PUP.Win32.Spigot_9f12ba22dc

Dynamic Analysis

Payload

Behaviour	Description
EmailWorm	Worm can send e-mails.

Process activity

The PUP creates the following process(es):

GoogleUpdate.exe:1704
GoogleUpdate.exe:3660
GoogleUpdate.exe:3252
GoogleUpdate.exe:1684
GoogleUpdate.exe:280
GoogleUpdate.exe:328
GoogleUpdate.exe:3284
GoogleUpdate.exe:3296
GoogleUpdate.exe:3160
googletoolbarinstaller_en_signed.exe:2208
googletoolbarinstaller_en_signed.exe:3468
NCH_GoogleToolbar.exe:3220
NCH_GoogleToolbar.exe:2488
GoogleToolbarManager_BA9226F4C70BECC2.exe:3600
GoogleToolbarManager_BA9226F4C70BECC2.exe:3108
GoogleToolbarManager_BA9226F4C70BECC2.exe:3588
GoogleToolbarManager_BA9226F4C70BECC2.exe:3492
GoogleToolbarManager_BA9226F4C70BECC2.exe:3096
GoogleToolbarManager_BA9226F4C70BECC2.exe:1404
fastfox.exe:2132
GoogleUpdaterService_B33FC4DD36A473C6.exe:2220
GoogleUpdaterService_B33FC4DD36A473C6.exe:3536
scribe.exe:2020
scribe.exe:1004
scribe.exe:1836
edsetup.exe:2812
nchsetup.exe:336
nchsetup.exe:1372
nchsetup.exe:2512
regsvr32.exe:2320
GoogleUpdateSetup_latest.exe:3240
GoogleUpdateSetup_latest.exe:2188
GoogleUpdaterService.exe:1128
GoogleUpdaterService.exe:3568
express.exe:1732
ffsetup.exe:2652
SearchWithGoogleUpdate_6F4EEAE8D7FCDAD8.exe:3560
SearchWithGoogleUpdate_6F4EEAE8D7FCDAD8.exe:304
GoogleToolbarNotifier.exe:1412
GoogleToolbarNotifier.exe:1636
%original file name%.exe:624

The PUP injects its code into the following process(es):No processes have been created.

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process GoogleUpdate.exe:1704 makes changes in the file system.

The PUP creates and/or writes to the following file(s):

%Program Files% (x86)\Google\Update\Download\{F69EABDD-A4BB-4555-BE7E-1EA5F59BBA24}\0.0.0.0\googletoolbarinstaller_en_signed.exe (38295 bytes)
C:\Windows\Temp\guiB682.tmp (15 bytes)
C:\Windows\Temp\gui1094.tmp (15 bytes)
%Program Files% (x86)\Google\Update\Install\{4B398FB8-FDA6-468E-A6BF-725792C3320C}\googletoolbarinstaller_en_signed.exe (38780 bytes)
%Program Files% (x86)\Google\Update\Install\{6C712992-D2F2-41C1-8E3E-60022AFAD2B1}\googletoolbarinstaller_en_signed.exe (38780 bytes)

The process GoogleUpdate.exe:3252 makes changes in the file system.

The PUP creates and/or writes to the following file(s):

%Program Files% (x86)\GUM30C.tmp\goopdateres_en.dll (28 bytes)
%Program Files% (x86)\GUM30C.tmp\goopdate.dll (835 bytes)

The process GoogleUpdate.exe:280 makes changes in the file system.

The PUP creates and/or writes to the following file(s):

%Program Files% (x86)\GUM98D5.tmp\goopdate.dll (835 bytes)
%Program Files% (x86)\GUM98D5.tmp\goopdateres_en.dll (28 bytes)

The process googletoolbarinstaller_en_signed.exe:2208 makes changes in the file system.

The PUP creates and/or writes to the following file(s):

%Program Files% (x86)\Google\Google Toolbar\Component\GoogleToolbarUser_32_52E818EF81C83A9B.exe (620 bytes)
%Program Files% (x86)\Google\Google Toolbar\Component\GoogleToolbar_64_62C1B48EAF0FD125.dll (514 bytes)
%Program Files% (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_0A4439FF67F61065.dll (2 bytes)
%Program Files% (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_64_2AD99D2EA038D2F2.dll (489 bytes)
C:\Windows\System32\config\SOFTWARE (67172 bytes)
C:\ (96 bytes)
%Program Files% (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_32_75A7C54F0BE42E8E.dll (149 bytes)
%Program Files% (x86)\Google\Google Toolbar\Component\GoogleToolbarUser_64_4D9709C1FA1422BA.exe (801 bytes)
%Program Files% (x86)\Google\Google Toolbar\Component\GoogleToolbar.7.5.6227.252.manifest.xml (36 bytes)
%Program Files% (x86)\Google\Google Toolbar\Component\GoogleToolbarManager_BA9226F4C70BECC2.exe (50 bytes)
%Program Files% (x86)\Google\Google Toolbar\Component\GoogleToolbar_32_3934E923EEC91A78.dll (390 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GoogleToolbarInstaller2.log (43839 bytes)
%Program Files% (x86)\Google\Google Toolbar\Component\SearchWithGoogleUpdate_6F4EEAE8D7FCDAD8.exe (50 bytes)
C:\Windows (288 bytes)
C:\$Directory (384 bytes)
%Program Files% (x86)\Google\Google Toolbar\Component\GoogleUpdateSetup_5CC4B0F53D73AD88.exe (1480 bytes)
%Program Files% (x86)\Google\Google Toolbar\Component\GoogleUpdaterService_B33FC4DD36A473C6.exe (390 bytes)
C:\Windows\System32\config\SOFTWARE.LOG1 (61484 bytes)
%Program Files% (x86)\Google\Google Toolbar\Component\GoogleCld_187F9D811452062B.dll (50 bytes)

The process googletoolbarinstaller_en_signed.exe:3468 makes changes in the file system.

The PUP creates and/or writes to the following file(s):

%Program Files% (x86)\Google\Google Toolbar\Component\GoogleToolbarUser_32_52E818EF81C83A9B.exe (620 bytes)
%Program Files% (x86)\Google\Google Toolbar\Component\GoogleToolbar_64_62C1B48EAF0FD125.dll (514 bytes)
%Program Files% (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_0A4439FF67F61065.dll (2 bytes)
%Program Files% (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_64_2AD99D2EA038D2F2.dll (489 bytes)
C:\Windows\System32\config\SOFTWARE (16375 bytes)
C:\ (96 bytes)
%Program Files% (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_32_75A7C54F0BE42E8E.dll (149 bytes)
%Program Files% (x86)\Google\Google Toolbar\Component\GoogleToolbarUser_64_4D9709C1FA1422BA.exe (801 bytes)
%Program Files% (x86)\Google\Google Toolbar\Component\GoogleToolbar.7.5.6227.252.manifest.xml (36 bytes)
%Program Files% (x86)\Google\Google Toolbar\Component\GoogleToolbarManager_BA9226F4C70BECC2.exe (50 bytes)
%Program Files% (x86)\Google\Google Toolbar\Component\GoogleToolbar_32_3934E923EEC91A78.dll (390 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GoogleToolbarInstaller2.log (58152 bytes)
%Program Files% (x86)\Google\Google Toolbar\Component\SearchWithGoogleUpdate_6F4EEAE8D7FCDAD8.exe (50 bytes)
C:\Windows (288 bytes)
C:\$Directory (384 bytes)
%Program Files% (x86)\Google\Google Toolbar\Component\GoogleUpdateSetup_5CC4B0F53D73AD88.exe (1480 bytes)
%Program Files% (x86)\Google\Google Toolbar\Component\GoogleUpdaterService_B33FC4DD36A473C6.exe (390 bytes)
C:\Windows\System32\config\SOFTWARE.LOG1 (14164 bytes)
%Program Files% (x86)\Google\Google Toolbar\Component\GoogleCld_187F9D811452062B.dll (50 bytes)

The process NCH_GoogleToolbar.exe:3220 makes changes in the file system.

The PUP creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi2BF.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GoogleUpdateSetup_latest.exe (25250 bytes)

The process NCH_GoogleToolbar.exe:2488 makes changes in the file system.

The PUP creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GoogleUpdateSetup_latest.exe (25250 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsn9888.tmp\System.dll (23 bytes)

The process GoogleToolbarManager_BA9226F4C70BECC2.exe:3600 makes changes in the file system.

The PUP creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GoogleToolbarInstaller1.log (1467 bytes)

The process GoogleToolbarManager_BA9226F4C70BECC2.exe:3108 makes changes in the file system.

The PUP creates and/or writes to the following file(s):

C:\ProgramData\Google\Custom Buttons\toolbar.google.com_O8Y91YHB24Z6SR0SGYSK.XML (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GoogleToolbarInstaller1.log (3159 bytes)

The process GoogleToolbarManager_BA9226F4C70BECC2.exe:3588 makes changes in the file system.

The PUP creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GoogleToolbarInstaller1.log (1704 bytes)

The process GoogleToolbarManager_BA9226F4C70BECC2.exe:3492 makes changes in the file system.

The PUP creates and/or writes to the following file(s):

%Program Files% (x86)\Google\Google Toolbar\GoogleToolbarHelperPatch_signed.msp (125 bytes)
%Program Files% (x86)\Google\Google Toolbar\GoogleToolbarHelper_signed.msi (28 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GoogleToolbarInstaller1.log (49169 bytes)

The process GoogleToolbarManager_BA9226F4C70BECC2.exe:3096 makes changes in the file system.

The PUP creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GoogleToolbarInstaller1.log (2406 bytes)

The process GoogleToolbarManager_BA9226F4C70BECC2.exe:1404 makes changes in the file system.

The PUP creates and/or writes to the following file(s):

%Program Files% (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (1281 bytes)
%Program Files% (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (673 bytes)
%Program Files% (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe (1425 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GoogleToolbarInstaller1.log (41404 bytes)
%Program Files% (x86)\Google\Google Toolbar\GoogleToolbarHelper_signed.msi (28 bytes)
%Program Files% (x86)\Google\Google Toolbar\GoogleToolbarUser_64.exe (2321 bytes)
%Program Files% (x86)\Google\Google Toolbar\GoogleToolbarHelperPatch_signed.msp (125 bytes)

The process GoogleUpdaterService_B33FC4DD36A473C6.exe:2220 makes changes in the file system.

The PUP creates and/or writes to the following file(s):

%Program Files% (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe (390 bytes)

The process scribe.exe:1004 makes changes in the file system.

The PUP creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_scribe_rl_adm (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\NCH Software\Scribe\Status\s0000000.sta (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\NCH Software\Scribe\Current\Welcome.wav (1425 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\NCH Software\Scribe\Current\Welcome.dat (832 bytes)

The process scribe.exe:1836 makes changes in the file system.

The PUP creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ffsetup.exe (268985 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\edsetup.exe (296411 bytes)

The process edsetup.exe:2812 makes changes in the file system.

The PUP creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\n1s\nchdata.dat (2104 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\n1s\nchsetup.cab (560 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\n1s\nchdata.cab (27 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\n1s\nchsetup.exe (24321 bytes)

The process nchsetup.exe:336 makes changes in the file system.

The PUP creates and/or writes to the following file(s):

%Program Files% (x86)\NCH Software\FastFox\Help\licenceterms.html (3 bytes)
C:\Users\"%CurrentUserName%"\Favorites\NCH Software Download Site.lnk (260 bytes)
%Program Files% (x86)\NCH Software\FastFox\Help\shortcuts.html (3 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Utilities\Classic FTP Software.lnk (1 bytes)
%Program Files% (x86)\NCH Software\FastFox\Help\restoredatadlg.html (1 bytes)
%Program Files% (x86)\NCH Software\FastFox\Help\autocompleteoptions.html (1 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Utilities\Text-to-Speech Reader.lnk (1 bytes)
%Program Files% (x86)\NCH Software\FastFox\_ffhook64.dll (7772 bytes)
%Program Files% (x86)\NCH Software\FastFox\Help\arrowlist.gif (455 bytes)
%Program Files% (x86)\NCH Software\FastFox\Help\fastfinishcontent.html (2 bytes)
C:\ProgramData\NCH Software\FastFox\demo.rtf (600 bytes)
%Program Files% (x86)\NCH Software\FastFox\Help\groups.html (1 bytes)
%Program Files% (x86)\NCH Software\FastFox\Help\quickstart.html (3 bytes)
C:\Users\Public\Desktop\FastFox.lnk (1 bytes)
%Program Files% (x86)\NCH Software\FastFox\Help\hotkeys.html (2 bytes)
%Program Files% (x86)\NCH Software\FastFox\Help\adminpassworddlg.html (1 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Utilities\Backup Software.lnk (1 bytes)
C:\ProgramData\NCH Software\FastFox\shared_abbrev.dat (66548 bytes)
%Program Files% (x86)\NCH Software\FastFox\Help\help.js (2 bytes)
%Program Files% (x86)\NCH Software\FastFox\Help\editpicture.html (2 bytes)
%Program Files% (x86)\NCH Software\FastFox\Help\editrich.html (2 bytes)
%Program Files% (x86)\NCH Software\FastFox\Help\generaldlg.html (2 bytes)
%Program Files% (x86)\NCH Software\FastFox\Help\autocase.html (3 bytes)
%Program Files% (x86)\NCH Software\FastFox\Help\introduction.html (2 bytes)
%Program Files% (x86)\NCH Software\FastFox\Help\groupprop.html (1 bytes)
%Program Files% (x86)\NCH Software\FastFox\Help\editsuggestiondlg.html (995 bytes)
%Program Files% (x86)\NCH Software\FastFox\Help\backupdatadlg.html (1 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Utilities\Express Zip File Compression.lnk (1 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Utilities\Encryption and Decryption Software.lnk (1 bytes)
%Program Files% (x86)\NCH Software\FastFox\Help\generalsetup.html (1 bytes)
%Program Files% (x86)\NCH Software\FastFox\Help\index.html (3 bytes)
%Program Files% (x86)\NCH Software\FastFox\Help\autocompletesetup.html (1 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Utilities\Doxillion Document Converter.lnk (1 bytes)
C:\Users\Public\Desktop\NCH Software.lnk (1 bytes)
%Program Files% (x86)\NCH Software\FastFox\Help\sharedabbreviation.html (2 bytes)
%Program Files% (x86)\NCH Software\FastFox\Help\hlp.css (1 bytes)
%Program Files% (x86)\NCH Software\FastFox\Help\selstoragedlg.html (1 bytes)
%Program Files% (x86)\NCH Software\FastFox\fastfoxsetup_v2.32.exe (3361 bytes)
%Program Files% (x86)\NCH Software\FastFox\Help\using.html (196 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FastFox.lnk (1 bytes)
%Program Files% (x86)\NCH Software\FastFox\Help\deletegroupdlg.html (1 bytes)
%Program Files% (x86)\NCH Software\FastFox\_fastfox64.exe (12076 bytes)
%Program Files% (x86)\NCH Software\Components\NCHToolbars\google\NCH_GoogleToolbar.exe (382879 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Utilities\Bolt PDF Printer.lnk (1 bytes)
%Program Files% (x86)\NCH Software\FastFox\Help\sysdate.html (2 bytes)
%Program Files% (x86)\NCH Software\FastFox\fastfox.exe (8020 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Utilities\Typing Expander Software.lnk (1 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Utilities\CD, DVD, BluRay Burner.lnk (1 bytes)
%Program Files% (x86)\NCH Software\FastFox\Help\editkeystroke.html (388 bytes)
%Program Files% (x86)\NCH Software\FastFox\Help\addshortcut.html (1 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Utilities\Uploader Software.lnk (1 bytes)
C:\ProgramData\NCH Software\FastFox\local\abbrev.dat (66548 bytes)
%Program Files% (x86)\NCH Software\FastFox\Help\902.html (1 bytes)
%Program Files% (x86)\NCH Software\FastFox\Help\editsimple.html (2 bytes)
%Program Files% (x86)\NCH Software\FastFox\_ffhook.dll (7332 bytes)

The process nchsetup.exe:1372 makes changes in the file system.

The PUP creates and/or writes to the following file(s):

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Video Capture Software.lnk (1 bytes)
C:\ProgramData\NCH Software\Scribe\Current\Welcome.wav (34532 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Express Burn CD, DVD or Blu-Ray.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\Favorites\NCH Software Download Site.lnk (310 bytes)
%Program Files% (x86)\NCH Software\Scribe\hookappcommand.dll (6988 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Express Zip File Compression.lnk (1 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\MixPad MultiTrack Mixer.lnk (1 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\WavePad Sound Editor.lnk (1 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Express Rip CD Ripper.lnk (1 bytes)
%Program Files% (x86)\NCH Software\Scribe\scribe.exe (13171 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Express Scribe Transcription Software.lnk (1 bytes)
C:\Users\Public\Desktop\Express Scribe Transcription Software.lnk (1 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Express Dictate Recorder.lnk (1 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dictation and Transcription Programs\Typing Expander Software.lnk (1 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Switch Sound File Converter.lnk (1 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Graphics File Converter.lnk (1 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\VideoPad Video Editor.lnk (1 bytes)
C:\ProgramData\NCH Software\Scribe\Current\Welcome.dat (96 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Invoicing Software.lnk (1 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Classic FTP Software.lnk (1 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Prism Video File Format Converter.lnk (1 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\RecordPad Sound Recorder.lnk (1 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Doxillion Document Converter.lnk (1 bytes)
C:\Users\Public\Desktop\NCH Suite.lnk (1 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Accounting Software.lnk (1 bytes)
C:\ProgramData\NCH Software\Scribe\Status\Template.doc (8844 bytes)
%Program Files% (x86)\NCH Software\Scribe\scribesetup_v5.69.exe (7345 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\SoundTap Streaming Recorder.lnk (1 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dictation and Transcription Programs\Dictation Recorder.lnk (1 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dictation and Transcription Programs\Transcription Software.lnk (1 bytes)

The process nchsetup.exe:2512 makes changes in the file system.

The PUP creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\Favorites\NCH Software Download Site.lnk (320 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Accounting Software.lnk (1 bytes)
C:\ProgramData\NCH Software\Express\tone-recordstart.wav (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Express Burn CD, DVD or Blu-Ray.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dictation and Transcription Programs\Transcription Software.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\SoundTap Streaming Recorder.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Express Zip File Compression.lnk (1 bytes)
%Program Files% (x86)\NCH Software\Express\express.exe (10864 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\WavePad Sound Editor.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Invoicing Software.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dictation and Transcription Programs\Dictation Recorder.lnk (1 bytes)
%Program Files% (x86)\NCH Software\Express\hookappcommand.dll (6988 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Switch Sound File Converter.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Express Rip CD Ripper.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Doxillion Document Converter.lnk (1 bytes)
C:\ProgramData\NCH Software\Express\tone-error.wav (3 bytes)
C:\ProgramData\NCH Software\Express\tone-recordstartoverwrite.wav (862 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Express Dictate Recorder.lnk (1 bytes)
C:\ProgramData\NCH Software\Express\tone-recordstop.wav (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Prism Video File Format Converter.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\RecordPad Sound Recorder.lnk (1 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Express Dictate Digital Dictation Software.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Graphics File Converter.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\VideoPad Video Editor.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Video Capture Software.lnk (1 bytes)
C:\ProgramData\NCH Software\Express\test.wav (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\MixPad MultiTrack Mixer.lnk (1 bytes)
%Program Files% (x86)\NCH Software\Express\expresssetup_v5.82.exe (4185 bytes)
C:\Users\Public\Desktop\Express Dictate Digital Dictation Software.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Classic FTP Software.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dictation and Transcription Programs\Typing Expander Software.lnk (1 bytes)

The process regsvr32.exe:2320 makes changes in the file system.

The PUP creates and/or writes to the following file(s):

%Program Files%\Google\GoogleToolbarNotifier\5.10.11023.1534\swg64.dll (299 bytes)

The process GoogleUpdateSetup_latest.exe:3240 makes changes in the file system.

The PUP creates and/or writes to the following file(s):

%Program Files% (x86)\GUM30C.tmp\goopdateres_kn.dll (29 bytes)
%Program Files% (x86)\GUM30C.tmp\goopdateres_sv.dll (29 bytes)
%Program Files% (x86)\GUM30C.tmp\goopdateres_sl.dll (29 bytes)
%Program Files% (x86)\GUM30C.tmp\goopdateres_mr.dll (28 bytes)
%Program Files% (x86)\GUM30C.tmp\GoogleUpdateHelper.msi (25 bytes)
%Program Files% (x86)\GUM30C.tmp\goopdateres_ur.dll (28 bytes)
%Program Files% (x86)\GUM30C.tmp\goopdateres_gu.dll (28 bytes)
%Program Files% (x86)\GUM30C.tmp\psuser.dll (159 bytes)
%Program Files% (x86)\GUM30C.tmp\GoogleUpdateBroker.exe (59 bytes)
%Program Files% (x86)\GUM30C.tmp\goopdateres_am.dll (25 bytes)
%Program Files% (x86)\GUM30C.tmp\goopdateres_pt-BR.dll (29 bytes)
%Program Files% (x86)\GUM30C.tmp\goopdateres_ko.dll (23 bytes)
%Program Files% (x86)\GUM30C.tmp\goopdateres_de.dll (31 bytes)
%Program Files% (x86)\GUM30C.tmp\psmachine.dll (159 bytes)
%Program Files% (x86)\GUM30C.tmp\goopdateres_th.dll (27 bytes)
%Program Files% (x86)\GUM30C.tmp\goopdate.dll (1702 bytes)
%Program Files% (x86)\GUM30C.tmp\goopdateres_bg.dll (30 bytes)
%Program Files% (x86)\GUM30C.tmp\goopdateres_vi.dll (28 bytes)
%Program Files% (x86)\GUM30C.tmp\goopdateres_cs.dll (28 bytes)
%Program Files% (x86)\GUM30C.tmp\goopdateres_ar.dll (26 bytes)
%Program Files% (x86)\GUM30C.tmp\goopdateres_ca.dll (29 bytes)
%Program Files% (x86)\GUM30C.tmp\goopdateres_zh-TW.dll (21 bytes)
%Program Files% (x86)\GUM30C.tmp\goopdateres_nl.dll (30 bytes)
%Program Files% (x86)\GUM30C.tmp\goopdateres_es-419.dll (29 bytes)
%Program Files% (x86)\GUM30C.tmp\goopdateres_is.dll (28 bytes)
%Program Files% (x86)\GUM30C.tmp\goopdateres_uk.dll (28 bytes)
%Program Files% (x86)\GUM30C.tmp\goopdateres_el.dll (30 bytes)
%Program Files% (x86)\GUM30C.tmp\goopdateres_sr.dll (29 bytes)
%Program Files% (x86)\GUM30C.tmp\goopdateres_lv.dll (30 bytes)
%Program Files% (x86)\GUM30C.tmp\goopdateres_zh-CN.dll (21 bytes)
%Program Files% (x86)\GUM30C.tmp\goopdateres_hu.dll (29 bytes)
%Program Files% (x86)\GUM30C.tmp\goopdateres_ta.dll (30 bytes)
%Program Files% (x86)\GUM30C.tmp\goopdateres_pl.dll (30 bytes)
%Program Files% (x86)\GUM30C.tmp\goopdateres_ru.dll (28 bytes)
%Program Files% (x86)\GUM30C.tmp\GoogleUpdateSetup.exe (5441 bytes)
%Program Files% (x86)\GUM30C.tmp\goopdateres_ro.dll (29 bytes)
%Program Files% (x86)\GUM30C.tmp\goopdateres_lt.dll (28 bytes)
%Program Files% (x86)\GUM30C.tmp\goopdateres_te.dll (29 bytes)
%Program Files% (x86)\GUM30C.tmp\goopdateres_fil.dll (30 bytes)
%Program Files% (x86)\GUM30C.tmp\goopdateres_fa.dll (27 bytes)
%Program Files% (x86)\GUM30C.tmp (28 bytes)
%Program Files% (x86)\GUM30C.tmp\goopdateres_ms.dll (28 bytes)
%Program Files% (x86)\GUM30C.tmp\GoogleUpdateOnDemand.exe (59 bytes)
%Program Files% (x86)\GUM30C.tmp\goopdateres_id.dll (28 bytes)
%Program Files% (x86)\GUM30C.tmp\goopdateres_sw.dll (29 bytes)
%Program Files% (x86)\GUM30C.tmp\goopdateres_hr.dll (29 bytes)
%Program Files% (x86)\GUM30C.tmp\goopdateres_iw.dll (26 bytes)
%Program Files% (x86)\GUM30C.tmp\GoogleUpdate.exe (234 bytes)
%Program Files% (x86)\GUM30C.tmp\goopdateres_ml.dll (31 bytes)
%Program Files% (x86)\GUM30C.tmp\goopdateres_tr.dll (29 bytes)
%Program Files% (x86)\GUM30C.tmp\goopdateres_da.dll (29 bytes)
%Program Files% (x86)\GUM30C.tmp\GoogleCrashHandler64.exe (550 bytes)
%Program Files% (x86)\GUM30C.tmp\goopdateres_hi.dll (29 bytes)
%Program Files% (x86)\GUM30C.tmp\goopdateres_it.dll (30 bytes)
%Program Files% (x86)\GUT30D.tmp (4 bytes)
%Program Files% (x86)\GUM30C.tmp\npGoogleUpdate3.dll (838 bytes)
%Program Files% (x86)\GUM30C.tmp\goopdateres_en.dll (27 bytes)
%Program Files% (x86)\GUM30C.tmp\goopdateres_no.dll (29 bytes)
%Program Files% (x86)\GUM30C.tmp\goopdateres_pt-PT.dll (29 bytes)
%Program Files% (x86)\GUM30C.tmp\goopdateres_fi.dll (29 bytes)
%Program Files% (x86)\GUM30C.tmp\goopdateres_es.dll (31 bytes)
%Program Files% (x86)\GUM30C.tmp\goopdateres_en-GB.dll (28 bytes)
%Program Files% (x86)\GUM30C.tmp\goopdateres_ja.dll (24 bytes)
%Program Files% (x86)\GUM30C.tmp\GoogleCrashHandler.exe (212 bytes)
%Program Files% (x86)\GUM30C.tmp\goopdateres_et.dll (28 bytes)
%Program Files% (x86)\GUM30C.tmp\goopdateres_sk.dll (29 bytes)
%Program Files% (x86)\GUM30C.tmp\goopdateres_fr.dll (30 bytes)
%Program Files% (x86)\GUM30C.tmp\goopdateres_bn.dll (28 bytes)

The process GoogleUpdateSetup_latest.exe:2188 makes changes in the file system.

The PUP creates and/or writes to the following file(s):

%Program Files% (x86)\GUM98D5.tmp\GoogleCrashHandler64.exe (550 bytes)
%Program Files% (x86)\GUM98D5.tmp\GoogleUpdateOnDemand.exe (59 bytes)
%Program Files% (x86)\GUM98D5.tmp\goopdateres_it.dll (30 bytes)
%Program Files% (x86)\GUM98D5.tmp\goopdateres_ca.dll (29 bytes)
%Program Files% (x86)\GUM98D5.tmp\goopdateres_et.dll (28 bytes)
%Program Files% (x86)\GUM98D5.tmp\goopdateres_es-419.dll (29 bytes)
%Program Files% (x86)\GUM98D5.tmp\goopdateres_ru.dll (28 bytes)
%Program Files% (x86)\GUM98D5.tmp\goopdateres_ja.dll (24 bytes)
%Program Files% (x86)\GUM98D5.tmp\goopdateres_hi.dll (29 bytes)
%Program Files% (x86)\GUM98D5.tmp\goopdateres_pl.dll (30 bytes)
%Program Files% (x86)\GUM98D5.tmp\goopdateres_iw.dll (26 bytes)
%Program Files% (x86)\GUM98D5.tmp\goopdateres_lv.dll (30 bytes)
%Program Files% (x86)\GUM98D5.tmp\goopdateres_id.dll (28 bytes)
%Program Files% (x86)\GUM98D5.tmp\goopdateres_nl.dll (30 bytes)
%Program Files% (x86)\GUM98D5.tmp\goopdateres_is.dll (28 bytes)
%Program Files% (x86)\GUM98D5.tmp\GoogleUpdateHelper.msi (25 bytes)
%Program Files% (x86)\GUM98D5.tmp\goopdateres_ko.dll (23 bytes)
%Program Files% (x86)\GUM98D5.tmp\goopdateres_zh-CN.dll (21 bytes)
%Program Files% (x86)\GUM98D5.tmp\goopdateres_tr.dll (29 bytes)
%Program Files% (x86)\GUM98D5.tmp\goopdateres_am.dll (25 bytes)
%Program Files% (x86)\GUM98D5.tmp\goopdateres_hu.dll (29 bytes)
%Program Files% (x86)\GUM98D5.tmp\goopdateres_en-GB.dll (28 bytes)
%Program Files% (x86)\GUM98D5.tmp\goopdateres_sr.dll (29 bytes)
%Program Files% (x86)\GUM98D5.tmp\goopdateres_fil.dll (30 bytes)
%Program Files% (x86)\GUM98D5.tmp\goopdateres_sw.dll (29 bytes)
%Program Files% (x86)\GUM98D5.tmp\GoogleUpdate.exe (234 bytes)
%Program Files% (x86)\GUM98D5.tmp\goopdateres_el.dll (30 bytes)
%Program Files% (x86)\GUM98D5.tmp\goopdateres_lt.dll (28 bytes)
%Program Files% (x86)\GUM98D5.tmp\goopdateres_hr.dll (29 bytes)
%Program Files% (x86)\GUM98D5.tmp\goopdateres_uk.dll (28 bytes)
%Program Files% (x86)\GUM98D5.tmp\goopdateres_en.dll (27 bytes)
%Program Files% (x86)\GUM98D5.tmp\goopdateres_ro.dll (29 bytes)
%Program Files% (x86)\GUT98D6.tmp (4 bytes)
%Program Files% (x86)\GUM98D5.tmp\goopdateres_sl.dll (29 bytes)
%Program Files% (x86)\GUM98D5.tmp\npGoogleUpdate3.dll (838 bytes)
%Program Files% (x86)\GUM98D5.tmp\goopdateres_da.dll (29 bytes)
%Program Files% (x86)\GUM98D5.tmp\goopdateres_ar.dll (26 bytes)
%Program Files% (x86)\GUM98D5.tmp\goopdateres_cs.dll (28 bytes)
%Program Files% (x86)\GUM98D5.tmp\psuser.dll (159 bytes)
%Program Files% (x86)\GUM98D5.tmp (28 bytes)
%Program Files% (x86)\GUM98D5.tmp\goopdateres_te.dll (29 bytes)
%Program Files% (x86)\GUM98D5.tmp\goopdateres_zh-TW.dll (21 bytes)
%Program Files% (x86)\GUM98D5.tmp\goopdateres_ml.dll (31 bytes)
%Program Files% (x86)\GUM98D5.tmp\goopdateres_kn.dll (29 bytes)
%Program Files% (x86)\GUM98D5.tmp\goopdateres_gu.dll (28 bytes)
%Program Files% (x86)\GUM98D5.tmp\GoogleUpdateBroker.exe (59 bytes)
%Program Files% (x86)\GUM98D5.tmp\goopdateres_fr.dll (30 bytes)
%Program Files% (x86)\GUM98D5.tmp\goopdateres_de.dll (31 bytes)
%Program Files% (x86)\GUM98D5.tmp\goopdateres_ur.dll (28 bytes)
%Program Files% (x86)\GUM98D5.tmp\goopdateres_fi.dll (29 bytes)
%Program Files% (x86)\GUM98D5.tmp\goopdateres_es.dll (31 bytes)
%Program Files% (x86)\GUM98D5.tmp\goopdateres_sv.dll (29 bytes)
%Program Files% (x86)\GUM98D5.tmp\GoogleCrashHandler.exe (212 bytes)
%Program Files% (x86)\GUM98D5.tmp\goopdateres_th.dll (27 bytes)
%Program Files% (x86)\GUM98D5.tmp\psmachine.dll (159 bytes)
%Program Files% (x86)\GUM98D5.tmp\goopdateres_ms.dll (28 bytes)
%Program Files% (x86)\GUM98D5.tmp\goopdateres_ta.dll (30 bytes)
%Program Files% (x86)\GUM98D5.tmp\goopdateres_vi.dll (28 bytes)
%Program Files% (x86)\GUM98D5.tmp\goopdateres_bg.dll (30 bytes)
%Program Files% (x86)\GUM98D5.tmp\goopdateres_fa.dll (27 bytes)
%Program Files% (x86)\GUM98D5.tmp\GoogleUpdateSetup.exe (5441 bytes)
%Program Files% (x86)\GUM98D5.tmp\goopdateres_sk.dll (29 bytes)
%Program Files% (x86)\GUM98D5.tmp\goopdateres_pt-BR.dll (29 bytes)
%Program Files% (x86)\GUM98D5.tmp\goopdateres_mr.dll (28 bytes)
%Program Files% (x86)\GUM98D5.tmp\goopdate.dll (1702 bytes)
%Program Files% (x86)\GUM98D5.tmp\goopdateres_bn.dll (28 bytes)
%Program Files% (x86)\GUM98D5.tmp\goopdateres_pt-PT.dll (29 bytes)
%Program Files% (x86)\GUM98D5.tmp\goopdateres_no.dll (29 bytes)

The process ffsetup.exe:2652 makes changes in the file system.

The PUP creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\n1s\nchdata.dat (18795 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\n1s\nchsetup.cab (382 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\n1s\nchdata.cab (143 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\n1s\nchsetup.exe (18257 bytes)

The process SearchWithGoogleUpdate_6F4EEAE8D7FCDAD8.exe:304 makes changes in the file system.

The PUP creates and/or writes to the following file(s):

%Program Files% (x86)\Google\GoogleToolbarNotifier\5.10.11023.1534\gtn.dll (144 bytes)
%Program Files% (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (79 bytes)
%Program Files% (x86)\Google\GoogleToolbarNotifier\5.10.11023.1534\gth.dll (40 bytes)
%Program Files%\Google\GoogleToolbarNotifier\5.10.11023.1534\swg64.dll (298 bytes)
%Program Files% (x86)\Google\GoogleToolbarNotifier\5.10.11023.1534\swg.dll (981 bytes)
%Program Files% (x86)\Google\GoogleToolbarNotifier\5.10.11023.1534\Readme.url (212 bytes)

The process GoogleToolbarNotifier.exe:1636 makes changes in the file system.

The PUP creates and/or writes to the following file(s):

%Program Files% (x86)\Google\GoogleToolbarNotifier\5.10.11023.1534\swg.dll (983 bytes)
%Program Files% (x86)\Google\GoogleToolbarNotifier\5.10.11023.1534\gtn.dll (147 bytes)

The process %original file name%.exe:624 makes changes in the file system.

The PUP creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\n1s\nchdata.dat (7384 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\n1s\nchsetup.cab (646 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\n1s\nchdata.cab (270 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\n1s\nchsetup.exe (29704 bytes)

Registry activity

The process GoogleUpdate.exe:1704 makes changes in the system registry.

The PUP creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{F69EABDD-A4BB-4555-BE7E-1EA5F59BBA24}]
"DayOfLastActivity" = "4294967295"
"usagestats" = "0"
"pv" = "7.5.6227.252"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{F69EABDD-A4BB-4555-BE7E-1EA5F59BBA24}\CurrentState]
"InstallProgressPercent" = "4294967295"
"StateValue" = "3"
"DownloadTimeRemainingMs" = "4294967295"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{F69EABDD-A4BB-4555-BE7E-1EA5F59BBA24}]
"LastCheckSuccess" = "1432028303"

[HKCU\Software\Google\Update\proxy]
"source" = "IEWPAD"

[HKCU\Software\Classes\Local Settings\MuiCache\2C\52C64B7E]
"LanguageList" = "en-US, en"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{F69EABDD-A4BB-4555-BE7E-1EA5F59BBA24}]
"DayOfInstall" = "3060"
"InstallTime" = "1432028284"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{F69EABDD-A4BB-4555-BE7E-1EA5F59BBA24}\CurrentState]
"InstallTimeRemainingMs" = "4294967295"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{F69EABDD-A4BB-4555-BE7E-1EA5F59BBA24}]
"DayOfLastRollCall" = "4294967295"
"brand" = "NCHD"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{F69EABDD-A4BB-4555-BE7E-1EA5F59BBA24}\CurrentState]
"DownloadProgressPercent" = "0"

The PUP deletes the following registry key(s):

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{F69EABDD-A4BB-4555-BE7E-1EA5F59BBA24}\CurrentState]

The PUP deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Google\Update]
"LastInstallerExtraCode1"
"LastInstallerSuccessLaunchCmdLine"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientStateMedium\{F69EABDD-A4BB-4555-BE7E-1EA5F59BBA24}]
"eulaaccepted"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{F69EABDD-A4BB-4555-BE7E-1EA5F59BBA24}]
"UpdateAvailableCount"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientStateMedium\{F69EABDD-A4BB-4555-BE7E-1EA5F59BBA24}]
"usagestats"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{F69EABDD-A4BB-4555-BE7E-1EA5F59BBA24}]
"ap"

[HKLM\SOFTWARE\Wow6432Node\Google\Update]
"LastInstallerResult"
"old-uid"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{F69EABDD-A4BB-4555-BE7E-1EA5F59BBA24}]
"iid"

[HKLM\SOFTWARE\Wow6432Node\Google\Update]
"uid"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{F69EABDD-A4BB-4555-BE7E-1EA5F59BBA24}]
"LastInstallerResult"

[HKLM\SOFTWARE\Wow6432Node\Google\Update]
"LastInstallerResultUIString"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{F69EABDD-A4BB-4555-BE7E-1EA5F59BBA24}]
"eulaaccepted"
"UpdateAvailableSince"
"LastInstallerError"
"LastInstallerResultUIString"
"experiment_labels"
"tttoken"

[HKLM\SOFTWARE\Wow6432Node\Google\Update]
"LastInstallerError"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{F69EABDD-A4BB-4555-BE7E-1EA5F59BBA24}]
"browser"
"LastInstallerExtraCode1"
"LastInstallerSuccessLaunchCmdLine"

The process GoogleUpdate.exe:3660 makes changes in the system registry.

The PUP creates and/or sets the following values in system registry:

[HKCU\Software\Google\Update\proxy]
"source" = "IEWPAD"

[HKCU\Software\Classes\Local Settings\MuiCache\2E\52C64B7E]
"LanguageList" = "en-US, en"

The PUP deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Google\Update]
"uid"
"old-uid"

The process GoogleUpdate.exe:3252 makes changes in the system registry.

The PUP creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{F69EABDD-A4BB-4555-BE7E-1EA5F59BBA24}]
"usagestats" = "0"

The PUP deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Google\Update]
"uid"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}]
"UpdateAvailableSince"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientStateMedium\{F69EABDD-A4BB-4555-BE7E-1EA5F59BBA24}]
"usagestats"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}]
"UpdateAvailableCount"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\network\secure]
"sk"

[HKLM\SOFTWARE\Wow6432Node\Google\Update]
"eulaaccepted"

[HKCU\Software\Google\Update]
"old-uid"

[HKLM\SOFTWARE\Wow6432Node\Google\Update]
"old-uid"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\network\secure]
"c"

[HKCU\Software\Google\Update]
"uid"

The process GoogleUpdate.exe:1684 makes changes in the system registry.

The PUP creates and/or sets the following values in system registry:

[HKCU\Software\Google\Update\proxy]
"source" = "IEWPAD"

[HKCU\Software\Classes\Local Settings\MuiCache\2C\52C64B7E]
"LanguageList" = "en-US, en"

The PUP deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Google\Update]
"uid"
"old-uid"

The process GoogleUpdate.exe:280 makes changes in the system registry.

The PUP creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{F69EABDD-A4BB-4555-BE7E-1EA5F59BBA24}]
"usagestats" = "0"

The PUP deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Google\Update]
"uid"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}]
"UpdateAvailableSince"
"UpdateAvailableCount"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\network\secure]
"sk"

[HKLM\SOFTWARE\Wow6432Node\Google\Update]
"eulaaccepted"

[HKCU\Software\Google\Update]
"old-uid"

[HKLM\SOFTWARE\Wow6432Node\Google\Update]
"old-uid"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\network\secure]
"c"

[HKCU\Software\Google\Update]
"uid"

The process GoogleUpdate.exe:328 makes changes in the system registry.

The PUP creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{F69EABDD-A4BB-4555-BE7E-1EA5F59BBA24}]
"usagestats" = "0"

The PUP deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Google\Update]
"uid"
"old-uid"
"eulaaccepted"

The process GoogleUpdate.exe:3284 makes changes in the system registry.

