

.>Windows Vista

.>Windows Vista

?Citrio requereix Windows Vista o Windows XP amb SP2 o superior.MCitrio vy

?Citrio requereix Windows Vista o Windows XP amb SP2 o superior.MCitrio vy

aduje opera

aduje opera

m Windows Vista nebo Windows XP SP2 nebo vy

m Windows Vista nebo Windows XP SP2 nebo vy

.BCitrio kr

.BCitrio kr

ver Windows Vista eller Windows XP med SP2 eller h

ver Windows Vista eller Windows XP med SP2 eller h

jere.IF

jere.IF

r Citrio ist Windows Vista oder Windows XP SP2 oder h

r Citrio ist Windows Vista oder Windows XP SP2 oder h

.?Citrio requires Windows Vista or Windows XP with SP2 or higher.?Citrio requires Windows Vista or Windows XP with SP2 or higher.JCitrio est

.?Citrio requires Windows Vista or Windows XP with SP2 or higher.?Citrio requires Windows Vista or Windows XP with SP2 or higher.JCitrio est

disponible para Windows Vista o Windows XP con SP2 o superior.RPara usar Citrio Frame, se necesita Windows Vista o Windows XP con SP2 o superior.JCitrio n

disponible para Windows Vista o Windows XP con SP2 o superior.RPara usar Citrio Frame, se necesita Windows Vista o Windows XP con SP2 o superior.JCitrio n

uab Windows Vistat v

uab Windows Vistat v

i Windows XP-d v

i Windows XP-d v

.ZCitrio edellytt

.ZCitrio edellytt

on Windows Vista tai Windows XP SP2 tai uudempi.

on Windows Vista tai Windows XP SP2 tai uudempi.

OKinakailangan ng Citrio ang Windows Vista o Windows XP na may SP2 o mas mataas.OCitrio requiert Windows Vista ou Windows XP avec SP2 ou une version ult

OKinakailangan ng Citrio ang Windows Vista o Windows XP na may SP2 o mas mataas.OCitrio requiert Windows Vista ou Windows XP avec SP2 ou une version ult

rieure.MCitrio

rieure.MCitrio

.ZCitrio zahtijeva sustav Windows Vista ili Windows XP sa servisnim paketom SP2 ili novijim.XA Citrio futtat

.ZCitrio zahtijeva sustav Windows Vista ili Windows XP sa servisnim paketom SP2 ili novijim.XA Citrio futtat

hoz Windows Vista, illetve Windows XP SP2 vagy

hoz Windows Vista, illetve Windows XP SP2 vagy

ges.PCitrio memerlukan Windows Vista atau Windows XP dengan SP2 atau yang lebih baru.ICitrio richiede Windows Vista o Windows XP con SP2 o versioni successive.P

ges.PCitrio memerlukan Windows Vista atau Windows XP dengan SP2 atau yang lebih baru.ICitrio richiede Windows Vista o Windows XP con SP2 o versioni successive.P

Windows XP SP2

Windows XP SP2

.FCitrio

.FCitrio

Windows Vista

Windows Vista

Windows XP

Windows XP

su SP2 ar naujesne versija.vP

su SP2 ar naujesne versija.vP

ma Windows Vista vai Windows XP ar SP2, vai jaun

ma Windows Vista vai Windows XP ar SP2, vai jaun

s versija.cCitrio-

s versija.cCitrio-

.ZCitrio

.ZCitrio

.MCitrio memerlukan Windows Vista atau Windows XP dengan SP2 atau lebih tinggi.DVoor Citrio is Windows Vista of Windows XP met SP2 of hoger vereist.BCitrio krever Windows Vista eller Windows XP med SP2 eller h

.MCitrio memerlukan Windows Vista atau Windows XP dengan SP2 atau lebih tinggi.DVoor Citrio is Windows Vista of Windows XP met SP2 of hoger vereist.BCitrio krever Windows Vista eller Windows XP med SP2 eller h

yere.PCitrio wymaga systemu Windows Vista b

yere.PCitrio wymaga systemu Windows Vista b

Windows XP z dodatkiem SP2 lub nowszym.BO Citrio requer o Windows Vista ou Windows XP com SP2 ou superior.BO Citrio requer o Windows Vista ou Windows XP com SP2 ou superior.NCitrio necesit

Windows XP z dodatkiem SP2 lub nowszym.BO Citrio requer o Windows Vista ou Windows XP com SP2 ou superior.BO Citrio requer o Windows Vista ou Windows XP com SP2 ou superior.NCitrio necesit

Windows Vista sau Windows XP cu SP2 sau o versiune ulterioar

Windows Vista sau Windows XP cu SP2 sau o versiune ulterioar

m Windows Vista alebo Windows XP s bal

m Windows Vista alebo Windows XP s bal

m.kZa Citrio potrebujete operacijski sistem Windows Vista ali Windows XP s servisnim paketom SP2 ali novej

m.kZa Citrio potrebujete operacijski sistem Windows Vista ali Windows XP s servisnim paketom SP2 ali novej

vs Windows Vista eller Windows XP med SP2 eller senare.CCitrio inahitaji Windows Vista au Windows XP iliyo na SP2 au zaidi.UWindows Vista

vs Windows Vista eller Windows XP med SP2 eller senare.CCitrio inahitaji Windows Vista au Windows XP iliyo na SP2 au zaidi.UWindows Vista

.DCitrio

.DCitrio

.CCitrio

.CCitrio

QCitrio; Windows Vista veya Windows XP SP2 ya da daha ileri bir s

QCitrio; Windows Vista veya Windows XP SP2 ya da daha ileri bir s

gerektirir.HCitrio

gerektirir.HCitrio

u Windows Vista ho

u Windows Vista ho

c Windows XP c

c Windows XP c

Windows Vista

Windows Vista

.yThe installer couldn't create a temporary directory. Please check for free disk space and permission to install software.yThe installer couldn't create a temporary directory. Please check for free disk space and permission to install software.

.yThe installer couldn't create a temporary directory. Please check for free disk space and permission to install software.yThe installer couldn't create a temporary directory. Please check for free disk space and permission to install software.

El instalador no pudo crear un directorio temporal. Verifique si hay espacio disponible en el disco y cuenta con permiso para instalar software.wInstallija ei suutnud luua ajutist kataloogi. Palun kontrollige vaba kettaruumi ja tarkvara installimise loa olemasolu.e

El instalador no pudo crear un directorio temporal. Verifique si hay espacio disponible en el disco y cuenta con permiso para instalar software.wInstallija ei suutnud luua ajutist kataloogi. Palun kontrollige vaba kettaruumi ja tarkvara installimise loa olemasolu.e

.xPemasang tidak dapat mencipta direktori sementara. Sila semak ruang cakera kosong dan kebenaran untuk memasang perisian.

.xPemasang tidak dapat mencipta direktori sementara. Sila semak ruang cakera kosong dan kebenaran untuk memasang perisian.

lador no ha pogut descomprimir l'arxiu. Torneu a baixar Citrio.RInstala

lador no ha pogut descomprimir l'arxiu. Torneu a baixar Citrio.RInstala

m Citrio znovu.JInstallationsprogrammet kunne ikke pakke arkivet ud. Download Citrio igen.iDas Installationsprogramm konnte das Archiv nicht dekomprimieren. Bitte laden Sie Citrio erneut herunter.Z

m Citrio znovu.JInstallationsprogrammet kunne ikke pakke arkivet ud. Download Citrio igen.iDas Installationsprogramm konnte das Archiv nicht dekomprimieren. Bitte laden Sie Citrio erneut herunter.Z

.IThe installer failed to uncompress archive. Please download Citrio again.IThe installer failed to uncompress archive. Please download Citrio again.[El programa de instalaci

.IThe installer failed to uncompress archive. Please download Citrio again.IThe installer failed to uncompress archive. Please download Citrio again.[El programa de instalaci

n no ha podido descomprimir el archivo. Vuelve a descargar Citrio.JEl instalador no pudo descomprimir el archivo. Descarga Citrio nuevamente.LInstalleril ei

n no ha podido descomprimir el archivo. Vuelve a descargar Citrio.JEl instalador no pudo descomprimir el archivo. Descarga Citrio nuevamente.LInstalleril ei

.NAsennusohjelma ei pystynyt purkamaan arkistotiedostoa. Lataa Citrio uudelleen.VNabigong i-uncompress ng installer ang archive. Mangyaring i-download muli ang Citrio.n

.NAsennusohjelma ei pystynyt purkamaan arkistotiedostoa. Lataa Citrio uudelleen.VNabigong i-uncompress ng installer ang archive. Mangyaring i-download muli ang Citrio.n

.JProgram za instalaciju nije dekomprimirao arhivu. Ponovo preuzmite Citrio.gNem siker

.JProgram za instalaciju nije dekomprimirao arhivu. Ponovo preuzmite Citrio.gNem siker

.NDiegimo programai nepavyko i

.NDiegimo programai nepavyko i

.SInstal

.SInstal

.LPemasang gagal untuk menyahmampat arkib. Sila muat turun Citrio sekali lagi.QHet installatieprogramma kan het archief niet uitpakken. Download Citrio opnieuw.QInstallasjonsprogrammet kunne ikke dekomprimere arkivet. Last ned Citrio p

.LPemasang gagal untuk menyahmampat arkib. Sila muat turun Citrio sekali lagi.QHet installatieprogramma kan het archief niet uitpakken. Download Citrio opnieuw.QInstallasjonsprogrammet kunne ikke dekomprimere arkivet. Last ned Citrio p

nytt.LInstalator nie mo

nytt.LInstalator nie mo

a o download do Citrio novamente.bHouve uma falha no programa de instala

a o download do Citrio novamente.bHouve uma falha no programa de instala

Citrio znova.KNamestitvenemu programu ni uspelo raz

Citrio znova.KNamestitvenemu programu ni uspelo raz

.RDet gick inte att packa upp arkivet med installationsfilen. Ladda ned Citrio igen.JKisakinishi kilishindwa kufinyuza kumbukumbu. Tafadhali pakua Citrio tena.P

.RDet gick inte att packa upp arkivet med installationsfilen. Ladda ned Citrio igen.JKisakinishi kilishindwa kufinyuza kumbukumbu. Tafadhali pakua Citrio tena.P

Navegador web

Navegador web

Webov

Webov

Webbrowser

Webbrowser

Web Browser

Web Browser

Navigateur Web

Navigateur Web

Web-preglednik

Web-preglednik

Browser Web

Browser Web

Browser web

Browser web

Penyemak imbas web

Penyemak imbas web

Navegador da Web

Navegador da Web

Webbl

Webbl

Web Taray

Web Taray

t web

t web

s un navegador web que executa les p

s un navegador web que executa les p

gines web i les aplicacions a gran velocitat.

gines web i les aplicacions a gran velocitat.

Citrio je webov

Citrio je webov

webov

webov

ejte web bezpe

ejte web bezpe

Citrio er en webbrowser, der k

Citrio er en webbrowser, der k

rer websider og applikationer med lynets hast. Den er hurtig, stabil og brugervenlig. Beskyttelse mod malware og phishing er indbygget i Citrio, s

rer websider og applikationer med lynets hast. Den er hurtig, stabil og brugervenlig. Beskyttelse mod malware og phishing er indbygget i Citrio, s

Citrio ist ein Webbrowser, der Webseiten und Apps in Sekundenschnelle l

Citrio ist ein Webbrowser, der Webseiten und Apps in Sekundenschnelle l

Citrio is a web browser that runs webpages and applications with lightning speed. It's fast, stable, and easy to use. Browse the web more safely with malware and phishing protection built into Citrio.

Citrio is a web browser that runs webpages and applications with lightning speed. It's fast, stable, and easy to use. Browse the web more safely with malware and phishing protection built into Citrio.

Citrio es un navegador web que ejecuta p

Citrio es un navegador web que ejecuta p

ginas web y aplicaciones a gran velocidad. Es r

ginas web y aplicaciones a gran velocidad. Es r

cil de utilizar. Citrio te permite navegar en la Web de forma m

cil de utilizar. Citrio te permite navegar en la Web de forma m

ginas web y aplicaciones con la velocidad de la luz. Es r

ginas web y aplicaciones con la velocidad de la luz. Es r

cil de usar. Navega por la Web con seguridad y protecci

cil de usar. Navega por la Web con seguridad y protecci

Ang Citrio ay isang web browser na nagpapatakbo ng mga webpage at application sa bilis ng kidlat. Ito ay mabilis, maaasahan, at madaling gamitin. Mas maingat na mag-browse sa web gamit ang proteksyon ng Citrio laban sa malware at phishing.

Ang Citrio ay isang web browser na nagpapatakbo ng mga webpage at application sa bilis ng kidlat. Ito ay mabilis, maaasahan, at madaling gamitin. Mas maingat na mag-browse sa web gamit ang proteksyon ng Citrio laban sa malware at phishing.

