Trojan.Generic.12555347_740c3e5838

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

citrio_41.0.2272.256_1.exe:3616
CatalinaUpdate.exe:1236
CatalinaUpdate.exe:1280
CatalinaUpdate.exe:208
CatalinaUpdate.exe:456
CatalinaUpdate.exe:1932
CatalinaUpdate.exe:2836
citrio.exe:3804
citrio.exe:3492
citrio.exe:3148
citrio.exe:3244
citrio.exe:224
citrio.exe:3368
citrio.exe:3472
citrio.exe:2484
citrio.exe:656
citrio.exe:1096
citrio.exe:3632
citrio.exe:3404
citrio.exe:3312
citrio.exe:3448
citrio.exe:3224
citrio.exe:3208
citrio.exe:3192
CatalinaCrashHandler.exe:2412
setup.exe:3676
%original file name%.exe:1736

The Trojan injects its code into the following process(es):

citrio.exe:3808
citrio.exe:2808
citrio.exe:3160
citrio.exe:3392
citrio.exe:1804
citrio.exe:476

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process citrio_41.0.2272.256_1.exe:3616 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\CR_E0220.tmp\CITRIO.PACKED.7Z (415199 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\CR_E0220.tmp\SETUP.EX_ (1724 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\CR_E0220.tmp\setup.exe (19923 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\CR_E0220.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\CR_E0220.tmp\CITRIO.PACKED.7Z (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\CR_E0220.tmp\SETUP.EX_ (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\CR_E0220.tmp\setup.exe (0 bytes)

The process CatalinaUpdate.exe:1236 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\Cab4.tmp (54 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar5.tmp (2712 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab8.tmp (48 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab6.tmp (54 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004 (408 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 (48 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 (408 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004 (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar7.tmp (2712 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar9.tmp (2712 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\Cab4.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar5.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab8.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab6.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar7.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar9.tmp (0 bytes)

The process CatalinaUpdate.exe:1280 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\Install\{2C93941F-2EE0-43BB-9129-D7C4EAAD6F62}\citrio_41.0.2272.256_1.exe (422134 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\Download\{92F8A219-E740-49D5-B785-B962AD819724}\41.0.2272.256\citrio_41.0.2272.256_1.exe (422134 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\Install (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{5723C22F-25BA-4E55-BE79-4D2B4905A9DB}-citrio_41.0.2272.256_1.exe (0 bytes)

The process CatalinaUpdate.exe:1932 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\CatalinaUpdateOnDemand.exe (58 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_hu.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_uk.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_no.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_th.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_fil.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_en.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_ja.dll (22 bytes)
%WinDir%\Tasks\CatalinaGroupUpdateTaskUserS-1-5-21-1844237615-1960408961-1801674531-1003Core.job (948 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_pl.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_fi.dll (26 bytes)
%WinDir%\Tasks\CatalinaGroupUpdateTaskUserS-1-5-21-1844237615-1960408961-1801674531-1003UA.job (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_pt-PT.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_en-GB.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_fr.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_et.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_sk.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_mr.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_bn.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_kn.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_es-419.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_sl.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_sw.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_iw.dll (23 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\CatalinaUpdateBroker.exe (58 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_ta.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_ko.dll (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_de.dll (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_hr.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_am.dll (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_pt-BR.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_sr.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_zh-CN.dll (19 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\CatalinaCrashHandler.exe (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_zh-TW.dll (19 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\CatalinaUpdate.exe (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_vi.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_cs.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_ar.dll (24 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_ca.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\npCatalinaUpdate3.dll (1281 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_nl.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\psmachine.dll (673 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_el.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_it.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_sv.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_lv.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_ur.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_te.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_is.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_ru.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\CatalinaUpdate.exe (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_ro.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_id.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\psuser.dll (673 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_fa.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_lt.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_tr.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_bg.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\CatalinaUpdateHelper.msi (36 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_ms.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdate.dll (5873 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_hi.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_es.dll (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_ml.dll (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_da.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_gu.dll (26 bytes)

The process citrio.exe:3808 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\NTUSER.DAT.LOG (4048 bytes)
%Documents and Settings%\%current user%\NTUSER.DAT (3764 bytes)

The process citrio.exe:3804 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libtheora_plugin.dll (22840 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\arrow-right.png (114 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libdts_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\lua\liblua_plugin.dll (20400 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libmkv_plugin.dll (66563 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libsubsusf_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\joox.luac (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libaes3_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\ScrollViewHelper.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\sse2\libi420_rgb_sse2_plugin.dll (8472 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_output\libmmdevice_plugin.dll (3656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libmpc_plugin.dll (5952 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libsepia_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libasf_plugin.dll (5224 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\StatusBarStyle.qml (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\GroupBox.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\MenuContentItem.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libpostproc_plugin.dll (7288 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_mixer\libfloat_mixer_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libdeinterlace_plugin.dll (10864 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\GammaAdjust.qml (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\TableView.qml (3656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\MenuClose.qml (588 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\meta_engine\libfolder_plugin.dll (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\rightanglearrow.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\ButtonStyle.qml (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libripple_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libadpcm_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libcc_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\SourceProxy.qml (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\SpinBox.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\BusyIndicator.qml (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\StackViewTransition.qml (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libdmo_plugin.dll (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\MenuScroll.qml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libvoc_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\services_discovery\libsap_plugin.dll (8472 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libwall_plugin.dll (3808 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\ToolbarLeft.qml (96 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_chroma\libyuy2_i422_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\OpacityMask.qml (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\scrollbar-handle-vertical.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\header.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\ToolButton.qml (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\packetizer\libpacketizer_flac_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\arrow-left.png (114 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libscene_plugin.dll (3656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\CalendarUtils.js (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\core\Hotkeys.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\SplashScreen.qml (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\qmldir (852 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libtimecode_plugin.dll (3656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libmono_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\check@2x.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\HueSaturation.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\TabView.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libdvdread_plugin.dll (11704 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\GroupBoxStyle.qml (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libaudio_format_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\tab.png (460 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libts_plugin.dll (9352 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libmagnify_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libscte27_plugin.dll (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libmosaic_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\packetizer\libpacketizer_vc1_plugin.dll (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libaraw_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libpva_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_filter\librecord_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libquicktime_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\ColumnMenuContent.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libgaussianblur_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\core\Functions.qml (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libspeex_plugin.dll (10216 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libatmo_plugin.dll (14776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\librotate_plugin.dll (4152 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libes_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libaiff_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\VolumeHeatScale.qml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\ProgressBar.qml (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\RadialGradient.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libshm_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\mux\libmux_avi_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_output\libafile_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\manifest.json (626 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\modules\dkjson.luac (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_out\libstream_out_duplicate_plugin.dll (3656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libremap_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libedummy_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_out\libstream_out_dummy_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_chroma\libi420_rgb_plugin.dll (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\ComboBoxStyle.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libaccess_bd_plugin.dll (7288 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\misc\libxml_plugin.dll (67908 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_out\libstream_out_standard_plugin.dll (3656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_filter\libhttplive_plugin.dll (34872 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\EditMenu_ios.qml (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\images\icon128.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libkate_plugin.dll (7784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\MenuStyle.qml (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\mux\libmux_wav_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\mux\libmux_asf_plugin.dll (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\liblive555_plugin.dll (45664 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\slider-handle.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libtta_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\EditMenu_base.qml (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\DirectionalBlur.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\MaskedBlur.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libheadphone_channel_mixer_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\sse2\libi422_yuy2_sse2_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\ApplicationWindowStyle.qml (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libcdda_plugin.dll (10864 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libaccess_realrtsp_plugin.dll (6984 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libau_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libmp4_plugin.dll (12376 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\scrollbar-handle-transient.png (249 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\vimeo.luac (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\katsomo.luac (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libnsc_plugin.dll (3808 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libgradfun_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libaccess_udp_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\librtp_plugin.dll (31256 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libdtv_plugin.dll (16664 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libdvbsub_plugin.dll (7784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\ToolbarTimeLength.qml (365 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\ContentItem.qml (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_out\libstream_out_description_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Layouts\plugins.qmltypes (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\spinner_large.png (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\StackView.qml (3656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\StatusBar.qml (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libposterize_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick.2\plugins.qmltypes (14960 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\ToolBar.qml (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\Desaturate.qml (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libty_plugin.dll (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\liblibmpeg2_plugin.dll (9496 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libball_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\DECODED_MESSAGE_CATALOGS (24 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\scrollbar-handle-horizontal.png (939 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\StackViewDelegate.qml (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\jamendo.luac (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_out\libstream_out_langfromtelx_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\BigPlayIcon.qml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\TableViewColumn.qml (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\youtube_homepage.luac (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\appletrailers.luac (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libaccess_tcp_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libcdg_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libmotiondetect_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\ZoomBlur.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\librawdv_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\liba52_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\main.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\metachannels.luac (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libchain_plugin.dll (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\modules\simplexml.luac (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libdshow_plugin.dll (18240 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\TitleBar.qml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libvc1_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\HoverButton.qml (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\TextAreaStyle.qml (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick.2\qmldir (111 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_output\libadummy_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\services_discovery\libmediadirs_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\ScrollViewStyle.qml (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libaccess_vdr_plugin.dll (5952 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_output\libvmem_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\ToolbarButton.qml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libg711_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\ToolbarBackground.qml (256 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\SwitchStyle.qml (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libmpeg_audio_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\liveleak.luac (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_chroma\librv32_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_output\libyuv_plugin.dll (3656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\mux\libmux_dummy_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\RadioButtonStyle.qml (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_chroma\libyuy2_i420_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libzvbi_plugin.dll (83471 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libcrystalhd_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\fonts\secondary.ttf (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\cue.luac (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\core\Buttons.qml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\meta_engine\libtaglib_plugin.dll (81329 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\liblpcm_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libsamplerate_plugin.dll (80307 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\arrow-right@2x.png (148 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\RadialBlur.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\ModalPopupBehavior.qml (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\CustomButton.qml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\VideoLayer.qml (291 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\private\GaussianInnerShadow.qml (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\EditMenu.qml (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_output\libwaveout_plugin.dll (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libps_plugin.dll (3656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\qmldir (134 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\MediaPlayer.html (634 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\misc\libaudioscrobbler_plugin.dll (3808 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\packetizer\libpacketizer_mpeg4video_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\slider-groove.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\mmx\libi420_yuy2_mmx_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\packetizer\libpacketizer_h264_plugin.dll (5224 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\COPYING.txt (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_out\libstream_out_autodel_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libdtstospdif_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libx264_plugin.dll (66979 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libugly_resampler_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_output\libdirect3d_plugin.dll (5224 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\check.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\librawvideo_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\spinner_medium.png (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\liberase_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\services_discovery\libwindrive_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libequalizer_plugin.dll (3808 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\anevia_streams.luac (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\arrow-left@2x.png (139 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\ToolMenuButton.qml (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libdxva2_plugin.dll (5224 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libtrivial_channel_mixer_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\CalendarStyle.qml (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libsid_plugin.dll (60000 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\ColorOverlay.qml (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\Style.qml (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_out\libstream_out_record_plugin.dll (3808 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libgain_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\private\GaussianMaskedBlur.qml (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\liba52tofloat32_plugin.dll (4152 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libadjust_plugin.dll (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libspatializer_plugin.dll (8472 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\d3dcompiler_43.dll (130008 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\dailymotion.luac (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\Toolbar.qml (517 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\TextInputWithHandles.qml (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\MenuBar.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\leftanglearrow.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\ToolBarStyle.qml (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libwav_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\packetizer\libpacketizer_dirac_plugin.dll (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_output\libcaca_plugin.dll (48104 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\FastGlow.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\arrow-up@2x.png (229 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_output\libdrawable_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\misc\liblogger_plugin.dll (3656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\ssleay32.dll (20400 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\StackView.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_output\libdirect2d_plugin.dll (3808 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\DECODED_IMAGES (1642 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\pinkbike.luac (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libvcd_plugin.dll (6872 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\SubtitleMenuItems.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\Displace.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libidummy_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\RecursiveBlur.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libopus_plugin.dll (11736 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libblend_plugin.dll (12376 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\packetizer\libpacketizer_mpegvideo_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\TabViewStyle.qml (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\spinner_small.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\msvcr90.dll (41752 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_out\libstream_out_mosaic_bridge_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_out\libstream_out_raop_plugin.dll (32816 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\ProgressBarStyle.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libblendbench_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\ToolbarBorder.qml (96 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\css\styles.css (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libaudiobargraph_v_plugin.dll (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_chroma\libgrey_yuv_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\LevelAdjust.qml (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libkaraoke_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\mmx\libi422_yuy2_mmx_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libstereo_widen_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\TabBar.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\fonts\default.ttf (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\private\GaussianDirectionalBlur.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\liblibass_plugin.dll (74023 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libhqdn3d_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\liblogo_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\GaussianBlur.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libaccess_attachment_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_out\libstream_out_display_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libyuvp_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\FastBlur.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_output\libvdummy_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libmjpeg_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libmpgv_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libdemuxdump_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\MouseSurface.qml (346 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_out\libstream_out_rtp_plugin.dll (37152 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\anevia_xml.luac (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libbluescreen_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\arrow-down@2x.png (212 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\mpora.luac (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\private\FastGlow.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\VolumeHeatColors.qml (265 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\misc\libgnutls_plugin.dll (130226 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libaccess_http_plugin.dll (8472 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libmpgatofixed32_plugin.dll (9496 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\text_renderer\libfreetype_plugin.dll (48104 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_filter\libsmooth_plugin.dll (4152 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\images\icon16.png (353 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libdemux_cdg_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Layouts\qmldir (130 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\fonts\glyphicons.ttf (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libnuv_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\focusframe.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libaccess_ftp_plugin.dll (5952 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\WebChimera.dll (882925 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_out\libstream_out_smem_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\progress-indeterminate.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\TableViewStyle.qml (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\images\close_but.png (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_out\libstream_out_transcode_plugin.dll (3656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libremoteosd_plugin.dll (32104 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libpuzzle_plugin.dll (5952 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libmirror_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\core\Settings.qml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libdtstofloat32_plugin.dll (11736 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\BasicButton.qml (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Slider.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libcanvas_plugin.dll (3656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_output\libamem_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libswscale_plugin.dll (38608 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\button_down.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libsmf_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\PlaylistMenuItems.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libsubsdec_plugin.dll (3808 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libextract_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libspeex_resampler_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libinvert_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\text_renderer\libtdummy_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libmod_plugin.dll (34392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\AbstractCheckable.qml (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libpsychedelic_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\CalendarHeaderModel.qml (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\liblibbluray_plugin.dll (129406 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\rockbox_fm_presets.luac (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libgme_plugin.dll (27336 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libzip_plugin.dll (8472 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\images\webchimera_logo.png (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\ScrollBar.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libaccess_rar_plugin.dll (3656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\mux\libmux_ts_plugin.dll (7288 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libimage_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libmarq_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\private\GaussianGlow.qml (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\mmx\libi420_rgb_mmx_plugin.dll (3808 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\tab_selected.png (498 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libuleaddvaudio_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libmotionblur_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_out\libstream_out_es_plugin.dll (3656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\SystemPaletteSingleton.qml (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\extreme.luac (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\france2.luac (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\VolumeHeat.qml (493 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\images\player_logo_small_h.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\pluzz.luac (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libxa_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libaccess_imem_plugin.dll (3808 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\TopCenterText.qml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\images\icon24.png (480 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\groupbox.png (485 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\TableViewSelection.qml (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libplaylist_plugin.dll (9496 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\TextSingleton.qml (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libparam_eq_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_chroma\libi420_yuy2_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libvorbis_plugin.dll (47352 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libstl_plugin.dll (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Menu.qml (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_output\libwingdi_plugin.dll (3808 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\misc\libfingerprinter_plugin.dll (3808 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\MenuContentScroller.qml (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libsubsdelay_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libcolorthres_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libalphamask_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\arrow-down.png (184 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libogg_plugin.dll (10216 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libstream_filter_rar_plugin.dll (3656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Label.qml (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libfilesystem_plugin.dll (3656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\ArtworkLayer.qml (232 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\mux\libmux_mp4_plugin.dll (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\mux\libmux_mpjpeg_plugin.dll (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\googlevideo.luac (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\Menu.qml (338 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libchorus_flanger_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\SubtitleText.qml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\mux\libmux_ps_plugin.dll (4152 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\ComboBox.qml (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\MenuHeader.qml (612 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libnsv_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libh264_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\misc\libexport_plugin.dll (3656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\zapiks.luac (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\style.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Tab.qml (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\RectangularGlow.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libanaglyph_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libdemux_stl_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\Colorize.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\Glow.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\TextField.qml (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libnormvol_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libantiflicker_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_chroma\libi422_yuy2_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libclone_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\images\icon256.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\StackViewSlideDelegate.qml (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libsvcdsub_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libavi_plugin.dll (6984 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\sse2\libi420_yuy2_sse2_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\packetizer\libpacketizer_mpeg4audio_plugin.dll (5224 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\libeay32.dll (68422 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libcvdsub_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\DropShadow.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libcroppadd_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libt140_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Button.qml (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\images\dragger.png (104 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\libvlc.dll (8472 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\ToolbarRight.qml (124 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\ThresholdMask.qml (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_output\libdirectdraw_plugin.dll (5224 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libdvdnav_plugin.dll (16664 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_chroma\libi422_i420_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\fonts\openfolder.ttf (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Calendar.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libflacsys_plugin.dll (5952 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\TextArea.qml (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libscreen_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\Fonts.qml (962 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libdolby_surround_decoder_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libgradient_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libscale_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_out\libstream_out_delay_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\TextHandle.qml (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\plugins.dat (14960 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\images\icon64.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\metacafe.luac (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\SpinBoxStyle.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\private\FastMaskedBlur.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\ProgressBar.qml (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\BusyIndicatorStyle.qml (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\ScrollView.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\librawvid_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\LinearGradient.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libfaad_plugin.dll (22904 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\button.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libvobsub_plugin.dll (5952 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\TextFieldStyle.qml (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\plugins.qmltypes (6984 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\canalplus.luac (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_output\libglwin32_plugin.dll (6984 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libsdp_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\ContextMenu.qml (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_out\libstream_out_setid_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\koreus.luac (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\webchimera.js (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libtwolame_plugin.dll (9760 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\packetizer\libpacketizer_mlp_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libavcodec_plugin.dll (661132 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\ToolButtonStyle.qml (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\TimeBubble.qml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\images\player_logo_small.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libdirac_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\Blend.qml (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libpng_plugin.dll (20400 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_filter\libdash_plugin.dll (45664 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\MenuBarStyle.qml (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libtransform_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\playlist_youtube.lua (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\TopRightText.qml (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\packetizer\libpacketizer_copy_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\MediaPlayer.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\youtube.luac (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libsimple_channel_mixer_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\services_discovery\libupnp_plugin.dll (25104 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libwave_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\arrow-up.png (186 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\UIsettings.qml (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libspudec_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\images\icon48.png (830 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\lelombrik.luac (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\SplitView.qml (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\CheckBoxStyle.qml (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\BrightnessContrast.qml (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Switch.qml (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libaccess_smb_plugin.dll (3656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\VolumeHeatMouse.qml (813 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\bbc_co_uk.luac (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\misc\libstats_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\qmldir (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\qmldir (913 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libcompressor_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\BigPauseIcon.qml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\private\SourceProxy.qml (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\InnerShadow.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\FocusFrame.qml (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\CheckBox.qml (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\services_discovery\libpodcast_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libddummy_plugin.dll (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\MenuItemSubControls.qml (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\FocusFrameStyle.qml (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libsubtitle_plugin.dll (6984 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\librss_plugin.dll (3808 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\soundcloud.luac (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\Control.qml (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\librawaud_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\MenuContent.qml (106 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libaudiobargraph_a_plugin.dll (3656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\images\webchimera_logo_small.png (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\jquery-2.1.3.min.js (6872 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_out\libstream_out_bridge_plugin.dll (3656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\editbox.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\break.luac (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libaccess_mms_plugin.dll (5952 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_out\libstream_out_chromaprint_plugin.dll (56936 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\VolumeHeatGraphics.qml (812 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\images\cursor-openhand.png (160 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\misc\libvod_rtsp_plugin.dll (6872 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_output\libdirectsound_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libreal_plugin.dll (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\SliderStyle.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\modules\sandbox.luac (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\RadioButton.qml (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libsharpen_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_mixer\libinteger_mixer_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\mux\libmux_ogg_plugin.dll (5224 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\ApplicationWindow.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\libvlccore.dll (139530 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libpanoramix_plugin.dll (3656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_out\libstream_out_gather_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libschroedinger_plugin.dll (68968 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\images\icon32.png (616 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\ConicalGradient.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\liba52tospdif_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libgrain_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libscaletempo_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\private\FastInnerShadow.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libflac_plugin.dll (12984 bytes)

The process citrio.exe:3492 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_11582\CRX_INSTALL\background.js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_11582\CRX_INSTALL\skin\icons\icon.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_11582\CRX_INSTALL\skin\icons\active.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_11582\DECODED_MESSAGE_CATALOGS (24 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_11582\CRX_INSTALL\skin\style.css (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_11582\CRX_INSTALL\skin\jquery-1.11.0.min.js (6984 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_11582\CRX_INSTALL\skin\icons\disable.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_11582\CRX_INSTALL\skin\popup.html (924 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_11582\DECODED_IMAGES (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_11582\CRX_INSTALL\skin\icons\static.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_11582\CRX_INSTALL\skin\sprite.png (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_11582\CRX_INSTALL\manifest.json (533 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_11582\CRX_INSTALL\skin\js.js (392 bytes)

