Trojan-Dropper.Win32.Agent.vsjx (Kaspersky), Trojan.Generic.12555347 (B) (Emsisoft), Trojan.Generic.12555347 (AdAware), Trojan.Win32.Swrort.3.FD, mzpefinder_pcap_file.YR, GenericInjector.YR (Lavasoft MAS)Behaviour: Trojan-Dropper, Trojan
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 740c3e58383e9933a540d817617ab300
SHA1: dd4689348a3b5fabd5a7bd799f4b32209853f862
SHA256: 7260cbf290e800268c1d3121a4182077a0b16de7d78e88c69862b99855216afb
SSDeep: 12288:AoucvQQACqe5gcEfjpo24PKCNRD2BsnmIvL7m1uMMM7 fiuGXLL:A3cvQYefjZFCNRyBsnxTi15T qb
Size: 732680 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: StdLib
Created at: 2014-12-10 23:16:41
Analyzed on: WindowsXP SP3 32-bit
Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The Trojan creates the following process(es):
citrio_41.0.2272.256_1.exe:3616
CatalinaUpdate.exe:1236
CatalinaUpdate.exe:1280
CatalinaUpdate.exe:208
CatalinaUpdate.exe:456
CatalinaUpdate.exe:1932
CatalinaUpdate.exe:2836
citrio.exe:3804
citrio.exe:3492
citrio.exe:3148
citrio.exe:3244
citrio.exe:224
citrio.exe:3368
citrio.exe:3472
citrio.exe:2484
citrio.exe:656
citrio.exe:1096
citrio.exe:3632
citrio.exe:3404
citrio.exe:3312
citrio.exe:3448
citrio.exe:3224
citrio.exe:3208
citrio.exe:3192
CatalinaCrashHandler.exe:2412
setup.exe:3676
%original file name%.exe:1736
The Trojan injects its code into the following process(es):
citrio.exe:3808
citrio.exe:2808
citrio.exe:3160
citrio.exe:3392
citrio.exe:1804
citrio.exe:476
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process citrio_41.0.2272.256_1.exe:3616 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\CR_E0220.tmp\CITRIO.PACKED.7Z (415199 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\CR_E0220.tmp\SETUP.EX_ (1724 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\CR_E0220.tmp\setup.exe (19923 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\CR_E0220.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\CR_E0220.tmp\CITRIO.PACKED.7Z (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\CR_E0220.tmp\SETUP.EX_ (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\CR_E0220.tmp\setup.exe (0 bytes)
The process CatalinaUpdate.exe:1236 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\Cab4.tmp (54 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar5.tmp (2712 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab8.tmp (48 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab6.tmp (54 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004 (408 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 (48 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 (408 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004 (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar7.tmp (2712 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar9.tmp (2712 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\Cab4.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar5.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab8.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab6.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar7.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar9.tmp (0 bytes)
The process CatalinaUpdate.exe:1280 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\Install\{2C93941F-2EE0-43BB-9129-D7C4EAAD6F62}\citrio_41.0.2272.256_1.exe (422134 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\Download\{92F8A219-E740-49D5-B785-B962AD819724}\41.0.2272.256\citrio_41.0.2272.256_1.exe (422134 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\Install (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{5723C22F-25BA-4E55-BE79-4D2B4905A9DB}-citrio_41.0.2272.256_1.exe (0 bytes)
The process CatalinaUpdate.exe:1932 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\CatalinaUpdateOnDemand.exe (58 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_hu.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_uk.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_no.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_th.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_fil.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_en.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_ja.dll (22 bytes)
%WinDir%\Tasks\CatalinaGroupUpdateTaskUserS-1-5-21-1844237615-1960408961-1801674531-1003Core.job (948 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_pl.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_fi.dll (26 bytes)
%WinDir%\Tasks\CatalinaGroupUpdateTaskUserS-1-5-21-1844237615-1960408961-1801674531-1003UA.job (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_pt-PT.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_en-GB.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_fr.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_et.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_sk.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_mr.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_bn.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_kn.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_es-419.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_sl.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_sw.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_iw.dll (23 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\CatalinaUpdateBroker.exe (58 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_ta.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_ko.dll (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_de.dll (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_hr.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_am.dll (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_pt-BR.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_sr.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_zh-CN.dll (19 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\CatalinaCrashHandler.exe (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_zh-TW.dll (19 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\CatalinaUpdate.exe (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_vi.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_cs.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_ar.dll (24 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_ca.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\npCatalinaUpdate3.dll (1281 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_nl.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\psmachine.dll (673 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_el.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_it.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_sv.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_lv.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_ur.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_te.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_is.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_ru.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\CatalinaUpdate.exe (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_ro.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_id.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\psuser.dll (673 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_fa.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_lt.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_tr.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_bg.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\CatalinaUpdateHelper.msi (36 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_ms.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdate.dll (5873 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_hi.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_es.dll (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_ml.dll (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_da.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_gu.dll (26 bytes)
The process citrio.exe:3808 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\NTUSER.DAT.LOG (4048 bytes)
%Documents and Settings%\%current user%\NTUSER.DAT (3764 bytes)
The process citrio.exe:3804 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libtheora_plugin.dll (22840 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\arrow-right.png (114 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libdts_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\lua\liblua_plugin.dll (20400 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libmkv_plugin.dll (66563 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libsubsusf_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\joox.luac (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libaes3_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\ScrollViewHelper.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\sse2\libi420_rgb_sse2_plugin.dll (8472 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_output\libmmdevice_plugin.dll (3656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libmpc_plugin.dll (5952 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libsepia_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libasf_plugin.dll (5224 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\StatusBarStyle.qml (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\GroupBox.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\MenuContentItem.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libpostproc_plugin.dll (7288 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_mixer\libfloat_mixer_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libdeinterlace_plugin.dll (10864 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\GammaAdjust.qml (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\TableView.qml (3656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\MenuClose.qml (588 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\meta_engine\libfolder_plugin.dll (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\rightanglearrow.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\ButtonStyle.qml (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libripple_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libadpcm_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libcc_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\SourceProxy.qml (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\SpinBox.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\BusyIndicator.qml (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\StackViewTransition.qml (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libdmo_plugin.dll (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\MenuScroll.qml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libvoc_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\services_discovery\libsap_plugin.dll (8472 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libwall_plugin.dll (3808 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\ToolbarLeft.qml (96 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_chroma\libyuy2_i422_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\OpacityMask.qml (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\scrollbar-handle-vertical.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\header.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\ToolButton.qml (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\packetizer\libpacketizer_flac_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\arrow-left.png (114 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libscene_plugin.dll (3656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\CalendarUtils.js (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\core\Hotkeys.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\SplashScreen.qml (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\qmldir (852 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libtimecode_plugin.dll (3656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libmono_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\check@2x.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\HueSaturation.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\TabView.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libdvdread_plugin.dll (11704 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\GroupBoxStyle.qml (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libaudio_format_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\tab.png (460 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libts_plugin.dll (9352 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libmagnify_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libscte27_plugin.dll (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libmosaic_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\packetizer\libpacketizer_vc1_plugin.dll (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libaraw_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libpva_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_filter\librecord_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libquicktime_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\ColumnMenuContent.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libgaussianblur_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\core\Functions.qml (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libspeex_plugin.dll (10216 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libatmo_plugin.dll (14776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\librotate_plugin.dll (4152 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libes_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libaiff_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\VolumeHeatScale.qml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\ProgressBar.qml (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\RadialGradient.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libshm_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\mux\libmux_avi_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_output\libafile_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\manifest.json (626 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\modules\dkjson.luac (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_out\libstream_out_duplicate_plugin.dll (3656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libremap_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libedummy_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_out\libstream_out_dummy_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_chroma\libi420_rgb_plugin.dll (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\ComboBoxStyle.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libaccess_bd_plugin.dll (7288 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\misc\libxml_plugin.dll (67908 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_out\libstream_out_standard_plugin.dll (3656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_filter\libhttplive_plugin.dll (34872 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\EditMenu_ios.qml (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\images\icon128.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libkate_plugin.dll (7784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\MenuStyle.qml (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\mux\libmux_wav_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\mux\libmux_asf_plugin.dll (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\liblive555_plugin.dll (45664 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\slider-handle.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libtta_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\EditMenu_base.qml (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\DirectionalBlur.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\MaskedBlur.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libheadphone_channel_mixer_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\sse2\libi422_yuy2_sse2_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\ApplicationWindowStyle.qml (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libcdda_plugin.dll (10864 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libaccess_realrtsp_plugin.dll (6984 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libau_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libmp4_plugin.dll (12376 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\scrollbar-handle-transient.png (249 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\vimeo.luac (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\katsomo.luac (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libnsc_plugin.dll (3808 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libgradfun_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libaccess_udp_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\librtp_plugin.dll (31256 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libdtv_plugin.dll (16664 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libdvbsub_plugin.dll (7784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\ToolbarTimeLength.qml (365 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\ContentItem.qml (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_out\libstream_out_description_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Layouts\plugins.qmltypes (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\spinner_large.png (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\StackView.qml (3656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\StatusBar.qml (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libposterize_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick.2\plugins.qmltypes (14960 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\ToolBar.qml (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\Desaturate.qml (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libty_plugin.dll (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\liblibmpeg2_plugin.dll (9496 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libball_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\DECODED_MESSAGE_CATALOGS (24 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\scrollbar-handle-horizontal.png (939 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\StackViewDelegate.qml (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\jamendo.luac (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_out\libstream_out_langfromtelx_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\BigPlayIcon.qml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\TableViewColumn.qml (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\youtube_homepage.luac (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\appletrailers.luac (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libaccess_tcp_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libcdg_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libmotiondetect_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\ZoomBlur.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\librawdv_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\liba52_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\main.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\metachannels.luac (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libchain_plugin.dll (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\modules\simplexml.luac (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libdshow_plugin.dll (18240 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\TitleBar.qml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libvc1_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\HoverButton.qml (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\TextAreaStyle.qml (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick.2\qmldir (111 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_output\libadummy_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\services_discovery\libmediadirs_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\ScrollViewStyle.qml (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libaccess_vdr_plugin.dll (5952 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_output\libvmem_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\ToolbarButton.qml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libg711_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\ToolbarBackground.qml (256 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\SwitchStyle.qml (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libmpeg_audio_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\liveleak.luac (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_chroma\librv32_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_output\libyuv_plugin.dll (3656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\mux\libmux_dummy_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\RadioButtonStyle.qml (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_chroma\libyuy2_i420_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libzvbi_plugin.dll (83471 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libcrystalhd_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\fonts\secondary.ttf (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\cue.luac (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\core\Buttons.qml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\meta_engine\libtaglib_plugin.dll (81329 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\liblpcm_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libsamplerate_plugin.dll (80307 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\arrow-right@2x.png (148 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\RadialBlur.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\ModalPopupBehavior.qml (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\CustomButton.qml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\VideoLayer.qml (291 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\private\GaussianInnerShadow.qml (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\EditMenu.qml (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_output\libwaveout_plugin.dll (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libps_plugin.dll (3656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\qmldir (134 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\MediaPlayer.html (634 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\misc\libaudioscrobbler_plugin.dll (3808 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\packetizer\libpacketizer_mpeg4video_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\slider-groove.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\mmx\libi420_yuy2_mmx_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\packetizer\libpacketizer_h264_plugin.dll (5224 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\COPYING.txt (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_out\libstream_out_autodel_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libdtstospdif_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libx264_plugin.dll (66979 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libugly_resampler_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_output\libdirect3d_plugin.dll (5224 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\check.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\librawvideo_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\spinner_medium.png (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\liberase_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\services_discovery\libwindrive_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libequalizer_plugin.dll (3808 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\anevia_streams.luac (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\arrow-left@2x.png (139 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\ToolMenuButton.qml (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libdxva2_plugin.dll (5224 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libtrivial_channel_mixer_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\CalendarStyle.qml (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libsid_plugin.dll (60000 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\ColorOverlay.qml (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\Style.qml (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_out\libstream_out_record_plugin.dll (3808 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libgain_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\private\GaussianMaskedBlur.qml (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\liba52tofloat32_plugin.dll (4152 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libadjust_plugin.dll (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libspatializer_plugin.dll (8472 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\d3dcompiler_43.dll (130008 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\dailymotion.luac (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\Toolbar.qml (517 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\TextInputWithHandles.qml (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\MenuBar.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\leftanglearrow.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\ToolBarStyle.qml (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libwav_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\packetizer\libpacketizer_dirac_plugin.dll (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_output\libcaca_plugin.dll (48104 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\FastGlow.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\arrow-up@2x.png (229 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_output\libdrawable_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\misc\liblogger_plugin.dll (3656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\ssleay32.dll (20400 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\StackView.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_output\libdirect2d_plugin.dll (3808 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\DECODED_IMAGES (1642 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\pinkbike.luac (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libvcd_plugin.dll (6872 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\SubtitleMenuItems.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\Displace.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libidummy_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\RecursiveBlur.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libopus_plugin.dll (11736 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libblend_plugin.dll (12376 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\packetizer\libpacketizer_mpegvideo_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\TabViewStyle.qml (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\spinner_small.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\msvcr90.dll (41752 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_out\libstream_out_mosaic_bridge_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_out\libstream_out_raop_plugin.dll (32816 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\ProgressBarStyle.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libblendbench_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\ToolbarBorder.qml (96 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\css\styles.css (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libaudiobargraph_v_plugin.dll (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_chroma\libgrey_yuv_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\LevelAdjust.qml (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libkaraoke_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\mmx\libi422_yuy2_mmx_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libstereo_widen_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\TabBar.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\fonts\default.ttf (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\private\GaussianDirectionalBlur.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\liblibass_plugin.dll (74023 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libhqdn3d_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\liblogo_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\GaussianBlur.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libaccess_attachment_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_out\libstream_out_display_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libyuvp_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\FastBlur.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_output\libvdummy_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libmjpeg_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libmpgv_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libdemuxdump_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\MouseSurface.qml (346 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_out\libstream_out_rtp_plugin.dll (37152 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\anevia_xml.luac (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libbluescreen_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\arrow-down@2x.png (212 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\mpora.luac (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\private\FastGlow.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\VolumeHeatColors.qml (265 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\misc\libgnutls_plugin.dll (130226 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libaccess_http_plugin.dll (8472 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libmpgatofixed32_plugin.dll (9496 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\text_renderer\libfreetype_plugin.dll (48104 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_filter\libsmooth_plugin.dll (4152 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\images\icon16.png (353 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libdemux_cdg_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Layouts\qmldir (130 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\fonts\glyphicons.ttf (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libnuv_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\focusframe.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libaccess_ftp_plugin.dll (5952 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\WebChimera.dll (882925 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_out\libstream_out_smem_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\progress-indeterminate.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\TableViewStyle.qml (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\images\close_but.png (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_out\libstream_out_transcode_plugin.dll (3656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libremoteosd_plugin.dll (32104 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libpuzzle_plugin.dll (5952 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libmirror_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\core\Settings.qml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libdtstofloat32_plugin.dll (11736 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\BasicButton.qml (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Slider.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libcanvas_plugin.dll (3656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_output\libamem_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libswscale_plugin.dll (38608 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\button_down.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libsmf_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\PlaylistMenuItems.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libsubsdec_plugin.dll (3808 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libextract_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libspeex_resampler_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libinvert_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\text_renderer\libtdummy_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libmod_plugin.dll (34392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\AbstractCheckable.qml (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libpsychedelic_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\CalendarHeaderModel.qml (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\liblibbluray_plugin.dll (129406 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\rockbox_fm_presets.luac (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libgme_plugin.dll (27336 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libzip_plugin.dll (8472 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\images\webchimera_logo.png (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\ScrollBar.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libaccess_rar_plugin.dll (3656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\mux\libmux_ts_plugin.dll (7288 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libimage_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libmarq_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\private\GaussianGlow.qml (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\mmx\libi420_rgb_mmx_plugin.dll (3808 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\tab_selected.png (498 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libuleaddvaudio_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libmotionblur_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_out\libstream_out_es_plugin.dll (3656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\SystemPaletteSingleton.qml (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\extreme.luac (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\france2.luac (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\VolumeHeat.qml (493 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\images\player_logo_small_h.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\pluzz.luac (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libxa_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libaccess_imem_plugin.dll (3808 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\TopCenterText.qml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\images\icon24.png (480 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\groupbox.png (485 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\TableViewSelection.qml (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libplaylist_plugin.dll (9496 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\TextSingleton.qml (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libparam_eq_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_chroma\libi420_yuy2_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libvorbis_plugin.dll (47352 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libstl_plugin.dll (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Menu.qml (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_output\libwingdi_plugin.dll (3808 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\misc\libfingerprinter_plugin.dll (3808 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\MenuContentScroller.qml (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libsubsdelay_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libcolorthres_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libalphamask_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\arrow-down.png (184 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libogg_plugin.dll (10216 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libstream_filter_rar_plugin.dll (3656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Label.qml (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libfilesystem_plugin.dll (3656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\ArtworkLayer.qml (232 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\mux\libmux_mp4_plugin.dll (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\mux\libmux_mpjpeg_plugin.dll (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\googlevideo.luac (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\Menu.qml (338 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libchorus_flanger_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\SubtitleText.qml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\mux\libmux_ps_plugin.dll (4152 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\ComboBox.qml (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\MenuHeader.qml (612 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libnsv_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libh264_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\misc\libexport_plugin.dll (3656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\zapiks.luac (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\style.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Tab.qml (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\RectangularGlow.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libanaglyph_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libdemux_stl_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\Colorize.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\Glow.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\TextField.qml (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libnormvol_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libantiflicker_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_chroma\libi422_yuy2_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libclone_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\images\icon256.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\StackViewSlideDelegate.qml (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libsvcdsub_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libavi_plugin.dll (6984 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\sse2\libi420_yuy2_sse2_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\packetizer\libpacketizer_mpeg4audio_plugin.dll (5224 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\libeay32.dll (68422 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libcvdsub_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\DropShadow.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libcroppadd_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libt140_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Button.qml (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\images\dragger.png (104 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\libvlc.dll (8472 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\ToolbarRight.qml (124 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\ThresholdMask.qml (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_output\libdirectdraw_plugin.dll (5224 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libdvdnav_plugin.dll (16664 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_chroma\libi422_i420_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\fonts\openfolder.ttf (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Calendar.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libflacsys_plugin.dll (5952 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\TextArea.qml (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libscreen_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\Fonts.qml (962 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libdolby_surround_decoder_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libgradient_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libscale_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_out\libstream_out_delay_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\TextHandle.qml (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\plugins.dat (14960 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\images\icon64.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\metacafe.luac (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\SpinBoxStyle.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\private\FastMaskedBlur.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\ProgressBar.qml (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\BusyIndicatorStyle.qml (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\ScrollView.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\librawvid_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\LinearGradient.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libfaad_plugin.dll (22904 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\button.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libvobsub_plugin.dll (5952 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\TextFieldStyle.qml (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\plugins.qmltypes (6984 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\canalplus.luac (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_output\libglwin32_plugin.dll (6984 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libsdp_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\ContextMenu.qml (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_out\libstream_out_setid_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\koreus.luac (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\webchimera.js (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libtwolame_plugin.dll (9760 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\packetizer\libpacketizer_mlp_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libavcodec_plugin.dll (661132 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\ToolButtonStyle.qml (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\TimeBubble.qml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\images\player_logo_small.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libdirac_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\Blend.qml (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libpng_plugin.dll (20400 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_filter\libdash_plugin.dll (45664 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\MenuBarStyle.qml (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libtransform_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\playlist_youtube.lua (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\TopRightText.qml (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\packetizer\libpacketizer_copy_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\MediaPlayer.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\youtube.luac (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libsimple_channel_mixer_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\services_discovery\libupnp_plugin.dll (25104 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libwave_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\arrow-up.png (186 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\UIsettings.qml (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libspudec_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\images\icon48.png (830 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\lelombrik.luac (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\SplitView.qml (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\CheckBoxStyle.qml (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\BrightnessContrast.qml (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Switch.qml (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libaccess_smb_plugin.dll (3656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\VolumeHeatMouse.qml (813 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\bbc_co_uk.luac (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\misc\libstats_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\qmldir (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\qmldir (913 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libcompressor_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\BigPauseIcon.qml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\private\SourceProxy.qml (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\InnerShadow.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\FocusFrame.qml (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\CheckBox.qml (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\services_discovery\libpodcast_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libddummy_plugin.dll (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\MenuItemSubControls.qml (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\FocusFrameStyle.qml (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libsubtitle_plugin.dll (6984 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\librss_plugin.dll (3808 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\soundcloud.luac (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\Control.qml (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\librawaud_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\MenuContent.qml (106 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libaudiobargraph_a_plugin.dll (3656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\images\webchimera_logo_small.png (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\jquery-2.1.3.min.js (6872 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_out\libstream_out_bridge_plugin.dll (3656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\editbox.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\break.luac (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libaccess_mms_plugin.dll (5952 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_out\libstream_out_chromaprint_plugin.dll (56936 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\VolumeHeatGraphics.qml (812 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\images\cursor-openhand.png (160 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\misc\libvod_rtsp_plugin.dll (6872 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_output\libdirectsound_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libreal_plugin.dll (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\SliderStyle.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\modules\sandbox.luac (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\RadioButton.qml (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libsharpen_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_mixer\libinteger_mixer_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\mux\libmux_ogg_plugin.dll (5224 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\ApplicationWindow.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\libvlccore.dll (139530 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libpanoramix_plugin.dll (3656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_out\libstream_out_gather_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libschroedinger_plugin.dll (68968 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\images\icon32.png (616 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\ConicalGradient.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\liba52tospdif_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libgrain_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libscaletempo_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\private\FastInnerShadow.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libflac_plugin.dll (12984 bytes)