Citrio est un navigateur Web qui ex

Citrio est un navigateur Web qui ex

cute les pages Web et les applications

cute les pages Web et les applications

une vitesse fulgurante. Il est rapide, stable et simple d'utilisation. Naviguez sur le Web en toute s

une vitesse fulgurante. Il est rapide, stable et simple d'utilisation. Naviguez sur le Web en toute s

Citrio je web-preglednik koji munjevitom brzinom prikazuje web-stranice i aplikacije. Brz je, stabilan i jednostavan za upotrebu. Pregledavajte web sigurnije jer je za

Citrio je web-preglednik koji munjevitom brzinom prikazuje web-stranice i aplikacije. Brz je, stabilan i jednostavan za upotrebu. Pregledavajte web sigurnije jer je za

mgyorsan futtatja a weboldalakat

mgyorsan futtatja a weboldalakat

Citrio adalah browser web yang menjalankan laman web dan aplikasi dengan kecepatan kilat. Browser ini cepat, stabil, dan mudah digunakan. Jelajahi web lebih aman dengan perlindungan dari perangkat lunak perusak dan phishing yang tertanam di dalam Citrio.

Citrio adalah browser web yang menjalankan laman web dan aplikasi dengan kecepatan kilat. Browser ini cepat, stabil, dan mudah digunakan. Jelajahi web lebih aman dengan perlindungan dari perangkat lunak perusak dan phishing yang tertanam di dalam Citrio.

un browser web che esegue le pagine web e le applicazioni alla velocit

un browser web che esegue le pagine web e le applicazioni alla velocit

-Citrio.xCitrio

-Citrio.xCitrio

.yCitrio

.yCitrio

Citrio merupakan penyemak imbas yang mengendalikan laman web dan aplikasi dengan kelajuan sepantas kilat. Citrio cepat, stabil dan mudah digunakan. Semak imbas web lebih selamat dengan perlindungan perisian hasad dan pancingan data terbina dalam Citrio.

Citrio merupakan penyemak imbas yang mengendalikan laman web dan aplikasi dengan kelajuan sepantas kilat. Citrio cepat, stabil dan mudah digunakan. Semak imbas web lebih selamat dengan perlindungan perisian hasad dan pancingan data terbina dalam Citrio.

Citrio is een webbrowser die webpagina's en applicaties bliksemsnel uitvoert. Citrio is snel, stabiel en eenvoudig in gebruik. Surf veiliger op internet met de in Citrio ingebouwde beveiliging tegen malware en phishing.

Citrio is een webbrowser die webpagina's en applicaties bliksemsnel uitvoert. Citrio is snel, stabiel en eenvoudig in gebruik. Surf veiliger op internet met de in Citrio ingebouwde beveiliging tegen malware en phishing.

um navegador que executa p

um navegador que executa p

ginas e aplicativos da web com alta velocidade.

ginas e aplicativos da web com alta velocidade.

cil de usar. Navegue na web com mais seguran

cil de usar. Navegue na web com mais seguran

um navegador de internet que executa p

um navegador de internet que executa p

ginas Web e aplica

ginas Web e aplica

cil de utilizar. Navegue na Web com mais seguran

cil de utilizar. Navegue na Web com mais seguran

Citrio este un browser web care ruleaz

Citrio este un browser web care ruleaz

pagini web

pagini web

i pe web

i pe web

a webov

a webov

web bezpe

web bezpe

r en webbl

r en webbl

r webbsidor och appar blixtsnabbt. Den

r webbsidor och appar blixtsnabbt. Den

Citrio, Web sayfalar

Citrio, Web sayfalar

ran bir Web taray

ran bir Web taray

sayesinde Web'de daha g

sayesinde Web'de daha g

t web ch

t web ch

c trang web v

c trang web v

t web nhanh,

t web nhanh,

t web tr

t web tr

o Citrio.KCitrio

o Citrio.KCitrio

executant actualment. Tanqueu Citrio i torneu-ho a provar.qNelze nainstalovat verzi prohl

executant actualment. Tanqueu Citrio i torneu-ho a provar.qNelze nainstalovat verzi prohl

Citrio a zkuste to znovu.jKan ikke installere den samme version af Citrio som den, der k

Citrio a zkuste to znovu.jKan ikke installere den samme version af Citrio som den, der k

.eCan not install the same Citrio version that is currently running. Please close Citrio and try again.eCan not install the same Citrio version that is currently running. Please close Citrio and try again.xNo se puede instalar la misma versi

.eCan not install the same Citrio version that is currently running. Please close Citrio and try again.eCan not install the same Citrio version that is currently running. Please close Citrio and try again.xNo se puede instalar la misma versi

ejecutando actualmente. Cierra Citrio y vuelve a intentarlo.nNo es posible instalar la misma versi

ejecutando actualmente. Cierra Citrio y vuelve a intentarlo.nNo es posible instalar la misma versi

.fCitrioista ei voi asentaa versiota, joka on t

.fCitrioista ei voi asentaa versiota, joka on t

uudelleen.pHindi ma-install ang parehong Bersyon ng Citrio na kasalukuyang tumatakbo. Pakisara ang Citrio at subukang muli.

uudelleen.pHindi ma-install ang parehong Bersyon ng Citrio na kasalukuyang tumatakbo. Pakisara ang Citrio at subukang muli.

.lNe mo

.lNe mo

ajte ponovo.mNem lehet ugyanazt a Citrio-verzi

ajte ponovo.mNem lehet ugyanazt a Citrio-verzi

jra.iTidak dapat memasang Citrio versi yang sama dengan yang sedang Anda jalankan. Tutup Citrio dan coba lagi.eImpossibile installare una versione di Citrio uguale a quella in esecuzione. Chiudi Citrio e riprova.

jra.iTidak dapat memasang Citrio versi yang sama dengan yang sedang Anda jalankan. Tutup Citrio dan coba lagi.eImpossibile installare una versione di Citrio uguale a quella in esecuzione. Chiudi Citrio e riprova.

.sNegalima

.sNegalima

.eNevar instal

.eNevar instal

.kTidak boleh memasang versi Citrio yang sama dengan yang sedang dijalankan. Sila tutup Citrio dan cuba lagi.qKan niet dezelfde Citrio-versie installeren, omdat deze versie nu actief is. Sluit Citrio en probeer het opnieuw.WKan ikke installere den samme Citrio-versjonen som kj

.kTidak boleh memasang versi Citrio yang sama dengan yang sedang dijalankan. Sila tutup Citrio dan cuba lagi.qKan niet dezelfde Citrio-versie installeren, omdat deze versie nu actief is. Sluit Citrio en probeer het opnieuw.WKan ikke installere den samme Citrio-versjonen som kj

nytt.iNie mo

nytt.iNie mo

buj ponownie.lN

buj ponownie.lN

sendo executada. Feche o Citrio e tente novamente.sN

sendo executada. Feche o Citrio e tente novamente.sN

atualmente em execu

atualmente em execu

o. Feche o Citrio e tente novamente.nNu se poate instala aceea

o. Feche o Citrio e tente novamente.nNu se poate instala aceea

ste to znova.eNi mogo

ste to znova.eNi mogo

.iDet g

.iDet g

k igen.pHaiwezi kusakinisha toleo sawia la Citrio ambalo linaendeshwa hivi sasa. Tafadhali funga Citrio na ujaribu tena.a

k igen.pHaiwezi kusakinisha toleo sawia la Citrio ambalo linaendeshwa hivi sasa. Tafadhali funga Citrio na ujaribu tena.a

ha fallat a causa d'un error no especificat. Torneu a baixar Citrio.HInstalace se z nezn

ha fallat a causa d'un error no especificat. Torneu a baixar Citrio.HInstalace se z nezn

m Citrio znovu.SInstallationen mislykkedes p

m Citrio znovu.SInstallationen mislykkedes p

.KInstallation failed due to unspecified error. Please download Citrio again.KInstallation failed due to unspecified error. Please download Citrio again.WLa instalaci

.KInstallation failed due to unspecified error. Please download Citrio again.KInstallation failed due to unspecified error. Please download Citrio again.WLa instalaci

n ha fallado debido a un error no especificado. Vuelve a descargar Citrio.QLa instalaci

n ha fallado debido a un error no especificado. Vuelve a descargar Citrio.QLa instalaci

debido a un error no especificado. Descarga Citrio otra vez.HInstallimine eba

debido a un error no especificado. Descarga Citrio otra vez.HInstallimine eba

.NAsennus ep

.NAsennus ep

.JInstalacija nije uspjela zbog nepoznate pogre

.JInstalacija nije uspjela zbog nepoznate pogre

jra a Citrioot.KPemasangan gagal karena kesalahan yang tidak ditentukan. Unduh Citrio lagi.UInstallazione non riuscita a causa di un errore imprecisato. Scarica di nuovo Citrio.5

jra a Citrioot.KPemasangan gagal karena kesalahan yang tidak ditentukan. Unduh Citrio lagi.UInstallazione non riuscita a causa di un errore imprecisato. Scarica di nuovo Citrio.5

.JNepavyko

.JNepavyko

.UInstal

.UInstal

.WPemasangan gagal disebabkan ralat yang tidak dinyatakan. Sila muat turun semula Citrio.MDe installatie is mislukt wegens een onbekende fout. Download Citrio opnieuw.SInstalleringen mislyktes p

.WPemasangan gagal disebabkan ralat yang tidak dinyatakan. Sila muat turun semula Citrio.MDe installatie is mislukt wegens een onbekende fout. Download Citrio opnieuw.SInstalleringen mislyktes p

a o download do Citrio novamente.UA instala

a o download do Citrio novamente.UA instala

o especificado. Transfira novamente o Citrio .SInstalarea nu a reu

o especificado. Transfira novamente o Citrio .SInstalarea nu a reu

znova.FNamestitev ni uspela zaradi nenavedene napake. Znova prenesite Citrio.H

znova.FNamestitev ni uspela zaradi nenavedene napake. Znova prenesite Citrio.H

.MInstallationen misslyckades p

.MInstallationen misslyckades p

nt fel. Ladda ned Citrio igen.YUsakinishaji ulishindwa kwa sababu ya hitilafu isiyobainika. Tafadhali pakua Citrio tena.Y

nt fel. Ladda ned Citrio igen.YUsakinishaji ulishindwa kwa sababu ya hitilafu isiyobainika. Tafadhali pakua Citrio tena.Y

citrio_48.0.2564.270_1.exe_1144:

.text

.text

`.data

`.data

.idata

.idata

@.rsrc

@.rsrc

@.reloc

@.reloc

c:\jenkins\workspace\Citrio-Dev-Clone\browser\src\out\Release\mini_installer.exe.pdb

c:\jenkins\workspace\Citrio-Dev-Clone\browser\src\out\Release\mini_installer.exe.pdb

RegCloseKey

RegCloseKey

RegOpenKeyExW

RegOpenKeyExW

ADVAPI32.dll

ADVAPI32.dll

GetProcessHeap

GetProcessHeap

KERNEL32.dll

KERNEL32.dll

SHELL32.dll

SHELL32.dll

setup.exe

setup.exe

S*.lK

S*.lK

XP.hS

XP.hS

.FKY2

.FKY2

S%d?K

S%d?K

X'"ÃŒJg`

X'"ÃŒJg`

;.BHl

;.BHl

ns .Zs

ns .Zs

.DikV

.DikV

.JzPlq

.JzPlq

-V})&

-V})&

TJ%8u

TJ%8u

y.RSt

y.RSt

ÁUPl

ÁUPl

.nYq95cg

.nYq95cg

%S4-!S

%S4-!S

.bBL'

.bBL'

8NA%x

8NA%x

I:.TW

I:.TW

@.cDX

@.cDX

5eXE.

5eXE.

?.mgH

?.mgH

.HsS844

.HsS844

z%u9&,

z%u9&,

%s1'a

%s1'a

%s.H*2

%s.H*2

Gf.sA!J|

Gf.sA!J|

x'P-5}

x'P-5}

.ks=R

.ks=R

1.hx

1.hx

{ZNe%C

{ZNe%C

{O1%3xC

{O1%3xC

[.qgB

[.qgB

Q0I.ul

Q0I.ul

Z0&.iI

Z0&.iI

#-!pH.BBMk

#-!pH.BBMk

mH4w$.eZ

mH4w$.eZ

89%u\

89%u\

*rt-hf}

*rt-hf}

O|.Nt

O|.Nt

H[?~;O%C

H[?~;O%C

.HKMkL

.HKMkL

%sD,h

%sD,h

#%>%x

#%>%x

QD.rj

QD.rj

]MP.wdnN

]MP.wdnN

@-1Z

@-1Z

.JozUY

.JozUY

l.oit

l.oit

X.Ko9

X.Ko9

l:.VPf

l:.VPf

bc%F:I

bc%F:I

[.Pf

[.Pf

tG5c.qT

tG5c.qT

$ESQL?*

$ESQL?*

?f.Ar

?f.Ar

.aF[m

.aF[m

C.hY`2

C.hY`2

I.mLvM

I.mLvM

.rfcV

.rfcV

2.vz$

2.vz$

;-O%x

;-O%x

'^Z%C

'^Z%C

-rV1}

-rV1}

RV]&.cU

RV]&.cU

%svA{

%svA{

ID%d$

ID%d$

.nF]1I

.nF]1I

.nUsLB9

.nUsLB9

c%SOq[U

c%SOq[U

J..wM

J..wM

P#.lJ

P#.lJ

0.SBL

0.SBL

.t.X.Wj

.t.X.Wj

:s>d%d`

:s>d%d`

.nq0=

.nq0=

%uR,:,

%uR,:,

-|?