The process citrio.exe:2808 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\images\icon48.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041 (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\images\icon256.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\proxy.crx (2105 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\citrio_ext.crx (109082 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\10.tmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\B.tmp (1478 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20282\CRX_INSTALL\manifest.json (899 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20282 (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\1F.tmp (13882 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20282\CRX_INSTALL\images\icon16.png (721 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\28.tmp (32 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\sr\messages.json (210 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\etilqs_Px70Os4eAETlqZY (286 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171 (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Local Storage\http_www.citrio.com_0.localstorage-journal (14172 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\11.tmp (4594416 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Cache\f_000006 (106 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Login Data (1454 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\etilqs_Z9phldjGeTZeR9O (131 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Extension Cookies (1955 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\1C.tmp (645 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\fr\messages.json (205 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\11.tmp (238288 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\images\128.png (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Cache\index (368 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\images\icon64.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Current Tabs (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\manifest.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\manifest.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\pt_PT\messages.json (237 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\images\icon128.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\E.tmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\icon_16.png (475 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\2B.tmp (97 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\images\icon16.png (321 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\img\16.png (752 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\19.tmp (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Cache\data_3 (5968 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Cache\data_2 (3272 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Cache\data_1 (79304 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Cache\data_0 (413176 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Shortcuts (592 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\etilqs_OdijbpIxDix1Xlr (532 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20282\affiliate.crx (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\manifest.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\CRX_INSTALL\manifest.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\ru\messages.json (265 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\etilqs_gWs6HtCIyiWsTcw (532 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\de\messages.json (208 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Shortcuts-journal (564 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\18.tmp (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\C.tmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Cache\f_000001 (68 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Cache\f_000003 (53 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Cache\f_000002 (36 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Cache\f_000005 (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Cache\f_000004 (65 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Cache\f_000007 (17 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\First Run (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Cache\f_000009 (104 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Cache\f_000008 (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Sync Extension Settings\jnoejnlbkbnckikbkmnpippafneemknp\LOG (220 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\21.tmp (46486 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\etilqs_an73aTGnGd5yszB (131 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\ar\messages.json (289 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\manifest.json (773 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\icon_128.png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533 (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Extension State\MANIFEST-000001 (75 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\21.tmp (2105 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Web Data (28199 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895 (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\icon_mono_off.png (731 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Cache\f_00000a (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\download_all.crx (3073 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Cache\f_00000b (76 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\etilqs_vSZCdRD8jKJYPIC (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\images\icon16.png (801 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\16.tmp (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\24.tmp (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\etilqs_1wOz32UPNJS4pan (292 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\20.tmp (79 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\tr\messages.json (212 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\uk\messages.json (269 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\el\messages.json (298 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\hi\messages.json (369 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Extension Rules\000003.log (663 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Session Storage\MANIFEST-000001 (75 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\icon_19.png (685 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Safe Browsing Cookies (745 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\26.tmp (645 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Login Data-journal (564 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2A.tmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\sv\messages.json (207 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_11582 (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\icon_mono_on.png (748 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\CRX_INSTALL\images\icon128.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\2D.tmp (32 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\he\messages.json (219 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\hu\messages.json (204 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Extension State\LOG (179 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\17.tmp (52 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\images\icon48.png (817 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\12.tmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\pl\messages.json (227 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Session Storage\LOG (179 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Visited Links (1868 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\15.tmp (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\manifest.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\13.tmp (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\1F.tmp (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Network Action Predictor (7647 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Top Sites-journal (12020 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\images\icon24.png (439 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\etilqs_1m97DXkaaHlcEJH (286 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\images\icon128.png (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\vi\messages.json (261 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\_locales\en\messages.json (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Top Sites (5232 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\share_page.crx (58 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\1A.tmp (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\ko\messages.json (209 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\14.tmp (47 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\zh_CN\messages.json (199 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\History (29905 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\README (166 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\da\messages.json (227 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\2C.tmp (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\img\128.png (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Sync Extension Settings\jnoejnlbkbnckikbkmnpippafneemknp\000003.log (269 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Current Session (10608 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\images\19.png (566 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\es\messages.json (224 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Sync Extension Settings\jnoejnlbkbnckikbkmnpippafneemknp\000001.dbtmp (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\img\48.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20282\CRX_INSTALL\images\icon128.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\1E.tmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Extension Cookies-journal (9796 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\CRX_INSTALL\images\icon16.png (420 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Favicons (8470 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\etilqs_byoyEzeIX6OTWgG (131 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Web Data-journal (10344 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Sync Extension Settings\jnoejnlbkbnckikbkmnpippafneemknp\MANIFEST-000001 (75 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Local Storage\http_www.citrio.com_0.localstorage (599 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\History-journal (16252 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\images\icon64.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_11582\CRX_INSTALL\skin\icons\icon.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\25.tmp (80 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\23.tmp (13 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Origin Bound Certs-journal (6215 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Extension Rules\LOG (179 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\it\messages.json (227 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\F.tmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\etilqs_JXBSpvcMjdPeHWR (131 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\27.tmp (32 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\1D.tmp (13 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_11582\CRX_INSTALL\skin\icons\static.png (543 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Favicons-journal (16036 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Session Storage\000001.dbtmp (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\1B.tmp (77 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181 (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Extension State\000003.log (9156 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Cookies (3317 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Safe Browsing Cookies-journal (2791 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\manifest.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20282\CRX_INSTALL\images\icon32.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Network Action Predictor-journal (12870 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_11582\media_downloader.crx (64 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Cookies-journal (18133 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Extension State\000001.dbtmp (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\29.tmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\D.tmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\en\messages.json (210 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\pt_BR\messages.json (237 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Extension Rules\000001.dbtmp (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\images\icon32.png (582 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\22.tmp (645 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551 (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Extension Rules\MANIFEST-000001 (75 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_11582\CRX_INSTALL\manifest.json (955 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\A.tmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Origin Bound Certs (841 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686 (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\cs\messages.json (324 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\images\icon48.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\images\icon256.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\proxy.crx (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Preferences~RF58fa5.TMP (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\citrio_ext.crx (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Preferences~RF6dd24.TMP (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\10.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20282 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\1F.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20282\CRX_INSTALL\images\icon16.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\DECODED_IMAGES (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\11.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\DECODED_IMAGES (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\DECODED_IMAGES (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\11.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\images\128.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\images\icon64.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\icon_16.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\img\16.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\E.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Secure Preferences~RF6086f.TMP (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Extensions\Temp\scoped_dir_2808_1250 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\images\icon16.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20282\affiliate.crx (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Extensions\Temp\scoped_dir_2808_30085 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\D.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Local State~RF63829.TMP (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\C.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Preferences~RF631d0.TMP (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Secure Preferences~RF6dca7.TMP (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\21.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Preferences~RF5f15c.TMP (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\icon_128.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\DECODED_IMAGES (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\21.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Extensions\Temp\scoped_dir_2808_3977 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20282\DECODED_IMAGES (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\DECODED_MESSAGE_CATALOGS (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\icon_mono_off.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Extensions\Temp\scoped_dir_2808_16322 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Preferences~RF5bffc.TMP (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\download_all.crx (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\images\icon16.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Local State~RF677a3.TMP (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\icon_19.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_11582\DECODED_MESSAGE_CATALOGS (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\img\48.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\DECODED_IMAGES (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2A.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_11582 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\icon_mono_on.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\CRX_INSTALL\images\icon128.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_11582\DECODED_IMAGES (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\DECODED_MESSAGE_CATALOGS (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\12.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\images\icon48.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\DECODED_MESSAGE_CATALOGS (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Extensions\Temp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Extensions\Temp\scoped_dir_2808_22249 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\1F.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Secure Preferences~RF58f66.TMP (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\images\icon24.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\images\icon128.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\TransportSecurity~RF671f6.TMP (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Extensions\Temp\scoped_dir_2808_25657 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Preferences~RF58eab.TMP (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\share_page.crx (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Local State~RF6f34c.TMP (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Local State~RF6a8c5.TMP (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\images\icon128.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\img\128.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\images\19.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20282\CRX_INSTALL\images\icon128.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\1E.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\CRX_INSTALL\images\icon16.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Secure Preferences~RF639a0.TMP (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Extensions\Temp\scoped_dir_2808_7982 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\images\icon64.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_11582\CRX_INSTALL\skin\icons\icon.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\DECODED_MESSAGE_CATALOGS (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\DECODED_IMAGES (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\DECODED_IMAGES (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\F.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\DECODED_MESSAGE_CATALOGS (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20282\DECODED_MESSAGE_CATALOGS (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Extensions\Temp\scoped_dir_2808_17942 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Local State~RF5c00b.TMP (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20282\CRX_INSTALL\images\icon32.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_11582\media_downloader.crx (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\29.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Secure Preferences~RF5cb27.TMP (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Extensions\Temp\scoped_dir_2808_2955 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\images\icon32.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_11582\CRX_INSTALL\skin\icons\static.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\A.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\DECODED_MESSAGE_CATALOGS (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\TransportSecurity~RF60d60.TMP (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\DECODED_MESSAGE_CATALOGS (0 bytes)

The process citrio.exe:3368 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\CRX_INSTALL\js\DTA.interface.js (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\CRX_INSTALL\js\DTA.popup.js (59 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\CRX_INSTALL\images\icon128.png (60000 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\CRX_INSTALL\images\button.logo.png (60000 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\CRX_INSTALL\images\logo.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\CRX_INSTALL\images\search.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\DECODED_IMAGES (66 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\CRX_INSTALL\background.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\CRX_INSTALL\images\icon16.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\CRX_INSTALL\js\lib\jquery.js (6984 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\CRX_INSTALL\images\button.logo.inactive.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\CRX_INSTALL\js\DTA.ui.js (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\CRX_INSTALL\images\icon.close.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\CRX_INSTALL\css\template.css (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\DECODED_MESSAGE_CATALOGS (24 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\CRX_INSTALL\manifest.json (729 bytes)

The process citrio.exe:3472 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\is.png (494 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ir.png (471 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\kw.png (476 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\md.png (548 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\es.png (493 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ae.png (446 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\scripts\background.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\sh.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\va.png (483 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\pm.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\vu.png (570 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\tc.png (604 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ms.png (592 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\ic16_gear.png (402 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\gl.png (521 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\fj.png (575 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\lt.png (395 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\si.png (468 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\mg.png (380 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\gs.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\uz.png (462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ls.png (639 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\tf.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\scripts\base64.js (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\scripts\tmpl.js (667 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\bz.png (615 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\mk.png (690 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\icon_128.png (16664 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\yt.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\styles\mochi.css (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\dk.png (416 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\sa.png (560 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\py.png (442 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\sb.png (649 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ci.png (428 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\am.png (414 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\bi.png (740 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\so.png (514 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\tj.png (436 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\bm.png (606 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\bb.png (573 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\scripts\agent.js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ht.png (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\np.png (634 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\cd.png (621 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\mr.png (567 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\kr.png (658 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\sm.png (552 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\az.png (472 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ng.png (441 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\io.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\de.png (391 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\il.png (468 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\gi.png (516 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\nc.png (608 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\aq.png (586 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\mh.png (698 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\jp.png (471 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\fm.png (565 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\bn.png (654 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\bo.png (461 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\lu.png (367 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\vg.png (618 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ua.png (399 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\cy.png (456 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\popup.html (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\kg.png (525 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ax.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ec.png (564 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\in.png (431 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\at.png (363 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\scripts\profile_detail.js (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\fk.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\jm.png (711 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\sy.png (422 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\kp.png (480 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\scripts\spine.route.js (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\scripts\spine.js (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ws.png (492 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\iq.png (475 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\cn.png (469 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ca.png (570 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\pw.png (610 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ug.png (536 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\mn.png (546 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\to.png (427 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\pr.png (498 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ye.png (362 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\je.png (632 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\nf.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\mz.png (539 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\tv.png (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ml.png (463 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\se.png (472 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\pe.png (536 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ch.png (434 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\wf.png (518 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\tw.png (461 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\cm.png (502 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\gp.png (509 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\me.png (555 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\tk.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ph.png (516 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\pk.png (600 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\gy.png (686 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\hu.png (369 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\mm.png (451 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\scripts\jquery.js (6984 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\mp.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\pt.png (591 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\styles\style.css (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\tz.png (655 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\br.png (687 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\list-img.png (603 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\sc.png (677 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\kn.png (662 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ao.png (535 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\manifest.json (511 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\gw.png (465 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\scripts\popup.js (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\nr.png (465 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\sr.png (470 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\scripts\new.js (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\om.png (446 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\cx.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\uy.png (479 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\image\icon_mono_on.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\dj.png (514 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\bs.png (494 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\im.png (543 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\icon_mono_off.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\eg.png (408 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\sg.png (409 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\it.png (440 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\scripts\ui.js (5224 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\er.png (645 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\settings-act.png (883 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\id.png (333 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\DECODED_IMAGES (68 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\no.png (485 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\gg.png (501 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\gf.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\rw.png (437 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\gb.png (707 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\my.png (509 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\gn.png (453 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ly.png (383 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\zw.png (591 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\bj.png (422 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\al.png (535 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\lr.png (457 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ag.png (622 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\pa.png (514 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ad.png (540 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\bh.png (529 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\vi.png (612 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\dm.png (668 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\nl.png (367 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\za.png (600 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ga.png (400 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\sl.png (377 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\mu.png (416 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\sandbox.html (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\tt.png (690 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\sv.png (450 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\bv.png (485 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\icon_mono_on.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\an.png (477 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ve.png (464 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\mf.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\co.png (387 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\vn.png (520 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\hr.png (553 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\nu.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\mo.png (647 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\scripts\model.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\cg.png (674 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\lk.png (586 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\lv.png (367 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\do.png (432 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\image\icon_128.png (16664 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\_locales\en\messages.json (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\speed.png (885 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\km.png (561 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ar.png (439 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\gu.png (532 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\scripts\sandbox.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ma.png (479 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\nz.png (623 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\vc.png (610 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\pf.png (476 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ba.png (627 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\li.png (462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\mv.png (537 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\us.png (488 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\re.png (488 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\sk.png (495 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\cu.png (513 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\jo.png (521 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ee.png (380 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\tl.png (569 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\scripts\logging.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\fr.png (446 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\dz.png (532 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\list-img-ac.png (620 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ky.png (600 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\rs.png (542 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\kz.png (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\bf.png (445 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\image\icon_mono_off.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\et.png (566 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ge.png (509 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\mq.png (604 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\eh.png (536 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ke.png (631 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\hm.png (614 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\close.png (552 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\mt.png (410 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\aw.png (453 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\mx.png (526 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\bw.png (425 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\na.png (717 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\um.png (488 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\gr.png (433 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\cc.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\sd.png (498 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\hk.png (611 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\mw.png (485 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ni.png (431 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ru.png (350 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\bt.png (607 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\scripts\profile_list.js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\gt.png (549 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ne.png (442 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\gq.png (536 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\cl.png (424 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ai.png (609 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\pg.png (629 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\td.png (461 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\tg.png (494 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\sj.png (485 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\scripts\mochi.js (363 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\be.png (452 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\sl_arrow.png (616 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\by.png (441 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\settings.png (871 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\qa.png (458 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\hn.png (432 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\fi.png (405 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\gh.png (453 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\mc.png (333 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\tm.png (553 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ck.png (630 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\sz.png (594 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\th.png (356 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\lc.png (631 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\pl.png (316 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\bg.png (352 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\pn.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\st.png (568 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\gd.png (683 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ie.png (432 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\scripts\doT.min.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ro.png (461 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\DECODED_MESSAGE_CATALOGS (48 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ki.png (679 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\fo.png (462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\image\ic16_gear.png (402 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\as.png (661 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\cv.png (492 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\tn.png (578 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\sn.png (512 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\la.png (530 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\bl.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\af.png (534 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ps.png (516 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\zm.png (527 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\bd.png (577 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\cf.png (514 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\scripts\spine.local.js (619 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\cz.png (492 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\lb.png (491 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\gm.png (398 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\kh.png (535 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\au.png (614 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\cr.png (364 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\tr.png (575 bytes)

The process citrio.exe:2484 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\js\onload.js (72 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\img\header-logo.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\css\uploadProgress.css (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\img\48.png (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\manifest.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\chrome_ex_oauth.html (331 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\img\header.png (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\js\jquery.js (6984 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\_metadata\verified_contents.json (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\img\vimeo4shared.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\DECODED_MESSAGE_CATALOGS (24 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\js\services.js (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\img\59.png (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\options.html (906 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\css\options.css (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\js\chrome_ex_oauthsimple.js (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\js\uploadProgress.js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\img\download-icon.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\css\services.css (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\img\16.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\js\background.js (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\js\chrome_ex_oauth.js (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\DECODED_IMAGES (75 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\js\options.js (894 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\img\128.png (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\uploadProgress.html (840 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\img\progress.png (455 bytes)

The process citrio.exe:656 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\hi\messages.json (375 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\images\small-icons-sprite.png (555 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\DECODED_MESSAGE_CATALOGS (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\images\logo.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\popup.html (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\DECODED_IMAGES (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\sv\messages.json (213 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\images\48.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\es\messages.json (230 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\images\icon_2.png (223 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\images\icon_3.png (326 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\images\nonews.svg (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\no\messages.json (209 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\ru\messages.json (271 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\images\icon_1.png (165 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\he\messages.json (225 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\de\messages.json (214 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_metadata\verified_contents.json (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\nwsh-back.js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\it\messages.json (233 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\pl\messages.json (233 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\sr\messages.json (216 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\hu\messages.json (210 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\ko\messages.json (215 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\ar\messages.json (295 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\images\icon_5.png (449 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\en\messages.json (216 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\images\loader.svg (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\vi\messages.json (267 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\images\128.png (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\images\503.gif (21968 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\images\icon_4.png (389 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\fr\messages.json (211 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\pt_BR\messages.json (243 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\nwsh-content.js (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\nwsh-background.js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\images\arrow.svg (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\zh_CN\messages.json (205 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\manifest.json (933 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\images\stars.png (624 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\pt_PT\messages.json (243 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\da\messages.json (233 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\images\19.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\style.css (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\images\date.svg (364 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\nwsh-ext.js (536 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\tr\messages.json (218 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\uk\messages.json (275 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\el\messages.json (304 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\cs\messages.json (330 bytes)

The process citrio.exe:3312 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20282\CRX_INSTALL\images\icon32.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20282\DECODED_MESSAGE_CATALOGS (24 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20282\CRX_INSTALL\images\icon128.png (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20282\DECODED_IMAGES (70 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20282\CRX_INSTALL\manifest.json (436 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20282\CRX_INSTALL\images\icon16.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20282\CRX_INSTALL\scripts\affiliate.js (127 bytes)

The process citrio.exe:3448 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\icon_19.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\imageformats\qico4.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\scripts\background_stats.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\DECODED_MESSAGE_CATALOGS (24 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\Include\pyconfig.h (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\DECODED_IMAGES (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\_elementtree.pyd (9496 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\python34.dll (164484 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\_bz2.pyd (3808 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\manifest.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\zlib1.dll (5224 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\_hashlib.pyd (49912 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\icon_empty.png (158 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\scripts\content_stats.js (605 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\msvcr100.dll (49672 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\_socket.pyd (3656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\win32api.pyd (6984 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\win32wnet.pyd (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\QtGui4.dll (541377 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\libtorrent.dll (104195 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\pyexpat.pyd (9496 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\youtube-dl.exe (173043 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\QtCore4.dll (152471 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\background.html (286 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\pywintypes34.dll (7784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\libeay32.dll (76989 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\_ctypes.pyd (6872 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\scripts\content_dv.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\_ssl.pyd (66767 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\select.pyd (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\base_library.zip (206432 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\citrio_ext.dll (33720 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\scripts\background_dv.js (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\dlnlib.dll (38832 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\icon_16.png (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\unicodedata.pyd (48768 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\_lzma.pyd (9496 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\libcurl.dll (22840 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\ssleay32.dll (18768 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\msvcp100.dll (27336 bytes)

The process citrio.exe:3224 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application\debug.log (121 bytes)

The process citrio.exe:3192 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\images\icon48.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\images\icon128.png (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\images\icon64.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\js\lib\jquery.js (6984 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\images\icon16.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\DECODED_MESSAGE_CATALOGS (24 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\images\icon.tw.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\js\popup.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\images\logo.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\images\icon.gp.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\css\template.css (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\popup.html (804 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\background.js (261 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\DECODED_IMAGES (92 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\manifest.json (630 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\images\icon35.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\images\icon.fb.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\images\16.png (1 bytes)

The process setup.exe:3676 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\citrio_200_percent.pak (9606 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\ca.pak (246 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\en-US.pak (201 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\icudtl.dat (76792 bytes)
%Documents and Settings%\%current user%\Desktop\Facebook.lnk (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\resources.pak (134807 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\pt-PT.pak (241 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application\41.0.2272.256\Installer\setup.exe (8657 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\citrio.7z (1302935 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch\Citrio.lnk (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\vi.pak (272 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\es-419.pak (245 bytes)
%Documents and Settings%\%current user%\Desktop\YouTube.lnk (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\ko.pak (250 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\wow_helper.exe (70 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\de.pak (243 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\d3dcompiler_47.dll (22433 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\pdf.dll (69133 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Extensions\citrio_ext.crx (108196 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\sk.pak (251 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\zh-CN.pak (200 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\fr.pak (261 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\es.pak (250 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\fi.pak (229 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\citrio_elf.dll (128 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\PepperFlash\pepflashplayer.dll (110258 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\el.pak (1723 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\sl.pak (227 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\ar.pak (326 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Extensions\share_page.crx (58 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\it.pak (239 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\he.pak (279 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\ms.pak (222 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\gu.pak (1769 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\ffmpegsumo.dll (9606 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\ml.pak (3704 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\pl.pak (239 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\citrio_100_percent.pak (7386 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\metro_driver.dll (1753 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Extensions\external_extensions.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\id.pak (217 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\th.pak (1763 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\PepperFlash\version.json (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\nacl_irt_x86_64.nexe (22433 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\te.pak (1835 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\ja.pak (294 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\fil.pak (248 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\da.pak (221 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\hu.pak (258 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application\citrio.exe (7433 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\libegl.dll (77 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\am.pak (1619 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\41.0.2272.256.manifest (224 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\ru.pak (1649 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\citrio.dll (236168 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\bg.pak (1683 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\VisualElements\smalllogo.png (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Extensions\proxy.crx (1668 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\nb.pak (221 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\uk.pak (1663 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\sw.pak (224 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\fa.pak (1628 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\delegate_execute.exe (3730 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\kn.pak (1845 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\ro.pak (248 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\libglesv2.dll (7386 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\hi.pak (1781 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\ta.pak (1862 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\sv.pak (223 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\lv.pak (246 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\libexif.dll (307 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\lt.pak (241 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\cs.pak (243 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\zh-TW.pak (202 bytes)
%Documents and Settings%\%current user%\Desktop\Citrio.lnk (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Extensions\affiliate.crx (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\bn.pak (1800 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\pt-BR.pak (235 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\en-GB.pak (201 bytes)
%Documents and Settings%\%current user%\Desktop\Chrome Web Store.lnk (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\VisualElementsManifest.xml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\secondarytile.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\et.pak (216 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\citrio_child.dll (266850 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\VisualElements\splash-620x300.png (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\chrome_watcher.dll (225 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\nl.pak (234 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\nacl64.exe (12289 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Extensions\media_downloader.crx (64 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\sr.pak (1648 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\mr.pak (1774 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Extensions\download_all.crx (1761 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Citrio\Citrio.lnk (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\hr.pak (231 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\VisualElements\logo.png (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\citrio.exe (5442 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\nacl_irt_x86_32.nexe (17629 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\tr.pak (241 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\wow_helper.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\citrio.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio (0 bytes)

The process %original file name%.exe:1736 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_sl.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_gu.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUT2.tmp (22433 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_nl.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_te.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_sk.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_el.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ru.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_es-419.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_iw.dll (23 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_no.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_tr.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_sr.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_en-GB.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_da.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ro.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_uk.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_zh-TW.dll (19 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_bn.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ms.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ta.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\CatalinaUpdateBroker.exe (58 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_es.dll (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdate.dll (1990 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_sw.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_de.dll (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_is.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_sv.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_fr.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_en.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_cs.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_mr.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_pt-BR.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_fa.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_kn.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_bg.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_pt-PT.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_id.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_fi.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ja.dll (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\npCatalinaUpdate3.dll (237 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\psuser.dll (161 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ml.dll (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ko.dll (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_th.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ca.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_vi.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_hi.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_zh-CN.dll (19 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_lv.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_hu.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\CatalinaUpdate.exe (130 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ar.dll (24 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_pl.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_hr.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\CatalinaUpdateHelper.msi (36 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_lt.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_et.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_am.dll (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\psmachine.dll (155 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\CatalinaCrashHandler.exe (130 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_it.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_fil.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ur.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\CatalinaUpdateOnDemand.exe (58 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_sl.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_gu.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\CatalinaUpdateBroker.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_nl.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_te.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_sk.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_el.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ru.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_es-419.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_iw.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_no.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_tr.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_sr.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_en-GB.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ja.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_da.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ro.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_uk.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_zh-TW.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_bn.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ms.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ta.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUT2.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_es.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdate.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_sw.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_de.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_is.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_sv.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_fr.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_en.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_cs.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_mr.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_pt-BR.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_fa.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_kn.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_bg.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_pt-PT.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_id.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_fi.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\npCatalinaUpdate3.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\psuser.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ml.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ko.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_th.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ca.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_vi.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_hi.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_zh-CN.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_lv.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_hu.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\CatalinaUpdate.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ar.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_pl.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_hr.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\CatalinaUpdateHelper.msi (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_lt.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_et.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_am.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\psmachine.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\CatalinaCrashHandler.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_it.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_fil.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ur.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\CatalinaUpdateOnDemand.exe (0 bytes)

Registry activity

The process citrio_41.0.2272.256_1.exe:3616 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2D 8B 55 DB D1 DB 80 2E 0E 11 56 40 67 EC 95 95"

[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"ap" = "-full"

The process CatalinaUpdate.exe:1236 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B2 F2 80 46 9C D1 4B 3A 5A C8 B2 41 02 9B F7 47"

[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Integers]
"windows_sp_major_version" = "03 00 00 00 00 00 00 00"
"windows_minor_version" = "01 00 00 00 00 00 00 00"

[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Counts]
"goopdate_main" = "02 00 00 00 00 00 00 00"

[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Integers]
"windows_major_version" = "05 00 00 00 00 00 00 00"

[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Counts]
"goopdate_constructor" = "02 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\3E2BF7F2031B96F38CE6C4D8A85D3E2D58476A0F]
"Blob" = "19 00 00 00 01 00 00 00 10 00 00 00 6D 00 C0 25"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\CatalinaGroup\Update\network\secure]
"sk"

[HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates]
"3E2BF7F2031B96F38CE6C4D8A85D3E2D58476A0F"

[HKCU\Software\CatalinaGroup\Update\network\secure]
"c"

The process CatalinaUpdate.exe:1280 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"pv" = "41.0.2272.256"

[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Counts]
"worker_package_cache_put_succeeded" = "01 00 00 00 00 00 00 00"

[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"brand" = "GGLS"
"LastInstallerError" = "0"
"LastInstallerResult" = "0"
"referral" = "1:original"

[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Counts]
"worker_download_total" = "01 00 00 00 00 00 00 00"

[HKCU\Software\CatalinaGroup\Update\proxy]
"source" = "IE"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"usagestats" = "1"

[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Counts]
"worker_package_cache_put_total" = "01 00 00 00 00 00 00 00"
"worker_download_succeeded" = "01 00 00 00 00 00 00 00"

[HKCU\Software\CatalinaGroup\Update]
"LastInstallerError" = "0"

[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Integers]
"windows_minor_version" = "01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"LastInstallerSuccessLaunchCmdLine" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application\citrio.exe"
"lang" = "en"