The process citrio.exe:3492 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_11582\CRX_INSTALL\background.js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_11582\CRX_INSTALL\skin\icons\icon.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_11582\CRX_INSTALL\skin\icons\active.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_11582\DECODED_MESSAGE_CATALOGS (24 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_11582\CRX_INSTALL\skin\style.css (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_11582\CRX_INSTALL\skin\jquery-1.11.0.min.js (6984 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_11582\CRX_INSTALL\skin\icons\disable.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_11582\CRX_INSTALL\skin\popup.html (924 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_11582\DECODED_IMAGES (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_11582\CRX_INSTALL\skin\icons\static.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_11582\CRX_INSTALL\skin\sprite.png (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_11582\CRX_INSTALL\manifest.json (533 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_11582\CRX_INSTALL\skin\js.js (392 bytes)
The process citrio.exe:2808 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\images\icon48.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041 (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\images\icon256.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\proxy.crx (2105 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\citrio_ext.crx (109082 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\10.tmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\B.tmp (1478 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20282\CRX_INSTALL\manifest.json (899 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20282 (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\1F.tmp (13882 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20282\CRX_INSTALL\images\icon16.png (721 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\28.tmp (32 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\sr\messages.json (210 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\etilqs_Px70Os4eAETlqZY (286 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171 (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Local Storage\http_www.citrio.com_0.localstorage-journal (14172 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\11.tmp (4594416 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Cache\f_000006 (106 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Login Data (1454 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\etilqs_Z9phldjGeTZeR9O (131 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Extension Cookies (1955 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\1C.tmp (645 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\fr\messages.json (205 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\11.tmp (238288 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\images\128.png (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Cache\index (368 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\images\icon64.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Current Tabs (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\manifest.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\manifest.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\pt_PT\messages.json (237 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\images\icon128.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\E.tmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\icon_16.png (475 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\2B.tmp (97 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\images\icon16.png (321 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\img\16.png (752 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\19.tmp (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Cache\data_3 (5968 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Cache\data_2 (3272 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Cache\data_1 (79304 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Cache\data_0 (413176 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Shortcuts (592 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\etilqs_OdijbpIxDix1Xlr (532 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20282\affiliate.crx (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\manifest.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\CRX_INSTALL\manifest.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\ru\messages.json (265 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\etilqs_gWs6HtCIyiWsTcw (532 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\de\messages.json (208 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Shortcuts-journal (564 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\18.tmp (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\C.tmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Cache\f_000001 (68 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Cache\f_000003 (53 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Cache\f_000002 (36 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Cache\f_000005 (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Cache\f_000004 (65 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Cache\f_000007 (17 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\First Run (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Cache\f_000009 (104 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Cache\f_000008 (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Sync Extension Settings\jnoejnlbkbnckikbkmnpippafneemknp\LOG (220 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\21.tmp (46486 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\etilqs_an73aTGnGd5yszB (131 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\ar\messages.json (289 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\manifest.json (773 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\icon_128.png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533 (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Extension State\MANIFEST-000001 (75 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\21.tmp (2105 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Web Data (28199 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895 (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\icon_mono_off.png (731 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Cache\f_00000a (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\download_all.crx (3073 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Cache\f_00000b (76 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\etilqs_vSZCdRD8jKJYPIC (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\images\icon16.png (801 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\16.tmp (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\24.tmp (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\etilqs_1wOz32UPNJS4pan (292 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\20.tmp (79 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\tr\messages.json (212 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\uk\messages.json (269 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\el\messages.json (298 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\hi\messages.json (369 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Extension Rules\000003.log (663 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Session Storage\MANIFEST-000001 (75 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\icon_19.png (685 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Safe Browsing Cookies (745 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\26.tmp (645 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Login Data-journal (564 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2A.tmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\sv\messages.json (207 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_11582 (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\icon_mono_on.png (748 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\CRX_INSTALL\images\icon128.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\2D.tmp (32 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\he\messages.json (219 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\hu\messages.json (204 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Extension State\LOG (179 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\17.tmp (52 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\images\icon48.png (817 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\12.tmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\pl\messages.json (227 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Session Storage\LOG (179 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Visited Links (1868 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\15.tmp (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\manifest.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\13.tmp (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\1F.tmp (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Network Action Predictor (7647 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Top Sites-journal (12020 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\images\icon24.png (439 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\etilqs_1m97DXkaaHlcEJH (286 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\images\icon128.png (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\vi\messages.json (261 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\_locales\en\messages.json (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Top Sites (5232 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\share_page.crx (58 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\1A.tmp (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\ko\messages.json (209 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\14.tmp (47 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\zh_CN\messages.json (199 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\History (29905 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\README (166 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\da\messages.json (227 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\2C.tmp (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\img\128.png (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Sync Extension Settings\jnoejnlbkbnckikbkmnpippafneemknp\000003.log (269 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Current Session (10608 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\images\19.png (566 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\es\messages.json (224 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Sync Extension Settings\jnoejnlbkbnckikbkmnpippafneemknp\000001.dbtmp (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\img\48.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20282\CRX_INSTALL\images\icon128.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\1E.tmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Extension Cookies-journal (9796 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\CRX_INSTALL\images\icon16.png (420 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Favicons (8470 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\etilqs_byoyEzeIX6OTWgG (131 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Web Data-journal (10344 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Sync Extension Settings\jnoejnlbkbnckikbkmnpippafneemknp\MANIFEST-000001 (75 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Local Storage\http_www.citrio.com_0.localstorage (599 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\History-journal (16252 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\images\icon64.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_11582\CRX_INSTALL\skin\icons\icon.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\25.tmp (80 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\23.tmp (13 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Origin Bound Certs-journal (6215 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Extension Rules\LOG (179 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\it\messages.json (227 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\F.tmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\etilqs_JXBSpvcMjdPeHWR (131 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\27.tmp (32 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\1D.tmp (13 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_11582\CRX_INSTALL\skin\icons\static.png (543 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Favicons-journal (16036 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Session Storage\000001.dbtmp (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\1B.tmp (77 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181 (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Extension State\000003.log (9156 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Cookies (3317 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Safe Browsing Cookies-journal (2791 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\manifest.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20282\CRX_INSTALL\images\icon32.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Network Action Predictor-journal (12870 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_11582\media_downloader.crx (64 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Cookies-journal (18133 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Extension State\000001.dbtmp (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\29.tmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\D.tmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\en\messages.json (210 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\pt_BR\messages.json (237 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Extension Rules\000001.dbtmp (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\images\icon32.png (582 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\22.tmp (645 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551 (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Extension Rules\MANIFEST-000001 (75 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_11582\CRX_INSTALL\manifest.json (955 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\A.tmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Origin Bound Certs (841 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686 (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\cs\messages.json (324 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\images\icon48.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\images\icon256.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\proxy.crx (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Preferences~RF58fa5.TMP (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\citrio_ext.crx (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Preferences~RF6dd24.TMP (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\10.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20282 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\1F.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20282\CRX_INSTALL\images\icon16.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\DECODED_IMAGES (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\11.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\DECODED_IMAGES (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\DECODED_IMAGES (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\11.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\images\128.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\images\icon64.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\icon_16.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\img\16.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\E.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Secure Preferences~RF6086f.TMP (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Extensions\Temp\scoped_dir_2808_1250 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\images\icon16.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20282\affiliate.crx (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Extensions\Temp\scoped_dir_2808_30085 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\D.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Local State~RF63829.TMP (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\C.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Preferences~RF631d0.TMP (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Secure Preferences~RF6dca7.TMP (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\21.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Preferences~RF5f15c.TMP (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\icon_128.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\DECODED_IMAGES (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\21.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Extensions\Temp\scoped_dir_2808_3977 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20282\DECODED_IMAGES (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\DECODED_MESSAGE_CATALOGS (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\icon_mono_off.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Extensions\Temp\scoped_dir_2808_16322 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Preferences~RF5bffc.TMP (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\download_all.crx (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\images\icon16.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Local State~RF677a3.TMP (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\icon_19.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_11582\DECODED_MESSAGE_CATALOGS (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\img\48.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\DECODED_IMAGES (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2A.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_11582 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\icon_mono_on.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\CRX_INSTALL\images\icon128.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_11582\DECODED_IMAGES (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\DECODED_MESSAGE_CATALOGS (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\12.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\images\icon48.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\DECODED_MESSAGE_CATALOGS (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Extensions\Temp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Extensions\Temp\scoped_dir_2808_22249 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\1F.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Secure Preferences~RF58f66.TMP (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\images\icon24.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\images\icon128.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\TransportSecurity~RF671f6.TMP (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Extensions\Temp\scoped_dir_2808_25657 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Preferences~RF58eab.TMP (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\share_page.crx (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Local State~RF6f34c.TMP (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Local State~RF6a8c5.TMP (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\images\icon128.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\img\128.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\images\19.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20282\CRX_INSTALL\images\icon128.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\1E.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\CRX_INSTALL\images\icon16.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Secure Preferences~RF639a0.TMP (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Extensions\Temp\scoped_dir_2808_7982 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\images\icon64.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_11582\CRX_INSTALL\skin\icons\icon.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\DECODED_MESSAGE_CATALOGS (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\DECODED_IMAGES (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\DECODED_IMAGES (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\F.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\DECODED_MESSAGE_CATALOGS (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20282\DECODED_MESSAGE_CATALOGS (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Extensions\Temp\scoped_dir_2808_17942 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Local State~RF5c00b.TMP (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20282\CRX_INSTALL\images\icon32.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_11582\media_downloader.crx (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\29.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Secure Preferences~RF5cb27.TMP (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Extensions\Temp\scoped_dir_2808_2955 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\images\icon32.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_11582\CRX_INSTALL\skin\icons\static.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\A.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\DECODED_MESSAGE_CATALOGS (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\TransportSecurity~RF60d60.TMP (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\DECODED_MESSAGE_CATALOGS (0 bytes)
The process citrio.exe:3368 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\CRX_INSTALL\js\DTA.interface.js (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\CRX_INSTALL\js\DTA.popup.js (59 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\CRX_INSTALL\images\icon128.png (60000 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\CRX_INSTALL\images\button.logo.png (60000 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\CRX_INSTALL\images\logo.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\CRX_INSTALL\images\search.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\DECODED_IMAGES (66 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\CRX_INSTALL\background.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\CRX_INSTALL\images\icon16.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\CRX_INSTALL\js\lib\jquery.js (6984 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\CRX_INSTALL\images\button.logo.inactive.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\CRX_INSTALL\js\DTA.ui.js (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\CRX_INSTALL\images\icon.close.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\CRX_INSTALL\css\template.css (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\DECODED_MESSAGE_CATALOGS (24 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\CRX_INSTALL\manifest.json (729 bytes)
The process citrio.exe:3472 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\is.png (494 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ir.png (471 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\kw.png (476 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\md.png (548 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\es.png (493 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ae.png (446 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\scripts\background.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\sh.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\va.png (483 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\pm.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\vu.png (570 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\tc.png (604 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ms.png (592 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\ic16_gear.png (402 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\gl.png (521 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\fj.png (575 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\lt.png (395 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\si.png (468 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\mg.png (380 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\gs.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\uz.png (462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ls.png (639 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\tf.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\scripts\base64.js (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\scripts\tmpl.js (667 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\bz.png (615 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\mk.png (690 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\icon_128.png (16664 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\yt.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\styles\mochi.css (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\dk.png (416 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\sa.png (560 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\py.png (442 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\sb.png (649 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ci.png (428 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\am.png (414 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\bi.png (740 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\so.png (514 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\tj.png (436 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\bm.png (606 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\bb.png (573 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\scripts\agent.js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ht.png (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\np.png (634 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\cd.png (621 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\mr.png (567 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\kr.png (658 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\sm.png (552 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\az.png (472 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ng.png (441 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\io.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\de.png (391 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\il.png (468 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\gi.png (516 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\nc.png (608 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\aq.png (586 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\mh.png (698 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\jp.png (471 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\fm.png (565 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\bn.png (654 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\bo.png (461 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\lu.png (367 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\vg.png (618 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ua.png (399 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\cy.png (456 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\popup.html (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\kg.png (525 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ax.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ec.png (564 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\in.png (431 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\at.png (363 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\scripts\profile_detail.js (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\fk.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\jm.png (711 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\sy.png (422 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\kp.png (480 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\scripts\spine.route.js (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\scripts\spine.js (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ws.png (492 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\iq.png (475 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\cn.png (469 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ca.png (570 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\pw.png (610 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ug.png (536 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\mn.png (546 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\to.png (427 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\pr.png (498 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ye.png (362 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\je.png (632 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\nf.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\mz.png (539 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\tv.png (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ml.png (463 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\se.png (472 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\pe.png (536 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ch.png (434 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\wf.png (518 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\tw.png (461 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\cm.png (502 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\gp.png (509 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\me.png (555 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\tk.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ph.png (516 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\pk.png (600 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\gy.png (686 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\hu.png (369 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\mm.png (451 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\scripts\jquery.js (6984 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\mp.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\pt.png (591 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\styles\style.css (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\tz.png (655 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\br.png (687 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\list-img.png (603 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\sc.png (677 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\kn.png (662 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ao.png (535 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\manifest.json (511 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\gw.png (465 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\scripts\popup.js (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\nr.png (465 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\sr.png (470 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\scripts\new.js (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\om.png (446 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\cx.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\uy.png (479 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\image\icon_mono_on.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\dj.png (514 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\bs.png (494 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\im.png (543 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\icon_mono_off.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\eg.png (408 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\sg.png (409 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\it.png (440 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\scripts\ui.js (5224 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\er.png (645 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\settings-act.png (883 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\id.png (333 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\DECODED_IMAGES (68 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\no.png (485 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\gg.png (501 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\gf.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\rw.png (437 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\gb.png (707 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\my.png (509 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\gn.png (453 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ly.png (383 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\zw.png (591 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\bj.png (422 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\al.png (535 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\lr.png (457 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ag.png (622 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\pa.png (514 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ad.png (540 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\bh.png (529 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\vi.png (612 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\dm.png (668 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\nl.png (367 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\za.png (600 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ga.png (400 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\sl.png (377 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\mu.png (416 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\sandbox.html (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\tt.png (690 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\sv.png (450 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\bv.png (485 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\icon_mono_on.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\an.png (477 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ve.png (464 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\mf.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\co.png (387 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\vn.png (520 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\hr.png (553 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\nu.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\mo.png (647 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\scripts\model.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\cg.png (674 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\lk.png (586 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\lv.png (367 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\do.png (432 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\image\icon_128.png (16664 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\_locales\en\messages.json (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\speed.png (885 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\km.png (561 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ar.png (439 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\gu.png (532 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\scripts\sandbox.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ma.png (479 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\nz.png (623 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\vc.png (610 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\pf.png (476 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ba.png (627 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\li.png (462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\mv.png (537 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\us.png (488 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\re.png (488 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\sk.png (495 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\cu.png (513 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\jo.png (521 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ee.png (380 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\tl.png (569 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\scripts\logging.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\fr.png (446 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\dz.png (532 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\list-img-ac.png (620 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ky.png (600 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\rs.png (542 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\kz.png (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\bf.png (445 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\image\icon_mono_off.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\et.png (566 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ge.png (509 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\mq.png (604 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\eh.png (536 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ke.png (631 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\hm.png (614 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\close.png (552 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\mt.png (410 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\aw.png (453 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\mx.png (526 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\bw.png (425 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\na.png (717 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\um.png (488 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\gr.png (433 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\cc.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\sd.png (498 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\hk.png (611 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\mw.png (485 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ni.png (431 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ru.png (350 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\bt.png (607 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\scripts\profile_list.js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\gt.png (549 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ne.png (442 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\gq.png (536 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\cl.png (424 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ai.png (609 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\pg.png (629 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\td.png (461 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\tg.png (494 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\sj.png (485 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\scripts\mochi.js (363 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\be.png (452 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\sl_arrow.png (616 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\by.png (441 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\settings.png (871 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\qa.png (458 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\hn.png (432 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\fi.png (405 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\gh.png (453 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\mc.png (333 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\tm.png (553 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ck.png (630 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\sz.png (594 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\th.png (356 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\lc.png (631 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\pl.png (316 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\bg.png (352 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\pn.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\st.png (568 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\gd.png (683 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ie.png (432 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\scripts\doT.min.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ro.png (461 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\DECODED_MESSAGE_CATALOGS (48 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ki.png (679 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\fo.png (462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\image\ic16_gear.png (402 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\as.png (661 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\cv.png (492 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\tn.png (578 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\sn.png (512 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\la.png (530 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\bl.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\af.png (534 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ps.png (516 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\zm.png (527 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\bd.png (577 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\cf.png (514 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\scripts\spine.local.js (619 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\cz.png (492 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\lb.png (491 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\gm.png (398 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\kh.png (535 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\au.png (614 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\cr.png (364 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\tr.png (575 bytes)
The process citrio.exe:2484 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\js\onload.js (72 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\img\header-logo.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\css\uploadProgress.css (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\img\48.png (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\manifest.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\chrome_ex_oauth.html (331 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\img\header.png (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\js\jquery.js (6984 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\_metadata\verified_contents.json (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\img\vimeo4shared.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\DECODED_MESSAGE_CATALOGS (24 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\js\services.js (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\img\59.png (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\options.html (906 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\css\options.css (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\js\chrome_ex_oauthsimple.js (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\js\uploadProgress.js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\img\download-icon.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\css\services.css (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\img\16.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\js\background.js (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\js\chrome_ex_oauth.js (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\DECODED_IMAGES (75 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\js\options.js (894 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\img\128.png (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\uploadProgress.html (840 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\img\progress.png (455 bytes)
The process citrio.exe:656 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\hi\messages.json (375 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\images\small-icons-sprite.png (555 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\DECODED_MESSAGE_CATALOGS (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\images\logo.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\popup.html (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\DECODED_IMAGES (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\sv\messages.json (213 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\images\48.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\es\messages.json (230 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\images\icon_2.png (223 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\images\icon_3.png (326 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\images\nonews.svg (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\no\messages.json (209 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\ru\messages.json (271 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\images\icon_1.png (165 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\he\messages.json (225 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\de\messages.json (214 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_metadata\verified_contents.json (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\nwsh-back.js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\it\messages.json (233 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\pl\messages.json (233 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\sr\messages.json (216 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\hu\messages.json (210 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\ko\messages.json (215 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\ar\messages.json (295 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\images\icon_5.png (449 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\en\messages.json (216 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\images\loader.svg (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\vi\messages.json (267 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\images\128.png (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\images\503.gif (21968 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\images\icon_4.png (389 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\fr\messages.json (211 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\pt_BR\messages.json (243 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\nwsh-content.js (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\nwsh-background.js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\images\arrow.svg (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\zh_CN\messages.json (205 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\manifest.json (933 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\images\stars.png (624 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\pt_PT\messages.json (243 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\da\messages.json (233 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\images\19.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\style.css (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\images\date.svg (364 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\nwsh-ext.js (536 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\tr\messages.json (218 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\uk\messages.json (275 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\el\messages.json (304 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\cs\messages.json (330 bytes)