-|?

].TYo?o6]

].TYo?o6]

m.Ugs

m.Ugs

M"].gW

M"].gW

Z%dk^

Z%dk^

j.tbH&

j.tbH&

O^.mbT

O^.mbT

%7 Q,N%C

%7 Q,N%C

p>.Vp

p>.Vp

c.HM

c.HM

/%XBw^

/%XBw^

.gS.v

.gS.v

.DYCqO

.DYCqO

t;

t;

.kQ#&TE'r

.kQ#&TE'r

'%uq|

'%uq|

.dUA7,"

.dUA7,"

%fuB0

%fuB0

.SE~7)=

.SE~7)=

_K }%D

_K }%D

w1.QRq

w1.QRq

n|:%c\C

n|:%c\C

ij

ij

tu%xl

tu%xl

d:E`%x

d:E`%x

\d%sX

\d%sX

l.fWfK

l.fWfK

z3.yN

z3.yN

%x[@

%x[@

)r.CS

)r.CS

.utP%

.utP%

(.OPD

(.OPD

8Y|s%D

8Y|s%D

RU&%c

RU&%c

-*%D/H

-*%D/H

cG.Ld

cG.Ld

.dj#3q7

.dj#3q7

T.roF

T.roF

T!(%fM)

T!(%fM)

.rRM,

.rRM,

%d.|

%d.|

#0.ii

#0.ii

@%Uy}Y

@%Uy}Y

7.vC`

7.vC`

E|%7S

E|%7S

.izCZ

.izCZ

.YzgMa

.YzgMa

F:\ZO

F:\ZO

.ol_$

.ol_$

c.XY!T

c.XY!T

Lt|

Lt|

%SZW>

%SZW>

7.ZUT

7.ZUT

Q:\dnF

Q:\dnF

mT.MRF%L

mT.MRF%L

.Xkt>

.Xkt>

Q%f^3

Q%f^3

".Rz*%4

".Rz*%4

.SsNE

.SsNE

.cM}6H

.cM}6H

.jD%3L

.jD%3L

.YL

.YL

%s08c9

%s08c9

9g.An

9g.An

X.kwbQ

X.kwbQ

cl 0%c

cl 0%c

n.leu

n.leu

%fv~"

%fv~"

YXXT %d=,F

YXXT %d=,F

G9$.nL

G9$.nL

)

)

8SM.kgC

8SM.kgC

T%Xp8

T%Xp8

sqLX

sqLX

%-8.MJy)N

%-8.MJy)N

X.WFwzA

X.WFwzA

!5.rxvm

!5.rxvm

xBi.HW

xBi.HW

Gc.AA*.E4N

Gc.AA*.E4N

m{.lu

m{.lu

u%0UW4

u%0UW4

ECX%UV

ECX%UV

!DB.sySf

!DB.sySf

--y}),

--y}),

.sXGFn

.sXGFn

cRtA

cRtA

H.XP$

H.XP$

.oRyP

.oRyP

J.OMbJ

J.OMbJ

.Vn:>

.Vn:>

nR%4X

nR%4X

X~#.Ry

X~#.Ry

.Kiv*

.Kiv*

*%c@W

*%c@W

%c/#K

%c/#K

v.GrG

v.GrG

R.Ws}

R.Ws}

`tA@%f

`tA@%f

%S]Q

%S]Q

%stL\

%stL\

%UzoS

%UzoS

\/.es

\/.es

%9x:I

%9x:I

g%claI

g%claI

AK.Lo

AK.Lo

_/.eu

_/.eu

MJFX{.Aj`

MJFX{.Aj`

d%C#q

d%C#q

v.iqx

v.iqx

.nBrS

.nBrS

.chm(

.chm(

b%D&R

b%D&R

Ku.eS

Ku.eS

y%d''Y

y%d''Y

.aI@)

.aI@)

J.wSN

J.wSN

;.sSs

;.sSs

_E%SC

_E%SC

.rXZ-

.rXZ-

oÞ-xL5

oÞ-xL5

.EB]P

.EB]P

%cm--

%cm--

%SX2Y

%SX2Y

W%C%c

W%C%c

.Fh9]n!s

.Fh9]n!s

.KN|F

.KN|F

x`N%s5

x`N%s5

Gq9VQEL

Gq9VQEL

zcp.jU?

zcp.jU?

z.gbsti

z.gbsti

t.jO'

t.jO'

g!.qQ

g!.qQ

C`i%8xF

C`i%8xF

\`%f^y41y

\`%f^y41y

n.lnF

n.lnF

?~.vGG

?~.vGG

.Hh'u5

.Hh'u5

{%;

{%;

3%.ZI

3%.ZI

>*Jh%s&

>*Jh%s&

NW.Fn

NW.Fn

2W.OV

2W.OV

%.Gp~

%.Gp~

B(.dQ

B(.dQ

'@n

'@n

.VWvf

.VWvf

O;%1S,S

O;%1S,S

%Sd#.

%Sd#.

wa.US

wa.US

.so$v`2

.so$v`2

%Xwh.

%Xwh.

`%X9kr

`%X9kr

\"%s$

\"%s$

Cp%XsT

Cp%XsT

$.Ko_

$.Ko_

G7a.TbT

G7a.TbT

bc%U0

bc%U0

.eZ[H

.eZ[H

pF%XH

pF%XH

;5.YR

;5.YR

p.rWSg

p.rWSg

Ju.if

Ju.if

]x~8%U

]x~8%U

D.Ii^3

D.Ii^3

Zf.mM[#2

Zf.mM[#2

Q k.MN!

Q k.MN!

.kS;!

.kS;!

.ODL%6

.ODL%6

.McJb

.McJb

%SV^?2[

%SV^?2[

-c}Z[

-c}Z[

uÞ6}

uÞ6}

A-n}c

A-n}c

c.fOV

c.fOV

1 9z%X

1 9z%X

W.hoZ

W.hoZ

^.HvK;

^.HvK;

Q.ZLT

Q.ZLT

%CYmC

%CYmC

%F>^M

%F>^M

*h.do

*h.do

.qc}L

.qc}L

X$.tZo

X$.tZo

EpHe.qJ

EpHe.qJ

ayA.AkG

ayA.AkG

Ø:y

Ø:y

OwW%f

OwW%f

8/Zy

8/Zy

S.meb

S.meb

W%8x@Gs

W%8x@Gs

%DHQ=

%DHQ=

%CY8W

%CY8W

Y.XlC

Y.XlC

8n%xLIV

8n%xLIV

-^%xMEY

-^%xMEY

(vA.Il

(vA.Il

.bI*,!

.bI*,!

-I

-I

%CQ>~

%CQ>~

R@.PBp

R@.PBp

lc.gu:

lc.gu:

L%xRZ

L%xRZ

sd'dÀ

sd'dÀ

4Nx.DQ

4Nx.DQ

Y.nti}\

Y.nti}\

.Ls"p

.Ls"p

oK^;.Rf

oK^;.Rf

%v%Du

%v%Du

.xm/[

.xm/[

v.Sj

v.Sj

dD%F;%U

dD%F;%U

xpKFTp

xpKFTp

l.coV

l.coV

%SB[x

%SB[x

~t.Se

~t.Se

7.mop

7.mop

].yITV

].yITV

.Ni2K

.Ni2K

%CW`1

%CW`1

e.bi R

e.bi R

|z.plbw"

|z.plbw"

.ofxt*E

.ofxt*E

.nXYM

.nXYM

>%X E

>%X E

.IVQX%

.IVQX%

v.jiFX

v.jiFX

:?.Mx

:?.Mx

Dt.mU

Dt.mU

%f>Gq

%f>Gq

C.hwr&

C.hwr&

q.XX7

q.XX7

TCPT

TCPT

Q.vzc

Q.vzc

.aJM)

.aJM)

.jreF}

.jreF}

.HeN0

.HeN0

%x2'x

%x2'x

t_kEy3~

t_kEy3~

I%D~Q

I%D~Q

hC.Vc`

hC.Vc`

G8u.bU

G8u.bU

@X(.qxl3

@X(.qxl3

o:\WiN

o:\WiN

.Of.Q

.Of.Q

*$%dg

*$%dg

N.omh

N.omh

.rXwx

.rXwx

%dW"Y?

%dW"Y?

.wjCh

.wjCh

nxL/'G.kW

nxL/'G.kW

?.mdj

?.mdj

.uEm#l

.uEm#l

7bN%C

7bN%C

.Yk e

.Yk e

#_-W}

#_-W}

.qX\|

.qX\|

|4".DP

|4".DP

".Zhz

".Zhz

0.bci

0.bci

K$d.DD

K$d.DD

8*\%FS>I

8*\%FS>I

Sd%XF

Sd%XF

.JQTlC

.JQTlC

]%F?rG

]%F?rG

CÐr

CÐr

%u?R/

%u?R/

E.Zhjf

E.Zhjf

1 ]ru

1 ]ru

eT.bU

eT.bU

uUf~.XU

uUf~.XU

.qVM>U

.qVM>U

%7S=a

%7S=a

86.gG

86.gG

xv.j.eq

xv.j.eq

noj-k}W2

noj-k}W2

.SBm9!

.SBm9!

=M$3.aw

=M$3.aw

dTA%sV

dTA%sV

T%cGsC

T%cGsC

%x}6b

%x}6b

-g};?

-g};?

]Hr%c

]Hr%c

.zqTEC

.zqTEC

.U.GH

.U.GH

SUI%X

SUI%X

.icp3

.icp3

.HK$A*

.HK$A*

%u*!}

%u*!}

@%UtO%\

@%UtO%\

B%S=]

B%S=]

.JC2a

.JC2a

tSÓ

tSÓ

UdPt,9

UdPt,9

@-?.dk2

@-?.dk2

O.gMtE

O.gMtE

.Fv02c

.Fv02c

%#$%d$

%#$%d$

}"g>%F

}"g>%F

U`'g%S

U`'g%S

:4.nX=

:4.nX=

,M!%f

,M!%f

04.Vd]

04.Vd]

.fc0iYS-

.fc0iYS-

g.kR

g.kR

%C$x(

%C$x(

V5.Vx

V5.Vx

4.cha

4.cha

.aWQu

.aWQu

7Z',Y.hg

7Z',Y.hg

-

-

sc.sh

sc.sh

l%dj J/Gx

l%dj J/Gx

G@".hi

G@".hi

vK.vS=

vK.vS=

-dEY}

-dEY}

_.dP}g

_.dP}g

.bgRP

.bgRP

%Sg_u$

%Sg_u$

.IZ!~K,

.IZ!~K,

L#Y%f

L#Y%f

(-.qA

(-.qA

v^.zyQ@

v^.zyQ@

%u9]Q[x_F

%u9]Q[x_F

|t.KK

|t.KK

T0.Tu

T0.Tu

C%U0Xr

C%U0Xr

I8fN.GP

I8fN.GP

n.xdi@

n.xdi@

i1%uL

i1%uL

*.Oj8

*.Oj8

Nt5%X^

Nt5%X^

Ðz>

Ðz>

.VuR4

.VuR4

}iCÛS

}iCÛS

)

)

)/.mXY

)/.mXY

vWOx6w1D%CN

vWOx6w1D%CN

.XcA"

.XcA"

!]!??#$-

!]!??#$-

7crtP9

7crtP9

1ÙJ

1ÙJ

u)%XK

u)%XK

.qtY`

.qtY`

1r.Bxg'

1r.Bxg'

.Jqœ

.Jqœ

DXn.CS

DXn.CS

.Nl'F

.Nl'F

Wz.cmF{oW

Wz.cmF{oW

hM%x}/s

hM%x}/s

HN.RU;Y

HN.RU;Y

&

&

H .QV

H .QV

;,U

;,U

CmD[@

CmD[@

.Tf15

.Tf15

.XsD]

.XsD]

5wEUv%u|

5wEUv%u|

owebUb

owebUb

.weSj#Vn

.weSj#Vn

bo"%xeT

bo"%xeT

}g$.ze

}g$.ze

D-qfu})

D-qfu})

.lW&$Z

.lW&$Z

oF.Qq

oF.Qq

.-Rh}

.-Rh}

.MTBQ3

.MTBQ3

,.iO$

,.iO$

PYp%D&

PYp%D&

x.WYE

x.WYE

A{}Rn%XW

A{}Rn%XW

b.mV{

b.mV{

`j~1.RY

`j~1.RY

L.Rop

L.Rop

.ANl[

.ANl[

.co`;

.co`;

M{%x\I

M{%x\I

.Jw&IJ#

.Jw&IJ#

;.CB!