[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Integers]
"windows_sp_major_version" = "03 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\CatalinaGroup\Update]
"LastInstallerSuccessLaunchCmdLine" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application\citrio.exe"

[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Counts]
"goopdate_main" = "06 00 00 00 00 00 00 00"
"worker_install_execute_total" = "01 00 00 00 00 00 00 00"

[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Integers]
"windows_major_version" = "05 00 00 00 00 00 00 00"

[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"LastCheckSuccess" = "1431508102"

[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Counts]
"goopdate_constructor" = "06 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update]
"CatalinaUpdate.exe" = "CatalinaGroup Update"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F1 6D 48 A6 F1 03 81 D8 53 68 B0 46 18 98 20 EA"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"InstallTime" = "1431508086"

[HKCU\Software\CatalinaGroup\Update]
"LastInstallerResult" = "0"

[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"iid" = "{2F851C43-A7C8-4061-8931-F5533108A703}"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\CatalinaGroup\Update\network\secure]
"sk"

[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"browser"
"LastInstallerError"
"LastInstallerResultUIString"
"eulaaccepted"
"UpdateAvailableSince"
"tttoken"

[HKCU\Software\CatalinaGroup\Update\network\secure]
"c"

[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"experiment_labels"
"InstallerResult"
"LastInstallerExtraCode1"

[HKCU\Software\CatalinaGroup\Update]
"LastInstallerError"

[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"LastInstallerSuccessLaunchCmdLine"

[HKCU\Software\CatalinaGroup\Update]
"LastInstallerSuccessLaunchCmdLine"

[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"InstallerError"
"LastInstallerResult"
"UpdateAvailableCount"
"InstallerSuccessLaunchCmdLine"
"ap"

[HKCU\Software\CatalinaGroup\Update]
"LastInstallerResultUIString"
"LastInstallerExtraCode1"
"LastInstallerResult"

[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"iid"

The process CatalinaUpdate.exe:208 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{13660822-39AC-408C-BA99-702EBEE3EF26}]
"CLSID" = "{13660822-39AC-408C-BA99-702EBEE3EF26}"

[HKCU\Software\Classes\Interface\{A2589E53-1490-4C0A-BFC7-A47B7A88E3D8}]
"(Default)" = "ICatalinaUpdate3WebSecurity"

[HKCU\Software\Classes\CatalinaGroupUpdate.Update3COMClassUser]
"(Default)" = "Update3COMClass"

[HKCU\Software\Classes\Interface\{0E09406F-1420-4BF4-B6EB-F0994674AD68}]
"(Default)" = "IAppBundle"

[HKCU\Software\Classes\CLSID\{554335BD-87F8-43DA-806A-741504EEFF62}\InProcServer32]
"ThreadingModel" = "Both"

[HKCU\Software\Classes\Interface\{3EA78C6E-8267-4554-8EC6-8982D5AF539A}]
"(Default)" = "ICoCreateAsyncStatus"

[HKCU\Software\Classes\Interface\{0E09406F-1420-4BF4-B6EB-F0994674AD68}\NumMethods]
"(Default)" = "39"

[HKCU\Software\Classes\CLSID\{F4CBF20B-F634-4095-B64A-2EBCDD9E560E}\InprocServer32]
"ThreadingModel" = "Both"

[HKCU\Software\Classes\Interface\{34F067BE-C79C-4C5F-8E64-622A3CC59055}\ProxyStubClsid32]
"(Default)" = "{554335BD-87F8-43DA-806A-741504EEFF62}"

[HKCU\Software\Classes\CLSID\{13660822-39AC-408C-BA99-702EBEE3EF26}\LocalServer32]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\CatalinaUpdateOnDemand.exe"

[HKCU\Software\Classes\Interface\{23185EAB-61B0-4B70-BE89-589585B91392}\NumMethods]
"(Default)" = "8"

[HKCU\Software\Classes\Interface\{C1D8630A-9D2D-4E0E-A4A1-8AA5CA3FAE57}\ProxyStubClsid32]
"(Default)" = "{554335BD-87F8-43DA-806A-741504EEFF62}"

[HKCU\Software\Classes\CLSID\{C8362D5A-4303-4E22-8668-BB10D65B95BD}\VersionIndependentProgID]
"(Default)" = "CatalinaGroupUpdate.OnDemandCOMClassUser"

[HKCU\Software\Classes\CLSID\{2823499B-60F3-4940-8042-2C16D5829A39}\VersionIndependentProgID]
"(Default)" = "CatalinaGroupUpdate.Update3WebUser"

[HKCU\Software\Classes\Interface\{7A1A1D82-1E2B-41B8-9FA3-F40D8DD3EEF0}\ProxyStubClsid32]
"(Default)" = "{554335BD-87F8-43DA-806A-741504EEFF62}"

[HKCU\Software\Classes\Interface\{263B5A28-834A-4D1B-AB71-A28E882CC59B}\NumMethods]
"(Default)" = "13"

[HKCU\Software\Classes\CatalinaGroupUpdate.CredentialDialogUser]
"(Default)" = "GoogleUpdate CredentialDialog"

[HKCU\Software\Classes\Interface\{7C9F9415-9947-482C-A62B-24A0BD92B8A7}\NumMethods]
"(Default)" = "4"

[HKCU\Software\Classes\Interface\{A2589E53-1490-4C0A-BFC7-A47B7A88E3D8}\ProxyStubClsid32]
"(Default)" = "{554335BD-87F8-43DA-806A-741504EEFF62}"

[HKCU\Software\Classes\Interface\{C1D8630A-9D2D-4E0E-A4A1-8AA5CA3FAE57}]
"(Default)" = "ICredentialDialog"

[HKCU\Software\Classes\Interface\{A1E6F38D-8C9E-4BDA-86A2-1940472A8429}]
"(Default)" = "ICatalinaUpdate"

[HKCU\Software\Classes\Interface\{FFC6ECB2-25E8-40EE-BF37-5AA25CBCBA63}\NumMethods]
"(Default)" = "10"

[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Counts]
"goopdate_main" = "01 00 00 00 00 00 00 00"

[HKCU\Software\Classes\Interface\{D085AC3B-E5CC-40C9-8366-C12ADC489967}\ProxyStubClsid32]
"(Default)" = "{554335BD-87F8-43DA-806A-741504EEFF62}"

[HKCU\Software\Classes\Interface\{789E3792-8514-4ED5-90F3-5B525275B953}\ProxyStubClsid32]
"(Default)" = "{554335BD-87F8-43DA-806A-741504EEFF62}"

[HKCU\Software\Classes\Interface\{FCD277CC-8D3E-4264-80D3-98E7B05E2E8A}\ProxyStubClsid32]
"(Default)" = "{554335BD-87F8-43DA-806A-741504EEFF62}"

[HKCU\Software\Classes\CLSID\{3C564FFE-55F7-43AC-886C-7E9E9091CB2A}]
"(Default)" = "Update3COMClass"

[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Integers]
"windows_sp_major_version" = "03 00 00 00 00 00 00 00"

[HKCU\Software\Classes\CLSID\{73436A91-85A6-4850-A7D0-375C4E369A5A}\ProgID]
"(Default)" = "CatalinaGroupUpdate.CredentialDialogUser.1.0"

[HKCU\Software\Classes\CLSID\{13660822-39AC-408C-BA99-702EBEE3EF26}]
"(Default)" = "CatalinaGroup.OneClickProcessLauncher"

[HKCU\Software\Classes\Interface\{263B5A28-834A-4D1B-AB71-A28E882CC59B}\ProxyStubClsid32]
"(Default)" = "{554335BD-87F8-43DA-806A-741504EEFF62}"

[HKCU\Software\Classes\CLSID\{C8362D5A-4303-4E22-8668-BB10D65B95BD}]
"(Default)" = "Google Update Legacy On Demand"

[HKCU\Software\Classes\CatalinaGroupUpdate.Update3WebUser\CurVer]
"(Default)" = "CatalinaGroupUpdate.Update3WebUser.1.0"

[HKCU\Software\Classes\Interface\{FCD277CC-8D3E-4264-80D3-98E7B05E2E8A}\NumMethods]
"(Default)" = "10"

[HKCU\Software\Classes\Interface\{CBAC6FCC-819A-443D-98BB-E7A122DCCAE3}\NumMethods]
"(Default)" = "4"

[HKCU\Software\Classes\Interface\{7C9F9415-9947-482C-A62B-24A0BD92B8A7}\ProxyStubClsid32]
"(Default)" = "{554335BD-87F8-43DA-806A-741504EEFF62}"

[HKCU\Software\Classes\Interface\{0CD725CD-5650-4F13-91DA-E42FAA9687E8}\ProxyStubClsid32]
"(Default)" = "{554335BD-87F8-43DA-806A-741504EEFF62}"

[HKCU\Software\Classes\CatalinaGroupUpdate.Update3WebUser\CLSID]
"(Default)" = "{2823499B-60F3-4940-8042-2C16D5829A39}"

[HKCU\Software\Classes\Interface\{FCD277CC-8D3E-4264-80D3-98E7B05E2E8A}]
"(Default)" = "IAppVersionWeb"

[HKCU\Software\Classes\CatalinaGroupUpdate.CredentialDialogUser.1.0]
"(Default)" = "GoogleUpdate CredentialDialog"

[HKCU\Software\Classes\Interface\{84BA4DAC-82EA-4DC8-BCB0-B69DD6E95670}\ProxyStubClsid32]
"(Default)" = "{554335BD-87F8-43DA-806A-741504EEFF62}"

[HKCU\Software\Classes\CLSID\{554335BD-87F8-43DA-806A-741504EEFF62}]
"(Default)" = "PSFactoryBuffer"

[HKCU\Software\Classes\Interface\{F009E353-D4BD-42FE-994E-F6C315055F9B}\ProxyStubClsid32]
"(Default)" = "{554335BD-87F8-43DA-806A-741504EEFF62}"

[HKCU\Software\Classes\CatalinaGroupUpdate.Update3COMClassUser\CurVer]
"(Default)" = "CatalinaGroupUpdate.Update3COMClassUser.1.0"

[HKCU\Software\Classes\CLSID\{73436A91-85A6-4850-A7D0-375C4E369A5A}\VersionIndependentProgID]
"(Default)" = "CatalinaGroupUpdate.CredentialDialogUser"

[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Integers]
"windows_minor_version" = "01 00 00 00 00 00 00 00"

[HKCU\Software\Classes\Interface\{CBAC6FCC-819A-443D-98BB-E7A122DCCAE3}]
"(Default)" = "IOneClickProcessLauncher"

[HKCU\Software\Classes\Interface\{051D14B3-CF0F-4CCA-B8FE-AF9E007ACD43}\NumMethods]
"(Default)" = "4"

[HKCU\Software\Classes\Interface\{051D14B3-CF0F-4CCA-B8FE-AF9E007ACD43}]
"(Default)" = "ICoCreateAsync"

[HKCU\Software\Classes\Interface\{F9F2D675-F172-42F2-A26E-6453B80EA7F1}]
"(Default)" = "ICurrentState"

[HKCU\Software\Classes\CLSID\{3C564FFE-55F7-43AC-886C-7E9E9091CB2A}\ProgID]
"(Default)" = "CatalinaGroupUpdate.Update3COMClassUser.1.0"

[HKCU\Software\Classes\Interface\{789E3792-8514-4ED5-90F3-5B525275B953}]
"(Default)" = "IAppBundleWeb"

[HKCU\Software\Classes\Interface\{D085AC3B-E5CC-40C9-8366-C12ADC489967}]
"(Default)" = "IApp"

[HKCU\Software\Classes\Interface\{A1E6F38D-8C9E-4BDA-86A2-1940472A8429}\NumMethods]
"(Default)" = "5"

[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Integers]
"windows_major_version" = "05 00 00 00 00 00 00 00"

[HKCU\Software\Classes\CatalinaGroup.OneClickProcessLauncherUser\CLSID]
"(Default)" = "{13660822-39AC-408C-BA99-702EBEE3EF26}"

[HKCU\Software\Classes\CLSID\{554335BD-87F8-43DA-806A-741504EEFF62}\InProcServer32]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\psuser.dll"

[HKCU\Software\Classes\Interface\{A1E6F38D-8C9E-4BDA-86A2-1940472A8429}\ProxyStubClsid32]
"(Default)" = "{554335BD-87F8-43DA-806A-741504EEFF62}"

[HKCU\Software\Classes\CatalinaGroupUpdate.CredentialDialogUser\CLSID]
"(Default)" = "{73436A91-85A6-4850-A7D0-375C4E369A5A}"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "18 02 65 F4 AF 74 89 18 6F F5 68 83 10 85 BD E1"

[HKCU\Software\Classes\Interface\{D085AC3B-E5CC-40C9-8366-C12ADC489967}\NumMethods]
"(Default)" = "44"

[HKCU\Software\Classes\CLSID\{13660822-39AC-408C-BA99-702EBEE3EF26}\VersionIndependentProgID]
"(Default)" = "CatalinaGroup.OneClickProcessLauncherUser"

[HKCU\Software\Classes\CatalinaGroupUpdate.Update3WebUser.1.0]
"(Default)" = "GoogleUpdate Update3Web"

[HKCU\Software\Classes\Interface\{C1D8630A-9D2D-4E0E-A4A1-8AA5CA3FAE57}\NumMethods]
"(Default)" = "4"

[HKCU\Software\Classes\Interface\{0CD725CD-5650-4F13-91DA-E42FAA9687E8}\NumMethods]
"(Default)" = "10"

[HKCU\Software\Classes\Interface\{34F067BE-C79C-4C5F-8E64-622A3CC59055}\NumMethods]
"(Default)" = "9"

[HKCU\Software\Classes\Interface\{EC3867B7-B9EF-494E-B42B-BA009D57D90E}\NumMethods]
"(Default)" = "6"

[HKCU\Software\Classes\Interface\{6B6DE56F-09F2-4343-80AD-28E5D6CB78F9}\ProxyStubClsid32]
"(Default)" = "{554335BD-87F8-43DA-806A-741504EEFF62}"

[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{13660822-39AC-408C-BA99-702EBEE3EF26}]
"Policy" = "3"

[HKCU\Software\Classes\Interface\{F9F2D675-F172-42F2-A26E-6453B80EA7F1}\ProxyStubClsid32]
"(Default)" = "{554335BD-87F8-43DA-806A-741504EEFF62}"

[HKCU\Software\Classes\Interface\{0E09406F-1420-4BF4-B6EB-F0994674AD68}\ProxyStubClsid32]
"(Default)" = "{554335BD-87F8-43DA-806A-741504EEFF62}"

[HKCU\Software\Classes\Interface\{6B6DE56F-09F2-4343-80AD-28E5D6CB78F9}\NumMethods]
"(Default)" = "14"

[HKCU\Software\Classes\CLSID\{2823499B-60F3-4940-8042-2C16D5829A39}\ProgID]
"(Default)" = "CatalinaGroupUpdate.Update3WebUser.1.0"

[HKCU\Software\Classes\Interface\{7C9F9415-9947-482C-A62B-24A0BD92B8A7}]
"(Default)" = "ICatalinaUpdateCore"

[HKCU\Software\Classes\Interface\{3EA78C6E-8267-4554-8EC6-8982D5AF539A}\NumMethods]
"(Default)" = "10"

[HKCU\Software\Classes\CLSID\{73436A91-85A6-4850-A7D0-375C4E369A5A}\LocalServer32]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\CatalinaUpdateOnDemand.exe"

[HKCU\Software\Classes\Interface\{051D14B3-CF0F-4CCA-B8FE-AF9E007ACD43}\ProxyStubClsid32]
"(Default)" = "{554335BD-87F8-43DA-806A-741504EEFF62}"

[HKCU\Software\Classes\CatalinaGroup.OneClickProcessLauncherUser.1.0]
"(Default)" = "CatalinaGroup.OneClickProcessLauncher"

[HKCU\Software\Classes\CLSID\{2823499B-60F3-4940-8042-2C16D5829A39}]
"(Default)" = "GoogleUpdate Update3Web"

[HKCU\Software\Classes\CLSID\{13660822-39AC-408C-BA99-702EBEE3EF26}\ProgID]
"(Default)" = "CatalinaGroup.OneClickProcessLauncherUser.1.0"

[HKCU\Software\Classes\Interface\{CBAC6FCC-819A-443D-98BB-E7A122DCCAE3}\ProxyStubClsid32]
"(Default)" = "{554335BD-87F8-43DA-806A-741504EEFF62}"

[HKCU\Software\Classes\CatalinaGroup.OneClickProcessLauncherUser\CurVer]
"(Default)" = "CatalinaGroup.OneClickProcessLauncherUser.1.0"

[HKCU\Software\Classes\CLSID\{2823499B-60F3-4940-8042-2C16D5829A39}\LocalServer32]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\CatalinaUpdateOnDemand.exe"

[HKCU\Software\Classes\Interface\{FFC6ECB2-25E8-40EE-BF37-5AA25CBCBA63}\ProxyStubClsid32]
"(Default)" = "{554335BD-87F8-43DA-806A-741504EEFF62}"

[HKCU\Software\Classes\Interface\{84BA4DAC-82EA-4DC8-BCB0-B69DD6E95670}\NumMethods]
"(Default)" = "10"

[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Counts]
"goopdate_constructor" = "01 00 00 00 00 00 00 00"

[HKCU\Software\Classes\Interface\{FFC6ECB2-25E8-40EE-BF37-5AA25CBCBA63}]
"(Default)" = "ICatalinaUpdate3"

[HKCU\Software\Classes\Interface\{263B5A28-834A-4D1B-AB71-A28E882CC59B}]
"(Default)" = "IJobObserver"

[HKCU\Software\Classes\Interface\{0CD725CD-5650-4F13-91DA-E42FAA9687E8}]
"(Default)" = "IAppVersion"

[HKCU\Software\Classes\CatalinaGroupUpdate.OnDemandCOMClassUser.1.0]
"(Default)" = "Google Update Legacy On Demand"

[HKCU\Software\Classes\CLSID\{D6C70234-3948-4009-8568-A538F47646CB}\InprocHandler32]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\psuser.dll"

[HKCU\Software\Classes\Interface\{F009E353-D4BD-42FE-994E-F6C315055F9B}]
"(Default)" = "ICatalinaUpdate3Web"

[HKCU\Software\Classes\Interface\{F009E353-D4BD-42FE-994E-F6C315055F9B}\NumMethods]
"(Default)" = "8"

[HKCU\Software\Classes\Interface\{A2589E53-1490-4C0A-BFC7-A47B7A88E3D8}\NumMethods]
"(Default)" = "4"

[HKCU\Software\Classes\Interface\{23185EAB-61B0-4B70-BE89-589585B91392}\ProxyStubClsid32]
"(Default)" = "{554335BD-87F8-43DA-806A-741504EEFF62}"

[HKCU\Software\Classes\Interface\{EC3867B7-B9EF-494E-B42B-BA009D57D90E}\ProxyStubClsid32]
"(Default)" = "{554335BD-87F8-43DA-806A-741504EEFF62}"

[HKCU\Software\Classes\CLSID\{3C564FFE-55F7-43AC-886C-7E9E9091CB2A}\VersionIndependentProgID]
"(Default)" = "CatalinaGroupUpdate.Update3COMClassUser"

[HKCU\Software\Classes\CatalinaGroupUpdate.OnDemandCOMClassUser\CLSID]
"(Default)" = "{C8362D5A-4303-4E22-8668-BB10D65B95BD}"

[HKCU\Software\Classes\Interface\{7A1A1D82-1E2B-41B8-9FA3-F40D8DD3EEF0}]
"(Default)" = "IBrowserHttpRequest2"

[HKCU\Software\Classes\CLSID\{F4CBF20B-F634-4095-B64A-2EBCDD9E560E}\InprocServer32]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\psuser.dll"

[HKCU\Software\Classes\CatalinaGroupUpdate.Update3WebUser.1.0\CLSID]
"(Default)" = "{2823499B-60F3-4940-8042-2C16D5829A39}"

[HKCU\Software\Classes\CatalinaGroupUpdate.Update3COMClassUser.1.0]
"(Default)" = "Update3COMClass"

[HKCU\Software\Classes\Interface\{789E3792-8514-4ED5-90F3-5B525275B953}\NumMethods]
"(Default)" = "24"

[HKCU\Software\Classes\Interface\{84BA4DAC-82EA-4DC8-BCB0-B69DD6E95670}]
"(Default)" = "IPackage"

[HKCU\Software\Classes\Interface\{7A1A1D82-1E2B-41B8-9FA3-F40D8DD3EEF0}\NumMethods]
"(Default)" = "4"

[HKCU\Software\Classes\CLSID\{C8362D5A-4303-4E22-8668-BB10D65B95BD}\LocalServer32]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\CatalinaUpdateOnDemand.exe"

[HKCU\Software\Classes\Interface\{3EA78C6E-8267-4554-8EC6-8982D5AF539A}\ProxyStubClsid32]
"(Default)" = "{554335BD-87F8-43DA-806A-741504EEFF62}"

[HKCU\Software\Classes\CLSID\{3C564FFE-55F7-43AC-886C-7E9E9091CB2A}\LocalServer32]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\CatalinaUpdate.exe"

[HKCU\Software\Classes\CatalinaGroupUpdate.Update3COMClassUser.1.0\CLSID]
"(Default)" = "{3C564FFE-55F7-43AC-886C-7E9E9091CB2A}"

[HKCU\Software\Classes\Interface\{6B6DE56F-09F2-4343-80AD-28E5D6CB78F9}]
"(Default)" = "IAppWeb"

[HKCU\Software\Classes\CatalinaGroupUpdate.OnDemandCOMClassUser.1.0\CLSID]
"(Default)" = "{C8362D5A-4303-4E22-8668-BB10D65B95BD}"

[HKCU\Software\Classes\CatalinaGroupUpdate.Update3WebUser]
"(Default)" = "GoogleUpdate Update3Web"

[HKCU\Software\Classes\CatalinaGroup.OneClickProcessLauncherUser]
"(Default)" = "CatalinaGroup.OneClickProcessLauncher"

[HKCU\Software\Classes\CLSID\{D6C70234-3948-4009-8568-A538F47646CB}\InprocHandler32]
"ThreadingModel" = "Both"

[HKCU\Software\Classes\Interface\{F9F2D675-F172-42F2-A26E-6453B80EA7F1}\NumMethods]
"(Default)" = "24"

[HKCU\Software\Classes\CatalinaGroup.OneClickProcessLauncherUser.1.0\CLSID]
"(Default)" = "{13660822-39AC-408C-BA99-702EBEE3EF26}"

[HKCU\Software\Classes\Interface\{EC3867B7-B9EF-494E-B42B-BA009D57D90E}]
"(Default)" = "IProcessLauncher"

[HKCU\Software\Classes\CatalinaGroupUpdate.OnDemandCOMClassUser\CurVer]
"(Default)" = "CatalinaGroupUpdate.OnDemandCOMClassUser.1.0"

[HKCU\Software\Classes\CLSID\{C8362D5A-4303-4E22-8668-BB10D65B95BD}\ProgID]
"(Default)" = "CatalinaGroupUpdate.OnDemandCOMClassUser.1.0"

[HKCU\Software\Classes\CatalinaGroupUpdate.Update3COMClassUser\CLSID]
"(Default)" = "{3C564FFE-55F7-43AC-886C-7E9E9091CB2A}"

[HKCU\Software\Classes\CatalinaGroupUpdate.CredentialDialogUser\CurVer]
"(Default)" = "CatalinaGroupUpdate.CredentialDialogUser.1.0"

[HKCU\Software\Classes\Interface\{34F067BE-C79C-4C5F-8E64-622A3CC59055}]
"(Default)" = "IProgressWndEvents"

[HKCU\Software\Classes\CatalinaGroupUpdate.OnDemandCOMClassUser]
"(Default)" = "Google Update Legacy On Demand"

[HKCU\Software\Classes\CLSID\{73436A91-85A6-4850-A7D0-375C4E369A5A}]
"(Default)" = "GoogleUpdate CredentialDialog"

[HKCU\Software\Classes\CatalinaGroupUpdate.CredentialDialogUser.1.0\CLSID]
"(Default)" = "{73436A91-85A6-4850-A7D0-375C4E369A5A}"

[HKCU\Software\Classes\Interface\{23185EAB-61B0-4B70-BE89-589585B91392}]
"(Default)" = "IRegistrationUpdateHook"

The Trojan deletes the following registry key(s):

[HKCU\Software\Classes\CLSID\{F4CBF20B-F634-4095-B64A-2EBCDD9E560E}]
[HKCU\Software\Classes\CLSID\{F4CBF20B-F634-4095-B64A-2EBCDD9E560E}\InprocServer32]
[HKCU\Software\Classes\CLSID\{D6C70234-3948-4009-8568-A538F47646CB}\InprocHandler32]
[HKCU\Software\Classes\CLSID\{D6C70234-3948-4009-8568-A538F47646CB}]

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\CatalinaGroup\Update\network\secure]
"sk"
"c"

The process CatalinaUpdate.exe:456 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "95 B5 EA 87 FD A9 A7 89 7B D7 92 DA F8 B3 51 60"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Integers]
"windows_sp_major_version" = "03 00 00 00 00 00 00 00"

[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"usagestats" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"LangID" = "09 04"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application]
"citrio.exe" = "Citrio"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Integers]
"windows_minor_version" = "01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Counts]
"goopdate_main" = "03 00 00 00 00 00 00 00"

[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Integers]
"windows_major_version" = "05 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Counts]
"goopdate_constructor" = "03 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\CatalinaGroup\Update]
"eulaaccepted"

[HKCU\Software\CatalinaGroup\Update\network\secure]
"sk"
"c"

The process CatalinaUpdate.exe:1932 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{841F4080-C687-4E9C-BD6E-EB5EECF4FAE6}]
"Policy" = "3"

[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Counts]
"opt_in_uid_generated" = "01 00 00 00 00 00 00 00"
"setup_should_install_total" = "01 00 00 00 00 00 00 00"

[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Timings]
"setup_install_google_update_total_ms" = "01 00 00 00 00 00 00 00 D7 04 00 00 00 00 00 00"

[HKCU\Software\Classes\CLSID\{841F4080-C687-4E9C-BD6E-EB5EECF4FAE6}\ProgID]
"(Default)" = "CatalinaGroup.OneClickCtrl.9"

[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Counts]
"setup_should_install_true_fresh_install" = "01 00 00 00 00 00 00 00"

[HKCU\Software\CatalinaGroup\Update\ClientState\{6C598730-F715-407B-A7AE-A8F10D0F8FA7}]
"iid" = "{2F851C43-A7C8-4061-8931-F5533108A703}"

[HKCU\Software\CatalinaGroup\Update]
"UID" = "{802C7BA9-B484-4EEE-84A7-5BB18059CB01}"

[HKCU\Software\Classes\MIME\Database\Content Type\application/x-vnd.catalinahub.oneclickctrl.9]
"CLSID" = "{841F4080-C687-4E9C-BD6E-EB5EECF4FAE6}"

[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Integers]
"windows_minor_version" = "01 00 00 00 00 00 00 00"

[HKCU\Software\Classes\CatalinaGroup.OneClickCtrl.9\CLSID]
"(Default)" = "{841F4080-C687-4E9C-BD6E-EB5EECF4FAE6}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Classes\CLSID\{841F4080-C687-4E9C-BD6E-EB5EECF4FAE6}]
"(Default)" = "CatalinaGroup Update Plugin"

[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{71216BD6-4D03-4387-BD01-7FE8D9512541}]
"Policy" = "3"

[HKCU\Software\Classes\MIME\Database\Content Type\application/x-vnd.catalinahub.update3webcontrol.3]
"CLSID" = "{71216BD6-4D03-4387-BD01-7FE8D9512541}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Timings]
"setup_phase2_ms" = "01 00 00 00 00 00 00 00 52 03 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{841F4080-C687-4E9C-BD6E-EB5EECF4FAE6}]
"AppName" = "CatalinaUpdate.exe"

[HKCU\Software\CatalinaGroup\Update]
"Version" = "1.3.25.215"

[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"usagestats" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKCU\Software\CatalinaGroup\Update\Clients\{6C598730-F715-407B-A7AE-A8F10D0F8FA7}]
"Name" = "Catalina Update"

[HKCU\Software\MozillaPlugins\@catalinahub.com/CatalinaGroup Update;version=3]
"vendor" = "Catalina Group Ltd."