The process citrio.exe:3312 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20282\CRX_INSTALL\images\icon32.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20282\DECODED_MESSAGE_CATALOGS (24 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20282\CRX_INSTALL\images\icon128.png (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20282\DECODED_IMAGES (70 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20282\CRX_INSTALL\manifest.json (436 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20282\CRX_INSTALL\images\icon16.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20282\CRX_INSTALL\scripts\affiliate.js (127 bytes)
The process citrio.exe:3448 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\icon_19.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\imageformats\qico4.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\scripts\background_stats.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\DECODED_MESSAGE_CATALOGS (24 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\Include\pyconfig.h (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\DECODED_IMAGES (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\_elementtree.pyd (9496 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\python34.dll (164484 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\_bz2.pyd (3808 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\manifest.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\zlib1.dll (5224 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\_hashlib.pyd (49912 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\icon_empty.png (158 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\scripts\content_stats.js (605 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\msvcr100.dll (49672 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\_socket.pyd (3656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\win32api.pyd (6984 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\win32wnet.pyd (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\QtGui4.dll (541377 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\libtorrent.dll (104195 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\pyexpat.pyd (9496 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\youtube-dl.exe (173043 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\QtCore4.dll (152471 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\background.html (286 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\pywintypes34.dll (7784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\libeay32.dll (76989 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\_ctypes.pyd (6872 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\scripts\content_dv.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\_ssl.pyd (66767 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\select.pyd (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\base_library.zip (206432 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\citrio_ext.dll (33720 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\scripts\background_dv.js (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\dlnlib.dll (38832 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\icon_16.png (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\unicodedata.pyd (48768 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\_lzma.pyd (9496 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\libcurl.dll (22840 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\ssleay32.dll (18768 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\msvcp100.dll (27336 bytes)
The process citrio.exe:3224 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application\debug.log (121 bytes)
The process citrio.exe:3192 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\images\icon48.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\images\icon128.png (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\images\icon64.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\js\lib\jquery.js (6984 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\images\icon16.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\DECODED_MESSAGE_CATALOGS (24 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\images\icon.tw.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\js\popup.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\images\logo.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\images\icon.gp.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\css\template.css (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\popup.html (804 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\background.js (261 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\DECODED_IMAGES (92 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\manifest.json (630 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\images\icon35.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\images\icon.fb.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\images\16.png (1 bytes)
The process setup.exe:3676 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\citrio_200_percent.pak (9606 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\ca.pak (246 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\en-US.pak (201 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\icudtl.dat (76792 bytes)
%Documents and Settings%\%current user%\Desktop\Facebook.lnk (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\resources.pak (134807 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\pt-PT.pak (241 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application\41.0.2272.256\Installer\setup.exe (8657 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\citrio.7z (1302935 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch\Citrio.lnk (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\vi.pak (272 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\es-419.pak (245 bytes)
%Documents and Settings%\%current user%\Desktop\YouTube.lnk (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\ko.pak (250 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\wow_helper.exe (70 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\de.pak (243 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\d3dcompiler_47.dll (22433 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\pdf.dll (69133 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Extensions\citrio_ext.crx (108196 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\sk.pak (251 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\zh-CN.pak (200 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\fr.pak (261 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\es.pak (250 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\fi.pak (229 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\citrio_elf.dll (128 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\PepperFlash\pepflashplayer.dll (110258 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\el.pak (1723 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\sl.pak (227 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\ar.pak (326 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Extensions\share_page.crx (58 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\it.pak (239 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\he.pak (279 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\ms.pak (222 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\gu.pak (1769 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\ffmpegsumo.dll (9606 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\ml.pak (3704 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\pl.pak (239 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\citrio_100_percent.pak (7386 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\metro_driver.dll (1753 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Extensions\external_extensions.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\id.pak (217 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\th.pak (1763 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\PepperFlash\version.json (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\nacl_irt_x86_64.nexe (22433 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\te.pak (1835 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\ja.pak (294 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\fil.pak (248 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\da.pak (221 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\hu.pak (258 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application\citrio.exe (7433 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\libegl.dll (77 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\am.pak (1619 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\41.0.2272.256.manifest (224 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\ru.pak (1649 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\citrio.dll (236168 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\bg.pak (1683 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\VisualElements\smalllogo.png (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Extensions\proxy.crx (1668 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\nb.pak (221 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\uk.pak (1663 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\sw.pak (224 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\fa.pak (1628 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\delegate_execute.exe (3730 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\kn.pak (1845 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\ro.pak (248 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\libglesv2.dll (7386 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\hi.pak (1781 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\ta.pak (1862 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\sv.pak (223 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\lv.pak (246 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\libexif.dll (307 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\lt.pak (241 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\cs.pak (243 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\zh-TW.pak (202 bytes)
%Documents and Settings%\%current user%\Desktop\Citrio.lnk (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Extensions\affiliate.crx (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\bn.pak (1800 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\pt-BR.pak (235 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\en-GB.pak (201 bytes)
%Documents and Settings%\%current user%\Desktop\Chrome Web Store.lnk (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\VisualElementsManifest.xml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\secondarytile.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\et.pak (216 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\citrio_child.dll (266850 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\VisualElements\splash-620x300.png (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\chrome_watcher.dll (225 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\nl.pak (234 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\nacl64.exe (12289 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Extensions\media_downloader.crx (64 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\sr.pak (1648 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\mr.pak (1774 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Extensions\download_all.crx (1761 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Citrio\Citrio.lnk (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\hr.pak (231 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\VisualElements\logo.png (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\citrio.exe (5442 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\nacl_irt_x86_32.nexe (17629 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\tr.pak (241 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\wow_helper.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\citrio.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio (0 bytes)
The process %original file name%.exe:1736 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_sl.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_gu.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUT2.tmp (22433 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_nl.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_te.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_sk.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_el.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ru.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_es-419.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_iw.dll (23 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_no.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_tr.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_sr.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_en-GB.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_da.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ro.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_uk.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_zh-TW.dll (19 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_bn.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ms.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ta.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\CatalinaUpdateBroker.exe (58 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_es.dll (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdate.dll (1990 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_sw.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_de.dll (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_is.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_sv.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_fr.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_en.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_cs.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_mr.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_pt-BR.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_fa.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_kn.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_bg.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_pt-PT.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_id.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_fi.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ja.dll (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\npCatalinaUpdate3.dll (237 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\psuser.dll (161 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ml.dll (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ko.dll (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_th.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ca.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_vi.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_hi.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_zh-CN.dll (19 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_lv.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_hu.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\CatalinaUpdate.exe (130 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ar.dll (24 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_pl.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_hr.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\CatalinaUpdateHelper.msi (36 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_lt.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_et.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_am.dll (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\psmachine.dll (155 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\CatalinaCrashHandler.exe (130 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_it.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_fil.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ur.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\CatalinaUpdateOnDemand.exe (58 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_sl.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_gu.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\CatalinaUpdateBroker.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_nl.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_te.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_sk.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_el.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ru.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_es-419.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_iw.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_no.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_tr.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_sr.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_en-GB.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ja.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_da.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ro.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_uk.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_zh-TW.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_bn.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ms.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ta.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUT2.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_es.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdate.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_sw.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_de.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_is.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_sv.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_fr.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_en.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_cs.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_mr.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_pt-BR.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_fa.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_kn.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_bg.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_pt-PT.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_id.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_fi.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\npCatalinaUpdate3.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\psuser.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ml.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ko.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_th.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ca.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_vi.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_hi.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_zh-CN.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_lv.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_hu.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\CatalinaUpdate.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ar.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_pl.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_hr.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\CatalinaUpdateHelper.msi (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_lt.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_et.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_am.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\psmachine.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\CatalinaCrashHandler.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_it.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_fil.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ur.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\CatalinaUpdateOnDemand.exe (0 bytes)
Registry activity
The process citrio_41.0.2272.256_1.exe:3616 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2D 8B 55 DB D1 DB 80 2E 0E 11 56 40 67 EC 95 95"
[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"ap" = "-full"
The process CatalinaUpdate.exe:1236 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B2 F2 80 46 9C D1 4B 3A 5A C8 B2 41 02 9B F7 47"
[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Integers]
"windows_sp_major_version" = "03 00 00 00 00 00 00 00"
"windows_minor_version" = "01 00 00 00 00 00 00 00"
[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Counts]
"goopdate_main" = "02 00 00 00 00 00 00 00"
[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Integers]
"windows_major_version" = "05 00 00 00 00 00 00 00"
[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Counts]
"goopdate_constructor" = "02 00 00 00 00 00 00 00"
[HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\3E2BF7F2031B96F38CE6C4D8A85D3E2D58476A0F]
"Blob" = "19 00 00 00 01 00 00 00 10 00 00 00 6D 00 C0 25"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\CatalinaGroup\Update\network\secure]
"sk"
[HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates]
"3E2BF7F2031B96F38CE6C4D8A85D3E2D58476A0F"
[HKCU\Software\CatalinaGroup\Update\network\secure]
"c"
The process CatalinaUpdate.exe:1280 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"pv" = "41.0.2272.256"
[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Counts]
"worker_package_cache_put_succeeded" = "01 00 00 00 00 00 00 00"
[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"brand" = "GGLS"
"LastInstallerError" = "0"
"LastInstallerResult" = "0"
"referral" = "1:original"
[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Counts]
"worker_download_total" = "01 00 00 00 00 00 00 00"
[HKCU\Software\CatalinaGroup\Update\proxy]
"source" = "IE"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"usagestats" = "1"
[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Counts]
"worker_package_cache_put_total" = "01 00 00 00 00 00 00 00"
"worker_download_succeeded" = "01 00 00 00 00 00 00 00"
[HKCU\Software\CatalinaGroup\Update]
"LastInstallerError" = "0"
[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Integers]
"windows_minor_version" = "01 00 00 00 00 00 00 00"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"LastInstallerSuccessLaunchCmdLine" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application\citrio.exe"
"lang" = "en"
[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Integers]
"windows_sp_major_version" = "03 00 00 00 00 00 00 00"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKCU\Software\CatalinaGroup\Update]
"LastInstallerSuccessLaunchCmdLine" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application\citrio.exe"
[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Counts]
"goopdate_main" = "06 00 00 00 00 00 00 00"
"worker_install_execute_total" = "01 00 00 00 00 00 00 00"
[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Integers]
"windows_major_version" = "05 00 00 00 00 00 00 00"
[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"LastCheckSuccess" = "1431508102"
[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Counts]
"goopdate_constructor" = "06 00 00 00 00 00 00 00"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update]
"CatalinaUpdate.exe" = "CatalinaGroup Update"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F1 6D 48 A6 F1 03 81 D8 53 68 B0 46 18 98 20 EA"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"InstallTime" = "1431508086"
[HKCU\Software\CatalinaGroup\Update]
"LastInstallerResult" = "0"
[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"iid" = "{2F851C43-A7C8-4061-8931-F5533108A703}"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\CatalinaGroup\Update\network\secure]
"sk"
[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"browser"
"LastInstallerError"
"LastInstallerResultUIString"
"eulaaccepted"
"UpdateAvailableSince"
"tttoken"
[HKCU\Software\CatalinaGroup\Update\network\secure]
"c"
[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"experiment_labels"
"InstallerResult"
"LastInstallerExtraCode1"
[HKCU\Software\CatalinaGroup\Update]
"LastInstallerError"
[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"LastInstallerSuccessLaunchCmdLine"
[HKCU\Software\CatalinaGroup\Update]
"LastInstallerSuccessLaunchCmdLine"
[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"InstallerError"
"LastInstallerResult"
"UpdateAvailableCount"
"InstallerSuccessLaunchCmdLine"
"ap"
[HKCU\Software\CatalinaGroup\Update]
"LastInstallerResultUIString"
"LastInstallerExtraCode1"
"LastInstallerResult"
[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"iid"
The process CatalinaUpdate.exe:208 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{13660822-39AC-408C-BA99-702EBEE3EF26}]
"CLSID" = "{13660822-39AC-408C-BA99-702EBEE3EF26}"
[HKCU\Software\Classes\Interface\{A2589E53-1490-4C0A-BFC7-A47B7A88E3D8}]
"(Default)" = "ICatalinaUpdate3WebSecurity"
[HKCU\Software\Classes\CatalinaGroupUpdate.Update3COMClassUser]
"(Default)" = "Update3COMClass"
[HKCU\Software\Classes\Interface\{0E09406F-1420-4BF4-B6EB-F0994674AD68}]
"(Default)" = "IAppBundle"
[HKCU\Software\Classes\CLSID\{554335BD-87F8-43DA-806A-741504EEFF62}\InProcServer32]
"ThreadingModel" = "Both"
[HKCU\Software\Classes\Interface\{3EA78C6E-8267-4554-8EC6-8982D5AF539A}]
"(Default)" = "ICoCreateAsyncStatus"
[HKCU\Software\Classes\Interface\{0E09406F-1420-4BF4-B6EB-F0994674AD68}\NumMethods]
"(Default)" = "39"
[HKCU\Software\Classes\CLSID\{F4CBF20B-F634-4095-B64A-2EBCDD9E560E}\InprocServer32]
"ThreadingModel" = "Both"
[HKCU\Software\Classes\Interface\{34F067BE-C79C-4C5F-8E64-622A3CC59055}\ProxyStubClsid32]
"(Default)" = "{554335BD-87F8-43DA-806A-741504EEFF62}"
[HKCU\Software\Classes\CLSID\{13660822-39AC-408C-BA99-702EBEE3EF26}\LocalServer32]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\CatalinaUpdateOnDemand.exe"
[HKCU\Software\Classes\Interface\{23185EAB-61B0-4B70-BE89-589585B91392}\NumMethods]
"(Default)" = "8"
[HKCU\Software\Classes\Interface\{C1D8630A-9D2D-4E0E-A4A1-8AA5CA3FAE57}\ProxyStubClsid32]
"(Default)" = "{554335BD-87F8-43DA-806A-741504EEFF62}"
[HKCU\Software\Classes\CLSID\{C8362D5A-4303-4E22-8668-BB10D65B95BD}\VersionIndependentProgID]
"(Default)" = "CatalinaGroupUpdate.OnDemandCOMClassUser"
[HKCU\Software\Classes\CLSID\{2823499B-60F3-4940-8042-2C16D5829A39}\VersionIndependentProgID]
"(Default)" = "CatalinaGroupUpdate.Update3WebUser"
[HKCU\Software\Classes\Interface\{7A1A1D82-1E2B-41B8-9FA3-F40D8DD3EEF0}\ProxyStubClsid32]
"(Default)" = "{554335BD-87F8-43DA-806A-741504EEFF62}"
[HKCU\Software\Classes\Interface\{263B5A28-834A-4D1B-AB71-A28E882CC59B}\NumMethods]
"(Default)" = "13"
[HKCU\Software\Classes\CatalinaGroupUpdate.CredentialDialogUser]
"(Default)" = "GoogleUpdate CredentialDialog"
[HKCU\Software\Classes\Interface\{7C9F9415-9947-482C-A62B-24A0BD92B8A7}\NumMethods]
"(Default)" = "4"
[HKCU\Software\Classes\Interface\{A2589E53-1490-4C0A-BFC7-A47B7A88E3D8}\ProxyStubClsid32]
"(Default)" = "{554335BD-87F8-43DA-806A-741504EEFF62}"
[HKCU\Software\Classes\Interface\{C1D8630A-9D2D-4E0E-A4A1-8AA5CA3FAE57}]
"(Default)" = "ICredentialDialog"
[HKCU\Software\Classes\Interface\{A1E6F38D-8C9E-4BDA-86A2-1940472A8429}]
"(Default)" = "ICatalinaUpdate"
[HKCU\Software\Classes\Interface\{FFC6ECB2-25E8-40EE-BF37-5AA25CBCBA63}\NumMethods]
"(Default)" = "10"
[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Counts]
"goopdate_main" = "01 00 00 00 00 00 00 00"
[HKCU\Software\Classes\Interface\{D085AC3B-E5CC-40C9-8366-C12ADC489967}\ProxyStubClsid32]
"(Default)" = "{554335BD-87F8-43DA-806A-741504EEFF62}"
[HKCU\Software\Classes\Interface\{789E3792-8514-4ED5-90F3-5B525275B953}\ProxyStubClsid32]
"(Default)" = "{554335BD-87F8-43DA-806A-741504EEFF62}"
[HKCU\Software\Classes\Interface\{FCD277CC-8D3E-4264-80D3-98E7B05E2E8A}\ProxyStubClsid32]
"(Default)" = "{554335BD-87F8-43DA-806A-741504EEFF62}"
[HKCU\Software\Classes\CLSID\{3C564FFE-55F7-43AC-886C-7E9E9091CB2A}]
"(Default)" = "Update3COMClass"
[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Integers]
"windows_sp_major_version" = "03 00 00 00 00 00 00 00"
[HKCU\Software\Classes\CLSID\{73436A91-85A6-4850-A7D0-375C4E369A5A}\ProgID]
"(Default)" = "CatalinaGroupUpdate.CredentialDialogUser.1.0"
[HKCU\Software\Classes\CLSID\{13660822-39AC-408C-BA99-702EBEE3EF26}]
"(Default)" = "CatalinaGroup.OneClickProcessLauncher"
[HKCU\Software\Classes\Interface\{263B5A28-834A-4D1B-AB71-A28E882CC59B}\ProxyStubClsid32]
"(Default)" = "{554335BD-87F8-43DA-806A-741504EEFF62}"
[HKCU\Software\Classes\CLSID\{C8362D5A-4303-4E22-8668-BB10D65B95BD}]
"(Default)" = "Google Update Legacy On Demand"
[HKCU\Software\Classes\CatalinaGroupUpdate.Update3WebUser\CurVer]
"(Default)" = "CatalinaGroupUpdate.Update3WebUser.1.0"
[HKCU\Software\Classes\Interface\{FCD277CC-8D3E-4264-80D3-98E7B05E2E8A}\NumMethods]
"(Default)" = "10"
[HKCU\Software\Classes\Interface\{CBAC6FCC-819A-443D-98BB-E7A122DCCAE3}\NumMethods]
"(Default)" = "4"
[HKCU\Software\Classes\Interface\{7C9F9415-9947-482C-A62B-24A0BD92B8A7}\ProxyStubClsid32]
"(Default)" = "{554335BD-87F8-43DA-806A-741504EEFF62}"
[HKCU\Software\Classes\Interface\{0CD725CD-5650-4F13-91DA-E42FAA9687E8}\ProxyStubClsid32]
"(Default)" = "{554335BD-87F8-43DA-806A-741504EEFF62}"
[HKCU\Software\Classes\CatalinaGroupUpdate.Update3WebUser\CLSID]
"(Default)" = "{2823499B-60F3-4940-8042-2C16D5829A39}"
[HKCU\Software\Classes\Interface\{FCD277CC-8D3E-4264-80D3-98E7B05E2E8A}]
"(Default)" = "IAppVersionWeb"
[HKCU\Software\Classes\CatalinaGroupUpdate.CredentialDialogUser.1.0]
"(Default)" = "GoogleUpdate CredentialDialog"
[HKCU\Software\Classes\Interface\{84BA4DAC-82EA-4DC8-BCB0-B69DD6E95670}\ProxyStubClsid32]
"(Default)" = "{554335BD-87F8-43DA-806A-741504EEFF62}"
[HKCU\Software\Classes\CLSID\{554335BD-87F8-43DA-806A-741504EEFF62}]
"(Default)" = "PSFactoryBuffer"
[HKCU\Software\Classes\Interface\{F009E353-D4BD-42FE-994E-F6C315055F9B}\ProxyStubClsid32]
"(Default)" = "{554335BD-87F8-43DA-806A-741504EEFF62}"
[HKCU\Software\Classes\CatalinaGroupUpdate.Update3COMClassUser\CurVer]
"(Default)" = "CatalinaGroupUpdate.Update3COMClassUser.1.0"
[HKCU\Software\Classes\CLSID\{73436A91-85A6-4850-A7D0-375C4E369A5A}\VersionIndependentProgID]
"(Default)" = "CatalinaGroupUpdate.CredentialDialogUser"
[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Integers]
"windows_minor_version" = "01 00 00 00 00 00 00 00"
[HKCU\Software\Classes\Interface\{CBAC6FCC-819A-443D-98BB-E7A122DCCAE3}]
"(Default)" = "IOneClickProcessLauncher"
[HKCU\Software\Classes\Interface\{051D14B3-CF0F-4CCA-B8FE-AF9E007ACD43}\NumMethods]
"(Default)" = "4"
[HKCU\Software\Classes\Interface\{051D14B3-CF0F-4CCA-B8FE-AF9E007ACD43}]
"(Default)" = "ICoCreateAsync"
[HKCU\Software\Classes\Interface\{F9F2D675-F172-42F2-A26E-6453B80EA7F1}]
"(Default)" = "ICurrentState"
[HKCU\Software\Classes\CLSID\{3C564FFE-55F7-43AC-886C-7E9E9091CB2A}\ProgID]
"(Default)" = "CatalinaGroupUpdate.Update3COMClassUser.1.0"
[HKCU\Software\Classes\Interface\{789E3792-8514-4ED5-90F3-5B525275B953}]
"(Default)" = "IAppBundleWeb"
[HKCU\Software\Classes\Interface\{D085AC3B-E5CC-40C9-8366-C12ADC489967}]
"(Default)" = "IApp"
[HKCU\Software\Classes\Interface\{A1E6F38D-8C9E-4BDA-86A2-1940472A8429}\NumMethods]
"(Default)" = "5"
[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Integers]
"windows_major_version" = "05 00 00 00 00 00 00 00"
[HKCU\Software\Classes\CatalinaGroup.OneClickProcessLauncherUser\CLSID]
"(Default)" = "{13660822-39AC-408C-BA99-702EBEE3EF26}"
[HKCU\Software\Classes\CLSID\{554335BD-87F8-43DA-806A-741504EEFF62}\InProcServer32]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\psuser.dll"
[HKCU\Software\Classes\Interface\{A1E6F38D-8C9E-4BDA-86A2-1940472A8429}\ProxyStubClsid32]
"(Default)" = "{554335BD-87F8-43DA-806A-741504EEFF62}"
[HKCU\Software\Classes\CatalinaGroupUpdate.CredentialDialogUser\CLSID]
"(Default)" = "{73436A91-85A6-4850-A7D0-375C4E369A5A}"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "18 02 65 F4 AF 74 89 18 6F F5 68 83 10 85 BD E1"
[HKCU\Software\Classes\Interface\{D085AC3B-E5CC-40C9-8366-C12ADC489967}\NumMethods]
"(Default)" = "44"
[HKCU\Software\Classes\CLSID\{13660822-39AC-408C-BA99-702EBEE3EF26}\VersionIndependentProgID]
"(Default)" = "CatalinaGroup.OneClickProcessLauncherUser"
[HKCU\Software\Classes\CatalinaGroupUpdate.Update3WebUser.1.0]
"(Default)" = "GoogleUpdate Update3Web"
[HKCU\Software\Classes\Interface\{C1D8630A-9D2D-4E0E-A4A1-8AA5CA3FAE57}\NumMethods]
"(Default)" = "4"
[HKCU\Software\Classes\Interface\{0CD725CD-5650-4F13-91DA-E42FAA9687E8}\NumMethods]
"(Default)" = "10"
[HKCU\Software\Classes\Interface\{34F067BE-C79C-4C5F-8E64-622A3CC59055}\NumMethods]
"(Default)" = "9"
[HKCU\Software\Classes\Interface\{EC3867B7-B9EF-494E-B42B-BA009D57D90E}\NumMethods]
"(Default)" = "6"
[HKCU\Software\Classes\Interface\{6B6DE56F-09F2-4343-80AD-28E5D6CB78F9}\ProxyStubClsid32]
"(Default)" = "{554335BD-87F8-43DA-806A-741504EEFF62}"
[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{13660822-39AC-408C-BA99-702EBEE3EF26}]
"Policy" = "3"
[HKCU\Software\Classes\Interface\{F9F2D675-F172-42F2-A26E-6453B80EA7F1}\ProxyStubClsid32]
"(Default)" = "{554335BD-87F8-43DA-806A-741504EEFF62}"
[HKCU\Software\Classes\Interface\{0E09406F-1420-4BF4-B6EB-F0994674AD68}\ProxyStubClsid32]
"(Default)" = "{554335BD-87F8-43DA-806A-741504EEFF62}"
[HKCU\Software\Classes\Interface\{6B6DE56F-09F2-4343-80AD-28E5D6CB78F9}\NumMethods]
"(Default)" = "14"
[HKCU\Software\Classes\CLSID\{2823499B-60F3-4940-8042-2C16D5829A39}\ProgID]
"(Default)" = "CatalinaGroupUpdate.Update3WebUser.1.0"
[HKCU\Software\Classes\Interface\{7C9F9415-9947-482C-A62B-24A0BD92B8A7}]
"(Default)" = "ICatalinaUpdateCore"
[HKCU\Software\Classes\Interface\{3EA78C6E-8267-4554-8EC6-8982D5AF539A}\NumMethods]
"(Default)" = "10"
[HKCU\Software\Classes\CLSID\{73436A91-85A6-4850-A7D0-375C4E369A5A}\LocalServer32]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\CatalinaUpdateOnDemand.exe"
[HKCU\Software\Classes\Interface\{051D14B3-CF0F-4CCA-B8FE-AF9E007ACD43}\ProxyStubClsid32]
"(Default)" = "{554335BD-87F8-43DA-806A-741504EEFF62}"
[HKCU\Software\Classes\CatalinaGroup.OneClickProcessLauncherUser.1.0]
"(Default)" = "CatalinaGroup.OneClickProcessLauncher"
[HKCU\Software\Classes\CLSID\{2823499B-60F3-4940-8042-2C16D5829A39}]
"(Default)" = "GoogleUpdate Update3Web"
[HKCU\Software\Classes\CLSID\{13660822-39AC-408C-BA99-702EBEE3EF26}\ProgID]
"(Default)" = "CatalinaGroup.OneClickProcessLauncherUser.1.0"
[HKCU\Software\Classes\Interface\{CBAC6FCC-819A-443D-98BB-E7A122DCCAE3}\ProxyStubClsid32]
"(Default)" = "{554335BD-87F8-43DA-806A-741504EEFF62}"
[HKCU\Software\Classes\CatalinaGroup.OneClickProcessLauncherUser\CurVer]
"(Default)" = "CatalinaGroup.OneClickProcessLauncherUser.1.0"
[HKCU\Software\Classes\CLSID\{2823499B-60F3-4940-8042-2C16D5829A39}\LocalServer32]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\CatalinaUpdateOnDemand.exe"
[HKCU\Software\Classes\Interface\{FFC6ECB2-25E8-40EE-BF37-5AA25CBCBA63}\ProxyStubClsid32]
"(Default)" = "{554335BD-87F8-43DA-806A-741504EEFF62}"
[HKCU\Software\Classes\Interface\{84BA4DAC-82EA-4DC8-BCB0-B69DD6E95670}\NumMethods]
"(Default)" = "10"
[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Counts]
"goopdate_constructor" = "01 00 00 00 00 00 00 00"
[HKCU\Software\Classes\Interface\{FFC6ECB2-25E8-40EE-BF37-5AA25CBCBA63}]
"(Default)" = "ICatalinaUpdate3"
[HKCU\Software\Classes\Interface\{263B5A28-834A-4D1B-AB71-A28E882CC59B}]
"(Default)" = "IJobObserver"
[HKCU\Software\Classes\Interface\{0CD725CD-5650-4F13-91DA-E42FAA9687E8}]
"(Default)" = "IAppVersion"
[HKCU\Software\Classes\CatalinaGroupUpdate.OnDemandCOMClassUser.1.0]
"(Default)" = "Google Update Legacy On Demand"
[HKCU\Software\Classes\CLSID\{D6C70234-3948-4009-8568-A538F47646CB}\InprocHandler32]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\psuser.dll"
[HKCU\Software\Classes\Interface\{F009E353-D4BD-42FE-994E-F6C315055F9B}]
"(Default)" = "ICatalinaUpdate3Web"
[HKCU\Software\Classes\Interface\{F009E353-D4BD-42FE-994E-F6C315055F9B}\NumMethods]
"(Default)" = "8"
[HKCU\Software\Classes\Interface\{A2589E53-1490-4C0A-BFC7-A47B7A88E3D8}\NumMethods]
"(Default)" = "4"
[HKCU\Software\Classes\Interface\{23185EAB-61B0-4B70-BE89-589585B91392}\ProxyStubClsid32]
"(Default)" = "{554335BD-87F8-43DA-806A-741504EEFF62}"
[HKCU\Software\Classes\Interface\{EC3867B7-B9EF-494E-B42B-BA009D57D90E}\ProxyStubClsid32]
"(Default)" = "{554335BD-87F8-43DA-806A-741504EEFF62}"
[HKCU\Software\Classes\CLSID\{3C564FFE-55F7-43AC-886C-7E9E9091CB2A}\VersionIndependentProgID]
"(Default)" = "CatalinaGroupUpdate.Update3COMClassUser"
[HKCU\Software\Classes\CatalinaGroupUpdate.OnDemandCOMClassUser\CLSID]
"(Default)" = "{C8362D5A-4303-4E22-8668-BB10D65B95BD}"
[HKCU\Software\Classes\Interface\{7A1A1D82-1E2B-41B8-9FA3-F40D8DD3EEF0}]
"(Default)" = "IBrowserHttpRequest2"
[HKCU\Software\Classes\CLSID\{F4CBF20B-F634-4095-B64A-2EBCDD9E560E}\InprocServer32]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\psuser.dll"
[HKCU\Software\Classes\CatalinaGroupUpdate.Update3WebUser.1.0\CLSID]
"(Default)" = "{2823499B-60F3-4940-8042-2C16D5829A39}"
[HKCU\Software\Classes\CatalinaGroupUpdate.Update3COMClassUser.1.0]
"(Default)" = "Update3COMClass"
[HKCU\Software\Classes\Interface\{789E3792-8514-4ED5-90F3-5B525275B953}\NumMethods]
"(Default)" = "24"
[HKCU\Software\Classes\Interface\{84BA4DAC-82EA-4DC8-BCB0-B69DD6E95670}]
"(Default)" = "IPackage"
[HKCU\Software\Classes\Interface\{7A1A1D82-1E2B-41B8-9FA3-F40D8DD3EEF0}\NumMethods]
"(Default)" = "4"
[HKCU\Software\Classes\CLSID\{C8362D5A-4303-4E22-8668-BB10D65B95BD}\LocalServer32]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\CatalinaUpdateOnDemand.exe"
[HKCU\Software\Classes\Interface\{3EA78C6E-8267-4554-8EC6-8982D5AF539A}\ProxyStubClsid32]
"(Default)" = "{554335BD-87F8-43DA-806A-741504EEFF62}"
[HKCU\Software\Classes\CLSID\{3C564FFE-55F7-43AC-886C-7E9E9091CB2A}\LocalServer32]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\CatalinaUpdate.exe"
[HKCU\Software\Classes\CatalinaGroupUpdate.Update3COMClassUser.1.0\CLSID]
"(Default)" = "{3C564FFE-55F7-43AC-886C-7E9E9091CB2A}"
[HKCU\Software\Classes\Interface\{6B6DE56F-09F2-4343-80AD-28E5D6CB78F9}]
"(Default)" = "IAppWeb"
[HKCU\Software\Classes\CatalinaGroupUpdate.OnDemandCOMClassUser.1.0\CLSID]
"(Default)" = "{C8362D5A-4303-4E22-8668-BB10D65B95BD}"
[HKCU\Software\Classes\CatalinaGroupUpdate.Update3WebUser]
"(Default)" = "GoogleUpdate Update3Web"
[HKCU\Software\Classes\CatalinaGroup.OneClickProcessLauncherUser]
"(Default)" = "CatalinaGroup.OneClickProcessLauncher"
[HKCU\Software\Classes\CLSID\{D6C70234-3948-4009-8568-A538F47646CB}\InprocHandler32]
"ThreadingModel" = "Both"
[HKCU\Software\Classes\Interface\{F9F2D675-F172-42F2-A26E-6453B80EA7F1}\NumMethods]
"(Default)" = "24"
[HKCU\Software\Classes\CatalinaGroup.OneClickProcessLauncherUser.1.0\CLSID]
"(Default)" = "{13660822-39AC-408C-BA99-702EBEE3EF26}"
[HKCU\Software\Classes\Interface\{EC3867B7-B9EF-494E-B42B-BA009D57D90E}]
"(Default)" = "IProcessLauncher"
[HKCU\Software\Classes\CatalinaGroupUpdate.OnDemandCOMClassUser\CurVer]
"(Default)" = "CatalinaGroupUpdate.OnDemandCOMClassUser.1.0"
[HKCU\Software\Classes\CLSID\{C8362D5A-4303-4E22-8668-BB10D65B95BD}\ProgID]
"(Default)" = "CatalinaGroupUpdate.OnDemandCOMClassUser.1.0"
[HKCU\Software\Classes\CatalinaGroupUpdate.Update3COMClassUser\CLSID]
"(Default)" = "{3C564FFE-55F7-43AC-886C-7E9E9091CB2A}"
[HKCU\Software\Classes\CatalinaGroupUpdate.CredentialDialogUser\CurVer]
"(Default)" = "CatalinaGroupUpdate.CredentialDialogUser.1.0"
[HKCU\Software\Classes\Interface\{34F067BE-C79C-4C5F-8E64-622A3CC59055}]
"(Default)" = "IProgressWndEvents"
[HKCU\Software\Classes\CatalinaGroupUpdate.OnDemandCOMClassUser]
"(Default)" = "Google Update Legacy On Demand"
[HKCU\Software\Classes\CLSID\{73436A91-85A6-4850-A7D0-375C4E369A5A}]
"(Default)" = "GoogleUpdate CredentialDialog"
[HKCU\Software\Classes\CatalinaGroupUpdate.CredentialDialogUser.1.0\CLSID]
"(Default)" = "{73436A91-85A6-4850-A7D0-375C4E369A5A}"
[HKCU\Software\Classes\Interface\{23185EAB-61B0-4B70-BE89-589585B91392}]
"(Default)" = "IRegistrationUpdateHook"
The Trojan deletes the following registry key(s):
[HKCU\Software\Classes\CLSID\{F4CBF20B-F634-4095-B64A-2EBCDD9E560E}]
[HKCU\Software\Classes\CLSID\{F4CBF20B-F634-4095-B64A-2EBCDD9E560E}\InprocServer32]
[HKCU\Software\Classes\CLSID\{D6C70234-3948-4009-8568-A538F47646CB}\InprocHandler32]
[HKCU\Software\Classes\CLSID\{D6C70234-3948-4009-8568-A538F47646CB}]
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\CatalinaGroup\Update\network\secure]
"sk"
"c"
The process CatalinaUpdate.exe:456 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "95 B5 EA 87 FD A9 A7 89 7B D7 92 DA F8 B3 51 60"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Integers]
"windows_sp_major_version" = "03 00 00 00 00 00 00 00"
[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"usagestats" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"LangID" = "09 04"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application]
"citrio.exe" = "Citrio"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Integers]
"windows_minor_version" = "01 00 00 00 00 00 00 00"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Counts]
"goopdate_main" = "03 00 00 00 00 00 00 00"
[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Integers]
"windows_major_version" = "05 00 00 00 00 00 00 00"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Counts]
"goopdate_constructor" = "03 00 00 00 00 00 00 00"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\CatalinaGroup\Update]
"eulaaccepted"
[HKCU\Software\CatalinaGroup\Update\network\secure]
"sk"
"c"
The process CatalinaUpdate.exe:1932 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{841F4080-C687-4E9C-BD6E-EB5EECF4FAE6}]
"Policy" = "3"
[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Counts]
"opt_in_uid_generated" = "01 00 00 00 00 00 00 00"
"setup_should_install_total" = "01 00 00 00 00 00 00 00"
[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Timings]
"setup_install_google_update_total_ms" = "01 00 00 00 00 00 00 00 D7 04 00 00 00 00 00 00"
[HKCU\Software\Classes\CLSID\{841F4080-C687-4E9C-BD6E-EB5EECF4FAE6}\ProgID]
"(Default)" = "CatalinaGroup.OneClickCtrl.9"
[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Counts]
"setup_should_install_true_fresh_install" = "01 00 00 00 00 00 00 00"
[HKCU\Software\CatalinaGroup\Update\ClientState\{6C598730-F715-407B-A7AE-A8F10D0F8FA7}]
"iid" = "{2F851C43-A7C8-4061-8931-F5533108A703}"
[HKCU\Software\CatalinaGroup\Update]
"UID" = "{802C7BA9-B484-4EEE-84A7-5BB18059CB01}"
[HKCU\Software\Classes\MIME\Database\Content Type\application/x-vnd.catalinahub.oneclickctrl.9]
"CLSID" = "{841F4080-C687-4E9C-BD6E-EB5EECF4FAE6}"
[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Integers]
"windows_minor_version" = "01 00 00 00 00 00 00 00"
[HKCU\Software\Classes\CatalinaGroup.OneClickCtrl.9\CLSID]
"(Default)" = "{841F4080-C687-4E9C-BD6E-EB5EECF4FAE6}"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Classes\CLSID\{841F4080-C687-4E9C-BD6E-EB5EECF4FAE6}]
"(Default)" = "CatalinaGroup Update Plugin"
[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{71216BD6-4D03-4387-BD01-7FE8D9512541}]
"Policy" = "3"
[HKCU\Software\Classes\MIME\Database\Content Type\application/x-vnd.catalinahub.update3webcontrol.3]
"CLSID" = "{71216BD6-4D03-4387-BD01-7FE8D9512541}"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Timings]
"setup_phase2_ms" = "01 00 00 00 00 00 00 00 52 03 00 00 00 00 00 00"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{841F4080-C687-4E9C-BD6E-EB5EECF4FAE6}]
"AppName" = "CatalinaUpdate.exe"
[HKCU\Software\CatalinaGroup\Update]
"Version" = "1.3.25.215"
[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"usagestats" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
[HKCU\Software\CatalinaGroup\Update\Clients\{6C598730-F715-407B-A7AE-A8F10D0F8FA7}]
"Name" = "Catalina Update"
[HKCU\Software\MozillaPlugins\@catalinahub.com/CatalinaGroup Update;version=3]
"vendor" = "Catalina Group Ltd."
[HKCU\Software\CatalinaGroup\Update\ClientState\{6C598730-F715-407B-A7AE-A8F10D0F8FA7}]
"InstallTime" = "1431508029"
[HKCU\Software\Classes\CLSID\{841F4080-C687-4E9C-BD6E-EB5EECF4FAE6}\InprocServer32]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\npCatalinaUpdate3.dll"
[HKCU\Software\MozillaPlugins\@catalinahub.com/CatalinaGroup Update;version=3]
"Description" = "CatalinaGroup Update"
[HKCU\Software\Classes\CatalinaGroup.Update3WebControl.3]
"(Default)" = "CatalinaGroup Update Plugin"
[HKCU\Software\MozillaPlugins\@catalinahub.com/CatalinaGroup Update;version=9]
"Path" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\npCatalinaUpdate3.dll"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Counts]
"setup_do_self_install_total" = "01 00 00 00 00 00 00 00"
[HKCU\Software\MozillaPlugins\@catalinahub.com/CatalinaGroup Update;version=9]
"Description" = "CatalinaGroup Update"
[HKCU\Software\Classes\CLSID\{841F4080-C687-4E9C-BD6E-EB5EECF4FAE6}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\MozillaPlugins\@catalinahub.com/CatalinaGroup Update;version=9]
"vendor" = "Catalina Group Ltd."