;.CB!

F{#F.qNG

F{#F.qNG

6.hpz

6.hpz

M%cq(

M%cq(

48L.dM

48L.dM

>i3%d@

>i3%d@

.jG@7'

.jG@7'

1O%c"`

1O%c"`

4:.mw

4:.mw

P,.UZt/Z

P,.UZt/Z

*%S@Rv~

*%S@Rv~

6mX.MQ

6mX.MQ

_ds.yT

_ds.yT

XWC%c

XWC%c

oc,-4}

oc,-4}

.ZV*,

.ZV*,

H.JjT

H.JjT

Uv.Owt

Uv.Owt

%1.fjcoI

%1.fjcoI

/%f/gs

/%f/gs

_j%c_g

_j%c_g

j.hrJ

j.hrJ

lp%sX

lp%sX

qkf%sAU

qkf%sAU

%u?B=R%

%u?B=R%

O.JpA

O.JpA

T%C

T%C

d.qd '

d.qd '

cs.mFiQ

cs.mFiQ

6.Dz,F3"

6.Dz,F3"

Dl%X(Nm

Dl%X(Nm

W0.Zzn

W0.Zzn

.In3N[

.In3N[

,`Þ

,`Þ

rH.noY

rH.noY

PX.HP

PX.HP

a.WWm@i

a.WWm@i

$&%.U

$&%.U

%c$?A

%c$?A

L)/%sZk-

L)/%sZk-

i`.qK

i`.qK

J.vF9p

J.vF9p

.He5?X

.He5?X

/H.XAj

/H.XAj

`T..Ji

`T..Ji

%xU?"qY

%xU?"qY

%UWt#

%UWt#

]=.cD{

]=.cD{

p~%fP~

p~%fP~

.BfMv

.BfMv

3 .XJw*-

3 .XJw*-

.YV|)

.YV|)

Ff<.tbm8>

Ff<.tbm8>

rA.se

rA.se

;%S,

;%S,

=/sS^

=/sS^

)%F Ja

)%F Ja

7)K%x:

7)K%x:

'C.Bk

'C.Bk

-q.vN

-q.vN

xkZ%C

xkZ%C

.Lr\)

.Lr\)

p, SSh

p, SSh

Z:ZZ%F

Z:ZZ%F

e*.dT

e*.dT

%s]0>

%s]0>

q"xq%S

q"xq%S

".aC/

".aC/

..sA{

..sA{

.ZTC[:K

.ZTC[:K

u2f3f%F

u2f3f%F

VKK;%U

VKK;%U

a%U(Dv

a%U(Dv

4.aTy

4.aTy

N.RTY|

N.RTY|

{A;%S

{A;%S

Z.DCsc

Z.DCsc

D r.kyU

D r.kyU

-a%0S

-a%0S

uDPA

uDPA

.BL45z

.BL45z

\.G.qB

\.G.qB

W.qc,I

W.qc,I

.yY{Y}

.yY{Y}

0;.BT

0;.BT

-u.Br

-u.Br

f.SNz

f.SNz

P!K%Dh

P!K%Dh

X|.PI`k

X|.PI`k

.jnqN7

.jnqN7

.QX)KTJ}t8

.QX)KTJ}t8

ù$;

ù$;

B%uK'B

B%uK'B

.nZk"

.nZk"

ta.vk

ta.vk

W.oaL

W.oaL

Mm.Gq

Mm.Gq

!;%D#

!;%D#

.sY= /@

.sY= /@

j6.REQ

j6.REQ

%Dsr#|4

%Dsr#|4

.Ga`z

.Ga`z

2@%Xqj

2@%Xqj

j.JmX

j.JmX

v-G.OO{J

v-G.OO{J

L5.ZM

L5.ZM

]'Er%D\QA

]'Er%D\QA

;.RsmIKM

;.RsmIKM

3:f.DG

3:f.DG

]@*%d

]@*%d

A>.Bk

A>.Bk

Ra\G8&%cr

Ra\G8&%cr

}.wLe

}.wLe

Ytdyn%d

Ytdyn%d

'z%s

'z%s

.QV{Q

.QV{Q

{}Pf%F

{}Pf%F

%D~L%

%D~L%

L.ba"~

L.ba"~

dP.He

dP.He

7cV%SI

7cV%SI

)8.WC

)8.WC

A.zk'

A.zk'

.up

.up

.Hl3GA

.Hl3GA

.Bbn](jLvZ

.Bbn](jLvZ

>>.aJ

>>.aJ

VÖl

VÖl

b5O8

b5O8

V.Vj!

V.Vj!

.wy

.wy

u.zoF

u.zoF

%S}Z2

%S}Z2

)=.yey

)=.yey

%CVSul

%CVSul

t.JY'

t.JY'

ßZr

ßZr

.sxtY

.sxtY

P?%sI =

P?%sI =

H.Ho;

H.Ho;

2>s@.ui

2>s@.ui

.oA9Z

.oA9Z

oLL\%X

oLL\%X

%4s{

%4s{

0 Ö

0 Ö

N(NG%D

N(NG%D

y.VG;$6'

y.VG;$6'

:s{(.MmZg

:s{(.MmZg

-bY9}

-bY9}

{%suG

{%suG

1Zb.ai

1Zb.ai

,,.tz

,,.tz

.eigO

.eigO

$B%sH

$B%sH

.JdHw

.JdHw

x%F_O

x%F_O

;QX.DKf

;QX.DKf

EO~D.phAR

EO~D.phAR

.Mx-c3

.Mx-c3

h.eSU

h.eSU

H{.ox

H{.ox

5F.AU

5F.AU

Z=5%XM

Z=5%XM

x.fy/f

x.fy/f

%PP.Wh8

%PP.Wh8

k%;.eX

k%;.eX

g.SIV

g.SIV

H.UtZ

H.UtZ

}h*%X

}h*%X

.YqPj

.YqPj

.Drc!

.Drc!

IO.Ud

IO.Ud

W%S:G

W%S:G

c*.cX

c*.cX

dhUDPxz

dhUDPxz

l}n.ku1wZ

l}n.ku1wZ

?=.DF>Ev

?=.DF>Ev

#.Ds2*~

#.Ds2*~

dq>%x

dq>%x

.Uz65

.Uz65

g.XVu}

g.XVu}

FW d,%.f

FW d,%.f

53r%d

53r%d

Q?c.xCF

Q?c.xCF

i%S7

i%S7

-QT}\U

-QT}\U

Hrp.JO

Hrp.JO

d.nIz

d.nIz

TCp&f

TCp&f

j%1uj7/

j%1uj7/

U.MLL

U.MLL

%d&]#

%d&]#

TQb%S[

TQb%S[

.AMtf

.AMtf

I.Di_D

I.Di_D

>e.Ub

>e.Ub

>3.iN

>3.iN

%6U|^

%6U|^

y[v%C

y[v%C

$.jIRp5p

$.jIRp5p

aeJ7"74.DZLh

aeJ7"74.DZLh

.yrh[z

.yrh[z

>.xt]]

>.xt]]

E%x=u

E%x=u

h.pK%

h.pK%

.ro

.ro

S/.vr

S/.vr

Xt.ai

Xt.ai

%F&z(

%F&z(

.gZZLd

.gZZLd

q.QY{e

q.QY{e

(.WS}

(.WS}

E(RG.vt

E(RG.vt

cRtgj

cRtgj

9_^keY

9_^keY

m8.dH

m8.dH

.ha3w

.ha3w

KE.kp

KE.kp

.CYX%

.CYX%

Fo(ø

Fo(ø

{:.Yf^

{:.Yf^

l9.gc{

l9.gc{

X=)l%x

X=)l%x

/x.Ls

/x.Ls

/.

/.

L?%C,[5

L?%C,[5

$.Zr}*w

$.Zr}*w

qp.BNO

qp.BNO

%Uvzj

%Uvzj

r.bdH=

r.bdH=

RH.jz$n

RH.jz$n

:?.KF

:?.KF

w^.qT

w^.qT

o.MN0*

o.MN0*

.okGC

.okGC

iM.YJ|

iM.YJ|

`.MJV

`.MJV

.VK"^

.VK"^

K,,

K,,

.KTYj

.KTYj

ni%2U=

ni%2U=

N~?%u

N~?%u

0R.mD

0R.mD

.uszq

.uszq

%D=7V

%D=7V

.CCFv

.CCFv

.fCgA

.fCgA

%FT_f#

%FT_f#

.kB.P

.kB.P

.BZ$8

.BZ$8

=.Dh%

=.Dh%

"gx%S

"gx%S

g.KNN

g.KNN

E.fF`

E.fF`

d.dTX9

d.dTX9

;.be_i

;.be_i

Ox.nG

Ox.nG

-9.XG

-9.XG

QZV.uA

QZV.uA

.eHU!

.eHU!

.Xr?BkZ

.Xr?BkZ

zwa.Ak

zwa.Ak

.TT2*I

.TT2*I

kE^3^a%C

kE^3^a%C

.SF:Q

.SF:Q

.|%Cnnv

.|%Cnnv

9@B%S

9@B%S

O=V.YpK

O=V.YpK

W@%Xh

W@%Xh

%s/y_\_

%s/y_\_

I.lncJZ

I.lncJZ

L.dN0L

L.dN0L

}..pI

}..pI

8v%dj

8v%dj

!.bj;}4460

!.bj;}4460

~%%xf

~%%xf

b1y.lE}LE

b1y.lE}LE

.Mg*xQm{4

.Mg*xQm{4

MT.CA(v?

MT.CA(v?

~.AD#

~.AD#

%s~0f

%s~0f

O.ZX

O.ZX

.Me?JRL

.Me?JRL

h`.ED

h`.ED

Ohm.UY

Ohm.UY

.MDa_

.MDa_

VOI%s

VOI%s

DQ.cx;

DQ.cx;

.un=V

.un=V

18.ou

18.ou

..gR8

..gR8

sU.yK

sU.yK

Q]V-9}

Q]V-9}

V.dw\;x

V.dw\;x

yPz%Xd

yPz%Xd

M .XL

M .XL

U4CKE]R%S

U4CKE]R%S

%.Ê

%.Ê

úR*

úR*

;.oV:

;.oV:

Cet%X

Cet%X

.XX;1

.XX;1

(G.qBsD

(G.qBsD

.SF/%u

.SF/%u

V`.XY

V`.XY

`.BHKF

`.BHKF

i%u i2

i%u i2

ZSQl

ZSQl

.NC]C

.NC]C

%fI5k)

%fI5k)

U :B7%F#

U :B7%F#

"%xEz]

"%xEz]

c%F[3(J

c%F[3(J

wR.rH7y

wR.rH7y

nY%UL

nY%UL

V_%UUd

V_%UUd

.QBx4

.QBx4

R.VV ;

R.VV ;

h.Tp$

h.Tp$

E%xW41

E%xW41

|\"%u

|\"%u

.zJ4

.zJ4

4A

4A

2.rbl

2.rbl

E;;.oW

E;;.oW

jtC9i%U

jtC9i%U

F&Dt%c

F&Dt%c

b2j?.bF

b2j?.bF

N%X(H

N%X(H

.PMe3

.PMe3

.AsVd

.AsVd

Lf.QV

Lf.QV

F*.RU

F*.RU

%DMSt

%DMSt

m.OR"

m.OR"

Urli

Urli

euVF

euVF

a.jdZ

a.jdZ

.Eh7wfs-

.Eh7wfs-

> nZ.mp#=

> nZ.mp#=

$y=;%D

$y=;%D

l%sv,

l%sv,

Y:\CI

Y:\CI

{.LM)&

{.LM)&

U;d?%u

U;d?%u

k.IO"

k.IO"

b[j.Wo(

b[j.Wo(

v .lJ

v .lJ

..bx*

..bx*

xw.FAk

xw.FAk

^%d%I

^%d%I

C!.Sa

C!.Sa

B.CaL

B.CaL

.XR1M

.XR1M

7w.sSXr)

7w.sSXr)

z%DyR*[C

z%DyR*[C

!%s?B

!%s?B

9.sV]

9.sV]

%uTP7w

%uTP7w

{.yFcx

{.yFcx

.vFl3

.vFl3

.CP;/

.CP;/

%dw.J!

%dw.J!