The PUP creates and/or sets the following values in system registry:

[HKCU\Software\Google\Update\proxy]
"source" = "IEWPAD"

[HKCU\Software\Classes\Local Settings\MuiCache\2D\52C64B7E]
"LanguageList" = "en-US, en"

The PUP deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Google\Update]
"uid"
"old-uid"

The process GoogleUpdate.exe:3296 makes changes in the system registry.

The PUP creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{F69EABDD-A4BB-4555-BE7E-1EA5F59BBA24}]
"usagestats" = "0"

The PUP deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Google\Update]
"uid"
"old-uid"
"eulaaccepted"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientStateMedium\{F69EABDD-A4BB-4555-BE7E-1EA5F59BBA24}]
"usagestats"

The process GoogleUpdate.exe:3160 makes changes in the system registry.

The PUP creates and/or sets the following values in system registry:

[HKCU\Software\Google\Update\proxy]
"source" = "IEWPAD"

[HKCU\Software\Classes\Local Settings\MuiCache\2D\52C64B7E]
"LanguageList" = "en-US, en"

The PUP deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Google\Update]
"uid"
"old-uid"

The process googletoolbarinstaller_en_signed.exe:2208 makes changes in the system registry.

The PUP creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKLM\SOFTWARE\Wow6432Node\Google\Google Toolbar\Branding]
"sin" = "0"

[HKLM\SOFTWARE\Wow6432Node\Google\Google Toolbar\Component]
"NextVersion" = "7.5.6227.252"
"currentVersion" = "7.5.6227.252"

[HKLM\SOFTWARE\Wow6432Node\Google\Google Toolbar\Branding]
"ein" = "1"

[HKCU\Software\Google\Google Toolbar\4.0\Setup]
"InstallProgress" = "3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 45 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Classes\Local Settings\MuiCache\2C\52C64B7E]
"LanguageList" = "en-US, en"

[HKLM\SOFTWARE\Wow6432Node\Google\Google Toolbar]
"test" = "41"

[HKLM\SOFTWARE\Wow6432Node\Google\Google Toolbar\4.0\Setup]
"EnabledExperiments" = "POSI,PUMA"

[HKCU\Software\Google\Google Toolbar\4.0\Setup]
"Command" = "2"

[HKLM\SOFTWARE\Wow6432Node\Google\Google Toolbar\4.0\Setup]
"FirstInstallTime" = "1432028303"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The PUP deletes the following value(s) in system registry:

[HKCU\Software\Google\Google Toolbar]
"LastInstallError"

[HKLM\SOFTWARE\Wow6432Node\Google\Google Toolbar\Component]
"NextVersion"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"
"ProxyServer"

[HKLM\SOFTWARE\Wow6432Node\Google\Google Toolbar\Component]
"PrimaryInstallDone"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

[HKLM\SOFTWARE\Wow6432Node\Google\Google Toolbar\4.0\Setup]
"FailedInstallPing"

The process googletoolbarinstaller_en_signed.exe:3468 makes changes in the system registry.

The PUP creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKLM\SOFTWARE\Wow6432Node\Google\Google Toolbar\Branding]
"sin" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKLM\SOFTWARE\Wow6432Node\Google\Google Toolbar\Component]
"NextVersion" = "7.5.6227.252"
"currentVersion" = "7.5.6227.252"

[HKLM\SOFTWARE\Wow6432Node\Google\Google Toolbar\Branding]
"ein" = "1"

[HKCU\Software\Google\Google Toolbar\4.0\Setup]
"InstallProgress" = "3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Classes\Local Settings\MuiCache\2D\52C64B7E]
"LanguageList" = "en-US, en"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 46 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "68 F8 F4 8D 17 92 D0 01"

[HKLM\SOFTWARE\Wow6432Node\Google\Google Toolbar]
"test" = "41"

[HKLM\SOFTWARE\Wow6432Node\Google\Google Toolbar\4.0\Setup]
"EnabledExperiments" = "POSI,PUMA"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Google\Google Toolbar\4.0\Setup]
"Command" = "2"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The PUP deletes the following value(s) in system registry:

[HKCU\Software\Google\Google Toolbar]
"LastInstallError"

[HKLM\SOFTWARE\Wow6432Node\Google\Google Toolbar\Component]
"NextVersion"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"
"ProxyServer"

[HKLM\SOFTWARE\Wow6432Node\Google\Google Toolbar\Component]
"PrimaryInstallDone"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

[HKLM\SOFTWARE\Wow6432Node\Google\Google Toolbar\4.0\Setup]
"FailedInstallPing"

The process GoogleToolbarManager_BA9226F4C70BECC2.exe:3600 makes changes in the system registry.

The PUP creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Google\Google Toolbar\Component\Used]
"GoogleToolbarDynamic_mui_en.dll" = "1"

The process GoogleToolbarManager_BA9226F4C70BECC2.exe:3108 makes changes in the system registry.

The PUP creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Google\Google Toolbar\Component\NonManifest\C:\ProgramData\Google\Custom Buttons]
"toolbar.google.com_O8Y91YHB24Z6SR0SGYSK.XML" = "1"

[HKLM\SOFTWARE\Wow6432Node\Google\Google Toolbar\Component\Used]
"GoogleToolbarDynamic_mui_en.dll" = "1"

The process GoogleToolbarManager_BA9226F4C70BECC2.exe:3588 makes changes in the system registry.

The PUP creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Google\Google Toolbar\Component\Used]
"GoogleToolbarManager.exe" = "1"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\Clients\{F69EABDD-A4BB-4555-BE7E-1EA5F59BBA24}]
"pv" = "7.5.6227.252"

The process GoogleToolbarManager_BA9226F4C70BECC2.exe:3492 makes changes in the system registry.

The PUP creates and/or sets the following values in system registry:

[HKCR\CLSID\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
"(Default)" = "Google Toolbar Helper"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{2318C2B1-4965-11d4-9B18-009027A5CD4F}]
"DisplayVersion" = "7.5.6227.252"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EE0B94B9-335F-4d2c-8B43-DACCD1EA6FF1}]
"Policy" = "3"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EE0B94B9-335F-4d2c-8B43-DACCD1EA6FF1}]
"AppPath" = "%Program Files% (x86)\Google\Google Toolbar"

[HKCR\CLSID\{AA58ED58-01DD-4d91-8333-CF10577473F7}\InprocServer32]
"(Default)" = "%Program Files% (x86)\Google\Google Toolbar\GoogleToolbar_64.dll"

[HKLM\SOFTWARE\Wow6432Node\Google\Google Toolbar\4.0\Setup]
"SystemPatchLevel" = "2"

[HKLM\SOFTWARE\Wow6432Node\Google\Google Toolbar\GoogleUpdate]
"InstallTimestamp" = "1432028308"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1A972DAF-A7EC-4ce3-B6C9-7B523CD6685F}]
"Policy" = "3"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{2318C2B1-4965-11d4-9B18-009027A5CD4F}]
"Publisher" = "Google Inc."

[HKLM\SOFTWARE\Wow6432Node\Google\Google Toolbar\Component\Used]
"GoogleUpdaterService.exe" = "1"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = "00"

[HKLM\SOFTWARE\Wow6432Node\Google\Google Toolbar\Branding]
"InstallType" = "3"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EE0B94B9-335F-4d2c-8B43-DACCD1EA6FF1}]
"AppName" = "GoogleToolbarUser_64.exe"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = "00"

[HKLM\SOFTWARE\Wow6432Node\Google\Google Toolbar\4.0\Setup]
"AllowInteractions" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{2318C2B1-4965-11d4-9B18-009027A5CD4F}]
"DisplayName" = "Google Toolbar for Internet Explorer (x64)"

[HKCR\Wow6432Node\CLSID\{2318C2B1-4965-11d4-9B18-009027A5CD4F}]
"(Default)" = "Google Toolbar"

[HKLM\SOFTWARE\Wow6432Node\Google\Google Toolbar\4.0\Setup]
"EnableUsageStats" = "1"

[HKCR\CLSID\{2318C2B1-4965-11d4-9B18-009027A5CD4F}\InprocServer32]
"(Default)" = "%Program Files% (x86)\Google\Google Toolbar\GoogleToolbar_64.dll"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1A972DAF-A7EC-4ce3-B6C9-7B523CD6685F}]
"AppName" = "GoogleToolbarUser_32.exe"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{2318C2B1-4965-11d4-9B18-009027A5CD4F}]
"UninstallString" = "%Program Files% (x86)\Google\Google Toolbar\Component\GoogleToolbarManager_BA9226F4C70BECC2.exe /uninstall"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EE0B94B9-335F-4d2c-8B43-DACCD1EA6FF1}]
"AppName" = "GoogleToolbarUser_64.exe"

[HKLM\SOFTWARE\Wow6432Node\Google\Google Toolbar\Component\Used]
"SearchWithGoogleUpdate.exe" = "1"

[HKCR\Installer\Products\18555481990E8AB4CBB63FB4F26006C0]
"AuthorizedLUAApp" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{2318C2B1-4965-11d4-9B18-009027A5CD4F}]
"DisplayIcon" = "%Program Files% (x86)\Google\Google Toolbar\Component\GoogleToolbarManager_BA9226F4C70BECC2.exe"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\Clients\{F69EABDD-A4BB-4555-BE7E-1EA5F59BBA24}]
"cmd_7.5.6227.252_7" = "%Program Files% (x86)\Google\Google Toolbar\Component\GoogleToolbarManager_BA9226F4C70BECC2.exe /execute:7"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1A972DAF-A7EC-4ce3-B6C9-7B523CD6685F}]
"AppPath" = "%Program Files% (x86)\Google\Google Toolbar"

[HKCU\Software\Google\Google Toolbar\4.0\Options]
"ToastSetDefaultSearch" = "3"

[HKLM\SOFTWARE\Wow6432Node\Google\Google Toolbar]
"test" = "41"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1A972DAF-A7EC-4ce3-B6C9-7B523CD6685F}]
"AppName" = "GoogleToolbarUser_32.exe"

[HKCR\Wow6432Node\CLSID\{2318C2B1-4965-11d4-9B18-009027A5CD4F}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Google\Google Toolbar\4.0\Options]
"ToastSetPageRank" = "2"

[HKLM\SOFTWARE\Wow6432Node\Google\Google Toolbar\GoogleUpdate]
"InstallResult" = "pi"

[HKCU\Software\Google\Google Toolbar\4.0\Options]
"RbbsBreak" = "1"

[HKCR\Wow6432Node\CLSID\{AA58ED58-01DD-4d91-8333-CF10577473F7}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKLM\SOFTWARE\Wow6432Node\Google\Google Toolbar\4.0\Setup]
"EulaAccepted" = "1"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Enable Browser Extensions" = "yes"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EE0B94B9-335F-4d2c-8B43-DACCD1EA6FF1}]
"Policy" = "3"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{2318C2B1-4965-11d4-9B18-009027A5CD4F}]
"Compatibility Flags" = "1024"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\Clients\{F69EABDD-A4BB-4555-BE7E-1EA5F59BBA24}]
"cmd_7.5.6227.252_9" = "%Program Files% (x86)\Google\Google Toolbar\Component\GoogleToolbarManager_BA9226F4C70BECC2.exe /execute:9"
"cmd_7.5.6227.252_8" = "%Program Files% (x86)\Google\Google Toolbar\Component\GoogleToolbarManager_BA9226F4C70BECC2.exe /execute:8"

[HKLM\SOFTWARE\Wow6432Node\Google\Google Toolbar\Component\Used]
"GoogleToolbarManager.exe" = "1"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\Clients\{F69EABDD-A4BB-4555-BE7E-1EA5F59BBA24}]
"cmd_7.5.6227.252_6" = "%Program Files% (x86)\Google\Google Toolbar\Component\GoogleToolbarManager_BA9226F4C70BECC2.exe /execute:6"
"cmd_7.5.6227.252_5" = "%Program Files% (x86)\Google\Google Toolbar\Component\GoogleToolbarManager_BA9226F4C70BECC2.exe /execute:5"
"cmd_7.5.6227.252_4" = "%Program Files% (x86)\Google\Google Toolbar\Component\GoogleToolbarManager_BA9226F4C70BECC2.exe /execute:4"
"cmd_7.5.6227.252_3" = "%Program Files% (x86)\Google\Google Toolbar\Component\GoogleToolbarManager_BA9226F4C70BECC2.exe /execute:3"
"cmd_7.5.6227.252_2" = "%Program Files% (x86)\Google\Google Toolbar\Component\GoogleToolbarManager_BA9226F4C70BECC2.exe /execute:2"
"cmd_7.5.6227.252_1" = "%Program Files% (x86)\Google\Google Toolbar\Component\GoogleToolbarManager_BA9226F4C70BECC2.exe /execute:1"
"cmd_7.5.6227.252_0" = "%Program Files% (x86)\Google\Google Toolbar\Component\GoogleToolbarManager_BA9226F4C70BECC2.exe /execute:0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1A972DAF-A7EC-4ce3-B6C9-7B523CD6685F}]
"Policy" = "3"

[HKCU\Software\Classes\Local Settings\MuiCache\2E\52C64B7E\@%SystemRoot%\system32]
"p2pcollab.dll,-8042" = "Peer to Peer Trust"

[HKLM\SOFTWARE\Wow6432Node\Google\Google Toolbar\Component]
"PrimaryInstallDone" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{2318C2B1-4965-11d4-9B18-009027A5CD4F}]
"Compatibility Flags" = "1024"

[HKCU\Software\Google\Google Toolbar\4.0\Options]
"ToastSetHomePage" = "2"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1A972DAF-A7EC-4ce3-B6C9-7B523CD6685F}]
"AppPath" = "%Program Files% (x86)\Google\Google Toolbar"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"GTB7.5" = ""

[HKCR\Wow6432Node\CLSID\{2318C2B1-4965-11d4-9B18-009027A5CD4F}\InprocServer32]
"(Default)" = "%Program Files% (x86)\Google\Google Toolbar\GoogleToolbar_32.dll"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"GTB7.5" = ""

[HKLM\SOFTWARE\Wow6432Node\Google\Google Toolbar\Installations]
"1432028309" = "v=7.5.6227.252&tbbrand=NCHD&i=0"

[HKCR\Wow6432Node\CLSID\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
"(Default)" = "Google Toolbar Helper"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{2318C2B1-4965-11d4-9B18-009027A5CD4F}]
"MinorVersion" = "5"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\Clients\{F69EABDD-A4BB-4555-BE7E-1EA5F59BBA24}]
"Name" = "Google Toolbar"

[HKCR\CLSID\{2318C2B1-4965-11d4-9B18-009027A5CD4F}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\CLSID\{AA58ED58-01DD-4d91-8333-CF10577473F7}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{2318C2B1-4965-11d4-9B18-009027A5CD4F}]
"InstallLocation" = "%Program Files% (x86)\Google\Google Toolbar\"

[HKCU\Software\Classes\Local Settings\MuiCache\2E\52C64B7E\@%SystemRoot%\system32]
"dnsapi.dll,-103" = "Domain Name System (DNS) Server Trust"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{2318C2B1-4965-11d4-9B18-009027A5CD4F}]
"NoModify" = "1"
"MajorVersion" = "7"
"NoRepair" = "1"

[HKCU\Software\Classes\Local Settings\MuiCache\2E\52C64B7E]
"LanguageList" = "en-US, en"

[HKCR\CLSID\{2318C2B1-4965-11d4-9B18-009027A5CD4F}]
"(Default)" = "Google Toolbar"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{F69EABDD-A4BB-4555-BE7E-1EA5F59BBA24}]
"brand" = "NCHD"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EE0B94B9-335F-4d2c-8B43-DACCD1EA6FF1}]
"AppPath" = "%Program Files% (x86)\Google\Google Toolbar"

[HKCR\Wow6432Node\CLSID\{AA58ED58-01DD-4d91-8333-CF10577473F7}\InprocServer32]
"(Default)" = "%Program Files% (x86)\Google\Google Toolbar\GoogleToolbar_32.dll"

The PUP deletes the following registry key(s):

[HKCR\Wow6432Node\CLSID\{2318C2B1-4965-11d4-9B18-009027A5CD4F}]
[HKCR\CLSID\{2318C2B1-4965-11d4-9B18-009027A5CD4F}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}]
[HKCR\Wow6432Node\CLSID\{2318C2B1-4965-11d4-9B18-009027A5CD4F}\Implemented Categories]
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{2318C2B1-4965-11d4-9B18-009027A5CD4F}]
[HKCR\CLSID\{2318C2B1-4965-11d4-9B18-009027A5CD4F}\Implemented Categories]
[HKCR\CLSID\{AA58ED58-01DD-4d91-8333-CF10577473F7}\Implemented Categories]
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{2318C2B1-4965-11d4-9B18-009027A5CD4F}]
[HKCU\Software\Classes\Local Settings\MuiCache\2D]
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
[HKCR\CLSID\{2318C2B1-4965-11d4-9B18-009027A5CD4F}]
[HKCR\Wow6432Node\CLSID\{AA58ED58-01DD-4d91-8333-CF10577473F7}\InprocServer32]
[HKCU\Software\Classes\Local Settings\MuiCache\2D\52C64B7E]
[HKCR\Wow6432Node\CLSID\{2318C2B1-4965-11d4-9B18-009027A5CD4F}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}]
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4D91-8333-CF10577473F7}]
[HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{2318C2B1-4965-11d4-9B18-009027A5CD4F}]
[HKCR\Wow6432Node\CLSID\{2318C2B1-4965-11d4-9B18-009027A5CD4F}\InprocServer32]
[HKCR\CLSID\{AA58ED58-01DD-4d91-8333-CF10577473F7}\InprocServer32]
[HKCR\CLSID\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
[HKCR\Wow6432Node\CLSID\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
[HKCR\Wow6432Node\CLSID\{AA58ED58-01DD-4d91-8333-CF10577473F7}\Implemented Categories]
[HKCR\CLSID\{AA58ED58-01DD-4d91-8333-CF10577473F7}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}]
[HKCR\Wow6432Node\CLSID\{AA58ED58-01DD-4d91-8333-CF10577473F7}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}]
[HKCR\CLSID\{2318C2B1-4965-11d4-9B18-009027A5CD4F}\InprocServer32]

The PUP deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"GTB7.5"

[HKLM\SOFTWARE\Wow6432Node\Google\Google Toolbar\4.0\Setup]
"UseIe64"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}"

[HKCU\Software\Google\Google Toolbar\4.0\Options]
"Vendor"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"GTB7.5"

[HKCU\Software\Google\Google Toolbar\4.0]
"Update"

[HKCU\Software\Google\Google Toolbar\4.0\Options]
"Hidden"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}"

[HKLM\SOFTWARE\Wow6432Node\Google\Google Toolbar\4.0\Setup]
"RefreshIE"

[HKLM\SOFTWARE\Wow6432Node\Google\Google Toolbar\Installations]
"1432028302"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\Clients\{F69EABDD-A4BB-4555-BE7E-1EA5F59BBA24}]
"lang"

[HKLM\SOFTWARE\Wow6432Node\Google\Google Toolbar\4.0\Setup]
"WelcomePage"

The process GoogleToolbarManager_BA9226F4C70BECC2.exe:3096 makes changes in the system registry.

The PUP creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Google\Google Toolbar\Component\Used]
"GoogleToolbarManager.exe" = "1"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\Clients\{F69EABDD-A4BB-4555-BE7E-1EA5F59BBA24}]
"pv" = "7.5.6227.252"

The process GoogleToolbarManager_BA9226F4C70BECC2.exe:1404 makes changes in the system registry.

The PUP creates and/or sets the following values in system registry:

[HKCR\CLSID\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
"(Default)" = "Google Toolbar Helper"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{2318C2B1-4965-11d4-9B18-009027A5CD4F}]
"DisplayVersion" = "7.5.6227.252"

[HKLM\SOFTWARE\Wow6432Node\Google\Google Toolbar\4.0\Setup]
"ToastOfferTime" = "0"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EE0B94B9-335F-4d2c-8B43-DACCD1EA6FF1}]
"AppPath" = "%Program Files% (x86)\Google\Google Toolbar"

[HKCR\Wow6432Node\CLSID\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
"(Default)" = "Google Toolbar Helper"

[HKCR\CLSID\{AA58ED58-01DD-4d91-8333-CF10577473F7}\InprocServer32]
"(Default)" = "%Program Files% (x86)\Google\Google Toolbar\GoogleToolbar_64.dll"

[HKLM\SOFTWARE\Wow6432Node\Google\Google Toolbar\4.0\Setup]
"SystemPatchLevel" = "1"

[HKLM\SOFTWARE\Wow6432Node\Google\Google Toolbar\GoogleUpdate]
"InstallTimestamp" = "1432028285"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1A972DAF-A7EC-4ce3-B6C9-7B523CD6685F}]
"Policy" = "3"

[HKCU\Software\Classes\Local Settings\MuiCache\2D\52C64B7E]
"LanguageList" = "en-US, en"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EE0B94B9-335F-4d2c-8B43-DACCD1EA6FF1}]
"Policy" = "3"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{2318C2B1-4965-11d4-9B18-009027A5CD4F}]
"Publisher" = "Google Inc."

[HKLM\SOFTWARE\Wow6432Node\Google\Google Toolbar\Component\Used]
"GoogleUpdaterService.exe" = "1"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = "00"

[HKLM\SOFTWARE\Wow6432Node\Google\Google Toolbar\Branding]
"InstallType" = "3"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EE0B94B9-335F-4d2c-8B43-DACCD1EA6FF1}]
"AppName" = "GoogleToolbarUser_64.exe"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = "00"

[HKLM\SOFTWARE\Wow6432Node\Google\Google Toolbar\4.0\Setup]
"AllowInteractions" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{2318C2B1-4965-11d4-9B18-009027A5CD4F}]
"DisplayName" = "Google Toolbar for Internet Explorer"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1A972DAF-A7EC-4ce3-B6C9-7B523CD6685F}]
"AppPath" = "%Program Files% (x86)\Google\Google Toolbar"

[HKLM\SOFTWARE\Wow6432Node\Google\Google Toolbar\4.0\Setup]
"EnableUsageStats" = "1"

[HKCR\CLSID\{2318C2B1-4965-11d4-9B18-009027A5CD4F}\InprocServer32]
"(Default)" = "%Program Files% (x86)\Google\Google Toolbar\GoogleToolbar_64.dll"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1A972DAF-A7EC-4ce3-B6C9-7B523CD6685F}]
"AppName" = "GoogleToolbarUser_32.exe"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{2318C2B1-4965-11d4-9B18-009027A5CD4F}]
"UninstallString" = "%Program Files% (x86)\Google\Google Toolbar\Component\GoogleToolbarManager_BA9226F4C70BECC2.exe /uninstall"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EE0B94B9-335F-4d2c-8B43-DACCD1EA6FF1}]
"AppName" = "GoogleToolbarUser_64.exe"

[HKLM\SOFTWARE\Wow6432Node\Google\Google Toolbar\Component\Used]
"SearchWithGoogleUpdate.exe" = "1"

[HKCU\Software\Google\Google Toolbar\4.0\Options]
"{14C626CA-ACAB-46e5-8A99-53C9E11CCCA0}_enabled" = "0"

[HKLM\SOFTWARE\Wow6432Node\Google\Google Toolbar\Branding]
"InstallTime" = "1432028285"

[HKCR\Installer\Products\18555481990E8AB4CBB63FB4F26006C0]
"AuthorizedLUAApp" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{2318C2B1-4965-11d4-9B18-009027A5CD4F}]
"DisplayIcon" = "%Program Files% (x86)\Google\Google Toolbar\Component\GoogleToolbarManager_BA9226F4C70BECC2.exe"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\Clients\{F69EABDD-A4BB-4555-BE7E-1EA5F59BBA24}]
"cmd_7.5.6227.252_7" = "%Program Files% (x86)\Google\Google Toolbar\Component\GoogleToolbarManager_BA9226F4C70BECC2.exe /execute:7"

[HKCU\Software\Google\Google Toolbar\4.0\Options]
"ButtonPageRank" = "0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1A972DAF-A7EC-4ce3-B6C9-7B523CD6685F}]
"AppPath" = "%Program Files% (x86)\Google\Google Toolbar"

[HKCU\Software\Google\Google Toolbar\4.0\Options]
"ToastSetDefaultSearch" = "3"

[HKLM\SOFTWARE\Wow6432Node\Google\Google Toolbar]
"test" = "41"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1A972DAF-A7EC-4ce3-B6C9-7B523CD6685F}]
"AppName" = "GoogleToolbarUser_32.exe"

[HKCR\Wow6432Node\CLSID\{2318C2B1-4965-11d4-9B18-009027A5CD4F}]
"(Default)" = "Google Toolbar"

[HKCR\Wow6432Node\CLSID\{2318C2B1-4965-11d4-9B18-009027A5CD4F}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Google\Google Toolbar\4.0\Options]
"ToastSetPageRank" = "2"

[HKLM\SOFTWARE\Wow6432Node\Google\Google Toolbar\GoogleUpdate]
"InstallResult" = "pi"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\Clients\{F69EABDD-A4BB-4555-BE7E-1EA5F59BBA24}]
"cmd_7.5.6227.252_5" = "%Program Files% (x86)\Google\Google Toolbar\Component\GoogleToolbarManager_BA9226F4C70BECC2.exe /execute:5"

[HKCR\Wow6432Node\CLSID\{AA58ED58-01DD-4d91-8333-CF10577473F7}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKLM\SOFTWARE\Wow6432Node\Google\Google Toolbar\4.0\Setup]
"EulaAccepted" = "1"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Enable Browser Extensions" = "yes"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EE0B94B9-335F-4d2c-8B43-DACCD1EA6FF1}]
"Policy" = "3"

[HKCU\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32]
"dnsapi.dll,-103" = "Domain Name System (DNS) Server Trust"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{2318C2B1-4965-11d4-9B18-009027A5CD4F}]
"Compatibility Flags" = "1024"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\Clients\{F69EABDD-A4BB-4555-BE7E-1EA5F59BBA24}]
"cmd_7.5.6227.252_9" = "%Program Files% (x86)\Google\Google Toolbar\Component\GoogleToolbarManager_BA9226F4C70BECC2.exe /execute:9"
"cmd_7.5.6227.252_8" = "%Program Files% (x86)\Google\Google Toolbar\Component\GoogleToolbarManager_BA9226F4C70BECC2.exe /execute:8"

[HKLM\SOFTWARE\Wow6432Node\Google\Google Toolbar\Component\Used]
"GoogleToolbarManager.exe" = "1"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\Clients\{F69EABDD-A4BB-4555-BE7E-1EA5F59BBA24}]
"cmd_7.5.6227.252_6" = "%Program Files% (x86)\Google\Google Toolbar\Component\GoogleToolbarManager_BA9226F4C70BECC2.exe /execute:6"

[HKLM\SOFTWARE\Wow6432Node\Google\Google Toolbar\Branding]
"brand" = "NCHD"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\Clients\{F69EABDD-A4BB-4555-BE7E-1EA5F59BBA24}]
"cmd_7.5.6227.252_4" = "%Program Files% (x86)\Google\Google Toolbar\Component\GoogleToolbarManager_BA9226F4C70BECC2.exe /execute:4"
"cmd_7.5.6227.252_3" = "%Program Files% (x86)\Google\Google Toolbar\Component\GoogleToolbarManager_BA9226F4C70BECC2.exe /execute:3"
"cmd_7.5.6227.252_2" = "%Program Files% (x86)\Google\Google Toolbar\Component\GoogleToolbarManager_BA9226F4C70BECC2.exe /execute:2"
"cmd_7.5.6227.252_1" = "%Program Files% (x86)\Google\Google Toolbar\Component\GoogleToolbarManager_BA9226F4C70BECC2.exe /execute:1"
"cmd_7.5.6227.252_0" = "%Program Files% (x86)\Google\Google Toolbar\Component\GoogleToolbarManager_BA9226F4C70BECC2.exe /execute:0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1A972DAF-A7EC-4ce3-B6C9-7B523CD6685F}]
"Policy" = "3"

[HKCU\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32]
"p2pcollab.dll,-8042" = "Peer to Peer Trust"

[HKLM\SOFTWARE\Wow6432Node\Google\Google Toolbar\Component]
"PrimaryInstallDone" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{2318C2B1-4965-11d4-9B18-009027A5CD4F}]
"Compatibility Flags" = "1024"

[HKCU\Software\Google\Google Toolbar\4.0\Options]
"ToastSetHomePage" = "2"
"BrowseByName" = "0"
"RbbsBreak" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"GTB7.5" = ""

[HKCR\Wow6432Node\CLSID\{2318C2B1-4965-11d4-9B18-009027A5CD4F}\InprocServer32]
"(Default)" = "%Program Files% (x86)\Google\Google Toolbar\GoogleToolbar_32.dll"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"GTB7.5" = ""

[HKCU\Software\Google\Google Toolbar\4.0\Options]
"UsageStatsEnabled" = "1"

[HKLM\SOFTWARE\Wow6432Node\Google\Google Toolbar\4.0\Setup]
"DisableBrowseByName" = "0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{2318C2B1-4965-11d4-9B18-009027A5CD4F}]
"MinorVersion" = "5"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\Clients\{F69EABDD-A4BB-4555-BE7E-1EA5F59BBA24}]
"Name" = "Google Toolbar"

[HKLM\SOFTWARE\Wow6432Node\Google\Google Toolbar\Branding]
"ID" = "6BA3A3DD8C86609F54CC8AB84959F665663D1aFIBM"

[HKCR\CLSID\{2318C2B1-4965-11d4-9B18-009027A5CD4F}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\CLSID\{AA58ED58-01DD-4d91-8333-CF10577473F7}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{2318C2B1-4965-11d4-9B18-009027A5CD4F}]
"InstallLocation" = "%Program Files% (x86)\Google\Google Toolbar\"
"NoModify" = "1"
"MajorVersion" = "7"
"NoRepair" = "1"

[HKCR\CLSID\{2318C2B1-4965-11d4-9B18-009027A5CD4F}]
"(Default)" = "Google Toolbar"

[HKLM\SOFTWARE\Wow6432Node\Google\Google Toolbar\Installations]
"1432028302" = "v=7.5.6227.252&tbbrand=NCHD&i=0"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{F69EABDD-A4BB-4555-BE7E-1EA5F59BBA24}]
"brand" = "NCHD"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EE0B94B9-335F-4d2c-8B43-DACCD1EA6FF1}]
"AppPath" = "%Program Files% (x86)\Google\Google Toolbar"

[HKCR\Wow6432Node\CLSID\{AA58ED58-01DD-4d91-8333-CF10577473F7}\InprocServer32]
"(Default)" = "%Program Files% (x86)\Google\Google Toolbar\GoogleToolbar_32.dll"

The PUP deletes the following registry key(s):

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories64\{00021493-0000-0000-C000-000000000046}]
[HKCR\Wow6432Node\CLSID\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}\ProgID]
[HKCR\CLSID\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}\TypeLib]
[HKCR\CLSID\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}\Programmable]
[HKCR\CLSID\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}\InprocServer32]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories64\{00021493-0000-0000-C000-000000000046}\Enum]
[HKCR\CLSID\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}\VersionIndependentProgID]
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{2318C2B1-4965-11d4-9B18-009027A5CD4F}]
[HKCU\Software\Classes\Local Settings\MuiCache\2C]
[HKCU\Software\Classes\Local Settings\MuiCache\2C\52C64B7E]
[HKCR\CLSID\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}\ProgID]
[HKCR\Wow6432Node\CLSID\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}\TypeLib]
[HKCR\Wow6432Node\CLSID\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}\VersionIndependentProgID]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories\{00021494-0000-0000-C000-000000000046}\Enum]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories\{00021494-0000-0000-C000-000000000046}]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories\{00021493-0000-0000-C000-000000000046}]
[HKCR\Wow6432Node\CLSID\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}\Programmable]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories64\{00021494-0000-0000-C000-000000000046}]
[HKCR\CLSID\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories64\{00021494-0000-0000-C000-000000000046}\Enum]
[HKCR\Wow6432Node\CLSID\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
[HKCR\Wow6432Node\CLSID\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}\InprocServer32]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories\{00021493-0000-0000-C000-000000000046}\Enum]

The PUP deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Google\Google Toolbar\4.0\Setup]
"UseIe64"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}"

[HKCU\Software\Google\Google Toolbar\4.0\Options]
"Vendor"

[HKCU\Software\Google\Google Toolbar\4.0]
"Update"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}"

[HKLM\SOFTWARE\Wow6432Node\Google\Google Toolbar\4.0\Setup]
"RefreshIE"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\Clients\{F69EABDD-A4BB-4555-BE7E-1EA5F59BBA24}]
"lang"

[HKLM\SOFTWARE\Wow6432Node\Google\Google Toolbar\4.0\Setup]
"WelcomePage"

The process fastfox.exe:2132 makes changes in the system registry.

The PUP creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\NCH Software\FastFox\Scheduler]
"SevenDays" = "1"

The process GoogleUpdaterService_B33FC4DD36A473C6.exe:2220 makes changes in the system registry.

The PUP creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Google\Common\Google Updater\apps\tbie]
"auto" = "0"

[HKLM\SOFTWARE\Wow6432Node\Google\Common\Google Updater]
"Path" = "%Program Files% (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe"
"Version" = "2.4.2617.4952"

The process GoogleUpdaterService_B33FC4DD36A473C6.exe:3536 makes changes in the system registry.

The PUP creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Google\Common\Google Updater\apps\tbie]
"auto" = "0"

The process scribe.exe:2020 makes changes in the system registry.

The PUP creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\NCH Software\Scribe\Scheduler]
"SevenDays" = "1"

The process scribe.exe:1004 makes changes in the system registry.

The PUP creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\DirectInput\MostRecentApplication]
"MostRecentStart" = "75 0C 25 74 17 92 D0 01"

[HKCU\Software\NCH Software\Scribe\Registration]
"RD" = "1432028262"
"Name" = ""

[HKCU\Software\NCH Software\Scribe\MainWindow]
"MiniWindowPositionX" = "453"

[HKCU\Software\NCH Software\Scribe\Settings]
"WordCount" = "1"

[HKCU\Software\Microsoft\DirectInput\MostRecentApplication]
"ID" = "SCRIBE.EXE53E24FA8001CE258"

[HKCU\Software\NCH Software\Scribe\Settings]
"UseWordProc" = "1"
"WordDefault" = "0"
"DataFolderCurrent" = "C:\Users\"%CurrentUserName%"\AppData\Roaming\NCH Software\Scribe"

[HKCU\Software\NCH Software\Scribe\Software]
"SVar" = "LLIBShowrelatedwhenchromeonLLIBShowSuiteButtonOn"

[HKCU\System\CurrentControlSet\Control\MediaProperties\PrivateProperties\DirectInput\VID_0E0F&PID_0003\Calibration\0]
"Guid" = "00 A9 17 D7 23 FE E4 11 80 01 44 45 53 54 00 00"

[HKCU\Software\Microsoft\DirectInput\MostRecentApplication]
"Version" = "00 07 00 00"

[HKCU\Software\NCH Software\Scribe\Settings]
"Word0" = "C:\ProgramData\NCH Software\Scribe\Status\Template.doc"

[HKCU\Software\NCH Software\Scribe\Registration]
"LR" = "1432028262"

[HKCU\Software\NCH Software\Scribe\MainWindow]
"MiniWindowPositionY" = "190"

[HKCU\Software\NCH Software\Scribe\Settings]
"currentfile" = "C:\Users\"%CurrentUserName%"\AppData\Roaming\NCH Software\Scribe\Current\Welcome.dat"

[HKCU\Software\Microsoft\DirectInput\MostRecentApplication]
"Name" = "SCRIBE.EXE"

[HKCU\Software\NCH Software\Scribe\Settings]
"CleanExit" = "0"
"DataFolderPrevious" = "C:\Users\"%CurrentUserName%"\AppData\Roaming\NCH Software\Scribe"

The process scribe.exe:1836 makes changes in the system registry.

The PUP creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\NCH Software\Scribe\Software]
"Toolbar" = "cnm-installed,gac,google"

[HKCU\Software\NCH Software\Components\GoogleToolbar]
"State" = "attempted"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 43 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Wow6432Node\NCH Software\Components\GoogleToolbar]
"State" = "attempted"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The PUP deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process edsetup.exe:2812 makes changes in the system registry.

The PUP creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
"UNCAsIntranet" = "0"

The PUP deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

The process nchsetup.exe:336 makes changes in the system registry.