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Counts]
"setup_install_task_succeeded" = "01 00 00 00 00 00 00 00"
[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{841F4080-C687-4E9C-BD6E-EB5EECF4FAE6}]
"AppPath" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update"
[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Integers]
"windows_sp_major_version" = "03 00 00 00 00 00 00 00"
[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Timings]
"setup_lock_acquire_ms" = "01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00"
[HKCU\Software\Classes\CLSID\{71216BD6-4D03-4387-BD01-7FE8D9512541}\InprocServer32]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\npCatalinaUpdate3.dll"
[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Counts]
"setup_files_total" = "01 00 00 00 00 00 00 00"
"goopdate_main" = "04 00 00 00 00 00 00 00"
[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{71216BD6-4D03-4387-BD01-7FE8D9512541}]
"AppPath" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215"
[HKCU\Software\CatalinaGroup\Update\ClientState\{6C598730-F715-407B-A7AE-A8F10D0F8FA7}]
"pv" = "1.3.25.215"
"brand" = "GGLS"
[HKCU\Software\Classes\CatalinaGroup.Update3WebControl.3\CLSID]
"(Default)" = "{71216BD6-4D03-4387-BD01-7FE8D9512541}"
[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{71216BD6-4D03-4387-BD01-7FE8D9512541}]
"AppName" = "CatalinaUpdateOnDemand.exe"
[HKCU\Software\CatalinaGroup\Update]
"Path" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\CatalinaUpdate.exe"
[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Counts]
"goopdate_constructor" = "04 00 00 00 00 00 00 00"
"setup_do_self_install_succeeded" = "01 00 00 00 00 00 00 00"
"setup_install_succeeded" = "01 00 00 00 00 00 00 00"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update]
"CatalinaUpdate.exe" = "CatalinaGroup Update"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8E 5C 52 B5 07 B7 6C EE BA 0D 62 81 44 C9 AA F2"
[HKCU\Software\Classes\CLSID\{71216BD6-4D03-4387-BD01-7FE8D9512541}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\CatalinaGroup\Update\Clients\{6C598730-F715-407B-A7AE-A8F10D0F8FA7}]
"pv" = "1.3.25.215"
[HKCU\Software\MozillaPlugins\@catalinahub.com/CatalinaGroup Update;version=3]
"ProductName" = "CatalinaGroup Update"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKCU\Software\Classes\CLSID\{71216BD6-4D03-4387-BD01-7FE8D9512541}\ProgID]
"(Default)" = "CatalinaGroup.Update3WebControl.3"
[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Timings]
"setup_install_task_ms" = "01 00 00 00 00 00 00 00 F6 00 00 00 00 00 00 00"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Classes\CatalinaGroup.OneClickCtrl.9]
"(Default)" = "CatalinaGroup Update Plugin"
[HKCU\Software\MozillaPlugins\@catalinahub.com/CatalinaGroup Update;version=9]
"ProductName" = "CatalinaGroup Update"
[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Counts]
"setup_install_total" = "01 00 00 00 00 00 00 00"
[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Integers]
"windows_major_version" = "05 00 00 00 00 00 00 00"
[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Counts]
"setup_files_verification_succeeded" = "01 00 00 00 00 00 00 00"
[HKCU\Software\MozillaPlugins\@catalinahub.com/CatalinaGroup Update;version=3]
"Path" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\npCatalinaUpdate3.dll"
[HKCU\Software\MozillaPlugins\@catalinahub.com/CatalinaGroup Update;version=9]
"Version" = "9"
[HKCU\Software\Classes\CLSID\{71216BD6-4D03-4387-BD01-7FE8D9512541}]
"(Default)" = "CatalinaGroup Update Plugin"
[HKCU\Software\MozillaPlugins\@catalinahub.com/CatalinaGroup Update;version=3]
"Version" = "3"
[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Timings]
"setup_files_ms" = "01 00 00 00 00 00 00 00 7A 01 00 00 00 00 00 00"
To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"CatalinaGroup Update" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\CatalinaUpdate.exe /c"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\CatalinaGroup\Update]
"ui"
[HKCU\Software\CatalinaGroup\Update\network\secure]
"sk"
[HKCU\Software\CatalinaGroup\Update]
"eulaaccepted"
[HKCU\Software\CatalinaGroup\Update\ClientState\{6C598730-F715-407B-A7AE-A8F10D0F8FA7}]
"UpdateAvailableSince"
[HKCU\Software\CatalinaGroup\Update\network\secure]
"c"
[HKCU\Software\CatalinaGroup\Update\ClientState\{6C598730-F715-407B-A7AE-A8F10D0F8FA7}]
"UpdateAvailableCount"
[HKCU\Software\CatalinaGroup\Update]
"LastChecked"
The process CatalinaUpdate.exe:2836 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5A EB 65 48 A1 13 98 C7 0A FD E7 38 93 86 55 98"
[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Integers]
"windows_sp_major_version" = "03 00 00 00 00 00 00 00"
[HKCU\Software\CatalinaGroup\Update\proxy]
"source" = "IE"
[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Integers]
"windows_minor_version" = "01 00 00 00 00 00 00 00"
[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Counts]
"goopdate_main" = "05 00 00 00 00 00 00 00"
[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Integers]
"windows_major_version" = "05 00 00 00 00 00 00 00"
[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Counts]
"goopdate_constructor" = "05 00 00 00 00 00 00 00"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\CatalinaGroup\Update\network\secure]
"sk"
"c"
The process citrio.exe:3808 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "83 C7 F7 90 E6 16 78 33 91 96 75 4F 81 3C 89 7A"
[HKCU\Software\Trolltech\OrganizationDefaults\Qt Plugin Cache 4.8.false\%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Extensions\dcagnhpbnggmbihndfkkhfjojgbaaedo\1.2.20_0\binaries\win\imageformats]
"qico4.dll" = "40806, 0, Windows msvc release full-config, 2015-05-04T17:08:28"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
The process citrio.exe:3804 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AC 6F 03 05 20 81 F2 CF 7D AB E9 01 9C 75 75 0E"
The process citrio.exe:3492 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C2 F5 02 92 B4 8D 99 6F 8F C4 BF 84 99 C1 AE B3"
The process citrio.exe:2808 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Classes\.rv]
"(Default)" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
[HKCU\Software\Classes\.3g2]
"(Default)" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\WLanDiagCtlGuid]
"BitNames" = " WLANHC_AUTOCONFIG WLANHC_RNWFMSM WLANHC_FATMSM WLANHC_DLLMAIN WLANHC_TEST"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\ServiceCtlGuid]
"BitNames" = " DOT11_AUTOCONF DOT11_AUTOCONF_CLIENT DOT11_AUTOCONF_UI DOT11_FATMSM DOT11_COMMON DOT11_WLANGPA DOT11_CLASS_COINSTALLER"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\DiagL2SecCtlGuid]
"Guid" = "2e8d9ec5-a712-48c4-8ce0-631eb0c1cd65"
[HKCU\Software\Classes\.mov]
"(Default)" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
[HKCU\Software\Classes\.flv]
"(Default)" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Personal" = "%Documents and Settings%\%current user%\My Documents"
[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"metricsid_installdate" = "0"
[HKCU\Software\Classes\.m4v]
"(Default)" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"dr" = "1"
[HKCU\Software\Classes\.mkv]
"(Default)" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"usagestats" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
[HKCU\Software\CatalinaGroup\Citrio\BLBeacon]
"Version" = "41.0.2272.256"
[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"metricsid_enableddate" = "1431508104"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\CtlGuid]
"BitNames" = " DOT11_ASSOCIATE DOT11_ROAMING DOT11_1X DOT11_PNP DOT11_SCAN DOT11_RECEIVE DOT11_SEND DOT11_IOCTL DOT11_OID DOT11_MISC DOT11_UPCALL DOT11_KEYMGR DOT11_PEER DOT11_SOFTAP DOT11_PAM DOT11_REPEATER DOT11_APROUTER DOT11_WME DOT11_CONFIG DOT11_MSM DOT11_MSM_ADAPT DOT11_MSM_SCAN DOT11_MSM_CONNECT DOT11_MSM_SECURITY_PKT DOT11_NOTIFY_OBJECT"
[HKCU\Software\Classes\.OGG]
"(Default)" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
[HKCU\Software\Classes\.m2v]
"(Default)" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
[HKCU\Software\CatalinaGroup\Citrio\StabilityMetrics]
"user_experience_metrics.stability.exited_cleanly" = "0"
[HKCU\Software\CatalinaGroup\Citrio\BLBeacon]
"State" = "1"
[HKCU\Software\Classes\.avi]
"(Default)" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
[HKCU\Software\Classes\.rm]
"(Default)" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing]
"LogSessionName" = "stdout"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\ServiceCtlGuid]
"Guid" = "0c5a3172-2248-44fd-b9a6-8389cb1dc56a"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\DiagL2SecCtlGuid]
"BitNames" = " SECHC_LOG_FLAG_ASSERT SECHC_LOG_FLAG_INIT SECHC_LOG_FLAG_DIAG SECHC_LOG_FLAG_ONEX_DIAG SECHC_LOG_FLAG_REPAIR SECHC_LOG_FLAG_STATE SECHC_LOG_FLAG_EXT SECHC_LOG_FLAG_EVENT_LOG SECHC_LOG_FLAG_FUNCTION SECHC_LOG_FLAG_MEMORY SECHC_LOG_FLAG_LOCKS"
[HKCU\Software\CatalinaGroup\Citrio]
"AssociationsRegistry" = "3"
[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"lastrun" = "13075981714062625"
[HKCR\TypeLib\{1EA4DBF0-3C3B-11CF-810C-00AA00389B71}\1.1\0\win32]
"(Default)" = "%System%\oleacc.dll"
[HKCU\Software\Classes\.ogv]
"(Default)" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
[HKCU\Software\Classes\.wmv]
"(Default)" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"_NumSignedIn" = "0"
[HKCU\Software\Classes\.mpg]
"(Default)" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
[HKCU\Software\Classes\.ogm]
"(Default)" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing]
"Active" = "1"
[HKCU\Software\CatalinaGroup\Citrio\BLBeacon]
"failed_count" = "0"
[HKCU\Software\Classes\.3gp]
"(Default)" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4F 5E EF 1B 25 5A 29 6A AB 91 92 9B 5C B5 CA 0C"
[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"metricsid" = "6BBAC4F3-050F-4F25-8599-2A2C6FD01074"
[HKCU\Software\Classes\.mp4]
"(Default)" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\CtlGuid]
"Guid" = "d905ac1c-65e7-4242-99ea-fe66a8355df8"
[HKCU\Software\Classes\.webm]
"(Default)" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
[HKCU\Software\Classes\.MP2]
"(Default)" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\WDiagCoreCtlGuid]
"BitNames" = " WD_LOG_FLAG_INIT WD_LOG_FLAG_RPC WD_LOG_FLAG_EVENT WD_LOG_FLAG_INTERFACE WD_LOG_FLAG_CONNECTION WD_LOG_FLAG_CONTROL WD_LOG_FLAG_LOCKS WD_LOG_FLAG_MEMORY WD_LOG_FLAG_REFERENCES WD_LOG_FLAG_FUNCTION_TRACE WD_LOG_FLAG_ASSERT"
[HKCU\Software\Classes\.nsv]
"(Default)" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing]
"ControlFlags" = "1"
[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"_NumAccounts" = "1"
[HKCU\Software\Classes\.asf]
"(Default)" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\WLanDiagCtlGuid]
"Guid" = "6da4ddca-0901-4bae-9ad4-7e6030bab531"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\WDiagCoreCtlGuid]
"Guid" = "637a0f36-dff5-4b2f-83dd-b106c1c725e2"
The Trojan deletes the following registry key(s):
[HKCU\Software\CatalinaGroup\Citrio\BLFinchList]
The process citrio.exe:3148 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "98 10 8E 5E 5E 75 51 D7 7C AD 8C C8 A5 B8 50 9B"
The process citrio.exe:3244 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D5 90 93 DB FD 00 21 F0 F0 D3 63 2E 87 2C C3 E4"
The process citrio.exe:3160 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "82 F5 8B C4 CE 0B 79 BD 91 58 C1 7F 01 99 5C D3"
The process citrio.exe:224 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BE 0C 6D 8B 09 37 08 3F 99 10 FA BF C3 9C 04 06"
The process citrio.exe:3368 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CD 79 BD 21 47 4F 84 2C 2F 0B D1 72 EB 74 D6 10"
The process citrio.exe:3472 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D3 47 F2 3F C7 09 51 A2 03 F9 66 F1 FA 46 23 20"
The process citrio.exe:2484 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F3 C3 58 4F 66 76 E8 82 47 93 08 D2 D3 BB 42 A8"
The process citrio.exe:656 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D3 22 DD 46 D7 31 65 FA 9D CA 38 76 E1 84 C3 F5"
The process citrio.exe:1096 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "81 DA 23 EE 01 6F 05 B7 9C 96 A9 66 46 52 CC 1A"
The process citrio.exe:3632 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3D 61 47 71 A2 C1 6D F7 9F 0B B9 51 4D 0B 09 07"
The process citrio.exe:3392 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "37 7D 95 5D 57 1F F0 F0 41 6E 2B CD 1E CF 06 BA"
The process citrio.exe:3404 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C3 3C 5D 06 28 90 44 44 E2 FA 39 7A DE E9 46 E2"
The process citrio.exe:3312 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DD A3 BD C6 F0 CB 97 BD DA 66 43 CB 87 65 E6 DF"
The process citrio.exe:1804 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9D EE 50 3C 01 5E 76 22 AC 0C 4E 1E B4 F4 3F 70"
The process citrio.exe:3448 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "52 64 D9 00 14 93 E1 B1 97 5C 69 9C C6 71 7C 83"
The process citrio.exe:3224 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "81 39 99 C9 6E BE 07 12 36 1D 11 BB 76 34 38 36"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
The process citrio.exe:3208 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CF 00 2C 9A E7 77 1B 54 CD 4C CE 86 97 95 4D 4A"
The process citrio.exe:476 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "37 55 D3 78 C2 E0 A3 5B 71 9C 5D FC 45 CC 72 61"
The process citrio.exe:3192 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "22 62 25 51 A1 64 CA 2C 9E A2 99 4E B3 6A F4 8A"
The process CatalinaCrashHandler.exe:2412 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4F 83 3E 9C 88 85 2F A1 76 49 EC DA A3 BB 1C 61"
The process setup.exe:3676 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\FileAssociations]
".avi" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
".webp" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
[HKCU\Software\Classes\ftp\shell]
"(Default)" = "open"
[HKCU\Software\Classes\magnet\shell\open\ddeexec]
"(Default)" = ""
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"
[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio,"
[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\InstallInfo]
"HideIconsCommand" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application\citrio.exe --hide-icons"
[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities]
"ApplicationIcon" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application\citrio.exe,0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Citrio]
"NoRepair" = "1"
"InstallLocation" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application"
[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\DefaultIcon]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application\citrio.exe,0"
[HKCR\.xht\OpenWithProgids]
"CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ" = ""
[HKCU\Software\Classes\CLSID\{8BF2F61B-E8C2-4A67-85D0-D6A69F9FD948}\LocalServer32]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application\41.0.2272.256\delegate_execute.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities]
"ApplicationName" = "Citrio"
[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\FileAssociations]
".mov" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
".xhtml" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
[HKCU\Software\CatalinaGroup\Update\Clients\{92F8A219-E740-49D5-B785-B962AD819724}\Commands\on-os-upgrade]
"AutoRunOnOSUpgrade" = "1"
[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"UninstallArguments" = " --uninstall"
[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\FileAssociations]
".flv" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
".torrent" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\URLAssociations]
"https" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Citrio]
"Publisher" = "© Epom Ltd."
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"
[HKCU\Software\CatalinaGroup\Update\Clients\{92F8A219-E740-49D5-B785-B962AD819724}]
"lang" = "en"
[HKCU\Software\Classes\ftp]
"URL Protocol" = ""
[HKCU\Software\Classes\http\shell\open\ddeexec]
"(Default)" = ""
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"
[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\FileAssociations]
".shtml" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
[HKCU\Software\CatalinaGroup\Update\Clients\{92F8A219-E740-49D5-B785-B962AD819724}]
"pv" = "41.0.2272.256"
[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\InstallInfo]
"IconsVisible" = "1"
"ReinstallCommand" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application\citrio.exe --make-default-browser"
[HKCU\Software\Classes\.xht]
"(Default)" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\FileAssociations]
".m4v" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
[HKCR\CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ\DefaultIcon]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application\citrio.exe,0"
[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\FileAssociations]
".xht" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\citrio.exe]
"Path" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application"
[HKCU\Software\Classes\CLSID\{8BF2F61B-E8C2-4A67-85D0-D6A69F9FD948}]
"(Default)" = "CommandExecuteImpl Class"
[HKCU\Software\Classes\.html]
"(Default)" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
[HKCU\Software\Classes\ftp\DefaultIcon]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application\citrio.exe,0"
[HKCU\Software\Classes\.shtml]
"(Default)" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
[HKCU\Software\Classes\https\shell\open\ddeexec]
"(Default)" = ""
[HKCR\.htm\OpenWithProgids]
"CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ" = ""
[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"InstallerError" = "0"
[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\InstallInfo]
"ShowIconsCommand" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application\citrio.exe --show-icons"
[HKCR\.webp\OpenWithProgids]
"CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ" = ""
[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\URLAssociations]
"mms" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"UninstallString" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application\41.0.2272.256\Installer\setup.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\FileAssociations]
".mpg" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
".nsv" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
[HKCU\Software\Classes\http\DefaultIcon]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application\citrio.exe,0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\URLAssociations]
"news" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\FileAssociations]
".asf" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
[HKCU\Software\CatalinaGroup\Citrio]
"AssociationsRegistry" = "1"
[HKCU\Software\Classes\ftp\shell\open\command]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application\citrio.exe -- %1"
[HKCU\Software\Classes\Magnet\DefaultIcon]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application\citrio.exe,0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Citrio]
"Version" = "41.0.2272.256"
[HKCU\Software\Classes\CLSID\{8BF2F61B-E8C2-4A67-85D0-D6A69F9FD948}\LocalServer32]
"ServerExecutable" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application\41.0.2272.256\delegate_execute.exe"
[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\URLAssociations]
"tel" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"InstallerExtraCode1" = "1"
[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\shell\open\command]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application\citrio.exe"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B2 60 29 6E B1 BF B7 CE DA 29 6C E1 38 9D 0F 21"
[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"ap" = "-stage:preconditions-full"
"InstallerSuccessLaunchCmdLine" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application\citrio.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\FileAssociations]
".MP2" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
".pdf" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Citrio]
"DisplayName" = "Citrio"
[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\FileAssociations]
".mp4" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
[HKCU\Software\Classes\Magnet]
"URL Protocol" = ""
[HKCU\Software\CatalinaGroup\Update\Clients\{92F8A219-E740-49D5-B785-B962AD819724}\Commands\on-os-upgrade]
"CommandLine" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application\41.0.2272.256\Installer\setup.exe --on-os-upgrade --verbose-logging"
[HKCU\Software\Classes\.pdf]
"(Default)" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
[HKCU\Software\CatalinaGroup\Update\Clients\{92F8A219-E740-49D5-B785-B962AD819724}]
"oopcrashes" = "1"
[HKLM\SOFTWARE\RegisteredApplications]
"Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ" = "Software\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities"
[HKCU\Software\Classes\https\shell]
"(Default)" = "open"
[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities]
"ApplicationDescription" = "Citrio is a web browser that runs webpages and applications with lightning speed. It's fast, stable, and easy to use. Browse the web more safely with malware and phishing protection built into Citrio."
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\Classes\https\DefaultIcon]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application\citrio.exe,0"
[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\FileAssociations]
".3gp" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
".webm" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
".mkv" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Citrio]
"NoModify" = "1"
[HKCU\Software\Classes\http\shell]
"(Default)" = "open"
[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\URLAssociations]
"ftp" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\Startmenu]
"StartMenuInternet" = "Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\FileAssociations]
".wmv" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
[HKCU\Software\Classes\http]
"URL Protocol" = ""
[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\URLAssociations]
"smsto" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
[HKCR\CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ\shell\open\command]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application\citrio.exe -- %1"
[HKCU\Software\Classes\https]
"URL Protocol" = ""
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"
[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\URLAssociations]
"mailto" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\FileAssociations]
".ogv" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\URLAssociations]
"webcal" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
"magnet" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\FileAssociations]
".3g2" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
[HKCU\Software\Classes\.htm]
"(Default)" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\URLAssociations]
"nntp" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKCR\.xhtml\OpenWithProgids]
"CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ" = ""
[HKCU\Software\Classes\Magnet\shell\open\command]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application\citrio.exe -- %1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Citrio]
"UninstallString" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application\41.0.2272.256\Installer\setup.exe --uninstall"
[HKCU\Software\Classes\ftp\shell\open\ddeexec]
"(Default)" = ""
[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\URLAssociations]
"sms" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Citrio]
"DisplayVersion" = "41.0.2272.256"
"DisplayIcon" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application\citrio.exe,0"
[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"InstallerResult" = "0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Citrio]
"InstallDate" = "20150513"
[HKCR\CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ]
"(Default)" = "Citrio Document"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
[HKCR\.shtml\OpenWithProgids]
"CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ" = ""
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"
[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\URLAssociations]
"urn" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
[HKCR\.html\OpenWithProgids]
"CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ" = ""
[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Citrio]
"VersionMajor" = "2272"
"VersionMinor" = "256"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKCU\Software\Classes\.torrent]
"(Default)" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
[HKCU\Software\Classes\.xhtml]
"(Default)" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\FileAssociations]
".rm" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
".RV" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
".htm" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
[HKCU\Software\Classes\Magnet\shell]
"(Default)" = "open"
[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\URLAssociations]
"irc" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
[HKCU\Software\CatalinaGroup\Update\Clients\{92F8A219-E740-49D5-B785-B962AD819724}]
"bt" = "1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\citrio.exe]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application\citrio.exe"
[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\URLAssociations]
"http" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\FileAssociations]
".m2v" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
".html" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
[HKCU\Software\CatalinaGroup\Update\Clients\{92F8A219-E740-49D5-B785-B962AD819724}]
"Name" = "Citrio"
[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\FileAssociations]
".OGG" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
[HKCU\Software\Clients\StartmenuInternet]
"(Default)" = "Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
[HKCU\Software\Classes\https\shell\open\command]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application\citrio.exe -- %1"
[HKCU\Software\Classes\http\shell\open\command]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application\citrio.exe -- %1"
[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ\Capabilities\FileAssociations]
".ogm" = "CitrioDOC.QQL2B5ZRL54V5ERAM5WD2OE6LQ"
[HKLM\SOFTWARE\Clients\StartMenuInternet\Citrio.QQL2B5ZRL54V5ERAM5WD2OE6LQ]
"(Default)" = "Citrio"
Adds a rule to the firewall Windows which allows any network activity:
[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application]
"citrio.exe" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application\citrio.exe:*:Enabled:Citrio"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"ap"
"InstallerExtraCode1"
The process %original file name%.exe:1736 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "95 77 11 BD BB 29 21 44 03 24 51 64 66 50 3B 53"
Dropped PE files
MD5 | File path |
---|---|
6cea215160ae4188fee4a92ef15dda05 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\CatalinaCrashHandler.exe |
6cea215160ae4188fee4a92ef15dda05 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\CatalinaUpdate.exe |
7ad1bcd40606876cb6680d83c9ec989a | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\CatalinaUpdateBroker.exe |
2b3cf7ea69432a594e10f40cb922ac26 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\CatalinaUpdateOnDemand.exe |
2c2b5f94feeb782f83bb15f016a6bf68 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdate.dll |
aaf96cdd105289e7ff35394d325cc3dc | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_am.dll |
a399a7747af02e7f6289398aa2265c3c | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_ar.dll |
c3b2b4701849ea07b96fa137a6e94e02 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_bg.dll |
de800351848d365dd563631771f5b5b0 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_bn.dll |
d8e741a14434f59b778db9e562625838 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_ca.dll |
6e27092a569dda3f4b0aa1a9948089a2 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_cs.dll |
c72c8072a466e9a32d2a926071bc400c | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_da.dll |
387cc6ea3e3b20fb7e55be314cf41ef9 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_de.dll |
fa3a9047608e216c68e83f3b3f4e62ec | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_el.dll |
c18e8508c8b691aad860de077390d9d3 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_en-GB.dll |
f8e1288bb72f67c25c367e5a61651bca | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_en.dll |
e67f2ba7b2d5e2841e7f317080f3fd62 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_es-419.dll |
4a80f1645d7dd9e9b1392841ad02d970 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_es.dll |
d83ed084a47c3352d5e68404500ce4af | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_et.dll |
a420edd640c17822899c730af0d516ad | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_fa.dll |
028b1d4af503a3209383ad0a2e1c6dac | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_fi.dll |
428a992a1329cebe4c48bb7d54ba44d7 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_fil.dll |
6805edac4a9be23a70947c5d990dbf8c | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_fr.dll |
f7e7d920bf9c0e98d350dd19a0dff5c3 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_gu.dll |
05770102a6c300aa14d917b773b13f72 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_hi.dll |
4c7c2b2f13eb1d17fdeb8974f1b9a1ab | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_hr.dll |
5ae0ab73c27fa94752554f811e54548e | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_hu.dll |
571702223ba20e311291c4641db8a0e5 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_id.dll |
b60ad05c51a0deb944c9b6d515ba3f75 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_is.dll |
d140749f5da947cad9d95a568c92a412 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_it.dll |
7572629ccdc27e59f98185b0b100a81d | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_iw.dll |
e00fc2475ee6221a470f7a02304ef577 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_ja.dll |
1f9c169f28c96a84ad699ad7d8e8ecea | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_kn.dll |
5426cd1549caf223134627d50c8f2fd7 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_ko.dll |
fcedbb1d3960e1ed1f208e426b461e47 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_lt.dll |
677c82aee1a8e1bc1d8679051a7a7ef6 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_lv.dll |
5adbacbe7871978d5487e50d4f9d5fd9 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_ml.dll |
7a7e9bbf621bd0310b27a29dae338b25 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_mr.dll |
f55cca95c0ce7bb9dd0df7426d0850b7 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_ms.dll |
b635337f96458e4240d6d36a0f1ad0c0 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_nl.dll |
a9d7acb329bb58291371783bfd765747 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_no.dll |
151e2197c465d69f0531f1eda0ae723e | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_pl.dll |
16f588b707fa9574c2c4c033442a54bc | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_pt-BR.dll |
742c5173ad19be9995323f9aa55c7ce6 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_pt-PT.dll |
9187e5a69439016f6d87d2400433652f | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_ro.dll |
1088f9f75d48492f9a59b327a1b4150f | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_ru.dll |
7aa2aa0182bf743aee50f0da6211fc25 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_sk.dll |
9f97e32ab67e6176a310f80750195055 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_sl.dll |
80d3b8af8f5ea5fabc59f6c3871f8c8b | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_sr.dll |
172d968afada4520e29d1fd274f89a4f | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_sv.dll |
7fc9f569c18a6dea813dd9a596aedb59 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_sw.dll |
ef7097038ed66124b148e2a796f591c3 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_ta.dll |
30ff6ccc5934ac9b9feec18c17534324 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_te.dll |
3405f18d69e7a10e02258f0cee5ca9a4 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_th.dll |
d07cd67deabd1d6bcbfd581eddb55191 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_tr.dll |
b5a72b466f81ab67a4efb1e8925fc4bc | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_uk.dll |
cec3e2877c12ec603e0f0c523909717e | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_ur.dll |
b31627a3b5d15e05b94c1261f3b3b85a | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_vi.dll |
b397baf228f38e28e2690ddb20852bce | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_zh-CN.dll |
1b0dea6bce09f17beec9646bae225517 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_zh-TW.dll |
5d092b19ed729ece612a2247cf45c358 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\npCatalinaUpdate3.dll |
4c3a99424c4a6fa0cfde4261b8c784d5 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\psmachine.dll |
6c87927c9537cc20f16943bded647e30 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\psuser.dll |
6cea215160ae4188fee4a92ef15dda05 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\CatalinaUpdate.exe |
c24369c18ece8e3a0d51d19938ecaa6b | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\Download\{92F8A219-E740-49D5-B785-B962AD819724}\41.0.2272.256\citrio_41.0.2272.256_1.exe |
c24369c18ece8e3a0d51d19938ecaa6b | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\CatalinaGroup\Update\Install\{2C93941F-2EE0-43BB-9129-D7C4EAAD6F62}\citrio_41.0.2272.256_1.exe |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
citrio_41.0.2272.256_1.exe:3616
CatalinaUpdate.exe:1236
CatalinaUpdate.exe:1280
CatalinaUpdate.exe:208
CatalinaUpdate.exe:456
CatalinaUpdate.exe:1932
CatalinaUpdate.exe:2836
citrio.exe:3804
citrio.exe:3492
citrio.exe:3148
citrio.exe:3244
citrio.exe:224
citrio.exe:3368
citrio.exe:3472
citrio.exe:2484
citrio.exe:656
citrio.exe:1096
citrio.exe:3632
citrio.exe:3404
citrio.exe:3312
citrio.exe:3448
citrio.exe:3224
citrio.exe:3208
citrio.exe:3192
CatalinaCrashHandler.exe:2412
setup.exe:3676
%original file name%.exe:1736 - Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temp\CR_E0220.tmp\CITRIO.PACKED.7Z (415199 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\CR_E0220.tmp\SETUP.EX_ (1724 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\CR_E0220.tmp\setup.exe (19923 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab4.tmp (54 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar5.tmp (2712 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab8.tmp (48 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab6.tmp (54 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004 (408 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 (48 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 (408 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004 (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar7.tmp (2712 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar9.tmp (2712 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\Install\{2C93941F-2EE0-43BB-9129-D7C4EAAD6F62}\citrio_41.0.2272.256_1.exe (422134 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\Download\{92F8A219-E740-49D5-B785-B962AD819724}\41.0.2272.256\citrio_41.0.2272.256_1.exe (422134 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\CatalinaUpdateOnDemand.exe (58 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_hu.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_uk.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_no.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_th.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_fil.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_en.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_ja.dll (22 bytes)
%WinDir%\Tasks\CatalinaGroupUpdateTaskUserS-1-5-21-1844237615-1960408961-1801674531-1003Core.job (948 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_pl.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_fi.dll (26 bytes)
%WinDir%\Tasks\CatalinaGroupUpdateTaskUserS-1-5-21-1844237615-1960408961-1801674531-1003UA.job (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_pt-PT.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_en-GB.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_fr.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_et.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_sk.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_mr.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_bn.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_kn.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_es-419.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_sl.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_sw.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_iw.dll (23 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\CatalinaUpdateBroker.exe (58 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_ta.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_ko.dll (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_de.dll (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_hr.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_am.dll (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_pt-BR.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_sr.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_zh-CN.dll (19 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\CatalinaCrashHandler.exe (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_zh-TW.dll (19 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\CatalinaUpdate.exe (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_vi.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_cs.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_ar.dll (24 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_ca.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\npCatalinaUpdate3.dll (1281 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_nl.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\psmachine.dll (673 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_el.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_it.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_sv.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_lv.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_ur.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_te.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_is.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_ru.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\CatalinaUpdate.exe (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_ro.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_id.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\psuser.dll (673 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_fa.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_lt.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_tr.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_bg.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\CatalinaUpdateHelper.msi (36 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_ms.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdate.dll (5873 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_hi.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_es.dll (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_ml.dll (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_da.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\goopdateres_gu.dll (26 bytes)
%Documents and Settings%\%current user%\NTUSER.DAT.LOG (4048 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libtheora_plugin.dll (22840 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\arrow-right.png (114 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libdts_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\lua\liblua_plugin.dll (20400 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libmkv_plugin.dll (66563 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libsubsusf_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\joox.luac (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libaes3_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\ScrollViewHelper.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\sse2\libi420_rgb_sse2_plugin.dll (8472 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_output\libmmdevice_plugin.dll (3656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libmpc_plugin.dll (5952 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libsepia_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libasf_plugin.dll (5224 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\StatusBarStyle.qml (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\GroupBox.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\MenuContentItem.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libpostproc_plugin.dll (7288 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_mixer\libfloat_mixer_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libdeinterlace_plugin.dll (10864 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\GammaAdjust.qml (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\TableView.qml (3656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\MenuClose.qml (588 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\meta_engine\libfolder_plugin.dll (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\rightanglearrow.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\ButtonStyle.qml (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libripple_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libadpcm_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libcc_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\SourceProxy.qml (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\SpinBox.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\BusyIndicator.qml (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\StackViewTransition.qml (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libdmo_plugin.dll (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\MenuScroll.qml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libvoc_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\services_discovery\libsap_plugin.dll (8472 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libwall_plugin.dll (3808 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\ToolbarLeft.qml (96 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_chroma\libyuy2_i422_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\OpacityMask.qml (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\scrollbar-handle-vertical.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\header.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\ToolButton.qml (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\packetizer\libpacketizer_flac_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\arrow-left.png (114 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libscene_plugin.dll (3656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\CalendarUtils.js (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\core\Hotkeys.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\SplashScreen.qml (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\qmldir (852 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libtimecode_plugin.dll (3656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libmono_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\check@2x.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\HueSaturation.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\TabView.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libdvdread_plugin.dll (11704 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\GroupBoxStyle.qml (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libaudio_format_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\tab.png (460 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libts_plugin.dll (9352 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libmagnify_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libscte27_plugin.dll (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libmosaic_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\packetizer\libpacketizer_vc1_plugin.dll (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libaraw_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libpva_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_filter\librecord_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libquicktime_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\ColumnMenuContent.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libgaussianblur_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\core\Functions.qml (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libspeex_plugin.dll (10216 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libatmo_plugin.dll (14776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\librotate_plugin.dll (4152 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libes_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libaiff_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\VolumeHeatScale.qml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\ProgressBar.qml (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\RadialGradient.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libshm_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\mux\libmux_avi_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_output\libafile_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\manifest.json (626 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\modules\dkjson.luac (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_out\libstream_out_duplicate_plugin.dll (3656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libremap_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libedummy_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_out\libstream_out_dummy_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_chroma\libi420_rgb_plugin.dll (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\ComboBoxStyle.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libaccess_bd_plugin.dll (7288 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\misc\libxml_plugin.dll (67908 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_out\libstream_out_standard_plugin.dll (3656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_filter\libhttplive_plugin.dll (34872 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\EditMenu_ios.qml (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\images\icon128.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libkate_plugin.dll (7784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\MenuStyle.qml (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\mux\libmux_wav_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\mux\libmux_asf_plugin.dll (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\liblive555_plugin.dll (45664 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\slider-handle.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libtta_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\EditMenu_base.qml (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\DirectionalBlur.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\MaskedBlur.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libheadphone_channel_mixer_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\sse2\libi422_yuy2_sse2_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\ApplicationWindowStyle.qml (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libcdda_plugin.dll (10864 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libaccess_realrtsp_plugin.dll (6984 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libau_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libmp4_plugin.dll (12376 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\scrollbar-handle-transient.png (249 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\vimeo.luac (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\katsomo.luac (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libnsc_plugin.dll (3808 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libgradfun_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libaccess_udp_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\librtp_plugin.dll (31256 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libdtv_plugin.dll (16664 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libdvbsub_plugin.dll (7784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\ToolbarTimeLength.qml (365 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\ContentItem.qml (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_out\libstream_out_description_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Layouts\plugins.qmltypes (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\spinner_large.png (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\StackView.qml (3656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\StatusBar.qml (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libposterize_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick.2\plugins.qmltypes (14960 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\ToolBar.qml (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\Desaturate.qml (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libty_plugin.dll (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\liblibmpeg2_plugin.dll (9496 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libball_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\DECODED_MESSAGE_CATALOGS (24 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\scrollbar-handle-horizontal.png (939 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\StackViewDelegate.qml (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\jamendo.luac (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_out\libstream_out_langfromtelx_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\BigPlayIcon.qml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\TableViewColumn.qml (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\youtube_homepage.luac (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\appletrailers.luac (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libaccess_tcp_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libcdg_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libmotiondetect_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\ZoomBlur.