R%u",

R%u",

q.IB:

q.IB:

(.Qm0

(.Qm0

78.eS,

78.eS,

#.%fY

#.%fY

.wVu^

.wVu^

j].bE

j].bE

L3Ï

L3Ï

.ZA~Fb

.ZA~Fb

C%FSE

C%FSE

.etJ{UT

.etJ{UT

.Eox!yW

.Eox!yW

%d!w^

%d!w^

Rn.Zw

Rn.Zw

%sP~z

%sP~z

ÞG/s$

ÞG/s$

t%FL

t%FL

-.anx'

-.anx'

Ï#O

Ï#O

j%u=Z

j%u=Z

xU%0S

xU%0S

%Xtu-

%Xtu-

sln%CX

sln%CX

L-q}N

L-q}N

.CqQVi

.CqQVi

E%c#&A

E%c#&A

K.GM)

K.GM)

UtD%s

UtD%s

EA.aJ

EA.aJ

T.qt;

T.qt;

5;.hLD

5;.hLD

p!KEY

p!KEY

Tfa.pn

Tfa.pn

S%uzj

S%uzj

b.cb`

b.cb`

@' 3$p

@' 3$p

-o}T-v

-o}T-v

yE.IR

yE.IR

qt.QE

qt.QE

Zl`#|%U

Zl`#|%U

_Q.pz

_Q.pz

-b}F.T

-b}F.T

%UgXx

%UgXx

.xKfE

.xKfE

=.UGp^

=.UGp^

I{.gF

I{.gF

tFg%d

tFg%d

*C%ChULQ

*C%ChULQ

8 .Tq

8 .Tq

.Cw%w

.Cw%w

Oø4

Oø4

`El%x

`El%x

f.QnHk

f.QnHk

i %X_

i %X_

Z.bs.I

Z.bs.I

9.Zha

9.Zha

.cK

.cK

@*.pG

@*.pG

.apln

.apln

.bE?C

.bE?C

>.fOt/

>.fOt/

84B%X-

84B%X-

U.tk(Pc

U.tk(Pc

a..VLp

a..VLp

go`%x

go`%x

bC.aK

bC.aK

vMA%d

vMA%d

&OÅ’}

&OÅ’}

C0.nO

C0.nO

.ACvt

.ACvt

BWEbF

BWEbF

.Lcsi

.Lcsi

%SQ!~c

%SQ!~c

>.Fm-

>.Fm-

.Bhuu

.Bhuu

2c\e.Xg{rx

2c\e.Xg{rx

&0^$%DrkA

&0^$%DrkA

ÃŽf-@

ÃŽf-@

.Ak~!

.Ak~!

JPY.Tp

JPY.Tp

%0.lDy*w

%0.lDy*w

rMsG`

rMsG`

_{%4x

_{%4x

m{8t1.nKW

m{8t1.nKW

0,Y%F

0,Y%F

GP-A}d

GP-A}d

.LN08

.LN08

g]~d%S

g]~d%S

4e%uR

4e%uR

K%cs3

K%cs3

/4).Tt

/4).Tt

j.aKx

j.aKx

?vp.Io|

?vp.Io|

ti.pZ

ti.pZ

.jK6JV

.jK6JV

yÍf

yÍf

.jx*Vl

.jx*Vl

?L%se

?L%se

`.Ljz

`.Ljz

.PqHe

.PqHe

%x.BF

%x.BF

H.SEZc

H.SEZc

\.stU(

\.stU(

-7}Sj

-7}Sj

@wM;%f>

@wM;%f>

2t.uj

2t.uj

6\%St

6\%St

T_8.nO:

T_8.nO:

h%fRd

h%fRd

0-.Nva{

0-.Nva{

K<.kv>

K<.kv>

r.cl|6

r.cl|6

%8Z%DU

%8Z%DU

x.pF_

x.pF_

*\j.bn

*\j.bn

3H%ul

3H%ul

.WS"0-

.WS"0-

#Sj%S

#Sj%S

(tu%c

(tu%c

~}.%dy

~}.%dy

.QbV-

.QbV-

Ì\&a

Ì\&a

4s üH

4s üH

iv%%s&;Aw

iv%%s&;Aw

].sDi

].sDi

u%xFo

u%xFo

Y`y]Ã…l

Y`y]Ã…l

*=.ZO

*=.ZO

%C=`w4

%C=`w4

.My?}

.My?}

!%s0Y_

!%s0Y_

2u.xHcU

2u.xHcU

.CowG

.CowG

..gPu

..gPu

R>A%dH

R>A%dH

&X.yW

&X.yW

.GLVK

.GLVK

%DkrB

%DkrB

k.mK}f

k.mK}f

.LK?t>

.LK?t>

%duBK

%duBK

.vQmK

.vQmK

>.SxF

>.SxF

-x6}!D

-x6}!D

3LCA7Na

3LCA7Na

.nagn

.nagn

ek.LQ

ek.LQ

]{.zn

]{.zn

.Dbf%

.Dbf%

%XqYlP

%XqYlP

y)a%!]%u

y)a%!]%u

Z%$'.ZF

Z%$'.ZF

3j_&a@A}.Cm

3j_&a@A}.Cm

.PH(a

.PH(a

b.wRa

b.wRa

3-;).tO

3-;).tO

k|pAT%c

k|pAT%c

!m.yv

!m.yv

5%R%U

5%R%U

z.MwR)A

z.MwR)A

78G%s

78G%s

_U

_U

MZurl

MZurl

NP%uZ

NP%uZ

$fT.sr

$fT.sr

~^.BoJ,

~^.BoJ,

6f.kZ

6f.kZ

-cq}l}

-cq}l}

.N%F`,N

.N%F`,N

%dnJq

%dnJq

%Xf"GS

%Xf"GS

?7.zH

?7.zH

-x@%d

-x@%d

$Y%9XT

$Y%9XT

\K`%x

\K`%x

.po=$

.po=$

.dbho2H"

.dbho2H"

oCd%s

oCd%s

l:7t.Afq

l:7t.Afq

gW.WC$$5

gW.WC$$5

.aM8-

.aM8-

9uRl

9uRl

\.LojD

\.LojD

%.Hsi

%.Hsi

.hm~~I

.hm~~I

.aKkC

.aKkC

"?%sAP

"?%sAP

h*.UV

h*.UV

9sW%X_

9sW%X_

IEKV.bl

IEKV.bl

$.XSgC

$.XSgC

"(_.rZ

"(_.rZ

V.Obm-

V.Obm-

.uYm_

.uYm_

Y_.cn

Y_.cn

}M.tj

}M.tj

Yag%SA]N

Yag%SA]N

cy.Zl u

cy.Zl u

.mf"D

.mf"D

.RyfW

.RyfW

7#[;$ 5$

7#[;$ 5$

.SyaNTm

.SyaNTm

@%.Mt

@%.Mt

&w.XY&

&w.XY&

?o44.Gu

?o44.Gu

N.dux

N.dux

.qH&c

.qH&c

9c9%s

9c9%s

aFL%s

aFL%s

>%1xK

>%1xK

=%9X6

=%9X6

)NV.vio

)NV.vio

v0f<.gi>

v0f<.gi>

t-?|;CC .cH3m

t-?|;CC .cH3m

.Ce?A

.Ce?A

^T%C=

^T%C=

QK

QK

YY%xPw[S

YY%xPw[S

Alw.BV$k

Alw.BV$k

k?AR.Jy

k?AR.Jy

.IQEC}

.IQEC}

%fh`qa

%fh`qa

.gBig

.gBig

HLÿo$

HLÿo$

7Y%dIA;|

7Y%dIA;|

?9.GKg4

?9.GKg4

`p%fH

`p%fH

.:.Ly

.:.Ly

5%9sV

5%9sV

.Bg-3

.Bg-3

.gil/Q

.gil/Q

%U""2

%U""2

'\.jP

'\.jP

g!h.Lu}

g!h.Lu}

| |.hT

| |.hT

"A%DQ6

"A%DQ6

CrTf3

CrTf3

D.aZz

D.aZz

9N.FY

9N.FY

SSn.VNDP

SSn.VNDP

ÃœWi

ÃœWi

;I9%xe

;I9%xe

e~G.DE:t

e~G.DE:t

^T0%c

^T0%c

(r.VN

(r.VN

`"Z.cx

`"Z.cx

.XJ-dv>

.XJ-dv>

%U :?

%U :?

0J%S8J

0J%S8J

V%U,lu

V%U,lu

J.hKpc5

J.hKpc5

Cf .xgR

Cf .xgR

%U9-w

%U9-w

'.3^'/=?_/

'.3^'/=?_/

)$3;g%u

)$3;g%u

.iN7z

.iN7z

ov>.EI_

ov>.EI_

tv.NJ

tv.NJ

^.Vt'

^.Vt'

'/%u#

'/%u#

!.Spa

!.Spa

%f

%f

.efiJ!

.efiJ!

[.Mx.

[.Mx.

.RURK

.RURK

/%W.pV

/%W.pV

d%4uo

d%4uo

.YQ(q

.YQ(q

.CBrD

.CBrD

~|{Msg

~|{Msg

0./a5*.Yw(Z

0./a5*.Yw(Z

/S.ZMU9

/S.ZMU9

XF.MR

XF.MR

01.BA

01.BA

%xa1$

%xa1$

@.LX

@.LX

S3,.ZO

S3,.ZO

T.LQh

T.LQh

%Sp#'

%Sp#'

-hieQ}

-hieQ}

DR%f$%D

DR%f$%D

iA9-zEg}

iA9-zEg}

ÖqlrV3

ÖqlrV3

GQ%Uf3C

GQ%Uf3C

uÏi

uÏi

C4.aa

C4.aa

d.Au{

d.Au{

%XRR{

%XRR{

7rn%SA

7rn%SA

p.QStP

p.QStP

-uM}{

-uM}{

.ojKe

.ojKe

p.tM7

p.tM7

7?F.Cg

7?F.Cg

Ï>,

Ï>,

3F%X%

3F%X%

%3\.BI$

%3\.BI$

JurL)

JurL)

9.VN-

9.VN-

q%S/d0H

q%S/d0H

D-.dJ

D-.dJ

W.Ec>P

W.Ec>P

.zS\]

.zS\]

i>WCRt

i>WCRt

Fg%Sj

Fg%Sj

Qu.KUXxm

Qu.KUXxm

hs.hcA

hs.hcA

%sg

%sg

A%Fl|

A%Fl|

k.RWT

k.RWT

,TÌ%

,TÌ%

.NYyr

.NYyr

P\.gP

P\.gP

"d.XfyN

"d.XfyN

S.sgx`

S.sgx`

Q&AB%s

Q&AB%s

.lgHK

.lgHK

X.nbo

X.nbo

TR %ue

TR %ue

9.GLj

9.GLj

6G%xF

6G%xF

.UsA_7

.UsA_7

~.lL;:

~.lL;:

x.BHZx

x.BHZx

\L.cz

\L.cz

M4.cro.5

M4.cro.5

,&c.kW

,&c.kW

S.rUa}

S.rUa}

sQLFw|

sQLFw|

M.FY[

M.FY[

cR#.Ua

cR#.Ua

2:%U(

2:%U(

]m .HW4

]m .HW4

(E.te

(E.te

%udZ\

%udZ\

v.bQgN

v.bQgN

.sVa1

.sVa1

.AhVK

.AhVK

:.RPbY

:.RPbY

#&_%f

#&_%f

.wyi8

.wyi8

~bB3.Fd

~bB3.Fd

R.LxP

R.LxP

.IR-U'

.IR-U'

lY`%U

lY`%U

a.FA =

a.FA =

Ml.tNL t

Ml.tNL t

.qOGP

.qOGP

ò9_1

ò9_1

{%x;O

{%x;O

.MX/

.MX/

jx/%x

jx/%x

[Wu.Iu

[Wu.Iu

'u.mA

'u.mA

l.Hs':71

l.Hs':71

%S*Y'

%S*Y'

.dI^A

.dI^A

.gBL

.gBL

x.DMb

x.DMb

3x.RJ

3x.RJ

.JrwS

.JrwS

%fZO)L

%fZO)L

_.DXu

_.DXu

.bgv:

.bgv:

.xTv7

.xTv7

^O"%S

^O"%S

.JC7mL

.JC7mL

l%DIQ

l%DIQ

.Tu-'y

.Tu-'y

_X-9}EF-

_X-9}EF-

.vE/x

.vE/x

9.Hl/x

9.Hl/x

V^LÓ

V^LÓ

.sI-(

.sI-(

f$l%u

f$l%u

T1.ua

T1.ua

-u}MD[&

-u}MD[&

%xixX/Hp

%xixX/Hp

{^%DH

{^%DH

J8%sE

J8%sE

4^Z!%X

4^Z!%X

%st9Xr[

%st9Xr[

%DT21

%DT21

IW.OX

IW.OX

l

l

99L%X}

99L%X}

zL\.CZ.

zL\.CZ.