The PUP creates and/or sets the following values in system registry:

[HKCU\Software\NCH Software\FastFox\ShortcutExempt]
"fmt" = "1"

[HKCU\Software\Classes\NCH.Scribe.aif\Shell\NCHconvertsound\command]
"(Default)" = "%Program Files% (x86)\NCH Software\FastFox\fastfox.exe -extfind Switch %L"

[HKCU\Software\Classes\Paint.Picture\Shell\NCHconvertimage]
"(Default)" = "Convert image file"

[HKCU\Software\Classes\AcroExch.Document\Shell\NCHconvertdoc\command]
"(Default)" = "%Program Files% (x86)\NCH Software\FastFox\fastfox.exe -extfind Doxillion %L"

[HKCU\Software\Classes\mpegfile\Shell\NCHconvertvideo\command]
"(Default)" = "%Program Files% (x86)\NCH Software\FastFox\fastfox.exe -extfind Prism %L"

[HKCU\Software\NCH Software\FastFox\Settings]
"ExePath" = "%Program Files% (x86)\NCH Software\FastFox\fastfox.exe"

[HKCU\Software\Classes\NCH.Scribe.wav\Shell\NCHconvertsound]
"(Default)" = "Convert sound file"

[HKCU\Software\NCH Software\FastFox\Software]
"InstalledBy" = "rpScribe"

[HKCU\Software\Classes\FirefoxHTML\shell\NCHconvertdoc\command]
"(Default)" = "%Program Files% (x86)\NCH Software\FastFox\fastfox.exe -extfind Doxillion %L"

[HKCU\Software\Classes\vobfile\Shell\NCHeditvideo]
"(Default)" = "Edit video file"

[HKLM\SOFTWARE\Wow6432Node\NCH Software\Components\GoogleToolbar]
"State" = "attempted"

[HKCU\Software\Classes\rtffile\Shell\NCHconvertdoc\command]
"(Default)" = "%Program Files% (x86)\NCH Software\FastFox\fastfox.exe -extfind Doxillion %L"

[HKCU\Software\Classes\NCH.Scribe.mp3\Shell\NCHeditsound]
"(Default)" = "Edit sound file"

[HKCU\Software\Classes\m4vfile\Shell\NCHconvertvideo\command]
"(Default)" = "%Program Files% (x86)\NCH Software\FastFox\fastfox.exe -extfind Prism %L"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\FastFox]
"VersionMinor" = "32"

[HKCU\Software\Classes\NCH.Scribe.wma\Shell\NCHeditsound]
"(Default)" = "Edit sound file"

[HKCU\Software\Classes\docfile\Shell\NCHconvertdoc\command]
"(Default)" = "%Program Files% (x86)\NCH Software\FastFox\fastfox.exe -extfind Doxillion %L"

[HKCU\Software\Classes\NCH.Scribe.wav\Shell\NCHconvertsound\command]
"(Default)" = "%Program Files% (x86)\NCH Software\FastFox\fastfox.exe -extfind Switch %L"

[HKCU\Software\Classes\neffile\Shell\NCHconvertimage]
"(Default)" = "Convert image file"

[HKCU\Software\Classes\pngfile\Shell\NCHslideshow\command]
"(Default)" = "%Program Files% (x86)\NCH Software\FastFox\fastfox.exe -extfind PhotoStage %L"

[HKCU\Software\Classes\aufile\Shell\NCHeditsound\command]
"(Default)" = "%Program Files% (x86)\NCH Software\FastFox\fastfox.exe -extfind WavePad %L"

[HKCU\Software\Classes\tar.gzfile\Shell\NCHextract]
"(Default)" = "Extract with Express Zip"

[HKCU\Software\Classes\mpegfile\Shell\NCHconvertvideo]
"(Default)" = "Convert video file"

[HKCU\Software\Classes\7zfile\Shell\NCHextract\command]
"(Default)" = "%Program Files% (x86)\NCH Software\FastFox\fastfox.exe -extfind ExpressZip %L"

[HKCU\Software\Classes\aacfile\Shell\NCHconvertsound\command]
"(Default)" = "%Program Files% (x86)\NCH Software\FastFox\fastfox.exe -extfind Switch %L"

[HKCU\Software\Classes\Paint.Picture\Shell\NCHslideshow\command]
"(Default)" = "%Program Files% (x86)\NCH Software\FastFox\fastfox.exe -extfind PhotoStage %L"

[HKCU\Software\Classes\m4afile\Shell\NCHeditsound\command]
"(Default)" = "%Program Files% (x86)\NCH Software\FastFox\fastfox.exe -extfind WavePad %L"

[HKCU\Software\Classes\wpfile\Shell\NCHconvertdoc\command]
"(Default)" = "%Program Files% (x86)\NCH Software\FastFox\fastfox.exe -extfind Doxillion %L"

[HKCU\Software\Classes\NCH.Scribe.mp3\Shell\NCHconvertsound]
"(Default)" = "Convert sound file"

[HKCU\Software\Classes\avifile\Shell\NCHeditvideo]
"(Default)" = "Edit video file"

[HKCU\Software\Classes\xvidfile\Shell\NCHconvertvideo\command]
"(Default)" = "%Program Files% (x86)\NCH Software\FastFox\fastfox.exe -extfind Prism %L"

[HKCU\Software\Classes\asffile\Shell\NCHeditvideo\command]
"(Default)" = "%Program Files% (x86)\NCH Software\FastFox\fastfox.exe -extfind VideoPad %L"

[HKCU\Software\Classes\vocfile\Shell\NCHeditsound\command]
"(Default)" = "%Program Files% (x86)\NCH Software\FastFox\fastfox.exe -extfind WavePad %L"

[HKCU\Software\Classes\NCH.Scribe.aif\Shell\NCHconvertsound]
"(Default)" = "Convert sound file"

[HKCU\Software\Classes\pngfile\Shell\NCHconvertimage\command]
"(Default)" = "%Program Files% (x86)\NCH Software\FastFox\fastfox.exe -extfind Pixillion %L"

[HKCU\Software\Classes\aacfile\Shell\NCHeditsound\command]
"(Default)" = "%Program Files% (x86)\NCH Software\FastFox\fastfox.exe -extfind WavePad %L"

[HKCU\Software\Classes\asffile\Shell\NCHconvertvideo\command]
"(Default)" = "%Program Files% (x86)\NCH Software\FastFox\fastfox.exe -extfind Prism %L"

[HKCU\Software\Classes\vobfile\Shell\NCHeditvideo\command]
"(Default)" = "%Program Files% (x86)\NCH Software\FastFox\fastfox.exe -extfind VideoPad %L"

[HKCU\Software\Classes\mpgfile\Shell\NCHeditvideo\command]
"(Default)" = "%Program Files% (x86)\NCH Software\FastFox\fastfox.exe -extfind VideoPad %L"

[HKCU\Software\Classes\giffile\Shell\NCHslideshow\command]
"(Default)" = "%Program Files% (x86)\NCH Software\FastFox\fastfox.exe -extfind PhotoStage %L"

[HKCU\Software\Classes\mpeg2file\Shell\NCHconvertvideo\command]
"(Default)" = "%Program Files% (x86)\NCH Software\FastFox\fastfox.exe -extfind Prism %L"

[HKCU\Software\Classes\mpgfile\Shell\NCHeditvideo]
"(Default)" = "Edit video file"

[HKCU\Software\Classes\vobfile\Shell\NCHconvertvideo\command]
"(Default)" = "%Program Files% (x86)\NCH Software\FastFox\fastfox.exe -extfind Prism %L"

[HKCU\Software\Classes\giffile\Shell\NCHslideshow]
"(Default)" = "Create slideshow"

[HKCU\Software\Classes\mpeg2file\Shell\NCHeditvideo\command]
"(Default)" = "%Program Files% (x86)\NCH Software\FastFox\fastfox.exe -extfind VideoPad %L"

[HKCU\Software\Classes\gsmfile\Shell\NCHconvertsound\command]
"(Default)" = "%Program Files% (x86)\NCH Software\FastFox\fastfox.exe -extfind Switch %L"

[HKCU\Software\Classes\wpdfile\Shell\NCHconvertdoc]
"(Default)" = "Convert file type"

[HKCU\Software\Classes\pngfile\Shell\NCHslideshow]
"(Default)" = "Create slideshow"

[HKCU\Software\Classes\divxfile\Shell\NCHconvertvideo\command]
"(Default)" = "%Program Files% (x86)\NCH Software\FastFox\fastfox.exe -extfind Prism %L"

[HKCU\Software\Classes\mpegfile\Shell\NCHeditvideo\command]
"(Default)" = "%Program Files% (x86)\NCH Software\FastFox\fastfox.exe -extfind VideoPad %L"

[HKCU\Software\Classes\mp4file\Shell\NCHeditvideo\command]
"(Default)" = "%Program Files% (x86)\NCH Software\FastFox\fastfox.exe -extfind VideoPad %L"

[HKCU\Software\Classes\Windows.IsoFile\shell\NCHextract\command]
"(Default)" = "%Program Files% (x86)\NCH Software\FastFox\fastfox.exe -extfind ExpressZip %L"

[HKCU\Software\Classes\AcroExch.Document\Shell\NCHconvertdoc]
"(Default)" = "Convert file type"

[HKCU\Software\Classes\NCH.Scribe.aif\Shell\NCHeditsound]
"(Default)" = "Edit sound file"

[HKCU\Software\Classes\jpegfile\Shell\NCHslideshow\command]
"(Default)" = "%Program Files% (x86)\NCH Software\FastFox\fastfox.exe -extfind PhotoStage %L"

[HKCU\Software\Classes\docfile\Shell\NCHconvertdoc]
"(Default)" = "Convert file type"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\FastFox]
"URLUpdateInfo" = "www.nch.com.au/fastfox/index.html"

[HKCU\Software\Classes\xvidfile\Shell\NCHconvertvideo]
"(Default)" = "Convert video file"

[HKCU\Software\Classes\wpdfile\Shell\NCHconvertdoc\command]
"(Default)" = "%Program Files% (x86)\NCH Software\FastFox\fastfox.exe -extfind Doxillion %L"

[HKCU\Software\Classes\neffile\Shell\NCHconvertimage\command]
"(Default)" = "%Program Files% (x86)\NCH Software\FastFox\fastfox.exe -extfind Pixillion %L"

[HKCU\Software\Conduit\AppPaths\FastFox.exe]
"AppPath" = "%Program Files% (x86)\NCH Software\FastFox\fastfox.exe"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\FastFox]
"VersionMajor" = "2"

[HKCU\Software\Classes\flacfile\Shell\NCHconvertsound\command]
"(Default)" = "%Program Files% (x86)\NCH Software\FastFox\fastfox.exe -extfind Switch %L"

[HKCU\Software\Classes\mp4file\Shell\NCHeditvideo]
"(Default)" = "Edit video file"

[HKCU\Software\Classes\Windows.IsoFile\shell\NCHextract]
"(Default)" = "Extract with Express Zip"

[HKCU\Software\Classes\tar.gzfile\Shell\NCHextract\command]
"(Default)" = "%Program Files% (x86)\NCH Software\FastFox\fastfox.exe -extfind ExpressZip %L"

[HKCU\Software\Classes\mpeg2file\Shell\NCHeditvideo]
"(Default)" = "Edit video file"

[HKCU\Software\Classes\aufile\Shell\NCHeditsound]
"(Default)" = "Edit sound file"

[HKCU\Software\NCH Software\FastFox\Settings]
"InstalledByAdmin" = "1"

[HKCU\Software\Classes\giffile\Shell\NCHconvertimage\command]
"(Default)" = "%Program Files% (x86)\NCH Software\FastFox\fastfox.exe -extfind Pixillion %L"

[HKCU\Software\Classes\vobfile\Shell\NCHconvertvideo]
"(Default)" = "Convert video file"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\FastFox]
"InstallLocation" = "%Program Files% (x86)\NCH Software\FastFox"

[HKCU\Software\NCH Software\Components\GoogleToolbar]
"State" = "attempted"

[HKCU\Software\Classes\voxfile\Shell\NCHconvertsound]
"(Default)" = "Convert sound file"

[HKCU\Software\Classes\rtffile\Shell\NCHconvertdoc]
"(Default)" = "Convert file type"

[HKLM\SOFTWARE\Wow6432Node\Conduit\AppPaths\FastFox.exe]
"AppPath" = "%Program Files% (x86)\NCH Software\FastFox\fastfox.exe"

[HKCU\Software\Classes\TIFImage.Document\Shell\NCHconvertimage]
"(Default)" = "Convert image file"

[HKCU\Software\Classes\xvidfile\Shell\NCHeditvideo]
"(Default)" = "Edit video file"

[HKCU\Software\Classes\NCH.Scribe.wav\Shell\NCHeditsound]
"(Default)" = "Edit sound file"

[HKCU\Software\Classes\docxfile\Shell\NCHconvertdoc]
"(Default)" = "Convert file type"

[HKCU\Software\Classes\divxfile\Shell\NCHeditvideo\command]
"(Default)" = "%Program Files% (x86)\NCH Software\FastFox\fastfox.exe -extfind VideoPad %L"

[HKCU\Software\Classes\NCH.Scribe.wma\Shell\NCHconvertsound\command]
"(Default)" = "%Program Files% (x86)\NCH Software\FastFox\fastfox.exe -extfind Switch %L"

[HKCU\Software\Classes\odtfile\Shell\NCHconvertdoc\command]
"(Default)" = "%Program Files% (x86)\NCH Software\FastFox\fastfox.exe -extfind Doxillion %L"

[HKCU\Software\Classes\gsmfile\Shell\NCHconvertsound]
"(Default)" = "Convert sound file"

[HKCU\Software\Classes\gzfile\Shell\NCHextract]
"(Default)" = "Extract with Express Zip"

[HKCU\Software\Classes\NCH.Scribe.wav\Shell\NCHeditsound\command]
"(Default)" = "%Program Files% (x86)\NCH Software\FastFox\fastfox.exe -extfind WavePad %L"

[HKCU\Software\Classes\divxfile\Shell\NCHconvertvideo]
"(Default)" = "Convert video file"

[HKCU\Software\Classes\CABFolder\Shell\NCHextract\command]
"(Default)" = "%Program Files% (x86)\NCH Software\FastFox\fastfox.exe -extfind ExpressZip %L"

[HKCU\Software\NCH Software\FastFox\Settings]
"InstallerPath" = "%Program Files% (x86)\NCH Software\FastFox"

[HKCU\Software\Classes\asffile\Shell\NCHeditvideo]
"(Default)" = "Edit video file"

[HKCU\Software\Classes\docxfile\Shell\NCHconvertdoc\command]
"(Default)" = "%Program Files% (x86)\NCH Software\FastFox\fastfox.exe -extfind Doxillion %L"

[HKCU\Software\Classes\mpgfile\Shell\NCHconvertvideo\command]
"(Default)" = "%Program Files% (x86)\NCH Software\FastFox\fastfox.exe -extfind Prism %L"

[HKCU\Software\Classes\jpegfile\Shell\NCHslideshow]
"(Default)" = "Create slideshow"

[HKCU\Software\Classes\voxfile\Shell\NCHeditsound]
"(Default)" = "Edit sound file"

[HKCU\Software\NCH Software\FastFox\Software]
"Toolbar" = "cnm-installed"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\FastFox]
"Publisher" = "NCH Software"

[HKCU\Software\Classes\flacfile\Shell\NCHconvertsound]
"(Default)" = "Convert sound file"

[HKCU\Software\Classes\rarfile\Shell\NCHextract]
"(Default)" = "Extract with Express Zip"

[HKCU\Software\Classes\mpegfile\Shell\NCHeditvideo]
"(Default)" = "Edit video file"

[HKCU\Software\Classes\movfile\Shell\NCHconvertvideo\command]
"(Default)" = "%Program Files% (x86)\NCH Software\FastFox\fastfox.exe -extfind Prism %L"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\FastFox]
"URLInfoAbout" = "http://www.nch.com.au/fastfox/support.html"

[HKCU\Software\Classes\odtfile\Shell\NCHconvertdoc]
"(Default)" = "Convert file type"

[HKCU\Software\Classes\NCH.Scribe.mp3\Shell\NCHconvertsound\command]
"(Default)" = "%Program Files% (x86)\NCH Software\FastFox\fastfox.exe -extfind Switch %L"

[HKCU\Software\Classes\neffile\Shell\NCHslideshow]
"(Default)" = "Create slideshow"

[HKCU\Software\Classes\ds2file\shell\NCHconvertsound]
"(Default)" = "Convert sound file"

[HKCU\Software\Classes\ds2file\shell\NCHconvertsound\command]
"(Default)" = "%Program Files% (x86)\NCH Software\FastFox\fastfox.exe -extfind Switch %L"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\FastFox]
"DisplayVersion" = "2.32"

[HKCU\Software\Classes\NCH.Scribe.wma\Shell\NCHconvertsound]
"(Default)" = "Convert sound file"

[HKCU\Software\Classes\NCH.Scribe.aif\Shell\NCHeditsound\command]
"(Default)" = "%Program Files% (x86)\NCH Software\FastFox\fastfox.exe -extfind WavePad %L"

[HKCU\Software\Classes\m4afile\Shell\NCHeditsound]
"(Default)" = "Edit sound file"

[HKCU\Software\Classes\NCH.Scribe.aiff\Shell\NCHeditsound\command]
"(Default)" = "%Program Files% (x86)\NCH Software\FastFox\fastfox.exe -extfind WavePad %L"

[HKCU\Software\Classes\avifile\Shell\NCHeditvideo\command]
"(Default)" = "%Program Files% (x86)\NCH Software\FastFox\fastfox.exe -extfind VideoPad %L"

[HKCU\Software\Classes\Paint.Picture\Shell\NCHconvertimage\command]
"(Default)" = "%Program Files% (x86)\NCH Software\FastFox\fastfox.exe -extfind Pixillion %L"

[HKCU\Software\Classes\NCH.Scribe.aiff\Shell\NCHeditsound]
"(Default)" = "Edit sound file"

[HKCU\Software\Classes\divxfile\Shell\NCHeditvideo]
"(Default)" = "Edit video file"

[HKLM\SOFTWARE\Wow6432Node\Google\GCAPITemp]
"test" = "testv"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\FastFox]
"Version" = "2.32"

[HKCU\Software\Classes\aufile\Shell\NCHconvertsound]
"(Default)" = "Convert sound file"

[HKCU\Software\Classes\7zfile\Shell\NCHextract]
"(Default)" = "Extract with Express Zip"

[HKCU\Software\Classes\neffile\Shell\NCHslideshow\command]
"(Default)" = "%Program Files% (x86)\NCH Software\FastFox\fastfox.exe -extfind PhotoStage %L"

[HKCU\Software\Classes\NCH.Scribe.aiff\Shell\NCHconvertsound\command]
"(Default)" = "%Program Files% (x86)\NCH Software\FastFox\fastfox.exe -extfind Switch %L"

[HKCU\Software\Classes\jpegfile\Shell\NCHconvertimage\command]
"(Default)" = "%Program Files% (x86)\NCH Software\FastFox\fastfox.exe -extfind Pixillion %L"

[HKLM\SOFTWARE\Wow6432Node\NCH Software\FastFox\Settings]
"RelatedRuns" = "-1"

[HKCU\Software\Classes\mpeg2file\Shell\NCHconvertvideo]
"(Default)" = "Convert video file"

[HKCU\Software\Classes\aacfile\Shell\NCHeditsound]
"(Default)" = "Edit sound file"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Classes\m4vfile\Shell\NCHeditvideo]
"(Default)" = "Edit video file"

[HKCU\Software\Classes\gzfile\Shell\NCHextract\command]
"(Default)" = "%Program Files% (x86)\NCH Software\FastFox\fastfox.exe -extfind ExpressZip %L"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Classes\TIFImage.Document\Shell\NCHconvertimage\command]
"(Default)" = "%Program Files% (x86)\NCH Software\FastFox\fastfox.exe -extfind Pixillion %L"

[HKCU\Software\Classes\tarfile\Shell\NCHextract\command]
"(Default)" = "%Program Files% (x86)\NCH Software\FastFox\fastfox.exe -extfind ExpressZip %L"

[HKCU\Software\Classes\Paint.Picture\Shell\NCHslideshow]
"(Default)" = "Create slideshow"

[HKCU\Software\Classes\tarfile\Shell\NCHextract]
"(Default)" = "Extract with Express Zip"

[HKCU\Software\Classes\mpgfile\Shell\NCHconvertvideo]
"(Default)" = "Convert video file"

[HKCU\Software\Classes\giffile\Shell\NCHconvertimage]
"(Default)" = "Convert image file"

[HKCU\Software\Classes\m4vfile\Shell\NCHconvertvideo]
"(Default)" = "Convert video file"

[HKCU\Software\Classes\avifile\Shell\NCHconvertvideo]
"(Default)" = "Convert video file"

[HKCU\Software\NCH Software\FastFox\Settings]
"currentVersion" = "2.32"

[HKCU\Software\Classes\asffile\Shell\NCHconvertvideo]
"(Default)" = "Convert video file"

[HKCU\Software\Classes\mp4file\Shell\NCHconvertvideo\command]
"(Default)" = "%Program Files% (x86)\NCH Software\FastFox\fastfox.exe -extfind Prism %L"

[HKCU\Software\Classes\aufile\Shell\NCHconvertsound\command]
"(Default)" = "%Program Files% (x86)\NCH Software\FastFox\fastfox.exe -extfind Switch %L"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\FastFox]
"DisplayName" = "FastFox"

[HKCU\Software\Classes\jpegfile\Shell\NCHconvertimage]
"(Default)" = "Convert image file"

[HKCU\Software\Classes\NCH.Scribe.aiff\Shell\NCHconvertsound]
"(Default)" = "Convert sound file"

[HKCU\Software\NCH Software\FastFox\ShortcutExempt]
"txt" = "1"

[HKCU\Software\NCH Software\FastFox\Settings]
"InstallDate" = "1432028268"

[HKCU\Software\Classes\oggfile\Shell\NCHeditsound\command]
"(Default)" = "%Program Files% (x86)\NCH Software\FastFox\fastfox.exe -extfind WavePad %L"

[HKCU\Software\Classes\pngfile\Shell\NCHconvertimage]
"(Default)" = "Convert image file"

[HKCU\Software\NCH Software\FastFox\Settings]
"PicShortcutsConvertedToWindowMetaFile" = "0"

[HKCU\Software\Classes\oggfile\Shell\NCHeditsound]
"(Default)" = "Edit sound file"

[HKCU\Software\Classes\voxfile\Shell\NCHeditsound\command]
"(Default)" = "%Program Files% (x86)\NCH Software\FastFox\fastfox.exe -extfind WavePad %L"

[HKCU\Software\Classes\movfile\Shell\NCHeditvideo\command]
"(Default)" = "%Program Files% (x86)\NCH Software\FastFox\fastfox.exe -extfind VideoPad %L"

[HKCU\Software\Classes\m4vfile\Shell\NCHeditvideo\command]
"(Default)" = "%Program Files% (x86)\NCH Software\FastFox\fastfox.exe -extfind VideoPad %L"

[HKCU\Software\Classes\wpfile\Shell\NCHconvertdoc]
"(Default)" = "Convert file type"

[HKCU\Software\Classes\movfile\Shell\NCHconvertvideo]
"(Default)" = "Convert video file"

[HKCU\Software\Classes\avifile\Shell\NCHconvertvideo\command]
"(Default)" = "%Program Files% (x86)\NCH Software\FastFox\fastfox.exe -extfind Prism %L"

[HKCU\Software\Classes\NCH.Scribe.mp3\Shell\NCHeditsound\command]
"(Default)" = "%Program Files% (x86)\NCH Software\FastFox\fastfox.exe -extfind WavePad %L"

[HKCU\Software\Classes\voxfile\Shell\NCHconvertsound\command]
"(Default)" = "%Program Files% (x86)\NCH Software\FastFox\fastfox.exe -extfind Switch %L"

[HKCU\Software\Classes\vocfile\Shell\NCHeditsound]
"(Default)" = "Edit sound file"

[HKCU\Software\Classes\aacfile\Shell\NCHconvertsound]
"(Default)" = "Convert sound file"

[HKCU\Software\NCH Software\FastFox\ShortcutExempt]
"CTRL SHIFT T" = "1"

[HKCU\Software\Classes\FirefoxHTML\shell\NCHconvertdoc]
"(Default)" = "Convert file type"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\FastFox]
"UninstallString" = "%Program Files% (x86)\NCH Software\FastFox\fastfox.exe -uninstall"

[HKCU\Software\Classes\rarfile\Shell\NCHextract\command]
"(Default)" = "%Program Files% (x86)\NCH Software\FastFox\fastfox.exe -extfind ExpressZip %L"

[HKCU\Software\Classes\mp4file\Shell\NCHconvertvideo]
"(Default)" = "Convert video file"

[HKCU\Software\Classes\NCH.Scribe.wma\Shell\NCHeditsound\command]
"(Default)" = "%Program Files% (x86)\NCH Software\FastFox\fastfox.exe -extfind WavePad %L"

[HKCU\Software\Classes\xvidfile\Shell\NCHeditvideo\command]
"(Default)" = "%Program Files% (x86)\NCH Software\FastFox\fastfox.exe -extfind VideoPad %L"

[HKLM\SOFTWARE\Wow6432Node\NCH Software\FastFox\Settings]
"InstallerPath" = "%Program Files% (x86)\NCH Software\FastFox"

[HKCU\Software\Classes\CABFolder\Shell\NCHextract]
"(Default)" = "Extract with Express Zip"

[HKCU\Software\Classes\movfile\Shell\NCHeditvideo]
"(Default)" = "Edit video file"

[HKCU\Software\NCH Software\FastFox\ShortcutExempt]
"PIC1" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\FastFox]
"DisplayIcon" = "%Program Files% (x86)\NCH Software\FastFox\fastfox.exe"

[HKLM\SOFTWARE\Wow6432Node\NCH Software\FastFox\Software]
"Installer" = "%Program Files% (x86)\NCH Software\FastFox\fastfoxsetup_v2.32.exe"

To automatically run itself each time Windows is booted, the PUP adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"FastFox" = "%Program Files% (x86)\NCH Software\FastFox\fastfox.exe -logon"

The PUP deletes the following registry key(s):

[HKLM\SOFTWARE\Wow6432Node\Google\GCAPITemp]

The PUP deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKLM\SOFTWARE\Wow6432Node\Google\GCAPITemp]
"test"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

The PUP disables automatic startup of the application by deleting the following autorun value:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce]
"FastFoxUninstall"

"_FastFoxUninstall4"

"_FastFoxUninstall5"

"_FastFoxUninstall2"

"_FastFoxUninstall3"

"_FastFoxUninstall"

"FastFoxUninstall2"

"FastFoxUninstall3"

"FastFoxUninstall4"

"FastFoxUninstall5"

The process nchsetup.exe:1372 makes changes in the system registry.

The PUP creates and/or sets the following values in system registry:

[HKCR\NCH.Scribe.dvs\shell\open\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe %L"

[HKCU\Software\Classes\NCH.Scribe.aif\Shell\NCHconvertsound\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe -extfind Switch %L"

[HKCR\NCH.Scribe.dvs\shell]
"(Default)" = "Open"

[HKCU\Software\Classes\NCH.Scribe.aiff\Shell\NCHeditsound\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe -extfind WavePad %L"

[HKCU\Software\NCH Software\Scribe\Settings]
"InstallerPath" = "%Program Files% (x86)\NCH Software\Scribe"

[HKCU\Software\Classes\.OGG]
"(Default)" = "oggfile"

[HKCU\Software\Classes\docfile\Shell\NCHconvertdoc\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe -extfind Doxillion %L"

[HKCU\Software\Classes\.tar]
"(Default)" = "tarfile"

[HKCU\Software\Classes\m4vfile\Shell]
"(Default)" = "open"

[HKLM\SOFTWARE\Wow6432Node\NCH Software\Scribe\Capabilities\FileAssociations]
".aif" = "NCH.Scribe.aif"

[HKCR\.wav\OpenWithProgIds]
"NCH.Scribe.wav" = "Type: REG_NONE, Length: 0"

[HKCU\Software\Classes\Paint.Picture\Shell\NCHslideshow\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe -extfind PhotoStage %L"

[HKCR\.msv]
"(Default)" = "NCH.Scribe.msv"

[HKCU\Software\Classes\NCH.Scribe.mp3\Shell\NCHconvertsound]
"(Default)" = "Convert sound file"

[HKCU\Software\Classes\.AAC]
"(Default)" = "aacfile"

[HKCU\Software\Classes\avifile\Shell\NCHeditvideo]
"(Default)" = "Edit video file"

[HKCU\Software\Classes\vocfile\Shell\NCHeditsound\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe -extfind WavePad %L"

[HKLM\SOFTWARE\Wow6432Node\NCH Software\Scribe\Capabilities\FileTypes]
".wma" = "NCH.Scribe.wma"

[HKCU\Software\Classes\mpeg2file\Shell\NCHconvertvideo\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe -extfind Prism %L"

[HKCR\NCH.Scribe.mp3\shell\open\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe %L"

[HKCU\Software\Classes\.meo]
"(Default)" = "meofile"

[HKCU\Software\Classes\.7z]
"(Default)" = "7zfile"

[HKCU\Software\Classes\.nef]
"(Default)" = "neffile"

[HKCU\Software\Classes\tar.gzfile\Shell\NCHextract]
"(Default)" = "Extract with Express Zip"

[HKCR\NCH.Scribe.dss\shell\open\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe %L"

[HKCR\NCH.Scribe.aif\shell\open\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe %L"

[HKCU\Software\Classes\m4afile\Shell]
"(Default)" = "open"

[HKLM\SOFTWARE\Wow6432Node\NCH Software\Scribe\Capabilities\FileTypes]
".aif" = "NCH.Scribe.aif"

[HKCU\Software\Classes\mp4file\Shell\NCHconvertvideo\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe -extfind Prism %L"

[HKCU\Software\Classes\docfile\Shell\NCHconvertdoc]
"(Default)" = "Convert file type"

[HKCR\SystemFileAssociations\.dct\Shell\Transcribe with Express Scribe Transcription Software\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe %L"

[HKCU\Software\Classes\.rar]
"(Default)" = "rarfile"

[HKCU\Software\Classes\xvidfile\Shell\NCHconvertvideo]
"(Default)" = "Convert video file"

[HKCU\Software\Classes\neffile\Shell\NCHconvertimage\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe -extfind Pixillion %L"

[HKCU\Software\Classes\.avi]
"(Default)" = "avifile"

[HKCU\Software\Classes\Windows.IsoFile\shell\NCHextract]
"(Default)" = "Extract with Express Zip"

[HKLM\SOFTWARE\Wow6432Node\NCH Software\Scribe\Capabilities\FileAssociations]
".aiff" = "NCH.Scribe.aiff"

[HKCU\Software\Classes\mpeg2file\Shell\NCHeditvideo]
"(Default)" = "Edit video file"

[HKCU\Software\Classes\aufile\Shell\NCHeditsound]
"(Default)" = "Edit sound file"

[HKCU\Software\Classes\pngfile\Shell\NCHslideshow]
"(Default)" = "Create slideshow"

[HKCR\NCH.Scribe.aiff\DefaultIcon]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe,0"

[HKCU\Software\Classes\TIFImage.Document\Shell\NCHconvertimage]
"(Default)" = "Convert image file"

[HKLM\SOFTWARE\Wow6432Node\NCH Software\Scribe\Capabilities\FileAssociations]
".wma" = "NCH.Scribe.wma"

[HKCU\Software\Classes\.asf]
"(Default)" = "asffile"

[HKCU\Software\Classes\gsmfile\Shell\NCHconvertsound]
"(Default)" = "Convert sound file"

[HKCU\Software\Classes\gzfile\Shell\NCHextract]
"(Default)" = "Extract with Express Zip"

[HKCU\Software\Classes\divxfile\Shell\NCHconvertvideo]
"(Default)" = "Convert video file"

[HKCR\.dvs\OpenWithProgIds]
"NCH.Scribe.dvs" = "Type: REG_NONE, Length: 0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Scribe]
"Publisher" = "NCH Software"

[HKCU\Software\Classes\vobfile\Shell\NCHconvertvideo\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe -extfind Prism %L"

[HKCU\Software\Classes\jpegfile\Shell\NCHslideshow]
"(Default)" = "Create slideshow"

[HKCU\Software\Classes\.vox]
"(Default)" = "voxfile"

[HKCR\NCH.Scribe.dvs\DefaultIcon]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe,0"

[HKCR\NCH.Scribe.dct\shell\Transcribe with Express Scribe Transcription Software\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe %L"

[HKCU\Software\Classes\neffile\Shell\NCHslideshow]
"(Default)" = "Create slideshow"

[HKCU\Software\Classes\ds2file\shell\NCHconvertsound]
"(Default)" = "Convert sound file"

[HKCU\Software\Classes\.vpj]
"(Default)" = "vpjfile"

[HKLM\SOFTWARE\Wow6432Node\NCH Software\Scribe\Settings]
"InstallerPath" = "%Program Files% (x86)\NCH Software\Scribe"

[HKCR\Applications\scribe.exe]
"(Default)" = "Express Scribe Transcription Software"

[HKCR\NCH.Scribe.dvs]
"(Default)" = "Express Scribe Dictation File"

[HKCU\Software\NCH Software\Scribe\Hotkey\6]
"Command" = "7"

[HKCU\Software\Classes\meofile]
"(Default)" = "Unhandled Extension Handler Finder"

[HKCU\Software\Classes\divxfile\Shell\NCHeditvideo]
"(Default)" = "Edit video file"

[HKCU\Software\Classes\vobfile\Shell]
"(Default)" = "open"

[HKCU\Software\Classes\neffile\Shell\NCHslideshow\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe -extfind PhotoStage %L"

[HKCU\Software\Classes\7zfile\Shell]
"(Default)" = "open"

[HKCU\Software\Classes\m4vfile\Shell\NCHeditvideo]
"(Default)" = "Edit video file"

[HKCU\Software\Classes\TIFImage.Document\Shell]
"(Default)" = "open"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Scribe]
"DisplayIcon" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe"

[HKCR\NCH.Scribe.msv\DefaultIcon]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe,0"

[HKCU\Software\Classes\m4vfile\Shell\NCHconvertvideo]
"(Default)" = "Convert video file"

[HKCU\Software\Classes\asffile\Shell\NCHconvertvideo]
"(Default)" = "Convert video file"

[HKCR\.aiff\OpenWithProgIds]
"NCH.Scribe.aiff" = "Type: REG_NONE, Length: 0"

[HKLM\SOFTWARE\Wow6432Node\NCH Software\Scribe\Capabilities\FileAssociations]
".dvs" = "NCH.Scribe.dvs"

[HKCU\Software\Classes\jpegfile\Shell\NCHconvertimage]
"(Default)" = "Convert image file"

[HKCU\Software\Classes\AcroExch.Document\Shell]
"(Default)" = "open"

[HKCU\Software\Classes\mp4file\Shell]
"(Default)" = "open"

[HKCU\Software\Classes\Paint.Picture\Shell]
"(Default)" = "open"

[HKCU\Software\Classes\m4vfile\Shell\NCHeditvideo\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe -extfind VideoPad %L"

[HKCU\Software\Classes\voxfile\Shell]
"(Default)" = "open"

[HKCU\Software\Classes\.AU]
"(Default)" = "aufile"

[HKCU\Software\Classes\.mpg]
"(Default)" = "mpgfile"

[HKCU\Software\Classes\.vob]
"(Default)" = "vobfile"

[HKCU\Software\Classes\mpdpfile]
"(Default)" = "Unhandled Extension Handler Finder"

[HKCU\Software\Classes\asffile\Shell]
"(Default)" = "open"

[HKCU\Software\Classes\mp4file\Shell\NCHconvertvideo]
"(Default)" = "Convert video file"

[HKCU\Software\Classes\NCH.Scribe.wma\Shell\NCHeditsound\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe -extfind WavePad %L"

[HKCR\NCH.Scribe.mp3\shell]
"(Default)" = "Open"

[HKCR\SystemFileAssociations\.mp3\Shell\Transcribe with Express Scribe Transcription Software\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe %L"

[HKCR\NCH.Scribe.aiff\shell\open\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe %L"

[HKCU\Software\Classes\vpjfile\shell\open\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe -extfind VideoPad %L"

[HKCU\Software\Classes\Paint.Picture\Shell\NCHconvertimage]
"(Default)" = "Convert image file"

[HKLM\SOFTWARE\Wow6432Node\NCH Software\Scribe\Capabilities\FileTypes]
".MP3" = "NCH.Scribe.mp3"

[HKCU\Software\Classes\.WAV]
"(Default)" = "NCH.Scribe.wav"

[HKCU\Software\Classes\.mov]
"(Default)" = "movfile"

[HKCR\.msv]
"Scribe.BAK" = ""

[HKCU\Software\Classes\rtffile\Shell\NCHconvertdoc\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe -extfind Doxillion %L"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Scribe]
"URLInfoAbout" = "www.nch.com.au/scribe/support.html"

[HKCU\Software\Classes\asffile\Shell\NCHeditvideo]
"(Default)" = "Edit video file"

[HKCU\Software\Classes\mohfile\DefaultIcon]
"(Default)" = "%SystemRoot%\SysWow64\shell32.dll,19"

[HKCR\NCH.Scribe.wma\DefaultIcon]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe,0"

[HKCU\Software\Classes\NCH.Scribe.wav\Shell\NCHconvertsound\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe -extfind Switch %L"

[HKCU\Software\NCH Software\Scribe\Software]
"Toolbar" = "cnm-installed"

[HKCU\Software\Classes\wpfile\Shell\NCHconvertdoc\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe -extfind Doxillion %L"

[HKCR\.aif\OpenWithProgIds]
"NCH.Scribe.aif" = "Type: REG_NONE, Length: 0"

[HKCR\NCH.Scribe.aiff\shell]
"(Default)" = "Open"

[HKCU\Software\NCH Software\Scribe\Settings]
"InstallDate" = "1432028237"

[HKCU\Software\NCH Software\Scribe\Hotkey\1]
"Command" = "10"

[HKCU\Software\Classes\asffile\Shell\NCHconvertvideo\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe -extfind Prism %L"

[HKCR\Applications\scribe.exe\shell\open\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe %L"

[HKCU\Software\Classes\.gz]
"(Default)" = "gzfile"

[HKCU\Software\Classes\giffile\Shell\NCHslideshow]
"(Default)" = "Create slideshow"

[HKCU\Software\Classes\mpeg2file\Shell\NCHeditvideo\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe -extfind VideoPad %L"

[HKCU\Software\Classes\wpdfile\Shell]
"(Default)" = "open"

[HKCU\Software\Classes\mpegfile\Shell\NCHeditvideo\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe -extfind VideoPad %L"

[HKCU\Software\Classes\mp4file\Shell\NCHeditvideo\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe -extfind VideoPad %L"

[HKCR\.dct\OpenWithProgIds]
"NCH.Scribe.dct" = "Type: REG_NONE, Length: 0"

[HKCU\Software\Classes\NCH.Scribe.aif\Shell\NCHeditsound]
"(Default)" = "Edit sound file"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dvs\UserChoice]
"Progid" = "NCH.Scribe.dvs"

[HKCR\.dss\OpenWithProgIds]
"NCH.Scribe.dss" = "Type: REG_NONE, Length: 0"

[HKCU\Software\Classes\flacfile\Shell\NCHconvertsound\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe -extfind Switch %L"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Scribe]
"URLUpdateInfo" = "www.nch.com.au/scribe/index.html"

[HKLM\SOFTWARE\Wow6432Node\NCH Software\Scribe\Settings]
"RelatedRuns" = "-1"

[HKCU\Software\Classes\.mpeg]
"(Default)" = "mpegfile"

[HKCU\Software\Classes\rtffile\Shell\NCHconvertdoc]
"(Default)" = "Convert file type"

[HKLM\SOFTWARE\Wow6432Node\NCH Software\Scribe\Capabilities\FileTypes]
".aiff" = "NCH.Scribe.aiff"

[HKCU\Software\Classes\.ds2]
"(Default)" = "ds2file"

[HKCU\Software\Classes\tar.gzfile\Shell]
"(Default)" = "open"

[HKCU\Software\Classes\docxfile\Shell\NCHconvertdoc]
"(Default)" = "Convert file type"

[HKCR\.mp3\OpenWithProgIds]
"NCH.Scribe.mp3" = "Type: REG_NONE, Length: 0"

[HKCU\Software\Classes\.WMA]
"(Default)" = "NCH.Scribe.wma"

[HKCU\Software\Classes\.xvid]
"(Default)" = "xvidfile"

[HKCR\NCH.Scribe.wma]
"(Default)" = ""

[HKCU\Software\Classes\NCH.Scribe.wma\Shell\NCHconvertsound\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe -extfind Switch %L"

[HKCU\Software\NCH Software\Scribe\Settings]
"InstalledByAdmin" = "1"

[HKCR\NCH.Scribe.dct\shell\open\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe %L"

[HKCR\.wma\OpenWithProgIds]
"NCH.Scribe.wma" = "Type: REG_NONE, Length: 0"

[HKCU\Software\Classes\mpgfile\Shell\NCHconvertvideo\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe -extfind Prism %L"

[HKLM\SOFTWARE\Wow6432Node\NCH Software\Scribe\Software]
"Installer" = "%Program Files% (x86)\NCH Software\Scribe\scribesetup_v5.69.exe"

[HKCU\Software\NCH Software\Scribe\Hotkey\0]
"key" = "122"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Scribe]
"DisplayName" = "Express Scribe Transcription Software"

[HKCR\.dvs]
"(Default)" = "NCH.Scribe.dvs"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.msv\UserChoice]
"Progid" = "NCH.Scribe.msv"

[HKCU\Software\Classes\.moh]
"(Default)" = "mohfile"

[HKCU\Software\Classes\.mpeg2]
"(Default)" = "mpeg2file"

[HKCU\Software\Classes\avifile\Shell\NCHconvertvideo\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe -extfind Prism %L"

[HKCU\Software\Classes\NCH.Scribe.aiff\Shell\NCHeditsound]
"(Default)" = "Edit sound file"

[HKCU\Software\Classes\gzfile\Shell\NCHextract\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe -extfind ExpressZip %L"

[HKCR\NCH.Scribe.wma\shell\open\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe %L"

[HKCU\Software\Classes\mpeg2file\Shell]
"(Default)" = "open"

[HKCU\Software\Classes\.voc]
"(Default)" = "vocfile"

[HKCU\Software\Classes\spjfile\DefaultIcon]
"(Default)" = "%SystemRoot%\SysWow64\shell32.dll,19"

[HKCU\Software\Classes\NCH.Scribe.aif\Shell\NCHeditsound\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe -extfind WavePad %L"

[HKCU\Software\Classes\vocfile\Shell\NCHeditsound]
"(Default)" = "Edit sound file"

[HKCR\NCH.Scribe.dct\shell]
"(Default)" = "Open"

[HKCU\Software\Classes\.wp]
"(Default)" = "wpfile"

[HKCU\Software\Classes\Paint.Picture\Shell\NCHconvertimage\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe -extfind Pixillion %L"

[HKCR\NCH.Scribe.mp3]
"(Default)" = ""

[HKCU\Software\Classes\aufile\Shell\NCHconvertsound]
"(Default)" = "Convert sound file"

[HKCU\Software\NCH Software\Scribe\Hotkey\7]
"Command" = "2"

[HKCU\Software\Classes\.divx]
"(Default)" = "divxfile"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dss\UserChoice]
"Progid" = "NCH.Scribe.dss"

[HKCU\Software\Classes\mohfile\shell\open\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe -extfind IMS %L"

[HKCU\Software\Classes\aacfile\Shell\NCHeditsound]
"(Default)" = "Edit sound file"

[HKCR\NCH.Scribe.wav\DefaultIcon]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe,0"

[HKCU\Software\Classes\.AIFF]
"(Default)" = "NCH.Scribe.aiff"

[HKCU\Software\Classes\Paint.Picture\Shell\NCHslideshow]
"(Default)" = "Create slideshow"

[HKLM\SOFTWARE\Wow6432Node\NCH Software\Scribe\Capabilities\FileAssociations]
".msv" = "NCH.Scribe.msv"

[HKCU\Software\Classes\.wpd]
"(Default)" = "wpdfile"

[HKCU\Software\Classes\spjfile]
"(Default)" = "Unhandled Extension Handler Finder"

[HKCU\Software\Classes\vpjfile]
"(Default)" = "Unhandled Extension Handler Finder"

[HKCU\Software\Classes\vobfile\Shell\NCHeditvideo]
"(Default)" = "Edit video file"

[HKCU\Software\Classes\NCH.Scribe.wma\Shell\NCHeditsound]
"(Default)" = "Edit sound file"