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\librawdv_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\liba52_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\main.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\metachannels.luac (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libchain_plugin.dll (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\modules\simplexml.luac (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libdshow_plugin.dll (18240 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\TitleBar.qml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libvc1_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\HoverButton.qml (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\TextAreaStyle.qml (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick.2\qmldir (111 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_output\libadummy_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\services_discovery\libmediadirs_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\ScrollViewStyle.qml (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libaccess_vdr_plugin.dll (5952 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_output\libvmem_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\ToolbarButton.qml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libg711_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\ToolbarBackground.qml (256 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\SwitchStyle.qml (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libmpeg_audio_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\liveleak.luac (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_chroma\librv32_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_output\libyuv_plugin.dll (3656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\mux\libmux_dummy_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\RadioButtonStyle.qml (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_chroma\libyuy2_i420_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libzvbi_plugin.dll (83471 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libcrystalhd_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\fonts\secondary.ttf (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\cue.luac (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\core\Buttons.qml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\meta_engine\libtaglib_plugin.dll (81329 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\liblpcm_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libsamplerate_plugin.dll (80307 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\arrow-right@2x.png (148 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\RadialBlur.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\ModalPopupBehavior.qml (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\CustomButton.qml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\VideoLayer.qml (291 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\private\GaussianInnerShadow.qml (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\EditMenu.qml (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_output\libwaveout_plugin.dll (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libps_plugin.dll (3656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\qmldir (134 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\MediaPlayer.html (634 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\misc\libaudioscrobbler_plugin.dll (3808 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\packetizer\libpacketizer_mpeg4video_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\slider-groove.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\mmx\libi420_yuy2_mmx_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\packetizer\libpacketizer_h264_plugin.dll (5224 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\COPYING.txt (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_out\libstream_out_autodel_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libdtstospdif_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libx264_plugin.dll (66979 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libugly_resampler_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_output\libdirect3d_plugin.dll (5224 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\check.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\librawvideo_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\spinner_medium.png (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\liberase_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\services_discovery\libwindrive_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libequalizer_plugin.dll (3808 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\anevia_streams.luac (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\arrow-left@2x.png (139 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\ToolMenuButton.qml (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libdxva2_plugin.dll (5224 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libtrivial_channel_mixer_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\CalendarStyle.qml (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libsid_plugin.dll (60000 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\ColorOverlay.qml (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\Style.qml (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_out\libstream_out_record_plugin.dll (3808 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libgain_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\private\GaussianMaskedBlur.qml (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\liba52tofloat32_plugin.dll (4152 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libadjust_plugin.dll (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libspatializer_plugin.dll (8472 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\d3dcompiler_43.dll (130008 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\dailymotion.luac (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\Toolbar.qml (517 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\TextInputWithHandles.qml (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\MenuBar.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\leftanglearrow.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\ToolBarStyle.qml (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libwav_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\packetizer\libpacketizer_dirac_plugin.dll (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_output\libcaca_plugin.dll (48104 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\FastGlow.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\arrow-up@2x.png (229 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_output\libdrawable_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\misc\liblogger_plugin.dll (3656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\ssleay32.dll (20400 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\StackView.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_output\libdirect2d_plugin.dll (3808 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\DECODED_IMAGES (1642 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\pinkbike.luac (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libvcd_plugin.dll (6872 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\SubtitleMenuItems.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\Displace.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libidummy_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\RecursiveBlur.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libopus_plugin.dll (11736 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libblend_plugin.dll (12376 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\packetizer\libpacketizer_mpegvideo_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\TabViewStyle.qml (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\spinner_small.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\msvcr90.dll (41752 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_out\libstream_out_mosaic_bridge_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_out\libstream_out_raop_plugin.dll (32816 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\ProgressBarStyle.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libblendbench_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\ToolbarBorder.qml (96 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\css\styles.css (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libaudiobargraph_v_plugin.dll (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_chroma\libgrey_yuv_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\LevelAdjust.qml (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libkaraoke_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\mmx\libi422_yuy2_mmx_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libstereo_widen_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\TabBar.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\fonts\default.ttf (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\private\GaussianDirectionalBlur.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\liblibass_plugin.dll (74023 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libhqdn3d_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\liblogo_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\GaussianBlur.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libaccess_attachment_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_out\libstream_out_display_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libyuvp_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\FastBlur.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_output\libvdummy_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libmjpeg_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libmpgv_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libdemuxdump_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\MouseSurface.qml (346 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_out\libstream_out_rtp_plugin.dll (37152 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\anevia_xml.luac (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libbluescreen_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\arrow-down@2x.png (212 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\mpora.luac (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\private\FastGlow.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\VolumeHeatColors.qml (265 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\misc\libgnutls_plugin.dll (130226 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libaccess_http_plugin.dll (8472 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libmpgatofixed32_plugin.dll (9496 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\text_renderer\libfreetype_plugin.dll (48104 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_filter\libsmooth_plugin.dll (4152 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\images\icon16.png (353 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libdemux_cdg_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Layouts\qmldir (130 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\fonts\glyphicons.ttf (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libnuv_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\focusframe.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libaccess_ftp_plugin.dll (5952 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\WebChimera.dll (882925 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_out\libstream_out_smem_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\progress-indeterminate.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\TableViewStyle.qml (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\images\close_but.png (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_out\libstream_out_transcode_plugin.dll (3656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libremoteosd_plugin.dll (32104 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libpuzzle_plugin.dll (5952 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libmirror_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\core\Settings.qml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libdtstofloat32_plugin.dll (11736 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\BasicButton.qml (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Slider.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libcanvas_plugin.dll (3656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_output\libamem_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libswscale_plugin.dll (38608 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\button_down.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libsmf_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\PlaylistMenuItems.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libsubsdec_plugin.dll (3808 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libextract_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libspeex_resampler_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libinvert_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\text_renderer\libtdummy_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libmod_plugin.dll (34392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\AbstractCheckable.qml (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libpsychedelic_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\CalendarHeaderModel.qml (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\liblibbluray_plugin.dll (129406 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\rockbox_fm_presets.luac (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libgme_plugin.dll (27336 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libzip_plugin.dll (8472 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\images\webchimera_logo.png (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\ScrollBar.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libaccess_rar_plugin.dll (3656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\mux\libmux_ts_plugin.dll (7288 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libimage_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libmarq_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\private\GaussianGlow.qml (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\mmx\libi420_rgb_mmx_plugin.dll (3808 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\tab_selected.png (498 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libuleaddvaudio_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libmotionblur_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_out\libstream_out_es_plugin.dll (3656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\SystemPaletteSingleton.qml (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\extreme.luac (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\france2.luac (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\VolumeHeat.qml (493 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\images\player_logo_small_h.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\pluzz.luac (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libxa_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libaccess_imem_plugin.dll (3808 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\TopCenterText.qml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\images\icon24.png (480 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\groupbox.png (485 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\TableViewSelection.qml (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libplaylist_plugin.dll (9496 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\TextSingleton.qml (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libparam_eq_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_chroma\libi420_yuy2_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libvorbis_plugin.dll (47352 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libstl_plugin.dll (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Menu.qml (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_output\libwingdi_plugin.dll (3808 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\misc\libfingerprinter_plugin.dll (3808 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\MenuContentScroller.qml (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libsubsdelay_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libcolorthres_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libalphamask_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\arrow-down.png (184 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libogg_plugin.dll (10216 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libstream_filter_rar_plugin.dll (3656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Label.qml (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libfilesystem_plugin.dll (3656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\ArtworkLayer.qml (232 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\mux\libmux_mp4_plugin.dll (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\mux\libmux_mpjpeg_plugin.dll (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\googlevideo.luac (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\Menu.qml (338 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libchorus_flanger_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\SubtitleText.qml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\mux\libmux_ps_plugin.dll (4152 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\ComboBox.qml (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\MenuHeader.qml (612 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libnsv_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libh264_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\misc\libexport_plugin.dll (3656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\zapiks.luac (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\style.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Tab.qml (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\RectangularGlow.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libanaglyph_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libdemux_stl_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\Colorize.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\Glow.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\TextField.qml (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libnormvol_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libantiflicker_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_chroma\libi422_yuy2_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libclone_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\images\icon256.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\StackViewSlideDelegate.qml (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libsvcdsub_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libavi_plugin.dll (6984 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\sse2\libi420_yuy2_sse2_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\packetizer\libpacketizer_mpeg4audio_plugin.dll (5224 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\libeay32.dll (68422 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libcvdsub_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\DropShadow.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libcroppadd_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libt140_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Button.qml (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\images\dragger.png (104 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\libvlc.dll (8472 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\ToolbarRight.qml (124 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\ThresholdMask.qml (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_output\libdirectdraw_plugin.dll (5224 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libdvdnav_plugin.dll (16664 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_chroma\libi422_i420_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\fonts\openfolder.ttf (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Calendar.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libflacsys_plugin.dll (5952 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\TextArea.qml (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libscreen_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\Fonts.qml (962 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libdolby_surround_decoder_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libgradient_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libscale_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_out\libstream_out_delay_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\TextHandle.qml (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\plugins.dat (14960 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\images\icon64.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\metacafe.luac (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\SpinBoxStyle.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\private\FastMaskedBlur.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\ProgressBar.qml (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\BusyIndicatorStyle.qml (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\ScrollView.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\librawvid_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\LinearGradient.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libfaad_plugin.dll (22904 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\button.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libvobsub_plugin.dll (5952 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\TextFieldStyle.qml (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\plugins.qmltypes (6984 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\canalplus.luac (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_output\libglwin32_plugin.dll (6984 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libsdp_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\ContextMenu.qml (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_out\libstream_out_setid_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\koreus.luac (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\webchimera.js (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libtwolame_plugin.dll (9760 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\packetizer\libpacketizer_mlp_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libavcodec_plugin.dll (661132 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\ToolButtonStyle.qml (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\TimeBubble.qml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\images\player_logo_small.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libdirac_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\Blend.qml (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libpng_plugin.dll (20400 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_filter\libdash_plugin.dll (45664 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\MenuBarStyle.qml (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libtransform_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\playlist_youtube.lua (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\TopRightText.qml (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\packetizer\libpacketizer_copy_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\MediaPlayer.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\youtube.luac (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libsimple_channel_mixer_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\services_discovery\libupnp_plugin.dll (25104 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libwave_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\arrow-up.png (186 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\UIsettings.qml (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libspudec_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\images\icon48.png (830 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\lelombrik.luac (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\SplitView.qml (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\CheckBoxStyle.qml (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\BrightnessContrast.qml (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Switch.qml (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libaccess_smb_plugin.dll (3656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\VolumeHeatMouse.qml (813 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\bbc_co_uk.luac (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\misc\libstats_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\qmldir (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\qmldir (913 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libcompressor_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\BigPauseIcon.qml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\private\SourceProxy.qml (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\InnerShadow.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\FocusFrame.qml (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\CheckBox.qml (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\services_discovery\libpodcast_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libddummy_plugin.dll (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\MenuItemSubControls.qml (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\FocusFrameStyle.qml (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libsubtitle_plugin.dll (6984 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\librss_plugin.dll (3808 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\soundcloud.luac (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Private\Control.qml (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\librawaud_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\MenuContent.qml (106 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libaudiobargraph_a_plugin.dll (3656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\images\webchimera_logo_small.png (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\jquery-2.1.3.min.js (6872 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_out\libstream_out_bridge_plugin.dll (3656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\images\editbox.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\playlist\break.luac (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\access\libaccess_mms_plugin.dll (5952 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_out\libstream_out_chromaprint_plugin.dll (56936 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\themes\sleek\components\VolumeHeatGraphics.qml (812 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\player\images\cursor-openhand.png (160 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\misc\libvod_rtsp_plugin.dll (6872 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_output\libdirectsound_plugin.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\demux\libreal_plugin.dll (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\Styles\Base\SliderStyle.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\lua\modules\sandbox.luac (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\RadioButton.qml (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libsharpen_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_mixer\libinteger_mixer_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\mux\libmux_ogg_plugin.dll (5224 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtQuick\Controls\ApplicationWindow.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\libvlccore.dll (139530 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libpanoramix_plugin.dll (3656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\stream_out\libstream_out_gather_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libschroedinger_plugin.dll (68968 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\images\icon32.png (616 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\ConicalGradient.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\liba52tospdif_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\video_filter\libgrain_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\audio_filter\libscaletempo_plugin.dll (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\qml\QtGraphicalEffects\private\FastInnerShadow.qml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\CRX_INSTALL\binaries\win\plugins\codec\libflac_plugin.dll (12984 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_11582\CRX_INSTALL\background.js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_11582\CRX_INSTALL\skin\icons\icon.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_11582\CRX_INSTALL\skin\icons\active.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_11582\DECODED_MESSAGE_CATALOGS (24 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_11582\CRX_INSTALL\skin\style.css (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_11582\CRX_INSTALL\skin\jquery-1.11.0.min.js (6984 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_11582\CRX_INSTALL\skin\icons\disable.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_11582\CRX_INSTALL\skin\popup.html (924 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_11582\DECODED_IMAGES (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_11582\CRX_INSTALL\skin\icons\static.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_11582\CRX_INSTALL\skin\sprite.png (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_11582\CRX_INSTALL\manifest.json (533 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_11582\CRX_INSTALL\skin\js.js (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\images\icon48.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041 (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\proxy.crx (2105 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\citrio_ext.crx (109082 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\10.tmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\B.tmp (1478 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20282\CRX_INSTALL\manifest.json (899 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\1F.tmp (13882 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20282\CRX_INSTALL\images\icon16.png (721 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\28.tmp (32 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\sr\messages.json (210 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\etilqs_Px70Os4eAETlqZY (286 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Local Storage\http_www.citrio.com_0.localstorage-journal (14172 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\11.tmp (4594416 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Cache\f_000006 (106 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Login Data (1454 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\etilqs_Z9phldjGeTZeR9O (131 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Extension Cookies (1955 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\1C.tmp (645 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\fr\messages.json (205 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_3551\11.tmp (238288 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\images\128.png (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Cache\index (368 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Current Tabs (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\manifest.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\manifest.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\pt_PT\messages.json (237 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\E.tmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\icon_16.png (475 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\2B.tmp (97 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\img\16.png (752 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\19.tmp (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Cache\data_3 (5968 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Cache\data_2 (3272 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Cache\data_1 (79304 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Cache\data_0 (413176 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Shortcuts (592 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\etilqs_OdijbpIxDix1Xlr (532 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20282\affiliate.crx (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\manifest.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\CRX_INSTALL\manifest.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\ru\messages.json (265 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\etilqs_gWs6HtCIyiWsTcw (532 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\de\messages.json (208 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Shortcuts-journal (564 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\18.tmp (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\C.tmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Cache\f_000001 (68 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Cache\f_000003 (53 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Cache\f_000002 (36 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Cache\f_000005 (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Cache\f_000004 (65 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Cache\f_000007 (17 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\First Run (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Cache\f_000009 (104 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Cache\f_000008 (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Sync Extension Settings\jnoejnlbkbnckikbkmnpippafneemknp\LOG (220 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\21.tmp (46486 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\etilqs_an73aTGnGd5yszB (131 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\ar\messages.json (289 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\manifest.json (773 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\icon_128.png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Extension State\MANIFEST-000001 (75 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\21.tmp (2105 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Web Data (28199 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\icon_mono_off.png (731 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Cache\f_00000a (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\download_all.crx (3073 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Cache\f_00000b (76 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\etilqs_vSZCdRD8jKJYPIC (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\images\icon16.png (801 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\16.tmp (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\24.tmp (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\etilqs_1wOz32UPNJS4pan (292 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\20.tmp (79 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\tr\messages.json (212 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\uk\messages.json (269 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\el\messages.json (298 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\hi\messages.json (369 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Extension Rules\000003.log (663 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Session Storage\MANIFEST-000001 (75 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\icon_19.png (685 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Safe Browsing Cookies (745 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\26.tmp (645 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Login Data-journal (564 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2A.tmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\sv\messages.json (207 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\icon_mono_on.png (748 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\CRX_INSTALL\images\icon128.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\2D.tmp (32 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\he\messages.json (219 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\hu\messages.json (204 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Extension State\LOG (179 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\17.tmp (52 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\12.tmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\pl\messages.json (227 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Session Storage\LOG (179 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Visited Links (1868 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\15.tmp (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\13.tmp (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\1F.tmp (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Network Action Predictor (7647 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Top Sites-journal (12020 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\etilqs_1m97DXkaaHlcEJH (286 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\images\icon128.png (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\vi\messages.json (261 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\_locales\en\messages.json (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\share_page.crx (58 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\1A.tmp (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\ko\messages.json (209 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\14.tmp (47 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\zh_CN\messages.json (199 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\History (29905 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\README (166 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\da\messages.json (227 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\2C.tmp (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\img\128.png (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Sync Extension Settings\jnoejnlbkbnckikbkmnpippafneemknp\000003.log (269 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Current Session (10608 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\images\19.png (566 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\es\messages.json (224 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Sync Extension Settings\jnoejnlbkbnckikbkmnpippafneemknp\000001.dbtmp (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\img\48.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20282\CRX_INSTALL\images\icon128.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\1E.tmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Extension Cookies-journal (9796 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\CRX_INSTALL\images\icon16.png (420 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Favicons (8470 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\etilqs_byoyEzeIX6OTWgG (131 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Web Data-journal (10344 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Sync Extension Settings\jnoejnlbkbnckikbkmnpippafneemknp\MANIFEST-000001 (75 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\History-journal (16252 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\images\icon64.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\25.tmp (80 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\23.tmp (13 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Origin Bound Certs-journal (6215 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Extension Rules\LOG (179 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\it\messages.json (227 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\F.tmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\etilqs_JXBSpvcMjdPeHWR (131 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\27.tmp (32 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\1D.tmp (13 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Favicons-journal (16036 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Session Storage\000001.dbtmp (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\1B.tmp (77 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Extension State\000003.log (9156 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Cookies (3317 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Safe Browsing Cookies-journal (2791 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\manifest.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20282\CRX_INSTALL\images\icon32.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Network Action Predictor-journal (12870 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_11582\media_downloader.crx (64 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Cookies-journal (18133 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Extension State\000001.dbtmp (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\29.tmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\D.tmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\en\messages.json (210 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\pt_BR\messages.json (237 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Extension Rules\000001.dbtmp (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\22.tmp (645 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\User Data\Default\Extension Rules\MANIFEST-000001 (75 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\A.tmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\cs\messages.json (324 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\CRX_INSTALL\js\DTA.interface.js (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\CRX_INSTALL\js\DTA.popup.js (59 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\CRX_INSTALL\images\button.logo.png (60000 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\CRX_INSTALL\images\logo.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\CRX_INSTALL\images\search.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\DECODED_IMAGES (66 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\CRX_INSTALL\background.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\CRX_INSTALL\js\lib\jquery.js (6984 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\CRX_INSTALL\images\button.logo.inactive.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\CRX_INSTALL\js\DTA.ui.js (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\CRX_INSTALL\images\icon.close.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\CRX_INSTALL\css\template.css (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_7686\DECODED_MESSAGE_CATALOGS (24 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\is.png (494 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ir.png (471 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\kw.png (476 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\md.png (548 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\es.png (493 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ae.png (446 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\scripts\background.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\sh.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\va.png (483 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\pm.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\vu.png (570 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\tc.png (604 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ms.png (592 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\ic16_gear.png (402 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\gl.png (521 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\fj.png (575 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\lt.png (395 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\si.png (468 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\mg.png (380 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\gs.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\uz.png (462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ls.png (639 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\tf.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\scripts\base64.js (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\scripts\tmpl.js (667 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\bz.png (615 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\mk.png (690 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\yt.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\styles\mochi.css (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\dk.png (416 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\sa.png (560 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\py.png (442 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\sb.png (649 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ci.png (428 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\am.png (414 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\bi.png (740 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\so.png (514 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\tj.png (436 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\bm.png (606 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\bb.png (573 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\scripts\agent.js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ht.png (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\np.png (634 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\cd.png (621 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\mr.png (567 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\kr.png (658 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\sm.png (552 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\az.png (472 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ng.png (441 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\io.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\de.png (391 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\il.png (468 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\gi.png (516 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\nc.png (608 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\aq.png (586 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\mh.png (698 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\jp.png (471 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\fm.png (565 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\bn.png (654 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\bo.png (461 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\lu.png (367 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\vg.png (618 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ua.png (399 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\cy.png (456 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\popup.html (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\kg.png (525 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ax.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ec.png (564 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\in.png (431 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\at.png (363 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\scripts\profile_detail.js (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\fk.