[HKCU\Software\CatalinaGroup\Update\ClientState\{6C598730-F715-407B-A7AE-A8F10D0F8FA7}]
"InstallTime" = "1431508029"

[HKCU\Software\Classes\CLSID\{841F4080-C687-4E9C-BD6E-EB5EECF4FAE6}\InprocServer32]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\npCatalinaUpdate3.dll"

[HKCU\Software\MozillaPlugins\@catalinahub.com/CatalinaGroup Update;version=3]
"Description" = "CatalinaGroup Update"

[HKCU\Software\Classes\CatalinaGroup.Update3WebControl.3]
"(Default)" = "CatalinaGroup Update Plugin"

[HKCU\Software\MozillaPlugins\@catalinahub.com/CatalinaGroup Update;version=9]
"Path" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\npCatalinaUpdate3.dll"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Counts]
"setup_do_self_install_total" = "01 00 00 00 00 00 00 00"

[HKCU\Software\MozillaPlugins\@catalinahub.com/CatalinaGroup Update;version=9]
"Description" = "CatalinaGroup Update"

[HKCU\Software\Classes\CLSID\{841F4080-C687-4E9C-BD6E-EB5EECF4FAE6}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\MozillaPlugins\@catalinahub.com/CatalinaGroup Update;version=9]
"vendor" = "Catalina Group Ltd."

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Counts]
"setup_install_task_succeeded" = "01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{841F4080-C687-4E9C-BD6E-EB5EECF4FAE6}]
"AppPath" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update"

[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Integers]
"windows_sp_major_version" = "03 00 00 00 00 00 00 00"

[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Timings]
"setup_lock_acquire_ms" = "01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00"

[HKCU\Software\Classes\CLSID\{71216BD6-4D03-4387-BD01-7FE8D9512541}\InprocServer32]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\npCatalinaUpdate3.dll"

[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Counts]
"setup_files_total" = "01 00 00 00 00 00 00 00"
"goopdate_main" = "04 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{71216BD6-4D03-4387-BD01-7FE8D9512541}]
"AppPath" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215"

[HKCU\Software\CatalinaGroup\Update\ClientState\{6C598730-F715-407B-A7AE-A8F10D0F8FA7}]
"pv" = "1.3.25.215"
"brand" = "GGLS"

[HKCU\Software\Classes\CatalinaGroup.Update3WebControl.3\CLSID]
"(Default)" = "{71216BD6-4D03-4387-BD01-7FE8D9512541}"

[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{71216BD6-4D03-4387-BD01-7FE8D9512541}]
"AppName" = "CatalinaUpdateOnDemand.exe"

[HKCU\Software\CatalinaGroup\Update]
"Path" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\CatalinaUpdate.exe"

[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Counts]
"goopdate_constructor" = "04 00 00 00 00 00 00 00"
"setup_do_self_install_succeeded" = "01 00 00 00 00 00 00 00"
"setup_install_succeeded" = "01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update]
"CatalinaUpdate.exe" = "CatalinaGroup Update"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8E 5C 52 B5 07 B7 6C EE BA 0D 62 81 44 C9 AA F2"

[HKCU\Software\Classes\CLSID\{71216BD6-4D03-4387-BD01-7FE8D9512541}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\CatalinaGroup\Update\Clients\{6C598730-F715-407B-A7AE-A8F10D0F8FA7}]
"pv" = "1.3.25.215"

[HKCU\Software\MozillaPlugins\@catalinahub.com/CatalinaGroup Update;version=3]
"ProductName" = "CatalinaGroup Update"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Classes\CLSID\{71216BD6-4D03-4387-BD01-7FE8D9512541}\ProgID]
"(Default)" = "CatalinaGroup.Update3WebControl.3"

[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Timings]
"setup_install_task_ms" = "01 00 00 00 00 00 00 00 F6 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Classes\CatalinaGroup.OneClickCtrl.9]
"(Default)" = "CatalinaGroup Update Plugin"

[HKCU\Software\MozillaPlugins\@catalinahub.com/CatalinaGroup Update;version=9]
"ProductName" = "CatalinaGroup Update"

[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Counts]
"setup_install_total" = "01 00 00 00 00 00 00 00"

[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Integers]
"windows_major_version" = "05 00 00 00 00 00 00 00"

[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Counts]
"setup_files_verification_succeeded" = "01 00 00 00 00 00 00 00"

[HKCU\Software\MozillaPlugins\@catalinahub.com/CatalinaGroup Update;version=3]
"Path" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\npCatalinaUpdate3.dll"

[HKCU\Software\MozillaPlugins\@catalinahub.com/CatalinaGroup Update;version=9]
"Version" = "9"

[HKCU\Software\Classes\CLSID\{71216BD6-4D03-4387-BD01-7FE8D9512541}]
"(Default)" = "CatalinaGroup Update Plugin"

[HKCU\Software\MozillaPlugins\@catalinahub.com/CatalinaGroup Update;version=3]
"Version" = "3"

[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Timings]
"setup_files_ms" = "01 00 00 00 00 00 00 00 7A 01 00 00 00 00 00 00"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"CatalinaGroup Update" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\CatalinaUpdate.exe /c"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\CatalinaGroup\Update]
"ui"

[HKCU\Software\CatalinaGroup\Update\network\secure]
"sk"

[HKCU\Software\CatalinaGroup\Update]
"eulaaccepted"

[HKCU\Software\CatalinaGroup\Update\ClientState\{6C598730-F715-407B-A7AE-A8F10D0F8FA7}]
"UpdateAvailableSince"

[HKCU\Software\CatalinaGroup\Update\network\secure]
"c"

[HKCU\Software\CatalinaGroup\Update\ClientState\{6C598730-F715-407B-A7AE-A8F10D0F8FA7}]
"UpdateAvailableCount"

[HKCU\Software\CatalinaGroup\Update]
"LastChecked"

The process CatalinaUpdate.exe:2836 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5A EB 65 48 A1 13 98 C7 0A FD E7 38 93 86 55 98"

[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Integers]
"windows_sp_major_version" = "03 00 00 00 00 00 00 00"

[HKCU\Software\CatalinaGroup\Update\proxy]
"source" = "IE"

[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Integers]
"windows_minor_version" = "01 00 00 00 00 00 00 00"

[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Counts]
"goopdate_main" = "05 00 00 00 00 00 00 00"

[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Integers]
"windows_major_version" = "05 00 00 00 00 00 00 00"

[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Counts]
"goopdate_constructor" = "05 00 00 00 00 00 00 00"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\CatalinaGroup\Update\network\secure]
"sk"
"c"

The process citrio.exe:3808 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "83 C7 F7 90 E6 16 78 33 91 96 75 4F 81 3C 89 7A"

[HKCU\Software\Trolltech\OrganizationDefaults\Qt Plugin Cache 4.8.false\%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Extensions\dcagnhpbnggmbihndfkkhfjojgbaaedo\1.2.20_0\binaries\win\imageformats]
"qico4.dll" = "40806, 0, Windows msvc release full-config, 2015-05-04T17:08:28"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

The process citrio.exe:3804 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AC 6F 03 05 20 81 F2 CF 7D AB E9 01 9C 75 75 0E"

The process citrio.exe:3492 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C2 F5 02 92 B4 8D 99 6F 8F C4 BF 84 99 C1 AE B3"

The process citrio.exe:2808 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Classes\.rv]
"(Default)" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\Classes\.3g2]
"(Default)" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\WLanDiagCtlGuid]
"BitNames" = " WLANHC_AUTOCONFIG WLANHC_RNWFMSM WLANHC_FATMSM WLANHC_DLLMAIN WLANHC_TEST"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\ServiceCtlGuid]
"BitNames" = " DOT11_AUTOCONF DOT11_AUTOCONF_CLIENT DOT11_AUTOCONF_UI DOT11_FATMSM DOT11_COMMON DOT11_WLANGPA DOT11_CLASS_COINSTALLER"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\DiagL2SecCtlGuid]
"Guid" = "2e8d9ec5-a712-48c4-8ce0-631eb0c1cd65"

[HKCU\Software\Classes\.mov]
"(Default)" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\Classes\.flv]
"(Default)" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"metricsid_installdate" = "0"

[HKCU\Software\Classes\.m4v]
"(Default)" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"dr" = "1"

[HKCU\Software\Classes\.mkv]
"(Default)" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"usagestats" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKCU\Software\CatalinaGroup\Citrio\BLBeacon]
"Version" = "41.0.2272.256"

[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"metricsid_enableddate" = "1431508104"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\CtlGuid]
"BitNames" = " DOT11_ASSOCIATE DOT11_ROAMING DOT11_1X DOT11_PNP DOT11_SCAN DOT11_RECEIVE DOT11_SEND DOT11_IOCTL DOT11_OID DOT11_MISC DOT11_UPCALL DOT11_KEYMGR DOT11_PEER DOT11_SOFTAP DOT11_PAM DOT11_REPEATER DOT11_APROUTER DOT11_WME DOT11_CONFIG DOT11_MSM DOT11_MSM_ADAPT DOT11_MSM_SCAN DOT11_MSM_CONNECT DOT11_MSM_SECURITY_PKT DOT11_NOTIFY_OBJECT"

[HKCU\Software\Classes\.OGG]
"(Default)" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\Classes\.m2v]
"(Default)" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\CatalinaGroup\Citrio\StabilityMetrics]
"user_experience_metrics.stability.exited_cleanly" = "0"

[HKCU\Software\CatalinaGroup\Citrio\BLBeacon]
"State" = "1"

[HKCU\Software\Classes\.avi]
"(Default)" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\Classes\.rm]
"(Default)" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\ServiceCtlGuid]
"Guid" = "0c5a3172-2248-44fd-b9a6-8389cb1dc56a"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\DiagL2SecCtlGuid]
"BitNames" = " SECHC_LOG_FLAG_ASSERT SECHC_LOG_FLAG_INIT SECHC_LOG_FLAG_DIAG SECHC_LOG_FLAG_ONEX_DIAG SECHC_LOG_FLAG_REPAIR SECHC_LOG_FLAG_STATE SECHC_LOG_FLAG_EXT SECHC_LOG_FLAG_EVENT_LOG SECHC_LOG_FLAG_FUNCTION SECHC_LOG_FLAG_MEMORY SECHC_LOG_FLAG_LOCKS"

[HKCU\Software\CatalinaGroup\Citrio]
"AssociationsRegistry" = "3"

[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"lastrun" = "13075981714062625"

[HKCR\TypeLib\{1EA4DBF0-3C3B-11CF-810C-00AA00389B71}\1.1\0\win32]
"(Default)" = "%System%\oleacc.dll"

[HKCU\Software\Classes\.ogv]
"(Default)" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\Classes\.wmv]
"(Default)" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"_NumSignedIn" = "0"

[HKCU\Software\Classes\.mpg]
"(Default)" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\Classes\.ogm]
"(Default)" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing]
"Active" = "1"

[HKCU\Software\CatalinaGroup\Citrio\BLBeacon]
"failed_count" = "0"

[HKCU\Software\Classes\.3gp]
"(Default)" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4F 5E EF 1B 25 5A 29 6A AB 91 92 9B 5C B5 CA 0C"

[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"metricsid" = "6BBAC4F3-050F-4F25-8599-2A2C6FD01074"

[HKCU\Software\Classes\.mp4]
"(Default)" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\CtlGuid]
"Guid" = "d905ac1c-65e7-4242-99ea-fe66a8355df8"

[HKCU\Software\Classes\.webm]
"(Default)" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\Classes\.MP2]
"(Default)" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\WDiagCoreCtlGuid]
"BitNames" = " WD_LOG_FLAG_INIT WD_LOG_FLAG_RPC WD_LOG_FLAG_EVENT WD_LOG_FLAG_INTERFACE WD_LOG_FLAG_CONNECTION WD_LOG_FLAG_CONTROL WD_LOG_FLAG_LOCKS WD_LOG_FLAG_MEMORY WD_LOG_FLAG_REFERENCES WD_LOG_FLAG_FUNCTION_TRACE WD_LOG_FLAG_ASSERT"

[HKCU\Software\Classes\.nsv]
"(Default)" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing]
"ControlFlags" = "1"

[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"_NumAccounts" = "1"

[HKCU\Software\Classes\.asf]
"(Default)" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\WLanDiagCtlGuid]
"Guid" = "6da4ddca-0901-4bae-9ad4-7e6030bab531"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\WDiagCoreCtlGuid]
"Guid" = "637a0f36-dff5-4b2f-83dd-b106c1c725e2"

The Trojan deletes the following registry key(s):

[HKCU\Software\CatalinaGroup\Citrio\BLFinchList]

The process citrio.exe:3148 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "98 10 8E 5E 5E 75 51 D7 7C AD 8C C8 A5 B8 50 9B"

The process citrio.exe:3244 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D5 90 93 DB FD 00 21 F0 F0 D3 63 2E 87 2C C3 E4"

The process citrio.exe:3160 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "82 F5 8B C4 CE 0B 79 BD 91 58 C1 7F 01 99 5C D3"

The process citrio.exe:224 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BE 0C 6D 8B 09 37 08 3F 99 10 FA BF C3 9C 04 06"

The process citrio.exe:3368 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CD 79 BD 21 47 4F 84 2C 2F 0B D1 72 EB 74 D6 10"

The process citrio.exe:3472 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D3 47 F2 3F C7 09 51 A2 03 F9 66 F1 FA 46 23 20"

The process citrio.exe:2484 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F3 C3 58 4F 66 76 E8 82 47 93 08 D2 D3 BB 42 A8"

The process citrio.exe:656 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D3 22 DD 46 D7 31 65 FA 9D CA 38 76 E1 84 C3 F5"

The process citrio.exe:1096 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "81 DA 23 EE 01 6F 05 B7 9C 96 A9 66 46 52 CC 1A"

The process citrio.exe:3632 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3D 61 47 71 A2 C1 6D F7 9F 0B B9 51 4D 0B 09 07"

The process citrio.exe:3392 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "37 7D 95 5D 57 1F F0 F0 41 6E 2B CD 1E CF 06 BA"

The process citrio.exe:3404 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C3 3C 5D 06 28 90 44 44 E2 FA 39 7A DE E9 46 E2"

The process citrio.exe:3312 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DD A3 BD C6 F0 CB 97 BD DA 66 43 CB 87 65 E6 DF"

The process citrio.exe:1804 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9D EE 50 3C 01 5E 76 22 AC 0C 4E 1E B4 F4 3F 70"

The process citrio.exe:3448 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "52 64 D9 00 14 93 E1 B1 97 5C 69 9C C6 71 7C 83"

The process citrio.exe:3224 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "81 39 99 C9 6E BE 07 12 36 1D 11 BB 76 34 38 36"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

The process citrio.exe:3208 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CF 00 2C 9A E7 77 1B 54 CD 4C CE 86 97 95 4D 4A"

The process citrio.exe:476 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "37 55 D3 78 C2 E0 A3 5B 71 9C 5D FC 45 CC 72 61"

The process citrio.exe:3192 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "22 62 25 51 A1 64 CA 2C 9E A2 99 4E B3 6A F4 8A"

The process CatalinaCrashHandler.exe:2412 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4F 83 3E 9C 88 85 2F A1 76 49 EC DA A3 BB 1C 61"

The process setup.exe:3676 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\FileAssociations]
".avi" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
".webp" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\Classes\ftp\shell]
"(Default)" = "open"

[HKCU\Software\Classes\magnet\shell\open\ddeexec]
"(Default)" = ""

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio,"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\InstallInfo]
"HideIconsCommand" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application\citrio.exe --hide-icons"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities]
"ApplicationIcon" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application\citrio.exe,0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Citrio]
"NoRepair" = "1"
"InstallLocation" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\DefaultIcon]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application\citrio.exe,0"

[HKCR\.xht\OpenWithProgids]
"CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ" = ""

[HKCU\Software\Classes\CLSID\{8BF2F61B-E8C2-4A67-85D0-D6A69F9FD948}\LocalServer32]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application\41.0.2272.256\delegate_execute.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities]
"ApplicationName" = "Citrio"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\FileAssociations]
".mov" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
".xhtml" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\CatalinaGroup\Update\Clients\{92F8A219-E740-49D5-B785-B962AD819724}\Commands\on-os-upgrade]
"AutoRunOnOSUpgrade" = "1"

[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"UninstallArguments" = " --uninstall"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\FileAssociations]
".flv" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
".torrent" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\URLAssociations]
"https" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Citrio]
"Publisher" = "© Epom Ltd."

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKCU\Software\CatalinaGroup\Update\Clients\{92F8A219-E740-49D5-B785-B962AD819724}]
"lang" = "en"

[HKCU\Software\Classes\ftp]
"URL Protocol" = ""

[HKCU\Software\Classes\http\shell\open\ddeexec]
"(Default)" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\FileAssociations]
".shtml" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\CatalinaGroup\Update\Clients\{92F8A219-E740-49D5-B785-B962AD819724}]
"pv" = "41.0.2272.256"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\InstallInfo]
"IconsVisible" = "1"
"ReinstallCommand" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application\citrio.exe --make-default-browser"

[HKCU\Software\Classes\.xht]
"(Default)" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\FileAssociations]
".m4v" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCR\CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ\DefaultIcon]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application\citrio.exe,0"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\FileAssociations]
".xht" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\citrio.exe]
"Path" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application"

[HKCU\Software\Classes\CLSID\{8BF2F61B-E8C2-4A67-85D0-D6A69F9FD948}]
"(Default)" = "CommandExecuteImpl Class"

[HKCU\Software\Classes\.html]
"(Default)" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\Classes\ftp\DefaultIcon]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application\citrio.exe,0"

[HKCU\Software\Classes\.shtml]
"(Default)" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\Classes\https\shell\open\ddeexec]
"(Default)" = ""

[HKCR\.htm\OpenWithProgids]
"CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ" = ""

[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"InstallerError" = "0"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\InstallInfo]
"ShowIconsCommand" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application\citrio.exe --show-icons"

[HKCR\.webp\OpenWithProgids]
"CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ" = ""

[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\URLAssociations]
"mms" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"UninstallString" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application\41.0.2272.256\Installer\setup.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\FileAssociations]
".mpg" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
".nsv" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\Classes\http\DefaultIcon]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application\citrio.exe,0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\URLAssociations]
"news" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\FileAssociations]
".asf" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\CatalinaGroup\Citrio]
"AssociationsRegistry" = "1"

[HKCU\Software\Classes\ftp\shell\open\command]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application\citrio.exe -- %1"

[HKCU\Software\Classes\Magnet\DefaultIcon]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application\citrio.exe,0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Citrio]
"Version" = "41.0.2272.256"

[HKCU\Software\Classes\CLSID\{8BF2F61B-E8C2-4A67-85D0-D6A69F9FD948}\LocalServer32]
"ServerExecutable" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application\41.0.2272.256\delegate_execute.exe"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\URLAssociations]
"tel" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"InstallerExtraCode1" = "1"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\shell\open\command]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application\citrio.exe"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B2 60 29 6E B1 BF B7 CE DA 29 6C E1 38 9D 0F 21"

[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"ap" = "-stage:preconditions-full"
"InstallerSuccessLaunchCmdLine" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application\citrio.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\FileAssociations]
".MP2" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
".pdf" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Citrio]
"DisplayName" = "Citrio"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\FileAssociations]
".mp4" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\Classes\Magnet]
"URL Protocol" = ""

[HKCU\Software\CatalinaGroup\Update\Clients\{92F8A219-E740-49D5-B785-B962AD819724}\Commands\on-os-upgrade]
"CommandLine" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application\41.0.2272.256\Installer\setup.exe --on-os-upgrade --verbose-logging"

[HKCU\Software\Classes\.pdf]
"(Default)" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\CatalinaGroup\Update\Clients\{92F8A219-E740-49D5-B785-B962AD819724}]
"oopcrashes" = "1"

[HKLM\SOFTWARE\RegisteredApplications]
"Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ" = "Software\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities"

[HKCU\Software\Classes\https\shell]
"(Default)" = "open"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities]
"ApplicationDescription" = "Citrio is a web browser that runs webpages and applications with lightning speed. It's fast, stable, and easy to use. Browse the web more safely with malware and phishing protection built into Citrio."