[HKCU\Software\Classes\pngfile\Shell\NCHconvertimage\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe -extfind Pixillion %L"

[HKCU\Software\Classes\xvidfile\Shell]
"(Default)" = "open"

[HKCU\Software\Classes\ivrfile\DefaultIcon]
"(Default)" = "%SystemRoot%\SysWow64\shell32.dll,19"

[HKCU\Software\Classes\mpegfile\Shell]
"(Default)" = "open"

[HKCR\.dct]
"Scribe.BAK" = ""

[HKCU\Software\Classes\voxfile\Shell\NCHconvertsound\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe -extfind Switch %L"

[HKCU\Software\Classes\ivrfile\shell\open\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe -extfind IVM %L"

[HKCU\Software\Classes\tarfile\Shell]
"(Default)" = "open"

[HKCR\NCH.Scribe.aif]
"(Default)" = ""

[HKCU\Software\Classes\FirefoxHTML\shell\NCHconvertdoc]
"(Default)" = "Convert file type"

[HKCU\Software\Classes\xvidfile\Shell\NCHeditvideo\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe -extfind VideoPad %L"

[HKCU\Software\Classes\movfile\Shell\NCHeditvideo]
"(Default)" = "Edit video file"

[HKCR\NCH.Scribe.dct\DefaultIcon]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe,0"

[HKCU\Software\Classes\mpegfile\Shell\NCHconvertvideo\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe -extfind Prism %L"

[HKCR\.dvs]
"Scribe.BAK" = ""

[HKCR\.dss]
"Scribe.BAK" = ""

[HKCU\Software\Classes\giffile\Shell\NCHconvertimage]
"(Default)" = "Convert image file"

[HKCU\Software\Classes\odtfile\Shell]
"(Default)" = "open"

[HKLM\SOFTWARE\RegisteredApplications]
"Scribe" = "Software\NCH Software\Scribe\Capabilities"

[HKCU\Software\Classes\movfile\Shell\NCHconvertvideo\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe -extfind Prism %L"

[HKCU\Software\Classes\jpegfile\Shell]
"(Default)" = "open"

[HKCR\NCH.Scribe.dss]
"(Default)" = "Express Scribe Dictation File"

[HKCU\Software\Classes\pngfile\Shell\NCHslideshow\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe -extfind PhotoStage %L"

[HKCU\Software\Classes\aufile\Shell\NCHeditsound\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe -extfind WavePad %L"

[HKCU\Software\Classes\mpgfile\Shell]
"(Default)" = "open"

[HKLM\SOFTWARE\Wow6432Node\NCH Software\Scribe\Capabilities\FileTypes]
".dct" = "NCH.Scribe.dct"

[HKCU\Software\Classes\xvidfile\Shell\NCHconvertvideo\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe -extfind Prism %L"

[HKCR\NCH.Scribe.aiff\Shell\Transcribe with Express Scribe Transcription Software\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe %L"

[HKLM\SOFTWARE\Wow6432Node\Google\GCAPITemp]
"test" = "testvlp"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Scribe]
"VersionMinor" = "69"

[HKCU\Software\Classes\m4afile\Shell\NCHeditsound\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe -extfind WavePad %L"

[HKCU\Software\Classes\NCH.Scribe.aif\Shell\NCHconvertsound]
"(Default)" = "Convert sound file"

[HKCU\Software\Classes\vobfile\Shell\NCHeditvideo\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe -extfind VideoPad %L"

[HKCU\Software\Classes\mpgfile\Shell\NCHeditvideo\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe -extfind VideoPad %L"

[HKCU\Software\Classes\.tar.gz]
"(Default)" = "tar.gzfile"

[HKCU\Software\NCH Software\Scribe\Hotkey\4]
"key" = "117"

[HKCU\Software\Classes\gsmfile\Shell\NCHconvertsound\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe -extfind Switch %L"

[HKCR\.msv\OpenWithProgIds]
"NCH.Scribe.msv" = "Type: REG_NONE, Length: 0"

[HKCU\Software\Classes\.MP3]
"(Default)" = "NCH.Scribe.mp3"

[HKLM\SOFTWARE\Wow6432Node\NCH Software\Scribe\Capabilities\FileAssociations]
".MP3" = "NCH.Scribe.mp3"

[HKCU\Software\Classes\divxfile\Shell\NCHconvertvideo\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe -extfind Prism %L"

[HKCU\Software\NCH Software\Scribe\Software]
"SVar" = "LLIBShowrelatedwhenchromeon"

[HKCU\Software\Classes\vocfile\Shell]
"(Default)" = "open"

[HKCR\NCH.Scribe.wav\shell]
"(Default)" = "Open"

[HKCU\Software\Classes\jpegfile\Shell\NCHslideshow\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe -extfind PhotoStage %L"

[HKCU\Software\Classes\.spj]
"(Default)" = "spjfile"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Scribe]
"UninstallString" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe -uninstall"

[HKCU\Software\Classes\meofile\shell\open\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe -extfind Meo %L"

[HKCU\Software\Classes\giffile\Shell]
"(Default)" = "open"

[HKCU\Software\Classes\mp4file\Shell\NCHeditvideo]
"(Default)" = "Edit video file"

[HKCU\Software\NCH Software\Scribe\Hotkey\2]
"key" = "115"

[HKCU\Software\Classes\Windows.IsoFile\shell]
"(Default)" = "open"

[HKCU\Software\Classes\vobfile\Shell\NCHconvertvideo]
"(Default)" = "Convert video file"

[HKCU\Software\Classes\mpeg2file\Shell\NCHconvertvideo]
"(Default)" = "Convert video file"

[HKCU\Software\Classes\voxfile\Shell\NCHconvertsound]
"(Default)" = "Convert sound file"

[HKCU\Software\Classes\avifile\Shell]
"(Default)" = "open"

[HKCU\Software\Classes\xvidfile\Shell\NCHeditvideo]
"(Default)" = "Edit video file"

[HKCR\NCH.Scribe.msv]
"(Default)" = "Express Scribe Dictation File"

[HKCU\Software\NCH Software\Scribe\Hotkey\1]
"key" = "114"

[HKCR\NCH.Scribe.mp3\Shell\Transcribe with Express Scribe Transcription Software\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe %L"

[HKCU\Software\Classes\.ivr]
"(Default)" = "ivrfile"

[HKCR\NCH.Scribe.wma\Shell\Transcribe with Express Scribe Transcription Software\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe %L"

[HKCR\SystemFileAssociations\.aiff\Shell\Transcribe with Express Scribe Transcription Software\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe %L"

[HKCU\Software\Classes\meofile\DefaultIcon]
"(Default)" = "%SystemRoot%\SysWow64\shell32.dll,19"

[HKCU\Software\Classes\CABFolder\Shell]
"(Default)" = "open"

[HKCU\Software\NCH Software\Scribe\Hotkey\3]
"key" = "116"

[HKLM\SOFTWARE\Wow6432Node\NCH Software\Scribe\Capabilities\FileTypes]
".WAV" = "NCH.Scribe.wav"

[HKCU\Software\Classes\oggfile\Shell]
"(Default)" = "open"

[HKCU\Software\Classes\docxfile\Shell\NCHconvertdoc\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe -extfind Doxillion %L"

[HKCU\Software\Classes\neffile\Shell]
"(Default)" = "open"

[HKCU\Software\Classes\voxfile\Shell\NCHeditsound]
"(Default)" = "Edit sound file"

[HKCR\NCH.Scribe.msv\shell\open\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe %L"

[HKCU\Software\Classes\NCH.Scribe.wav\Shell\NCHeditsound]
"(Default)" = "Edit sound file"

[HKCU\Software\Classes\flacfile\Shell\NCHconvertsound]
"(Default)" = "Convert sound file"

[HKCR\NCH.Scribe.msv\shell]
"(Default)" = "Open"

[HKCU\Software\Classes\rarfile\Shell\NCHextract]
"(Default)" = "Extract with Express Zip"

[HKCU\Software\Classes\odtfile\Shell\NCHconvertdoc]
"(Default)" = "Convert file type"

[HKCU\Software\Classes\NCH.Scribe.mp3\Shell\NCHconvertsound\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe -extfind Switch %L"

[HKCU\Software\Classes\ds2file\shell\NCHconvertsound\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe -extfind Switch %L"

[HKCU\Software\Classes\.FLAC]
"(Default)" = "flacfile"

[HKCU\Software\Classes\NCH.Scribe.wma\Shell\NCHconvertsound]
"(Default)" = "Convert sound file"

[HKCU\Software\Classes\mpdpfile\shell\open\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe -extfind MixPad %L"

[HKCU\Software\NCH Software\Scribe\Hotkey]
"maxId" = "9"

[HKCU\Software\Classes\NCH.Scribe.wav\Shell\NCHconvertsound]
"(Default)" = "Convert sound file"

[HKCR\NCH.Scribe.aif\DefaultIcon]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe,0"

[HKCU\Software\NCH Software\Scribe\Hotkey\8]
"key" = "121"

[HKCU\Software\Classes\ds2file\shell]
"(Default)" = "open"

[HKCR\NCH.Scribe.aiff]
"(Default)" = ""

[HKCU\Software\Classes\giffile\Shell\NCHslideshow\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe -extfind PhotoStage %L"

[HKCU\Software\Classes\.gsm]
"(Default)" = "gsmfile"

[HKCU\Software\Classes\NCH.Scribe.aiff\Shell\NCHconvertsound\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe -extfind Switch %L"

[HKCU\Software\Classes\ivrfile]
"(Default)" = "Unhandled Extension Handler Finder"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\NCH Software\Scribe\Hotkey\4]
"Command" = "1"

[HKCU\Software\Classes\tarfile\Shell\NCHextract]
"(Default)" = "Extract with Express Zip"

[HKCU\Software\Classes\tarfile\Shell\NCHextract\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe -extfind ExpressZip %L"

[HKCU\Software\NCH Software\Scribe\Hotkey\2]
"Command" = "3"

[HKCU\Software\NCH Software\Scribe\Hotkey\5]
"Command" = "6"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCR\NCH.Scribe.dct]
"(Default)" = "Express Scribe Dictation File"

[HKCU\Software\NCH Software\Scribe\Settings]
"currentVersion" = "5.69"

[HKCU\Software\Classes\avifile\Shell\NCHconvertvideo]
"(Default)" = "Convert video file"

[HKCR\NCH.Scribe.mp3\DefaultIcon]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe,0"

[HKCU\Software\Classes\oggfile\Shell\NCHeditsound\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe -extfind WavePad %L"

[HKCU\Software\Classes\oggfile\Shell\NCHeditsound]
"(Default)" = "Edit sound file"

[HKCU\Software\Classes\movfile\Shell\NCHeditvideo\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe -extfind VideoPad %L"

[HKCU\Software\Classes\movfile\Shell\NCHconvertvideo]
"(Default)" = "Convert video file"

[HKCU\Software\Classes\.M4A]
"(Default)" = "m4afile"

[HKCU\Software\Classes\aacfile\Shell\NCHconvertsound]
"(Default)" = "Convert sound file"

[HKCU\Software\Classes\spjfile\shell\open\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe -extfind PhotoStage %L"

[HKCU\Software\Classes\rarfile\Shell\NCHextract\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe -extfind ExpressZip %L"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Scribe]
"VersionMajor" = "5"

[HKCU\Software\Classes\CABFolder\Shell\NCHextract]
"(Default)" = "Extract with Express Zip"

[HKCU\Software\Classes\wpfile\Shell\NCHconvertdoc]
"(Default)" = "Convert file type"

[HKCR\NCH.Scribe.wav]
"(Default)" = ""

[HKLM\SOFTWARE\Wow6432Node\NCH Software\Scribe\Capabilities\FileAssociations]
".dct" = "NCH.Scribe.dct"

[HKCU\Software\Classes\.AIF]
"(Default)" = "NCH.Scribe.aif"

[HKCU\Software\Classes\flacfile\Shell]
"(Default)" = "open"

[HKCU\Software\NCH Software\Scribe\Hotkey\6]
"key" = "119"

[HKCU\Software\NCH Software\Scribe\Hotkey\3]
"Command" = "0"

[HKCU\Software\Classes\7zfile\Shell\NCHextract\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe -extfind ExpressZip %L"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer]
"GlobalAssocChangedCounter" = "35"

[HKCR\NCH.Scribe.aif\shell]
"(Default)" = "Open"

[HKCU\Software\Classes\FirefoxHTML\shell\NCHconvertdoc\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe -extfind Doxillion %L"

[HKCU\Software\Classes\gsmfile\Shell]
"(Default)" = "open"

[HKCU\Software\Classes\NCH.Scribe.mp3\Shell\NCHeditsound]
"(Default)" = "Edit sound file"

[HKCR\NCH.Scribe.wav\Shell\Transcribe with Express Scribe Transcription Software\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe %L"

[HKCU\Software\Classes\neffile\Shell\NCHconvertimage]
"(Default)" = "Convert image file"

[HKCU\Software\Classes\TIFImage.Document\Shell\NCHconvertimage\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe -extfind Pixillion %L"

[HKCU\Software\Classes\mpegfile\Shell\NCHconvertvideo]
"(Default)" = "Convert video file"

[HKCU\Software\Classes\aacfile\Shell\NCHconvertsound\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe -extfind Switch %L"

[HKLM\SOFTWARE\Wow6432Node\NCH Software\Scribe\Capabilities]
"ApplicationDescription" = "Express Scribe Transcription Software"

[HKCU\Software\NCH Software\Scribe\Hotkey\7]
"key" = "120"

[HKCU\Software\NCH Software\Scribe\Hotkey\5]
"key" = "118"

[HKCU\Software\Classes\asffile\Shell\NCHeditvideo\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe -extfind VideoPad %L"

[HKLM\SOFTWARE\Wow6432Node\NCH Software\Scribe\Capabilities\FileAssociations]
".dss" = "NCH.Scribe.dss"

[HKCU\Software\Classes\aacfile\Shell\NCHeditsound\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe -extfind WavePad %L"

[HKCU\Software\Classes\AcroExch.Document\Shell\NCHconvertdoc]
"(Default)" = "Convert file type"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Scribe]
"InstallLocation" = "%Program Files% (x86)\NCH Software\Scribe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dct\UserChoice]
"Progid" = "NCH.Scribe.dct"

[HKCU\Software\Classes\wpdfile\Shell\NCHconvertdoc]
"(Default)" = "Convert file type"

[HKCU\Software\Classes\Windows.IsoFile\shell\NCHextract\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe -extfind ExpressZip %L"

[HKCU\Software\Classes\aacfile\Shell]
"(Default)" = "open"

[HKCU\Software\Classes\.m4v]
"(Default)" = "m4vfile"

[HKCU\Software\Classes\divxfile\Shell]
"(Default)" = "open"

[HKCU\Software\Classes\AcroExch.Document\Shell\NCHconvertdoc\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe -extfind Doxillion %L"

[HKCU\Software\Classes\m4vfile\Shell\NCHconvertvideo\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe -extfind Prism %L"

[HKCU\Software\Classes\tar.gzfile\Shell\NCHextract\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe -extfind ExpressZip %L"

[HKCU\Software\Classes\giffile\Shell\NCHconvertimage\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe -extfind Pixillion %L"

[HKCU\Software\Classes\wpdfile\Shell\NCHconvertdoc\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe -extfind Doxillion %L"

[HKCU\Software\Classes\.mpdp]
"(Default)" = "mpdpfile"

[HKCU\Software\Classes\mpdpfile\DefaultIcon]
"(Default)" = "%SystemRoot%\SysWow64\shell32.dll,19"

[HKCU\Software\Classes\NCH.Scribe.wav\Shell\NCHeditsound\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe -extfind WavePad %L"

[HKCU\Software\Classes\docxfile\Shell]
"(Default)" = "open"

[HKCR\NCH.Scribe.aif\Shell\Transcribe with Express Scribe Transcription Software\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe %L"

[HKCR\NCH.Scribe.wma\shell]
"(Default)" = "Open"

[HKCR\.dss]
"(Default)" = "NCH.Scribe.dss"

[HKCU\Software\Classes\movfile\Shell]
"(Default)" = "open"

[HKCU\Software\Classes\odtfile\Shell\NCHconvertdoc\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe -extfind Doxillion %L"

[HKCR\Applications\scribe.exe\shell]
"(Default)" = "Open"

[HKCU\Software\Classes\wpfile\Shell]
"(Default)" = "open"

[HKCU\Software\Classes\rarfile\Shell]
"(Default)" = "open"

[HKCU\Software\Classes\CABFolder\Shell\NCHextract\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe -extfind ExpressZip %L"

[HKCU\Software\Classes\divxfile\Shell\NCHeditvideo\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe -extfind VideoPad %L"

[HKCU\Software\Classes\gzfile\Shell]
"(Default)" = "open"

[HKCR\Applications\scribe.exe\DefaultIcon]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe,0"

[HKCU\Software\Classes\mpegfile\Shell\NCHeditvideo]
"(Default)" = "Edit video file"

[HKCU\Software\Classes\m4afile\Shell\NCHeditsound]
"(Default)" = "Edit sound file"

[HKCU\Software\Classes\avifile\Shell\NCHeditvideo\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe -extfind VideoPad %L"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Scribe]
"Version" = "5.69"

[HKCU\Software\Classes\mohfile]
"(Default)" = "Unhandled Extension Handler Finder"

[HKCU\Software\Classes\.mp4]
"(Default)" = "mp4file"

[HKCU\Software\Classes\Windows.IsoFile\shell\open\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe -extfind ExpressBurn %L"

[HKCU\Software\Classes\7zfile\Shell\NCHextract]
"(Default)" = "Extract with Express Zip"

[HKCR\.dct]
"(Default)" = "NCH.Scribe.dct"

[HKCU\Software\Classes\jpegfile\Shell\NCHconvertimage\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe -extfind Pixillion %L"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Scribe]
"DisplayVersion" = "5.69"

[HKCR\NCH.Scribe.dss\DefaultIcon]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe,0"

[HKCU\Software\Classes\pngfile\Shell]
"(Default)" = "open"

[HKCU\Software\Classes\vpjfile\DefaultIcon]
"(Default)" = "%SystemRoot%\SysWow64\shell32.dll,19"

[HKLM\SOFTWARE\Wow6432Node\NCH Software\Scribe\Capabilities\FileAssociations]
".WAV" = "NCH.Scribe.wav"

[HKCR\SystemFileAssociations\.wma\Shell\Transcribe with Express Scribe Transcription Software\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe %L"

[HKCU\Software\Classes\mpgfile\Shell\NCHconvertvideo]
"(Default)" = "Convert video file"

[HKCU\Software\NCH Software\Scribe\Hotkey\0]
"Command" = "9"

[HKCU\Software\Classes\.doc]
"(Default)" = "docfile"

[HKCU\Software\NCH Software\Scribe\Hotkey\8]
"Command" = "8"

[HKCU\Software\Classes\aufile\Shell]
"(Default)" = "open"

[HKCR\NCH.Scribe.wav\shell\open\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe %L"

[HKCU\Software\Classes\aufile\Shell\NCHconvertsound\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe -extfind Switch %L"

[HKCU\Software\Classes\rtffile\Shell]
"(Default)" = "open"

[HKCU\Software\Classes\docfile\Shell]
"(Default)" = "open"

[HKCR\NCH.Scribe.dss\shell]
"(Default)" = "Open"

[HKCU\Software\Classes\NCH.Scribe.aiff\Shell\NCHconvertsound]
"(Default)" = "Convert sound file"

[HKCR\SystemFileAssociations\.aif\Shell\Transcribe with Express Scribe Transcription Software\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe %L"

[HKCU\Software\Classes\pngfile\Shell\NCHconvertimage]
"(Default)" = "Convert image file"

[HKCU\Software\Classes\mpgfile\Shell\NCHeditvideo]
"(Default)" = "Edit video file"

[HKCU\Software\Classes\voxfile\Shell\NCHeditsound\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe -extfind WavePad %L"

[HKCR\SystemFileAssociations\.wav\Shell\Transcribe with Express Scribe Transcription Software\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe %L"

[HKCU\Software\Classes\NCH.Scribe.mp3\Shell\NCHeditsound\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Scribe\scribe.exe -extfind WavePad %L"

[HKCU\Software\Classes\Windows.IsoFile\DefaultIcon]
"(Default)" = "%SystemRoot%\SysWow64\shell32.dll,19"

The PUP deletes the following registry key(s):

[HKLM\SOFTWARE\Wow6432Node\Google\GCAPITemp]

The PUP deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dvs\UserChoice]
"Progid"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKLM\SOFTWARE\Wow6432Node\Google\GCAPITemp]
"test"

[HKCU\Software\NCH Software\Scribe\Software]
"_ShowSurvey"
"InstalledBy"
"ShowSurveyNow"
"ShowSurvey"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.msv\UserChoice]
"Progid"

[HKCU\Software\NCH Software\Scribe\Software]
"_ShowSurveyNow"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dss\UserChoice]
"Progid"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\NCH Software\Scribe\Software]
"_InstalledBy"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dct\UserChoice]
"Progid"

The process nchsetup.exe:2512 makes changes in the system registry.

The PUP creates and/or sets the following values in system registry:

[HKCU\Software\Classes\NCH.Scribe.aif\Shell\NCHconvertsound\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Express\express.exe -extfind Switch %L"

[HKCU\Software\Classes\Paint.Picture\Shell\NCHconvertimage]
"(Default)" = "Convert image file"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Express]
"VersionMajor" = "5"

[HKCU\Software\Classes\mpegfile\Shell\NCHconvertvideo\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Express\express.exe -extfind Prism %L"

[HKCU\Software\Classes\NCH.Scribe.aiff\Shell\NCHeditsound\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Express\express.exe -extfind WavePad %L"

[HKCU\Software\Classes\FirefoxHTML\shell\NCHconvertdoc\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Express\express.exe -extfind Doxillion %L"

[HKCU\Software\Classes\rtffile\Shell\NCHconvertdoc\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Express\express.exe -extfind Doxillion %L"

[HKCU\Software\Classes\NCH.Scribe.mp3\Shell\NCHeditsound]
"(Default)" = "Edit sound file"

[HKCU\Software\Classes\asffile\Shell\NCHeditvideo]
"(Default)" = "Edit video file"

[HKCU\Software\Classes\NCH.Scribe.wma\Shell\NCHeditsound]
"(Default)" = "Edit sound file"

[HKCU\Software\Classes\docfile\Shell\NCHconvertdoc\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Express\express.exe -extfind Doxillion %L"

[HKCU\Software\Classes\NCH.Scribe.wav\Shell\NCHconvertsound\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Express\express.exe -extfind Switch %L"

[HKCU\Software\Classes\neffile\Shell\NCHconvertimage]
"(Default)" = "Convert image file"

[HKCU\Software\Classes\pngfile\Shell\NCHslideshow\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Express\express.exe -extfind PhotoStage %L"

[HKCU\Software\Classes\aufile\Shell\NCHeditsound\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Express\express.exe -extfind WavePad %L"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Express]
"DisplayName" = "Express Dictate Digital Dictation Software"

[HKCU\Software\Classes\7zfile\Shell\NCHextract\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Express\express.exe -extfind ExpressZip %L"

[HKCU\Software\Classes\aacfile\Shell\NCHconvertsound\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Express\express.exe -extfind Switch %L"

[HKCU\Software\Classes\Paint.Picture\Shell\NCHslideshow\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Express\express.exe -extfind PhotoStage %L"

[HKCU\Software\Classes\m4afile\Shell\NCHeditsound\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Express\express.exe -extfind WavePad %L"

[HKCU\Software\Classes\wpfile\Shell\NCHconvertdoc\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Express\express.exe -extfind Doxillion %L"

[HKCU\Software\Classes\NCH.Scribe.mp3\Shell\NCHconvertsound]
"(Default)" = "Convert sound file"

[HKCU\Software\Classes\avifile\Shell\NCHeditvideo]
"(Default)" = "Edit video file"

[HKCU\Software\Classes\xvidfile\Shell\NCHconvertvideo\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Express\express.exe -extfind Prism %L"

[HKCU\Software\Classes\asffile\Shell\NCHeditvideo\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Express\express.exe -extfind VideoPad %L"

[HKCU\Software\Classes\vocfile\Shell\NCHeditsound\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Express\express.exe -extfind WavePad %L"

[HKCU\Software\Classes\NCH.Scribe.aif\Shell\NCHconvertsound]
"(Default)" = "Convert sound file"

[HKCU\Software\Classes\aacfile\Shell\NCHeditsound\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Express\express.exe -extfind WavePad %L"

[HKCU\Software\Classes\asffile\Shell\NCHconvertvideo\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Express\express.exe -extfind Prism %L"

[HKCU\Software\Classes\vobfile\Shell\NCHeditvideo\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Express\express.exe -extfind VideoPad %L"

[HKCU\Software\Classes\mpgfile\Shell\NCHeditvideo\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Express\express.exe -extfind VideoPad %L"

[HKCU\Software\Classes\AcroExch.Document\Shell\NCHconvertdoc]
"(Default)" = "Convert file type"

[HKCU\Software\Classes\mpeg2file\Shell\NCHconvertvideo\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Express\express.exe -extfind Prism %L"

[HKCU\Software\Classes\pngfile\Shell\NCHconvertimage\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Express\express.exe -extfind Pixillion %L"

[HKCU\Software\NCH Software\Express\Settings]
"WorkingDataFolderPrevious" = "C:\Users\"%CurrentUserName%"\AppData\Roaming\NCH Software\Express"

[HKCU\Software\Classes\giffile\Shell\NCHslideshow]
"(Default)" = "Create slideshow"

[HKCU\Software\Classes\mpeg2file\Shell\NCHeditvideo\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Express\express.exe -extfind VideoPad %L"

[HKCU\Software\Classes\gsmfile\Shell\NCHconvertsound\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Express\express.exe -extfind Switch %L"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Express]
"Publisher" = "NCH Software"

[HKCU\Software\Classes\wpdfile\Shell\NCHconvertdoc]
"(Default)" = "Convert file type"

[HKLM\SOFTWARE\Wow6432Node\NCH Software\Express\Settings]
"InstallerPath" = "%Program Files% (x86)\NCH Software\Express"

[HKCU\Software\NCH Software\Express\Settings]
"WorkingDataFolder" = "C:\Users\"%CurrentUserName%"\AppData\Roaming\NCH Software\Express"

[HKCU\Software\Classes\tar.gzfile\Shell\NCHextract]
"(Default)" = "Extract with Express Zip"

[HKCU\Software\Classes\divxfile\Shell\NCHconvertvideo\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Express\express.exe -extfind Prism %L"

[HKCU\Software\Classes\mpegfile\Shell\NCHeditvideo\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Express\express.exe -extfind VideoPad %L"

[HKCU\Software\Classes\mp4file\Shell\NCHeditvideo\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Express\express.exe -extfind VideoPad %L"

[HKCU\Software\Classes\Windows.IsoFile\shell\NCHextract\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Express\express.exe -extfind ExpressZip %L"

[HKCU\Software\Classes\NCH.Scribe.aif\Shell\NCHeditsound]
"(Default)" = "Edit sound file"

[HKCU\Software\Classes\jpegfile\Shell\NCHslideshow\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Express\express.exe -extfind PhotoStage %L"

[HKCU\Software\Classes\docfile\Shell\NCHconvertdoc]
"(Default)" = "Convert file type"

[HKCU\Software\Classes\xvidfile\Shell\NCHconvertvideo]
"(Default)" = "Convert video file"

[HKCU\Software\NCH Software\Express\Settings]
"InstalledByAdmin" = "1"

[HKCU\Software\Classes\neffile\Shell\NCHconvertimage\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Express\express.exe -extfind Pixillion %L"

[HKCU\Software\Classes\m4vfile\Shell\NCHconvertvideo\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Express\express.exe -extfind Prism %L"

[HKCU\Software\Classes\flacfile\Shell\NCHconvertsound\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Express\express.exe -extfind Switch %L"

[HKCU\Software\Classes\mp4file\Shell\NCHeditvideo]
"(Default)" = "Edit video file"

[HKCU\Software\Classes\Windows.IsoFile\shell\NCHextract]
"(Default)" = "Extract with Express Zip"

[HKCU\Software\Classes\tar.gzfile\Shell\NCHextract\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Express\express.exe -extfind ExpressZip %L"

[HKCU\Software\Classes\mpeg2file\Shell\NCHeditvideo]
"(Default)" = "Edit video file"

[HKCU\Software\Classes\aufile\Shell\NCHeditsound]
"(Default)" = "Edit sound file"

[HKCU\Software\Classes\pngfile\Shell\NCHslideshow]
"(Default)" = "Create slideshow"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Express]
"DisplayIcon" = "%Program Files% (x86)\NCH Software\Express\express.exe"

[HKCU\Software\Classes\giffile\Shell\NCHconvertimage\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Express\express.exe -extfind Pixillion %L"

[HKCU\Software\Classes\vobfile\Shell\NCHconvertvideo]
"(Default)" = "Convert video file"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Express]
"Version" = "5.82"

[HKCU\Software\Classes\voxfile\Shell\NCHconvertsound]
"(Default)" = "Convert sound file"

[HKCU\Software\Classes\rtffile\Shell\NCHconvertdoc]
"(Default)" = "Convert file type"

[HKCU\Software\Classes\TIFImage.Document\Shell\NCHconvertimage]
"(Default)" = "Convert image file"

[HKCU\Software\Classes\xvidfile\Shell\NCHeditvideo]
"(Default)" = "Edit video file"

[HKCU\Software\Classes\giffile\Shell\NCHconvertimage]
"(Default)" = "Convert image file"

[HKCU\Software\Classes\docxfile\Shell\NCHconvertdoc]
"(Default)" = "Convert file type"

[HKCU\Software\Classes\divxfile\Shell\NCHeditvideo\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Express\express.exe -extfind VideoPad %L"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Express]
"URLUpdateInfo" = "www.nch.com.au/express/index.html"

[HKCU\Software\Classes\NCH.Scribe.wma\Shell\NCHconvertsound\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Express\express.exe -extfind Switch %L"

[HKCU\Software\Classes\odtfile\Shell\NCHconvertdoc\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Express\express.exe -extfind Doxillion %L"

[HKCU\Software\Classes\gsmfile\Shell\NCHconvertsound]
"(Default)" = "Convert sound file"

[HKCU\Software\Classes\gzfile\Shell\NCHextract]
"(Default)" = "Extract with Express Zip"

[HKCU\Software\Classes\NCH.Scribe.wav\Shell\NCHeditsound\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Express\express.exe -extfind WavePad %L"

[HKCU\Software\Classes\divxfile\Shell\NCHconvertvideo]
"(Default)" = "Convert video file"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Express]
"UninstallString" = "%Program Files% (x86)\NCH Software\Express\express.exe -uninstall"

[HKCU\Software\Classes\CABFolder\Shell\NCHextract\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Express\express.exe -extfind ExpressZip %L"

[HKCU\Software\Classes\vobfile\Shell\NCHconvertvideo\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Express\express.exe -extfind Prism %L"

[HKCU\Software\Classes\docxfile\Shell\NCHconvertdoc\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Express\express.exe -extfind Doxillion %L"

[HKCU\Software\Classes\mpgfile\Shell\NCHconvertvideo\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Express\express.exe -extfind Prism %L"

[HKCU\Software\Classes\jpegfile\Shell\NCHslideshow]
"(Default)" = "Create slideshow"

[HKCU\Software\Classes\voxfile\Shell\NCHeditsound]
"(Default)" = "Edit sound file"

[HKCU\Software\Classes\NCH.Scribe.wav\Shell\NCHeditsound]
"(Default)" = "Edit sound file"

[HKCU\Software\Classes\flacfile\Shell\NCHconvertsound]
"(Default)" = "Convert sound file"

[HKCU\Software\Classes\rarfile\Shell\NCHextract]
"(Default)" = "Extract with Express Zip"

[HKCU\Software\Classes\mpegfile\Shell\NCHeditvideo]
"(Default)" = "Edit video file"

[HKCU\Software\Classes\movfile\Shell\NCHconvertvideo\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Express\express.exe -extfind Prism %L"

[HKCU\Software\Classes\avifile\Shell\NCHconvertvideo\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Express\express.exe -extfind Prism %L"

[HKCU\Software\Classes\odtfile\Shell\NCHconvertdoc]
"(Default)" = "Convert file type"

[HKCU\Software\Classes\NCH.Scribe.mp3\Shell\NCHeditsound\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Express\express.exe -extfind WavePad %L"

[HKCU\Software\Classes\NCH.Scribe.mp3\Shell\NCHconvertsound\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Express\express.exe -extfind Switch %L"

[HKCU\Software\Classes\neffile\Shell\NCHslideshow]
"(Default)" = "Create slideshow"

[HKCU\Software\Classes\ds2file\shell\NCHconvertsound]
"(Default)" = "Convert sound file"

[HKCU\Software\Classes\ds2file\shell\NCHconvertsound\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Express\express.exe -extfind Switch %L"

[HKLM\SOFTWARE\Wow6432Node\NCH Software\Express\Software]
"Installer" = "%Program Files% (x86)\NCH Software\Express\expresssetup_v5.82.exe"

[HKCU\Software\Classes\NCH.Scribe.wma\Shell\NCHconvertsound]
"(Default)" = "Convert sound file"

[HKCU\Software\Classes\NCH.Scribe.aif\Shell\NCHeditsound\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Express\express.exe -extfind WavePad %L"

[HKCU\Software\Classes\m4afile\Shell\NCHeditsound]
"(Default)" = "Edit sound file"

[HKCU\Software\NCH Software\Express\Settings]
"InstallerPath" = "%Program Files% (x86)\NCH Software\Express"

[HKCU\Software\Classes\NCH.Scribe.wav\Shell\NCHconvertsound]
"(Default)" = "Convert sound file"

[HKCU\Software\Classes\avifile\Shell\NCHeditvideo\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Express\express.exe -extfind VideoPad %L"

[HKCU\Software\Classes\Paint.Picture\Shell\NCHconvertimage\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Express\express.exe -extfind Pixillion %L"

[HKCU\Software\Classes\NCH.Scribe.aiff\Shell\NCHeditsound]
"(Default)" = "Edit sound file"

[HKCU\Software\Classes\divxfile\Shell\NCHeditvideo]
"(Default)" = "Edit video file"

[HKCU\Software\Classes\giffile\Shell\NCHslideshow\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Express\express.exe -extfind PhotoStage %L"

[HKCU\Software\Classes\aufile\Shell\NCHconvertsound]
"(Default)" = "Convert sound file"

[HKCU\Software\Classes\7zfile\Shell\NCHextract]
"(Default)" = "Extract with Express Zip"

[HKCU\Software\Classes\neffile\Shell\NCHslideshow\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Express\express.exe -extfind PhotoStage %L"

[HKCU\Software\Classes\NCH.Scribe.aiff\Shell\NCHconvertsound\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Express\express.exe -extfind Switch %L"

[HKCU\Software\Classes\jpegfile\Shell\NCHconvertimage\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Express\express.exe -extfind Pixillion %L"

[HKCU\Software\Classes\mpeg2file\Shell\NCHconvertvideo]
"(Default)" = "Convert video file"

[HKCU\Software\Classes\aacfile\Shell\NCHeditsound]
"(Default)" = "Edit sound file"

[HKCU\Software\Classes\m4vfile\Shell\NCHeditvideo]
"(Default)" = "Edit video file"

[HKCU\Software\Classes\gzfile\Shell\NCHextract\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Express\express.exe -extfind ExpressZip %L"

[HKCU\Software\NCH Software\Express\Settings]
"InstallDateFirst" = "1432028265"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Express]
"DisplayVersion" = "5.82"
"InstallLocation" = "%Program Files% (x86)\NCH Software\Express"

[HKCU\Software\Classes\Paint.Picture\Shell\NCHslideshow]
"(Default)" = "Create slideshow"

[HKCU\Software\Classes\TIFImage.Document\Shell\NCHconvertimage\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Express\express.exe -extfind Pixillion %L"

[HKCU\Software\Classes\tarfile\Shell\NCHextract]
"(Default)" = "Extract with Express Zip"

[HKCU\Software\Classes\mpgfile\Shell\NCHconvertvideo]
"(Default)" = "Convert video file"

[HKCU\Software\Classes\mp4file\Shell\NCHconvertvideo]
"(Default)" = "Convert video file"

[HKCU\Software\Classes\m4vfile\Shell\NCHconvertvideo]
"(Default)" = "Convert video file"

[HKCU\Software\Classes\avifile\Shell\NCHconvertvideo]
"(Default)" = "Convert video file"

[HKCU\Software\Classes\asffile\Shell\NCHconvertvideo]
"(Default)" = "Convert video file"

[HKCU\Software\Classes\mp4file\Shell\NCHconvertvideo\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Express\express.exe -extfind Prism %L"

[HKCU\Software\Classes\aufile\Shell\NCHconvertsound\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Express\express.exe -extfind Switch %L"

[HKCU\Software\Classes\AcroExch.Document\Shell\NCHconvertdoc\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Express\express.exe -extfind Doxillion %L"

[HKCU\Software\Classes\vobfile\Shell\NCHeditvideo]
"(Default)" = "Edit video file"

[HKCU\Software\Classes\jpegfile\Shell\NCHconvertimage]
"(Default)" = "Convert image file"

[HKCU\Software\Classes\NCH.Scribe.aiff\Shell\NCHconvertsound]
"(Default)" = "Convert sound file"

[HKCU\Software\Classes\oggfile\Shell\NCHeditsound\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Express\express.exe -extfind WavePad %L"

[HKCU\Software\Classes\pngfile\Shell\NCHconvertimage]
"(Default)" = "Convert image file"

[HKCU\Software\Classes\mpgfile\Shell\NCHeditvideo]
"(Default)" = "Edit video file"

[HKCU\Software\Classes\oggfile\Shell\NCHeditsound]
"(Default)" = "Edit sound file"

[HKCU\Software\Classes\voxfile\Shell\NCHeditsound\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Express\express.exe -extfind WavePad %L"

[HKCU\Software\Classes\movfile\Shell\NCHeditvideo\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Express\express.exe -extfind VideoPad %L"

[HKCU\Software\Classes\m4vfile\Shell\NCHeditvideo\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Express\express.exe -extfind VideoPad %L"

[HKCU\Software\NCH Software\Express\Software]
"InstalledBy" = "rpScribe"

[HKCU\Software\Classes\wpdfile\Shell\NCHconvertdoc\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Express\express.exe -extfind Doxillion %L"

[HKCU\Software\Classes\movfile\Shell\NCHconvertvideo]
"(Default)" = "Convert video file"

[HKCU\Software\NCH Software\Express\Settings]
"currentVersion" = "5.82"

[HKCU\Software\Classes\mpegfile\Shell\NCHconvertvideo]
"(Default)" = "Convert video file"

[HKCU\Software\Classes\voxfile\Shell\NCHconvertsound\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Express\express.exe -extfind Switch %L"

[HKCU\Software\Classes\vocfile\Shell\NCHeditsound]
"(Default)" = "Edit sound file"

[HKCU\Software\Classes\aacfile\Shell\NCHconvertsound]
"(Default)" = "Convert sound file"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Express]
"URLInfoAbout" = "www.nch.com.au/express/support.html"

[HKCU\Software\Classes\FirefoxHTML\shell\NCHconvertdoc]
"(Default)" = "Convert file type"

[HKCU\Software\Classes\rarfile\Shell\NCHextract\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Express\express.exe -extfind ExpressZip %L"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Express]
"VersionMinor" = "82"

[HKCU\Software\Classes\NCH.Scribe.wma\Shell\NCHeditsound\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Express\express.exe -extfind WavePad %L"

[HKCU\Software\Classes\xvidfile\Shell\NCHeditvideo\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Express\express.exe -extfind VideoPad %L"

[HKCU\Software\Classes\CABFolder\Shell\NCHextract]
"(Default)" = "Extract with Express Zip"

[HKCU\Software\Classes\movfile\Shell\NCHeditvideo]
"(Default)" = "Edit video file"

[HKCU\Software\Classes\wpfile\Shell\NCHconvertdoc]
"(Default)" = "Convert file type"

[HKCU\Software\Classes\tarfile\Shell\NCHextract\command]
"(Default)" = "%Program Files% (x86)\NCH Software\Express\express.exe -extfind ExpressZip %L"

[HKCU\Software\NCH Software\Express\Settings]
"InstallDate" = "1432028265"

The PUP deletes the following value(s) in system registry:

[HKCU\Software\NCH Software\Express\Settings]
"OSCheck"
"InstalledByAdmin"
"_NewerVersion"
"_OSCheck"
"NewerVersion"
"_InstalledByAdmin"

The process regsvr32.exe:2320 makes changes in the system registry.