,!Pn%S

,!Pn%S

IlÞ

IlÞ

.MG

.MG

5zK%D$n

5zK%D$n

%s>nhK

%s>nhK

b&$t%xa

b&$t%xa

Sh%U7,]#

Sh%U7,]#

z.nr1}

z.nr1}

.MW]N

.MW]N

.kG8kh

.kG8kh

'Y.Uk

'Y.Uk

.MJ^w

.MJ^w

d%dz>P

d%dz>P

n4!%s

n4!%s

9.sV)H

9.sV)H

.WUtF

.WUtF

%xQV,

%xQV,

s_\8%d_

s_\8%d_

Z.GU{d

Z.GU{d

%fuFi

%fuFi

iw.wOCg

iw.wOCg

b%2xS

b%2xS

<.hn>

<.hn>

N*uN%c

N*uN%c

,%.qb8:

,%.qb8:

p.sN$O

p.sN$O

t^.AD

t^.AD

RL%CK

RL%CK

.eh*^

.eh*^

.pHu5

.pHu5

.rfn'{

.rfn'{

`#.Cib;

`#.Cib;

.idq?

.idq?

%XoE?

%XoE?

rY.Cw

rY.Cw

.Ty)

.Ty)

.e%skh

.e%skh

.IzMA-

.IzMA-

}.%X4

}.%X4

%xa:&

%xa:&

=Ul.uUA

=Ul.uUA

ZF_/]

ZF_/]

g'ch2%F"

g'ch2%F"

yU'.Fi

yU'.Fi

.zGviY:

.zGviY:

.OW_ DU

.OW_ DU

hmi%SC

hmi%SC

j0{%s

j0{%s

%Xllo]

%Xllo]

RVW%6x

RVW%6x

m%z%S

m%z%S

xj;%U1

xj;%U1

s.Bsc

s.Bsc

tcpXXY

tcpXXY

z3.QJ

z3.QJ

;r.Mw

;r.Mw

.JH

.JH

C%S(N

C%S(N

%uWz^

%uWz^

?.Qaf

?.Qaf

e.CCd07G6

e.CCd07G6

/p.BY

/p.BY

v{y%f

v{y%f

.VA 9W

.VA 9W

b.hBe

b.hBe

w%XpS

w%XpS

$!Ë

$!Ë

Csu/

Csu/

pwF\.ot

pwF\.ot

_%x|p2

_%x|p2

%dMei

%dMei

6tZ9)%f

6tZ9)%f

-5p}B

-5p}B

;7.Yh

;7.Yh

*bT.XT

*bT.XT

.XdRf

.XdRf

%u4?!

%u4?!

Qn.agA

Qn.agA

-%c;(

-%c;(

%fG]U;

%fG]U;

.iU.%

.iU.%

8II%x

8II%x

S!^;.Juq

S!^;.Juq

.FM,{IlZ

.FM,{IlZ

-SVAH}

-SVAH}

0m%s|F

0m%s|F

);.<.hk>

);.<.hk>

>l8.Mp

>l8.Mp

-XfqE}

-XfqE}

Ho.VHn

Ho.VHn

E%4S{T

E%4S{T

.CD.8r

.CD.8r

479%Dt

479%Dt

.ER^'O

.ER^'O

Vn.DJg

Vn.DJg

.ls4

.ls4

A.fNU

A.fNU

.dLJ@d

.dLJ@d

FHf2o%x

FHf2o%x

g?4%d

g?4%d

O.VIOa

O.VIOa

þ'

þ'

HR-P0G}7U

HR-P0G}7U

.DAun3K

.DAun3K

(.le.

(.le.

m;%s=

m;%s=

.LwTv

.LwTv

w%s|>

w%s|>

.AsOHanG

.AsOHanG

H5õ

H5õ

c8Qb.Vr

c8Qb.Vr

Nh%Xb

Nh%Xb

].JGx?

].JGx?

:a.jm

:a.jm

pg.zh

pg.zh

O0.Ab

O0.Ab

r.js4

r.js4

lh.sD

lh.sD

\%D>0

\%D>0

.eiB#$

.eiB#$

0f.QwU

0f.QwU

W(.HE

W(.HE

45%uj

45%uj

m%F)p

m%F)p

cuRl

cuRl

p-EF}N4(

p-EF}N4(

..vB wn3

..vB wn3

1-Y}]d

1-Y}]d

FJ.Iu

FJ.Iu

[%.s1!

[%.s1!

^$M.RJ

^$M.RJ

xe6%c=

xe6%c=

%DSrQf

%DSrQf

1%0uw

1%0uw

.Wp%P

.Wp%P

.Eh

.Eh

"~.Ik!

"~.Ik!

Yx.bN

Yx.bN

ax.Nx

ax.Nx

C:.cl

C:.cl

W_f.XH

W_f.XH

Q!^a9%s

Q!^a9%s

V.AG(

V.AG(

].mwB

].mwB

hN%s5

hN%s5

&Ii.qv

&Ii.qv

R.guHB

R.guHB

(?.Sta

(?.Sta

S:\vGj

S:\vGj

].npW@

].npW@

!l.mk

!l.mk

}%SA&le

}%SA&le

$yh-n}u

$yh-n}u

D#%FU

D#%FU

q.Db;

q.Db;

.IuBnu`

.IuBnu`

(-Jw},

(-Jw},

5U%uP

5U%uP

.mu\.

.mu\.

C%CWB

C%CWB

L%c]7

L%c]7

.LLX('2

.LLX('2

CB_;%c

CB_;%c

m.ehK*=

m.ehK*=

V.liu

V.liu

bE%x;

bE%x;

@.iPL

@.iPL

R.QE*_

R.QE*_

:;.Eb

:;.Eb

5.Dpthb

5.Dpthb

b6.jgoT

b6.jgoT

w%u7 g_

w%u7 g_

.ja

.ja

).utp

).utp

4##.kM

4##.kM

Ag%uu

Ag%uu

2.NTC

2.NTC

s1.yv[i

s1.yv[i

)6.TmJ

)6.TmJ

%.cN(

%.cN(

4g%X3[*

4g%X3[*

dD.xG

dD.xG

.JDh}

.JDh}

.gqSZ

.gqSZ

9"F.Of

9"F.Of

U.Won

U.Won

rR.bs

rR.bs

%k.EdO

%k.EdO

b%6Y%cz

b%6Y%cz

hi3.Qln

hi3.Qln

V.BZ&?c

V.BZ&?c

/.osT

/.osT

%s' aL

%s' aL

oa*%Dpi

oa*%Dpi

-7}}mQO

-7}}mQO

E:\}q

E:\}q

% ($4?`{

% ($4?`{

.SWT0

.SWT0

.Qv&=

.Qv&=

.IupP

.IupP

g%f*h7

g%f*h7

X.Xa;x

X.Xa;x

*Y%sC

*Y%sC

(.ZN(3

(.ZN(3

J.VKR

J.VKR

G.bS1H

G.bS1H

.]r6.Ssx66

.]r6.Ssx66

x1.CK

x1.CK

ZY.bY@

ZY.bY@

y.aq*

y.aq*

B7%DH

B7%DH

'.ZfR

'.ZfR

pmK

pmK

f^.Zn

f^.Zn

xEr%D

xEr%D

sHe.Bc

sHe.Bc

|9%c

|9%c

Gf%U1

Gf%U1

%u92`

%u92`

G.vr!

G.vr!

.GYF5h0

.GYF5h0

z.zz!3v

z.zz!3v

.Jh'_

.Jh'_

.Zsg,}&;0

.Zsg,}&;0

?<.77>

?<.77>

V.fXF

V.fXF

6H.ygp

6H.ygp

-.LDx

-.LDx

MEz%X`9a),0

MEz%X`9a),0

'qU%x

'qU%x

t.Ib9

t.Ib9

_.XFR

_.XFR

.zb43

.zb43

wu/10@%F

wu/10@%F

E.qT|

E.qT|

k.oIG '

k.oIG '

%dSV1'

%dSV1'

.mH)zt

.mH)zt

ScMdR

ScMdR

N#.CE

N#.CE

f0V.Vp

f0V.Vp

%Ckf7m

%Ckf7m

.miv^z

.miv^z

-.lWv

-.lWv

N.blw|

N.blw|

_y7L8B%u

_y7L8B%u

3:5.GJ

3:5.GJ

.Iccaa

.Iccaa

'.mT1

'.mT1

g.JD4

g.JD4

hm.GaQl`

hm.GaQl`

=~.Ys

=~.Ys

gm.pg\

gm.pg\

.&oö

.&oö

].DD'

].DD'

@%cpdU38h

@%cpdU38h

N&q%u

N&q%u

-(.%D

-(.%D

.B.GH

.B.GH

G.tZa

G.tZa

Lbf%U

Lbf%U

.Qb>@

.Qb>@

tmb%u

tmb%u

e},

e},

.HLu~@g

.HLu~@g

Pi.sT9

Pi.sT9

cN%Ct

cN%Ct

C;%ss

C;%ss

yf.Er#g

yf.Er#g

-zDE}

-zDE}

.fFm7

.fFm7

q.Ox9

q.Ox9

2%SUh

2%SUh

ea%f[*

ea%f[*

.oc~Q

.oc~Q

L=kP.OP

L=kP.OP

exl.nJ

exl.nJ

)]C.fN

)]C.fN

N.eg6

N.eg6

.ijF{

.ijF{

%Ds j

%Ds j

%X]'o

%X]'o

.wHV;

.wHV;

{mv.xw

{mv.xw

$~.iO

$~.iO

K.fSRD

K.fSRD

{eV.GK)

{eV.GK)

r/.xh

r/.xh

w.pK29

w.pK29

..AoS,

..AoS,

3B.xv

3B.xv

lkt&.vB

lkt&.vB

b%fNzH

b%fNzH

/-M}

/-M}

J\sR16SV:%U

J\sR16SV:%U

.tkbI

.tkbI

B?.sK

B?.sK

d4%SR_

d4%SR_

CWY.QV

CWY.QV

D.GPX

D.GPX

.aUVu'

.aUVu'

B^?.YlQOn(

B^?.YlQOn(

X,).yN

X,).yN

Y61tCPI

Y61tCPI

_.cvbt

_.cvbt

Wpf%dr

Wpf%dr

Kk-M}]g

Kk-M}]g

h%4S$^

h%4S$^

7J.RJf

7J.RJf

Ir.Po

Ir.Po

;.BbP

;.BbP

.Xmnw S!

.Xmnw S!

t%CZC

t%CZC

5.POe(

5.POe(

tmÛ

tmÛ

.jF^d

.jF^d

$y.IE

$y.IE

Df.og

Df.og

%D%{2

%D%{2

@~*[%D

@~*[%D

.rH78

.rH78

a1.Pc

a1.Pc

Ät6h

Ät6h

>4.ac

>4.ac

u[.iPs

u[.iPs

Dq.ro

Dq.ro

@/]%F$f&

@/]%F$f&

vd:%D

vd:%D

se.TY

se.TY

A.bb]

A.bb]

A_T-N8}{J

A_T-N8}{J

?\\~&?(8

?\\~&?(8

o{sl

o{sl

A.Zki

A.Zki

bX.Dd

bX.Dd

.rHv>

.rHv>

.lL?%

.lL?%

>U0%SJ

>U0%SJ

.Sx@J

.Sx@J

m<.kfqwf>

m<.kfqwf>

}@.tR

}@.tR

.QSq.lO

.QSq.lO

H.al_

H.al_

q|-a}

q|-a}

t.Tij

t.Tij

h.OA>Ka_

h.OA>Ka_

& y%d

& y%d

;'.NM

;'.NM

.BB}82u

.BB}82u

`=.ge

`=.ge

/Z.JK

/Z.JK

t1.Rb

t1.Rb

%x4\E

%x4\E

m.QqI

m.QqI

C&N%U

C&N%U

DhJHwYa.Pj

DhJHwYa.Pj

.oD&B"

.oD&B"

K@l.WXRZR

K@l.WXRZR

-9}*K

-9}*K

vY.fjx

vY.fjx

|þ5

|þ5

Xds.frF

Xds.frF

#`s.CvG

#`s.CvG

!BZg.nP

!BZg.nP

!<.hhydj>

!<.hhydj>

cU.Mu

cU.Mu

%S?x 8

%S?x 8

.pMjl0F

.pMjl0F

%XF&u

%XF&u

.EE6 `

.EE6 `

%UsSik

%UsSik

1rJ@T.bSP

1rJ@T.bSP

!.Yx F

!.Yx F

2%d~X

2%d~X

9%%uZ

9%%uZ

òl}

òl}

b~fI%u$

b~fI%u$

.thUn

.thUn

5a.LcZ4

5a.LcZ4

.Ls9m

.Ls9m

WkFtp

WkFtp

fÀ2~

fÀ2~

.BL]

.BL]

10x%2U

10x%2U

0UrL)

0UrL)