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\jm.png (711 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\sy.png (422 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\kp.png (480 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\scripts\spine.route.js (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\scripts\spine.js (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ws.png (492 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\iq.png (475 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\cn.png (469 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ca.png (570 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\pw.png (610 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ug.png (536 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\mn.png (546 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\to.png (427 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\pr.png (498 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ye.png (362 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\je.png (632 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\nf.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\mz.png (539 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\tv.png (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ml.png (463 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\se.png (472 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\pe.png (536 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ch.png (434 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\wf.png (518 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\tw.png (461 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\cm.png (502 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\gp.png (509 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\me.png (555 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\tk.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ph.png (516 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\pk.png (600 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\gy.png (686 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\hu.png (369 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\mm.png (451 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\scripts\jquery.js (6984 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\mp.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\pt.png (591 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\styles\style.css (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\tz.png (655 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\br.png (687 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\list-img.png (603 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\sc.png (677 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\kn.png (662 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ao.png (535 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\gw.png (465 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\scripts\popup.js (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\nr.png (465 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\sr.png (470 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\scripts\new.js (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\om.png (446 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\cx.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\uy.png (479 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\image\icon_mono_on.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\dj.png (514 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\bs.png (494 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\im.png (543 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\eg.png (408 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\sg.png (409 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\it.png (440 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\scripts\ui.js (5224 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\er.png (645 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\settings-act.png (883 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\id.png (333 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\DECODED_IMAGES (68 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\no.png (485 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\gg.png (501 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\gf.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\rw.png (437 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\gb.png (707 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\my.png (509 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\gn.png (453 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ly.png (383 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\zw.png (591 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\bj.png (422 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\al.png (535 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\lr.png (457 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ag.png (622 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\pa.png (514 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ad.png (540 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\bh.png (529 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\vi.png (612 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\dm.png (668 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\nl.png (367 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\za.png (600 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ga.png (400 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\sl.png (377 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\mu.png (416 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\sandbox.html (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\tt.png (690 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\sv.png (450 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\bv.png (485 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\an.png (477 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ve.png (464 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\mf.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\co.png (387 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\vn.png (520 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\hr.png (553 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\nu.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\mo.png (647 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\scripts\model.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\cg.png (674 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\lk.png (586 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\lv.png (367 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\do.png (432 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\image\icon_128.png (16664 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\speed.png (885 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\km.png (561 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ar.png (439 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\gu.png (532 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\scripts\sandbox.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ma.png (479 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\nz.png (623 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\vc.png (610 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\pf.png (476 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ba.png (627 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\li.png (462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\mv.png (537 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\us.png (488 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\re.png (488 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\sk.png (495 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\cu.png (513 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\jo.png (521 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ee.png (380 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\tl.png (569 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\scripts\logging.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\fr.png (446 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\dz.png (532 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\list-img-ac.png (620 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ky.png (600 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\rs.png (542 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\kz.png (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\bf.png (445 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\image\icon_mono_off.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\et.png (566 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ge.png (509 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\mq.png (604 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\eh.png (536 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ke.png (631 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\hm.png (614 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\close.png (552 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\mt.png (410 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\aw.png (453 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\mx.png (526 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\bw.png (425 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\na.png (717 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\um.png (488 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\gr.png (433 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\cc.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\sd.png (498 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\hk.png (611 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\mw.png (485 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ni.png (431 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ru.png (350 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\bt.png (607 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\scripts\profile_list.js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\gt.png (549 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ne.png (442 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\gq.png (536 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\cl.png (424 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ai.png (609 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\pg.png (629 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\td.png (461 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\tg.png (494 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\sj.png (485 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\scripts\mochi.js (363 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\be.png (452 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\sl_arrow.png (616 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\by.png (441 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\settings.png (871 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\qa.png (458 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\hn.png (432 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\fi.png (405 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\gh.png (453 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\mc.png (333 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\tm.png (553 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ck.png (630 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\sz.png (594 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\th.png (356 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\lc.png (631 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\pl.png (316 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\bg.png (352 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\pn.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\st.png (568 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\gd.png (683 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ie.png (432 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\scripts\doT.min.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ro.png (461 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\DECODED_MESSAGE_CATALOGS (48 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ki.png (679 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\fo.png (462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\image\ic16_gear.png (402 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\as.png (661 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\cv.png (492 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\tn.png (578 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\sn.png (512 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\la.png (530 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\bl.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\af.png (534 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\ps.png (516 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\zm.png (527 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\bd.png (577 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\cf.png (514 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\scripts\spine.local.js (619 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\cz.png (492 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\lb.png (491 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\gm.png (398 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\kh.png (535 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\au.png (614 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\cr.png (364 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_10895\CRX_INSTALL\image\flags\tr.png (575 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\js\onload.js (72 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\img\header-logo.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\css\uploadProgress.css (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\chrome_ex_oauth.html (331 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\img\header.png (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\js\jquery.js (6984 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\_metadata\verified_contents.json (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\img\vimeo4shared.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\DECODED_MESSAGE_CATALOGS (24 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\js\services.js (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\img\59.png (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\options.html (906 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\css\options.css (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\js\chrome_ex_oauthsimple.js (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\js\uploadProgress.js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\img\download-icon.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\css\services.css (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\js\background.js (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\js\chrome_ex_oauth.js (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\DECODED_IMAGES (75 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\js\options.js (894 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\uploadProgress.html (840 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_4181\CRX_INSTALL\img\progress.png (455 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\images\small-icons-sprite.png (555 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\DECODED_MESSAGE_CATALOGS (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\images\logo.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\popup.html (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\DECODED_IMAGES (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\images\48.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\images\icon_2.png (223 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\images\icon_3.png (326 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\images\nonews.svg (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_locales\no\messages.json (209 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\images\icon_1.png (165 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\_metadata\verified_contents.json (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\nwsh-back.js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\images\icon_5.png (449 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\images\loader.svg (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\images\503.gif (21968 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\images\icon_4.png (389 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\nwsh-content.js (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\nwsh-background.js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\images\arrow.svg (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\images\stars.png (624 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\style.css (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\images\date.svg (364 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_23171\CRX_INSTALL\nwsh-ext.js (536 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20282\DECODED_MESSAGE_CATALOGS (24 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20282\DECODED_IMAGES (70 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20282\CRX_INSTALL\scripts\affiliate.js (127 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\imageformats\qico4.dll (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\scripts\background_stats.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\DECODED_MESSAGE_CATALOGS (24 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\Include\pyconfig.h (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\DECODED_IMAGES (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\_elementtree.pyd (9496 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\python34.dll (164484 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\_bz2.pyd (3808 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\zlib1.dll (5224 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\_hashlib.pyd (49912 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\icon_empty.png (158 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\scripts\content_stats.js (605 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\msvcr100.dll (49672 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\_socket.pyd (3656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\win32api.pyd (6984 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\win32wnet.pyd (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\QtGui4.dll (541377 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\libtorrent.dll (104195 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\pyexpat.pyd (9496 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\youtube-dl.exe (173043 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\QtCore4.dll (152471 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\background.html (286 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\pywintypes34.dll (7784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\libeay32.dll (76989 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\_ctypes.pyd (6872 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\scripts\content_dv.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\_ssl.pyd (66767 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\select.pyd (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\base_library.zip (206432 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\citrio_ext.dll (33720 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\scripts\background_dv.js (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\dlnlib.dll (38832 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\unicodedata.pyd (48768 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\_lzma.pyd (9496 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\libcurl.dll (22840 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\ssleay32.dll (18768 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_25041\CRX_INSTALL\binaries\win\msvcp100.dll (27336 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application\debug.log (121 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\js\lib\jquery.js (6984 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\DECODED_MESSAGE_CATALOGS (24 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\images\icon.tw.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\js\popup.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\images\logo.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\images\icon.gp.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\css\template.css (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\popup.html (804 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\background.js (261 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\DECODED_IMAGES (92 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\images\icon35.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\images\icon.fb.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\scoped_dir_2808_20533\CRX_INSTALL\images\16.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\citrio_200_percent.pak (9606 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\ca.pak (246 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\en-US.pak (201 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\icudtl.dat (76792 bytes)
%Documents and Settings%\%current user%\Desktop\Facebook.lnk (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\resources.pak (134807 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\pt-PT.pak (241 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application\41.0.2272.256\Installer\setup.exe (8657 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\citrio.7z (1302935 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch\Citrio.lnk (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\vi.pak (272 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\es-419.pak (245 bytes)
%Documents and Settings%\%current user%\Desktop\YouTube.lnk (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\ko.pak (250 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\wow_helper.exe (70 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\de.pak (243 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\d3dcompiler_47.dll (22433 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\pdf.dll (69133 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Extensions\citrio_ext.crx (108196 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\sk.pak (251 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\zh-CN.pak (200 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\fr.pak (261 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\es.pak (250 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\fi.pak (229 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\citrio_elf.dll (128 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\PepperFlash\pepflashplayer.dll (110258 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\el.pak (1723 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\sl.pak (227 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\ar.pak (326 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Extensions\share_page.crx (58 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\it.pak (239 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\he.pak (279 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\ms.pak (222 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\gu.pak (1769 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\ffmpegsumo.dll (9606 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\ml.pak (3704 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\pl.pak (239 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\citrio_100_percent.pak (7386 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\metro_driver.dll (1753 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Extensions\external_extensions.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\id.pak (217 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\th.pak (1763 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\PepperFlash\version.json (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\nacl_irt_x86_64.nexe (22433 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\te.pak (1835 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\ja.pak (294 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\fil.pak (248 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\da.pak (221 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\hu.pak (258 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application\citrio.exe (7433 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\libegl.dll (77 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\am.pak (1619 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\41.0.2272.256.manifest (224 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\ru.pak (1649 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\citrio.dll (236168 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\bg.pak (1683 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\VisualElements\smalllogo.png (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Extensions\proxy.crx (1668 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\nb.pak (221 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\uk.pak (1663 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\sw.pak (224 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\fa.pak (1628 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\delegate_execute.exe (3730 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\kn.pak (1845 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\ro.pak (248 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\libglesv2.dll (7386 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\hi.pak (1781 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\ta.pak (1862 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\sv.pak (223 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\lv.pak (246 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\libexif.dll (307 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\lt.pak (241 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\cs.pak (243 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\zh-TW.pak (202 bytes)
%Documents and Settings%\%current user%\Desktop\Citrio.lnk (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Extensions\affiliate.crx (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\bn.pak (1800 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\pt-BR.pak (235 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\en-GB.pak (201 bytes)
%Documents and Settings%\%current user%\Desktop\Chrome Web Store.lnk (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\VisualElementsManifest.xml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\secondarytile.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\et.pak (216 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\citrio_child.dll (266850 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\VisualElements\splash-620x300.png (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\chrome_watcher.dll (225 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\nl.pak (234 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\nacl64.exe (12289 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Extensions\media_downloader.crx (64 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\sr.pak (1648 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\mr.pak (1774 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Extensions\download_all.crx (1761 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Citrio\Citrio.lnk (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\hr.pak (231 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\VisualElements\logo.png (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\citrio.exe (5442 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\nacl_irt_x86_32.nexe (17629 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Temp\source3676_23365\Citrio-bin\41.0.2272.256\Locales\tr.pak (241 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_sl.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_gu.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUT2.tmp (22433 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_nl.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_te.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_sk.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_el.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ru.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_es-419.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_iw.dll (23 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_no.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_tr.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_sr.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_en-GB.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_da.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ro.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_uk.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_zh-TW.dll (19 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_bn.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ms.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ta.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\CatalinaUpdateBroker.exe (58 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_es.dll (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdate.dll (1990 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_sw.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_de.dll (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_is.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_sv.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_fr.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_en.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_cs.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_mr.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_pt-BR.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_fa.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_kn.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_bg.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_pt-PT.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_id.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_fi.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ja.dll (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\npCatalinaUpdate3.dll (237 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\psuser.dll (161 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ml.dll (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ko.dll (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_th.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ca.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_vi.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_hi.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_zh-CN.dll (19 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_lv.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_hu.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\CatalinaUpdate.exe (130 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ar.dll (24 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_pl.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_hr.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\CatalinaUpdateHelper.msi (36 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_lt.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_et.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_am.dll (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\psmachine.dll (155 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\CatalinaCrashHandler.exe (130 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_it.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_fil.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ur.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\CatalinaUpdateOnDemand.exe (58 bytes) - Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"CatalinaGroup Update" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\CatalinaUpdate.exe /c" - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
Static Analysis
VersionInfo
Company Name: Catalina Group Ltd.
Product Name: CatalinaGroup Update
Product Version: 1.3.25.215
Legal Copyright: Copyright 2013 Catalina Group Ltd.
Legal Trademarks:
Original Filename: CatalinaUpdateSetup.exe
Internal Name: CatalinaGroup Update Setup
File Version: 1.3.25.215
File Description: CatalinaGroup Update Setup
Comments:
Language: Language Neutral
Company Name: Catalina Group Ltd.Product Name: CatalinaGroup UpdateProduct Version: 1.3.25.215Legal Copyright: Copyright 2013 Catalina Group Ltd.Legal Trademarks: Original Filename: CatalinaUpdateSetup.exeInternal Name: CatalinaGroup Update SetupFile Version: 1.3.25.215File Description: CatalinaGroup Update SetupComments: Language: Language Neutral
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
.text | 4096 | 47535 | 47616 | 4.63666 | da072aeedacb67c58ca3952875d79a2b |
.rdata | 53248 | 10788 | 11264 | 3.70551 | cc85a67bbda310b5aa377cecaa3156cf |
.data | 65536 | 6428 | 3584 | 1.72368 | 8e425fbedc6927dfabb8fdfaaf8e8d97 |
.rsrc | 73728 | 659744 | 659968 | 5.30312 | 89169e477c01dd8186928471af10e787 |
.reloc | 737280 | 5598 | 5632 | 2.64966 | 17957bd86fff892742280f82a0bf537a |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Total found: 55
52e93d93473e442df41b45a8df00f628
4f0acf873009b0cf0e89d10892e393f9
28abfe0c3e4590a11d0736ab880c5987
64df6e96429a9fe3bd1b483ecf0961cd
c5cfe009e1e65a170da3052981874345
a6f9ab77421a528b7c7cd2f18bec8e5d
5eec07d1d0930a323cce95aaa1581737
3886d7762b345b0f2f5bfec5cc8f5f0e
6efef102a13f8aad7ae7b1ddd7a5c648
4854ab62c0262c63cdf33ebfc80ddb35
035c249781db5107cafeeb7607c3c697
82aa707b75ec9b620d08c03bbb3d4d1e
e0f2da4263afb73fbd1db49753665d81
4aee0f6b49fa24bf85de868c8332cc64
2a0d81d981e3d4cdec30a4528238cf43
7a8757db5e84593ceabd79d890887e59
cedb7fc834ea2b5786f5a27a33f40f95
04c0b7523dd8300f65e037d12bd60064
18cb4280c8fecf80f62ad0a65947cd70
d6eb88a73d98b4db1678ebb376d5f8a3
edee24f98c9a2bf2804898a0333edfea
9b7f9d226474d458316df1f994821807
8197dcd6af91174c7e4ed99cda1f5dd8
155df244efb56d5ac4452b8b5c5db144
a79d1eb06eff95b9fd9f933f8e280429
Network Activity
URLs
URL | IP |
---|---|
hxxp://catalinahub.com/update/ping | |
hxxp://catalinahub.com/update/check?w=3:H0r8iAJfY0HPFbfafxuAsuNAYdcfvoZko0Y55G3J2L8XzWRWZxCNbFQvLX6kLnBUlDQat7qHnZ__OKw95t0PBy5wH9EaX_xcLLjrzYaG23_B5LRfYFPb_RN5NYQQSnB73ODtOplfSUbnRwsR7yyRxSBvKHj7TPUgX_PLut5KOPA | |
hxxp://catalinahub.com/update/check | |
hxxp://catalinahub.silvercdn.com/download/citrio_41.0.2272.256_1.exe | |
hxxp://a767.g.akamai.net/msdownload/update/v3/static/trustedr/en/authrootseq.txt | |
hxxp://a767.g.akamai.net/msdownload/update/v3/static/trustedr/en/authrootstl.cab | |
hxxp://www.gstatic.com/chrome/profile_avatars/NothingToDownload | |
hxxp://catalinahub.com/citrio/promo/1?dist=stable&osname=win&branding=41.0.2272.256&osver=5.1 SP3&hl=en-US | |
hxxp://catalinahub.com/update/extension?response=updatecheck&os=win&arch=x86&nacl_arch=x86-32&prod=chromiumcrx&prodchannel=stable&prodversion=41.0.2272.256&lang=en-US&x=id=hjinflocgjpjihbgdlipilmjlbkjkmak&v=0.0.0.0&uc&uid={802C7BA9-B484-4EEE-84A7-5BB18059CB01} | |
hxxp://catalinahub.silvercdn.com/download/extensions/mediaplayer_0.0.5.crx | |
hxxp://catalinahub.com/citrio/provided-data/1?user_id={802C7BA9-B484-4EEE-84A7-5BB18059CB01}&browser_version=41.0.2272.256&browser_buildtype=1&request_homepage=true&request_search_engine=true&request_ntp_search=true | |
hxxp://www.citrio.com/welcome.html?intl=en | |
hxxp://www.citrio.com/welcome?intl=en | |
hxxp://www.citrio.com/resources/css/main.css?v=7 | |
hxxp://www-google-analytics.l.google.com/r/__utm.gif?utmwv=5.6.4&utms=1&utmn=304882759&utmhn=www.citrio.com&utmcs=UTF-8&utmsr=1276x846&utmvp=1040x677&utmsc=24-bit&utmul=en-us&utmje=1&utmfl=17.0 r0&utmdt=Citrio browser&utmhid=1139682178&utmr=-&utmp=/welcome?intl=en&utmht=1431508120073&utmac=UA-40355395-1&utmcc=__utma=213201158.1092086691.1431508120.1431508120.1431508120.1;+__utmz=213201158.1431508120.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=1496462959&utmredir=1&utmu=DAAAAAAAAAAAAAAAAAAAAAAE~ | |
hxxp://www.citrio.com/resources/fonts/museo-300.woff | |
hxxp://www.citrio.com/resources/fonts/museo-500.woff | |
hxxp://www.citrio.com/resources/fonts/museo-700.otf | |
hxxp://www.citrio.com/resources/images/logo.svg | |
hxxp://www.citrio.com/resources/images/landing/bg-full-win.png | |
hxxp://www.citrio.com/resources/images/fourth_03.svg | |
hxxp://e3821.dspe1.akamaiedge.net/uk_UA/sdk.js | |
hxxp://mc.yandex.ru/metrika/watch.js | |
hxxp://www.citrio.com/resources/images/accelerator.png | |
hxxp://www.citrio.com/resources/images/proxy.png | |
hxxp://www.citrio.com/resources/images/third.png | |
hxxp://www.citrio.com/resources/images/third_02.svg | |
hxxp://www.citrio.com/resources/images/fourth_01.svg | |
hxxp://www.citrio.com/resources/images/tw.svg |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
POST /update/ping HTTP/1.1
User-Agent: Google Update/1.3.25.215;winhttp
X-Last-HR: 0x800421f4
X-Last-HTTP-Status-Code: 500
X-Retry-Count: 0
Host: catalinahub.com
Content-Length: 613
Connection: Keep-Alive
Cache-Control: no-cache
Pragma: no-cache
<?xml version="1.0" encoding="UTF-8"?><request protocol="3.0" version="1.3.25.215" ismachine="0" sessionid="{CD858DB3-E8C7-4B70-8AE9-A56F0EF43D45}" userid="{802C7BA9-B484-4EEE-84A7-5BB18059CB01}" installsource="taggedmi" testsource="auto" requestid="{FF8F5362-DD2E-4B88-BE2A-D640C39BCA8F}"><os platform="win" version="5.1" sp="Service Pack 3" arch="x86"/><app appid="{6C598730-F715-407B-A7AE-A8F10D0F8FA7}" version="" nextversion="1.3.25.215" buildtype="" lang="en" brand="" client="" iid="{2F851C43-A7C8-4061-8931-F5533108A703}"><event eventtype="2" eventresult="1" errorcode="0" extracode1="0"/></app></request>
HTTP/1.1 500 Internal Server Error
Date: Wed, 13 May 2015 09:07:13 GMT
Server: Apache-Coyote/1.1
Content-Type: text/html;charset=utf-8
Content-Length: 4975
Connection: close
<html><head><title>Apache Tomcat/7.0.41 - Error report</title><style><!--H1 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:22px;} H2 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:16px;} H3 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:14px;} BODY {font-family:Tahoma,Arial,sans-serif;color:black;background-color:white;} B {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;} P {font-family:Tahoma,Arial,sans-serif;background:white;color:black;font-size:12px;}A {color : black;}A.name {color : black;}HR {color : #525D76;}--></style> </head><body><h1>HTTP Status 500 - Request processing failed; nested exception is java.lang.NullPointerException</h1><HR size="1" noshade="noshade"><p><b>type</b> Exception report</p><p><b>message</b> <u>Request processing failed; nested exception is java.lang.NullPointerException</u></p><p><b>description</b> <u>The server encountered an internal error that prevented it from fulfilling this request.</u></p><p><b>exception</b> <pre>org.springframework.web.util.NestedServletException: Request processing failed; nested exception is java.lang.NullPointerException..org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:894)..org.springframe
<<< skipped >>>
GET /citrio/promo/1?dist=stable&osname=win&branding=41.0.2272.256&osver=5.1 SP3&hl=en-US HTTP/1.1
Host: catalinahub.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.256 Safari/537.36
Accept-Encoding: gzip, deflate
HTTP/1.1 200 OK
Date: Wed, 13 May 2015 09:08:28 GMT
Server: Apache-Coyote/1.1
Accept-Ranges: bytes
ETag: W/"306-1400161181000"
Last-Modified: Thu, 15 May 2014 13:39:41 GMT
Content-Length: 306
Connection: close
Content-Type: text/plain; charset=UTF-8
{.."url_promo":..[{..."identifier":1,..."date":[{"start":"15-may-2014 00:00","end":"30-may-2014 23:59"}],..."strings":{"URL":"hXXp://citrio.com/announcements/announcement_33_0_1750_237.html"},..."grouping":{"buckets":1,"segment":1,"increment_max":1},..."max_views":5,..."min_version":"33.0.1750.237"..}]..}..
GET /resources/fonts/museo-500.woff HTTP/1.1
Host: VVV.citrio.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.256 Safari/537.36
Accept: */*
Referer: hXXp://VVV.citrio.com/resources/css/main.css?v=7
X-Citrio-Timestamp: Iqh6TjevTuxEjVzfitaOBgq 0LI= 2015-05-13T09:08:40.267Z
Accept-Encoding: gzip, deflate, sdch
Accept-Language: en-US,en;q=0.8
Cookie: __utmt=1; __utma=213201158.1092086691.1431508120.1431508120.1431508120.1; __utmb=213201158.1.10.1431508120; __utmc=213201158; __utmz=213201158.1431508120.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)
HTTP/1.1 200 OK
Date: Wed, 13 May 2015 09:08:42 GMT
Server: Apache/2.2.15 (CentOS)
Last-Modified: Fri, 17 Oct 2014 10:03:38 GMT
ETag: "63e0d3c-10600-5059b7a91d280"
Accept-Ranges: bytes
Content-Length: 67072
Connection: close
Content-Type: text/plain; charset=UTF-8
wOFF........................................FFTM............f?>.GDEF......."...&...ZGPOS......%.....!.n.GSUB..'........z.a..OS/2..)@...N...`...dcmap..)....R...N....cvt .. ....:...:....fpgm.., .......eS./.gasp..-.............glyf..-....l...<Q_<.head...H...3...6....hhea...|...!...$....hmtx......./...D.l..loca............lg.rmaxp...t... ... .p..name............[..qpost...$............prep...@.......".*..webf.............$Q..........=.......';.......`.x.c`d``..b9..`.BF&. .e...Y.b..... ..x..}.tTe~......d...y.u.C.nQWA..1...Bt...,...E...y.u..(R..R^JY.rx=.4.p8).4]..!....M.9.....i.q:;.........wf...3...I.z...........K...i>-....,XL.V...s4..U....P6\IJ.}.9....{...U<.....H...M......#..%..]...._.Op.k_.Vj.h'..._k..].*..#...{..d..Z..f.[Y.p~...........%>..f.s./f.2.r.]9...QNe....9?..$...@...........]..&.2.*.t....r?....K#4..9.g.#..[G.7....GT.....r......~$.N......-.;.w$.6.L...~......w......_..~...3......7..`,b..`R................>-.j....p..}Q....../. ..7>]...5............U.o.....T..b..p_..K]?..............t.ZT\tc..ES....[T^....ES.~..7..-:Vt.Ou.../Q. .~[tI..u....rh.....KO...]..M..n...5.e.....5;.....>Z.$y......Tv.h.Acd.-.....V..."..H..(;.......Q......U.D.....J.N9}N7...F.D..U....|.E...T*.!.s.'.j.]O%2..6!U/.:..F#...q.g4..t".F.S....O..)[.A. .!..x>J..[MYT.2.D...>..zP..T&.i#.....qT...\....P}....7.R..A...^..:..G......%....l.J`g.l.k/...xV............&........Hm..i(i..&....A...[...0.yT.6..(K.".....8T.U.....n....j.?@}.... .>C........#..#q....9.o..5.e..|=.|...m.Z!;.d3....%xV...,m...v1.. .;9.\...H.....v....?.
<<< skipped >>>
GET /citrio/provided-data/1?user_id={802C7BA9-B484-4EEE-84A7-5BB18059CB01}&browser_version=41.0.2272.256&browser_buildtype=1&request_homepage=true&request_search_engine=true&request_ntp_search=true HTTP/1.1
Host: catalinahub.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.256 Safari/537.36
Accept-Encoding: gzip, deflate
HTTP/1.1 200 OK
Date: Wed, 13 May 2015 09:08:36 GMT
Server: Apache-Coyote/1.1
Content-Type: text/plain;charset=UTF-8
Connection: close
Transfer-Encoding: chunked
512..<?xml version="1.0" encoding="UTF-8"?>.<provided_data api_version="1">. <homepage url="hXXp://google.com" />. <search_engine. name="google". keyword="google.com". favicon_url="hXXp://VVV.google.com/favicon.ico". search_url="{google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}". suggest_url="{google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter}". />. <ntp_search. favicon_url="hXXp://VVV.google.com/favicon.ico". search_url="{google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}". suggest_url="{google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter}". />.</provided_data>..0..
GET /update/extension?response=updatecheck&os=win&arch=x86&nacl_arch=x86-32&prod=chromiumcrx&prodchannel=stable&prodversion=41.0.2272.256&lang=en-US&x=id=hjinflocgjpjihbgdlipilmjlbkjkmak&v=0.0.0.0&uc&uid={802C7BA9-B484-4EEE-84A7-5BB18059CB01} HTTP/1.1
Host: catalinahub.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.256 Safari/537.36
X-Citrio-Timestamp: mxgf1JX0co XIMzk3La9IGmLbOw= 2015-05-13T09:08:25.841Z
Accept-Encoding: gzip, deflate, sdch
Accept-Language: en-US,en;q=0.8
HTTP/1.1 200 OK
Date: Wed, 13 May 2015 09:08:28 GMT
Server: Apache-Coyote/1.1
Content-Type: application/xml;charset=UTF-8
Connection: close
Transfer-Encoding: chunked
174..<?xml version="1.0" encoding="UTF-8" standalone="yes"?><gupdate protocol="2.0" xmlns="hXXp://VVV.google.com/update2/response"><app appid="hjinflocgjpjihbgdlipilmjlbkjkmak" status="ok"><updatecheck status="ok" version="0.0.5" codebase="hXXp://static.citrio.com/download/extensions/mediaplayer_0.0.5.crx" hash="XAJujXl2ufg8 h67 rAnoD66vLo=" size="31547651"/></app></gupdate>..0..
POST /update/ping HTTP/1.1
User-Agent: Google Update/1.3.25.215;winhttp
X-Last-HR: 0x800421f4
X-Last-HTTP-Status-Code: 500
X-Retry-Count: 1
Host: catalinahub.com
Content-Length: 613
Connection: Keep-Alive
Cache-Control: no-cache
Pragma: no-cache
<?xml version="1.0" encoding="UTF-8"?><request protocol="3.0" version="1.3.25.215" ismachine="0" sessionid="{CD858DB3-E8C7-4B70-8AE9-A56F0EF43D45}" userid="{802C7BA9-B484-4EEE-84A7-5BB18059CB01}" installsource="taggedmi" testsource="auto" requestid="{FF8F5362-DD2E-4B88-BE2A-D640C39BCA8F}"><os platform="win" version="5.1" sp="Service Pack 3" arch="x86"/><app appid="{6C598730-F715-407B-A7AE-A8F10D0F8FA7}" version="" nextversion="1.3.25.215" buildtype="" lang="en" brand="" client="" iid="{2F851C43-A7C8-4061-8931-F5533108A703}"><event eventtype="2" eventresult="1" errorcode="0" extracode1="0"/></app></request>
HTTP/1.1 500 Internal Server Error
Date: Wed, 13 May 2015 09:07:19 GMT
Server: Apache-Coyote/1.1
Content-Type: text/html;charset=utf-8
Content-Length: 4975
Connection: close
<html><head><title>Apache Tomcat/7.0.41 - Error report</title><style><!--H1 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:22px;} H2 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:16px;} H3 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:14px;} BODY {font-family:Tahoma,Arial,sans-serif;color:black;background-color:white;} B {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;} P {font-family:Tahoma,Arial,sans-serif;background:white;color:black;font-size:12px;}A {color : black;}A.name {color : black;}HR {color : #525D76;}--></style> </head><body><h1>HTTP Status 500 - Request processing failed; nested exception is java.lang.NullPointerException</h1><HR size="1" noshade="noshade"><p><b>type</b> Exception report</p><p><b>message</b> <u>Request processing failed; nested exception is java.lang.NullPointerException</u></p><p><b>description</b> <u>The server encountered an internal error that prevented it from fulfilling this request.</u></p><p><b>exception</b> <pre>org.springframework.web.util.NestedServletException: Request processing failed; nested exception is java.lang.NullPointerException..org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:894)..org.springframe
<<< skipped >>>
POST /update/check?w=3:H0r8iAJfY0HPFbfafxuAsuNAYdcfvoZko0Y55G3J2L8XzWRWZxCNbFQvLX6kLnBUlDQat7qHnZ__OKw95t0PBy5wH9EaX_xcLLjrzYaG23_B5LRfYFPb_RN5NYQQSnB73ODtOplfSUbnRwsR7yyRxSBvKHj7TPUgX_PLut5KOPA HTTP/1.1
User-Agent: Google Update/1.3.25.215;winhttp;cup
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
If-Match: "8PTvtU7Rlc_ahU24MTh4JdQNvd4"
Host: catalinahub.com
Content-Length: 567
Connection: Keep-Alive
Cache-Control: no-cache
Pragma: no-cache
<?xml version="1.0" encoding="UTF-8"?><request protocol="3.0" version="1.3.25.215" ismachine="0" sessionid="{CD858DB3-E8C7-4B70-8AE9-A56F0EF43D45}" userid="{802C7BA9-B484-4EEE-84A7-5BB18059CB01}" installsource="taggedmi" testsource="auto" requestid="{C266AB80-007A-4178-99B3-FA3D40793BBD}"><os platform="win" version="5.1" sp="Service Pack 3" arch="x86"/><app appid="{92F8A219-E740-49D5-B785-B962AD819724}" version="" nextversion="" buildtype="1" lang="en" brand="" client="" installage="-1" iid="{2F851C43-A7C8-4061-8931-F5533108A703}"><updatecheck/></app></request>
HTTP/1.1 200 OK
Date: Wed, 13 May 2015 09:07:11 GMT
Server: Apache-Coyote/1.1
Content-Type: application/xml;charset=UTF-8
Connection: close
Transfer-Encoding: chunked
2a6..<?xml version="1.0" encoding="UTF-8" standalone="yes"?><response protocol="3.0" server="dist"><dayStart elapsed_seconds="32832"/><app appid="{92F8A219-E740-49D5-B785-B962AD819724}" status="ok"><updatecheck status="ok"><urls><url codebase="hXXp://static.citrio.com/download/"/></urls><manifest version="41.0.2272.256"><packages><package hash="90v/AOStQ2VXeuyrX07HmQ2BMZw=" name="citrio_41.0.2272.256_1.exe" required="true" size="55656848"/></packages><actions><action arguments="--chrome --do-not-launch-chrome" event="install" run="citrio_41.0.2272.256_1.exe"/><action event="postinstall" onsuccess="exitsilentlyonlaunchcmd"/></actions></manifest></updatecheck></app></response>..0..