The PUP creates and/or sets the following values in system registry:

[HKCR\CLSID\{FBA44040-BD27-4A09-ACC8-C08B7C723DCD}\ProgID]
"(Default)" = "ProtectorExe.ProtectorHost.1"

[HKCR\CLSID\{FBA44040-BD27-4A09-ACC8-C08B7C723DCD}]
"(Default)" = "ProtectorHost Class"

[HKCR\protector_dll.ProtectorBho\CurVer]
"(Default)" = "protector_dll.ProtectorBho.1"

[HKCR\protector_dll.ProtectorLib\CurVer]
"(Default)" = "protector_dll.ProtectorLib.1"

[HKCR\AppID\{96FBC13C-8214-4100-88E0-FF74D7A1CB4D}]
"(Default)" = "protector_dll"

[HKCR\CLSID\{84798B8E-69F8-4846-9516-373C2996E2F7}]
"(Default)" = "ProtectorLib Class"

[HKCR\protector_dll.ProtectorBho.1\CLSID]
"(Default)" = "{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}"

[HKCR\CLSID\{84798B8E-69F8-4846-9516-373C2996E2F7}\VersionIndependentProgID]
"(Default)" = "protector_dll.ProtectorLib"

[HKCR\CLSID\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}\TypeLib]
"(Default)" = "{C7CB459A-7261-4AE6-A87A-17041EE98A40}"

[HKCR\CLSID\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}\VersionIndependentProgID]
"(Default)" = "protector_dll.ProtectorBho"

[HKCR\protector_dll.ProtectorBho.1]
"(Default)" = "Google Toolbar Notifier BHO"

[HKCR\CLSID\{FBA44040-BD27-4A09-ACC8-C08B7C723DCD}\TypeLib]
"(Default)" = "{C7CB459A-7261-4AE6-A87A-17041EE98A40}"

[HKCR\CLSID\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\protector_dll.ProtectorLib\CLSID]
"(Default)" = "{84798B8E-69F8-4846-9516-373C2996E2F7}"

[HKCR\CLSID\{84798B8E-69F8-4846-9516-373C2996E2F7}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\protector_dll.ProtectorLib.1\CLSID]
"(Default)" = "{84798B8E-69F8-4846-9516-373C2996E2F7}"

[HKCR\CLSID\{84798B8E-69F8-4846-9516-373C2996E2F7}]
"AppID" = "{96FBC13C-8214-4100-88E0-FF74D7A1CB4D}"

[HKCR\CLSID\{FBA44040-BD27-4A09-ACC8-C08B7C723DCD}]
"AppID" = "{A97CA128-6998-4F8E-807E-8ED05FADAFB0}"

[HKCR\CLSID\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}\InprocServer32]
"(Default)" = "%Program Files%\Google\GoogleToolbarNotifier\5.10.11023.1534\swg64.dll"

[HKCR\protector_dll.ProtectorLib]
"(Default)" = "ProtectorLib Class"

[HKCR\CLSID\{FBA44040-BD27-4A09-ACC8-C08B7C723DCD}]
"Depend" = "%Program Files% (x86)\Google\GoogleToolbarNotifier\5.10.11023.1534\gtn.dll"

[HKCR\CLSID\{84798B8E-69F8-4846-9516-373C2996E2F7}\ProgID]
"(Default)" = "protector_dll.ProtectorLib.1"

[HKCR\CLSID\{FBA44040-BD27-4A09-ACC8-C08B7C723DCD}\VersionIndependentProgID]
"(Default)" = "ProtectorExe.ProtectorHost"

[HKCR\CLSID\{FBA44040-BD27-4A09-ACC8-C08B7C723DCD}\LocalServer32]
"(Default)" = "%Program Files% (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

[HKCR\CLSID\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
"AppID" = "{96FBC13C-8214-4100-88E0-FF74D7A1CB4D}"

[HKCR\protector_dll.ProtectorLib.1]
"(Default)" = "ProtectorLib Class"

[HKCR\CLSID\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}\ProgID]
"(Default)" = "protector_dll.ProtectorBho.1"

[HKCR\CLSID\{84798B8E-69F8-4846-9516-373C2996E2F7}\TypeLib]
"(Default)" = "{C7CB459A-7261-4AE6-A87A-17041EE98A40}"

[HKCR\CLSID\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
"(Default)" = "Google Toolbar Notifier BHO"

[HKCR\protector_dll.ProtectorBho]
"(Default)" = "Google Toolbar Notifier BHO"

[HKCR\AppID\protector_dll.DLL]
"AppID" = "{96FBC13C-8214-4100-88E0-FF74D7A1CB4D}"

[HKCR\protector_dll.ProtectorBho\CLSID]
"(Default)" = "{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}"

[HKCR\CLSID\{84798B8E-69F8-4846-9516-373C2996E2F7}\InprocServer32]
"(Default)" = "%Program Files%\Google\GoogleToolbarNotifier\5.10.11023.1534\swg64.dll"

The process GoogleUpdaterService.exe:1128 makes changes in the system registry.

The PUP creates and/or sets the following values in system registry:

[HKCR\Wow6432Node\Interface\{C07A89E4-82A3-4A29-9908-DFC9DEBF8267}]
"(Default)" = "ISilentUpdater"

[HKCR\TypeLib\{5924C60B-6D7F-4AD6-8084-24A59431C967}\1.0\HELPDIR]
"(Default)" = ""

[HKCR\Interface\{5C8CE0B5-6DA0-49A1-B675-78FD03EA3224}]
"(Default)" = "IUpdaterScheduler"

[HKCR\Interface\{5C8CE0B5-6DA0-49A1-B675-78FD03EA3224}\TypeLib]
"(Default)" = "{5924C60B-6D7F-4AD6-8084-24A59431C967}"

[HKLM\SOFTWARE\Wow6432Node\Google\Common\Google Updater\apps\swg]
"auto" = "0"

[HKCR\AppID\GoogleUpdaterService.exe]
"AppID" = "{61E28BF8-C02B-499F-8E7A-34C1E4A1C649}"

[HKCR\Wow6432Node\CLSID\{89DAE4CD-9F17-4980-902A-99BA84A8F5C8}\TypeLib]
"(Default)" = "{5924C60B-6D7F-4AD6-8084-24A59431C967}"

[HKCR\GUSchedulerCtl.UpdaterScheduler]
"(Default)" = "Google Updater Scheduler class"

[HKCR\Interface\{C07A89E4-82A3-4A29-9908-DFC9DEBF8267}\TypeLib]
"Version" = "1.0"

[HKCR\Wow6432Node\Interface\{C07A89E4-82A3-4A29-9908-DFC9DEBF8267}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Interface\{C07A89E4-82A3-4A29-9908-DFC9DEBF8267}\TypeLib]
"(Default)" = "{5924C60B-6D7F-4AD6-8084-24A59431C967}"

[HKCR\Wow6432Node\CLSID\{89DAE4CD-9F17-4980-902A-99BA84A8F5C8}\ProgID]
"(Default)" = "GUServiceCtl.SilentUpdater.1"

[HKCR\Wow6432Node\CLSID\{89DAE4CD-9F17-4980-902A-99BA84A8F5C8}]
"AppID" = "{61E28BF8-C02B-499F-8E7A-34C1E4A1C649}"

[HKCR\Wow6432Node\CLSID\{B53B7061-6584-46AA-A033-D610EB10BD9B}\LocalServer32]
"(Default)" = "%Program Files% (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe"

[HKCR\Wow6432Node\CLSID\{B53B7061-6584-46AA-A033-D610EB10BD9B}]
"(Default)" = "Google Updater Scheduler class"

[HKCR\Wow6432Node\Interface\{C07A89E4-82A3-4A29-9908-DFC9DEBF8267}\TypeLib]
"Version" = "1.0"

[HKCR\GUServiceCtl.SilentUpdater]
"(Default)" = "Google Silent Updater class"

[HKCR\GUServiceCtl.SilentUpdater\CLSID]
"(Default)" = "{89DAE4CD-9F17-4980-902A-99BA84A8F5C8}"

[HKCR\Wow6432Node\CLSID\{89DAE4CD-9F17-4980-902A-99BA84A8F5C8}]
"(Default)" = "Google Silent Updater class"

[HKCR\Interface\{5C8CE0B5-6DA0-49A1-B675-78FD03EA3224}\TypeLib]
"Version" = "1.0"

[HKCR\Wow6432Node\CLSID\{B53B7061-6584-46AA-A033-D610EB10BD9B}\TypeLib]
"(Default)" = "{5924C60B-6D7F-4AD6-8084-24A59431C967}"

[HKCR\GUSchedulerCtl.UpdaterScheduler.1\CLSID]
"(Default)" = "{B53B7061-6584-46AA-A033-D610EB10BD9B}"

[HKCR\GUServiceCtl.SilentUpdater\CurVer]
"(Default)" = "GUServiceCtl.SilentUpdater.1"

[HKCR\Wow6432Node\Interface\{C07A89E4-82A3-4A29-9908-DFC9DEBF8267}\TypeLib]
"(Default)" = "{5924C60B-6D7F-4AD6-8084-24A59431C967}"

[HKCR\AppID\{61E28BF8-C02B-499F-8E7A-34C1E4A1C649}]
"LocalService" = "gusvc"

[HKCR\Wow6432Node\CLSID\{89DAE4CD-9F17-4980-902A-99BA84A8F5C8}\LocalServer32]
"(Default)" = "%Program Files% (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe"

[HKCR\Wow6432Node\Interface\{5C8CE0B5-6DA0-49A1-B675-78FD03EA3224}]
"(Default)" = "IUpdaterScheduler"

[HKCR\AppID\{61E28BF8-C02B-499F-8E7A-34C1E4A1C649}]
"(Default)" = "gusvc"

[HKCR\TypeLib\{5924C60B-6D7F-4AD6-8084-24A59431C967}\1.0]
"(Default)" = "Google Updater Service 1.0 Type Library"

[HKCR\GUServiceCtl.SilentUpdater.1\CLSID]
"(Default)" = "{89DAE4CD-9F17-4980-902A-99BA84A8F5C8}"

[HKCR\Wow6432Node\CLSID\{B53B7061-6584-46AA-A033-D610EB10BD9B}\VersionIndependentProgID]
"(Default)" = "GUSchedulerCtl.UpdaterScheduler"

[HKCR\Wow6432Node\CLSID\{B53B7061-6584-46AA-A033-D610EB10BD9B}]
"AppID" = "{61E28BF8-C02B-499F-8E7A-34C1E4A1C649}"

[HKCR\GUServiceCtl.SilentUpdater.1]
"(Default)" = "Google Silent Updater class"

[HKCR\Wow6432Node\Interface\{5C8CE0B5-6DA0-49A1-B675-78FD03EA3224}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\TypeLib\{5924C60B-6D7F-4AD6-8084-24A59431C967}\1.0\FLAGS]
"(Default)" = "0"

[HKCR\Wow6432Node\Interface\{5C8CE0B5-6DA0-49A1-B675-78FD03EA3224}\TypeLib]
"Version" = "1.0"

[HKCR\Interface\{C07A89E4-82A3-4A29-9908-DFC9DEBF8267}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\TypeLib\{5924C60B-6D7F-4AD6-8084-24A59431C967}\1.0\0\win32]
"(Default)" = "%Program Files% (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe"

[HKCR\Wow6432Node\CLSID\{B53B7061-6584-46AA-A033-D610EB10BD9B}\ProgID]
"(Default)" = "GUSchedulerCtl.UpdaterScheduler.1"

[HKCR\Interface\{5C8CE0B5-6DA0-49A1-B675-78FD03EA3224}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\CLSID\{89DAE4CD-9F17-4980-902A-99BA84A8F5C8}\VersionIndependentProgID]
"(Default)" = "GUServiceCtl.SilentUpdater"

[HKCR\Interface\{C07A89E4-82A3-4A29-9908-DFC9DEBF8267}]
"(Default)" = "ISilentUpdater"

[HKCR\GUSchedulerCtl.UpdaterScheduler\CLSID]
"(Default)" = "{B53B7061-6584-46AA-A033-D610EB10BD9B}"

[HKCR\GUSchedulerCtl.UpdaterScheduler.1]
"(Default)" = "Google Updater Scheduler class"

[HKCR\GUSchedulerCtl.UpdaterScheduler\CurVer]
"(Default)" = "GUSchedulerCtl.UpdaterScheduler.1"

[HKCR\Wow6432Node\Interface\{5C8CE0B5-6DA0-49A1-B675-78FD03EA3224}\TypeLib]
"(Default)" = "{5924C60B-6D7F-4AD6-8084-24A59431C967}"

The PUP deletes the following value(s) in system registry:

[HKCR\AppID\{61E28BF8-C02B-499F-8E7A-34C1E4A1C649}]
"LocalService"

The process GoogleUpdaterService.exe:3568 makes changes in the system registry.

The PUP creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Google\Common\Google Updater\apps\swg]
"auto" = "0"

The process express.exe:1732 makes changes in the system registry.

The PUP creates and/or sets the following values in system registry:

[HKCU\Software\NCH Software\Express\Settings]
"WorkingDataFolderPrevious" = "C:\Users\"%CurrentUserName%"\AppData\Roaming\NCH Software\Express"

[HKLM\SOFTWARE\Wow6432Node\NCH Software\Express\Scheduler]
"SevenDays" = "1"

[HKCU\Software\NCH Software\Express\Settings]
"WorkingDataFolder" = "C:\Users\"%CurrentUserName%"\AppData\Roaming\NCH Software\Express"

The process ffsetup.exe:2652 makes changes in the system registry.

The PUP creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
"UNCAsIntranet" = "0"

The PUP deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

The process SearchWithGoogleUpdate_6F4EEAE8D7FCDAD8.exe:3560 makes changes in the system registry.

The PUP creates and/or sets the following values in system registry:

[HKCU\Software\Google\GoogleToolbarNotifier\Temp]
"ust" = "100"

[HKLM\SOFTWARE\Wow6432Node\Google\GoogleToolbarNotifier\Clients]
"ietb" = "0"

The process SearchWithGoogleUpdate_6F4EEAE8D7FCDAD8.exe:304 makes changes in the system registry.

The PUP creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Google\GoogleToolbarNotifier]
"Version" = "5.10.11023.1534"
"ID" = "6fcd4572f44047df87447927667a9779"

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\%Program Files% (x86)\Google\Update\1.3.25.11, , \??\%Program Files% (x86)\Google\GoogleToolbarNotifier\5.10.11023.1534,"

[HKCU\Software\Google\GoogleToolbarNotifier\Temp]
"ust" = "100"

[HKLM\SOFTWARE\Wow6432Node\Google\GoogleToolbarNotifier\Clients]
"ietb" = "0"

[HKLM\SOFTWARE\Wow6432Node\Google\GoogleToolbarNotifier]
"brand" = "NCHD"

The PUP deletes the following registry key(s):

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]

The process GoogleToolbarNotifier.exe:1412 makes changes in the system registry.

The PUP creates and/or sets the following values in system registry:

[HKCU\Software\Google\GoogleToolbarNotifier\Stats]
"HideUI_Throttled" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\GoogleToolbarNotifier_RASAPI32]
"EnableConsoleTracing" = "0"

[HKCU\Software\Google\GoogleToolbarNotifier\Stats]
"DetectChange_DS" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{AAB62F56-1F12-4B3C-A0EE-A1324874AB51}]
"WpadDecisionTime" = "68 F8 F4 8D 17 92 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Google\GoogleToolbarNotifier]
"FirstRun" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Google\GoogleToolbarNotifier\Stats]
"Icon_Click" = "0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\GoogleToolbarNotifier_RASAPI32]
"FileDirectory" = "%windir%\tracing"

[HKCU\Software\Google\GoogleToolbarNotifier\Stats]
"UserAllowChange_DS" = "0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\GoogleToolbarNotifier_RASAPI32]
"EnableFileTracing" = "0"

[HKCU\Software\Google\GoogleToolbarNotifier]
"UpdateURL" = "http://clients1.google.com/tools/swg2/update"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Google\GoogleToolbarNotifier]
"lds" = "http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7"

[HKCU\Software\Google\GoogleToolbarNotifier\Stats]
"ShowUI_TrayIcon" = "0"

[HKCU\Software\Google\GoogleToolbarNotifier]
"DefaultLanguage" = "en"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{AAB62F56-1F12-4B3C-A0EE-A1324874AB51}]
"WpadDecision" = "0"

[HKCU\Software\Google\GoogleToolbarNotifier]
"TS" = "1432028303"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "68 F8 F4 8D 17 92 D0 01"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\GoogleToolbarNotifier_RASAPI32]
"ConsoleTracingMask" = "4294901760"

[HKCU\Software\Classes\Local Settings\MuiCache\2D\52C64B7E]
"LanguageList" = "en-US, en"

[HKCU\Software\Google\GoogleToolbarNotifier]
"AppPath" = "%Program Files% (x86)\Google\GoogleToolbarNotifier"

[HKCU\Software\Google\GoogleToolbarNotifier\Stats]
"ShowUI_Popup" = "0"

[HKCU\Software\Google\GoogleToolbarNotifier]
"InstalledVersion" = "5.10.11023.1534"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 44 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Google\GoogleToolbarNotifier\Stats]
"LastReportTime" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Google\GoogleToolbarNotifier\Temp]
"scShowTrayIcon" = "ffffffff"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{AAB62F56-1F12-4B3C-A0EE-A1324874AB51}]
"WpadNetworkName" = "Network 4"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\GoogleToolbarNotifier_RASAPI32]
"MaxFileSize" = "1048576"

[HKCU\Software\Google\GoogleToolbarNotifier]
"UsageStat" = "1"

[HKCU\Software\Google\GoogleToolbarNotifier\Stats]
"ModifyUI_UserIntent" = "0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\GoogleToolbarNotifier_RASAPI32]
"FileTracingMask" = "4294901760"

[HKCU\Software\Google\GoogleToolbarNotifier\Stats]
"Bubble_Click" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{AAB62F56-1F12-4B3C-A0EE-A1324874AB51}]
"WpadDecisionReason" = "1"

[HKCU\Software\Google\GoogleToolbarNotifier]
"Version" = "5.10.11023.1534"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The PUP deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{AAB62F56-1F12-4B3C-A0EE-A1324874AB51}]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoDetect"

[HKCU\Software\Google\GoogleToolbarNotifier]
"WantProductRestart"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"

[HKCU\Software\Google\GoogleToolbarNotifier]
"ts"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Google\GoogleToolbarNotifier]
"DSPSuspended"
"SuspendedDS"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"

The process GoogleToolbarNotifier.exe:1636 makes changes in the system registry.

The PUP creates and/or sets the following values in system registry:

[HKCR\Interface\{BACAB2F3-7213-4865-96E9-B6B06BF49192}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Interface\{DD65ABB2-2628-425B-86F5-825E4A3D3AD9}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Interface\{91F39C2A-95E7-497A-A539-0AC715DC66D2}\TypeLib]
"(Default)" = "{C7CB459A-7261-4AE6-A87A-17041EE98A40}"

[HKCR\ProtectorExe.ProtectorHost.1\CLSID]
"(Default)" = "{FBA44040-BD27-4A09-ACC8-C08B7C723DCD}"

[HKCR\Wow6432Node\Interface\{F1A383D4-0364-4092-82E0-C39DAE5D801D}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Interface\{AF606610-3627-4DF2-A6D5-32C6A355ACD1}\TypeLib]
"Version" = "1a.0"

[HKCR\Interface\{17484B9D-89FA-484F-912E-017D06C41FE0}]
"(Default)" = "IProtectorLib7"

[HKCR\Wow6432Node\Interface\{91959FBB-853A-4AC7-A082-2DDF787F4CA9}\TypeLib]
"Version" = "1a.0"

[HKCR\Interface\{315A0BBF-D55B-4FCE-833E-8BAA5B6344F6}]
"(Default)" = "IProtector11"

[HKCR\Interface\{F1A383D4-0364-4092-82E0-C39DAE5D801D}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\Interface\{F1A383D4-0364-4092-82E0-C39DAE5D801D}\TypeLib]
"Version" = "1a.0"

[HKCR\Interface\{2212951C-1623-4095-906B-AC50B8F91016}]
"(Default)" = "IProtector2"

[HKCR\Interface\{480AD54B-C652-44B9-BCF6-746745055CD3}\TypeLib]
"(Default)" = "{C7CB459A-7261-4AE6-A87A-17041EE98A40}"

[HKCR\Wow6432Node\CLSID\{84798B8E-69F8-4846-9516-373C2996E2F7}\InprocServer32]
"(Default)" = "%Program Files% (x86)\Google\GoogleToolbarNotifier\5.10.11023.1534\swg.dll"

[HKCR\Wow6432Node\Interface\{1F7328B7-E25A-4527-B24B-D9173401BB89}\TypeLib]
"(Default)" = "{C7CB459A-7261-4AE6-A87A-17041EE98A40}"

[HKCR\Wow6432Node\Interface\{AF606610-3627-4DF2-A6D5-32C6A355ACD1}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\Interface\{AF606610-3627-4DF2-A6D5-32C6A355ACD1}\TypeLib]
"(Default)" = "{C7CB459A-7261-4AE6-A87A-17041EE98A40}"

[HKCR\Interface\{A45CDEEB-65F5-49AE-AA3E-9376F4806075}]
"(Default)" = "IProtector8"

[HKCR\Wow6432Node\Interface\{315A0BBF-D55B-4FCE-833E-8BAA5B6344F6}\TypeLib]
"(Default)" = "{C7CB459A-7261-4AE6-A87A-17041EE98A40}"

[HKCR\Interface\{2351B346-00E8-4EAC-9B75-B138B465D659}\TypeLib]
"(Default)" = "{C7CB459A-7261-4AE6-A87A-17041EE98A40}"

[HKCR\Wow6432Node\Interface\{6EACF525-5F81-4381-9E46-DC316C39E0D2}]
"(Default)" = "IProtector6"

[HKCR\Interface\{A45CDEEB-65F5-49AE-AA3E-9376F4806075}\TypeLib]
"Version" = "1a.0"

[HKCR\Interface\{91959FBB-853A-4AC7-A082-2DDF787F4CA9}]
"(Default)" = "IProtectorHost2"

[HKCR\Wow6432Node\CLSID\{84798B8E-69F8-4846-9516-373C2996E2F7}\ProgID]
"(Default)" = "protector_dll.ProtectorLib.1"

[HKCR\Interface\{91959FBB-853A-4AC7-A082-2DDF787F4CA9}\TypeLib]
"Version" = "1a.0"

[HKCR\Wow6432Node\Interface\{9D932020-700E-4F0D-8446-2872ABD8B4FA}\TypeLib]
"Version" = "1a.0"

[HKCR\Interface\{315A0BBF-D55B-4FCE-833E-8BAA5B6344F6}\TypeLib]
"Version" = "1a.0"

[HKCR\Wow6432Node\Interface\{AF606610-3627-4DF2-A6D5-32C6A355ACD1}]
"(Default)" = "IProtectorLib"

[HKCR\Wow6432Node\Interface\{6C110376-C248-47F6-9DB2-CFCDEADB6A3E}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Interface\{2212951C-1623-4095-906B-AC50B8F91016}\TypeLib]
"(Default)" = "{C7CB459A-7261-4AE6-A87A-17041EE98A40}"

[HKCR\Interface\{6C110376-C248-47F6-9DB2-CFCDEADB6A3E}\TypeLib]
"(Default)" = "{C7CB459A-7261-4AE6-A87A-17041EE98A40}"

[HKCR\Wow6432Node\Interface\{91F39C2A-95E7-497A-A539-0AC715DC66D2}]
"(Default)" = "IProtector3"

[HKCR\Interface\{DA69D3CC-7676-4A65-889F-C052977F1AA9}\TypeLib]
"Version" = "1a.0"

[HKCR\TypeLib\{C7CB459A-7261-4AE6-A87A-17041EE98A40}\1a.0]
"(Default)" = "protector_dllLib"

[HKCR\Interface\{480AD54B-C652-44B9-BCF6-746745055CD3}\TypeLib]
"Version" = "1a.0"

[HKCR\Wow6432Node\Interface\{2212951C-1623-4095-906B-AC50B8F91016}\TypeLib]
"(Default)" = "{C7CB459A-7261-4AE6-A87A-17041EE98A40}"

[HKCR\Wow6432Node\Interface\{BACAB2F3-7213-4865-96E9-B6B06BF49192}\TypeLib]
"(Default)" = "{C7CB459A-7261-4AE6-A87A-17041EE98A40}"

[HKCR\Interface\{17484B9D-89FA-484F-912E-017D06C41FE0}\TypeLib]
"(Default)" = "{C7CB459A-7261-4AE6-A87A-17041EE98A40}"

[HKCR\Interface\{6EACF525-5F81-4381-9E46-DC316C39E0D2}\TypeLib]
"(Default)" = "{C7CB459A-7261-4AE6-A87A-17041EE98A40}"

[HKCR\Wow6432Node\Interface\{9D932020-700E-4F0D-8446-2872ABD8B4FA}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\AppID\{96FBC13C-8214-4100-88E0-FF74D7A1CB4D}]
"(Default)" = "protector_dll"

[HKCR\Interface\{277FD1E8-9884-4E0A-9392-7CFF83F067B2}]
"(Default)" = "IProtector9"

[HKCR\Interface\{2212951C-1623-4095-906B-AC50B8F91016}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\AppID\{A97CA128-6998-4F8E-807E-8ED05FADAFB0}]
"(Default)" = "ProtectorExe"

[HKCR\Interface\{BACAB2F3-7213-4865-96E9-B6B06BF49192}]
"(Default)" = "IProtectorLib8"

[HKCR\Interface\{315A0BBF-D55B-4FCE-833E-8BAA5B6344F6}\TypeLib]
"(Default)" = "{C7CB459A-7261-4AE6-A87A-17041EE98A40}"

[HKCR\Wow6432Node\Interface\{BACAB2F3-7213-4865-96E9-B6B06BF49192}]
"(Default)" = "IProtectorLib8"

[HKCR\Wow6432Node\CLSID\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
"(Default)" = "Google Toolbar Notifier BHO"

[HKCR\Interface\{17484B9D-89FA-484F-912E-017D06C41FE0}\TypeLib]
"Version" = "1a.0"

[HKCR\Wow6432Node\CLSID\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}\TypeLib]
"(Default)" = "{C7CB459A-7261-4AE6-A87A-17041EE98A40}"

[HKCR\Interface\{A0CF48B9-DB91-49A5-BEE7-2FB45BA2F610}\TypeLib]
"(Default)" = "{C7CB459A-7261-4AE6-A87A-17041EE98A40}"

[HKCR\Wow6432Node\Interface\{9891812B-5820-4A77-827E-772B200239E1}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\CLSID\{6134CEA9-DD6E-495C-A0D1-4F232027D7D7}]
"AppID" = "{96FBC13C-8214-4100-88E0-FF74D7A1CB4D}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{80B84A0A-EDA4-47fd-8BE1-6B49F4197EE5}]
"AppPath" = "%Program Files% (x86)\Google\GoogleToolbarNotifier"

[HKCR\Wow6432Node\Interface\{5D358B5C-3415-42BB-A606-E1089B674F41}\TypeLib]
"Version" = "1a.0"

[HKCR\Wow6432Node\Interface\{17484B9D-89FA-484F-912E-017D06C41FE0}\TypeLib]
"Version" = "1a.0"

[HKCR\Wow6432Node\Interface\{17484B9D-89FA-484F-912E-017D06C41FE0}]
"(Default)" = "IProtectorLib7"

[HKCR\protector_dll.ProtectorLib.1]
"(Default)" = "ProtectorLib Class"

[HKCR\Wow6432Node\Interface\{9891812B-5820-4A77-827E-772B200239E1}]
"(Default)" = "IProtector4"

[HKCR\Wow6432Node\CLSID\{FBA44040-BD27-4A09-ACC8-C08B7C723DCD}]
"Depend" = "%Program Files% (x86)\Google\GoogleToolbarNotifier\5.10.11023.1534\gtn.dll"

[HKCR\Wow6432Node\CLSID\{84798B8E-69F8-4846-9516-373C2996E2F7}]
"(Default)" = "ProtectorLib Class"

[HKCR\Wow6432Node\Interface\{A45CDEEB-65F5-49AE-AA3E-9376F4806075}\TypeLib]
"Version" = "1a.0"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{80B84A0A-EDA4-47fd-8BE1-6B49F4197EE5}]
"AppName" = "GoogleToolbarNotifier.exe"

[HKCR\Wow6432Node\Interface\{1F7328B7-E25A-4527-B24B-D9173401BB89}]
"(Default)" = "IProtector5"

[HKCR\Interface\{315A0BBF-D55B-4FCE-833E-8BAA5B6344F6}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Interface\{5D358B5C-3415-42BB-A606-E1089B674F41}\TypeLib]
"(Default)" = "{C7CB459A-7261-4AE6-A87A-17041EE98A40}"

[HKCR\Interface\{235317AD-6EF4-4209-9354-F88869E1A3BB}]
"(Default)" = "IProtectorLib5"

[HKCR\Wow6432Node\Interface\{9891812B-5820-4A77-827E-772B200239E1}\TypeLib]
"Version" = "1a.0"

[HKCR\Wow6432Node\Interface\{2212951C-1623-4095-906B-AC50B8F91016}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Interface\{9891812B-5820-4A77-827E-772B200239E1}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Interface\{235317AD-6EF4-4209-9354-F88869E1A3BB}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\Interface\{A0CF48B9-DB91-49A5-BEE7-2FB45BA2F610}\TypeLib]
"(Default)" = "{C7CB459A-7261-4AE6-A87A-17041EE98A40}"

[HKCR\Interface\{1F7328B7-E25A-4527-B24B-D9173401BB89}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\CLSID\{FBA44040-BD27-4A09-ACC8-C08B7C723DCD}]
"(Default)" = "ProtectorHost Class"

[HKCR\Interface\{9891812B-5820-4A77-827E-772B200239E1}\TypeLib]
"Version" = "1a.0"

[HKCR\Wow6432Node\Interface\{DA69D3CC-7676-4A65-889F-C052977F1AA9}]
"(Default)" = "IProtectorHost"

[HKCR\Wow6432Node\CLSID\{6134CEA9-DD6E-495C-A0D1-4F232027D7D7}\InprocServer32]
"(Default)" = "%Program Files% (x86)\Google\GoogleToolbarNotifier\5.10.11023.1534\swg.dll"

[HKCR\Interface\{6C110376-C248-47F6-9DB2-CFCDEADB6A3E}]
"(Default)" = "IProtector10"

[HKCR\Wow6432Node\CLSID\{6134CEA9-DD6E-495C-A0D1-4F232027D7D7}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\Wow6432Node\Interface\{A0CF48B9-DB91-49A5-BEE7-2FB45BA2F610}\TypeLib]
"Version" = "1a.0"

[HKCR\Wow6432Node\Interface\{F1A383D4-0364-4092-82E0-C39DAE5D801D}\TypeLib]
"(Default)" = "{C7CB459A-7261-4AE6-A87A-17041EE98A40}"

[HKCR\Wow6432Node\CLSID\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}\VersionIndependentProgID]
"(Default)" = "protector_dll.ProtectorBho"

[HKCR\Wow6432Node\Interface\{91F39C2A-95E7-497A-A539-0AC715DC66D2}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\Interface\{6C110376-C248-47F6-9DB2-CFCDEADB6A3E}]
"(Default)" = "IProtector10"

[HKCR\Wow6432Node\CLSID\{FBA44040-BD27-4A09-ACC8-C08B7C723DCD}\ProgID]
"(Default)" = "ProtectorExe.ProtectorHost.1"

[HKCR\Interface\{235317AD-6EF4-4209-9354-F88869E1A3BB}\TypeLib]
"Version" = "1a.0"

[HKCR\Wow6432Node\Interface\{91959FBB-853A-4AC7-A082-2DDF787F4CA9}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\Interface\{2351B346-00E8-4EAC-9B75-B138B465D659}\TypeLib]
"Version" = "1a.0"

[HKCR\Wow6432Node\Interface\{DA69D3CC-7676-4A65-889F-C052977F1AA9}\TypeLib]
"Version" = "1a.0"

[HKCR\protector_dll.ProtectorLib\CurVer]
"(Default)" = "protector_dll.ProtectorLib.1"

[HKCR\Interface\{91959FBB-853A-4AC7-A082-2DDF787F4CA9}\TypeLib]
"(Default)" = "{C7CB459A-7261-4AE6-A87A-17041EE98A40}"

[HKCR\Wow6432Node\Interface\{9891812B-5820-4A77-827E-772B200239E1}\TypeLib]
"(Default)" = "{C7CB459A-7261-4AE6-A87A-17041EE98A40}"

[HKCR\Wow6432Node\Interface\{2212951C-1623-4095-906B-AC50B8F91016}]
"(Default)" = "IProtector2"

[HKCR\Interface\{1F7328B7-E25A-4527-B24B-D9173401BB89}]
"(Default)" = "IProtector5"

[HKCR\Interface\{6C110376-C248-47F6-9DB2-CFCDEADB6A3E}\TypeLib]
"Version" = "1a.0"

[HKCR\Interface\{17484B9D-89FA-484F-912E-017D06C41FE0}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Interface\{5D358B5C-3415-42BB-A606-E1089B674F41}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Interface\{A45CDEEB-65F5-49AE-AA3E-9376F4806075}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\CLSID\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\Interface\{6C110376-C248-47F6-9DB2-CFCDEADB6A3E}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Interface\{5D358B5C-3415-42BB-A606-E1089B674F41}\TypeLib]
"Version" = "1a.0"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{80B84A0A-EDA4-47fd-8BE1-6B49F4197EE5}]
"AppPath" = "%Program Files% (x86)\Google\GoogleToolbarNotifier"

[HKCR\Interface\{DA69D3CC-7676-4A65-889F-C052977F1AA9}]
"(Default)" = "IProtectorHost"

[HKCR\Interface\{91F39C2A-95E7-497A-A539-0AC715DC66D2}]
"(Default)" = "IProtector3"

[HKCR\Interface\{6EACF525-5F81-4381-9E46-DC316C39E0D2}\TypeLib]
"Version" = "1a.0"

[HKCR\Wow6432Node\Interface\{5D358B5C-3415-42BB-A606-E1089B674F41}\TypeLib]
"(Default)" = "{C7CB459A-7261-4AE6-A87A-17041EE98A40}"

[HKCR\AppID\ProtectorExe.EXE]
"AppID" = "{A97CA128-6998-4F8E-807E-8ED05FADAFB0}"

[HKCR\Wow6432Node\CLSID\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
"AppID" = "{96FBC13C-8214-4100-88E0-FF74D7A1CB4D}"

[HKCR\protector_dll.Protector.1\CLSID]
"(Default)" = "{6134CEA9-DD6E-495C-A0D1-4F232027D7D7}"

[HKCR\ProtectorExe.ProtectorHost\CLSID]
"(Default)" = "{FBA44040-BD27-4A09-ACC8-C08B7C723DCD}"

[HKCR\protector_dll.ProtectorBho]
"(Default)" = "Google Toolbar Notifier BHO"

[HKCR\Wow6432Node\Interface\{DD65ABB2-2628-425B-86F5-825E4A3D3AD9}\TypeLib]
"(Default)" = "{C7CB459A-7261-4AE6-A87A-17041EE98A40}"

[HKCR\AppID\protector_dll.DLL]
"AppID" = "{96FBC13C-8214-4100-88E0-FF74D7A1CB4D}"

[HKCR\Interface\{91959FBB-853A-4AC7-A082-2DDF787F4CA9}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Interface\{DA69D3CC-7676-4A65-889F-C052977F1AA9}\TypeLib]
"(Default)" = "{C7CB459A-7261-4AE6-A87A-17041EE98A40}"

[HKCR\Interface\{BACAB2F3-7213-4865-96E9-B6B06BF49192}\TypeLib]
"(Default)" = "{C7CB459A-7261-4AE6-A87A-17041EE98A40}"

[HKCR\Interface\{A0CF48B9-DB91-49A5-BEE7-2FB45BA2F610}]
"(Default)" = "IProtectorLib2"

[HKCR\Interface\{F1A383D4-0364-4092-82E0-C39DAE5D801D}\TypeLib]
"Version" = "1a.0"

[HKCR\Wow6432Node\Interface\{5D358B5C-3415-42BB-A606-E1089B674F41}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\CLSID\{6134CEA9-DD6E-495C-A0D1-4F232027D7D7}\ProgID]
"(Default)" = "protector_dll.Protector.1"

[HKCR\Wow6432Node\Interface\{1F7328B7-E25A-4527-B24B-D9173401BB89}\TypeLib]
"Version" = "1a.0"

[HKCR\Interface\{2212951C-1623-4095-906B-AC50B8F91016}\TypeLib]
"Version" = "1a.0"

[HKCR\Interface\{480AD54B-C652-44B9-BCF6-746745055CD3}]
"(Default)" = "IProtectorLib6"

[HKCR\protector_dll.Protector\CLSID]
"(Default)" = "{6134CEA9-DD6E-495C-A0D1-4F232027D7D7}"

[HKCR\Wow6432Node\CLSID\{FBA44040-BD27-4A09-ACC8-C08B7C723DCD}\VersionIndependentProgID]
"(Default)" = "ProtectorExe.ProtectorHost"

[HKCR\Wow6432Node\Interface\{2212951C-1623-4095-906B-AC50B8F91016}\TypeLib]
"Version" = "1a.0"

[HKCR\Wow6432Node\Interface\{BACAB2F3-7213-4865-96E9-B6B06BF49192}\TypeLib]
"Version" = "1a.0"

[HKCR\Wow6432Node\Interface\{5D358B5C-3415-42BB-A606-E1089B674F41}]
"(Default)" = "IProtector7"

[HKCR\Wow6432Node\Interface\{2351B346-00E8-4EAC-9B75-B138B465D659}\TypeLib]
"(Default)" = "{C7CB459A-7261-4AE6-A87A-17041EE98A40}"

[HKCR\ProtectorExe.ProtectorHost]
"(Default)" = "ProtectorHost Class"

[HKCR\Wow6432Node\Interface\{91F39C2A-95E7-497A-A539-0AC715DC66D2}\TypeLib]
"(Default)" = "{C7CB459A-7261-4AE6-A87A-17041EE98A40}"

[HKCR\Interface\{9891812B-5820-4A77-827E-772B200239E1}]
"(Default)" = "IProtector4"

[HKCR\Wow6432Node\CLSID\{84798B8E-69F8-4846-9516-373C2996E2F7}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\Wow6432Node\Interface\{DD65ABB2-2628-425B-86F5-825E4A3D3AD9}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\protector_dll.ProtectorBho.1\CLSID]
"(Default)" = "{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}"

[HKCR\TypeLib\{C7CB459A-7261-4AE6-A87A-17041EE98A40}\1a.0\HELPDIR]
"(Default)" = "%Program Files% (x86)\Google\GoogleToolbarNotifier\5.10.11023.1534"

[HKCR\Wow6432Node\Interface\{DD65ABB2-2628-425B-86F5-825E4A3D3AD9}\TypeLib]
"Version" = "1a.0"

[HKCR\Wow6432Node\Interface\{9D932020-700E-4F0D-8446-2872ABD8B4FA}\TypeLib]
"(Default)" = "{C7CB459A-7261-4AE6-A87A-17041EE98A40}"

[HKCR\protector_dll.ProtectorBho.1]
"(Default)" = "Google Toolbar Notifier BHO"

[HKCR\Interface\{9D932020-700E-4F0D-8446-2872ABD8B4FA}]
"(Default)" = "IProtectorLib3"

[HKCR\Wow6432Node\CLSID\{84798B8E-69F8-4846-9516-373C2996E2F7}\VersionIndependentProgID]
"(Default)" = "protector_dll.ProtectorLib"

[HKCR\Wow6432Node\Interface\{315A0BBF-D55B-4FCE-833E-8BAA5B6344F6}]
"(Default)" = "IProtector11"

[HKCR\Wow6432Node\Interface\{F1A383D4-0364-4092-82E0-C39DAE5D801D}]
"(Default)" = "IProtector12"

[HKCR\Wow6432Node\CLSID\{84798B8E-69F8-4846-9516-373C2996E2F7}\TypeLib]
"(Default)" = "{C7CB459A-7261-4AE6-A87A-17041EE98A40}"

[HKCR\TypeLib\{C7CB459A-7261-4AE6-A87A-17041EE98A40}\1a.0\FLAGS]
"(Default)" = "0"

[HKCR\Wow6432Node\Interface\{315A0BBF-D55B-4FCE-833E-8BAA5B6344F6}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\CLSID\{6134CEA9-DD6E-495C-A0D1-4F232027D7D7}\VersionIndependentProgID]
"(Default)" = "protector_dll.Protector"