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Classes\https\DefaultIcon]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application\citrio.exe,0"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\FileAssociations]
".3gp" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
".webm" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
".mkv" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Citrio]
"NoModify" = "1"

[HKCU\Software\Classes\http\shell]
"(Default)" = "open"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\URLAssociations]
"ftp" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\Startmenu]
"StartMenuInternet" = "Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\FileAssociations]
".wmv" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\Classes\http]
"URL Protocol" = ""

[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\URLAssociations]
"smsto" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCR\CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ\shell\open\command]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application\citrio.exe -- %1"

[HKCU\Software\Classes\https]
"URL Protocol" = ""

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\URLAssociations]
"mailto" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\FileAssociations]
".ogv" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\URLAssociations]
"webcal" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
"magnet" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\FileAssociations]
".3g2" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\Classes\.htm]
"(Default)" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\URLAssociations]
"nntp" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCR\.xhtml\OpenWithProgids]
"CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ" = ""

[HKCU\Software\Classes\Magnet\shell\open\command]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application\citrio.exe -- %1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Citrio]
"UninstallString" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application\41.0.2272.256\Installer\setup.exe --uninstall"

[HKCU\Software\Classes\ftp\shell\open\ddeexec]
"(Default)" = ""

[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\URLAssociations]
"sms" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Citrio]
"DisplayVersion" = "41.0.2272.256"
"DisplayIcon" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application\citrio.exe,0"

[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"InstallerResult" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Citrio]
"InstallDate" = "20150513"

[HKCR\CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ]
"(Default)" = "Citrio Document"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKCR\.shtml\OpenWithProgids]
"CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ" = ""

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\URLAssociations]
"urn" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCR\.html\OpenWithProgids]
"CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Citrio]
"VersionMajor" = "2272"
"VersionMinor" = "256"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Classes\.torrent]
"(Default)" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\Classes\.xhtml]
"(Default)" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\FileAssociations]
".rm" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
".RV" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
".htm" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\Classes\Magnet\shell]
"(Default)" = "open"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\URLAssociations]
"irc" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\CatalinaGroup\Update\Clients\{92F8A219-E740-49D5-B785-B962AD819724}]
"bt" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\citrio.exe]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application\citrio.exe"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\URLAssociations]
"http" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\FileAssociations]
".m2v" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
".html" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\CatalinaGroup\Update\Clients\{92F8A219-E740-49D5-B785-B962AD819724}]
"Name" = "Citrio"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\FileAssociations]
".OGG" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\Clients\StartmenuInternet]
"(Default)" = "Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKCU\Software\Classes\https\shell\open\command]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application\citrio.exe -- %1"

[HKCU\Software\Classes\http\shell\open\command]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application\citrio.exe -- %1"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\FileAssociations]
".ogm" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ]
"(Default)" = "Citrio"

Adds a rule to the firewall Windows which allows any network activity:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application]
"citrio.exe" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application\citrio.exe:*:Enabled:Citrio"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"ap"
"InstallerExtraCode1"

The process %original file name%.exe:1736 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "95 77 11 BD BB 29 21 44 03 24 51 64 66 50 3B 53"

Dropped PE files

MD5	File path
6cea215160ae4188fee4a92ef15dda05	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\CatalinaCrashHandler.exe
6cea215160ae4188fee4a92ef15dda05	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\CatalinaUpdate.exe
7ad1bcd40606876cb6680d83c9ec989a	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\CatalinaUpdateBroker.exe
2b3cf7ea69432a594e10f40cb922ac26	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\CatalinaUpdateOnDemand.exe
2c2b5f94feeb782f83bb15f016a6bf68	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdate.dll
aaf96cdd105289e7ff35394d325cc3dc	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_am.dll
a399a7747af02e7f6289398aa2265c3c	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_ar.dll
c3b2b4701849ea07b96fa137a6e94e02	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_bg.dll
de800351848d365dd563631771f5b5b0	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_bn.dll
d8e741a14434f59b778db9e562625838	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_ca.dll
6e27092a569dda3f4b0aa1a9948089a2	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_cs.dll
c72c8072a466e9a32d2a926071bc400c	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_da.dll
387cc6ea3e3b20fb7e55be314cf41ef9	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_de.dll
fa3a9047608e216c68e83f3b3f4e62ec	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_el.dll
c18e8508c8b691aad860de077390d9d3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_en-GB.dll
f8e1288bb72f67c25c367e5a61651bca	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_en.dll
e67f2ba7b2d5e2841e7f317080f3fd62	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_es-419.dll
4a80f1645d7dd9e9b1392841ad02d970	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_es.dll
d83ed084a47c3352d5e68404500ce4af	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_et.dll
a420edd640c17822899c730af0d516ad	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_fa.dll
028b1d4af503a3209383ad0a2e1c6dac	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_fi.dll
428a992a1329cebe4c48bb7d54ba44d7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_fil.dll
6805edac4a9be23a70947c5d990dbf8c	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_fr.dll
f7e7d920bf9c0e98d350dd19a0dff5c3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_gu.dll
05770102a6c300aa14d917b773b13f72	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_hi.dll
4c7c2b2f13eb1d17fdeb8974f1b9a1ab	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_hr.dll
5ae0ab73c27fa94752554f811e54548e	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_hu.dll
571702223ba20e311291c4641db8a0e5	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_id.dll
b60ad05c51a0deb944c9b6d515ba3f75	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_is.dll
d140749f5da947cad9d95a568c92a412	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_it.dll
7572629ccdc27e59f98185b0b100a81d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_iw.dll
e00fc2475ee6221a470f7a02304ef577	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_ja.dll
1f9c169f28c96a84ad699ad7d8e8ecea	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_kn.dll
5426cd1549caf223134627d50c8f2fd7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_ko.dll
fcedbb1d3960e1ed1f208e426b461e47	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_lt.dll
677c82aee1a8e1bc1d8679051a7a7ef6	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_lv.dll
5adbacbe7871978d5487e50d4f9d5fd9	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_ml.dll
7a7e9bbf621bd0310b27a29dae338b25	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_mr.dll
f55cca95c0ce7bb9dd0df7426d0850b7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_ms.dll
b635337f96458e4240d6d36a0f1ad0c0	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_nl.dll
a9d7acb329bb58291371783bfd765747	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_no.dll
151e2197c465d69f0531f1eda0ae723e	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_pl.dll
16f588b707fa9574c2c4c033442a54bc	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_pt-BR.dll
742c5173ad19be9995323f9aa55c7ce6	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_pt-PT.dll
9187e5a69439016f6d87d2400433652f	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_ro.dll
1088f9f75d48492f9a59b327a1b4150f	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_ru.dll
7aa2aa0182bf743aee50f0da6211fc25	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_sk.dll
9f97e32ab67e6176a310f80750195055	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_sl.dll
80d3b8af8f5ea5fabc59f6c3871f8c8b	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_sr.dll
172d968afada4520e29d1fd274f89a4f	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_sv.dll
7fc9f569c18a6dea813dd9a596aedb59	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_sw.dll
ef7097038ed66124b148e2a796f591c3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_ta.dll
30ff6ccc5934ac9b9feec18c17534324	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_te.dll
3405f18d69e7a10e02258f0cee5ca9a4	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_th.dll
d07cd67deabd1d6bcbfd581eddb55191	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_tr.dll
b5a72b466f81ab67a4efb1e8925fc4bc	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_uk.dll
cec3e2877c12ec603e0f0c523909717e	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_ur.dll
b31627a3b5d15e05b94c1261f3b3b85a	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_vi.dll
b397baf228f38e28e2690ddb20852bce	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_zh-CN.dll
1b0dea6bce09f17beec9646bae225517	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_zh-TW.dll
5d092b19ed729ece612a2247cf45c358	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\npCatalinaUpdate3.dll
4c3a99424c4a6fa0cfde4261b8c784d5	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\psmachine.dll
6c87927c9537cc20f16943bded647e30	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\psuser.dll
6cea215160ae4188fee4a92ef15dda05	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\CatalinaUpdate.exe
c24369c18ece8e3a0d51d19938ecaa6b	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\Download\{92F8A219-E740-49D5-B785-B962AD819724}\41.0.2272.256\citrio_41.0.2272.256_1.exe
c24369c18ece8e3a0d51d19938ecaa6b	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\Install\{2C93941F-2EE0-43BB-9129-D7C4EAAD6F62}\citrio_41.0.2272.256_1.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):

   citrio_41.0.2272.256_1.exe:3616
   CatalinaUpdate.exe:1236
   CatalinaUpdate.exe:1280
   CatalinaUpdate.exe:208
   CatalinaUpdate.exe:456
   CatalinaUpdate.exe:1932
   CatalinaUpdate.exe:2836
   citrio.exe:3804
   citrio.exe:3492
   citrio.exe:3148
   citrio.exe:3244
   citrio.exe:224
   citrio.exe:3368
   citrio.exe:3472
   citrio.exe:2484
   citrio.exe:656
   citrio.exe:1096
   citrio.exe:3632
   citrio.exe:3404
   citrio.exe:3312
   citrio.exe:3448
   citrio.exe:3224
   citrio.exe:3208
   citrio.exe:3192
   CatalinaCrashHandler.exe:2412
   setup.exe:3676
   %original file name%.exe:1736

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:

   %Documents and Settings%\%current user%\Local Settings\Temp\CR_E0220.tmp\CITRIO.PACKED.7Z (415199 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\CR_E0220.tmp\SETUP.EX_ (1724 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\CR_E0220.tmp\setup.exe (19923 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Cab4.tmp (54 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Tar5.tmp (2712 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Cab8.tmp (48 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Cab6.tmp (54 bytes)
   %Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004 (408 bytes)
   %Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 (48 bytes)
   %Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 (408 bytes)
   %Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004 (18 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Tar7.tmp (2712 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Tar9.tmp (2712 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\Install\{2C93941F-2EE0-43BB-9129-D7C4EAAD6F62}\citrio_41.0.2272.256_1.exe (422134 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\Download\{92F8A219-E740-49D5-B785-B962AD819724}\41.0.2272.256\citrio_41.0.2272.256_1.exe (422134 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\CatalinaUpdateOnDemand.exe (58 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_hu.dll (27 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_uk.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_no.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_th.dll (25 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_fil.dll (27 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_en.dll (25 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_ja.dll (22 bytes)
   %WinDir%\Tasks\CatalinaGroupUpdateTaskUserS-1-5-21-1844237615-1960408961-1801674531-1003Core.job (948 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_pl.dll (27 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_fi.dll (26 bytes)
   %WinDir%\Tasks\CatalinaGroupUpdateTaskUserS-1-5-21-1844237615-1960408961-1801674531-1003UA.job (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_pt-PT.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_en-GB.dll (25 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_fr.dll (28 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_et.dll (25 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_sk.dll (27 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_mr.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_bn.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_kn.dll (27 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_es-419.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_sl.dll (27 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_sw.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_iw.dll (23 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\CatalinaUpdateBroker.exe (58 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_ta.dll (27 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_ko.dll (21 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_de.dll (29 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_hr.dll (27 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_am.dll (22 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_pt-BR.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_sr.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_zh-CN.dll (19 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\CatalinaCrashHandler.exe (601 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_zh-TW.dll (19 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\CatalinaUpdate.exe (601 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_vi.dll (25 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_cs.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_ar.dll (24 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_ca.dll (27 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\npCatalinaUpdate3.dll (1281 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_nl.dll (27 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\psmachine.dll (673 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_el.dll (28 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_it.dll (28 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_sv.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_lv.dll (27 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_ur.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_te.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_is.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_ru.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\CatalinaUpdate.exe (601 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_ro.dll (27 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_id.dll (25 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\psuser.dll (673 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_fa.dll (25 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_lt.dll (25 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_tr.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_bg.dll (27 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\CatalinaUpdateHelper.msi (36 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_ms.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdate.dll (5873 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_hi.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_es.dll (29 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_ml.dll (29 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_da.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_gu.dll (26 bytes)
   %Documents and Settings%\%current user%\NTUSER.DAT.LOG (4048 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libtheora_plugin.dll (22840 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\arrow-right.png (114 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libdts_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\lua\liblua_plugin.dll (20400 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libmkv_plugin.dll (66563 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libsubsusf_plugin.dll (1928 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\joox.luac (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libaes3_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\ScrollViewHelper.qml (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\sse2\libi420_rgb_sse2_plugin.dll (8472 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_output\libmmdevice_plugin.dll (3656 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libmpc_plugin.dll (5952 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libsepia_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libasf_plugin.dll (5224 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\StatusBarStyle.qml (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\GroupBox.qml (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\MenuContentItem.qml (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libpostproc_plugin.dll (7288 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_mixer\libfloat_mixer_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libdeinterlace_plugin.dll (10864 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\GammaAdjust.qml (6 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\TableView.qml (3656 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\MenuClose.qml (588 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\meta_engine\libfolder_plugin.dll (2696 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\rightanglearrow.png (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\ButtonStyle.qml (6 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libripple_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libadpcm_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libcc_plugin.dll (1928 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\SourceProxy.qml (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\SpinBox.qml (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\BusyIndicator.qml (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\StackViewTransition.qml (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libdmo_plugin.dll (2696 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\MenuScroll.qml (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libvoc_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\services_discovery\libsap_plugin.dll (8472 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libwall_plugin.dll (3808 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\ToolbarLeft.qml (96 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_chroma\libyuy2_i422_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\OpacityMask.qml (5 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\scrollbar-handle-vertical.png (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\header.png (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\ToolButton.qml (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\packetizer\libpacketizer_flac_plugin.dll (1928 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\arrow-left.png (114 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libscene_plugin.dll (3656 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\CalendarUtils.js (5 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\core\Hotkeys.qml (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\SplashScreen.qml (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\qmldir (852 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libtimecode_plugin.dll (3656 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libmono_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\check@2x.png (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\HueSaturation.qml (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\TabView.qml (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libdvdread_plugin.dll (11704 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\GroupBoxStyle.qml (5 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libaudio_format_plugin.dll (1928 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\tab.png (460 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libts_plugin.dll (9352 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libmagnify_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libscte27_plugin.dll (2696 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libmosaic_plugin.dll (1928 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\packetizer\libpacketizer_vc1_plugin.dll (2696 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libaraw_plugin.dll (1928 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libpva_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_filter\librecord_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libquicktime_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\ColumnMenuContent.qml (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libgaussianblur_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\core\Functions.qml (2696 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libspeex_plugin.dll (10216 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libatmo_plugin.dll (14776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\librotate_plugin.dll (4152 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libes_plugin.dll (1928 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libaiff_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\VolumeHeatScale.qml (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\ProgressBar.qml (6 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\RadialGradient.qml (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libshm_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\mux\libmux_avi_plugin.dll (1928 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_output\libafile_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\manifest.json (626 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\modules\dkjson.luac (1928 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_out\libstream_out_duplicate_plugin.dll (3656 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libremap_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libedummy_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_out\libstream_out_dummy_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_chroma\libi420_rgb_plugin.dll (2696 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\ComboBoxStyle.qml (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libaccess_bd_plugin.dll (7288 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\misc\libxml_plugin.dll (67908 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_out\libstream_out_standard_plugin.dll (3656 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_filter\libhttplive_plugin.dll (34872 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\EditMenu_ios.qml (7 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\images\icon128.png (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libkate_plugin.dll (7784 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\MenuStyle.qml (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\mux\libmux_wav_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\mux\libmux_asf_plugin.dll (2696 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\liblive555_plugin.dll (45664 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\slider-handle.png (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libtta_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\EditMenu_base.qml (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\DirectionalBlur.qml (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\MaskedBlur.qml (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libheadphone_channel_mixer_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\sse2\libi422_yuy2_sse2_plugin.dll (1928 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\ApplicationWindowStyle.qml (5 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libcdda_plugin.dll (10864 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libaccess_realrtsp_plugin.dll (6984 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libau_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libmp4_plugin.dll (12376 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\scrollbar-handle-transient.png (249 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\vimeo.luac (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\katsomo.luac (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libnsc_plugin.dll (3808 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libgradfun_plugin.dll (1928 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libaccess_udp_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\librtp_plugin.dll (31256 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libdtv_plugin.dll (16664 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libdvbsub_plugin.dll (7784 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\ToolbarTimeLength.qml (365 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\ContentItem.qml (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_out\libstream_out_description_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Layouts\plugins.qmltypes (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\spinner_large.png (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\StackView.qml (3656 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\StatusBar.qml (6 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libposterize_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick.2\plugins.qmltypes (14960 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\ToolBar.qml (7 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\Desaturate.qml (5 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libty_plugin.dll (2696 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\liblibmpeg2_plugin.dll (9496 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libball_plugin.dll (1928 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\DECODED_MESSAGE_CATALOGS (24 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\scrollbar-handle-horizontal.png (939 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\StackViewDelegate.qml (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\jamendo.luac (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_out\libstream_out_langfromtelx_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\BigPlayIcon.qml (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\TableViewColumn.qml (6 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\youtube_homepage.luac (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\appletrailers.luac (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libaccess_tcp_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libcdg_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libmotiondetect_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\ZoomBlur.qml (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\librawdv_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\liba52_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\main.qml (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\metachannels.luac (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libchain_plugin.dll (2696 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\modules\simplexml.luac (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libdshow_plugin.dll (18240 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\TitleBar.qml (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libvc1_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\HoverButton.qml (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\TextAreaStyle.qml (6 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick.2\qmldir (111 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_output\libadummy_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\services_discovery\libmediadirs_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\ScrollViewStyle.qml (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libaccess_vdr_plugin.dll (5952 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_output\libvmem_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\ToolbarButton.qml (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libg711_plugin.dll (1928 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\ToolbarBackground.qml (256 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\SwitchStyle.qml (6 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libmpeg_audio_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\liveleak.luac (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_chroma\librv32_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_output\libyuv_plugin.dll (3656 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\mux\libmux_dummy_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\RadioButtonStyle.qml (6 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_chroma\libyuy2_i420_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libzvbi_plugin.dll (83471 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libcrystalhd_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\fonts\secondary.ttf (2696 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\cue.luac (5 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\core\Buttons.qml (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\meta_engine\libtaglib_plugin.dll (81329 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\liblpcm_plugin.dll (1928 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libsamplerate_plugin.dll (80307 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\arrow-right@2x.png (148 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\RadialBlur.qml (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\ModalPopupBehavior.qml (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\CustomButton.qml (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\VideoLayer.qml (291 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\private\GaussianInnerShadow.qml (5 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\EditMenu.qml (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_output\libwaveout_plugin.dll (2696 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libps_plugin.dll (3656 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\qmldir (134 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\MediaPlayer.html (634 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\misc\libaudioscrobbler_plugin.dll (3808 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\packetizer\libpacketizer_mpeg4video_plugin.dll (1928 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\slider-groove.png (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\mmx\libi420_yuy2_mmx_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\packetizer\libpacketizer_h264_plugin.dll (5224 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\COPYING.txt (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_out\libstream_out_autodel_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libdtstospdif_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libx264_plugin.dll (66979 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libugly_resampler_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_output\libdirect3d_plugin.dll (5224 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\check.png (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\librawvideo_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\spinner_medium.png (5 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\liberase_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\services_discovery\libwindrive_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libequalizer_plugin.dll (3808 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\anevia_streams.luac (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\arrow-left@2x.png (139 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\ToolMenuButton.qml (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libdxva2_plugin.dll (5224 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libtrivial_channel_mixer_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\CalendarStyle.qml (1928 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libsid_plugin.dll (60000 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\ColorOverlay.qml (5 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\Style.qml (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_out\libstream_out_record_plugin.dll (3808 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libgain_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\private\GaussianMaskedBlur.qml (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\liba52tofloat32_plugin.dll (4152 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libadjust_plugin.dll (2696 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libspatializer_plugin.dll (8472 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\d3dcompiler_43.dll (130008 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\dailymotion.luac (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\Toolbar.qml (517 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\TextInputWithHandles.qml (7 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\MenuBar.qml (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\leftanglearrow.png (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\ToolBarStyle.qml (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libwav_plugin.dll (1928 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\packetizer\libpacketizer_dirac_plugin.dll (2696 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_output\libcaca_plugin.dll (48104 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\FastGlow.qml (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\arrow-up@2x.png (229 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_output\libdrawable_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\misc\liblogger_plugin.dll (3656 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\ssleay32.dll (20400 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\StackView.js (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_output\libdirect2d_plugin.dll (3808 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\DECODED_IMAGES (1642 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\pinkbike.luac (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libvcd_plugin.dll (6872 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\SubtitleMenuItems.qml (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\Displace.qml (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libidummy_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\RecursiveBlur.qml (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libopus_plugin.dll (11736 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libblend_plugin.dll (12376 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\packetizer\libpacketizer_mpegvideo_plugin.dll (1928 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\TabViewStyle.qml (7 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\spinner_small.png (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\msvcr90.dll (41752 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_out\libstream_out_mosaic_bridge_plugin.dll (1928 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_out\libstream_out_raop_plugin.dll (32816 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\ProgressBarStyle.qml (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libblendbench_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\ToolbarBorder.qml (96 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\css\styles.css (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libaudiobargraph_v_plugin.dll (2696 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_chroma\libgrey_yuv_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\LevelAdjust.qml (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libkaraoke_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\mmx\libi422_yuy2_mmx_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libstereo_widen_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\TabBar.qml (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\fonts\default.ttf (2696 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\private\GaussianDirectionalBlur.qml (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\liblibass_plugin.dll (74023 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libhqdn3d_plugin.dll (1928 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\liblogo_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\GaussianBlur.qml (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libaccess_attachment_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_out\libstream_out_display_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libyuvp_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\FastBlur.qml (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_output\libvdummy_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libmjpeg_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libmpgv_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libdemuxdump_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\MouseSurface.qml (346 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_out\libstream_out_rtp_plugin.dll (37152 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\anevia_xml.luac (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libbluescreen_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\arrow-down@2x.png (212 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\mpora.luac (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\private\FastGlow.qml (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\VolumeHeatColors.qml (265 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\misc\libgnutls_plugin.dll (130226 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libaccess_http_plugin.dll (8472 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libmpgatofixed32_plugin.dll (9496 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\text_renderer\libfreetype_plugin.dll (48104 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_filter\libsmooth_plugin.dll (4152 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\images\icon16.png (353 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libdemux_cdg_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Layouts\qmldir (130 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\fonts\glyphicons.ttf (6 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libnuv_plugin.dll (1928 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\focusframe.png (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libaccess_ftp_plugin.dll (5952 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\WebChimera.dll (882925 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_out\libstream_out_smem_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\progress-indeterminate.png (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\TableViewStyle.qml (5 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\images\close_but.png (5 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_out\libstream_out_transcode_plugin.dll (3656 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libremoteosd_plugin.dll (32104 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libpuzzle_plugin.dll (5952 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libmirror_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\core\Settings.qml (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libdtstofloat32_plugin.dll (11736 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\BasicButton.qml (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Slider.qml (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libcanvas_plugin.dll (3656 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_output\libamem_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libswscale_plugin.dll (38608 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\button_down.png (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libsmf_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\PlaylistMenuItems.qml (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libsubsdec_plugin.dll (3808 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libextract_plugin.dll (1928 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libspeex_resampler_plugin.dll (1928 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libinvert_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\text_renderer\libtdummy_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libmod_plugin.dll (34392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\AbstractCheckable.qml (5 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libpsychedelic_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\CalendarHeaderModel.qml (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\liblibbluray_plugin.dll (129406 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\rockbox_fm_presets.luac (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libgme_plugin.dll (27336 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libzip_plugin.dll (8472 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\images\webchimera_logo.png (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\ScrollBar.qml (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libaccess_rar_plugin.dll (3656 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\mux\libmux_ts_plugin.dll (7288 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libimage_plugin.dll (1928 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libmarq_plugin.dll (1928 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\private\GaussianGlow.qml (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\mmx\libi420_rgb_mmx_plugin.dll (3808 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\tab_selected.png (498 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libuleaddvaudio_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libmotionblur_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_out\libstream_out_es_plugin.dll (3656 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\SystemPaletteSingleton.qml (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\extreme.luac (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\france2.luac (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\VolumeHeat.qml (493 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\images\player_logo_small_h.png (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\pluzz.luac (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libxa_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libaccess_imem_plugin.dll (3808 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\TopCenterText.qml (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\images\icon24.png (480 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\groupbox.png (485 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\TableViewSelection.qml (7 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libplaylist_plugin.dll (9496 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\TextSingleton.qml (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libparam_eq_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_chroma\libi420_yuy2_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libvorbis_plugin.dll (47352 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libstl_plugin.dll (2696 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Menu.qml (5 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_output\libwingdi_plugin.dll (3808 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\misc\libfingerprinter_plugin.dll (3808 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\MenuContentScroller.qml (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libsubsdelay_plugin.dll (1928 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libcolorthres_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libalphamask_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\arrow-down.png (184 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libogg_plugin.dll (10216 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libstream_filter_rar_plugin.dll (3656 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Label.qml (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libfilesystem_plugin.dll (3656 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\ArtworkLayer.qml (232 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\mux\libmux_mp4_plugin.dll (2696 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\mux\libmux_mpjpeg_plugin.dll (2696 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\googlevideo.luac (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\Menu.qml (338 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libchorus_flanger_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\SubtitleText.qml (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\mux\libmux_ps_plugin.dll (4152 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\ComboBox.qml (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\MenuHeader.qml (612 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libnsv_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libh264_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\misc\libexport_plugin.dll (3656 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\zapiks.luac (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\style.js (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Tab.qml (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\RectangularGlow.qml (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libanaglyph_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libdemux_stl_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\Colorize.qml (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\Glow.qml (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\TextField.qml (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libnormvol_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libantiflicker_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_chroma\libi422_yuy2_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libclone_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\images\icon256.png (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\StackViewSlideDelegate.qml (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libsvcdsub_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libavi_plugin.dll (6984 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\sse2\libi420_yuy2_sse2_plugin.dll (1928 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\packetizer\libpacketizer_mpeg4audio_plugin.dll (5224 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\libeay32.dll (68422 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libcvdsub_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\DropShadow.qml (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libcroppadd_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libt140_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Button.qml (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\images\dragger.png (104 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\libvlc.dll (8472 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\ToolbarRight.qml (124 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\ThresholdMask.qml (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_output\libdirectdraw_plugin.dll (5224 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libdvdnav_plugin.dll (16664 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_chroma\libi422_i420_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\fonts\openfolder.ttf (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Calendar.qml (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libflacsys_plugin.dll (5952 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\TextArea.qml (2696 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libscreen_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\Fonts.qml (962 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libdolby_surround_decoder_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libgradient_plugin.dll (1928 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libscale_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_out\libstream_out_delay_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\TextHandle.qml (5 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\plugins.dat (14960 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\images\icon64.png (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\metacafe.luac (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\SpinBoxStyle.qml (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\private\FastMaskedBlur.qml (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\ProgressBar.qml (5 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\BusyIndicatorStyle.qml (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\ScrollView.qml (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\librawvid_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\LinearGradient.qml (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libfaad_plugin.dll (22904 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\button.png (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libvobsub_plugin.dll (5952 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\TextFieldStyle.qml (7 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\plugins.qmltypes (6984 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\canalplus.luac (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_output\libglwin32_plugin.dll (6984 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libsdp_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\ContextMenu.qml (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_out\libstream_out_setid_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\koreus.luac (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\webchimera.js (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libtwolame_plugin.dll (9760 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\packetizer\libpacketizer_mlp_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libavcodec_plugin.dll (661132 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\ToolButtonStyle.qml (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\TimeBubble.qml (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\images\player_logo_small.png (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libdirac_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\Blend.qml (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libpng_plugin.dll (20400 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_filter\libdash_plugin.dll (45664 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\MenuBarStyle.qml (5 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libtransform_plugin.dll (1928 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\playlist_youtube.lua (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\TopRightText.qml (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\packetizer\libpacketizer_copy_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\MediaPlayer.js (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\youtube.luac (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libsimple_channel_mixer_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\services_discovery\libupnp_plugin.dll (25104 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libwave_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\arrow-up.png (186 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\UIsettings.qml (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libspudec_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\images\icon48.png (830 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\lelombrik.luac (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\SplitView.qml (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\CheckBoxStyle.qml (7 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\BrightnessContrast.qml (7 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Switch.qml (5 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libaccess_smb_plugin.dll (3656 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\VolumeHeatMouse.qml (813 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\bbc_co_uk.luac (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\misc\libstats_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\qmldir (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\qmldir (913 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libcompressor_plugin.dll (1928 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\BigPauseIcon.qml (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\private\SourceProxy.qml (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\InnerShadow.qml (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\FocusFrame.qml (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\CheckBox.qml (7 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\services_discovery\libpodcast_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libddummy_plugin.dll (2696 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\MenuItemSubControls.qml (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\FocusFrameStyle.qml (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libsubtitle_plugin.dll (6984 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\librss_plugin.dll (3808 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\soundcloud.luac (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\Control.qml (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\librawaud_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\MenuContent.qml (106 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libaudiobargraph_a_plugin.dll (3656 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\images\webchimera_logo_small.png (7 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\jquery-2.1.3.min.js (6872 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_out\libstream_out_bridge_plugin.dll (3656 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\editbox.png (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\break.luac (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libaccess_mms_plugin.dll (5952 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_out\libstream_out_chromaprint_plugin.dll (56936 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\VolumeHeatGraphics.qml (812 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\images\cursor-openhand.png (160 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\misc\libvod_rtsp_plugin.dll (6872 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_output\libdirectsound_plugin.dll (1928 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libreal_plugin.dll (2696 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\SliderStyle.qml (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\modules\sandbox.luac (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\RadioButton.qml (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libsharpen_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_mixer\libinteger_mixer_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\mux\libmux_ogg_plugin.dll (5224 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\ApplicationWindow.qml (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\libvlccore.dll (139530 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libpanoramix_plugin.dll (3656 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_out\libstream_out_gather_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libschroedinger_plugin.dll (68968 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\images\icon32.png (616 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\ConicalGradient.qml (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\liba52tospdif_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libgrain_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libscaletempo_plugin.dll (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\private\FastInnerShadow.qml (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libflac_plugin.dll (12984 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_11582\CRX_INSTALL\background.js (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_11582\CRX_INSTALL\skin\icons\icon.png (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_11582\CRX_INSTALL\skin\icons\active.png (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_11582\DECODED_MESSAGE_CATALOGS (24 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_11582\CRX_INSTALL\skin\style.css (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_11582\CRX_INSTALL\skin\jquery-1.11.0.min.js (6984 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_11582\CRX_INSTALL\skin\icons\disable.png (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_11582\CRX_INSTALL\skin\popup.html (924 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_11582\DECODED_IMAGES (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_11582\CRX_INSTALL\skin\icons\static.png (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_11582\CRX_INSTALL\skin\sprite.png (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_11582\CRX_INSTALL\manifest.json (533 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_11582\CRX_INSTALL\skin\js.js (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\images\icon48.png (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041 (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\proxy.crx (2105 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\citrio_ext.crx (109082 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\10.tmp (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\B.tmp (1478 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20282\CRX_INSTALL\manifest.json (899 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\1F.tmp (13882 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20282\CRX_INSTALL\images\icon16.png (721 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\28.tmp (32 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\sr\messages.json (210 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\etilqs_Px70Os4eAETlqZY (286 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Local Storage\http_www.citrio.com_0.localstorage-journal (14172 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\11.tmp (4594416 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Cache\f_000006 (106 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Login Data (1454 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\etilqs_Z9phldjGeTZeR9O (131 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Extension Cookies (1955 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\1C.tmp (645 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\fr\messages.json (205 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\11.tmp (238288 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\images\128.png (5 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Cache\index (368 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Current Tabs (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\manifest.json (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\manifest.json (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\pt_PT\messages.json (237 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\E.tmp (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\icon_16.png (475 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\2B.tmp (97 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\img\16.png (752 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\19.tmp (12 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Cache\data_3 (5968 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Cache\data_2 (3272 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Cache\data_1 (79304 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Cache\data_0 (413176 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Shortcuts (592 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\etilqs_OdijbpIxDix1Xlr (532 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20282\affiliate.crx (10 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\manifest.json (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\CRX_INSTALL\manifest.json (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\ru\messages.json (265 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\etilqs_gWs6HtCIyiWsTcw (532 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\de\messages.json (208 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Shortcuts-journal (564 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\18.tmp (7 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\C.tmp (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Cache\f_000001 (68 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Cache\f_000003 (53 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Cache\f_000002 (36 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Cache\f_000005 (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Cache\f_000004 (65 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Cache\f_000007 (17 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\First Run (0 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Cache\f_000009 (104 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Cache\f_000008 (21 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Sync Extension Settings\jnoejnlbkbnckikbkmnpippafneemknp\LOG (220 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\21.tmp (46486 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\etilqs_an73aTGnGd5yszB (131 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\ar\messages.json (289 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\manifest.json (773 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\icon_128.png (6 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Extension State\MANIFEST-000001 (75 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\21.tmp (2105 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Web Data (28199 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\icon_mono_off.png (731 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Cache\f_00000a (21 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\download_all.crx (3073 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Cache\f_00000b (76 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\etilqs_vSZCdRD8jKJYPIC (20 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\images\icon16.png (801 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\16.tmp (7 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\24.tmp (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\etilqs_1wOz32UPNJS4pan (292 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\20.tmp (79 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\tr\messages.json (212 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\uk\messages.json (269 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\el\messages.json (298 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\hi\messages.json (369 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Extension Rules\000003.log (663 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Session Storage\MANIFEST-000001 (75 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\icon_19.png (685 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Safe Browsing Cookies (745 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\26.tmp (645 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Login Data-journal (564 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\2A.tmp (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\sv\messages.json (207 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\icon_mono_on.png (748 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\CRX_INSTALL\images\icon128.png (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\2D.tmp (32 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\he\messages.json (219 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\hu\messages.json (204 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Extension State\LOG (179 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\17.tmp (52 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\12.tmp (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\pl\messages.json (227 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Session Storage\LOG (179 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Visited Links (1868 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\15.tmp (7 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\13.tmp (7 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\1F.tmp (601 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Network Action Predictor (7647 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Top Sites-journal (12020 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\etilqs_1m97DXkaaHlcEJH (286 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\images\icon128.png (5 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\vi\messages.json (261 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\_locales\en\messages.json (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\share_page.crx (58 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\1A.tmp (7 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\ko\messages.json (209 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\14.tmp (47 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\zh_CN\messages.json (199 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\History (29905 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\README (166 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\da\messages.json (227 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\2C.tmp (14 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\img\128.png (16 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Sync Extension Settings\jnoejnlbkbnckikbkmnpippafneemknp\000003.log (269 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Current Session (10608 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\images\19.png (566 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\es\messages.json (224 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Sync Extension Settings\jnoejnlbkbnckikbkmnpippafneemknp\000001.dbtmp (20 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\img\48.png (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20282\CRX_INSTALL\images\icon128.png (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\1E.tmp (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Extension Cookies-journal (9796 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\CRX_INSTALL\images\icon16.png (420 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Favicons (8470 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\etilqs_byoyEzeIX6OTWgG (131 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Web Data-journal (10344 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Sync Extension Settings\jnoejnlbkbnckikbkmnpippafneemknp\MANIFEST-000001 (75 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\History-journal (16252 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\images\icon64.png (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\25.tmp (80 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\23.tmp (13 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Origin Bound Certs-journal (6215 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Extension Rules\LOG (179 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\it\messages.json (227 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\F.tmp (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\etilqs_JXBSpvcMjdPeHWR (131 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\27.tmp (32 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\1D.tmp (13 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Favicons-journal (16036 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Session Storage\000001.dbtmp (20 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\1B.tmp (77 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Extension State\000003.log (9156 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Cookies (3317 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Safe Browsing Cookies-journal (2791 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\manifest.json (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20282\CRX_INSTALL\images\icon32.png (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Network Action Predictor-journal (12870 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_11582\media_downloader.crx (64 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Cookies-journal (18133 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Extension State\000001.dbtmp (20 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\29.tmp (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\D.tmp (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\en\messages.json (210 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\pt_BR\messages.json (237 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Extension Rules\000001.dbtmp (20 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\22.tmp (645 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Extension Rules\MANIFEST-000001 (75 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\A.tmp (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\cs\messages.json (324 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\CRX_INSTALL\js\DTA.interface.js (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\CRX_INSTALL\js\DTA.popup.js (59 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\CRX_INSTALL\images\button.logo.png (60000 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\CRX_INSTALL\images\logo.png (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\CRX_INSTALL\images\search.png (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\DECODED_IMAGES (66 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\CRX_INSTALL\background.js (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\CRX_INSTALL\js\lib\jquery.js (6984 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\CRX_INSTALL\images\button.logo.inactive.png (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\CRX_INSTALL\js\DTA.ui.js (7 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\CRX_INSTALL\images\icon.close.png (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\CRX_INSTALL\css\template.css (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\DECODED_MESSAGE_CATALOGS (24 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\is.png (494 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ir.png (471 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\kw.png (476 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\md.png (548 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\es.png (493 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ae.png (446 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\scripts\background.js (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\sh.png (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\va.png (483 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\pm.png (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\vu.png (570 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\tc.png (604 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ms.png (592 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\ic16_gear.png (402 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\gl.png (521 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\fj.png (575 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\lt.png (395 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\si.png (468 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\mg.png (380 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\gs.png (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\uz.png (462 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ls.png (639 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\tf.png (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\scripts\base64.js (6 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\scripts\tmpl.js (667 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\bz.png (615 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\mk.png (690 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\yt.png (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\styles\mochi.css (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\dk.png (416 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\sa.png (560 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\py.png (442 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\sb.png (649 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ci.png (428 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\am.png (414 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\bi.png (740 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\so.png (514 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\tj.png (436 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\bm.png (606 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\bb.png (573 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\scripts\agent.js (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ht.png (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\np.png (634 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\cd.png (621 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\mr.png (567 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\kr.png (658 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\sm.png (552 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\az.png (472 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ng.png (441 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\io.png (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\de.png (391 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\il.png (468 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\gi.png (516 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\nc.png (608 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\aq.png (586 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\mh.png (698 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\jp.png (471 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\fm.png (565 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\bn.png (654 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\bo.png (461 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\lu.png (367 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\vg.png (618 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ua.png (399 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\cy.png (456 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\popup.html (7 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\kg.png (525 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ax.png (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ec.png (564 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\in.png (431 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\at.png (363 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\scripts\profile_detail.js (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\fk.png (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\jm.png (711 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\sy.png (422 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\kp.png (480 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\scripts\spine.route.js (5 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\scripts\spine.js (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ws.png (492 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\iq.png (475 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\cn.png (469 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ca.png (570 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\pw.png (610 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ug.png (536 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\mn.png (546 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\to.png (427 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\pr.png (498 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ye.png (362 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\je.png (632 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\nf.png (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\mz.png (539 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\tv.png (601 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ml.png (463 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\se.png (472 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\pe.png (536 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ch.png (434 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\wf.png (518 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\tw.png (461 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\cm.png (502 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\gp.png (509 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\me.png (555 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\tk.png (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ph.png (516 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\pk.png (600 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\gy.png (686 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\hu.png (369 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\mm.png (451 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\scripts\jquery.js (6984 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\mp.png (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\pt.png (591 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\styles\style.css (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\tz.png (655 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\br.png (687 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\list-img.png (603 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\sc.png (677 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\kn.png (662 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ao.png (535 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\gw.png (465 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\scripts\popup.js (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\nr.png (465 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\sr.png (470 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\scripts\new.js (5 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\om.png (446 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\cx.png (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\uy.png (479 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\image\icon_mono_on.png (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\dj.png (514 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\bs.png (494 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\im.png (543 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\eg.png (408 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\sg.png (409 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\it.png (440 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\scripts\ui.js (5224 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\er.png (645 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\settings-act.png (883 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\id.png (333 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\DECODED_IMAGES (68 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\no.png (485 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\gg.png (501 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\gf.png (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\rw.png (437 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\gb.png (707 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\my.png (509 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\gn.png (453 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ly.png (383 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\zw.png (591 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\bj.png (422 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\al.png (535 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\lr.png (457 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ag.png (622 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\pa.png (514 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ad.png (540 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\bh.png (529 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\vi.png (612 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\dm.png (668 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\nl.png (367 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\za.png (600 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ga.png (400 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\sl.png (377 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\mu.png (416 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\sandbox.html (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\tt.png (690 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\sv.png (450 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\bv.png (485 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\an.png (477 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ve.png (464 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\mf.png (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\co.png (387 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\vn.png (520 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\hr.png (553 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\nu.png (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\mo.png (647 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\scripts\model.js (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\cg.png (674 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\lk.png (586 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\lv.png (367 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\do.png (432 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\image\icon_128.png (16664 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\speed.png (885 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\km.png (561 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ar.png (439 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\gu.png (532 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\scripts\sandbox.js (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ma.png (479 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\nz.png (623 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\vc.png (610 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\pf.png (476 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ba.png (627 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\li.png (462 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\mv.png (537 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\us.png (488 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\re.png (488 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\sk.png (495 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\cu.png (513 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\jo.png (521 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ee.png (380 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\tl.png (569 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\scripts\logging.js (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\fr.png (446 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\dz.png (532 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\list-img-ac.png (620 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ky.png (600 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\rs.png (542 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\kz.png (601 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\bf.png (445 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\image\icon_mono_off.png (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\et.png (566 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ge.png (509 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\mq.png (604 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\eh.png (536 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ke.png (631 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\hm.png (614 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\close.png (552 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\mt.png (410 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\aw.png (453 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\mx.png (526 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\bw.png (425 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\na.png (717 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\um.png (488 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\gr.png (433 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\cc.png (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\sd.png (498 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\hk.png (611 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\mw.png (485 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ni.png (431 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ru.png (350 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\bt.png (607 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\scripts\profile_list.js (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\gt.png (549 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ne.png (442 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\gq.png (536 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\cl.png (424 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ai.png (609 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\pg.png (629 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\td.png (461 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\tg.png (494 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\sj.png (485 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\scripts\mochi.js (363 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\be.png (452 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\sl_arrow.png (616 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\by.png (441 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\settings.png (871 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\qa.png (458 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\hn.png (432 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\fi.png (405 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\gh.png (453 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\mc.png (333 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\tm.png (553 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ck.png (630 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\sz.png (594 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\th.png (356 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\lc.png (631 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\pl.png (316 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\bg.png (352 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\pn.png (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\st.png (568 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\gd.png (683 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ie.png (432 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\scripts\doT.min.js (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ro.png (461 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\DECODED_MESSAGE_CATALOGS (48 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ki.png (679 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\fo.png (462 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\image\ic16_gear.png (402 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\as.png (661 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\cv.png (492 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\tn.png (578 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\sn.png (512 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\la.png (530 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\bl.png (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\af.png (534 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ps.png (516 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\zm.png (527 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\bd.png (577 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\cf.png (514 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\scripts\spine.local.js (619 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\cz.png (492 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\lb.png (491 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\gm.png (398 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\kh.png (535 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\au.png (614 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\cr.png (364 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\tr.png (575 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\js\onload.js (72 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\img\header-logo.png (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\css\uploadProgress.css (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\chrome_ex_oauth.html (331 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\img\header.png (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\js\jquery.js (6984 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\_metadata\verified_contents.json (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\img\vimeo4shared.png (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\DECODED_MESSAGE_CATALOGS (24 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\js\services.js (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\img\59.png (5 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\options.html (906 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\css\options.css (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\js\chrome_ex_oauthsimple.js (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\js\uploadProgress.js (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\img\download-icon.png (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\css\services.css (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\js\background.js (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\js\chrome_ex_oauth.js (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\DECODED_IMAGES (75 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\js\options.js (894 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\uploadProgress.html (840 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\img\progress.png (455 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\images\small-icons-sprite.png (555 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\DECODED_MESSAGE_CATALOGS (5 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\images\logo.png (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\popup.html (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\DECODED_IMAGES (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\images\48.png (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\images\icon_2.png (223 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\images\icon_3.png (326 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\images\nonews.svg (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\no\messages.json (209 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\images\icon_1.png (165 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_metadata\verified_contents.json (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\nwsh-back.js (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\images\icon_5.png (449 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\images\loader.svg (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\images\503.gif (21968 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\images\icon_4.png (389 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\nwsh-content.js (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\nwsh-background.js (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\images\arrow.svg (180 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\images\stars.png (624 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\style.css (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\images\date.svg (364 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\nwsh-ext.js (536 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20282\DECODED_MESSAGE_CATALOGS (24 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20282\DECODED_IMAGES (70 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20282\CRX_INSTALL\scripts\affiliate.js (127 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\imageformats\qico4.dll (1928 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\scripts\background_stats.js (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\DECODED_MESSAGE_CATALOGS (24 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\Include\pyconfig.h (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\DECODED_IMAGES (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\_elementtree.pyd (9496 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\python34.dll (164484 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\_bz2.pyd (3808 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\zlib1.dll (5224 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\_hashlib.pyd (49912 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\icon_empty.png (158 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\scripts\content_stats.js (605 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\msvcr100.dll (49672 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\_socket.pyd (3656 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\win32api.pyd (6984 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\win32wnet.pyd (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\QtGui4.dll (541377 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\libtorrent.dll (104195 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\pyexpat.pyd (9496 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\youtube-dl.exe (173043 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\QtCore4.dll (152471 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\background.html (286 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\pywintypes34.dll (7784 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\libeay32.dll (76989 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\_ctypes.pyd (6872 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\scripts\content_dv.js (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\_ssl.pyd (66767 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\select.pyd (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\base_library.zip (206432 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\citrio_ext.dll (33720 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\scripts\background_dv.js (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\dlnlib.dll (38832 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\unicodedata.pyd (48768 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\_lzma.pyd (9496 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\libcurl.dll (22840 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\ssleay32.dll (18768 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\msvcp100.dll (27336 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application\debug.log (121 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\js\lib\jquery.js (6984 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\DECODED_MESSAGE_CATALOGS (24 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\images\icon.tw.png (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\js\popup.js (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\images\logo.png (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\images\icon.gp.png (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\css\template.css (5 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\popup.html (804 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\background.js (261 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\DECODED_IMAGES (92 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\images\icon35.png (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\images\icon.fb.png (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\images\16.png (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\citrio_200_percent.pak (9606 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\ca.pak (246 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\en-US.pak (201 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\icudtl.dat (76792 bytes)
   %Documents and Settings%\%current user%\Desktop\Facebook.lnk (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\resources.pak (134807 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\pt-PT.pak (241 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application\41.0.2272.256\Installer\setup.exe (8657 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\citrio.7z (1302935 bytes)
   %Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch\Citrio.lnk (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\vi.pak (272 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\es-419.pak (245 bytes)
   %Documents and Settings%\%current user%\Desktop\YouTube.lnk (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\ko.pak (250 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\wow_helper.exe (70 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\de.pak (243 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\d3dcompiler_47.dll (22433 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\pdf.dll (69133 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Extensions\citrio_ext.crx (108196 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\sk.pak (251 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\zh-CN.pak (200 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\fr.pak (261 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\es.pak (250 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\fi.pak (229 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\citrio_elf.dll (128 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\PepperFlash\pepflashplayer.dll (110258 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\el.pak (1723 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\sl.pak (227 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\ar.pak (326 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Extensions\share_page.crx (58 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\it.pak (239 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\he.pak (279 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\ms.pak (222 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\gu.pak (1769 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\ffmpegsumo.dll (9606 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\ml.pak (3704 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\pl.pak (239 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\citrio_100_percent.pak (7386 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\metro_driver.dll (1753 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Extensions\external_extensions.json (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\id.pak (217 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\th.pak (1763 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\PepperFlash\version.json (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\nacl_irt_x86_64.nexe (22433 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\te.pak (1835 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\ja.pak (294 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\fil.pak (248 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\da.pak (221 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\hu.pak (258 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application\citrio.exe (7433 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\libegl.dll (77 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\am.pak (1619 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\41.0.2272.256.manifest (224 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\ru.pak (1649 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\citrio.dll (236168 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\bg.pak (1683 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\VisualElements\smalllogo.png (18 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Extensions\proxy.crx (1668 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\nb.pak (221 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\uk.pak (1663 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\sw.pak (224 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\fa.pak (1628 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\delegate_execute.exe (3730 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\kn.pak (1845 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\ro.pak (248 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\libglesv2.dll (7386 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\hi.pak (1781 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\ta.pak (1862 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\sv.pak (223 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\lv.pak (246 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\libexif.dll (307 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\lt.pak (241 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\cs.pak (243 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\zh-TW.pak (202 bytes)
   %Documents and Settings%\%current user%\Desktop\Citrio.lnk (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Extensions\affiliate.crx (10 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\bn.pak (1800 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\pt-BR.pak (235 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\en-GB.pak (201 bytes)
   %Documents and Settings%\%current user%\Desktop\Chrome Web Store.lnk (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\VisualElementsManifest.xml (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\secondarytile.png (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\et.pak (216 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\citrio_child.dll (266850 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\VisualElements\splash-620x300.png (28 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\chrome_watcher.dll (225 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\nl.pak (234 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\nacl64.exe (12289 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Extensions\media_downloader.crx (64 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\sr.pak (1648 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\mr.pak (1774 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Extensions\download_all.crx (1761 bytes)
   %Documents and Settings%\%current user%\Start Menu\Programs\Citrio\Citrio.lnk (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\hr.pak (231 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\VisualElements\logo.png (7 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\citrio.exe (5442 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\nacl_irt_x86_32.nexe (17629 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\tr.pak (241 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_sl.dll (27 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_gu.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUT2.tmp (22433 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_nl.dll (27 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_te.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_sk.dll (27 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_el.dll (28 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ru.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_es-419.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_iw.dll (23 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_no.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_tr.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_sr.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_en-GB.dll (25 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_da.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ro.dll (27 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_uk.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_zh-TW.dll (19 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_bn.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ms.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ta.dll (27 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\CatalinaUpdateBroker.exe (58 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_es.dll (29 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdate.dll (1990 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_sw.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_de.dll (29 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_is.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_sv.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_fr.dll (28 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_en.dll (25 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_cs.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_mr.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_pt-BR.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_fa.dll (25 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_kn.dll (27 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_bg.dll (27 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_pt-PT.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_id.dll (25 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_fi.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ja.dll (22 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\npCatalinaUpdate3.dll (237 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\psuser.dll (161 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ml.dll (29 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ko.dll (21 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_th.dll (25 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ca.dll (27 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_vi.dll (25 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_hi.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_zh-CN.dll (19 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_lv.dll (27 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_hu.dll (27 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\CatalinaUpdate.exe (130 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ar.dll (24 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_pl.dll (27 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_hr.dll (27 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\CatalinaUpdateHelper.msi (36 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_lt.dll (25 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_et.dll (25 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_am.dll (22 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\psmachine.dll (155 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\CatalinaCrashHandler.exe (130 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_it.dll (28 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_fil.dll (27 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ur.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\CatalinaUpdateOnDemand.exe (58 bytes)