POST /update/ping HTTP/1.1
User-Agent: Google Update/1.3.25.215;winhttp
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
Host: catalinahub.com
Content-Length: 965
Connection: Keep-Alive
Cache-Control: no-cache
Pragma: no-cache
<?xml version="1.0" encoding="UTF-8"?><request protocol="3.0" version="1.3.25.215" ismachine="0" sessionid="{CD858DB3-E8C7-4B70-8AE9-A56F0EF43D45}" userid="{802C7BA9-B484-4EEE-84A7-5BB18059CB01}" installsource="taggedmi" testsource="auto" requestid="{694CAC4A-E36D-497E-88A7-A70C9733D683}"><os platform="win" version="5.1" sp="Service Pack 3" arch="x86"/><app appid="{92F8A219-E740-49D5-B785-B962AD819724}" version="" nextversion="41.0.2272.256" buildtype="1" lang="en" brand="" client="" installage="-1" iid="{2F851C43-A7C8-4061-8931-F5533108A703}"><event eventtype="9" eventresult="1" errorcode="0" extracode1="0"/><event eventtype="5" eventresult="1" errorcode="0" extracode1="0"/><event eventtype="1" eventresult="1" errorcode="0" extracode1="0" download_time_ms="54703" downloaded="55656848" total="55656848"/><event eventtype="6" eventresult="1" errorcode="0" extracode1="0"/><event eventtype="2" eventresult="1" errorcode="0" extracode1="0"/></app></request>
HTTP/1.1 200 OK
Date: Wed, 13 May 2015 09:08:26 GMT
Server: Apache-Coyote/1.1
Content-Type: application/xml;charset=UTF-8
Connection: close
Transfer-Encoding: chunked
136..<?xml version="1.0" encoding="UTF-8" standalone="yes"?><response protocol="3.0" server="dist"><dayStart elapsed_seconds="32906"/><app appid="{92F8A219-E740-49D5-B785-B962AD819724}" status="ok"><event status="ok"/><event status="ok"/><event status="ok"/><event status="ok"/><event status="ok"/></app></response>..0..
GET /resources/images/third_02.svg HTTP/1.1
Host: VVV.citrio.com
Connection: keep-alive
Accept: image/webp,*/*;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.256 Safari/537.36
Referer: hXXp://VVV.citrio.com/resources/css/main.css?v=7
X-Citrio-Timestamp: jXBGigczEmCnNmCbu3g7vsxQcb0= 2015-05-13T09:08:40.911Z
Accept-Encoding: gzip, deflate, sdch
Accept-Language: en-US,en;q=0.8
Cookie: __utmt=1; __utma=213201158.1092086691.1431508120.1431508120.1431508120.1; __utmb=213201158.1.10.1431508120; __utmc=213201158; __utmz=213201158.1431508120.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)
HTTP/1.1 200 OK
Date: Wed, 13 May 2015 09:08:43 GMT
Server: Apache/2.2.15 (CentOS)
Last-Modified: Fri, 17 Oct 2014 10:03:37 GMT
ETag: "63e0c53-ef9-5059b7a829040"
Accept-Ranges: bytes
Content-Length: 3833
Connection: close
Content-Type: image/svg xml
<svg xmlns="hXXp://VVV.w3.org/2000/svg" xmlns:xlink="hXXp://VVV.w3.org/1999/xlink" width="24px" height="70px">...<defs>... <path id="q" d="M16.746,17.573c-0.286,0-0.56,0.09-0.794,0.26c-1.161,0.841-2.521,1.285-3.933,1.285l-0.1-0.001.. ...c-0.204-0.003-0.389-0.013-0.565-0.029c-0.048-0.004-0.096-0.011-0.144-0.018l-0.086-0.012c-0.145-0.019-0.291-0.039-0.435-0.069.. ...c-0.076-0.016-0.15-0.034-0.225-0.053l-0.036-0.009c-0.14-0.034-0.279-0.067-0.415-0.11c-0.038-0.012-0.076-0.025-0.113-0.039.. ...L9.82,18.75c-0.192-0.066-0.336-0.121-0.469-0.178c-0.03-0.013-0.059-0.027-0.1-0.046c-0.198-0.089-0.369-0.175-0.524-0.263.. ...l-0.124,0.235l0.101-0.248c-0.576-0.326-1.104-0.734-1.568-1.214l-0.022-0.024c-0.141-0.148-0.279-0.305-0.413-0.472.. ...c-0.014-0.017-0.079-0.104-0.079-0.104c-0.934-1.208-1.452-2.646-1.506-4.173h1.618l0.215-0.416L3.94,7.176H3.509L0.5,11.846.. ...l0.215,0.416h1.626c0.05,1.935,0.637,3.797,1.704,5.396c0.013,0.026,0.026,0.05,0.041,0.071c0.083,0.123,0.173,0.24,0.263,0.355.. ...l0.091,0.118l0.047,0.064c0.029,0.04,0.057,0.079,0.087,0.115c0.159,0.198,0.34,0.405,0.555,0.632l0.055,0.058.. ...c0.641,0.665,1.372,1.232,2.186,1.694c0.019,0.012,0.038,0.023,0.049,0.028c0.226,0.126,0.456,0.241,0.704,0.352l0.177,0.082.. ...c0.186,0.079,0.385,0.155,0.622,0.235c0.101,0.036,0.201,0.073,0.303,0.104c0.18,0.056,0.366,0.103,0.566,0.152l0.13,0.031.. ...c0.081,0.02,0.163,0.039,0.248,0.057c0.019,0.004,0.037,0.008,0.055,0.013c0.035,0.008,0.069,0.01
<<< skipped >>>
GET /resources/images/third.png HTTP/1.1
Host: VVV.citrio.com
Connection: keep-alive
Accept: image/webp,*/*;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.256 Safari/537.36
Referer: hXXp://VVV.citrio.com/resources/css/main.css?v=7
X-Citrio-Timestamp: 3WRnD35f26X4Urm0ToXcm HVGxQ= 2015-05-13T09:08:40.910Z
Accept-Encoding: gzip, deflate, sdch
Accept-Language: en-US,en;q=0.8
Cookie: __utmt=1; __utma=213201158.1092086691.1431508120.1431508120.1431508120.1; __utmb=213201158.1.10.1431508120; __utmc=213201158; __utmz=213201158.1431508120.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)
HTTP/1.1 200 OK
Date: Wed, 13 May 2015 09:08:43 GMT
Server: Apache/2.2.15 (CentOS)
Last-Modified: Thu, 16 Apr 2015 12:32:58 GMT
ETag: "63e0d37-199d4-513d6a9e77280"
Accept-Ranges: bytes
Content-Length: 104916
Connection: close
Content-Type: image/png
.PNG........IHDR.............X.......tEXtSoftware.Adobe ImageReadyq.e<...(iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.155772, 2014/01/13-19:44:00 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2014 (Macintosh)" xmpMM:InstanceID="xmp.iid:715AD06FDC5711E4B616BE53B21A867E" xmpMM:DocumentID="xmp.did:715AD070DC5711E4B616BE53B21A867E"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:715AD06DDC5711E4B616BE53B21A867E" stRef:documentID="xmp.did:715AD06EDC5711E4B616BE53B21A867E"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..'/...BIDATx....|......]w....%[...m\h..S.J.).MB ....... $.$$t....p..K.e...;.z...o..s6n......#.......y.......p<.....H$Rp8....9.H$.v.\.......K....p.,..._......p8g..&...p8\09........p8...L....p.`r8........p8........p..p8........p8........p..p8....&...p8\09........p8...L....p8\09...........].......R.p)..yN..Z.J..1b....O.w..1466..G.....*..%.\r......{....w.hmm..............N...7..t....M..p8..!?.).~....s_.....`\.9-.n.:......M.......}...X.t)JJJ......>.......r..W_}U...X.h.n..6dee}cN...7...2.w...b......../LS*..........'|&&&...:.N.....Boo..===..yg...Y......y.O =.):.X....\.....y..O.Mr....\..
<<< skipped >>>
GET /resources/fonts/museo-700.otf HTTP/1.1
Host: VVV.citrio.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.256 Safari/537.36
Accept: */*
Referer: hXXp://VVV.citrio.com/resources/css/main.css?v=7
X-Citrio-Timestamp: m5S7yOylrpzfpRS6AomoMqBdewQ= 2015-05-13T09:08:40.288Z
Accept-Encoding: gzip, deflate, sdch
Accept-Language: en-US,en;q=0.8
Cookie: __utmt=1; __utma=213201158.1092086691.1431508120.1431508120.1431508120.1; __utmb=213201158.1.10.1431508120; __utmc=213201158; __utmz=213201158.1431508120.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)
HTTP/1.1 200 OK
Date: Wed, 13 May 2015 09:08:42 GMT
Server: Apache/2.2.15 (CentOS)
Last-Modified: Fri, 17 Oct 2014 10:03:38 GMT
ETag: "63e0d3e-1a0d8-5059b7a91d280"
Accept-Ranges: bytes
Content-Length: 106712
Connection: close
Content-Type: application/vnd.oasis.opendocument.formula-template
OTTO.......0CFF ............GPOS..l.........GSUB.o.n.......LOS/2....... ...`cmap..G.... ....head.w.........6hhea...........$hmtxF.z.........maxp..P.........namev...........post...2....... ............_.<..........';......F.<...).n...............................n....................P........K.X.......X...K...X...^.2.,............................xljb... ............ ............ . .......n.........8.............8...........G.........&.J...........p.................................*.........................................................................8...........G.........p...........&.{.....................L..........."......................."...........T.7.................................:.................................................)Copyright (c) 2012 by Jos Buivenga. All rights reserved.Museo Sans Cyrl700JosBuivenga: Museo Sans Cyrl 700: 2012Museo Sans Cyrl 700Version 1.023MuseoSansCyrl-700Museo Sans is a trademark of Jos Buivenga.Jos BuivengaSpaced and kerned with iKern.hXXp://VVV.exljbris.com.C.o.p.y.r.i.g.h.t. .(.c.). .2.0.1.2. .b.y. .J.o.s. .B.u.i.v.e.n.g.a... .A.l.l. .r.i.g.h.t.s. .r.e.s.e.r.v.e.d...M.u.s.e.o. .S.a.n.s. .C.y.r.l. .7.0.0.R.e.g.u.l.a.r.J.o.s.B.u.i.v.e.n.g.a.:. .M.u.s.e.o. .S.a.n.s. .C.y.r.l. .7.0.0.:. .2.0.1.2.M.u.s.e.o.S.a.n.s.C.y.r.l.-.7.0.0.V.e.r.s.i.o.n. .1...0.2.3.M.u.s.e.o. .S.a.n.s. .i.s. .a. .t.r.a.d.e.m.a.r.k. .o.f. .J.o.s. .B.u.i.v.e.n.g.a...J.o.s. .B.u.i.v.e.n.g.a.S.p.a.c.e.d. .a.n.d. .k.e.r.n.e.d. .w.i.t.h. .i.K.e.r.n...h.t.t.p.:././.w.w.w...e.x.l.j.b.r.i.s...c.o.m.
<<< skipped >>>
GET /download/citrio_41.0.2272.256_1.exe HTTP/1.1
Accept: */*
Accept-Encoding: identity
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
User-Agent: Microsoft BITS/6.7
Host: static.citrio.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Wed, 13 May 2015 08:32:02 GMT
Server: Apache-Coyote/1.1
ETag: W/"55656848-1431505908000"
Last-Modified: Wed, 13 May 2015 08:31:48 GMT
Content-Type: application/octet-stream;charset=UTF-8
Age: 2111
Content-Length: 55656848
Connection: close
Accept-Ranges: bytes
MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}.Y49x7g9x7g9x7g...g>x7g9x6g.x7gD..g>x7g4*.g8x7g9x.g:x7gD..g8x7gRich9x7g........................PE..L...).KU................."....Q......!.......@....@...........................Q.....}XQ......................................P..P....`....Q..........4Q......pQ.t.......8............................................P...............................text...Z!.......".................. ..`.data........@......................@....idata.......P.......&..............@..@.rsrc.....Q..`....Q..,..............@..@.reloc..t....pQ......2Q.............@..B....................................................................................................................................................................................................................................................................................................................................................................).KU........g...H...H.......).KU....................{.9.2.F.8.A.2.1.9.-.E.7.4.0.-.4.9.D.5.-.B.7.8.5.-.B.9.6.2.A.D.8.1.9.7.2.4.}.....{.E.9.F.2.4.A.7.C.-.1.3.C.A.-.4.2.F.B.-.A.4.D.9.-.7.9.C.3.C.9.D.2.1.B.2.8.}.....{.0.1.0.5.E.A.0.2.-.8.0.2.D.-.4.B.3.7.-.8.1.6.1.-.4.E.D.2.5.C.4.9.3.2.6.6.}.....{.D.E.2.8.A.2.E.A.-.7.7.F.A.-.4.F.2.B.-.8.2.5.2.-.C.3.B.5.8.4.4.F.6.4.5.5.}.....{.F.0.B.5.0.D.5.A.-.4.B.B.A.-.4.5.1.4.-.A.D.2.C.-.E.B.A.5.0.C.2.9.C.4.6.0.}.....-.-.c.h.r.o.m.e.-.s.x.s.....-.-.c.h.r.o.m.e.....-.
<<< skipped >>>
Map
The Trojan connects to the servers at the folowing location(s):
Strings from Dumps
CatalinaCrashHandler.exe_2412:
.text
.text
`.data
`.data
.text/DE
.text/DE
@.rsrc
@.rsrc
@.reloc
@.reloc
SHELL32.dll
SHELL32.dll
USER32.dll
USER32.dll
SHLWAPI.dll
SHLWAPI.dll
WINTRUST.dll
WINTRUST.dll
Please contact the application's support team for more information.
Please contact the application's support team for more information.
- Attempt to initialize the CRT more than once.
- Attempt to initialize the CRT more than once.
- CRT not initialized
- CRT not initialized
- floating point support not loaded
- floating point support not loaded
GetProcessWindowStation
GetProcessWindowStation
USER32.DLL
USER32.DLL
operator
operator
CatalinaUpdate_unsigned.pdb
CatalinaUpdate_unsigned.pdb
RegOpenKeyExW
RegOpenKeyExW
ADVAPI32.dll
ADVAPI32.dll
KERNEL32.dll
KERNEL32.dll
ole32.dll
ole32.dll
GetProcessHeap
GetProcessHeap
GetCPInfo
GetCPInfo
GetConsoleOutputCP
GetConsoleOutputCP
name="Microsoft.Windows.Common-Controls"
name="Microsoft.Windows.Common-Controls"
version="6.0.0.0"
version="6.0.0.0"
publicKeyToken="6595b64144ccf1df"
publicKeyToken="6595b64144ccf1df"
###7777_{
###7777_{
###____777
###____777
###````87{
###````87{
3 3$3(3,30343~3
3 3$3(3,30343~3
5 5$5(5,5
5 5$5(5,5
?$?(?,?4?
?$?(?,?4?
= =$=@=`=
= =$=@=`=
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\CatalinaCrashHandler.exe
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.215\CatalinaCrashHandler.exe
KERNEL32.DLL
KERNEL32.DLL
mscoree.dll
mscoree.dll
goopdate.dll
goopdate.dll
CatalinaUpdate.exe
CatalinaUpdate.exe
Software\CatalinaGroup\Update\Clients\{6C598730-F715-407B-A7AE-A8F10D0F8FA7}
Software\CatalinaGroup\Update\Clients\{6C598730-F715-407B-A7AE-A8F10D0F8FA7}
1.3.25.215
1.3.25.215
2007-2010
2007-2010
2007-2010
2007-2010
citrio.exe_2808:
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
@.reloc
@.reloc
SHA256 block transform for x86, CRYPTOGAMS by
SHA256 block transform for x86, CRYPTOGAMS by
HtdHtHHHt.HH
HtdHtHHHt.HH
j.Yf;
j.Yf;
_tcPVj@
_tcPVj@
.PjRW
.PjRW
c:\jenkins\workspace\citrio-dev\browser\src\chrome\app\chrome_exe_main_win.cc
c:\jenkins\workspace\citrio-dev\browser\src\chrome\app\chrome_exe_main_win.cc
c:\jenkins\workspace\citrio-dev\browser\src\chrome\app\chrome_watcher_command_line_win.cc
c:\jenkins\workspace\citrio-dev\browser\src\chrome\app\chrome_watcher_command_line_win.cc
No valid Chrome version found
No valid Chrome version found
c:\jenkins\workspace\citrio-dev\browser\src\chrome\app\client_util.cc
c:\jenkins\workspace\citrio-dev\browser\src\chrome\app\client_util.cc
Failed to load Chrome DLL from
Failed to load Chrome DLL from
ChromeMain
ChromeMain
RelaunchChromeBrowserWithNewCommandLineIfNeeded
RelaunchChromeBrowserWithNewCommandLineIfNeeded
Could not find exported function
Could not find exported function
1.3.21.115
1.3.21.115
%s-x-x
%s-x-x
Chrome
Chrome
0.0.0.0-devel
0.0.0.0-devel
%s-%x
%s-%x
font_key_name
font_key_name
url-chunk
url-chunk
subresource_url
subresource_url
c:\jenkins\workspace\citrio-dev\browser\src\components\browser_watcher\watcher_client_win.cc
c:\jenkins\workspace\citrio-dev\browser\src\components\browser_watcher\watcher_client_win.cc
CHROME_MAIN_TIME
CHROME_MAIN_TIME
c:\jenkins\workspace\citrio-dev\browser\src\chrome\installer\util\google_update_settings.cc
c:\jenkins\workspace\citrio-dev\browser\src\chrome\installer\util\google_update_settings.cc
Failed to write to application's ClientState key
Failed to write to application's ClientState key
Removed incremental installer failure key; switching to channel:
Removed incremental installer failure key; switching to channel:
Removed multi-install failure key; switching to channel:
Removed multi-install failure key; switching to channel:
chrome-sxs
chrome-sxs
googlechrome
googlechrome
c:\jenkins\workspace\citrio-dev\browser\src\chrome\installer\util\channel_info.cc
c:\jenkins\workspace\citrio-dev\browser\src\chrome\installer\util\channel_info.cc
Cannot initialize AppCommands from an invalid key.
Cannot initialize AppCommands from an invalid key.
c:\jenkins\workspace\citrio-dev\browser\src\chrome\installer\util\app_commands.cc
c:\jenkins\workspace\citrio-dev\browser\src\chrome\installer\util\app_commands.cc
Failed to open key "
Failed to open key "
Skipping over key "
Skipping over key "
iexplore.exe
iexplore.exe
googlechromeapphost
googlechromeapphost
googlechromeframe
googlechromeframe
Cannot initialize an AppCommand from an invalid key.
Cannot initialize an AppCommand from an invalid key.
c:\jenkins\workspace\citrio-dev\browser\src\chrome\installer\util\app_command.cc
c:\jenkins\workspace\citrio-dev\browser\src\chrome\installer\util\app_command.cc
c:\jenkins\workspace\citrio-dev\browser\src\chrome\installer\util\language_selector.cc
c:\jenkins\workspace\citrio-dev\browser\src\chrome\installer\util\language_selector.cc
CHROME_BREAKPAD_PIPE_NAME
CHROME_BREAKPAD_PIPE_NAME
c:\jenkins\workspace\citrio-dev\browser\src\components\crash\app\breakpad_win.cc
c:\jenkins\workspace\citrio-dev\browser\src\components\crash\app\breakpad_win.cc
NTDLL.DLL
NTDLL.DLL
kernel32.dll
kernel32.dll
c:\jenkins\workspace\citrio-dev\browser\src\sandbox\win\src\sandbox_policy_base.cc
c:\jenkins\workspace\citrio-dev\browser\src\sandbox\win\src\sandbox_policy_base.cc
CreateNamedPipeW
CreateNamedPipeW
NtCreateKey
NtCreateKey
NtOpenKey
NtOpenKey
NtOpenKeyEx
NtOpenKeyEx
MetricsReportingEnabled
MetricsReportingEnabled
CHROME_VERSION
CHROME_VERSION
41.0.2272.256
41.0.2272.256
CHROME_HEADLESS
CHROME_HEADLESS
CHROME_METRO_CONNECTED
CHROME_METRO_CONNECTED
CHROME_CRASHED
CHROME_CRASHED
CHROME_RESTART
CHROME_RESTART
chrome.googleechotest.com
chrome.googleechotest.com
user_experience_metrics.reporting_enabled
user_experience_metrics.reporting_enabled
SHELL32.dll
SHELL32.dll
ole32.dll
ole32.dll
OLEAUT32.dll
OLEAUT32.dll
function not supported
function not supported
operation canceled
operation canceled
address_family_not_supported
address_family_not_supported
operation_in_progress
operation_in_progress
operation_not_supported
operation_not_supported
protocol_not_supported
protocol_not_supported
operation_would_block
operation_would_block
address family not supported
address family not supported
broken pipe
broken pipe
inappropriate io control operation
inappropriate io control operation
not supported
not supported
operation in progress
operation in progress
operation not permitted
operation not permitted
operation not supported
operation not supported
operation would block
operation would block
protocol not supported
protocol not supported
GetProcessWindowStation
GetProcessWindowStation
operator
operator
(0x%X)
(0x%X)
Error (0x%X) while retrieving error. (0x%X)
Error (0x%X) while retrieving error. (0x%X)
%s-%Iu
%s-%Iu
(%d = %3.1f%%)
(%d = %3.1f%%)
Histogram: %s recorded %d samples
Histogram: %s recorded %d samples
(flags = 0x%x)
(flags = 0x%x)
PlatformFile.UnknownErrors.Windows
PlatformFile.UnknownErrors.Windows
user32.dll
user32.dll
0123456789
0123456789
\uX
\uX
.syzygy
.syzygy
.thunks
.thunks
Dictionary keys must be quoted.
Dictionary keys must be quoted.
Unsupported encoding. JSON must be UTF-8.
Unsupported encoding. JSON must be UTF-8.
Line: %i, column: %i, %s
Line: %i, column: %i, %s
full-memory-crash-report
full-memory-crash-report
c:\jenkins\workspace\Citrio-Dev\browser\src\out\Release\initialexe\citrio.exe.pdb
c:\jenkins\workspace\Citrio-Dev\browser\src\out\Release\initialexe\citrio.exe.pdb
citrio.exe
citrio.exe
ClearBreakpadPipeEnvironmentVariable
ClearBreakpadPipeEnvironmentVariable
ClearCrashKeyValueImpl
ClearCrashKeyValueImpl
SetCrashKeyValueImpl
SetCrashKeyValueImpl
SignalChromeElf
SignalChromeElf
citrio_elf.dll
citrio_elf.dll
VERSION.dll
VERSION.dll
WINMM.dll
WINMM.dll
RegCreateKeyExW
RegCreateKeyExW
RegQueryInfoKeyW
RegQueryInfoKeyW
RegOpenKeyExW
RegOpenKeyExW
RegEnumKeyExW
RegEnumKeyExW
RegCloseKey
RegCloseKey
ADVAPI32.dll
ADVAPI32.dll
CloseWindowStation
CloseWindowStation
CreateWindowStationW
CreateWindowStationW
SetProcessWindowStation
SetProcessWindowStation
USER32.dll
USER32.dll
GetProcessHeap
GetProcessHeap
GetWindowsDirectoryW
GetWindowsDirectoryW
CreateIoCompletionPort
CreateIoCompletionPort
GetProcessHandleCount
GetProcessHandleCount
KERNEL32.dll
KERNEL32.dll
USERENV.dll
USERENV.dll
WTSAPI32.dll
WTSAPI32.dll
GetCPInfo
GetCPInfo
SetNamedPipeHandleState
SetNamedPipeHandleState
TransactNamedPipe
TransactNamedPipe
WaitNamedPipeW
WaitNamedPipeW
zcÃ
zcÃ
41.0.2272.256-00000af8-00055f5d
41.0.2272.256-00000af8-00055f5d
444.44...4
444.44...4
4.4....4.
4.4....4.
..44.44@4
..44.44@4
4@444@4.
4@444@4.
.4@4@@4.
.4@4@@4.
}.GnO
}.GnO
Ôjo
Ôjo
k.SZ[
k.SZ[
j.oii
j.oii
8%8s8
8%8s8
30}0#1\1
30}0#1\1
0!0%0)0-0105090
0!0%0)0-0105090
0 0(00080
0 0(00080
8(9,909\9
8(9,909\9
= =$=(=,=0=4=8=
= =$=(=,=0=4=8=
3 3$3,3@3`3
3 3$3,3@3`3
chrome_watcher.dll
chrome_watcher.dll
{0105EA02-802D-4B37-8161-4ED25C493266}
{0105EA02-802D-4B37-8161-4ED25C493266}
app_host.exe
app_host.exe
citrio.dll
citrio.dll
citrio_child.dll
citrio_child.dll
metro_driver.dll
metro_driver.dll
{E9F24A7C-13CA-42FB-A4D9-79C3C9D21B28}
{E9F24A7C-13CA-42FB-A4D9-79C3C9D21B28}
ChromeCanary
ChromeCanary
ChromeSSHTM
ChromeSSHTM
Chrome Canary HTML Document
Chrome Canary HTML Document
{1BEAC3E3-B852-44F4-B468-8906C062422E}
{1BEAC3E3-B852-44F4-B468-8906C062422E}
BGoogle Chrome Canary
BGoogle Chrome Canary
{3599E25E-6314-4BE9-AE14-E51877342426}
{3599E25E-6314-4BE9-AE14-E51877342426}
{675046A3-9F4F-4805-A81C-CBF753FE3428}
{675046A3-9F4F-4805-A81C-CBF753FE3428}
Browse the web
Browse the web
Software\Microsoft\Windows\CurrentVersion\Uninstall\Citrio
Software\Microsoft\Windows\CurrentVersion\Uninstall\Citrio
-chrome
-chrome
-chromeframe
-chromeframe
WebAccessible
WebAccessible
{92F8A219-E740-49D5-B785-B962AD819724}
{92F8A219-E740-49D5-B785-B962AD819724}
{8BF2F61B-E8C2-4A67-85D0-D6A69F9FD948}
{8BF2F61B-E8C2-4A67-85D0-D6A69F9FD948}
hXXp://VVV.citrio.com/goodbye.html?intl=$1
hXXp://VVV.citrio.com/goodbye.html?intl=$1
%d.%d.%d
%d.%d.%d
BGoogle Chrome App Launcher
BGoogle Chrome App Launcher
ChromeAppList
ChromeAppList
Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome App Launcher
Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome App Launcher
{DE28A2EA-77FA-4F2B-8252-C3B5844F6455}
{DE28A2EA-77FA-4F2B-8252-C3B5844F6455}
BGoogle Chrome Frame
BGoogle Chrome Frame
Chrome in a Frame.
Chrome in a Frame.