[HKCR\Interface\{AF606610-3627-4DF2-A6D5-32C6A355ACD1}\TypeLib]
"(Default)" = "{C7CB459A-7261-4AE6-A87A-17041EE98A40}"

[HKCR\Wow6432Node\Interface\{277FD1E8-9884-4E0A-9392-7CFF83F067B2}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Interface\{A0CF48B9-DB91-49A5-BEE7-2FB45BA2F610}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\CLSID\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}\ProgID]
"(Default)" = "protector_dll.ProtectorBho.1"

[HKCR\protector_dll.ProtectorLib.1\CLSID]
"(Default)" = "{84798B8E-69F8-4846-9516-373C2996E2F7}"

[HKCR\Interface\{BACAB2F3-7213-4865-96E9-B6B06BF49192}\TypeLib]
"Version" = "1a.0"

[HKCR\Wow6432Node\Interface\{9D932020-700E-4F0D-8446-2872ABD8B4FA}]
"(Default)" = "IProtectorLib3"

[HKCR\Interface\{9891812B-5820-4A77-827E-772B200239E1}\TypeLib]
"(Default)" = "{C7CB459A-7261-4AE6-A87A-17041EE98A40}"

[HKCR\Wow6432Node\Interface\{17484B9D-89FA-484F-912E-017D06C41FE0}\TypeLib]
"(Default)" = "{C7CB459A-7261-4AE6-A87A-17041EE98A40}"

[HKCR\Wow6432Node\CLSID\{84798B8E-69F8-4846-9516-373C2996E2F7}]
"AppID" = "{96FBC13C-8214-4100-88E0-FF74D7A1CB4D}"

[HKCR\Interface\{DD65ABB2-2628-425B-86F5-825E4A3D3AD9}\TypeLib]
"(Default)" = "{C7CB459A-7261-4AE6-A87A-17041EE98A40}"

[HKCR\Wow6432Node\Interface\{235317AD-6EF4-4209-9354-F88869E1A3BB}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\Interface\{6EACF525-5F81-4381-9E46-DC316C39E0D2}\TypeLib]
"Version" = "1a.0"

[HKCR\Interface\{A0CF48B9-DB91-49A5-BEE7-2FB45BA2F610}\TypeLib]
"Version" = "1a.0"

[HKCR\Interface\{2351B346-00E8-4EAC-9B75-B138B465D659}]
"(Default)" = "IProtector"

[HKCR\Interface\{6EACF525-5F81-4381-9E46-DC316C39E0D2}]
"(Default)" = "IProtector6"

[HKCR\Interface\{2351B346-00E8-4EAC-9B75-B138B465D659}\TypeLib]
"Version" = "1a.0"

[HKCR\ProtectorExe.ProtectorHost.1]
"(Default)" = "ProtectorHost Class"

[HKCR\Wow6432Node\Interface\{BACAB2F3-7213-4865-96E9-B6B06BF49192}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\protector_dll.Protector\CurVer]
"(Default)" = "protector_dll.Protector.1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{80B84A0A-EDA4-47fd-8BE1-6B49F4197EE5}]
"AppName" = "GoogleToolbarNotifier.exe"

[HKCR\Interface\{91F39C2A-95E7-497A-A539-0AC715DC66D2}\TypeLib]
"Version" = "1a.0"

[HKCR\Interface\{A45CDEEB-65F5-49AE-AA3E-9376F4806075}\TypeLib]
"(Default)" = "{C7CB459A-7261-4AE6-A87A-17041EE98A40}"

[HKCR\Wow6432Node\Interface\{277FD1E8-9884-4E0A-9392-7CFF83F067B2}\TypeLib]
"(Default)" = "{C7CB459A-7261-4AE6-A87A-17041EE98A40}"

[HKCR\Wow6432Node\Interface\{91F39C2A-95E7-497A-A539-0AC715DC66D2}\TypeLib]
"Version" = "1a.0"

[HKCR\AppID\{A97CA128-6998-4F8E-807E-8ED05FADAFB0}]
"RunAs" = "Interactive User"

[HKCR\Wow6432Node\Interface\{235317AD-6EF4-4209-9354-F88869E1A3BB}]
"(Default)" = "IProtectorLib5"

[HKCR\Interface\{DD65ABB2-2628-425B-86F5-825E4A3D3AD9}\TypeLib]
"Version" = "1a.0"

[HKCR\Interface\{9D932020-700E-4F0D-8446-2872ABD8B4FA}\TypeLib]
"(Default)" = "{C7CB459A-7261-4AE6-A87A-17041EE98A40}"

[HKCR\Wow6432Node\Interface\{A0CF48B9-DB91-49A5-BEE7-2FB45BA2F610}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Interface\{9D932020-700E-4F0D-8446-2872ABD8B4FA}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{80B84A0A-EDA4-47fd-8BE1-6B49F4197EE5}]
"Policy" = "3"

[HKCR\protector_dll.ProtectorBho\CLSID]
"(Default)" = "{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}"

[HKCR\Wow6432Node\Interface\{235317AD-6EF4-4209-9354-F88869E1A3BB}\TypeLib]
"Version" = "1a.0"

[HKCR\Interface\{1F7328B7-E25A-4527-B24B-D9173401BB89}\TypeLib]
"(Default)" = "{C7CB459A-7261-4AE6-A87A-17041EE98A40}"

[HKCR\Wow6432Node\CLSID\{FBA44040-BD27-4A09-ACC8-C08B7C723DCD}]
"AppID" = "{A97CA128-6998-4F8E-807E-8ED05FADAFB0}"

[HKCR\Wow6432Node\CLSID\{FBA44040-BD27-4A09-ACC8-C08B7C723DCD}\LocalServer32]
"(Default)" = "%Program Files% (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

[HKCR\protector_dll.ProtectorBho\CurVer]
"(Default)" = "protector_dll.ProtectorBho.1"

[HKCR\Wow6432Node\Interface\{A45CDEEB-65F5-49AE-AA3E-9376F4806075}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\ProtectorExe.ProtectorHost\CurVer]
"(Default)" = "ProtectorExe.ProtectorHost.1"

[HKCR\Wow6432Node\CLSID\{6134CEA9-DD6E-495C-A0D1-4F232027D7D7}\TypeLib]
"(Default)" = "{C7CB459A-7261-4AE6-A87A-17041EE98A40}"

[HKCR\Wow6432Node\Interface\{DA69D3CC-7676-4A65-889F-C052977F1AA9}\TypeLib]
"(Default)" = "{C7CB459A-7261-4AE6-A87A-17041EE98A40}"

[HKCR\Interface\{235317AD-6EF4-4209-9354-F88869E1A3BB}\TypeLib]
"(Default)" = "{C7CB459A-7261-4AE6-A87A-17041EE98A40}"

[HKCR\TypeLib\{C7CB459A-7261-4AE6-A87A-17041EE98A40}\1a.0\0\win32]
"(Default)" = "%Program Files% (x86)\Google\GoogleToolbarNotifier\5.10.11023.1534\swg.dll"

[HKCR\Wow6432Node\Interface\{17484B9D-89FA-484F-912E-017D06C41FE0}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{80B84A0A-EDA4-47fd-8BE1-6B49F4197EE5}]
"Policy" = "3"

[HKCR\Wow6432Node\Interface\{6C110376-C248-47F6-9DB2-CFCDEADB6A3E}\TypeLib]
"(Default)" = "{C7CB459A-7261-4AE6-A87A-17041EE98A40}"

[HKCR\Wow6432Node\Interface\{480AD54B-C652-44B9-BCF6-746745055CD3}\TypeLib]
"(Default)" = "{C7CB459A-7261-4AE6-A87A-17041EE98A40}"

[HKCR\Interface\{F1A383D4-0364-4092-82E0-C39DAE5D801D}]
"(Default)" = "IProtector12"

[HKCR\Wow6432Node\Interface\{91959FBB-853A-4AC7-A082-2DDF787F4CA9}]
"(Default)" = "IProtectorHost2"

[HKCR\Interface\{91F39C2A-95E7-497A-A539-0AC715DC66D2}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Interface\{2351B346-00E8-4EAC-9B75-B138B465D659}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Interface\{1F7328B7-E25A-4527-B24B-D9173401BB89}\TypeLib]
"Version" = "1a.0"

[HKCR\protector_dll.Protector.1]
"(Default)" = "Protector Class"

[HKCR\Wow6432Node\Interface\{6EACF525-5F81-4381-9E46-DC316C39E0D2}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\CLSID\{FBA44040-BD27-4A09-ACC8-C08B7C723DCD}\TypeLib]
"(Default)" = "{C7CB459A-7261-4AE6-A87A-17041EE98A40}"

[HKCR\Wow6432Node\CLSID\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}\InprocServer32]
"(Default)" = "%Program Files% (x86)\Google\GoogleToolbarNotifier\5.10.11023.1534\swg.dll"

[HKCR\protector_dll.Protector]
"(Default)" = "Protector Class"

[HKCR\protector_dll.ProtectorLib\CLSID]
"(Default)" = "{84798B8E-69F8-4846-9516-373C2996E2F7}"

[HKCR\Interface\{AF606610-3627-4DF2-A6D5-32C6A355ACD1}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Interface\{277FD1E8-9884-4E0A-9392-7CFF83F067B2}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Interface\{DA69D3CC-7676-4A65-889F-C052977F1AA9}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Interface\{9D932020-700E-4F0D-8446-2872ABD8B4FA}\TypeLib]
"Version" = "1a.0"

[HKCR\Wow6432Node\Interface\{315A0BBF-D55B-4FCE-833E-8BAA5B6344F6}\TypeLib]
"Version" = "1a.0"

[HKCR\Wow6432Node\Interface\{A45CDEEB-65F5-49AE-AA3E-9376F4806075}]
"(Default)" = "IProtector8"

[HKCR\Wow6432Node\Interface\{2351B346-00E8-4EAC-9B75-B138B465D659}]
"(Default)" = "IProtector"

[HKCR\Wow6432Node\Interface\{2351B346-00E8-4EAC-9B75-B138B465D659}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Interface\{6EACF525-5F81-4381-9E46-DC316C39E0D2}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\Interface\{277FD1E8-9884-4E0A-9392-7CFF83F067B2}]
"(Default)" = "IProtector9"

[HKCR\Interface\{F1A383D4-0364-4092-82E0-C39DAE5D801D}\TypeLib]
"(Default)" = "{C7CB459A-7261-4AE6-A87A-17041EE98A40}"

[HKCR\Wow6432Node\Interface\{DA69D3CC-7676-4A65-889F-C052977F1AA9}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\CLSID\{6134CEA9-DD6E-495C-A0D1-4F232027D7D7}]
"(Default)" = "Protector Class"

[HKCR\Interface\{277FD1E8-9884-4E0A-9392-7CFF83F067B2}\TypeLib]
"(Default)" = "{C7CB459A-7261-4AE6-A87A-17041EE98A40}"

[HKCR\Wow6432Node\Interface\{DD65ABB2-2628-425B-86F5-825E4A3D3AD9}]
"(Default)" = "IProtectorLib4"

[HKCR\Interface\{5D358B5C-3415-42BB-A606-E1089B674F41}]
"(Default)" = "IProtector7"

[HKCR\Interface\{AF606610-3627-4DF2-A6D5-32C6A355ACD1}]
"(Default)" = "IProtectorLib"

[HKCR\Wow6432Node\Interface\{277FD1E8-9884-4E0A-9392-7CFF83F067B2}\TypeLib]
"Version" = "1a.0"

[HKCR\Wow6432Node\Interface\{A45CDEEB-65F5-49AE-AA3E-9376F4806075}\TypeLib]
"(Default)" = "{C7CB459A-7261-4AE6-A87A-17041EE98A40}"

[HKCR\Interface\{DD65ABB2-2628-425B-86F5-825E4A3D3AD9}]
"(Default)" = "IProtectorLib4"

[HKCR\protector_dll.ProtectorLib]
"(Default)" = "ProtectorLib Class"

[HKCR\Wow6432Node\Interface\{6EACF525-5F81-4381-9E46-DC316C39E0D2}\TypeLib]
"(Default)" = "{C7CB459A-7261-4AE6-A87A-17041EE98A40}"

[HKCR\Wow6432Node\Interface\{AF606610-3627-4DF2-A6D5-32C6A355ACD1}\TypeLib]
"Version" = "1a.0"

[HKCR\Wow6432Node\Interface\{480AD54B-C652-44B9-BCF6-746745055CD3}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\Interface\{480AD54B-C652-44B9-BCF6-746745055CD3}]
"(Default)" = "IProtectorLib6"

[HKCR\Wow6432Node\Interface\{6C110376-C248-47F6-9DB2-CFCDEADB6A3E}\TypeLib]
"Version" = "1a.0"

[HKCR\Interface\{480AD54B-C652-44B9-BCF6-746745055CD3}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\Interface\{480AD54B-C652-44B9-BCF6-746745055CD3}\TypeLib]
"Version" = "1a.0"

[HKCR\Wow6432Node\Interface\{235317AD-6EF4-4209-9354-F88869E1A3BB}\TypeLib]
"(Default)" = "{C7CB459A-7261-4AE6-A87A-17041EE98A40}"

[HKCR\Wow6432Node\Interface\{A0CF48B9-DB91-49A5-BEE7-2FB45BA2F610}]
"(Default)" = "IProtectorLib2"

[HKCR\Wow6432Node\Interface\{1F7328B7-E25A-4527-B24B-D9173401BB89}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\Interface\{91959FBB-853A-4AC7-A082-2DDF787F4CA9}\TypeLib]
"(Default)" = "{C7CB459A-7261-4AE6-A87A-17041EE98A40}"

[HKCR\Interface\{277FD1E8-9884-4E0A-9392-7CFF83F067B2}\TypeLib]
"Version" = "1a.0"

The process %original file name%.exe:624 makes changes in the system registry.

The PUP creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
"UNCAsIntranet" = "0"

The PUP deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

Dropped PE files

MD5	File path
5d4bc124faae6730ac002cdb67bf1a1c	c:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
786996ff4ea890b9f43ed68dd55ffd7b	c:\Program Files (x86)\Google\Google Toolbar\Component\GoogleCld_187F9D811452062B.dll
c74e54032b25934882f5da142135f6e4	c:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_32_75A7C54F0BE42E8E.dll
d257b5fafad4fe93cd13ac792bf9b152	c:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_64_2AD99D2EA038D2F2.dll
d59b2b86e3b0f21c42700cb4f60c8f4d	c:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_0A4439FF67F61065.dll
327c893aa5966ac436ca275f8d64c8c0	c:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarManager_BA9226F4C70BECC2.exe
adf24d7a7195453f85e2f5cef3cbcc33	c:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarUser_32_52E818EF81C83A9B.exe
852fd4db3205ff0cb6d8f473776f99b1	c:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarUser_64_4D9709C1FA1422BA.exe
aa9bc44f6d065f76902e516d0b45db6d	c:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbar_32_3934E923EEC91A78.dll
ba214814e91a9eae3eeeaed77841f82a	c:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbar_64_62C1B48EAF0FD125.dll
1f2afab903c0d48480561f3bbd4539c2	c:\Program Files (x86)\Google\Google Toolbar\Component\GoogleUpdateSetup_5CC4B0F53D73AD88.exe
4beaf576cb43358c4db9f45ac7c09cdb	c:\Program Files (x86)\Google\Google Toolbar\Component\GoogleUpdaterService_B33FC4DD36A473C6.exe
78206b34bd050db564bf5b4b8c697925	c:\Program Files (x86)\Google\Google Toolbar\Component\SearchWithGoogleUpdate_6F4EEAE8D7FCDAD8.exe
adf24d7a7195453f85e2f5cef3cbcc33	c:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe
852fd4db3205ff0cb6d8f473776f99b1	c:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_64.exe
aa9bc44f6d065f76902e516d0b45db6d	c:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
ba214814e91a9eae3eeeaed77841f82a	c:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll
34c575178bacadb9744f3fb7f86b5ee3	c:\Program Files (x86)\Google\GoogleToolbarNotifier\5.10.11023.1534\gth.dll
c9188d8d26ceedbe77fa96f128f10fec	c:\Program Files (x86)\Google\GoogleToolbarNotifier\5.10.11023.1534\gtn.dll
68ba0437b07cd40c453c606dd762f6e0	c:\Program Files (x86)\Google\GoogleToolbarNotifier\5.10.11023.1534\swg.dll
5d61be7db55b026a5d61a3eed09d0ead	c:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
5050eb8b35a2ec4e17772690bb3e815c	c:\Program Files (x86)\Google\Update\Download\{F69EABDD-A4BB-4555-BE7E-1EA5F59BBA24}\0.0.0.0\googletoolbarinstaller_en_signed.exe
5050eb8b35a2ec4e17772690bb3e815c	c:\Program Files (x86)\Google\Update\Install\{4B398FB8-FDA6-468E-A6BF-725792C3320C}\googletoolbarinstaller_en_signed.exe
5050eb8b35a2ec4e17772690bb3e815c	c:\Program Files (x86)\Google\Update\Install\{6C712992-D2F2-41C1-8E3E-60022AFAD2B1}\googletoolbarinstaller_en_signed.exe
6154f737535b3dbea39c63223d52f5b8	c:\Program Files (x86)\NCH Software\Components\NCHToolbars\google\NCH_GoogleToolbar.exe
3b8a57229f677c0caf11ed463000a6d9	c:\Program Files (x86)\NCH Software\Express\express.exe
49159400a6781fab5788101a3f889c56	c:\Program Files (x86)\NCH Software\Express\expresssetup_v5.82.exe
c9d7f12d4b1567ef2b823a9f872b3c9d	c:\Program Files (x86)\NCH Software\Express\hookappcommand.dll
fe5850d91f9c8205d422acca377346bf	c:\Program Files (x86)\NCH Software\FastFox\fastfox.exe
0ac6d8149334dd8d3b9aa91170abd2e2	c:\Program Files (x86)\NCH Software\FastFox\fastfox64.exe
0227c222caf66dcb59c3713fb249b308	c:\Program Files (x86)\NCH Software\FastFox\fastfoxsetup_v2.32.exe
705d4f8e11a8dfdcd0e726235bf85690	c:\Program Files (x86)\NCH Software\FastFox\ffhook.dll
fb3b9e5688cce1eb4870f564c0152f1c	c:\Program Files (x86)\NCH Software\FastFox\ffhook64.dll
c9d7f12d4b1567ef2b823a9f872b3c9d	c:\Program Files (x86)\NCH Software\Scribe\hookappcommand.dll
d7f759c72dfbb1c8c20de009f3fcdc17	c:\Program Files (x86)\NCH Software\Scribe\scribe.exe
f440fbe175ee3222a3424a9b9b2030a0	c:\Program Files\Google\GoogleToolbarNotifier\5.10.11023.1534\swg64.dll

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):

   GoogleUpdate.exe:1704
   GoogleUpdate.exe:3660
   GoogleUpdate.exe:3252
   GoogleUpdate.exe:1684
   GoogleUpdate.exe:280
   GoogleUpdate.exe:328
   GoogleUpdate.exe:3284
   GoogleUpdate.exe:3296
   GoogleUpdate.exe:3160
   googletoolbarinstaller_en_signed.exe:2208
   googletoolbarinstaller_en_signed.exe:3468
   NCH_GoogleToolbar.exe:3220
   NCH_GoogleToolbar.exe:2488
   GoogleToolbarManager_BA9226F4C70BECC2.exe:3600
   GoogleToolbarManager_BA9226F4C70BECC2.exe:3108
   GoogleToolbarManager_BA9226F4C70BECC2.exe:3588
   GoogleToolbarManager_BA9226F4C70BECC2.exe:3492
   GoogleToolbarManager_BA9226F4C70BECC2.exe:3096
   GoogleToolbarManager_BA9226F4C70BECC2.exe:1404
   fastfox.exe:2132
   GoogleUpdaterService_B33FC4DD36A473C6.exe:2220
   GoogleUpdaterService_B33FC4DD36A473C6.exe:3536
   scribe.exe:2020
   scribe.exe:1004
   scribe.exe:1836
   edsetup.exe:2812
   nchsetup.exe:336
   nchsetup.exe:1372
   nchsetup.exe:2512
   regsvr32.exe:2320
   GoogleUpdateSetup_latest.exe:3240
   GoogleUpdateSetup_latest.exe:2188
   GoogleUpdaterService.exe:1128
   GoogleUpdaterService.exe:3568
   express.exe:1732
   ffsetup.exe:2652
   SearchWithGoogleUpdate_6F4EEAE8D7FCDAD8.exe:3560
   SearchWithGoogleUpdate_6F4EEAE8D7FCDAD8.exe:304
   GoogleToolbarNotifier.exe:1412
   GoogleToolbarNotifier.exe:1636
   %original file name%.exe:624
   

2. Delete the original PUP file.
   
3. Delete or disinfect the following files created/modified by the PUP:

   %Program Files% (x86)\Google\Update\Download\{F69EABDD-A4BB-4555-BE7E-1EA5F59BBA24}\0.0.0.0\googletoolbarinstaller_en_signed.exe (38295 bytes)
   C:\Windows\Temp\guiB682.tmp (15 bytes)
   C:\Windows\Temp\gui1094.tmp (15 bytes)
   %Program Files% (x86)\Google\Update\Install\{4B398FB8-FDA6-468E-A6BF-725792C3320C}\googletoolbarinstaller_en_signed.exe (38780 bytes)
   %Program Files% (x86)\Google\Update\Install\{6C712992-D2F2-41C1-8E3E-60022AFAD2B1}\googletoolbarinstaller_en_signed.exe (38780 bytes)
   %Program Files% (x86)\GUM30C.tmp\goopdateres_en.dll (28 bytes)
   %Program Files% (x86)\GUM30C.tmp\goopdate.dll (835 bytes)
   %Program Files% (x86)\GUM98D5.tmp\goopdate.dll (835 bytes)
   %Program Files% (x86)\GUM98D5.tmp\goopdateres_en.dll (28 bytes)
   %Program Files% (x86)\Google\Google Toolbar\Component\GoogleToolbarUser_32_52E818EF81C83A9B.exe (620 bytes)
   %Program Files% (x86)\Google\Google Toolbar\Component\GoogleToolbar_64_62C1B48EAF0FD125.dll (514 bytes)
   %Program Files% (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_0A4439FF67F61065.dll (2 bytes)
   %Program Files% (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_64_2AD99D2EA038D2F2.dll (489 bytes)
   C:\Windows\System32\config\SOFTWARE (67172 bytes)
   %Program Files% (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_32_75A7C54F0BE42E8E.dll (149 bytes)
   %Program Files% (x86)\Google\Google Toolbar\Component\GoogleToolbarUser_64_4D9709C1FA1422BA.exe (801 bytes)
   %Program Files% (x86)\Google\Google Toolbar\Component\GoogleToolbar.7.5.6227.252.manifest.xml (36 bytes)
   %Program Files% (x86)\Google\Google Toolbar\Component\GoogleToolbarManager_BA9226F4C70BECC2.exe (50 bytes)
   %Program Files% (x86)\Google\Google Toolbar\Component\GoogleToolbar_32_3934E923EEC91A78.dll (390 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GoogleToolbarInstaller2.log (43839 bytes)
   %Program Files% (x86)\Google\Google Toolbar\Component\SearchWithGoogleUpdate_6F4EEAE8D7FCDAD8.exe (50 bytes)
   C:\$Directory (384 bytes)
   %Program Files% (x86)\Google\Google Toolbar\Component\GoogleUpdateSetup_5CC4B0F53D73AD88.exe (1480 bytes)
   %Program Files% (x86)\Google\Google Toolbar\Component\GoogleUpdaterService_B33FC4DD36A473C6.exe (390 bytes)
   C:\Windows\System32\config\SOFTWARE.LOG1 (61484 bytes)
   %Program Files% (x86)\Google\Google Toolbar\Component\GoogleCld_187F9D811452062B.dll (50 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi2BF.tmp\System.dll (23 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GoogleUpdateSetup_latest.exe (25250 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsn9888.tmp\System.dll (23 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GoogleToolbarInstaller1.log (1467 bytes)
   C:\ProgramData\Google\Custom Buttons\toolbar.google.com_O8Y91YHB24Z6SR0SGYSK.XML (12 bytes)
   %Program Files% (x86)\Google\Google Toolbar\GoogleToolbarHelperPatch_signed.msp (125 bytes)
   %Program Files% (x86)\Google\Google Toolbar\GoogleToolbarHelper_signed.msi (28 bytes)
   %Program Files% (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (1281 bytes)
   %Program Files% (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (673 bytes)
   %Program Files% (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe (1425 bytes)
   %Program Files% (x86)\Google\Google Toolbar\GoogleToolbarUser_64.exe (2321 bytes)
   %Program Files% (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe (390 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_scribe_rl_adm (8 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Roaming\NCH Software\Scribe\Status\s0000000.sta (44 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Roaming\NCH Software\Scribe\Current\Welcome.wav (1425 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Roaming\NCH Software\Scribe\Current\Welcome.dat (832 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ffsetup.exe (268985 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\edsetup.exe (296411 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\n1s\nchdata.dat (2104 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\n1s\nchsetup.cab (560 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\n1s\nchdata.cab (27 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\n1s\nchsetup.exe (24321 bytes)
   %Program Files% (x86)\NCH Software\FastFox\Help\licenceterms.html (3 bytes)
   C:\Users\"%CurrentUserName%"\Favorites\NCH Software Download Site.lnk (260 bytes)
   %Program Files% (x86)\NCH Software\FastFox\Help\shortcuts.html (3 bytes)
   C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Utilities\Classic FTP Software.lnk (1 bytes)
   %Program Files% (x86)\NCH Software\FastFox\Help\restoredatadlg.html (1 bytes)
   %Program Files% (x86)\NCH Software\FastFox\Help\autocompleteoptions.html (1 bytes)
   C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Utilities\Text-to-Speech Reader.lnk (1 bytes)
   %Program Files% (x86)\NCH Software\FastFox\_ffhook64.dll (7772 bytes)
   %Program Files% (x86)\NCH Software\FastFox\Help\arrowlist.gif (455 bytes)
   %Program Files% (x86)\NCH Software\FastFox\Help\fastfinishcontent.html (2 bytes)
   C:\ProgramData\NCH Software\FastFox\demo.rtf (600 bytes)
   %Program Files% (x86)\NCH Software\FastFox\Help\groups.html (1 bytes)
   %Program Files% (x86)\NCH Software\FastFox\Help\quickstart.html (3 bytes)
   C:\Users\Public\Desktop\FastFox.lnk (1 bytes)
   %Program Files% (x86)\NCH Software\FastFox\Help\hotkeys.html (2 bytes)
   %Program Files% (x86)\NCH Software\FastFox\Help\adminpassworddlg.html (1 bytes)
   C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Utilities\Backup Software.lnk (1 bytes)
   C:\ProgramData\NCH Software\FastFox\shared_abbrev.dat (66548 bytes)
   %Program Files% (x86)\NCH Software\FastFox\Help\help.js (2 bytes)
   %Program Files% (x86)\NCH Software\FastFox\Help\editpicture.html (2 bytes)
   %Program Files% (x86)\NCH Software\FastFox\Help\editrich.html (2 bytes)
   %Program Files% (x86)\NCH Software\FastFox\Help\generaldlg.html (2 bytes)
   %Program Files% (x86)\NCH Software\FastFox\Help\autocase.html (3 bytes)
   %Program Files% (x86)\NCH Software\FastFox\Help\introduction.html (2 bytes)
   %Program Files% (x86)\NCH Software\FastFox\Help\groupprop.html (1 bytes)
   %Program Files% (x86)\NCH Software\FastFox\Help\editsuggestiondlg.html (995 bytes)
   %Program Files% (x86)\NCH Software\FastFox\Help\backupdatadlg.html (1 bytes)
   C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Utilities\Express Zip File Compression.lnk (1 bytes)
   C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Utilities\Encryption and Decryption Software.lnk (1 bytes)
   %Program Files% (x86)\NCH Software\FastFox\Help\generalsetup.html (1 bytes)
   %Program Files% (x86)\NCH Software\FastFox\Help\index.html (3 bytes)
   %Program Files% (x86)\NCH Software\FastFox\Help\autocompletesetup.html (1 bytes)
   C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Utilities\Doxillion Document Converter.lnk (1 bytes)
   C:\Users\Public\Desktop\NCH Software.lnk (1 bytes)
   %Program Files% (x86)\NCH Software\FastFox\Help\sharedabbreviation.html (2 bytes)
   %Program Files% (x86)\NCH Software\FastFox\Help\hlp.css (1 bytes)
   %Program Files% (x86)\NCH Software\FastFox\Help\selstoragedlg.html (1 bytes)
   %Program Files% (x86)\NCH Software\FastFox\fastfoxsetup_v2.32.exe (3361 bytes)
   %Program Files% (x86)\NCH Software\FastFox\Help\using.html (196 bytes)
   C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FastFox.lnk (1 bytes)
   %Program Files% (x86)\NCH Software\FastFox\Help\deletegroupdlg.html (1 bytes)
   %Program Files% (x86)\NCH Software\FastFox\_fastfox64.exe (12076 bytes)
   %Program Files% (x86)\NCH Software\Components\NCHToolbars\google\NCH_GoogleToolbar.exe (382879 bytes)
   C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Utilities\Bolt PDF Printer.lnk (1 bytes)
   %Program Files% (x86)\NCH Software\FastFox\Help\sysdate.html (2 bytes)
   %Program Files% (x86)\NCH Software\FastFox\fastfox.exe (8020 bytes)
   C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Utilities\Typing Expander Software.lnk (1 bytes)
   C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Utilities\CD, DVD, BluRay Burner.lnk (1 bytes)
   %Program Files% (x86)\NCH Software\FastFox\Help\editkeystroke.html (388 bytes)
   %Program Files% (x86)\NCH Software\FastFox\Help\addshortcut.html (1 bytes)
   C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Utilities\Uploader Software.lnk (1 bytes)
   C:\ProgramData\NCH Software\FastFox\local\abbrev.dat (66548 bytes)
   %Program Files% (x86)\NCH Software\FastFox\Help\902.html (1 bytes)
   %Program Files% (x86)\NCH Software\FastFox\Help\editsimple.html (2 bytes)
   %Program Files% (x86)\NCH Software\FastFox\_ffhook.dll (7332 bytes)
   C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Video Capture Software.lnk (1 bytes)
   C:\ProgramData\NCH Software\Scribe\Current\Welcome.wav (34532 bytes)
   C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Express Burn CD, DVD or Blu-Ray.lnk (1 bytes)
   %Program Files% (x86)\NCH Software\Scribe\hookappcommand.dll (6988 bytes)
   C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Express Zip File Compression.lnk (1 bytes)
   C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\MixPad MultiTrack Mixer.lnk (1 bytes)
   C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\WavePad Sound Editor.lnk (1 bytes)
   C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Express Rip CD Ripper.lnk (1 bytes)
   %Program Files% (x86)\NCH Software\Scribe\scribe.exe (13171 bytes)
   C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Express Scribe Transcription Software.lnk (1 bytes)
   C:\Users\Public\Desktop\Express Scribe Transcription Software.lnk (1 bytes)
   C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Express Dictate Recorder.lnk (1 bytes)
   C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dictation and Transcription Programs\Typing Expander Software.lnk (1 bytes)
   C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Switch Sound File Converter.lnk (1 bytes)
   C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Graphics File Converter.lnk (1 bytes)
   C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\VideoPad Video Editor.lnk (1 bytes)
   C:\ProgramData\NCH Software\Scribe\Current\Welcome.dat (96 bytes)
   C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Invoicing Software.lnk (1 bytes)
   C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Classic FTP Software.lnk (1 bytes)
   C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Prism Video File Format Converter.lnk (1 bytes)
   C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\RecordPad Sound Recorder.lnk (1 bytes)
   C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Doxillion Document Converter.lnk (1 bytes)
   C:\Users\Public\Desktop\NCH Suite.lnk (1 bytes)
   C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Accounting Software.lnk (1 bytes)
   C:\ProgramData\NCH Software\Scribe\Status\Template.doc (8844 bytes)
   %Program Files% (x86)\NCH Software\Scribe\scribesetup_v5.69.exe (7345 bytes)
   C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\SoundTap Streaming Recorder.lnk (1 bytes)
   C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dictation and Transcription Programs\Dictation Recorder.lnk (1 bytes)
   C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dictation and Transcription Programs\Transcription Software.lnk (1 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Accounting Software.lnk (1 bytes)
   C:\ProgramData\NCH Software\Express\tone-recordstart.wav (1 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Express Burn CD, DVD or Blu-Ray.lnk (1 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dictation and Transcription Programs\Transcription Software.lnk (1 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\SoundTap Streaming Recorder.lnk (1 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Express Zip File Compression.lnk (1 bytes)
   %Program Files% (x86)\NCH Software\Express\express.exe (10864 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\WavePad Sound Editor.lnk (1 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Invoicing Software.lnk (1 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dictation and Transcription Programs\Dictation Recorder.lnk (1 bytes)
   %Program Files% (x86)\NCH Software\Express\hookappcommand.dll (6988 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Switch Sound File Converter.lnk (1 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Express Rip CD Ripper.lnk (1 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Doxillion Document Converter.lnk (1 bytes)
   C:\ProgramData\NCH Software\Express\tone-error.wav (3 bytes)
   C:\ProgramData\NCH Software\Express\tone-recordstartoverwrite.wav (862 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Express Dictate Recorder.lnk (1 bytes)
   C:\ProgramData\NCH Software\Express\tone-recordstop.wav (4 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Prism Video File Format Converter.lnk (1 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\RecordPad Sound Recorder.lnk (1 bytes)
   C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Express Dictate Digital Dictation Software.lnk (1 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Graphics File Converter.lnk (1 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\VideoPad Video Editor.lnk (1 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Video Capture Software.lnk (1 bytes)
   C:\ProgramData\NCH Software\Express\test.wav (196 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\MixPad MultiTrack Mixer.lnk (1 bytes)
   %Program Files% (x86)\NCH Software\Express\expresssetup_v5.82.exe (4185 bytes)
   C:\Users\Public\Desktop\Express Dictate Digital Dictation Software.lnk (1 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Classic FTP Software.lnk (1 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dictation and Transcription Programs\Typing Expander Software.lnk (1 bytes)
   %Program Files%\Google\GoogleToolbarNotifier\5.10.11023.1534\swg64.dll (299 bytes)
   %Program Files% (x86)\GUM30C.tmp\goopdateres_kn.dll (29 bytes)
   %Program Files% (x86)\GUM30C.tmp\goopdateres_sv.dll (29 bytes)
   %Program Files% (x86)\GUM30C.tmp\goopdateres_sl.dll (29 bytes)
   %Program Files% (x86)\GUM30C.tmp\goopdateres_mr.dll (28 bytes)
   %Program Files% (x86)\GUM30C.tmp\GoogleUpdateHelper.msi (25 bytes)
   %Program Files% (x86)\GUM30C.tmp\goopdateres_ur.dll (28 bytes)
   %Program Files% (x86)\GUM30C.tmp\goopdateres_gu.dll (28 bytes)
   %Program Files% (x86)\GUM30C.tmp\psuser.dll (159 bytes)
   %Program Files% (x86)\GUM30C.tmp\GoogleUpdateBroker.exe (59 bytes)
   %Program Files% (x86)\GUM30C.tmp\goopdateres_am.dll (25 bytes)
   %Program Files% (x86)\GUM30C.tmp\goopdateres_pt-BR.dll (29 bytes)
   %Program Files% (x86)\GUM30C.tmp\goopdateres_ko.dll (23 bytes)
   %Program Files% (x86)\GUM30C.tmp\goopdateres_de.dll (31 bytes)
   %Program Files% (x86)\GUM30C.tmp\psmachine.dll (159 bytes)
   %Program Files% (x86)\GUM30C.tmp\goopdateres_th.dll (27 bytes)
   %Program Files% (x86)\GUM30C.tmp\goopdateres_bg.dll (30 bytes)
   %Program Files% (x86)\GUM30C.tmp\goopdateres_vi.dll (28 bytes)
   %Program Files% (x86)\GUM30C.tmp\goopdateres_cs.dll (28 bytes)
   %Program Files% (x86)\GUM30C.tmp\goopdateres_ar.dll (26 bytes)
   %Program Files% (x86)\GUM30C.tmp\goopdateres_ca.dll (29 bytes)
   %Program Files% (x86)\GUM30C.tmp\goopdateres_zh-TW.dll (21 bytes)
   %Program Files% (x86)\GUM30C.tmp\goopdateres_nl.dll (30 bytes)
   %Program Files% (x86)\GUM30C.tmp\goopdateres_es-419.dll (29 bytes)
   %Program Files% (x86)\GUM30C.tmp\goopdateres_is.dll (28 bytes)
   %Program Files% (x86)\GUM30C.tmp\goopdateres_uk.dll (28 bytes)
   %Program Files% (x86)\GUM30C.tmp\goopdateres_el.dll (30 bytes)
   %Program Files% (x86)\GUM30C.tmp\goopdateres_sr.dll (29 bytes)
   %Program Files% (x86)\GUM30C.tmp\goopdateres_lv.dll (30 bytes)
   %Program Files% (x86)\GUM30C.tmp\goopdateres_zh-CN.dll (21 bytes)
   %Program Files% (x86)\GUM30C.tmp\goopdateres_hu.dll (29 bytes)
   %Program Files% (x86)\GUM30C.tmp\goopdateres_ta.dll (30 bytes)
   %Program Files% (x86)\GUM30C.tmp\goopdateres_pl.dll (30 bytes)
   %Program Files% (x86)\GUM30C.tmp\goopdateres_ru.dll (28 bytes)
   %Program Files% (x86)\GUM30C.tmp\GoogleUpdateSetup.exe (5441 bytes)
   %Program Files% (x86)\GUM30C.tmp\goopdateres_ro.dll (29 bytes)
   %Program Files% (x86)\GUM30C.tmp\goopdateres_lt.dll (28 bytes)
   %Program Files% (x86)\GUM30C.tmp\goopdateres_te.dll (29 bytes)
   %Program Files% (x86)\GUM30C.tmp\goopdateres_fil.dll (30 bytes)
   %Program Files% (x86)\GUM30C.tmp\goopdateres_fa.dll (27 bytes)
   %Program Files% (x86)\GUM30C.tmp\goopdateres_ms.dll (28 bytes)
   %Program Files% (x86)\GUM30C.tmp\GoogleUpdateOnDemand.exe (59 bytes)
   %Program Files% (x86)\GUM30C.tmp\goopdateres_id.dll (28 bytes)
   %Program Files% (x86)\GUM30C.tmp\goopdateres_sw.dll (29 bytes)
   %Program Files% (x86)\GUM30C.tmp\goopdateres_hr.dll (29 bytes)
   %Program Files% (x86)\GUM30C.tmp\goopdateres_iw.dll (26 bytes)
   %Program Files% (x86)\GUM30C.tmp\GoogleUpdate.exe (234 bytes)
   %Program Files% (x86)\GUM30C.tmp\goopdateres_ml.dll (31 bytes)
   %Program Files% (x86)\GUM30C.tmp\goopdateres_tr.dll (29 bytes)
   %Program Files% (x86)\GUM30C.tmp\goopdateres_da.dll (29 bytes)
   %Program Files% (x86)\GUM30C.tmp\GoogleCrashHandler64.exe (550 bytes)
   %Program Files% (x86)\GUM30C.tmp\goopdateres_hi.dll (29 bytes)
   %Program Files% (x86)\GUM30C.tmp\goopdateres_it.dll (30 bytes)
   %Program Files% (x86)\GUT30D.tmp (4 bytes)
   %Program Files% (x86)\GUM30C.tmp\npGoogleUpdate3.dll (838 bytes)
   %Program Files% (x86)\GUM30C.tmp\goopdateres_no.dll (29 bytes)
   %Program Files% (x86)\GUM30C.tmp\goopdateres_pt-PT.dll (29 bytes)
   %Program Files% (x86)\GUM30C.tmp\goopdateres_fi.dll (29 bytes)
   %Program Files% (x86)\GUM30C.tmp\goopdateres_es.dll (31 bytes)
   %Program Files% (x86)\GUM30C.tmp\goopdateres_en-GB.dll (28 bytes)
   %Program Files% (x86)\GUM30C.tmp\goopdateres_ja.dll (24 bytes)
   %Program Files% (x86)\GUM30C.tmp\GoogleCrashHandler.exe (212 bytes)
   %Program Files% (x86)\GUM30C.tmp\goopdateres_et.dll (28 bytes)
   %Program Files% (x86)\GUM30C.tmp\goopdateres_sk.dll (29 bytes)
   %Program Files% (x86)\GUM30C.tmp\goopdateres_fr.dll (30 bytes)
   %Program Files% (x86)\GUM30C.tmp\goopdateres_bn.dll (28 bytes)
   %Program Files% (x86)\GUM98D5.tmp\GoogleCrashHandler64.exe (550 bytes)
   %Program Files% (x86)\GUM98D5.tmp\GoogleUpdateOnDemand.exe (59 bytes)
   %Program Files% (x86)\GUM98D5.tmp\goopdateres_it.dll (30 bytes)
   %Program Files% (x86)\GUM98D5.tmp\goopdateres_ca.dll (29 bytes)
   %Program Files% (x86)\GUM98D5.tmp\goopdateres_et.dll (28 bytes)
   %Program Files% (x86)\GUM98D5.tmp\goopdateres_es-419.dll (29 bytes)
   %Program Files% (x86)\GUM98D5.tmp\goopdateres_ru.dll (28 bytes)
   %Program Files% (x86)\GUM98D5.tmp\goopdateres_ja.dll (24 bytes)
   %Program Files% (x86)\GUM98D5.tmp\goopdateres_hi.dll (29 bytes)
   %Program Files% (x86)\GUM98D5.tmp\goopdateres_pl.dll (30 bytes)
   %Program Files% (x86)\GUM98D5.tmp\goopdateres_iw.dll (26 bytes)
   %Program Files% (x86)\GUM98D5.tmp\goopdateres_lv.dll (30 bytes)
   %Program Files% (x86)\GUM98D5.tmp\goopdateres_id.dll (28 bytes)
   %Program Files% (x86)\GUM98D5.tmp\goopdateres_nl.dll (30 bytes)
   %Program Files% (x86)\GUM98D5.tmp\goopdateres_is.dll (28 bytes)
   %Program Files% (x86)\GUM98D5.tmp\GoogleUpdateHelper.msi (25 bytes)
   %Program Files% (x86)\GUM98D5.tmp\goopdateres_ko.dll (23 bytes)
   %Program Files% (x86)\GUM98D5.tmp\goopdateres_zh-CN.dll (21 bytes)
   %Program Files% (x86)\GUM98D5.tmp\goopdateres_tr.dll (29 bytes)
   %Program Files% (x86)\GUM98D5.tmp\goopdateres_am.dll (25 bytes)
   %Program Files% (x86)\GUM98D5.tmp\goopdateres_hu.dll (29 bytes)
   %Program Files% (x86)\GUM98D5.tmp\goopdateres_en-GB.dll (28 bytes)
   %Program Files% (x86)\GUM98D5.tmp\goopdateres_sr.dll (29 bytes)
   %Program Files% (x86)\GUM98D5.tmp\goopdateres_fil.dll (30 bytes)
   %Program Files% (x86)\GUM98D5.tmp\goopdateres_sw.dll (29 bytes)
   %Program Files% (x86)\GUM98D5.tmp\GoogleUpdate.exe (234 bytes)
   %Program Files% (x86)\GUM98D5.tmp\goopdateres_el.dll (30 bytes)
   %Program Files% (x86)\GUM98D5.tmp\goopdateres_lt.dll (28 bytes)
   %Program Files% (x86)\GUM98D5.tmp\goopdateres_hr.dll (29 bytes)
   %Program Files% (x86)\GUM98D5.tmp\goopdateres_uk.dll (28 bytes)
   %Program Files% (x86)\GUM98D5.tmp\goopdateres_ro.dll (29 bytes)
   %Program Files% (x86)\GUT98D6.tmp (4 bytes)
   %Program Files% (x86)\GUM98D5.tmp\goopdateres_sl.dll (29 bytes)
   %Program Files% (x86)\GUM98D5.tmp\npGoogleUpdate3.dll (838 bytes)
   %Program Files% (x86)\GUM98D5.tmp\goopdateres_da.dll (29 bytes)
   %Program Files% (x86)\GUM98D5.tmp\goopdateres_ar.dll (26 bytes)
   %Program Files% (x86)\GUM98D5.tmp\goopdateres_cs.dll (28 bytes)
   %Program Files% (x86)\GUM98D5.tmp\psuser.dll (159 bytes)
   %Program Files% (x86)\GUM98D5.tmp\goopdateres_te.dll (29 bytes)
   %Program Files% (x86)\GUM98D5.tmp\goopdateres_zh-TW.dll (21 bytes)
   %Program Files% (x86)\GUM98D5.tmp\goopdateres_ml.dll (31 bytes)
   %Program Files% (x86)\GUM98D5.tmp\goopdateres_kn.dll (29 bytes)
   %Program Files% (x86)\GUM98D5.tmp\goopdateres_gu.dll (28 bytes)
   %Program Files% (x86)\GUM98D5.tmp\GoogleUpdateBroker.exe (59 bytes)
   %Program Files% (x86)\GUM98D5.tmp\goopdateres_fr.dll (30 bytes)
   %Program Files% (x86)\GUM98D5.tmp\goopdateres_de.dll (31 bytes)
   %Program Files% (x86)\GUM98D5.tmp\goopdateres_ur.dll (28 bytes)
   %Program Files% (x86)\GUM98D5.tmp\goopdateres_fi.dll (29 bytes)
   %Program Files% (x86)\GUM98D5.tmp\goopdateres_es.dll (31 bytes)
   %Program Files% (x86)\GUM98D5.tmp\goopdateres_sv.dll (29 bytes)
   %Program Files% (x86)\GUM98D5.tmp\GoogleCrashHandler.exe (212 bytes)
   %Program Files% (x86)\GUM98D5.tmp\goopdateres_th.dll (27 bytes)
   %Program Files% (x86)\GUM98D5.tmp\psmachine.dll (159 bytes)
   %Program Files% (x86)\GUM98D5.tmp\goopdateres_ms.dll (28 bytes)
   %Program Files% (x86)\GUM98D5.tmp\goopdateres_ta.dll (30 bytes)
   %Program Files% (x86)\GUM98D5.tmp\goopdateres_vi.dll (28 bytes)
   %Program Files% (x86)\GUM98D5.tmp\goopdateres_bg.dll (30 bytes)
   %Program Files% (x86)\GUM98D5.tmp\goopdateres_fa.dll (27 bytes)
   %Program Files% (x86)\GUM98D5.tmp\GoogleUpdateSetup.exe (5441 bytes)
   %Program Files% (x86)\GUM98D5.tmp\goopdateres_sk.dll (29 bytes)
   %Program Files% (x86)\GUM98D5.tmp\goopdateres_pt-BR.dll (29 bytes)
   %Program Files% (x86)\GUM98D5.tmp\goopdateres_mr.dll (28 bytes)
   %Program Files% (x86)\GUM98D5.tmp\goopdateres_bn.dll (28 bytes)
   %Program Files% (x86)\GUM98D5.tmp\goopdateres_pt-PT.dll (29 bytes)
   %Program Files% (x86)\GUM98D5.tmp\goopdateres_no.dll (29 bytes)
   %Program Files% (x86)\Google\GoogleToolbarNotifier\5.10.11023.1534\gtn.dll (144 bytes)
   %Program Files% (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (79 bytes)
   %Program Files% (x86)\Google\GoogleToolbarNotifier\5.10.11023.1534\gth.dll (40 bytes)
   %Program Files% (x86)\Google\GoogleToolbarNotifier\5.10.11023.1534\swg.dll (981 bytes)
   %Program Files% (x86)\Google\GoogleToolbarNotifier\5.10.11023.1534\Readme.url (212 bytes)
   