4. Delete the following value(s) in the autorun key (How to Work with System Registry):

   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   "CatalinaGroup Update" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\CatalinaUpdate.exe /c"

5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
6. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: Catalina Group Ltd.
Product Name: CatalinaGroup Update
Product Version: 1.3.25.215
Legal Copyright: Copyright 2013 Catalina Group Ltd.
Legal Trademarks:
Original Filename: CatalinaUpdateSetup.exe
Internal Name: CatalinaGroup Update Setup
File Version: 1.3.25.215
File Description: CatalinaGroup Update Setup
Comments:
Language: Language Neutral

Company Name: Catalina Group Ltd.Product Name: CatalinaGroup UpdateProduct Version: 1.3.25.215Legal Copyright: Copyright 2013 Catalina Group Ltd.Legal Trademarks: Original Filename: CatalinaUpdateSetup.exeInternal Name: CatalinaGroup Update SetupFile Version: 1.3.25.215File Description: CatalinaGroup Update SetupComments: Language: Language Neutral

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	47535	47616	4.63666	da072aeedacb67c58ca3952875d79a2b
.rdata	53248	10788	11264	3.70551	cc85a67bbda310b5aa377cecaa3156cf
.data	65536	6428	3584	1.72368	8e425fbedc6927dfabb8fdfaaf8e8d97
.rsrc	73728	659744	659968	5.30312	89169e477c01dd8186928471af10e787
.reloc	737280	5598	5632	2.64966	17957bd86fff892742280f82a0bf537a

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 55
52e93d93473e442df41b45a8df00f628
4f0acf873009b0cf0e89d10892e393f9
28abfe0c3e4590a11d0736ab880c5987
64df6e96429a9fe3bd1b483ecf0961cd
c5cfe009e1e65a170da3052981874345
a6f9ab77421a528b7c7cd2f18bec8e5d
5eec07d1d0930a323cce95aaa1581737
3886d7762b345b0f2f5bfec5cc8f5f0e
6efef102a13f8aad7ae7b1ddd7a5c648
4854ab62c0262c63cdf33ebfc80ddb35
035c249781db5107cafeeb7607c3c697
82aa707b75ec9b620d08c03bbb3d4d1e
e0f2da4263afb73fbd1db49753665d81
4aee0f6b49fa24bf85de868c8332cc64
2a0d81d981e3d4cdec30a4528238cf43
7a8757db5e84593ceabd79d890887e59
cedb7fc834ea2b5786f5a27a33f40f95
04c0b7523dd8300f65e037d12bd60064
18cb4280c8fecf80f62ad0a65947cd70
d6eb88a73d98b4db1678ebb376d5f8a3
edee24f98c9a2bf2804898a0333edfea
9b7f9d226474d458316df1f994821807
8197dcd6af91174c7e4ed99cda1f5dd8
155df244efb56d5ac4452b8b5c5db144
a79d1eb06eff95b9fd9f933f8e280429

Network Activity

URLs

URL	IP
hxxp://catalinahub.com/update/ping
hxxp://catalinahub.com/update/check?w=3:H0r8iAJfY0HPFbfafxuAsuNAYdcfvoZko0Y55G3J2L8XzWRWZxCNbFQvLX6kLnBUlDQat7qHnZ__OKw95t0PBy5wH9EaX_xcLLjrzYaG23_B5LRfYFPb_RN5NYQQSnB73ODtOplfSUbnRwsR7yyRxSBvKHj7TPUgX_PLut5KOPA
hxxp://catalinahub.com/update/check
hxxp://catalinahub.silvercdn.com/download/citrio_41.0.2272.256_1.exe
hxxp://a767.g.akamai.net/msdownload/update/v3/static/trustedr/en/authrootseq.txt
hxxp://a767.g.akamai.net/msdownload/update/v3/static/trustedr/en/authrootstl.cab
hxxp://www.gstatic.com/chrome/profile_avatars/NothingToDownload
hxxp://catalinahub.com/citrio/promo/1?dist=stable&osname=win&branding=41.0.2272.256&osver=5.1 SP3&hl=en-US
hxxp://catalinahub.com/update/extension?response=updatecheck&os=win&arch=x86&nacl_arch=x86-32&prod=chromiumcrx&prodchannel=stable&prodversion=41.0.2272.256&lang=en-US&x=id=hjinflocgjpjihbgdlipilmjlbkjkmak&v=0.0.0.0&uc&uid={802C7BA9-B484-4EEE-84A7-5BB18059CB01}
hxxp://catalinahub.silvercdn.com/download/extensions/mediaplayer_0.0.5.crx
hxxp://catalinahub.com/citrio/provided-data/1?user_id={802C7BA9-B484-4EEE-84A7-5BB18059CB01}&browser_version=41.0.2272.256&browser_buildtype=1&request_homepage=true&request_search_engine=true&request_ntp_search=true
hxxp://www.citrio.com/welcome.html?intl=en
hxxp://www.citrio.com/welcome?intl=en
hxxp://www.citrio.com/resources/css/main.css?v=7
hxxp://www-google-analytics.l.google.com/r/__utm.gif?utmwv=5.6.4&utms=1&utmn=304882759&utmhn=www.citrio.com&utmcs=UTF-8&utmsr=1276x846&utmvp=1040x677&utmsc=24-bit&utmul=en-us&utmje=1&utmfl=17.0 r0&utmdt=Citrio browser&utmhid=1139682178&utmr=-&utmp=/welcome?intl=en&utmht=1431508120073&utmac=UA-40355395-1&utmcc=__utma=213201158.1092086691.1431508120.1431508120.1431508120.1;+__utmz=213201158.1431508120.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=1496462959&utmredir=1&utmu=DAAAAAAAAAAAAAAAAAAAAAAE~
hxxp://www.citrio.com/resources/fonts/museo-300.woff
hxxp://www.citrio.com/resources/fonts/museo-500.woff
hxxp://www.citrio.com/resources/fonts/museo-700.otf
hxxp://www.citrio.com/resources/images/logo.svg
hxxp://www.citrio.com/resources/images/landing/bg-full-win.png
hxxp://www.citrio.com/resources/images/fourth_03.svg
hxxp://e3821.dspe1.akamaiedge.net/uk_UA/sdk.js
hxxp://mc.yandex.ru/metrika/watch.js
hxxp://www.citrio.com/resources/images/accelerator.png
hxxp://www.citrio.com/resources/images/proxy.png
hxxp://www.citrio.com/resources/images/third.png
hxxp://www.citrio.com/resources/images/third_02.svg
hxxp://www.citrio.com/resources/images/fourth_01.svg
hxxp://www.citrio.com/resources/images/tw.svg

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

POST /update/ping HTTP/1.1

User-Agent: Google Update/1.3.25.215;winhttp

X-Last-HR: 0x800421f4

X-Last-HTTP-Status-Code: 500

X-Retry-Count: 0

Host: catalinahub.com

Content-Length: 613

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

<?xml version="1.0" encoding="UTF-8"?><request protocol="3.0" version="1.3.25.215" ismachine="0" sessionid="{CD858DB3-E8C7-4B70-8AE9-A56F0EF43D45}" userid="{802C7BA9-B484-4EEE-84A7-5BB18059CB01}" installsource="taggedmi" testsource="auto" requestid="{FF8F5362-DD2E-4B88-BE2A-D640C39BCA8F}"><os platform="win" version="5.1" sp="Service Pack 3" arch="x86"/><app appid="{6C598730-F715-407B-A7AE-A8F10D0F8FA7}" version="" nextversion="1.3.25.215" buildtype="" lang="en" brand="" client="" iid="{2F851C43-A7C8-4061-8931-F5533108A703}"><event eventtype="2" eventresult="1" errorcode="0" extracode1="0"/></app></request>

HTTP/1.1 500 Internal Server Error

Date: Wed, 13 May 2015 09:07:13 GMT

Server: Apache-Coyote/1.1

Content-Type: text/html;charset=utf-8

Content-Length: 4975

Connection: close

<html><head><title>Apache Tomcat/7.0.41 - Error report</title><style><!--H1 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:22px;} H2 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:16px;} H3 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:14px;} BODY {font-family:Tahoma,Arial,sans-serif;color:black;background-color:white;} B {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;} P {font-family:Tahoma,Arial,sans-serif;background:white;color:black;font-size:12px;}A {color : black;}A.name {color : black;}HR {color : #525D76;}--></style> </head><body><h1>HTTP Status 500 - Request processing failed; nested exception is java.lang.NullPointerException</h1><HR size="1" noshade="noshade"><p><b>type</b> Exception report</p><p><b>message</b> <u>Request processing failed; nested exception is java.lang.NullPointerException</u></p><p><b>description</b> <u>The server encountered an internal error that prevented it from fulfilling this request.</u></p><p><b>exception</b> <pre>org.springframework.web.util.NestedServletException: Request processing failed; nested exception is java.lang.NullPointerException..org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:894)..org.springframe

<<< skipped >>>

GET /citrio/promo/1?dist=stable&osname=win&branding=41.0.2272.256&osver=5.1 SP3&hl=en-US HTTP/1.1

Host: catalinahub.com

Connection: keep-alive

User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.256 Safari/537.36

Accept-Encoding: gzip, deflate

HTTP/1.1 200 OK

Date: Wed, 13 May 2015 09:08:28 GMT

Server: Apache-Coyote/1.1

Accept-Ranges: bytes

ETag: W/"306-1400161181000"

Last-Modified: Thu, 15 May 2014 13:39:41 GMT

Content-Length: 306

Connection: close

Content-Type: text/plain; charset=UTF-8

{.."url_promo":..[{..."identifier":1,..."date":[{"start":"15-may-2014 00:00","end":"30-may-2014 23:59"}],..."strings":{"URL":"hXXp://citrio.com/announcements/announcement_33_0_1750_237.html"},..."grouping":{"buckets":1,"segment":1,"increment_max":1},..."max_views":5,..."min_version":"33.0.1750.237"..}]..}..

GET /resources/fonts/museo-500.woff HTTP/1.1

Host: VVV.citrio.com

Connection: keep-alive

User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.256 Safari/537.36

Accept: */*

Referer: hXXp://VVV.citrio.com/resources/css/main.css?v=7

X-Citrio-Timestamp: Iqh6TjevTuxEjVzfitaOBgq 0LI= 2015-05-13T09:08:40.267Z

Accept-Encoding: gzip, deflate, sdch

Accept-Language: en-US,en;q=0.8

Cookie: __utmt=1; __utma=213201158.1092086691.1431508120.1431508120.1431508120.1; __utmb=213201158.1.10.1431508120; __utmc=213201158; __utmz=213201158.1431508120.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)

HTTP/1.1 200 OK

Date: Wed, 13 May 2015 09:08:42 GMT

Server: Apache/2.2.15 (CentOS)

Last-Modified: Fri, 17 Oct 2014 10:03:38 GMT

ETag: "63e0d3c-10600-5059b7a91d280"

Accept-Ranges: bytes

Content-Length: 67072

Connection: close

Content-Type: text/plain; charset=UTF-8

wOFF........................................FFTM............f?>.GDEF......."...&...ZGPOS......%.....!.n.GSUB..'........z.a..OS/2..)@...N...`...dcmap..)....R...N....cvt .. ....:...:....fpgm.., .......eS./.gasp..-.............glyf..-....l...<Q_<.head...H...3...6....hhea...|...!...$....hmtx......./...D.l..loca............lg.rmaxp...t... ... .p..name............[..qpost...$............prep...@.......".*..webf.............$Q..........=.......';.......`.x.c`d``..b9..`.BF&. .e...Y.b..... ..x..}.tTe~......d...y.u.C.nQWA..1...Bt...,...E...y.u..(R..R^JY.rx=.4.p8).4]..!....M.9.....i.q:;.........wf...3...I.z...........K...i>-....,XL.V...s4..U....P6\IJ.}.9....{...U<.....H...M......#..%..]...._.Op.k_.Vj.h'..._k..].*..#...{..d..Z..f.[Y.p~...........%>..f.s./f.2.r.]9...QNe....9?..$...@...........]..&.2.*.t....r?....K#4..9.g.#..[G.7....GT.....r......~$.N......-.;.w$.6.L...~......w......_..~...3......7..`,b..`R................>-.j....p..}Q....../. ..7>]...5............U.o.....T..b..p_..K]?..............t.ZT\tc..ES....[T^....ES.~..7..-:Vt.Ou.../Q. .~[tI..u....rh.....KO...]..M..n...5.e.....5;.....>Z.$y......Tv.h.Acd.-.....V..."..H..(;.......Q......U.D.....J.N9}N7...F.D..U....|.E...T*.!.s.'.j.]O%2..6!U/.:..F#...q.g4..t".F.S....O..)[.A. .!..x>J..[MYT.2.D...>..zP..T&.i#.....qT...\....P}....7.R..A...^..:..G......%....l.J`g.l.k/...xV............&........Hm..i(i..&....A...[...0.yT.6..(K.".....8T.U.....n....j.?@}.... .>C........#..#q....9.o..5.e..|=.|...m.Z!;.d3....%xV...,m...v1.. .;9.\...H.....v....?.

<<< skipped >>>

GET /citrio/provided-data/1?user_id={802C7BA9-B484-4EEE-84A7-5BB18059CB01}&browser_version=41.0.2272.256&browser_buildtype=1&request_homepage=true&request_search_engine=true&request_ntp_search=true HTTP/1.1

Host: catalinahub.com

Connection: keep-alive

User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.256 Safari/537.36

Accept-Encoding: gzip, deflate

HTTP/1.1 200 OK

Date: Wed, 13 May 2015 09:08:36 GMT

Server: Apache-Coyote/1.1

Content-Type: text/plain;charset=UTF-8

Connection: close

Transfer-Encoding: chunked

512..<?xml version="1.0" encoding="UTF-8"?>.<provided_data api_version="1">. <homepage url="hXXp://google.com" />. <search_engine. name="google". keyword="google.com". favicon_url="hXXp://VVV.google.com/favicon.ico". search_url="{google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}". suggest_url="{google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter}". />. <ntp_search. favicon_url="hXXp://VVV.google.com/favicon.ico". search_url="{google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}". suggest_url="{google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter}". />.</provided_data>..0..

GET /update/extension?response=updatecheck&os=win&arch=x86&nacl_arch=x86-32&prod=chromiumcrx&prodchannel=stable&prodversion=41.0.2272.256&lang=en-US&x=id=hjinflocgjpjihbgdlipilmjlbkjkmak&v=0.0.0.0&uc&uid={802C7BA9-B484-4EEE-84A7-5BB18059CB01} HTTP/1.1

Host: catalinahub.com

Connection: keep-alive

User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.256 Safari/537.36

X-Citrio-Timestamp: mxgf1JX0co XIMzk3La9IGmLbOw= 2015-05-13T09:08:25.841Z

Accept-Encoding: gzip, deflate, sdch

Accept-Language: en-US,en;q=0.8

HTTP/1.1 200 OK

Date: Wed, 13 May 2015 09:08:28 GMT

Server: Apache-Coyote/1.1

Content-Type: application/xml;charset=UTF-8

Connection: close

Transfer-Encoding: chunked

174..<?xml version="1.0" encoding="UTF-8" standalone="yes"?><gupdate protocol="2.0" xmlns="hXXp://VVV.google.com/update2/response"><app appid="hjinflocgjpjihbgdlipilmjlbkjkmak" status="ok"><updatecheck status="ok" version="0.0.5" codebase="hXXp://static.citrio.com/download/extensions/mediaplayer_0.0.5.crx" hash="XAJujXl2ufg8 h67 rAnoD66vLo=" size="31547651"/></app></gupdate>..0..

POST /update/ping HTTP/1.1

User-Agent: Google Update/1.3.25.215;winhttp

X-Last-HR: 0x800421f4

X-Last-HTTP-Status-Code: 500

X-Retry-Count: 1

Host: catalinahub.com

Content-Length: 613

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

<?xml version="1.0" encoding="UTF-8"?><request protocol="3.0" version="1.3.25.215" ismachine="0" sessionid="{CD858DB3-E8C7-4B70-8AE9-A56F0EF43D45}" userid="{802C7BA9-B484-4EEE-84A7-5BB18059CB01}" installsource="taggedmi" testsource="auto" requestid="{FF8F5362-DD2E-4B88-BE2A-D640C39BCA8F}"><os platform="win" version="5.1" sp="Service Pack 3" arch="x86"/><app appid="{6C598730-F715-407B-A7AE-A8F10D0F8FA7}" version="" nextversion="1.3.25.215" buildtype="" lang="en" brand="" client="" iid="{2F851C43-A7C8-4061-8931-F5533108A703}"><event eventtype="2" eventresult="1" errorcode="0" extracode1="0"/></app></request>

HTTP/1.1 500 Internal Server Error

Date: Wed, 13 May 2015 09:07:19 GMT

Server: Apache-Coyote/1.1

Content-Type: text/html;charset=utf-8

Content-Length: 4975

Connection: close

<html><head><title>Apache Tomcat/7.0.41 - Error report</title><style><!--H1 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:22px;} H2 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:16px;} H3 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:14px;} BODY {font-family:Tahoma,Arial,sans-serif;color:black;background-color:white;} B {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;} P {font-family:Tahoma,Arial,sans-serif;background:white;color:black;font-size:12px;}A {color : black;}A.name {color : black;}HR {color : #525D76;}--></style> </head><body><h1>HTTP Status 500 - Request processing failed; nested exception is java.lang.NullPointerException</h1><HR size="1" noshade="noshade"><p><b>type</b> Exception report</p><p><b>message</b> <u>Request processing failed; nested exception is java.lang.NullPointerException</u></p><p><b>description</b> <u>The server encountered an internal error that prevented it from fulfilling this request.</u></p><p><b>exception</b> <pre>org.springframework.web.util.NestedServletException: Request processing failed; nested exception is java.lang.NullPointerException..org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:894)..org.springframe

<<< skipped >>>

POST /update/check?w=3:H0r8iAJfY0HPFbfafxuAsuNAYdcfvoZko0Y55G3J2L8XzWRWZxCNbFQvLX6kLnBUlDQat7qHnZ__OKw95t0PBy5wH9EaX_xcLLjrzYaG23_B5LRfYFPb_RN5NYQQSnB73ODtOplfSUbnRwsR7yyRxSBvKHj7TPUgX_PLut5KOPA HTTP/1.1

User-Agent: Google Update/1.3.25.215;winhttp;cup

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

If-Match: "8PTvtU7Rlc_ahU24MTh4JdQNvd4"

Host: catalinahub.com

Content-Length: 567

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

<?xml version="1.0" encoding="UTF-8"?><request protocol="3.0" version="1.3.25.215" ismachine="0" sessionid="{CD858DB3-E8C7-4B70-8AE9-A56F0EF43D45}" userid="{802C7BA9-B484-4EEE-84A7-5BB18059CB01}" installsource="taggedmi" testsource="auto" requestid="{C266AB80-007A-4178-99B3-FA3D40793BBD}"><os platform="win" version="5.1" sp="Service Pack 3" arch="x86"/><app appid="{92F8A219-E740-49D5-B785-B962AD819724}" version="" nextversion="" buildtype="1" lang="en" brand="" client="" installage="-1" iid="{2F851C43-A7C8-4061-8931-F5533108A703}"><updatecheck/></app></request>

HTTP/1.1 200 OK

Date: Wed, 13 May 2015 09:07:11 GMT

Server: Apache-Coyote/1.1

Content-Type: application/xml;charset=UTF-8

Connection: close

Transfer-Encoding: chunked

2a6..<?xml version="1.0" encoding="UTF-8" standalone="yes"?><response protocol="3.0" server="dist"><dayStart elapsed_seconds="32832"/><app appid="{92F8A219-E740-49D5-B785-B962AD819724}" status="ok"><updatecheck status="ok"><urls><url codebase="hXXp://static.citrio.com/download/"/></urls><manifest version="41.0.2272.256"><packages><package hash="90v/AOStQ2VXeuyrX07HmQ2BMZw=" name="citrio_41.0.2272.256_1.exe" required="true" size="55656848"/></packages><actions><action arguments="--chrome --do-not-launch-chrome" event="install" run="citrio_41.0.2272.256_1.exe"/><action event="postinstall" onsuccess="exitsilentlyonlaunchcmd"/></actions></manifest></updatecheck></app></response>..0..

POST /update/ping HTTP/1.1

User-Agent: Google Update/1.3.25.215;winhttp

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

Host: catalinahub.com

Content-Length: 965

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

<?xml version="1.0" encoding="UTF-8"?><request protocol="3.0" version="1.3.25.215" ismachine="0" sessionid="{CD858DB3-E8C7-4B70-8AE9-A56F0EF43D45}" userid="{802C7BA9-B484-4EEE-84A7-5BB18059CB01}" installsource="taggedmi" testsource="auto" requestid="{694CAC4A-E36D-497E-88A7-A70C9733D683}"><os platform="win" version="5.1" sp="Service Pack 3" arch="x86"/><app appid="{92F8A219-E740-49D5-B785-B962AD819724}" version="" nextversion="41.0.2272.256" buildtype="1" lang="en" brand="" client="" installage="-1" iid="{2F851C43-A7C8-4061-8931-F5533108A703}"><event eventtype="9" eventresult="1" errorcode="0" extracode1="0"/><event eventtype="5" eventresult="1" errorcode="0" extracode1="0"/><event eventtype="1" eventresult="1" errorcode="0" extracode1="0" download_time_ms="54703" downloaded="55656848" total="55656848"/><event eventtype="6" eventresult="1" errorcode="0" extracode1="0"/><event eventtype="2" eventresult="1" errorcode="0" extracode1="0"/></app></request>

HTTP/1.1 200 OK

Date: Wed, 13 May 2015 09:08:26 GMT

Server: Apache-Coyote/1.1

Content-Type: application/xml;charset=UTF-8

Connection: close

Transfer-Encoding: chunked

136..<?xml version="1.0" encoding="UTF-8" standalone="yes"?><response protocol="3.0" server="dist"><dayStart elapsed_seconds="32906"/><app appid="{92F8A219-E740-49D5-B785-B962AD819724}" status="ok"><event status="ok"/><event status="ok"/><event status="ok"/><event status="ok"/><event status="ok"/></app></response>..0..