=.Rx,6

=.Rx,6

-.WW4,

-.WW4,

.ECs3wBou

.ECs3wBou

8%DM)-

8%DM)-

%cW&ZD{

%cW&ZD{

.KGp-

.KGp-

R"P.aR

R"P.aR

3.uPK

3.uPK

~O%U}

~O%U}

.zzK)L:GZ

.zzK)L:GZ

0o5JG

0o5JG

d.Js%]IW

d.Js%]IW

3BK%f

3BK%f

%C;0oeG

%C;0oeG

v>%c

v>%c

PmC

.qa%5
.dR3t>
S.IdS
/F%c$
?OU4M#.iO X
wjS%X
3b.RH
.FbEMf
Wwr]%F
#d.oQ
%DnJO
0O.ai
~.ICoZ
_o.px
K=-b}k
0%U%lfR15
v.qiC
Y.vy7
%2Uki
p.wVm
".cD9
 /.TJ
5Dj.by}
V.fK'
Ã’3z^
gS.Nb
~J!.wZ
hW{%xIl
[D.yH
~@Ý;y
Y.Ux#5d
r|.OT
"%1s[
%UJaH
d.Tvv9
.BkYJ
.Qp2N1qq
s.kv\
%Sz B~
.eD3I
.kt)0%6]
 s.vMy
Z:\! ~
ew.Vp
.Wd(g
%sa3>c
v%Uwc
.xP-A
s].jL
Y%sU`
7fòa 2r
_.Fw%
%X-Qdh
-3}q*
hY'%CmTb
W@.zz
_1*rmg%dRA
Fr@t;.nJA
@G.os
Y..Ps
#(%D|
(/.me`^pL
BtF%XJ
sIy.OO
.Cjm]
q%.PJrb
x@.wk 
.ZGei
,.vGDv
.ofaT
0w.Zr
(~4(%7uj
.ImNKD
XG.pZW*,
:#TcP
u.yZV
z.Gl/
%Slw&
x.ZwW
MhJx%d
.YW*XV
1z-A}N
7.tvUP
Nc%c@
T.GYV:
%9%.f*`
.Fa?h
GyH.Kxq
.iGB/
'pr%U
?.rO:VG
fRN.Ky
7.XiS
tx.xZ
kEYZk
@.NY|
-
8.PfP6LLR
0.Lxm
.pD0K
ZS-9}
"6..zX
xY.qW
A.Fgkc7
m%Crk:
o3%s"
$%csl
Pl-.lZ
>c.WBx [
Pu%x~n
%uoo#
%D>} V
.US H]
.Xuv`u'}
Y.WauRCM08
ZN`.Ym
pR'%U
B.md.XnS
ku%X(
$[.Zvp
FN.gx`
\.wRF
9%d)h
p.lM
r/|%f
9ns.HJ
K&.ARyE
.PK9:
 j gf%S
f7x.WH
FqWK%Xx
&\.cA
.jsJi
-5%xH 7
'P-N.jm'
ACrT4w
?%D> 
SshIB
I.hH@
|A.OF1
s6%uC
~.rra0N
.tk@_
.Xw$f
(%S~;]
\4E%s
~K%Fq
4=%do
9S%Xva
.ZHC:
n(%Xun
[%cQ3
.dXx@"
9.sEW
.nY,*
^Fb.wI{
xb>fU0V.sf
y.BT
d{M%c
;|%2u 
%sGh3
Y[F}u%sC
M.Zn 
xG.uu
WEbl
E%Udk
 Z,%d
@Ci@G.hZ
Y.hRB
]v.wu
.zc@I[
!.rj"*
.xR[]
\.xZ=
,]T%c
?EorMh.zx
s.sVk
_.qoy?
.sz@p>
.TD)Lf
.gL*o
DwN%Uk
w%S\e
&{%F}h
cRtY
yiN%u
.zB\S
oU.TR
,$%C;
?@.uf}R
Fe.yW
W6bW.nO
.Nd
d.ZgK
kh.KD1 @
!H%Uw88
J.ORm`
5$.%u
YVKt.lJ]gn
J/.Ul
9Ym.wC
%D)RY
`P.nD
8H.ms
E%U.5
-%fs*
I.pz;
.b$.pl
.NYr03DT
N%sL}
1.rN,
.fIc1
8.iV~
.sZPQ
7n%dH
TFTP
!Cmd`
&%s
be%Xf
2.bG,
).XoY
8l|.qa
tPs.rl|N
I.Db%
`.yGW
.ypb`z
a%B.ko!
uRL[3=H
SM.Jf&
%uq(y
O
:=%a%X^SR
 c.xa
.MTq|e&
L?nA%c
jWZ%sV
V%XISO
OKEXeq
ŸBt
S.dvt
dQs6.NE
{.wk|x
%d|#Q
FB.zI
O^B%s
0`Fp[.Ap
.Gdu 
T.ZDgp
nudP
FM#.ySu7x
%xi3X
%DKoq
o^.ZYc
/=?q%S
s.CX3
'e.KC
cP.Lu
A7tcpK
03%c$
P.YME
'@P%U!Yq5m/
-V}yfJx
9(D%Fj
>u48%cV
).QS8
%U;#J
.Wb'[5
x.jx?
p.wZV
,a.kB
{piY#>,%5x
\2`%N.grF
ld.sf
QurL
Jg}.Tg
1(b`@%f
v*).hT^
i.mj.
e).Km
(H%CR
fURli
%c*
8%F\G
o.oS;
j>Í)
d4-q}
.JW4e9n
rr%U(9a
}.EO8
.qIMP
8=a-w}
{.GIB
%s}kn
}P1~>!Q8%d
Y_{.bM
o.zkBk
%D\RG,T
.Ht`ma!
OS=%c}
$.yf4
.v.xHm(
.zLcjX
1U%uV@
/C
kEYjw
|q.aI=
B.BHR
TDn%F
%uomP46
*Bp{%9X;
^9%s5[Kw!
%u}j#
MSgr
o.bR?LL
.dkj $D
.fW
`.XX5\e
P].BAZ
*%sOo
Í-dQ
zx`l.rUEo)
mrj.gh
.kc 3
WSSHG@
/Xi%SI
x&.In
.bu"t
K.Iiab
on%.Pg
;2%D-
0T.wk
2.mK%
.AM30JE! 
\{#%X
-
*.bV:
Up/%C
22`-*~|2
k!o%U
/}.cs
%C?~VT
l.-6}N
.Ag-;n:
\
s,b.RC
.tF8W
.Mj
.rQC 
MK2b%u
i3-
%CKn9
kb|.BS
(2%C[
P.hKx
v=E.CB
MT.tC
#>-F}(
I-$%U
%dKs~
|*.xx
X%uw9
3%x[6
].Us}J
%D_an
=.Nia
9%.os
{@^.XZ
xNFB.OO
%FomZ
;5.TA
c.yuY|
@%fv@5
%xZq:
.Fz]I{$}
.LVqI@
.DVWD
*TCP6
%f$bA:]
GÅ“QF
.WJ;K
D.LC{:}
Y0.Ql
%ua(}4h
,.lo}
.wJYN
nvV%cYH
M.wKWGw
/.MbJ?y
.WUx1
K.hQa
Z.mm:
r:~.Pa
%d=I\I
'=0l.QdW
9l.DP(
 t%S\
\}.WJU
Wx%sg
N6.iB
.OzTs
WU
1oR.hF
`.edl{
8-9x}
? .vx
d[.kE@7
T%x8Y
EzHx4A%X
f&I%XI}6
c.Jqn
.hE
P).oP
vu%U)
%s@d'
0sqlD
u4eXE '7f
{i[.jb
.XH{_
Gm.Dq
X%uj7
tD.%s
%DP}b
M,%S;
?.xJX
5\mm%S
#u.om
.gE2"
h%f -K
.bmkfNLw*
1%u&!/2Fr
{-C}Fy
wV%fRt
'J.SLv.L
g.DhgI-
.ChW /
x%Cg,
di.BX
%f,j9]
%X*XN
cp~%x
<.nbd>
F3t%S
.Wv3P
.FX{/z
.MLIz
-B}o7
.aodMeCx
%FIHm{
,~.ui
 .INY
).CMc1
9NE.Ir
uH.AE
.vhVF
0E&Al3
%s)KW
@.gk`
8.SYa
.kddO
p%X0@
.fAgx
Q.JRS&
.vpKR
.Ly9*z
te,.yMA
.Xl(#
FWÞ
%X@F=
0Dm%f
Kz^.VO
)z2.Vj
D%c 0
\i.VJ
.Vqyl
e)&%uJ
.aYK]x
X.W%f
:6.VC
s.TnR
RE.NC|L
,%f-_9
.MD/J
=N.co
.YTcWD
5d%Sbp
BA1%D
 Ec.wS
phG%S
_7.ro
BmN.Yk
x}DQw%s
Te.XC
{&F-0}
YÈg
Tv.HC
TVqS
~.Cgbe
e)UY.fl
sS.Ae2
w4.Xf 3
;`Fy%Dm
pI.MR
%c.Uiv
%%cj>
U3Q]%U
@e.EGQ
_x%Ck41a
.xeXt
2.Xa$L
.nAPj
.Pi~4
Vu.ba
Dqf.Eb
`tCpC
.IMv.v"
:.IgD
.re-0
Z}.Qp}
^M%XD
8)%D}
%cM0*X
e%F$r
Vd1.QQ
-3}jAOqJ$!N
pý9
v"8s%c& 
w,^c%c
.Sh0m
q2.jX 
F%x>xm
%m%C;/
.lE`1Z
Y].Ff
%sd"U%
?}SSH!
-6}]U
TJSq.YW
6J.cuv
#eXE/
KVi.WIB!
\%F(p
d_H
r.ccx
Yz.WX
%xTQp
S.yp.
E,vB8%C
WM3.liw
r .Lx
B#Sqle
WeBRj
OUgR.DJ
"n.hN
-s?%X
ÉBx*
{.eYz
rLB$;x.AK
%u"DC_
%XjbK
h})%d
u.fV[
N.kFg
|A!%c
.OShc
.ycH'
.Fem=
F.mA7
.rcx-
H=J%S
%cid;
.aC,.~*
&P|.ip
11.po
)!Ú
^.Xe&
?=.tu
> -r}F
>,^.oMQ
Bz.IR0l
%D n|
.Xp%V
'M.Ku
q.tS^JZ
mC-Btg}
,9F,.SS
Gzg%X
t.QWo
.xbatm
.pET?
B.EP7P
dsSSH
a%8U*
Do%Sk
%s=~?
/úw
u9_Vd
%ŸY7
d.zpr
wB o.sp
C%swf
J.XXB
oYÚ
s3% %c
mH$d.MQ
FW.Mg
!.AE(
U.UUZ
%Xj[a{&x
R.RI!r
.veWsb
;.5$.JWK
PG%S0
-.XhA~
A%EXeqV
.IaU;
S=-5w}.
z.Vbe
.yT,bd
BF.gQ
t%CSr9]
7.dwB
[,%D/{
@;.at
}IVn.Rf
Vw@.gX
.Gr\(
c~%D.
V%4Xfe
.yBUe
Hßh
W.GYCE
)vw.NI
2a.tX
,F%S7:ttI
A.uD o
fMsg
s:\p5
.ONH|
%Sr&l
GLZ.no
n%9U 
HS%SW
.Kf.)*
$?.HH
'.DI(
#%sbZ
=DMSg
T.qE5
%x:_'k
a%fl;R
%Xh/?
.aBWq
sD%Sx
4wV%F\
g.cvil[
R.NVQ
.WBI%
4U%ci
&t.yz
f4Ic.ZW
P.Sou'
9Jc7<.pez>
p.NX>G
kQ.SId9
(.sF/ t
%u ,*?
.wa-,ns`
lzX.ff
%SMYG%
eV.KF%G
%dYr0c
.zYT4-
.FJmS0
JI.Yw
3WebM
.JC_~
Z%fG'-%
S0D.eT/
MnE%F
[W e%C
Tkv%CY
bm
L8Jy%c
}.smk
.OuWqI
V%U-/1
"}=.ReC
%ChhD!
=Uþ*1X
,.OvY/
.EJM=
%XG6'M
;;[R.gD{
%DjAB
7.zdbR
.mdoY
%Xi[K
_Q%Sh
Xq.QHh
]}[%d
a^%xY
.aI"n:c
.VpXA
9.eU4G
S}.Jr"0
5].sz
ik>Ms.pYm
.U.gf%P
?.XGR
.rf)_
-w}5'
.Ey\k
n/%XM
.Et@*q
.VWD25
%X#Wt
6.oI1
.Zlj-
\e0%f| 
;G&%u
-WY}B
.Jgte/S
A..chhPm
"#%Uu
K9 %f
BA.%FW_B
`8%Dh
D#kLsSh
J.uL7
1%D%s2
%lW_.LeXw
D.DA{
SfL%d
.HsKq
L.iJr
z'.lj
.edSU
ev.KI
z%u*R
%.EL4
.iR4K
%7uWFn@
2t%SP
i.CcC
H4.xv
k.DQ,
#.yKa8
pB.CM
.PUYU
%cSUcGk
.dX'h
mh.Gr