4. Delete the following value(s) in the autorun key (How to Work with System Registry):

   [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
   "FastFox" = "%Program Files% (x86)\NCH Software\FastFox\fastfox.exe -logon"

5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: NCH Software
Product Name: ExpressScribe
Product Version:
Legal Copyright: NCH Software
Legal Trademarks:
Original Filename:
Internal Name: Scribe
File Version: 5.69
File Description: Express Scribe Transcription Software
Comments:
Language: Language Neutral

Company Name: NCH SoftwareProduct Name: ExpressScribeProduct Version: Legal Copyright: NCH SoftwareLegal Trademarks: Original Filename: Internal Name: ScribeFile Version: 5.69 File Description: Express Scribe Transcription SoftwareComments: Language: Language Neutral

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.rdata	4096	2338	2560	2.76389	a322bee8b6315dcdf55664104eb8aed4
.data	8192	1596	2048	3.48789	cc10a049565dcd8a13f7ded9f6d7749b
.rsrc	12288	925152	925184	5.54423	6eb1b0b97765e7dbf38b8e9c13da15b0

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://audiochannel.net/components/edsetup.exe	66.39.83.117
hxxp://audiochannel.net/components/ffsetup.exe	66.39.83.117
hxxp://audiochannel.net/versions/components/tb_google_row.dat	66.39.83.117
hxxp://audiochannel.net/components/toolbars/NCH_GoogleToolbar.exe	66.39.83.117
hxxp://dl.l.google.com/dl/toolbar/t7/data/7.5.6227.252/googletoolbarinstaller_en_signed.exe
hxxp://a1621.g.akamai.net/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?8375aa7c3aaffcf1
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEFIA5aolVvwahu2WydRLM8c=
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTSqZMG5M8TA9rdzkbCnNwuMAd5VgQUz5mp6nsm9EvJjo/X8AUm7+PSp50CECkSxwyaK4o+9vYHRmLWi40=
hxxp://google.com/tools/swg2/update?type=c&as=swg&os=win&osv=6.1.7601&hl=en&ie=10.0.9200.16521&ds=0&pds=0&su=0&hpi=-1&brand=NCHD&pa=9&cl=1&tbv=&id=6fcd4572f44047df87447927667a9779eb587e9442&from=&to=5.10.11023.1534	216.58.209.174
hxxp://google.com/tools/pso/ping?as=tbin&gu=pi&mode=3&sin=1&ein=0&version=7.5.6227.252&brand=NCHD&hl=en&tbiv=7.5.6227.252&time=1432028303&fitime=1432028303&browser=9.10.9200.16521&osver=6.1&ossp=1.0&osarch=64&ext=EXE&id=6BA3A3DD8C86609F54CC8AB84959F665663D1aFIBM	216.58.209.174
hxxp://google.com/tools/pso/ping?as=tbin&gu=pi&mode=3&sin=2&ein=0&version=7.5.6227.252&brand=NCHD&hl=en&tbiv=7.5.6227.252&time=1432028309&fitime=1432028303&verold=7.5.6227.252&brandold=NCHD&browser=9.10.9200.16521&osver=6.1&ossp=1.0&osarch=64&ext=EXE&id=6BA3A3DD8C86609F54CC8AB84959F665663D1aFIBM	216.58.209.174
hxxp://a1621.g.akamai.net/msdownload/update/v3/static/trustedr/en/authrootstl.cab?4b69c6918b9372a6
hxxp://a1363.dscg.akamai.net/pki/crl/products/WinPCA.crl
hxxp://a1363.dscg.akamai.net/pki/crl/products/MicrosoftTimeStampPCA.crl
hxxp://a1363.dscg.akamai.net/pki/crl/products/microsoftrootcert.crl
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w=
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAxNF3PJUX7iAOhAP2oGxcI=
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTSqZMG5M8TA9rdzkbCnNwuMAd5VgQUz5mp6nsm9EvJjo/X8AUm7+PSp50CEALa8SdwQh28+NjkQGqVhx8=
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTSqZMG5M8TA9rdzkbCnNwuMAd5VgQUz5mp6nsm9EvJjo/X8AUm7+PSp50CEGO+CyDUoFQBjrKVo87pCRc=
hxxp://a1363.dscg.akamai.net/pki/crl/products/MicCodSigPCA_08-31-2010.crl
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEEES5jLHsYoCmjofrIA6uJ8=
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD/yl6nWPkczAQUe1tFz6/Oy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS+zcBkvzl4=
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9+WQCtWAQU1A1lP3q9NMb+R+dMDcC98t4Vq3ECEGpWCCD6PprY5UEXNLHUCtU=
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAKQll6RM0DNpmNM7zH3/Qc=
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTEemCaVgs8Tuh2B9fGVE0pKKNyzgQUTF+nNhcF4oZhIkk5jLmo40rgOBoCEC6utoKGY/7ZdVX4/iTzOxo=
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRODEXefhs/UZFum2o8YfzOFwceMwQUkz5j3yJ0BOBkhDHd2yOfDq+2TZMCEA89qsgV9niZmSI6gIO0S/U=
hxxp://ocsp.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD/yl6nWPkczAQUe1tFz6/Oy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS+zcBkvzl4=	23.43.139.27
hxxp://ocsp.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9+WQCtWAQU1A1lP3q9NMb+R+dMDcC98t4Vq3ECEGpWCCD6PprY5UEXNLHUCtU=	23.43.139.27
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAxNF3PJUX7iAOhAP2oGxcI=	23.43.139.27
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTSqZMG5M8TA9rdzkbCnNwuMAd5VgQUz5mp6nsm9EvJjo/X8AUm7+PSp50CEGO+CyDUoFQBjrKVo87pCRc=	23.43.139.27
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRODEXefhs/UZFum2o8YfzOFwceMwQUkz5j3yJ0BOBkhDHd2yOfDq+2TZMCEA89qsgV9niZmSI6gIO0S/U=	23.43.139.27
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAKQll6RM0DNpmNM7zH3/Qc=	23.43.139.27
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTEemCaVgs8Tuh2B9fGVE0pKKNyzgQUTF+nNhcF4oZhIkk5jLmo40rgOBoCEC6utoKGY/7ZdVX4/iTzOxo=	23.43.139.27
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w=	23.43.139.27
hxxp://clients1.google.com/tools/pso/ping?as=tbin&gu=pi&mode=3&sin=2&ein=0&version=7.5.6227.252&brand=NCHD&hl=en&tbiv=7.5.6227.252&time=1432028309&fitime=1432028303&verold=7.5.6227.252&brandold=NCHD&browser=9.10.9200.16521&osver=6.1&ossp=1.0&osarch=64&ext=EXE&id=6BA3A3DD8C86609F54CC8AB84959F665663D1aFIBM	216.58.209.174
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEEES5jLHsYoCmjofrIA6uJ8=	23.43.139.27
hxxp://www.audiochannel.net/versions/components/tb_google_row.dat	66.39.83.117
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTSqZMG5M8TA9rdzkbCnNwuMAd5VgQUz5mp6nsm9EvJjo/X8AUm7+PSp50CEALa8SdwQh28+NjkQGqVhx8=	23.43.139.27
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTSqZMG5M8TA9rdzkbCnNwuMAd5VgQUz5mp6nsm9EvJjo/X8AUm7+PSp50CECkSxwyaK4o+9vYHRmLWi40=	23.43.139.27
hxxp://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl	87.245.221.113
hxxp://clients1.google.com/tools/swg2/update?type=c&as=swg&os=win&osv=6.1.7601&hl=en&ie=10.0.9200.16521&ds=0&pds=0&su=0&hpi=-1&brand=NCHD&pa=9&cl=1&tbv=&id=6fcd4572f44047df87447927667a9779eb587e9442&from=&to=5.10.11023.1534	216.58.209.174
hxxp://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl	87.245.221.113
hxxp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?4b69c6918b9372a6	87.245.221.90
hxxp://dl.google.com/dl/toolbar/t7/data/7.5.6227.252/googletoolbarinstaller_en_signed.exe	216.58.211.14
hxxp://crl.microsoft.com/pki/crl/products/WinPCA.crl	87.245.221.113
hxxp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?8375aa7c3aaffcf1	87.245.221.90
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEFIA5aolVvwahu2WydRLM8c=	23.43.139.27
hxxp://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl	87.245.221.113
hxxp://clients1.google.com/tools/pso/ping?as=tbin&gu=pi&mode=3&sin=1&ein=0&version=7.5.6227.252&brand=NCHD&hl=en&tbiv=7.5.6227.252&time=1432028303&fitime=1432028303&browser=9.10.9200.16521&osver=6.1&ossp=1.0&osarch=64&ext=EXE&id=6BA3A3DD8C86609F54CC8AB84959F665663D1aFIBM	216.58.209.174
hxxp://www.audiochannel.net/components/toolbars/NCH_GoogleToolbar.exe	66.39.83.117
tools.google.com	173.194.44.39

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD/yl6nWPkczAQUe1tFz6/Oy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS+zcBkvzl4= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.thawte.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1503

content-transfer-encoding: binary

Cache-Control: max-age=343207, public, no-transform, must-revalidate

Last-Modified: Sat, 16 May 2015 09:00:21 GMT

Expires: Sat, 23 May 2015 09:00:21 GMT

Date: Tue, 19 May 2015 09:41:53 GMT

Connection: keep-alive

0..........0..... .....0......0...0......&Km...."....}....,.c..20150516090021Z0s0q0I0... ........0..k....&..p..^.X.....{[E....z.1..j..F.WHP..G.Mxs..../.p./.^....20150516090021Z....20150523090021Z0...*.H...............Y..W..n.W5\.BO(f.X..Us2..g.8;..'k.-W..3l...._3.L]....>....>..*..a_^.........d..;._...@..F{e?.2.....dh)6....#..H...P."...E.l.fe.}.@.G.....sHX.[E.kv.].).$^...:....c8.3...)....r...Z.a..........4$*.wq...`zA]..Z9...`.[.....ss1..* H..!.a@.M..y.7.~....=...p...2....0...0...0............I...*....^n...0...*.H........0..1.0...U....US1.0...U....thawte, Inc.1(0&..U....Certification Services Division1806..U.../(c) 2006 thawte, Inc. - For authorized use only1.0...U....thawte Primary Root CA0...141202000000Z..151216235959Z0_1.0...U....US1.0...U....thawte, Inc.1907..U...0thawte Primary Root OCSP Responder Certificate 30.."0...*.H.............0.........x...F83..,.D.,2D.;JGc.|_.k.....B.7.....G}.M.s.....S.i.Uu.h.Aq..v...4:l..U.......T7l...~vl...r....{*..........V.o..8|.B..^.a.. ...z....x..s...\[Y....<....'> ..YC..7.zVk.$...o3..kao]c...>C./bPX.......I..Oc.....NN......g.....,/..]......qN.....V!<.3.)...y#.........i0g0...U.%..0... .......0... .....0......0...U.......0.0...U...........0!..U....0...0.1.0...U....TGV-B-2770...*.H................lt..\..z. ..N.f.!.S5d?J.&....r...D........L.`.s.p...HC.L.8f... .........GA7......P..Z.%.../............z.n.6~I...].).....W...W\|.uya..:...^...hW..7.Z.uc.'....:.xL...HS.....>.........5......%....3S....h........U....o.C.\.t.....G.._.C0(l.E9..6UTxg.gF ..;.....

<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9+WQCtWAQU1A1lP3q9NMb+R+dMDcC98t4Vq3ECEGpWCCD6PprY5UEXNLHUCtU= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.thawte.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1396

content-transfer-encoding: binary

Cache-Control: max-age=587316, public, no-transform, must-revalidate

Last-Modified: Tue, 19 May 2015 04:50:05 GMT

Expires: Tue, 26 May 2015 04:50:05 GMT

Date: Tue, 19 May 2015 09:41:53 GMT

Connection: keep-alive

0..p......i0..e.. .....0.....V0..R0......Qw.}`.Z8...JV...r@z...20150519045005Z0s0q0I0... ........l....r.vdv0..*.~Y..X....e?z.4..G.L.......q..jV. .>...A.4........20150519045005Z....20150526045005Z0...*.H..............m...I....'H8....|....9j...........-S.........?8..a~W.(...b..7...j..5..........I.T.H..{-..y.&..6.`.%t..:!T.....X...mW..j.....6....i....D.@/..}M.R%U.0...0.......^.R...M..F.n/..b.{.:.g<f...i.;..M.b......P.U.-....(....NI.2......M.q..F.P.T....6.|......&.a.Z-.H....0...0...0..y.......^..........N...)0...*.H........0J1.0...U....US1.0...U....Thawte, Inc.1$0"..U....Thawte Code Signing CA - G20...150303000000Z..150601235959Z0Y1.0...U....US1.0...U....Thawte, Inc.1301..U...*Thawte Code Signing CA - G2 OCSP Responder0.."0...*.H.............0............).Z.......O.~.l...,\.3.".'.'W .ih./..}OA...K...HJd....K^..<.....-.rWJ.j.U.._......W.../.6....J.y.u-.\...2..U.52B.>...=F...RbR.y.zm.......{b.bj....Y..J..m...*=.^......V.}p......rmA......9.L ...{?.g.-Y............8...k.$.:.5..6#4..F.#....t.B.8.O)'F.p).........d0b0...U....0.0...U.%..0... .......0...U........0... .....0......0"..U....0...0.1.0...U....TGV-B-32450...*.H..............C.....8.Aw.{....`...y1N...W4M..M.J.3~..7#}..X..:x..5....$...Z^%.?6..e...}I.)....... .A.w......_...B..j.T..Yu.o.....g....H....q.Ju.SA`K.....~..O_.....S....I>..O.X..E.......]...y..L..F....K......../...._XSk6.:a};.?`...:^.....p....4Z.3L;.......t....>.....j....

<<< skipped >>>

GET /components/edsetup.exe HTTP/1.0

Host: audiochannel.net

HTTP/1.1 200 OK

Date: Tue, 19 May 2015 09:37:43 GMT

Server: Apache/2.2.29

Last-Modified: Thu, 23 Oct 2014 21:37:01 GMT

ETag: "94860-5061ddd597940"

Accept-Ranges: bytes

Content-Length: 608352

Connection: close

Content-Type: application/octet-stream

X-Pad: avoid browser bug

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......I.. ...s...s...s...s...s...s-..s*7.s...s*7.s...s*7.s...sRich...s........................PE..L...3..R.............................!............@..........................P..................................................x....0...............2..`............................................................................................rdata.."...........................@..@.data...<.... ......................@....rsrc........0......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................v...`...v...................................,...B...P...f...........................F...:.......................bad allocation..kernel32.dll....VerifyVersionInfoA..W.i.n.d.o.w.s. .9.8./.M.E. .S.u.p.p.o.r.t...T.h.i.s. .v.e.r.s.i.o.n. .o.f. .t.h.e. .a.p.p.l.i.c.a.t.i.o.n. .r.e.q.u.i.r.e.s. .W.i.n.d.o.w.s. .X.P./.2.0.0.3. .o.r. .l.a.t.e.r.......D.o. .y.o.u. .w.a.n.t. .t.o. .g.o. .t.h.e. .w.e.b.s.i.t.e. .a.n.d. .d.o.w.n.l.o.a.d. .t.h.e. .W.i.n.d.o.w.s. .9.8./.M.E. .v.e

<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTSqZMG5M8TA9rdzkbCnNwuMAd5VgQUz5mp6nsm9EvJjo/X8AUm7+PSp50CEGO+CyDUoFQBjrKVo87pCRc= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1724

content-transfer-encoding: binary

Cache-Control: max-age=597481, public, no-transform, must-revalidate

Last-Modified: Tue, 19 May 2015 07:39:49 GMT

Expires: Tue, 26 May 2015 07:39:49 GMT

Date: Tue, 19 May 2015 09:41:48 GMT

Connection: keep-alive

0..........0..... .....0......0...0......s]c...{6SFe..z.%......20150519073949Z0s0q0I0... ...................F....0.yV......{&.K......&.......c.. ..T.............20150519073949Z....20150526073949Z0...*.H...............v.....8...;.o.4.?(3[.....).;....t.W...N\.. ..<S[.|^=.^...N.W.^7..3d..[.XaJ...J.\$X...\.t.x.........5.Z(..jWL...............p....<....d9...I2C...<zm......A.........L....R..l..`...^..Y.\.....*J...}&be......X.e$..:.s..Vx.....o..A.Hh..p\..N Ve...`.{9......W....0...0...0..........KA.w.aD*.2"6..Em0...*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use at hXXps://VVV.verisign.com/rpa (c)101.0,..U...%VeriSign Class 3 Code Signing 2010 CA0...150519000000Z..150817235959Z0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1:08..U...1VeriSign Class 3 Code Signing 2010 OCSP Responder0.."0...*.H.............0.........w.n...}.{...{....G....;.X.e...A.....Z.6bmZ..A#.1.E........HHlY.9H..t......X.`b|(}Z......8:...T.%...nl.(.........). H=p.5...7.....0...&M...)9-.......\C..MD.W.L....gtl..p.....7...5...]......T2~.=P.i..4..1.............U"W...8.U..g.0..y....g.q.......0....nw.{.........0...0...U....0.0....U. ...0..0....`.H...E....0..0(.. .........hXXps://VVV.verisign.com/CPS0b.. .......0V0...VeriSign, Inc.0.....=VeriSign's CPS incorp. by reference liab. ltd. (c)97 VeriSign0...U.%..0... .......0...U........0... .....0......0!..U....0...0.1.0...U....TGV-C-5800...*.H..............2.........P ..$.y..=|G(T...I...s3.b.D .KwD...!T..o.X...%.

<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEEES5jLHsYoCmjofrIA6uJ8= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1790

content-transfer-encoding: binary

Cache-Control: max-age=554911, public, no-transform, must-revalidate

Last-Modified: Mon, 18 May 2015 19:50:23 GMT

Expires: Mon, 25 May 2015 19:50:23 GMT

Date: Tue, 19 May 2015 09:41:52 GMT

Connection: keep-alive

0..........0..... .....0......0...0......'.V.8.F.V....H....JW..20150518195023Z0s0q0I0... ..........!7h....O.d...AG&h.....k.&p..?...-.5.......A..2.....:...:......20150518195023Z....20150525195023Z0...*.H..............MI......._.3}...$.f?....]..._j..a.....H...E.H..A....}..o.w.C6...0.)j.._..N...7.....0s..j.V.{B.6....O..4...n..p..;}a?.lh.....t.w.Uph.....i`....U\.sQ.P..5..S.DNt\./W.....T..]r.O.".Lp....4....qO.J..G._..> ...R..... ...[y..02..|.......R..>....bl....".Ov.S@......#0...0...0..........r..?.*......y"..0...*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use at hXXps://VVV.verisign.com/rpa (c)09100...U...'VeriSign Class 3 Code Signing 2009-2 CA0...150226000000Z..150527235959Z0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use at hXXps://VVV.verisign.com/rpa (c)091<0:..U...3VeriSign Class 3 Code Signing 2009-2 OCSP Responder0.."0...*.H.............0.............m5*R........2....>...yU4..L.. ...........u..Hez..Pn.....d...nz(...V7.}^...d!RX...bl..[..a...L.. .~..Ij......%..%p.-...u..:..i..F*]...*....{NH..|0...gHX.Q.r....S..........._.9.(w...suC...N..s.....&."...:.C.Q.i~rl..<..krS..8.B..o].y..L.4...iB@..s.....mw.........0...0...U....0.0....U. ...0..0....`.H...E....0..0(.. .........hXXps://VVV.verisign.com/CPS0b.. .......0V0...VeriSign, Inc.0.....=VeriSign's CPS incorp. by reference liab. ltd. (c)97 VeriSign0...U.%..0... .......0...U........0... .....0......0"..U....0...0.1.0...U....TGV-B-32010...*.H

<<< skipped >>>

GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.microsoft.com

HTTP/1.1 200 OK

Content-Type: application/pkix-crl

Last-Modified: Tue, 14 Apr 2015 05:02:07 GMT

Accept-Ranges: bytes

ETag: "2711f7277076d01:0"

Server: Microsoft-IIS/8.5

VTag: 279782516600000000

P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"

X-Powered-By: ASP.NET

Content-Length: 554

Cache-Control: max-age=900

Date: Tue, 19 May 2015 09:41:52 GMT

Connection: keep-alive

0..&0......0...*.H........0y1.0...U....US1.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corporation1#0!..U....Microsoft Code Signing PCA..150413163223Z..150713045223Z.a0_0...U.#..0..........X..7.3...L...0... .....7.........0...U......Z0... .....7......150712164223Z0...*.H.............WK....e.\.-.n......./......."]..E!.. //=...[....w... ..........#...[.l.J..f|..... .s......w...J._.......3.[..#.z....ko.I..Q{....e.nV......F..d}..rF\H.jlH]dQ.E....x......W............j....&L. 2.$.?...X?.#.(.....pK.v.......y..r....t......=.AW......K.G.gJD.b...

GET /versions/components/tb_google_row.dat HTTP/1.0

Host: VVV.audiochannel.net

HTTP/1.1 404 Not Found

Date: Tue, 19 May 2015 09:38:24 GMT

Server: Apache/2.2.29

Content-Length: 235

Connection: close

Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>404 Not Found</title>.</head><body>.<h1>Not Found</h1>.<p>The requested URL /versions/components/tb_google_row.dat was not found on this server.</p>.</body></html>...

GET /msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?8375aa7c3aaffcf1 HTTP/1.1

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Tue, 24 Mar 2015 16:17:41 GMT

If-None-Match: "804047d4e66d01:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: ctldl.windowsupdate.com

HTTP/1.1 304 Not Modified

Content-Type: application/octet-stream

Last-Modified: Tue, 24 Mar 2015 16:17:41 GMT

ETag: "804047d4e66d01:0"

Cache-Control: max-age=86400

Date: Tue, 19 May 2015 09:38:11 GMT

Connection: keep-alive

HTTP/1.1 304 Not Modified..Content-Type: application/octet-stream..Last-Modified: Tue, 24 Mar 2015 16:17:41 GMT..ETag: "804047d4e66d01:0"..Cache-Control: max-age=86400..Date: Tue, 19 May 2015 09:38:11 GMT..Connection: keep-alive..

GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1

Cache-Control: max-age = 900

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Tue, 24 Mar 2015 05:02:25 GMT

If-None-Match: "a1132b8ef65d01:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.microsoft.com

HTTP/1.1 304 Not Modified

Content-Type: application/pkix-crl

Last-Modified: Tue, 24 Mar 2015 05:02:25 GMT

ETag: "a1132b8ef65d01:0"

Cache-Control: max-age=808

Date: Tue, 19 May 2015 09:41:43 GMT

Connection: keep-alive

HTTP/1.1 304 Not Modified..Content-Type: application/pkix-crl..Last-Modified: Tue, 24 Mar 2015 05:02:25 GMT..ETag: "a1132b8ef65d01:0"..Cache-Control: max-age=808..Date: Tue, 19 May 2015 09:41:43 GMT..Connection: keep-alive..

GET /tools/swg2/update?type=c&as=swg&os=win&osv=6.1.7601&hl=en&ie=10.0.9200.16521&ds=0&pds=0&su=0&hpi=-1&brand=NCHD&pa=9&cl=1&tbv=&id=6fcd4572f44047df87447927667a9779eb587e9442&from=&to=5.10.11023.1534 HTTP/1.1

Accept: */*

User-Agent: SearchWithGoogle

Host: clients1.google.com

HTTP/1.1 200 OK

Content-Type: text/plain

Transfer-Encoding: chunked

Date: Tue, 19 May 2015 09:38:23 GMT

Expires: Tue, 19 May 2015 09:38:23 GMT

Cache-Control: private, max-age=0

X-Content-Type-Options: nosniff

X-Frame-Options: SAMEORIGIN

X-XSS-Protection: 1; mode=block

Server: GSE

Alternate-Protocol: 80:quic,p=1

16..rlz: 1R______enUA641..0..

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTSqZMG5M8TA9rdzkbCnNwuMAd5VgQUz5mp6nsm9EvJjo/X8AUm7+PSp50CEALa8SdwQh28+NjkQGqVhx8= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1725

content-transfer-encoding: binary

Cache-Control: max-age=559424, public, no-transform, must-revalidate

Last-Modified: Mon, 18 May 2015 21:05:30 GMT

Expires: Mon, 25 May 2015 21:05:30 GMT

Date: Tue, 19 May 2015 09:41:47 GMT

Connection: keep-alive

0..........0..... .....0......0...0......N$p...v....1.;..vn....20150518210530Z0s0q0I0... ...................F....0.yV......{&.K......&..........'pB.....@j.......20150518210530Z....20150525210530Z0...*.H................^.M...a..b....0....}......Q.^..E.#s5'mX...Mj.X$1,....k...v\.....9....k.L":d.l..%.0......-..JGH.c&TCn.MD..K..w.9..a....=.3;E...a...../.l.R.....b.1..^x.-...5..1...w%By.s...N4...u2>.ai Z..X...%..........S.7.._...$[.^.....'LTY.M....R..cO.A...m.;k.....;.........0...0...0............F...I]A(M..s@.0...*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use at https://VVV.verisign.com/rpa (c)101.0,..U...%VeriSign Class 3 Code Signing 2010 CA0...150225000000Z..150526235959Z0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1:08..U...1VeriSign Class 3 Code Signing 2010 OCSP Responder0.."0...*.H.............0.........q<...A...#......A...u..Lz.............o..D.vQ%..s.......f....e../jI.d.W.....|K;.j5...#.B%.]..~S.... .|;S.&.....N..`...5.....!D.p....M/.. ..;j...q..`6...2.Ck..BnLHvCZn%....,.w.Ooi..z'...\.Yx......b..L...5.o..o..{..}.........%e.....N..._i........*Bc....:yQg.........0...0...U....0.0....U. ...0..0....`.H...E....0..0(.. .........hXXps://VVV.verisign.com/CPS0b.. .......0V0...VeriSign, Inc.0.....=VeriSign's CPS incorp. by reference liab. ltd. (c)97 VeriSign0...U.%..0... .......0...U........0... .....0......0"..U....0...0.1.0...U....TGV-B-31830...*.H..............-..^.........f.P`...s.....8.....V.......... .... B.(@-)6.Rf.

<<< skipped >>>

GET /components/ffsetup.exe HTTP/1.0

Host: audiochannel.net

HTTP/1.1 200 OK

Date: Tue, 19 May 2015 09:37:46 GMT

Server: Apache/2.2.29

Last-Modified: Tue, 21 Jan 2014 19:35:24 GMT

ETag: "85618-4f0801c0df700"

Accept-Ranges: bytes

Content-Length: 546328

Connection: close

Content-Type: application/octet-stream

X-Pad: avoid browser bug

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......I.. ...s...s...s...s...s...s-..s*7.s...s*7.s...s*7.s...sRich...s........................PE..L...3..R.....................<.......!............@..........................`....... ..........................................x....0..t(...........@...............................................................................................rdata.."...........................@..@.data...<.... ......................@....rsrc...t(...0...*..................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................v...`...v...................................,...B...P...f...........................F...:.......................bad allocation..kernel32.dll....VerifyVersionInfoA..W.i.n.d.o.w.s. .9.8./.M.E. .S.u.p.p.o.r.t...T.h.i.s. .v.e.r.s.i.o.n. .o.f. .t.h.e. .a.p.p.l.i.c.a.t.i.o.n. .r.e.q.u.i.r.e.s. .W.i.n.d.o.w.s. .X.P./.2.0.0.3. .o.r. .l.a.t.e.r.......D.o. .y.o.u. .w.a.n.t. .t.o. .g.o. .t.h.e. .w.e.b.s.i.t.e. .a.n.d. .d.o.w.n.l.o.a.d. .t.h.e. .W.i.n.d.o.w.s. .9.8./.M.E. .

<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAKQll6RM0DNpmNM7zH3/Qc= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1790

content-transfer-encoding: binary

Cache-Control: max-age=545742, public, no-transform, must-revalidate

Last-Modified: Mon, 18 May 2015 17:15:12 GMT

Expires: Mon, 25 May 2015 17:15:12 GMT

Date: Tue, 19 May 2015 09:42:02 GMT

Connection: keep-alive

0..........0..... .....0......0...0......'.V.8.F.V....H....JW..20150518171512Z0s0q0I0... ..........!7h....O.d...AG&h.....k.&p..?...-.5..........^.3@..cL.1.......20150518171512Z....20150525171512Z0...*.H............."...S...P......,;...X..d]..1Do......c...i.{g..'...K...1...5.E.6.I.F.. .......2...-Dy2"..PPF.n....A"6:A4>..G.,.ei...'.......2Jt^.....1CP...F..@......:6.q...U '...hJ..W_\.J.Z..= ..i......l_S...a......p..e..]....B......v .M.x.S..1S..P%...........w.....w..sp;....#0...0...0..........r..?.*......y"..0...*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use at https://VVV.verisign.com/rpa (c)09100...U...'VeriSign Class 3 Code Signing 2009-2 CA0...150226000000Z..150527235959Z0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use at hXXps://VVV.verisign.com/rpa (c)091<0:..U...3VeriSign Class 3 Code Signing 2009-2 OCSP Responder0.."0...*.H.............0.............m5*R........2....>...yU4..L.. ...........u..Hez..Pn.....d...nz(...V7.}^...d!RX...bl..[..a...L.. .~..Ij......%..%p.-...u..:..i..F*]...*....{NH..|0...gHX.Q.r....S..........._.9.(w...suC...N..s.....&."...:.C.Q.i~rl..<..krS..8.B..o].y..L.4...iB@..s.....mw.........0...0...U....0.0....U. ...0..0....`.H...E....0..0(.. .........hXXps://VVV.verisign.com/CPS0b.. .......0V0...VeriSign, Inc.0.....=VeriSign's CPS incorp. by reference liab. ltd. (c)97 VeriSign0...U.%..0... .......0...U........0... .....0......0"..U....0...0.1.0...U....TGV-B-32010...*.H...

<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTEemCaVgs8Tuh2B9fGVE0pKKNyzgQUTF+nNhcF4oZhIkk5jLmo40rgOBoCEC6utoKGY/7ZdVX4/iTzOxo= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1552

content-transfer-encoding: binary

Cache-Control: max-age=573171, public, no-transform, must-revalidate

Last-Modified: Tue, 19 May 2015 00:50:21 GMT

Expires: Tue, 26 May 2015 00:50:21 GMT

Date: Tue, 19 May 2015 09:42:02 GMT

Connection: keep-alive

0..........0..... .....0......0...0........C...4N...@..6...v...20150519005021Z0s0q0I0... .........z`.V.<N.v...TM)(.r...L_.6....a"I9....J.8........c..uU..$.;.....20150519005021Z....20150526005021Z0...*.H.............X..~.$.T..w......6..!O.Y....N.{*.`.......S.u..{....$Q.fO.).. ...1z..A..::O..?.g......d*.Z......l..uq...nx....(..n.}d6 .........?_..X.T.....1..Y&.....n.. ..?..%gE.6.3.C.*[r..0C...._.y...../..c.m.J.....T....99Jkc.a.n}%.....4..W....t1...O.....i..S_V..z.hV.2.u...50..10..-0..........y.P}~.EY....T]. 0...*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1<0:..U...3Class 3 Public Primary Certification Authority - G21:08..U...1(c) 1998 VeriSign, Inc. - For authorized use only1.0...U....VeriSign Trust Network0...141202000000Z..151216235959Z0..1.0...U....US1.0...U....Symantec Corporation1.0...U....Symantec Trust Network1?0=..U...6Symantec Class 3 PCA - G2 OCSP Responder Certificate 30.."0...*.H.............0..........6..]......w';.r........I..c..4.... .........TyW......hd_.....!C.k......SE<?o.H.. .me.c..9N.&....e.^-..a.....i\:..*."..u...|....".Nf3.~.L...QW...p.....-]UV8U...J&.<./.G.....I...4.T....#I*.i.E0\..~q$.I.......X?G....f.t......v.l.U.Ld.I...B.....=...Sf...H.s.........0..0...U....0.0l..U. .e0c0a..`.H...E....0R0&.. .........hXXp://VVV.symauth.com/cps0(.. .......0...hXXp://VVV.symauth.com/rpa0...U.%..0... .......0...U........0... .....0......0!..U....0...0.1.0...U....TGV-B-2740...*.H............1.`...i.....H.C.i.9~.i..Z.r.*$..(./.ag9.....J.Q.~.`.$?b..C....<.h.........d&....3.kV.....f...3I..