GET /resources/images/third_02.svg HTTP/1.1

Host: VVV.citrio.com

Connection: keep-alive

Accept: image/webp,*/*;q=0.8

User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.256 Safari/537.36

Referer: hXXp://VVV.citrio.com/resources/css/main.css?v=7

X-Citrio-Timestamp: jXBGigczEmCnNmCbu3g7vsxQcb0= 2015-05-13T09:08:40.911Z

Accept-Encoding: gzip, deflate, sdch

Accept-Language: en-US,en;q=0.8

Cookie: __utmt=1; __utma=213201158.1092086691.1431508120.1431508120.1431508120.1; __utmb=213201158.1.10.1431508120; __utmc=213201158; __utmz=213201158.1431508120.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)

HTTP/1.1 200 OK

Date: Wed, 13 May 2015 09:08:43 GMT

Server: Apache/2.2.15 (CentOS)

Last-Modified: Fri, 17 Oct 2014 10:03:37 GMT

ETag: "63e0c53-ef9-5059b7a829040"

Accept-Ranges: bytes

Content-Length: 3833

Connection: close

Content-Type: image/svg xml

<svg xmlns="hXXp://VVV.w3.org/2000/svg" xmlns:xlink="hXXp://VVV.w3.org/1999/xlink" width="24px" height="70px">...<defs>... <path id="q" d="M16.746,17.573c-0.286,0-0.56,0.09-0.794,0.26c-1.161,0.841-2.521,1.285-3.933,1.285l-0.1-0.001.. ...c-0.204-0.003-0.389-0.013-0.565-0.029c-0.048-0.004-0.096-0.011-0.144-0.018l-0.086-0.012c-0.145-0.019-0.291-0.039-0.435-0.069.. ...c-0.076-0.016-0.15-0.034-0.225-0.053l-0.036-0.009c-0.14-0.034-0.279-0.067-0.415-0.11c-0.038-0.012-0.076-0.025-0.113-0.039.. ...L9.82,18.75c-0.192-0.066-0.336-0.121-0.469-0.178c-0.03-0.013-0.059-0.027-0.1-0.046c-0.198-0.089-0.369-0.175-0.524-0.263.. ...l-0.124,0.235l0.101-0.248c-0.576-0.326-1.104-0.734-1.568-1.214l-0.022-0.024c-0.141-0.148-0.279-0.305-0.413-0.472.. ...c-0.014-0.017-0.079-0.104-0.079-0.104c-0.934-1.208-1.452-2.646-1.506-4.173h1.618l0.215-0.416L3.94,7.176H3.509L0.5,11.846.. ...l0.215,0.416h1.626c0.05,1.935,0.637,3.797,1.704,5.396c0.013,0.026,0.026,0.05,0.041,0.071c0.083,0.123,0.173,0.24,0.263,0.355.. ...l0.091,0.118l0.047,0.064c0.029,0.04,0.057,0.079,0.087,0.115c0.159,0.198,0.34,0.405,0.555,0.632l0.055,0.058.. ...c0.641,0.665,1.372,1.232,2.186,1.694c0.019,0.012,0.038,0.023,0.049,0.028c0.226,0.126,0.456,0.241,0.704,0.352l0.177,0.082.. ...c0.186,0.079,0.385,0.155,0.622,0.235c0.101,0.036,0.201,0.073,0.303,0.104c0.18,0.056,0.366,0.103,0.566,0.152l0.13,0.031.. ...c0.081,0.02,0.163,0.039,0.248,0.057c0.019,0.004,0.037,0.008,0.055,0.013c0.035,0.008,0.069,0.01

<<< skipped >>>

GET /resources/images/third.png HTTP/1.1

Host: VVV.citrio.com

Connection: keep-alive

Accept: image/webp,*/*;q=0.8

User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.256 Safari/537.36

Referer: hXXp://VVV.citrio.com/resources/css/main.css?v=7

X-Citrio-Timestamp: 3WRnD35f26X4Urm0ToXcm HVGxQ= 2015-05-13T09:08:40.910Z

Accept-Encoding: gzip, deflate, sdch

Accept-Language: en-US,en;q=0.8

Cookie: __utmt=1; __utma=213201158.1092086691.1431508120.1431508120.1431508120.1; __utmb=213201158.1.10.1431508120; __utmc=213201158; __utmz=213201158.1431508120.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)

HTTP/1.1 200 OK

Date: Wed, 13 May 2015 09:08:43 GMT

Server: Apache/2.2.15 (CentOS)

Last-Modified: Thu, 16 Apr 2015 12:32:58 GMT

ETag: "63e0d37-199d4-513d6a9e77280"

Accept-Ranges: bytes

Content-Length: 104916

Connection: close

Content-Type: image/png

.PNG........IHDR.............X.......tEXtSoftware.Adobe ImageReadyq.e<...(iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.155772, 2014/01/13-19:44:00 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2014 (Macintosh)" xmpMM:InstanceID="xmp.iid:715AD06FDC5711E4B616BE53B21A867E" xmpMM:DocumentID="xmp.did:715AD070DC5711E4B616BE53B21A867E"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:715AD06DDC5711E4B616BE53B21A867E" stRef:documentID="xmp.did:715AD06EDC5711E4B616BE53B21A867E"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..'/...BIDATx....|......]w....%[...m\h..S.J.).MB ....... $.$$t....p..K.e...;.z...o..s6n......#.......y.......p<.....H$Rp8....9.H$.v.\.......K....p.,..._......p8g..&...p8\09........p8...L....p.`r8........p8........p..p8........p8........p..p8....&...p8\09........p8...L....p8\09...........].......R.p)..yN..Z.J..1b....O.w..1466..G.....*..%.\r......{....w.hmm..............N...7..t....M..p8..!?.).~....s_.....`\.9-.n.:......M.......}...X.t)JJJ......>.......r..W_}U...X.h.n..6dee}cN...7...2.w...b......../LS*..........'|&&&...:.N.....Boo..===..yg...Y......y.O =.):.X....\.....y..O.Mr....\..

<<< skipped >>>

GET /resources/fonts/museo-700.otf HTTP/1.1

Host: VVV.citrio.com

Connection: keep-alive

User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.256 Safari/537.36

Accept: */*

Referer: hXXp://VVV.citrio.com/resources/css/main.css?v=7

X-Citrio-Timestamp: m5S7yOylrpzfpRS6AomoMqBdewQ= 2015-05-13T09:08:40.288Z

Accept-Encoding: gzip, deflate, sdch

Accept-Language: en-US,en;q=0.8

Cookie: __utmt=1; __utma=213201158.1092086691.1431508120.1431508120.1431508120.1; __utmb=213201158.1.10.1431508120; __utmc=213201158; __utmz=213201158.1431508120.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)

HTTP/1.1 200 OK

Date: Wed, 13 May 2015 09:08:42 GMT

Server: Apache/2.2.15 (CentOS)

Last-Modified: Fri, 17 Oct 2014 10:03:38 GMT

ETag: "63e0d3e-1a0d8-5059b7a91d280"

Accept-Ranges: bytes

Content-Length: 106712

Connection: close

Content-Type: application/vnd.oasis.opendocument.formula-template

OTTO.......0CFF ............GPOS..l.........GSUB.o.n.......LOS/2....... ...`cmap..G.... ....head.w.........6hhea...........$hmtxF.z.........maxp..P.........namev...........post...2....... ............_.<..........';......F.<...).n...............................n....................P........K.X.......X...K...X...^.2.,............................xljb... ............ ............ . .......n.........8.............8...........G.........&.J...........p.................................*.........................................................................8...........G.........p...........&.{.....................L..........."......................."...........T.7.................................:.................................................)Copyright (c) 2012 by Jos Buivenga. All rights reserved.Museo Sans Cyrl700JosBuivenga: Museo Sans Cyrl 700: 2012Museo Sans Cyrl 700Version 1.023MuseoSansCyrl-700Museo Sans is a trademark of Jos Buivenga.Jos BuivengaSpaced and kerned with iKern.hXXp://VVV.exljbris.com.C.o.p.y.r.i.g.h.t. .(.c.). .2.0.1.2. .b.y. .J.o.s. .B.u.i.v.e.n.g.a... .A.l.l. .r.i.g.h.t.s. .r.e.s.e.r.v.e.d...M.u.s.e.o. .S.a.n.s. .C.y.r.l. .7.0.0.R.e.g.u.l.a.r.J.o.s.B.u.i.v.e.n.g.a.:. .M.u.s.e.o. .S.a.n.s. .C.y.r.l. .7.0.0.:. .2.0.1.2.M.u.s.e.o.S.a.n.s.C.y.r.l.-.7.0.0.V.e.r.s.i.o.n. .1...0.2.3.M.u.s.e.o. .S.a.n.s. .i.s. .a. .t.r.a.d.e.m.a.r.k. .o.f. .J.o.s. .B.u.i.v.e.n.g.a...J.o.s. .B.u.i.v.e.n.g.a.S.p.a.c.e.d. .a.n.d. .k.e.r.n.e.d. .w.i.t.h. .i.K.e.r.n...h.t.t.p.:././.w.w.w...e.x.l.j.b.r.i.s...c.o.m.

<<< skipped >>>

GET /download/citrio_41.0.2272.256_1.exe HTTP/1.1

Accept: */*

Accept-Encoding: identity

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

User-Agent: Microsoft BITS/6.7

Host: static.citrio.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 13 May 2015 08:32:02 GMT

Server: Apache-Coyote/1.1

ETag: W/"55656848-1431505908000"

Last-Modified: Wed, 13 May 2015 08:31:48 GMT

Content-Type: application/octet-stream;charset=UTF-8

Age: 2111

Content-Length: 55656848

Connection: close

Accept-Ranges: bytes

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}.Y49x7g9x7g9x7g...g>x7g9x6g.x7gD..g>x7g4*.g8x7g9x.g:x7gD..g8x7gRich9x7g........................PE..L...).KU................."....Q......!.......@....@...........................Q.....}XQ......................................P..P....`....Q..........4Q......pQ.t.......8............................................P...............................text...Z!.......".................. ..`.data........@......................@....idata.......P.......&..............@..@.rsrc.....Q..`....Q..,..............@..@.reloc..t....pQ......2Q.............@..B....................................................................................................................................................................................................................................................................................................................................................................).KU........g...H...H.......).KU....................{.9.2.F.8.A.2.1.9.-.E.7.4.0.-.4.9.D.5.-.B.7.8.5.-.B.9.6.2.A.D.8.1.9.7.2.4.}.....{.E.9.F.2.4.A.7.C.-.1.3.C.A.-.4.2.F.B.-.A.4.D.9.-.7.9.C.3.C.9.D.2.1.B.2.8.}.....{.0.1.0.5.E.A.0.2.-.8.0.2.D.-.4.B.3.7.-.8.1.6.1.-.4.E.D.2.5.C.4.9.3.2.6.6.}.....{.D.E.2.8.A.2.E.A.-.7.7.F.A.-.4.F.2.B.-.8.2.5.2.-.C.3.B.5.8.4.4.F.6.4.5.5.}.....{.F.0.B.5.0.D.5.A.-.4.B.B.A.-.4.5.1.4.-.A.D.2.C.-.E.B.A.5.0.C.2.9.C.4.6.0.}.....-.-.c.h.r.o.m.e.-.s.x.s.....-.-.c.h.r.o.m.e.....-.

<<< skipped >>>

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

CatalinaCrashHandler.exe_2412:

.text

.text

`.data

`.data

.text/DE

.text/DE

@.rsrc

@.rsrc

@.reloc

@.reloc

SHELL32.dll

SHELL32.dll

USER32.dll

USER32.dll

SHLWAPI.dll

SHLWAPI.dll

WINTRUST.dll

WINTRUST.dll

Please contact the application's support team for more information.

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- CRT not initialized

- floating point support not loaded

- floating point support not loaded

GetProcessWindowStation

GetProcessWindowStation

USER32.DLL

USER32.DLL

operator

operator

CatalinaUpdate_unsigned.pdb

CatalinaUpdate_unsigned.pdb

RegOpenKeyExW

RegOpenKeyExW

ADVAPI32.dll

ADVAPI32.dll

KERNEL32.dll

KERNEL32.dll

ole32.dll

ole32.dll

GetProcessHeap

GetProcessHeap

GetCPInfo

GetCPInfo

GetConsoleOutputCP

GetConsoleOutputCP

name="Microsoft.Windows.Common-Controls"

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

publicKeyToken="6595b64144ccf1df"

###7777_{

###7777_{

###____777

###____777

###````87{

###````87{

3 3$3(3,30343~3

3 3$3(3,30343~3

5 5$5(5,5

5 5$5(5,5

?$?(?,?4?

?$?(?,?4?

= =$=@=`=

= =$=@=`=

%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\CatalinaCrashHandler.exe

%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\CatalinaCrashHandler.exe

KERNEL32.DLL

KERNEL32.DLL

mscoree.dll

mscoree.dll

goopdate.dll

goopdate.dll

CatalinaUpdate.exe

CatalinaUpdate.exe

Software\CatalinaGroup\Update\Clients\{6C598730-F715-407B-A7AE-A8F10D0F8FA7}

Software\CatalinaGroup\Update\Clients\{6C598730-F715-407B-A7AE-A8F10D0F8FA7}

1.3.25.215

1.3.25.215

2007-2010

2007-2010

2007-2010

2007-2010

citrio.exe_2808:

.text

.text

`.rdata

`.rdata

@.data

@.data

.rsrc

.rsrc

@.reloc

@.reloc

SHA256 block transform for x86, CRYPTOGAMS by

SHA256 block transform for x86, CRYPTOGAMS by

HtdHtHHHt.HH

HtdHtHHHt.HH

j.Yf;

j.Yf;

_tcPVj@

_tcPVj@

.PjRW

.PjRW

c:\jenkins\workspace\citrio-dev\browser\src\chrome\app\chrome_exe_main_win.cc

c:\jenkins\workspace\citrio-dev\browser\src\chrome\app\chrome_exe_main_win.cc

c:\jenkins\workspace\citrio-dev\browser\src\chrome\app\chrome_watcher_command_line_win.cc

c:\jenkins\workspace\citrio-dev\browser\src\chrome\app\chrome_watcher_command_line_win.cc

No valid Chrome version found

No valid Chrome version found

c:\jenkins\workspace\citrio-dev\browser\src\chrome\app\client_util.cc

c:\jenkins\workspace\citrio-dev\browser\src\chrome\app\client_util.cc

Failed to load Chrome DLL from

Failed to load Chrome DLL from

ChromeMain

ChromeMain

RelaunchChromeBrowserWithNewCommandLineIfNeeded

RelaunchChromeBrowserWithNewCommandLineIfNeeded

Could not find exported function

Could not find exported function

1.3.21.115

1.3.21.115

%s-x-x

%s-x-x

Chrome

Chrome

0.0.0.0-devel

0.0.0.0-devel

%s-%x

%s-%x

font_key_name

font_key_name

url-chunk

url-chunk

subresource_url

subresource_url

c:\jenkins\workspace\citrio-dev\browser\src\components\browser_watcher\watcher_client_win.cc

c:\jenkins\workspace\citrio-dev\browser\src\components\browser_watcher\watcher_client_win.cc

CHROME_MAIN_TIME

CHROME_MAIN_TIME

c:\jenkins\workspace\citrio-dev\browser\src\chrome\installer\util\google_update_settings.cc

c:\jenkins\workspace\citrio-dev\browser\src\chrome\installer\util\google_update_settings.cc

Failed to write to application's ClientState key

Failed to write to application's ClientState key

Removed incremental installer failure key; switching to channel:

Removed incremental installer failure key; switching to channel:

Removed multi-install failure key; switching to channel:

Removed multi-install failure key; switching to channel:

chrome-sxs

chrome-sxs

googlechrome

googlechrome

c:\jenkins\workspace\citrio-dev\browser\src\chrome\installer\util\channel_info.cc

c:\jenkins\workspace\citrio-dev\browser\src\chrome\installer\util\channel_info.cc

Cannot initialize AppCommands from an invalid key.

Cannot initialize AppCommands from an invalid key.

c:\jenkins\workspace\citrio-dev\browser\src\chrome\installer\util\app_commands.cc

c:\jenkins\workspace\citrio-dev\browser\src\chrome\installer\util\app_commands.cc

Failed to open key "

Failed to open key "

Skipping over key "

Skipping over key "

iexplore.exe

iexplore.exe

googlechromeapphost

googlechromeapphost

googlechromeframe

googlechromeframe

Cannot initialize an AppCommand from an invalid key.

Cannot initialize an AppCommand from an invalid key.

c:\jenkins\workspace\citrio-dev\browser\src\chrome\installer\util\app_command.cc

c:\jenkins\workspace\citrio-dev\browser\src\chrome\installer\util\app_command.cc

c:\jenkins\workspace\citrio-dev\browser\src\chrome\installer\util\language_selector.cc

c:\jenkins\workspace\citrio-dev\browser\src\chrome\installer\util\language_selector.cc

CHROME_BREAKPAD_PIPE_NAME

CHROME_BREAKPAD_PIPE_NAME

c:\jenkins\workspace\citrio-dev\browser\src\components\crash\app\breakpad_win.cc

c:\jenkins\workspace\citrio-dev\browser\src\components\crash\app\breakpad_win.cc

NTDLL.DLL

NTDLL.DLL

kernel32.dll

kernel32.dll

c:\jenkins\workspace\citrio-dev\browser\src\sandbox\win\src\sandbox_policy_base.cc

c:\jenkins\workspace\citrio-dev\browser\src\sandbox\win\src\sandbox_policy_base.cc

CreateNamedPipeW

CreateNamedPipeW

NtCreateKey

NtCreateKey

NtOpenKey

NtOpenKey

NtOpenKeyEx

NtOpenKeyEx

MetricsReportingEnabled

MetricsReportingEnabled

CHROME_VERSION

CHROME_VERSION

41.0.2272.256

41.0.2272.256

CHROME_HEADLESS

CHROME_HEADLESS

CHROME_METRO_CONNECTED

CHROME_METRO_CONNECTED

CHROME_CRASHED

CHROME_CRASHED

CHROME_RESTART

CHROME_RESTART

chrome.googleechotest.com

chrome.googleechotest.com

user_experience_metrics.reporting_enabled

user_experience_metrics.reporting_enabled

SHELL32.dll

SHELL32.dll

ole32.dll

ole32.dll

OLEAUT32.dll

OLEAUT32.dll

function not supported

function not supported

operation canceled

operation canceled

address_family_not_supported

address_family_not_supported

operation_in_progress

operation_in_progress

operation_not_supported

operation_not_supported

protocol_not_supported

protocol_not_supported

operation_would_block

operation_would_block

address family not supported

address family not supported

broken pipe

broken pipe

inappropriate io control operation

inappropriate io control operation

not supported

not supported

operation in progress

operation in progress

operation not permitted

operation not permitted

operation not supported

operation not supported

operation would block

operation would block

protocol not supported

protocol not supported

GetProcessWindowStation

GetProcessWindowStation

operator

operator

(0x%X)

(0x%X)

Error (0x%X) while retrieving error. (0x%X)

Error (0x%X) while retrieving error. (0x%X)

%s-%Iu

%s-%Iu

(%d = %3.1f%%)

(%d = %3.1f%%)

Histogram: %s recorded %d samples

Histogram: %s recorded %d samples

(flags = 0x%x)

(flags = 0x%x)

PlatformFile.UnknownErrors.Windows

PlatformFile.UnknownErrors.Windows

user32.dll

user32.dll

0123456789

0123456789

\uX

\uX

.syzygy

.syzygy

.thunks

.thunks

Dictionary keys must be quoted.

Dictionary keys must be quoted.

Unsupported encoding. JSON must be UTF-8.

Unsupported encoding. JSON must be UTF-8.

Line: %i, column: %i, %s

Line: %i, column: %i, %s

full-memory-crash-report

full-memory-crash-report

c:\jenkins\workspace\Citrio-Dev\browser\src\out\Release\initialexe\citrio.exe.pdb

c:\jenkins\workspace\Citrio-Dev\browser\src\out\Release\initialexe\citrio.exe.pdb

citrio.exe

citrio.exe

ClearBreakpadPipeEnvironmentVariable

ClearBreakpadPipeEnvironmentVariable

ClearCrashKeyValueImpl

ClearCrashKeyValueImpl

SetCrashKeyValueImpl

SetCrashKeyValueImpl

SignalChromeElf

SignalChromeElf

citrio_elf.dll

citrio_elf.dll

VERSION.dll

VERSION.dll

WINMM.dll

WINMM.dll

RegCreateKeyExW

RegCreateKeyExW

RegQueryInfoKeyW

RegQueryInfoKeyW

RegOpenKeyExW

RegOpenKeyExW

RegEnumKeyExW

RegEnumKeyExW

RegCloseKey

RegCloseKey

ADVAPI32.dll

ADVAPI32.dll

CloseWindowStation

CloseWindowStation

CreateWindowStationW

CreateWindowStationW

SetProcessWindowStation

SetProcessWindowStation

USER32.dll

USER32.dll

GetProcessHeap

GetProcessHeap

GetWindowsDirectoryW

GetWindowsDirectoryW

CreateIoCompletionPort

CreateIoCompletionPort

GetProcessHandleCount

GetProcessHandleCount

KERNEL32.dll

KERNEL32.dll

USERENV.dll

USERENV.dll

WTSAPI32.dll

WTSAPI32.dll

GetCPInfo

GetCPInfo

SetNamedPipeHandleState

SetNamedPipeHandleState

TransactNamedPipe

TransactNamedPipe

WaitNamedPipeW

WaitNamedPipeW

zcÁ

zcÁ

41.0.2272.256-00000af8-00055f5d

41.0.2272.256-00000af8-00055f5d

444.44...4

444.44...4

4.4....4.

4.4....4.

..44.44@4

..44.44@4

4@444@4.

4@444@4.

.4@4@@4.

.4@4@@4.

}.GnO

}.GnO

Ôjo

Ôjo

k.SZ[

k.SZ[

j.oii

j.oii

8%8s8

8%8s8

30}0#1\1

30}0#1\1

0!0%0)0-0105090

0!0%0)0-0105090

0 0(00080

0 0(00080

8(9,909\9

8(9,909\9

= =$=(=,=0=4=8=

= =$=(=,=0=4=8=

3 3$3,3@3`3

3 3$3,3@3`3

chrome_watcher.dll

chrome_watcher.dll

{0105EA02-802D-4B37-8161-4ED25C493266}

{0105EA02-802D-4B37-8161-4ED25C493266}

app_host.exe

app_host.exe

citrio.dll

citrio.dll

citrio_child.dll

citrio_child.dll

metro_driver.dll

metro_driver.dll

{E9F24A7C-13CA-42FB-A4D9-79C3C9D21B28}

{E9F24A7C-13CA-42FB-A4D9-79C3C9D21B28}

ChromeCanary

ChromeCanary

ChromeSSHTM

ChromeSSHTM

Chrome Canary HTML Document

Chrome Canary HTML Document

{1BEAC3E3-B852-44F4-B468-8906C062422E}

{1BEAC3E3-B852-44F4-B468-8906C062422E}

BGoogle Chrome Canary

BGoogle Chrome Canary

{3599E25E-6314-4BE9-AE14-E51877342426}

{3599E25E-6314-4BE9-AE14-E51877342426}

{675046A3-9F4F-4805-A81C-CBF753FE3428}

{675046A3-9F4F-4805-A81C-CBF753FE3428}

Browse the web

Browse the web

Software\Microsoft\Windows\CurrentVersion\Uninstall\Citrio

Software\Microsoft\Windows\CurrentVersion\Uninstall\Citrio

-chrome

-chrome

-chromeframe

-chromeframe

WebAccessible

WebAccessible

{92F8A219-E740-49D5-B785-B962AD819724}

{92F8A219-E740-49D5-B785-B962AD819724}

{8BF2F61B-E8C2-4A67-85D0-D6A69F9FD948}

{8BF2F61B-E8C2-4A67-85D0-D6A69F9FD948}

hXXp://VVV.citrio.com/goodbye.html?intl=$1

hXXp://VVV.citrio.com/goodbye.html?intl=$1

%d.%d.%d

%d.%d.%d

BGoogle Chrome App Launcher

BGoogle Chrome App Launcher

ChromeAppList

ChromeAppList

Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome App Launcher

Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome App Launcher

{DE28A2EA-77FA-4F2B-8252-C3B5844F6455}

{DE28A2EA-77FA-4F2B-8252-C3B5844F6455}

BGoogle Chrome Frame

BGoogle Chrome Frame

Chrome in a Frame.

Chrome in a Frame.

Uninstall Chrome Frame

Uninstall Chrome Frame

Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome Frame

Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome Frame

{F0B50D5A-4BBA-4514-AD2C-EBA50C29C460}

{F0B50D5A-4BBA-4514-AD2C-EBA50C29C460}

Google Chrome binaries

Google Chrome binaries

\\.\pipe\GoogleCrashServices\

\\.\pipe\GoogleCrashServices\

\\.\pipe\ChromeCrashServices

\\.\pipe\ChromeCrashServices

error %u

error %u

chrome.exe

chrome.exe

ntdll.dll

ntdll.dll

HKEY_CLASSES_ROOT

HKEY_CLASSES_ROOT

HKEY_CURRENT_USER

HKEY_CURRENT_USER

HKEY_LOCAL_MACHINE

HKEY_LOCAL_MACHINE

HKEY_USERS

HKEY_USERS

HKEY_PERFORMANCE_DATA

HKEY_PERFORMANCE_DATA

HKEY_PERFORMANCE_TEXT

HKEY_PERFORMANCE_TEXT

HKEY_PERFORMANCE_NLSTEXT

HKEY_PERFORMANCE_NLSTEXT

HKEY_CURRENT_CONFIG

HKEY_CURRENT_CONFIG

HKEY_DYN_DATA

HKEY_DYN_DATA

pipe\

pipe\

Ckernel32.dll

Ckernel32.dll

kernelbase.dll

kernelbase.dll

eKey

eKey

gdi32.dll

gdi32.dll

xntdll.dll

xntdll.dll

wow_helper.exe"

wow_helper.exe"

Cntdll.dll

Cntdll.dll

${windows}

${windows}

hunspecified-crash-key

hunspecified-crash-key

Dmscoree.dll

Dmscoree.dll

HADVAPI32.DLL

HADVAPI32.DLL

- floating point support not loaded

- floating point support not loaded

- CRT not initialized

- CRT not initialized

- Attempt to initialize the CRT more than once.

- Attempt to initialize the CRT more than once.

USER32.DLL

USER32.DLL

portuguese-brazilian

portuguese-brazilian

dbghelp.dll

dbghelp.dll

rpcrt4.dll

rpcrt4.dll

%s\%s.dmp

%s\%s.dmp