e*&.ju
ÝAH
l7.ZHf
>$%DJ
%f |KiB
$.EmO
)T%Dg
i.aH`
%uX8R1
^x.Dk*L
k.Lf5U
-P}\z
S.MiU
.LS|1Ae
#
y,%XB
Th%cN
f"7.jW
k".btt
e.mWe5
vIX[.Yi'
.Umv`
t8$.wu
';.xJ"E}
.yV#!
9.Ct\
a.dC])e
@ECe.vIC
gkL%1u
9.yVE
I-Q}?
ns`.na*I=Hj
Bp@I.rS
J}e%X
.WoN/
.LqN\w
f;.Uhl:?;
>#[.RN
T`T%d
d&.BSk
eR{%x&
%Fy$s
.EGnZ
O`.No
>]j%U#G
A.YzB
.Aw\Hb
k[r{.pW
6E.eN
!Z%cy
3AN,S%.PN
oN.cm
x.cunB
"d.mD
S0%.f
.ghK3
bJ%Dr
%.Nea}d
IKEYj"
qS%d:!H
.DI9V
G4-%S
.sn/|7$
B%DOA
=^{(^.QZ
-.BQe
[(~%S
[.ta[
.Xs%H
;.tQk
\NU0.MH
UA.QK
%c;0|{
.dwOD
%uD*9
Ht%co
7%XeUa!
%XsY-
Czqq%xB
d|%uY
r.VOb]|
8c.TN
"tz.Tq.
M;-L}
,0.dW>pW
S6.Ws;
tH.Pn.Y
CxU%f
h.cyZ
s.VMAx
fm%S'
F|.YB
)v.TYv5
'`b5.YY
]A?.eg
.dbt`{
2r.vG
Kp.zZ'9
8E%Ss
|.zlEh
r4E%d:z
#%Cw9
.CEUY
b7.wY
D>.LR
Rx%Cr6~*
6%dnS?
&%St!
%7sr8
d.ae`?
M%S7J
XG.gAg
>`[%X
.ep3j'
.Sr9t
p"v%S
>Z,%DRm{
'w.Is
E.JI4F
.tD:zl
g.bSZ
{e@%s
l.ULs
8VÃŽ!
au.gZ
 qr.YGs
-Xgz9}m:J
t2url
.DG3~P0
_K[Ih
t%ClnH
iX.CGF
Wh.QfrD
_fl
4.gdZ&
3@.nW
Yj*j%u
#s.qUK
C%9u=I 
F@.zuE9
.zgqUP
.Rhht
.ULW-
lcRT
.zH'bX
AX%U"
mvûk
Ei.KX
.CZZF
WE\N%do
p.hG~
%f}7RN
c?û
S%C^XM*^
0n%D:
{i.bx1
x]ipJ.PJ
y;.PW0(
P;CD.nEr2
p.eZR
%uIIHqH
!?.vE
.hm3B
.sGhW
.tCKS
`\%uW
.WhuhByI
aGl%D
ObA%s
TH.oa
aK=%f`"
:N.dMY
.BZ`w
N:%xY
W,.bz
^4.Ga&
f.YM4
.sR-b
.KFuC
K%dup
tLObc.Yk
.eQ6h
b5%c'
yK.UZ's
8>.Mg
;?.os
w.eH '3
.IEu}
3u.jZ
P.uY8
Z".TE
E%SELw
2v%C;
.ToOQo
8\%Cv
M0.nq
G.oP{x"
U.LyF
.gwUQ2
GH-3}
0I%c>
=*'.cx
l7_%s
kI.lg
j.sB}
.eYMP
ø_w
n.qj1
zI%us
[.JDl
yw%X#D
%SF)P3
%xYa6
isG%u
7.ktF
:.sD7,
J.ke_Q'
v.jDf
j.An8
c.eC}
%Dy:G~Na
=.AKNk
i%X#4Y
G}.RVOX
.QqW]
.pYJyz7
!.jOQ
%f[3
d.obY
9`%sq&
q;.Yl
.ljMs$/
3U%sz
PV).lX\u
4C.mM
g-i}Hh
-s.Yn
%U?Qo
zo].vR
.kQ5ie
[SSH?
dL.ef
ugò
?2.ySK
{fE.JD
2l.FN
}%5x!
%D&u;
cJ%s>
1o0%x'\
"~.uP
%du?{m4mibi
(R.UMpB
.wR9:
V.Ve3
JZ%c}
.eN-Bl2
scO%d
ÃŒBU
.jJ
 .LRe
`/%UxF
I.oM2
S.bNI"
*h8%C
J_N!%f
..lY:
.vV2!
.doSX
7N%C}
.ib/k
jZk.qbQim
g.AN/
Gv.OVT
v~.KS;O$V
1P4F%c
8.De9
M.Cq=
{}1%F
.tHo!
%uY)}
ok:%X.
Vd.juw5
:_.AT
.Ps$O
Y.fSxot
"i078%ug
0.hgQ5k
!PY9%S}S
[(I.DW
I`.yXx[
V9.XL
e.BFT'n
iwX~.IO|
w`H.uhw
~.Xu$
.aV3?
.Bd{S
]!.YD
b-.Xt
sQlh
fEXE
X%UBm
l"y.xN"
XD
uR.qF
n.akg7
r%c?R/
6cSÍ
%.WIf
xp.qs
OL.Rd
*ÃŒa
-s}a;
k;.sv
L n%f
%D$Und
J.yTn
..HZ/
C2.pDUa
oe%D?
[zY"%F
&L.ot2d,
l;.zg
F0#%S
Sv=%x
Ï*%2"
"&o.bSI
SP.PJ
..EgZ
Nml.eY
PZ%D[
X8ov.bjp
4oHô8
SqlXL}8
.uL'2
*r.Up
iFu.Ly
].HUs
%D~T{
Ta.Ei
Ar.Sff
.wY9o
[x``%u
C%xl\^gW
nO{.vVHRVw
.yc~m
T3%UN
bw.cl
|).RJ
uf].sO
uG.zel
s*.Kl%
%X u>
!%XEn
H&%SRh
J18.ec
eùc
F%U,S
\l2
uM^Yi%ft
9.zM`
}UH%X
hC.WU
[Hz1s.Ni
.wyui
Qa!.mi"
?%.VHHP
Z.EJ8o
5p/.kF
.hOI]
 (Pn!.od
.qg&E
"DS%C
.HH;O
^x l6`^%s
G.Iw_
q%S
T:\x4
X2.wr
\%d^m
P.oc76/L
>K3-l}>
X.eH(
zd.aP
SJ.RC
Q:)xS.kI
.WH&k
w%sT42z
StÏR
-!.hE
x%sB>
.BnhD>
m%SL~d
.YvN%T
U~.lg
R.Mdp2
ÔYe
d.XQ$`&
.gW?p
zQ.QP
&vBN%U
ò Z
H*%F{
)=&Nf%F
D..bl
B.aYk
0H.Qe
n%Fj4
O.Mni
&-h}h
.GiUNx
h.jy:
.fQO;
=~.Cb
.Zlv$f
Es.RT
-I.jZb
'.Vh~
.wW7^s
' Z%D{
W8.rG
%fn5Xc
i.Ynld
.erJXW
XN.Ec
|.TZs
.Woz9$
o(
|.TFtJB
K4^%f=
O.nqz
vU.Bx
bk.wO
`.TV;}j1
.dtoBVV
T7.vKN
GW.xO
x%Fz,
`X %u
jY.bX
yv.FO
=7TD%f
ZZ%c[mJ
Ga<.lc>
x`A%S$a
$qS%s_F
^=q%D
.lqm^Br
=b.RI
9.vA&
b*o)%U}
.EG]R
zF%F>k
1\1%d
kv/
L%d\g\
[.LR"|
ýPh
o%-2}U@V
.jY~hQ
}.Shd
ml.IW
aS.Lz
UE.rk
Bexe
I'-l}"
@.Hn&
,.TU}
jE=.IzA
R~%X%
YzT%S&
%8%dr
.YMH^"
?&29%,=^
9m.VZl
y^%S1
|=.wh-
%xrtJs``
.RSuyrX
c'.Sl
.Tj9}
>.yUP
t}%CI1
3%fVm>:l5~
,.eGf
.Ss]b
q.hTl
k.dP_
|S%Um
{/[(/0[12
%u&* 
8%Uo!
.vG2^vXw
-Bv3}?
Ju
# .Vm
"G%%xy
`,.pB 
h1.mWU8X
h.kt}*`
Y7fld%x
%8Xnw
.lt&7
-4.dp}2
=W.qQR
.VN41I[7
.o%UO\ru8
.njG\
Z.DpE
\.vb)
d#.Ss
?{P.NA`a
_%dQ]
pjey%X3#%&
f5(.Vj
qKoj%2s
4^-Y}B
|`%Sx
R:\Nf
.iXn8
 .nNH
%uay=:\
/#-N}_%
!qcrT
Fv%xY {
.qyjq
-.AWz
J}%5X?
0.uc1
2>.YP;l
r.lkZ
.Cp3x4
pZ.qTF
.Ywp-
_W.ENoU
.BlV*
C:I\.SI
9N%x|
v%3S/\
48.eJ
v/.bUzT
-UHaA}
C.GC%M
%u~U[
%dP')E
.nS4c
.xC",
y1 %x=
.dK2$!
keyE*7
.nl_\
%S(w`
.ZH""/#
kL.(.uR9
!t/
;v%SEb(
E%xi9
-?k.gv
0.uvR
(DTi)m_.ia|
.84\ 4$^
%URCB
U!FF.dK
p.xW!
'W.uE
gk%9S=
1.Ll_
o4.IV
k.Wvh
\8.gN
Q%U|\}%-J
g%uW>
e.iws
Jk.XS
&%X`!
(%s@9
.fXZ:
I%xXj
w9T.Sl
wQ,.yz
%cO=0
#?.Sj*
p;.zHMV
qsM?%x~
^"7R%C
{%x.2Gk
0~.uio
}%D=T
.EPci
i%s=uq
pMl%d
0bQH__4%S
\.XDR
%c!IV@
d.ugk:
!1%8!%s
(%xi`
-zl4x5}
Rn}=j.lq
FH.iH
.zx$.
.TKpz
).OUw?
`Jng.oO4%
6 <.jd>
U.FA;Z
1%c@ t
s.sV u
I%Dls
lLa.Cw
%C=QH
.xZc#
U~xW1!.CqH
.VLk%{
.Iv\p=mrrx
#b.zlKZ
)E.jqc
n%U_w
`RKÜ
WwJ.CCA
z$^3~%3u
A$(%s
@%cN5
ED.Xx
9".TI
.pKS|O
(a.ojX
kPB%Un
d[e.av
W%CGFGQ[
%9X;$
o4.Ij
B=j%u
fE .ot
SsqLH
ÈiZ%
U%U|R
.kqp 
95.lb
-?e%U
).BCh)8
B8.hF
D.WmT1G
.kpZ^U
/rX-X}
Y%UU{
D.ZjJ,
-%SZl\J
_}l
%fqs0;
cS.WS
92".DN
J8.Lo
>wtGx%u*X
%xXI@
%XN=P
-5Q.Xh-
.vcQFR
Dm.wu
.sS*~
o('.ZK{G
]JA.Bf
re4%F@
.Rd_~d
%xW=j2t
@.fh[!
j
ohrB
3o.RL
.Cv^Ww
.Fa $
7%$=n%U
':"W%u
B.Dt#
6T.Ep
.oWL?d
ZF.lF
ac}.yR
.gHPx
qU.fI
c9%UM
@.tzW
*r
J.XSx
.wk4Y
^I\.MT
W60R.zP)
.Tw1;
;%u5y{
.VNrZ
s%c=#y
W8(J.LS
':-B%CL
o.SbWT
P.qJ|
F|.EoY
W%S*[
ja.Ze
C;H.Ix.6sC
%u)[f
07Ð
.haX?
z(.Aw
C%u-u6
`P%S'
Udpy
V)!.wIf
.kS,'
{.W"i
sz.qj$
.ns&`J(
.wk I
.xW.a1k#=
E.SK@
cMdv
.Els&
-.ZG|
.xc&}
K%F)e
.eI;z
CO.WN
3Crtdn
%Fw{>
\\Û*Bl
 o%Fq
CqXB%xRc
AF`%u
/AW.RW
%xqw"
.RS`V
z3.fJ
oU.rs/AWfug
.YX>c
4UZ8%u
er.yr
?.VMi
`By%u`6FW
^%U2
j.yM:
m.HwR
Dd(.Yzd
Ay.XH
5%s^p
'u9LOzV%U
%u
7bssH}\/
v50
]h.vF
^.MGQ
.hnuM
B].zC
J/sqLR
%c@;y
EK/%c
%SrNf
Jpo%XB
f&%DW
g.lwR2
pN(e.qB
Nna.YhO
%X(I[c
}X.VJ
K7.CF
tm.Dx.
O*2
%f^ffh~
n|.Gm
y.fRJ
(N.vv
%D/?:
.taN>f
ip.us
B:\i3F
iH.xP
!;H%xL
.jTl51
`~cmD
T#%x`
Y.WJ~V
o9k.yA
.SJ)zG
WY.eX
.XY{`3R
E.hEP
.Uvr&s
S.qx#
[XO