<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRODEXefhs/UZFum2o8YfzOFwceMwQUkz5j3yJ0BOBkhDHd2yOfDq+2TZMCEA89qsgV9niZmSI6gIO0S/U= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1725

content-transfer-encoding: binary

Cache-Control: max-age=563875, public, no-transform, must-revalidate

Last-Modified: Mon, 18 May 2015 22:15:43 GMT

Expires: Mon, 25 May 2015 22:15:43 GMT

Date: Tue, 19 May 2015 09:42:02 GMT

Connection: keep-alive

0..........0..... .....0......0...0......%bn.$..5.......?'4....20150518221543Z0s0q0I0... ........N.E.~.?Q.n.j<a.....3...>c."t..d.1..#....M....=....x..":...K.....20150518221543Z....20150525221543Z0...*.H.............i.`._..84...".FlP.T.LzX../f.....&..f...X.>.Ig.N4*....d......=....|q. p....J...m[.V.Kz....2.c.Zj\.s...^}...............'H.7i.u.nD..J.....Jw.yI....vGi......_........o*z..Z....cH[...w.8.....K.}.1..=|.(.l.e.CC77..l.kR.....?.x...>...o3d.....JQ.tS3v....<...3f.\.....0...0...0..........7.R.~|..r."....#0...*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use at hXXps://VVV.verisign.com/rpa (c)091.0,..U...%VeriSign Class 3 Code Signing 2009 CA0...150401000000Z..150630235959Z0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1:08..U...1VeriSign Class 3 Code Signing 2009 OCSP Responder0.."0...*.H.............0..........z..|..>.....5.Z ...2.C MWIH.5......M.\.... ...eW..`.B=..`:..R. ...Z.k.Y.....p@.(3.c....a.;..[E....J:'...`...B....M..&......{. (........%......^[v[....m....*.T.o&4..3.....3.........G...e)...'?.K..2s..8=?..z.:..T..-.8R..8wv7*U.K..c...<s...]{.........6.?_...........0...0...U....0.0....U. ...0..0....`.H...E....0..0(.. .........https://VVV.verisign.com/CPS0b.. .......0V0...VeriSign, Inc.0.....=VeriSign's CPS incorp. by reference liab. ltd. (c)97 VeriSign0...U.%..0... .......0...U........0... .....0......0"..U....0...0.1.0...U....TGV-B-34920...*.H.............,..-......q3a........z....t;B.z.h...]...#}.6.,

<<< skipped >>>

GET /components/toolbars/NCH_GoogleToolbar.exe HTTP/1.0

Host: VVV.audiochannel.net

HTTP/1.1 200 OK

Date: Tue, 19 May 2015 09:37:55 GMT

Server: Apache

Last-Modified: Mon, 07 Apr 2014 23:51:36 GMT

Accept-Ranges: bytes

Content-Length: 782288

Connection: close

Content-Type: application/x-msdownload

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........#yd.B.7.B.7.B.7..z7.B.7..l7.B.7.B.7.B.7.:.7.B.7...7.B.7.:.7.B.7Rich.B.7........................PE..L...?..I.................h...@...B...4............@.................................z................................................................................................................................................................text....g.......h.................. ..`.rdata...............l..............@..@.data...............................@....ndata...................................rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................U....\.}..t .}.F.E.u..H......G..H.P.u..u..u...|.@..K...SV.5..G.W.E.P.u.....@..e...E..E.P.u.....@..}..e....D.@........FR..VV..U... M..........M........E...FQ.....NU..M.......M...VT..U........FP..E...............E.P.M...H.@..E..P.E..E.P.u.....@..u....E..9}...n....~X.te.v4..L.@..E...tU.}.j.W.E......E.......P.@..vXW..T.@..u..5X.@.W..h ....E..E.Pj.h.2G.W....@..u.W...u....E.P.u.....@._^3.[.....L$....G...i. @...T.....tUVW.q.3.;5..G.sD..i. @...D..S.....t.G.....t...O..t .....u...3....3...F. @..;5..G.r.[_^...U..QQ.U.

<<< skipped >>>

GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab?4b69c6918b9372a6 HTTP/1.1

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Tue, 24 Feb 2015 00:37:01 GMT

If-None-Match: "80b4d90ca4fd01:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: ctldl.windowsupdate.com

HTTP/1.1 304 Not Modified

Content-Type: application/octet-stream

Last-Modified: Tue, 24 Feb 2015 00:37:01 GMT

ETag: "80b4d90ca4fd01:0"

Cache-Control: max-age=604800

Date: Tue, 19 May 2015 09:38:52 GMT

Connection: keep-alive

HTTP/1.1 304 Not Modified..Content-Type: application/octet-stream..Last-Modified: Tue, 24 Feb 2015 00:37:01 GMT..ETag: "80b4d90ca4fd01:0"..Cache-Control: max-age=604800..Date: Tue, 19 May 2015 09:38:52 GMT..Connection: keep-alive..

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1453

content-transfer-encoding: binary

Cache-Control: max-age=574824, public, no-transform, must-revalidate

Last-Modified: Tue, 19 May 2015 01:20:15 GMT

Expires: Tue, 26 May 2015 01:20:15 GMT

Date: Tue, 19 May 2015 09:41:46 GMT

Connection: keep-alive

0..........0..... .....0......0...0......T3t.%..O.E..~..F.=....20150519012015Z0s0q0I0... ........H.dI.....3..^B...d6Q....ZL%."..1.m..._)..a..eR&.....Y.)..".\....20150519012015Z....20150526012015Z0...*.H.............U.[.....lB..h2..\"........]......(wA..H..M4,`.o..Pz.L..h..$c ...l.....EO&3.?.{O.Dw..5v.x...A..C..=f*!.P..#..cM.....y.%..... o|...).q.b.....Y3....D..U...pr7..p.p.y..R.|Z......W......U....^D.WW...B...N......l...{.).g...sS...4>~<.IB.c....t1.(...P.J.:...).G.b.....0...0...0..3......./...b.v..-....l}0...*.H........0_1.0...U....US1.0...U....VeriSign, Inc.1705..U....Class 3 Public Primary Certification Authority0...141202000000Z..151216235959Z0..1.0...U....US1.0...U....Symantec Corporation1.0...U....Symantec Trust Network1?0=..U...6Symantec Class 3 PCA - G1 OCSP Responder Certificate 30.."0...*.H.............0..........'......Y..x.3B1.7..Q..`..d.. ....s..t.$a.....j2R.{ ,*..c{.3.....H..3-; ).....0._...*..9M..V...... ...{m...-.......)..tR..{D....~...M...T..pS.p..^|o....S..v.).).....r.v.qo$......C.V!....@.h#qh...u1T.].G0.]E...=._...... ........TE...Sa.s4........r...3.............0..0...U....0.0l..U. .e0c0a..`.H...E....0R0&.. .........hXXp://VVV.symauth.com/cps0(.. .......0...hXXp://VVV.symauth.com/rpa0...U.%..0... .......0...U........0... .....0......0!..U....0...0.1.0...U....TGV-B-2730...*.H.............$..H......oU....Y!.z{*.V.M..u.._z..3>.. 0....3..m.....e.......a..D...........e..F6:.y.....di.......<y.Z.......x}..q.2....UZ1 :,t>....

<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAxNF3PJUX7iAOhAP2oGxcI= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1790

content-transfer-encoding: binary

Cache-Control: max-age=364386, public, no-transform, must-revalidate

Last-Modified: Sat, 16 May 2015 14:50:04 GMT

Expires: Sat, 23 May 2015 14:50:04 GMT

Date: Tue, 19 May 2015 09:41:46 GMT

Connection: keep-alive

0..........0..... .....0......0...0......'.V.8.F.V....H....JW..20150516145004Z0s0q0I0... ..........!7h....O.d...AG&h.....k.&p..?...-.5........M.s.Q~...@?j.......20150516145004Z....20150523145004Z0...*.H.................T.....j....../.....i....A.......\.<2.Lg.....kBq......\..."}.HO6..%M..k....g.#..U......I..T"...~..%s.&).i...._.!.K.0W....n....V..&.....m.G.......l|....p...l7.`..0............n......-4X..K..^.uN....U.X.:3...e..H-..K..Y9.Q.)p]......H='jn............n.).l....#0...0...0..........r..?.*......y"..0...*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use at https://VVV.verisign.com/rpa (c)09100...U...'VeriSign Class 3 Code Signing 2009-2 CA0...150226000000Z..150527235959Z0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use at hXXps://VVV.verisign.com/rpa (c)091<0:..U...3VeriSign Class 3 Code Signing 2009-2 OCSP Responder0.."0...*.H.............0.............m5*R........2....>...yU4..L.. ...........u..Hez..Pn.....d...nz(...V7.}^...d!RX...bl..[..a...L.. .~..Ij......%..%p.-...u..:..i..F*]...*....{NH..|0...gHX.Q.r....S..........._.9.(w...suC...N..s.....&."...:.C.Q.i~rl..<..krS..8.B..o].y..L.4...iB@..s.....mw.........0...0...U....0.0....U. ...0..0....`.H...E....0..0(.. .........hXXps://VVV.verisign.com/CPS0b.. .......0V0...VeriSign, Inc.0.....=VeriSign's CPS incorp. by reference liab. ltd. (c)97 VeriSign0...U.%..0... .......0...U........0... .....0......0"..U....0...0.1.0...U....TGV-B-32010...*.H...

<<< skipped >>>

HEAD /dl/toolbar/t7/data/7.5.6227.252/googletoolbarinstaller_en_signed.exe HTTP/1.1

Connection: Keep-Alive

Accept: */*

Accept-Encoding: identity

User-Agent: Microsoft BITS/7.5

X-Old-UID: cnt=0

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

Host: dl.google.com

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Length: 5059928

Content-Type: application/x-msdos-program

Etag: "506e4"

Expires: Wed, 20 May 2015 02:38:03 PDT

Last-Modified: Fri, 27 Feb 2015 23:15:00 GMT

Server: downloads

X-Content-Type-Options: nosniff

X-Frame-Options: SAMEORIGIN

X-Xss-Protection: 1; mode=block

Date: Tue, 19 May 2015 09:38:03 GMT

Alternate-Protocol: 80:quic,p=1

....

GET /dl/toolbar/t7/data/7.5.6227.252/googletoolbarinstaller_en_signed.exe HTTP/1.1

Connection: Keep-Alive

Accept: */*

Accept-Encoding: identity

If-Unmodified-Since: Fri, 27 Feb 2015 23:15:00 GMT

User-Agent: Microsoft BITS/7.5

X-Old-UID: cnt=0

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

Host: dl.google.com

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Length: 5059928

Content-Type: application/x-msdos-program

Etag: "506e4"

Expires: Wed, 20 May 2015 02:38:03 PDT

Last-Modified: Fri, 27 Feb 2015 23:15:00 GMT

Server: downloads

X-Content-Type-Options: nosniff

X-Frame-Options: SAMEORIGIN

X-Xss-Protection: 1; mode=block

Date: Tue, 19 May 2015 09:38:03 GMT

Alternate-Protocol: 80:quic,p=1

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........R.&.3eu.3eu.3eu...u.3eu...u:3eu...u.3eu.3du.2eu...u.3eu...u.3eu.3eu.3eu...u.3euRich.3eu........................PE..L...r..T.................z...8......9u............@..........................P........M...@.................................| ..H....p................M.X....@.......................................................................................text....`.......FL.....PEC2*O......`....rsrc........p.......JL............. ....reloc.......@........M.............@...................................................................................................................................................................................................................................................................................................................................................................................................................................7...l....7........{...@.k.i..Y.. ....O}...X..Q>!L........f.l.Hs..s...5.*.O..{0=L...L..j2}.\b.....s?P.........n......}M...^.......7..........5..).SF.f6..:.#.0...@|y.a-h......5>b......Jb6......u?l.q..Iu..fI$M.ex..A..5.3.)......k..u..~....y...U:..[.B..cHD.X...Yn...c............@..........2.F....q.."%.'..E.........).t.............{%...m.n............y.}.s.......a(...".....9.f...#."..l/....M..aA.3M.....B.k'.......]..z..w.8.B..2..S.z..l_....7=..3I[.l(.V.I.......!.K."c...`..5.7......w. .........3A...`.~.....

<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEFIA5aolVvwahu2WydRLM8c= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1762

content-transfer-encoding: binary

Cache-Control: max-age=364533, public, no-transform, must-revalidate

Last-Modified: Sat, 16 May 2015 14:50:06 GMT

Expires: Sat, 23 May 2015 14:50:06 GMT

Date: Tue, 19 May 2015 09:38:16 GMT

Connection: keep-alive

0..........0..... .....0......0...0......;O}a.!..u...au..eUNp..20150516145006Z0s0q0I0... ...................B.>.I.$&.....e......0..C9...313..R...%V.......K3.....20150516145006Z....20150523145006Z0...*.H......................v q....?.J.........o.....Q_.?6....t:....2..g.....7.=./...a...cr*N*.mE...R(6N...W......`FS.M..Z.Du.....Zr........(>......W.N...Aa..;..Xe=.`h....!D..............:dx......[...........D#".....2..&...`.]n.!.`.]......=Q.........w....L.Fl.?....(5=...j.Y.....0...0...0...........2...'U.BM...g.B0...*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1:08..U...1(c) 2006 VeriSign, Inc. - For authorized use only1E0C..U...<VeriSign Class 3 Public Primary Certification Authority - G50...141202000000Z..151216235959Z0..1.0...U....US1.0...U....Symantec Corporation1.0...U....Symantec Trust Network1?0=..U...6Symantec Class 3 PCA - G5 OCSP Responder Certificate 30.."0...*.H.............0...............2&..PL...,..2....:..tH...`JG.%..*...s.c%...?t..J..0.q....~..k@X.l.i....0..kk..h.9"1.5?..s.....3[...u......]...R0..Z}....l..I.Y.....j\H.q...#.uw.4qz.#.J.....@2$"..$l.B.......D.ye..(..2.........@...... ...."... E..0M,..b{.^..s'....f.6.pr4.J........'j..........0...0...U.......0.0l..U. .e0c0a..`.H...E....0R0&.. .........hXXp://VVV.symauth.com/cps0(.. .......0...hXXp://VVV.symauth.com/rpa0...U.%..0... .......0...U...........0... .....0......0!..U....0...0.1.0...U....TGV-B-2760...U......;O}a.!..u...au..eUNp0...U.#..0.....e......0..C9...3130...*.H.............(.&..Dgr.Ve..#...5.N.

<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTSqZMG5M8TA9rdzkbCnNwuMAd5VgQUz5mp6nsm9EvJjo/X8AUm7+PSp50CECkSxwyaK4o+9vYHRmLWi40= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1725

content-transfer-encoding: binary

Cache-Control: max-age=469128, public, no-transform, must-revalidate

Last-Modified: Sun, 17 May 2015 19:55:28 GMT

Expires: Sun, 24 May 2015 19:55:28 GMT

Date: Tue, 19 May 2015 09:38:21 GMT

Connection: keep-alive

0..........0..... .....0......0...0......N$p...v....1.;..vn....20150517195528Z0s0q0I0... ...................F....0.yV......{&.K......&.......).... .>...Fb.......20150517195528Z....20150524195528Z0...*.H.............V!.HE...\.bq..y.@....2i}..`G\...T.{.'..NQ<1....-.-x.}It....0.....G.. .(Q.....I.?.....a.....f..?..\...o._M..@..0..7.`m..>./..!.Y...6..7v...QI9.k............]..4|.*..}G.....1._> ...H[...H..H...N..s)W.{zt.c..2..wR.1W.R.o.>M;.y..pK.h.-9;W.......~..........{.......0...0...0............F...I]A(M..s@.0...*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use at hXXps://VVV.verisign.com/rpa (c)101.0,..U...%VeriSign Class 3 Code Signing 2010 CA0...150225000000Z..150526235959Z0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1:08..U...1VeriSign Class 3 Code Signing 2010 OCSP Responder0.."0...*.H.............0.........q<...A...#......A...u..Lz.............o..D.vQ%..s.......f....e../jI.d.W.....|K;.j5...#.B%.]..~S.... .|;S.&.....N..`...5.....!D.p....M/.. ..;j...q..`6...2.Ck..BnLHvCZn%....,.w.Ooi..z'...\.Yx......b..L...5.o..o..{..}.........%e.....N..._i........*Bc....:yQg.........0...0...U....0.0....U. ...0..0....`.H...E....0..0(.. .........hXXps://VVV.verisign.com/CPS0b.. .......0V0...VeriSign, Inc.0.....=VeriSign's CPS incorp. by reference liab. ltd. (c)97 VeriSign0...U.%..0... .......0...U........0... .....0......0"..U....0...0.1.0...U....TGV-B-31830...*.H..............-..^.........f.P`...s.....8.....V.......... ....

<<< skipped >>>

GET /tools/pso/ping?as=tbin&gu=pi&mode=3&sin=1&ein=0&version=7.5.6227.252&brand=NCHD&hl=en&tbiv=7.5.6227.252&time=1432028303&fitime=1432028303&browser=9.10.9200.16521&osver=6.1&ossp=1.0&osarch=64&ext=EXE&id=6BA3A3DD8C86609F54CC8AB84959F665663D1aFIBM HTTP/1.1

User-Agent: Google Toolbar installer

Host: clients1.google.com

HTTP/1.1 200 OK

Content-Type: text/html; charset=utf-8

Content-Length: 2

Date: Tue, 19 May 2015 09:38:23 GMT

Expires: Tue, 19 May 2015 09:38:23 GMT

Cache-Control: private, max-age=0

X-Content-Type-Options: nosniff

X-Frame-Options: SAMEORIGIN

X-XSS-Protection: 1; mode=block

Server: GSE

Alternate-Protocol: 80:quic,p=1

ok..

GET /versions/components/tb_google_row.dat HTTP/1.0

Host: VVV.audiochannel.net

HTTP/1.1 404 Not Found

Date: Tue, 19 May 2015 09:37:54 GMT

Server: Apache

Content-Length: 236

Connection: close

Content-Type: text/html; charset=iso-8859-1

<html><head><title>Error 404 - Not Found</title><head><body><h1>Error 404 - Not Found</h1><p>The document you are looking for may have been removed or re-named. Please contact the web site owner for further assistance.</p></body></html>..

GET /tools/pso/ping?as=tbin&gu=pi&mode=3&sin=2&ein=0&version=7.5.6227.252&brand=NCHD&hl=en&tbiv=7.5.6227.252&time=1432028309&fitime=1432028303&verold=7.5.6227.252&brandold=NCHD&browser=9.10.9200.16521&osver=6.1&ossp=1.0&osarch=64&ext=EXE&id=6BA3A3DD8C86609F54CC8AB84959F665663D1aFIBM HTTP/1.1

User-Agent: Google Toolbar installer

Host: clients1.google.com

HTTP/1.1 200 OK

Content-Type: text/html; charset=utf-8

Content-Length: 2

Date: Tue, 19 May 2015 09:38:29 GMT

Expires: Tue, 19 May 2015 09:38:29 GMT

Cache-Control: private, max-age=0

X-Content-Type-Options: nosniff

X-Frame-Options: SAMEORIGIN

X-XSS-Protection: 1; mode=block

Server: GSE

Alternate-Protocol: 80:quic,p=1

ok..

GET /pki/crl/products/WinPCA.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.microsoft.com

HTTP/1.1 200 OK

Content-Type: application/pkix-crl

Last-Modified: Sat, 07 Mar 2015 06:01:44 GMT

Accept-Ranges: bytes

ETag: "dde36a309c58d01:0"

Server: Microsoft-IIS/8.0

VTag: 43879645100000000

P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"

X-Powered-By: ASP.NET

Content-Length: 561

Cache-Control: max-age=900

Date: Tue, 19 May 2015 09:41:12 GMT

Connection: keep-alive

0..-0......0...*.H........0..1.0...U....US1.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corporation1 0)..U..."Microsoft Windows Verification PCA..150306223202Z..150605105201Z._0]0...U.#..0.......p............<.J0... .....7.......0...U......40... .....7......150604224201Z0...*.H.............4......n[.t........'....Dx.P3R.!3.|D.6vL.."k..9'....L..k......e.4......._..N..TJ......N.fP...H.....8...TJA...fGA.e...^"{../...H?..E.Y.U....h..0/.......d...6..K..V?QM...{..h.....{.3...v.....\~.7n..5..'..k.Ia.YL..LP.b....._7.V..%......z*$q..Y..f.b..L8<~..v.w....

GET /pki/crl/products/MicrosoftTimeStampPCA.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.microsoft.com

HTTP/1.1 200 OK

Content-Type: application/pkix-crl

Last-Modified: Thu, 05 Mar 2015 06:01:35 GMT

Accept-Ranges: bytes

ETag: "cf2633d6957d01:0"

Server: Microsoft-IIS/8.5

VTag: 79131127200000000

P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"

X-Powered-By: ASP.NET

Content-Length: 550

Cache-Control: max-age=900

Date: Tue, 19 May 2015 09:41:12 GMT

Connection: keep-alive

0.."0......0...*.H........0w1.0...U....US1.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corporation1!0...U....Microsoft Time-Stamp PCA..150304221607Z..150603103607Z._0]0...U.#..0...#4..RFp..@.v.. ..5..0... .....7.......0...U......20... .....7......150602222607Z0...*.H.............Y..}y`....T.Z..`B<..I.N..O... E:....7......a..).........._|W5laoqi(..>t~.."...&`.._.7J...:..{bO_Kyi...R...!...B.s..I.c&j...(I\.S{._;@B...[i.e.[."...R` \...........M^k.=q[.V...9y..G.1o#k3<.W.......H.$>}...U...2qyd2|b.fB.....r....H.P...;....Q...b......5%.P.#..

Map

The PUP connects to the servers at the folowing location(s):

Strings from Dumps

scribe.exe_1836:

.rdata

.rdata

@.data

@.data

.rsrc

.rsrc

mscoree.dll

mscoree.dll

Please contact the application's support team for more information.

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- CRT not initialized

- floating point support not loaded

- floating point support not loaded

.mixcrt

.mixcrt

KERNEL32.DLL

KERNEL32.DLL

GetProcessWindowStation

GetProcessWindowStation

USER32.DLL

USER32.DLL

operator

operator

CWD %s

CWD %s

DELE %s

DELE %s

RNFR %s

RNFR %s

RNTO %s

RNTO %s

UxTheme.dll

UxTheme.dll

dwmapi.dll

dwmapi.dll

software=Scribe&version=5.69&report=UINSTALL&text=%s-%s&language=en&platform=Win&extra1=%d%s

software=Scribe&version=5.69&report=UINSTALL&text=%s-%s&language=en&platform=Win&extra1=%d%s

hXXp://%s/components/%s

hXXp://%s/components/%s

user32.dll

user32.dll

hXXp://VVV.audiochannel.net/versions/components/%s.txt

hXXp://VVV.audiochannel.net/versions/components/%s.txt

%s%d%d%d

%s%d%d%d

kernel32.dll

kernel32.dll

hXXp://cgi.nch.com.au/cgi-bin/regcheck.exe?cmd=v&id=%d&magic=%d&magicb=%d

hXXp://cgi.nch.com.au/cgi-bin/regcheck.exe?cmd=v&id=%d&magic=%d&magicb=%d

tb_%s_us.dat

tb_%s_us.dat

tb_%s_uk.dat

tb_%s_uk.dat

tb_%s_row.dat

tb_%s_row.dat

hXXp://VVV.audiochannel.net/versions/components/%s

hXXp://VVV.audiochannel.net/versions/components/%s

hXXp://VVV.audiochannel.net/components/toolbars/NCH_Chrome.exe

hXXp://VVV.audiochannel.net/components/toolbars/NCH_Chrome.exe

hXXp://VVV.audiochannel.net/components/toolbars/NCH_GoogleToolbar.exe

hXXp://VVV.audiochannel.net/components/toolbars/NCH_GoogleToolbar.exe

hXXp://VVV.audiochannel.net/versions/scribe.txt

hXXp://VVV.audiochannel.net/versions/scribe.txt

comctl32.dll

comctl32.dll

TaskDialogIndirect

TaskDialogIndirect

software=Scribe&version=5.69&report=COMMENT&text=COMMENT-%s&language=en&platform=Win

software=Scribe&version=5.69&report=COMMENT&text=COMMENT-%s&language=en&platform=Win

%s%s%s

%s%s%s

MAPI32.DLL

MAPI32.DLL

SMTP:%s

SMTP:%s

%s, %.2d %s 20%.2d %.2d:%.2d:%.2d %s%.2d%.2d

%s, %.2d %s 20%.2d %.2d:%.2d:%.2d %s%.2d%.2d

From: %s

From: %s

To: %s

To: %s

Subject: %s

Subject: %s

Date: %s

Date: %s

X-Mailer: Scribe VVV.nch.com.au/software

X-Mailer: Scribe VVV.nch.com.au/software

gc0p4Jq0M2Yt08jU534c%d

gc0p4Jq0M2Yt08jU534c%d

Content-Type: multipart/mixed; boundary=%s

Content-Type: multipart/mixed; boundary=%s

Content-Type: %s; name="%s"

Content-Type: %s; name="%s"

Content-Disposition: attachment; filename="%s"

Content-Disposition: attachment; filename="%s"

--%s--

--%s--

AUTH LOGIN

AUTH LOGIN

MKD %s

MKD %s

RMD %s

RMD %s

USER %s

USER %s

PASS %s

PASS %s

RETR %s

RETR %s

%s %s

%s %s

STOR %s

STOR %s

MFMT dddddd %s

MFMT dddddd %s

MDTM %s

MDTM %s

MLST %s

MLST %s

MLSD %s

MLSD %s

Windows_NT

Windows_NT

LIST %s

LIST %s

LIST %s*

LIST %s*

SIZE %s

SIZE %s

folder %s

folder %s

http=

http=

%s/%s

%s/%s

POST %s HTTP/1.0

POST %s HTTP/1.0

Host: %s

Host: %s

Content-Type: application/x-www-form-urlencoded

Content-Type: application/x-www-form-urlencoded

Content-Length: %d

Content-Length: %d

HTTP/1.

HTTP/1.

google.com

google.com

yahoo.com

yahoo.com

C:\SourceCode\llib\include\../net/ssl.cpp

C:\SourceCode\llib\include\../net/ssl.cpp

GET %s HTTP/1.0

GET %s HTTP/1.0

CONNECT %s:%d HTTP/1.0

CONNECT %s:%d HTTP/1.0

GET %s%s%s HTTP/1.0

GET %s%s%s HTTP/1.0

User-Agent: %s

User-Agent: %s

webm

webm

%d %d

%d %d

?#%X.y

?#%X.y

PeekNamedPipe

PeekNamedPipe

GetProcessHeap

GetProcessHeap

CreatePipe

CreatePipe

KERNEL32.dll

KERNEL32.dll

RegCloseKey

RegCloseKey

RegOpenKeyExW

RegOpenKeyExW

RegEnumKeyW

RegEnumKeyW

RegDeleteKeyW

RegDeleteKeyW

RegOpenKeyW

RegOpenKeyW

RegQueryInfoKeyW

RegQueryInfoKeyW

RegCreateKeyExW

RegCreateKeyExW

CryptDeriveKey

CryptDeriveKey

RegSetKeySecurity

RegSetKeySecurity

RegEnumKeyExW

RegEnumKeyExW

ADVAPI32.dll

ADVAPI32.dll

COMCTL32.dll

COMCTL32.dll

comdlg32.dll

comdlg32.dll

SetViewportExtEx

SetViewportExtEx

GetViewportExtEx

GetViewportExtEx

GDI32.dll

GDI32.dll

acmDriverClose

acmDriverClose

acmDriverEnum

acmDriverEnum

acmDriverOpen

acmDriverOpen

acmDriverDetailsW

acmDriverDetailsW

MSACM32.dll

MSACM32.dll

ole32.dll

ole32.dll

OLEAUT32.dll

OLEAUT32.dll

ShellExecuteW

ShellExecuteW

ShellExecuteExW

ShellExecuteExW

SHELL32.dll

SHELL32.dll

SHDeleteKeyW

SHDeleteKeyW

SHDeleteEmptyKeyW

SHDeleteEmptyKeyW

SHLWAPI.dll

SHLWAPI.dll

GetKeyState

GetKeyState

GetAsyncKeyState

GetAsyncKeyState

MsgWaitForMultipleObjects

MsgWaitForMultipleObjects

CreateDialogIndirectParamW

CreateDialogIndirectParamW

UnregisterHotKey

UnregisterHotKey

SetWindowsHookExW

SetWindowsHookExW

GetKeyNameTextW

GetKeyNameTextW

MapVirtualKeyW

MapVirtualKeyW

RegisterHotKey

RegisterHotKey

UnhookWindowsHookEx

UnhookWindowsHookEx

USER32.dll

USER32.dll

WINMM.dll

WINMM.dll

WS2_32.dll

WS2_32.dll

NETAPI32.dll

NETAPI32.dll

MSIMG32.dll

MSIMG32.dll

iphlpapi.dll

iphlpapi.dll

WININET.dll

WININET.dll

DNSAPI.dll

DNSAPI.dll

GdiplusShutdown

GdiplusShutdown

gdiplus.dll

gdiplus.dll

GetCPInfo

GetCPInfo

GetConsoleOutputCP

GetConsoleOutputCP

zcÁ

zcÁ

SSShB

SSShB

SSSSSSShl

SSSSSSShl

SSSSSSShx5@

SSSSSSShx5@

u.SSW

u.SSW

z

z

PVVj.Vf

PVVj.Vf

D$`PWWj.Wf

D$`PWWj.Wf

PSShD

PSShD

PSSSSSSh

PSSSSSSh

SSShlcB

SSShlcB

SShx5@

SShx5@

}rSSh7

}rSSh7

ttSSh

ttSSh

C%uuQ

C%uuQ

!t.Ht

!t.Ht

Ht.Ht

Ht.Ht

PWSSh0

PWSSh0

.snduG

.snduG

t8Ht.Ht$Ht

t8Ht.Ht$Ht

PVSShl`C

PVSShl`C

%Program Files% (x86)\NCH Software\Scribe\scribe.exe

%Program Files% (x86)\NCH Software\Scribe\scribe.exe

ssshhhWWW

ssshhhWWW

-!.WF

-!.WF

2%SGE

2%SGE

(%xSK

(%xSK

=#"$%$&%$&%$&%$&%$"$/.0

=#"$%$&%$&%$&%$&%$"$/.0

3333333

3333333

33333333

33333333

"((("&&!

"((("&&!

"((("&&&

"((("&&&

"((("'''

"((("'''

3% !5&!%

3% !5&!%

5&!%3% !

5&!%3% !

D3.DD3.

D3.DD3.

.HKLJ

.HKLJ

SHD.SHD

SHD.SHD

44444444444

44444444444

4444444

4444444

4444444444

4444444444

44444444

44444444

444444444

444444444

mhXXp://ns.adobe.com/xap/1.0/

mhXXp://ns.adobe.com/xap/1.0/

" id="W5M0MpCehiHzreSzNTczkc9d"?>

" id="W5M0MpCehiHzreSzNTczkc9d"?>

Attachments of "%s"

Attachments of "%s"

%s file already exists. Do you want to replace it?

%s file already exists. Do you want to replace it?

%s\%s

%s\%s

Password

Password

.webm

.webm

"%s" "%s"

"%s" "%s"

%s -w %s

%s -w %s

"%s" "%s" "%s"

"%s" "%s" "%s"

Cannot open the file "%s" because it is corrupt.

Cannot open the file "%s" because it is corrupt.

Cannot open the file "%s". Check it exists and you have read access.

Cannot open the file "%s". Check it exists and you have read access.

Cannot open the file "%s". It is possible the file format is not supported by this program. Please see "hXXp://VVV.nch.com.au/acm/formats.html" for more information.

Cannot open the file "%s". It is possible the file format is not supported by this program. Please see "hXXp://VVV.nch.com.au/acm/formats.html" for more information.

Cannot open the file "%s" because the required codec ("%s") is not installed. See "hXXp://nch.com.au/acm/index.html" for more information.

Cannot open the file "%s" because the required codec ("%s") is not installed. See "hXXp://nch.com.au/acm/index.html" for more information.

Cannot open the file "%s" because it is using an unknown codec or is possibly not a real wave file.

Cannot open the file "%s" because it is using an unknown codec or is possibly not a real wave file.

Cannot open the file "%s". It is possibly either corrupt or not a true layer-3 MPEG file.

Cannot open the file "%s". It is possibly either corrupt or not a true layer-3 MPEG file.

Visit "hXXp://VVV.microsoft.com/directx" to obtain the latest version.

Visit "hXXp://VVV.microsoft.com/directx" to obtain the latest version.

.flac

.flac

The decoder process failed when decompressing the file "%s" to wave format. It is possible your logon account does not have write access to the folder "%s"

The decoder process failed when decompressing the file "%s" to wave format. It is possible your logon account does not have write access to the folder "%s"

Cannot open file "%s". It is possible that the file is protected with Digital Rights Management (DRM) which limits where the audio file can be used.

Cannot open file "%s". It is possible that the file is protected with Digital Rights Management (DRM) which limits where the audio file can be used.

Cannot open the file "%s". It is possible you do not have the Sony plugin installed or your recorder is not supported. If you do not have the plugin please download it from "hXXp://VVV.nch.com.au/scribe/sony.html".

Cannot open the file "%s". It is possible you do not have the Sony plugin installed or your recorder is not supported. If you do not have the plugin please download it from "hXXp://VVV.nch.com.au/scribe/sony.html".

key%u

key%u

Unable to load an encrypted recording because the decryption key has not been set. Please enter the decryption key and try to load the dictation again.

Unable to load an encrypted recording because the decryption key has not been set. Please enter the decryption key and try to load the dictation again.

The notes for this dictation are too long to display in the notes window. They have been moved to an attachment called "%s".

The notes for this dictation are too long to display in the notes window. They have been moved to an attachment called "%s".

_%d.owf

_%d.owf

Saving: %s

Saving: %s

Unable to open dct or wav file because audio compression codec is not installed on this computer or file is corrupt. If the problem persists see VVV.nch.com.au/acm for more information about codecs. You might need to install further Audio Compression Manager codecs from your Windows CD-ROM. If it is a wav file, try to open it with Windows Media Player to auto-install codecs.

Unable to open dct or wav file because audio compression codec is not installed on this computer or file is corrupt. If the problem persists see VVV.nch.com.au/acm for more information about codecs. You might need to install further Audio Compression Manager codecs from your Windows CD-ROM. If it is a wav file, try to open it with Windows Media Player to auto-install codecs.

Attempt to delete the file "%s" failed. It is possible that the folder is read only or your do not have delete access rights on the folder.

Attempt to delete the file "%s" failed. It is possible that the folder is read only or your do not have delete access rights on the folder.

Component download or installation failed. (%s)

Component download or installation failed. (%s)

The %s format is not supported by Express Scribe.

The %s format is not supported by Express Scribe.

_%s_%s

_%s_%s

*._%s_%s

*._%s_%s

Checking for files to load from FTP...

Checking for files to load from FTP...

Cannot log onto the FTP server "%s". The server may be having problems. Otherwise please check you have entered the server name and any required user and password correctly.

Cannot log onto the FTP server "%s". The server may be having problems. Otherwise please check you have entered the server name and any required user and password correctly.

Cannot find the directory "%s" on the FTP server.

Cannot find the directory "%s" on the FTP server.

Incoming%d

Incoming%d

FTPSecure

FTPSecure

FTPServer

FTPServer

.aiff

.aiff

.aifc

.aifc

Temp%d.wav

Temp%d.wav

.dart

.dart

.mpdp

.mpdp

shell32.dll

shell32.dll

%sAscend

%sAscend

Bookmarks of "%s"

Bookmarks of "%s"

Track %d

Track %d

CD%.2dTrack%.2d_Dur%s.cda

CD%.2dTrack%.2d_Dur%s.cda

.orig

.orig

.dvr-ms

.dvr-ms

bookmark%d

bookmark%d

bookmarkÃœreatedate

bookmarkÃœreatedate

bookmarkÝata

bookmarkÝata

%.8u.dat

%.8u.dat

%s:%s:%s.000

%s:%s:%s.000

*.dat

*.dat

Video playback requires %s

Video playback requires %s

UseSMTPHost

UseSMTPHost

MailSMTPHost

MailSMTPHost

SMTPAuthOn

SMTPAuthOn

SMTPUserName

SMTPUserName

SMTPPassword

SMTPPassword

Dictation (%s)

Dictation (%s)

Transcript.txt

Transcript.txt

F%sChannel

F%sChannel

control.exe mmsys.cpl,,1

control.exe mmsys.cpl,,1

sndvol32.exe /rec

sndvol32.exe /rec

Dock %u

Dock %u

Please connect your portable recorder to your computer and press the play button on your portable recorder.

Please connect your portable recorder to your computer and press the play button on your portable recorder.

FtpServer

FtpServer

FtpUserName

FtpUserName

FtpPassword

FtpPassword

FtpDirectory

FtpDirectory

dctfwd%sender-num%-%dict-num%-%dict-name%

dctfwd%sender-num%-%dict-num%-%dict-name%

FTP Server Details Required.

FTP Server Details Required.

Please enter the FTP server name, user name, password and directory.

Please enter the FTP server name, user name, password and directory.

Hotkey

Hotkey

FTPAnonymous

FTPAnonymous

hXXps://secure.nch.com.au/cgi-bin/register.exe?software=scribe

hXXps://secure.nch.com.au/cgi-bin/register.exe?software=scribe

Time must be between %s and %s.

Time must be between %s and %s.

%sColumn

%sColumn

%sText

%sText

VVV.nch.com.au/scribe/index.html

VVV.nch.com.au/scribe/index.html

VVV.nch.com.au/scribe/support.html

VVV.nch.com.au/scribe/support.html

hXXp://VVV.nch.com.au/suggestions/index.html?software=Scribe&version=5.69

hXXp://VVV.nch.com.au/suggestions/index.html?software=Scribe&version=5.69

hXXp://VVV.nch.com.au/software/bug.html?software=Scribe&version=5.69

hXXp://VVV.nch.com.au/software/bug.html?software=Scribe&version=5.69

Dock a recording from a portable recorder (using default method)

Dock a recording from a portable recorder (using default method)

System-Wide Hot-Keys...

System-Wide Hot-Keys...

Float Above Other Windows

Float Above Other Windows

High Pass Filter

High Pass Filter

Export Notes...

Export Notes...

Transfer from Portable (Dock)

Transfer from Portable (Dock)

scribe.exe

scribe.exe

%s - Licensed software

%s - Licensed software

%s - Licensed to %s

%s - Licensed to %s

%s (Unlicensed) Non-commercial home use only

%s (Unlicensed) Non-commercial home use only

WindowStandard

WindowStandard

%s Mini

%s Mini

%s v 5.69

%s v 5.69

Welcome.dat

Welcome.dat

List %d of %lu

List %d of %lu

This %s file is not supported by Express Scribe.

This %s file is not supported by Express Scribe.

*.dct

*.dct

%s.dct

%s.dct

A file with the name '%s' already exists.

A file with the name '%s' already exists.

ExportNotesFolder

ExportNotesFolder

notes.txt

notes.txt

Export Notes

Export Notes

Error exporting notes.

Error exporting notes.

The wordprocessor base file %s does not exist.

The wordprocessor base file %s does not exist.

%s: %s

%s: %s

highpass

highpass

Disable system-wide hot-keys

Disable system-wide hot-keys

Enable system-wide hot-keys

Enable system-wide hot-keys

"%s" has sent a dictation cancel and recover notice for the file "%s". Do you want to delete this file from the list?

"%s" has sent a dictation cancel and recover notice for the file "%s". Do you want to delete this file from the list?

%s File Format

%s File Format

Speed (%d%%)

Speed (%d%%)

Playback Speed (%d%%)

Playback Speed (%d%%)

The file '%s' that Express Scribe is attempting to load is encrypted. A decryption key has not been set so it cannot load the file. Would you like to set one now?

The file '%s' that Express Scribe is attempting to load is encrypted. A decryption key has not been set so it cannot load the file. Would you like to set one now?

Set Key

Set Key

Decryption Key Not Set

Decryption Key Not Set

The space on the hard drive is running low. Currently only %dMB is free. Please free space by deleting unused files.

The space on the hard drive is running low. Currently only %dMB is free. Please free space by deleting unused files.

@ (%s)

@ (%s)

%d of %d Loaded

%d of %d Loaded

Encryption key not set for this Dictation

Encryption key not set for this Dictation

File: %s

File: %s

From: %s

From: %s

Email: %s

Email: %s

You must have Express Scribe installed to open the file. Express Scribe can be downloaded free at VVV.nch.com.au/scribe.

You must have Express Scribe installed to open the file. Express Scribe can be downloaded free at VVV.nch.com.au/scribe.

Forwarded to %s

Forwarded to %s

Unable to copy the file "%s" into the send folder "%s".

Unable to copy the file "%s" into the send folder "%s".

Unable to logon to ftp server "%s" with user name "%s" and the entered password.

Unable to logon to ftp server "%s" with user name "%s" and the entered password.

FTP upload failed because the directory "%s" was not found on the server "%s".

FTP upload failed because the directory "%s" was not found on the server "%s".

FTP upload of file "%s" failed.

FTP upload of file "%s" failed.

Forwarded to %s/%s

Forwarded to %s/%s

=:d

=:d

%d:d

%d:d

=:d.d

=:d.d

%d:d.d

%d:d.d