Uninstall Chrome Frame
Uninstall Chrome Frame
Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome Frame
Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome Frame
{F0B50D5A-4BBA-4514-AD2C-EBA50C29C460}
{F0B50D5A-4BBA-4514-AD2C-EBA50C29C460}
Google Chrome binaries
Google Chrome binaries
\\.\pipe\GoogleCrashServices\
\\.\pipe\GoogleCrashServices\
\\.\pipe\ChromeCrashServices
\\.\pipe\ChromeCrashServices
error %u
error %u
chrome.exe
chrome.exe
ntdll.dll
ntdll.dll
HKEY_CLASSES_ROOT
HKEY_CLASSES_ROOT
HKEY_CURRENT_USER
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_LOCAL_MACHINE
HKEY_USERS
HKEY_USERS
HKEY_PERFORMANCE_DATA
HKEY_PERFORMANCE_DATA
HKEY_PERFORMANCE_TEXT
HKEY_PERFORMANCE_TEXT
HKEY_PERFORMANCE_NLSTEXT
HKEY_PERFORMANCE_NLSTEXT
HKEY_CURRENT_CONFIG
HKEY_CURRENT_CONFIG
HKEY_DYN_DATA
HKEY_DYN_DATA
pipe\
pipe\
Ckernel32.dll
Ckernel32.dll
kernelbase.dll
kernelbase.dll
eKey
eKey
gdi32.dll
gdi32.dll
xntdll.dll
xntdll.dll
wow_helper.exe"
wow_helper.exe"
Cntdll.dll
Cntdll.dll
${windows}
${windows}
hunspecified-crash-key
hunspecified-crash-key
Dmscoree.dll
Dmscoree.dll
HADVAPI32.DLL
HADVAPI32.DLL
- floating point support not loaded
- floating point support not loaded
- CRT not initialized
- CRT not initialized
- Attempt to initialize the CRT more than once.
- Attempt to initialize the CRT more than once.
USER32.DLL
USER32.DLL
portuguese-brazilian
portuguese-brazilian
dbghelp.dll
dbghelp.dll
rpcrt4.dll
rpcrt4.dll
%s\%s.dmp
%s\%s.dmp
x-x-x-xx-xxxxxx
x-x-x-xx-xxxxxx
Ndebug.log
Ndebug.log
.\debug.log
.\debug.log
\StringFileInfo\xx\%ls
\StringFileInfo\xx\%ls
tntdll.dll
tntdll.dll
Chrome_MessageWindow
Chrome_MessageWindow
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application\citrio.exe
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application\citrio.exe
IDR_X006_CITRIO_CHROMESTORE
IDR_X006_CITRIO_CHROMESTORE
citrio_exe
citrio_exe
citrio.exe_2808_rwx_1600A000_00078000:
PPP;%x
PPP;%x
VW;%x
VW;%x
PPPP;%x
PPPP;%x
PPPPPPP;%x
PPPPPPP;%x
PPPPP;%x
PPPPP;%x
PP;%x
PP;%x
citrio.exe_3160:
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
@.reloc
@.reloc
SHA256 block transform for x86, CRYPTOGAMS by
SHA256 block transform for x86, CRYPTOGAMS by
HtdHtHHHt.HH
HtdHtHHHt.HH
j.Yf;
j.Yf;
_tcPVj@
_tcPVj@
.PjRW
.PjRW
c:\jenkins\workspace\citrio-dev\browser\src\chrome\app\chrome_exe_main_win.cc
c:\jenkins\workspace\citrio-dev\browser\src\chrome\app\chrome_exe_main_win.cc
c:\jenkins\workspace\citrio-dev\browser\src\chrome\app\chrome_watcher_command_line_win.cc
c:\jenkins\workspace\citrio-dev\browser\src\chrome\app\chrome_watcher_command_line_win.cc
No valid Chrome version found
No valid Chrome version found
c:\jenkins\workspace\citrio-dev\browser\src\chrome\app\client_util.cc
c:\jenkins\workspace\citrio-dev\browser\src\chrome\app\client_util.cc
Failed to load Chrome DLL from
Failed to load Chrome DLL from
ChromeMain
ChromeMain
RelaunchChromeBrowserWithNewCommandLineIfNeeded
RelaunchChromeBrowserWithNewCommandLineIfNeeded
Could not find exported function
Could not find exported function
1.3.21.115
1.3.21.115
%s-x-x
%s-x-x
Chrome
Chrome
0.0.0.0-devel
0.0.0.0-devel
%s-%x
%s-%x
font_key_name
font_key_name
url-chunk
url-chunk
subresource_url
subresource_url
c:\jenkins\workspace\citrio-dev\browser\src\components\browser_watcher\watcher_client_win.cc
c:\jenkins\workspace\citrio-dev\browser\src\components\browser_watcher\watcher_client_win.cc
CHROME_MAIN_TIME
CHROME_MAIN_TIME
c:\jenkins\workspace\citrio-dev\browser\src\chrome\installer\util\google_update_settings.cc
c:\jenkins\workspace\citrio-dev\browser\src\chrome\installer\util\google_update_settings.cc
Failed to write to application's ClientState key
Failed to write to application's ClientState key
Removed incremental installer failure key; switching to channel:
Removed incremental installer failure key; switching to channel:
Removed multi-install failure key; switching to channel:
Removed multi-install failure key; switching to channel:
chrome-sxs
chrome-sxs
googlechrome
googlechrome
c:\jenkins\workspace\citrio-dev\browser\src\chrome\installer\util\channel_info.cc
c:\jenkins\workspace\citrio-dev\browser\src\chrome\installer\util\channel_info.cc
Cannot initialize AppCommands from an invalid key.
Cannot initialize AppCommands from an invalid key.
c:\jenkins\workspace\citrio-dev\browser\src\chrome\installer\util\app_commands.cc
c:\jenkins\workspace\citrio-dev\browser\src\chrome\installer\util\app_commands.cc
Failed to open key "
Failed to open key "
Skipping over key "
Skipping over key "
iexplore.exe
iexplore.exe
googlechromeapphost
googlechromeapphost
googlechromeframe
googlechromeframe
Cannot initialize an AppCommand from an invalid key.
Cannot initialize an AppCommand from an invalid key.
c:\jenkins\workspace\citrio-dev\browser\src\chrome\installer\util\app_command.cc
c:\jenkins\workspace\citrio-dev\browser\src\chrome\installer\util\app_command.cc
c:\jenkins\workspace\citrio-dev\browser\src\chrome\installer\util\language_selector.cc
c:\jenkins\workspace\citrio-dev\browser\src\chrome\installer\util\language_selector.cc
CHROME_BREAKPAD_PIPE_NAME
CHROME_BREAKPAD_PIPE_NAME
c:\jenkins\workspace\citrio-dev\browser\src\components\crash\app\breakpad_win.cc
c:\jenkins\workspace\citrio-dev\browser\src\components\crash\app\breakpad_win.cc
NTDLL.DLL
NTDLL.DLL
kernel32.dll
kernel32.dll
c:\jenkins\workspace\citrio-dev\browser\src\sandbox\win\src\sandbox_policy_base.cc
c:\jenkins\workspace\citrio-dev\browser\src\sandbox\win\src\sandbox_policy_base.cc
CreateNamedPipeW
CreateNamedPipeW
NtCreateKey
NtCreateKey
NtOpenKey
NtOpenKey
NtOpenKeyEx
NtOpenKeyEx
MetricsReportingEnabled
MetricsReportingEnabled
CHROME_VERSION
CHROME_VERSION
41.0.2272.256
41.0.2272.256
CHROME_HEADLESS
CHROME_HEADLESS
CHROME_METRO_CONNECTED
CHROME_METRO_CONNECTED
CHROME_CRASHED
CHROME_CRASHED
CHROME_RESTART
CHROME_RESTART
chrome.googleechotest.com
chrome.googleechotest.com
user_experience_metrics.reporting_enabled
user_experience_metrics.reporting_enabled
SHELL32.dll
SHELL32.dll
ole32.dll
ole32.dll
OLEAUT32.dll
OLEAUT32.dll
function not supported
function not supported
operation canceled
operation canceled
address_family_not_supported
address_family_not_supported
operation_in_progress
operation_in_progress
operation_not_supported
operation_not_supported
protocol_not_supported
protocol_not_supported
operation_would_block
operation_would_block
address family not supported
address family not supported
broken pipe
broken pipe
inappropriate io control operation
inappropriate io control operation
not supported
not supported
operation in progress
operation in progress
operation not permitted
operation not permitted
operation not supported
operation not supported
operation would block
operation would block
protocol not supported
protocol not supported
GetProcessWindowStation
GetProcessWindowStation
operator
operator
(0x%X)
(0x%X)
Error (0x%X) while retrieving error. (0x%X)
Error (0x%X) while retrieving error. (0x%X)
%s-%Iu
%s-%Iu
(%d = %3.1f%%)
(%d = %3.1f%%)
Histogram: %s recorded %d samples
Histogram: %s recorded %d samples
(flags = 0x%x)
(flags = 0x%x)
PlatformFile.UnknownErrors.Windows
PlatformFile.UnknownErrors.Windows
user32.dll
user32.dll
0123456789
0123456789
\uX
\uX
.syzygy
.syzygy
.thunks
.thunks
Dictionary keys must be quoted.
Dictionary keys must be quoted.
Unsupported encoding. JSON must be UTF-8.
Unsupported encoding. JSON must be UTF-8.
Line: %i, column: %i, %s
Line: %i, column: %i, %s
full-memory-crash-report
full-memory-crash-report
c:\jenkins\workspace\Citrio-Dev\browser\src\out\Release\initialexe\citrio.exe.pdb
c:\jenkins\workspace\Citrio-Dev\browser\src\out\Release\initialexe\citrio.exe.pdb
citrio.exe
citrio.exe
ClearBreakpadPipeEnvironmentVariable
ClearBreakpadPipeEnvironmentVariable
ClearCrashKeyValueImpl
ClearCrashKeyValueImpl
SetCrashKeyValueImpl
SetCrashKeyValueImpl
SignalChromeElf
SignalChromeElf
citrio_elf.dll
citrio_elf.dll
VERSION.dll
VERSION.dll
WINMM.dll
WINMM.dll
RegCreateKeyExW
RegCreateKeyExW
RegQueryInfoKeyW
RegQueryInfoKeyW
RegOpenKeyExW
RegOpenKeyExW
RegEnumKeyExW
RegEnumKeyExW
RegCloseKey
RegCloseKey
ADVAPI32.dll
ADVAPI32.dll
CloseWindowStation
CloseWindowStation
CreateWindowStationW
CreateWindowStationW
SetProcessWindowStation
SetProcessWindowStation
USER32.dll
USER32.dll
GetProcessHeap
GetProcessHeap
GetWindowsDirectoryW
GetWindowsDirectoryW
CreateIoCompletionPort
CreateIoCompletionPort
GetProcessHandleCount
GetProcessHandleCount
KERNEL32.dll
KERNEL32.dll
USERENV.dll
USERENV.dll
WTSAPI32.dll
WTSAPI32.dll
GetCPInfo
GetCPInfo
SetNamedPipeHandleState
SetNamedPipeHandleState
TransactNamedPipe
TransactNamedPipe
WaitNamedPipeW
WaitNamedPipeW
zcÃ
zcÃ
444.44...4
444.44...4
4.4....4.
4.4....4.
..44.44@4
..44.44@4
4@444@4.
4@444@4.
.4@4@@4.
.4@4@@4.
}.GnO
}.GnO
Ôjo
Ôjo
k.SZ[
k.SZ[
j.oii
j.oii
8%8s8
8%8s8
30}0#1\1
30}0#1\1
0!0%0)0-0105090
0!0%0)0-0105090
0 0(00080
0 0(00080
8(9,909\9
8(9,909\9
= =$=(=,=0=4=8=
= =$=(=,=0=4=8=
3 3$3,3@3`3
3 3$3,3@3`3
chrome_watcher.dll
chrome_watcher.dll
{0105EA02-802D-4B37-8161-4ED25C493266}
{0105EA02-802D-4B37-8161-4ED25C493266}
app_host.exe
app_host.exe
citrio.dll
citrio.dll
citrio_child.dll
citrio_child.dll
metro_driver.dll
metro_driver.dll
{E9F24A7C-13CA-42FB-A4D9-79C3C9D21B28}
{E9F24A7C-13CA-42FB-A4D9-79C3C9D21B28}
ChromeCanary
ChromeCanary
ChromeSSHTM
ChromeSSHTM
Chrome Canary HTML Document
Chrome Canary HTML Document
{1BEAC3E3-B852-44F4-B468-8906C062422E}
{1BEAC3E3-B852-44F4-B468-8906C062422E}
BGoogle Chrome Canary
BGoogle Chrome Canary
{3599E25E-6314-4BE9-AE14-E51877342426}
{3599E25E-6314-4BE9-AE14-E51877342426}
{675046A3-9F4F-4805-A81C-CBF753FE3428}
{675046A3-9F4F-4805-A81C-CBF753FE3428}
Browse the web
Browse the web
Software\Microsoft\Windows\CurrentVersion\Uninstall\Citrio
Software\Microsoft\Windows\CurrentVersion\Uninstall\Citrio
-chrome
-chrome
-chromeframe
-chromeframe
WebAccessible
WebAccessible
{92F8A219-E740-49D5-B785-B962AD819724}
{92F8A219-E740-49D5-B785-B962AD819724}
{8BF2F61B-E8C2-4A67-85D0-D6A69F9FD948}
{8BF2F61B-E8C2-4A67-85D0-D6A69F9FD948}
hXXp://VVV.citrio.com/goodbye.html?intl=$1
hXXp://VVV.citrio.com/goodbye.html?intl=$1
%d.%d.%d
%d.%d.%d
BGoogle Chrome App Launcher
BGoogle Chrome App Launcher
ChromeAppList
ChromeAppList
Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome App Launcher
Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome App Launcher
{DE28A2EA-77FA-4F2B-8252-C3B5844F6455}
{DE28A2EA-77FA-4F2B-8252-C3B5844F6455}
BGoogle Chrome Frame
BGoogle Chrome Frame
Chrome in a Frame.
Chrome in a Frame.
Uninstall Chrome Frame
Uninstall Chrome Frame
Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome Frame
Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome Frame
{F0B50D5A-4BBA-4514-AD2C-EBA50C29C460}
{F0B50D5A-4BBA-4514-AD2C-EBA50C29C460}
Google Chrome binaries
Google Chrome binaries
\\.\pipe\GoogleCrashServices\
\\.\pipe\GoogleCrashServices\
\\.\pipe\ChromeCrashServices
\\.\pipe\ChromeCrashServices
error %u
error %u
chrome.exe
chrome.exe
ntdll.dll
ntdll.dll
HKEY_CLASSES_ROOT
HKEY_CLASSES_ROOT
HKEY_CURRENT_USER
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_LOCAL_MACHINE
HKEY_USERS
HKEY_USERS
HKEY_PERFORMANCE_DATA
HKEY_PERFORMANCE_DATA
HKEY_PERFORMANCE_TEXT
HKEY_PERFORMANCE_TEXT
HKEY_PERFORMANCE_NLSTEXT
HKEY_PERFORMANCE_NLSTEXT
HKEY_CURRENT_CONFIG
HKEY_CURRENT_CONFIG
HKEY_DYN_DATA
HKEY_DYN_DATA
pipe\
pipe\
Ckernel32.dll
Ckernel32.dll
kernelbase.dll
kernelbase.dll
eKey
eKey
gdi32.dll
gdi32.dll
xntdll.dll
xntdll.dll
wow_helper.exe"
wow_helper.exe"
Cntdll.dll
Cntdll.dll
${windows}
${windows}
hunspecified-crash-key
hunspecified-crash-key
Dmscoree.dll
Dmscoree.dll
HADVAPI32.DLL
HADVAPI32.DLL
- floating point support not loaded
- floating point support not loaded
- CRT not initialized
- CRT not initialized
- Attempt to initialize the CRT more than once.
- Attempt to initialize the CRT more than once.
USER32.DLL
USER32.DLL
portuguese-brazilian
portuguese-brazilian
dbghelp.dll
dbghelp.dll
rpcrt4.dll
rpcrt4.dll
%s\%s.dmp
%s\%s.dmp
x-x-x-xx-xxxxxx
x-x-x-xx-xxxxxx
Ndebug.log
Ndebug.log
.\debug.log
.\debug.log
\StringFileInfo\xx\%ls
\StringFileInfo\xx\%ls
tntdll.dll
tntdll.dll
Chrome_MessageWindow
Chrome_MessageWindow
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application\citrio.exe
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application\citrio.exe
IDR_X006_CITRIO_CHROMESTORE
IDR_X006_CITRIO_CHROMESTORE
citrio_exe
citrio_exe
citrio.exe_3160_rwx_1DA0A000_00078000:
PPP;%x
PPP;%x
PPPP;%x
PPPP;%x
PPPPPPP;%x
PPPPPPP;%x
PPPPP;%x
PPPPP;%x
P6Y%C
P6Y%C
PP;%x
PP;%x
PPPPPPPPPP;%x
PPPPPPPPPP;%x
PPPPPPPPPPP;%x
PPPPPPPPPPP;%x
PPPPPPPP;%x
PPPPPPPP;%x
PPPPPP;%x
PPPPPP;%x
PPPPPPPPP;%x
PPPPPPPPP;%x
webk
webk
citrio.exe_3160_rwx_36A0A000_000F5000:
PP;%x
PP;%x
PPP;%x
PPP;%x
PPPPP;%x
PPPPP;%x
PPPP;%x
PPPP;%x
PPPPPPP;%x
PPPPPPP;%x
PPPPPPPP;%x
PPPPPPPP;%x
PPPPPPPPPP;%x
PPPPPPPPPP;%x
=.DOU
=.DOU
=.DOUu
=.DOUu
=WWW.
=WWW.
citrio.exe_1804:
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
@.reloc
@.reloc
SHA256 block transform for x86, CRYPTOGAMS by
SHA256 block transform for x86, CRYPTOGAMS by
HtdHtHHHt.HH
HtdHtHHHt.HH
j.Yf;
j.Yf;
_tcPVj@
_tcPVj@
.PjRW
.PjRW
c:\jenkins\workspace\citrio-dev\browser\src\chrome\app\chrome_exe_main_win.cc
c:\jenkins\workspace\citrio-dev\browser\src\chrome\app\chrome_exe_main_win.cc
c:\jenkins\workspace\citrio-dev\browser\src\chrome\app\chrome_watcher_command_line_win.cc
c:\jenkins\workspace\citrio-dev\browser\src\chrome\app\chrome_watcher_command_line_win.cc
No valid Chrome version found
No valid Chrome version found
c:\jenkins\workspace\citrio-dev\browser\src\chrome\app\client_util.cc
c:\jenkins\workspace\citrio-dev\browser\src\chrome\app\client_util.cc
Failed to load Chrome DLL from
Failed to load Chrome DLL from
ChromeMain
ChromeMain
RelaunchChromeBrowserWithNewCommandLineIfNeeded
RelaunchChromeBrowserWithNewCommandLineIfNeeded
Could not find exported function
Could not find exported function
1.3.21.115
1.3.21.115
%s-x-x
%s-x-x
Chrome
Chrome
0.0.0.0-devel
0.0.0.0-devel
%s-%x
%s-%x
font_key_name
font_key_name
url-chunk
url-chunk
subresource_url
subresource_url
c:\jenkins\workspace\citrio-dev\browser\src\components\browser_watcher\watcher_client_win.cc
c:\jenkins\workspace\citrio-dev\browser\src\components\browser_watcher\watcher_client_win.cc
CHROME_MAIN_TIME
CHROME_MAIN_TIME
c:\jenkins\workspace\citrio-dev\browser\src\chrome\installer\util\google_update_settings.cc
c:\jenkins\workspace\citrio-dev\browser\src\chrome\installer\util\google_update_settings.cc
Failed to write to application's ClientState key
Failed to write to application's ClientState key
Removed incremental installer failure key; switching to channel:
Removed incremental installer failure key; switching to channel:
Removed multi-install failure key; switching to channel:
Removed multi-install failure key; switching to channel:
chrome-sxs
chrome-sxs
googlechrome
googlechrome
c:\jenkins\workspace\citrio-dev\browser\src\chrome\installer\util\channel_info.cc
c:\jenkins\workspace\citrio-dev\browser\src\chrome\installer\util\channel_info.cc
Cannot initialize AppCommands from an invalid key.
Cannot initialize AppCommands from an invalid key.
c:\jenkins\workspace\citrio-dev\browser\src\chrome\installer\util\app_commands.cc
c:\jenkins\workspace\citrio-dev\browser\src\chrome\installer\util\app_commands.cc
Failed to open key "
Failed to open key "
Skipping over key "
Skipping over key "
iexplore.exe
iexplore.exe
googlechromeapphost
googlechromeapphost
googlechromeframe
googlechromeframe
Cannot initialize an AppCommand from an invalid key.
Cannot initialize an AppCommand from an invalid key.
c:\jenkins\workspace\citrio-dev\browser\src\chrome\installer\util\app_command.cc
c:\jenkins\workspace\citrio-dev\browser\src\chrome\installer\util\app_command.cc
c:\jenkins\workspace\citrio-dev\browser\src\chrome\installer\util\language_selector.cc
c:\jenkins\workspace\citrio-dev\browser\src\chrome\installer\util\language_selector.cc
CHROME_BREAKPAD_PIPE_NAME
CHROME_BREAKPAD_PIPE_NAME
c:\jenkins\workspace\citrio-dev\browser\src\components\crash\app\breakpad_win.cc
c:\jenkins\workspace\citrio-dev\browser\src\components\crash\app\breakpad_win.cc
NTDLL.DLL
NTDLL.DLL
kernel32.dll
kernel32.dll
c:\jenkins\workspace\citrio-dev\browser\src\sandbox\win\src\sandbox_policy_base.cc
c:\jenkins\workspace\citrio-dev\browser\src\sandbox\win\src\sandbox_policy_base.cc
CreateNamedPipeW
CreateNamedPipeW
NtCreateKey
NtCreateKey
NtOpenKey
NtOpenKey
NtOpenKeyEx
NtOpenKeyEx
MetricsReportingEnabled
MetricsReportingEnabled
CHROME_VERSION
CHROME_VERSION
41.0.2272.256
41.0.2272.256
CHROME_HEADLESS
CHROME_HEADLESS
CHROME_METRO_CONNECTED
CHROME_METRO_CONNECTED
CHROME_CRASHED
CHROME_CRASHED
CHROME_RESTART
CHROME_RESTART
chrome.googleechotest.com
chrome.googleechotest.com
user_experience_metrics.reporting_enabled
user_experience_metrics.reporting_enabled
SHELL32.dll
SHELL32.dll
ole32.dll
ole32.dll
OLEAUT32.dll
OLEAUT32.dll
function not supported
function not supported
operation canceled
operation canceled
address_family_not_supported
address_family_not_supported
operation_in_progress
operation_in_progress
operation_not_supported
operation_not_supported
protocol_not_supported
protocol_not_supported
operation_would_block
operation_would_block
address family not supported
address family not supported
broken pipe
broken pipe
inappropriate io control operation
inappropriate io control operation
not supported
not supported
operation in progress
operation in progress
operation not permitted
operation not permitted
operation not supported
operation not supported
operation would block
operation would block
protocol not supported
protocol not supported
GetProcessWindowStation
GetProcessWindowStation
operator
operator
(0x%X)
(0x%X)
Error (0x%X) while retrieving error. (0x%X)
Error (0x%X) while retrieving error. (0x%X)
%s-%Iu
%s-%Iu
(%d = %3.1f%%)
(%d = %3.1f%%)
Histogram: %s recorded %d samples
Histogram: %s recorded %d samples
(flags = 0x%x)
(flags = 0x%x)
PlatformFile.UnknownErrors.Windows
PlatformFile.UnknownErrors.Windows
user32.dll
user32.dll
0123456789
0123456789
\uX
\uX
.syzygy
.syzygy
.thunks
.thunks
Dictionary keys must be quoted.
Dictionary keys must be quoted.
Unsupported encoding. JSON must be UTF-8.
Unsupported encoding. JSON must be UTF-8.
Line: %i, column: %i, %s
Line: %i, column: %i, %s
full-memory-crash-report
full-memory-crash-report
c:\jenkins\workspace\Citrio-Dev\browser\src\out\Release\initialexe\citrio.exe.pdb
c:\jenkins\workspace\Citrio-Dev\browser\src\out\Release\initialexe\citrio.exe.pdb
citrio.exe
citrio.exe
ClearBreakpadPipeEnvironmentVariable
ClearBreakpadPipeEnvironmentVariable
ClearCrashKeyValueImpl
ClearCrashKeyValueImpl
SetCrashKeyValueImpl
SetCrashKeyValueImpl
SignalChromeElf
SignalChromeElf
citrio_elf.dll
citrio_elf.dll
VERSION.dll
VERSION.dll
WINMM.dll
WINMM.dll
RegCreateKeyExW
RegCreateKeyExW
RegQueryInfoKeyW
RegQueryInfoKeyW
RegOpenKeyExW
RegOpenKeyExW
RegEnumKeyExW
RegEnumKeyExW
RegCloseKey
RegCloseKey
ADVAPI32.dll
ADVAPI32.dll
CloseWindowStation
CloseWindowStation
CreateWindowStationW
CreateWindowStationW
SetProcessWindowStation
SetProcessWindowStation
USER32.dll
USER32.dll
GetProcessHeap
GetProcessHeap
GetWindowsDirectoryW
GetWindowsDirectoryW
CreateIoCompletionPort
CreateIoCompletionPort
GetProcessHandleCount
GetProcessHandleCount
KERNEL32.dll
KERNEL32.dll
USERENV.dll
USERENV.dll
WTSAPI32.dll
WTSAPI32.dll
GetCPInfo
GetCPInfo
SetNamedPipeHandleState
SetNamedPipeHandleState
TransactNamedPipe
TransactNamedPipe
WaitNamedPipeW
WaitNamedPipeW
zcÃ
zcÃ
444.44...4
444.44...4
4.4....4.
4.4....4.
..44.44@4
..44.44@4
4@444@4.
4@444@4.
.4@4@@4.
.4@4@@4.
}.GnO
}.GnO
Ôjo
Ôjo
k.SZ[
k.SZ[
j.oii
j.oii
8%8s8
8%8s8
30}0#1\1
30}0#1\1
0!0%0)0-0105090
0!0%0)0-0105090
0 0(00080
0 0(00080
8(9,909\9
8(9,909\9
= =$=(=,=0=4=8=
= =$=(=,=0=4=8=
3 3$3,3@3`3
3 3$3,3@3`3
chrome_watcher.dll
chrome_watcher.dll
{0105EA02-802D-4B37-8161-4ED25C493266}
{0105EA02-802D-4B37-8161-4ED25C493266}
app_host.exe
app_host.exe
citrio.dll
citrio.dll
citrio_child.dll
citrio_child.dll
metro_driver.dll
metro_driver.dll
{E9F24A7C-13CA-42FB-A4D9-79C3C9D21B28}
{E9F24A7C-13CA-42FB-A4D9-79C3C9D21B28}
ChromeCanary
ChromeCanary
ChromeSSHTM
ChromeSSHTM
Chrome Canary HTML Document
Chrome Canary HTML Document
{1BEAC3E3-B852-44F4-B468-8906C062422E}
{1BEAC3E3-B852-44F4-B468-8906C062422E}
BGoogle Chrome Canary
BGoogle Chrome Canary
{3599E25E-6314-4BE9-AE14-E51877342426}
{3599E25E-6314-4BE9-AE14-E51877342426}
{675046A3-9F4F-4805-A81C-CBF753FE3428}
{675046A3-9F4F-4805-A81C-CBF753FE3428}
Browse the web
Browse the web
Software\Microsoft\Windows\CurrentVersion\Uninstall\Citrio
Software\Microsoft\Windows\CurrentVersion\Uninstall\Citrio
-chrome
-chrome
-chromeframe
-chromeframe
WebAccessible
WebAccessible
{92F8A219-E740-49D5-B785-B962AD819724}
{92F8A219-E740-49D5-B785-B962AD819724}
{8BF2F61B-E8C2-4A67-85D0-D6A69F9FD948}
{8BF2F61B-E8C2-4A67-85D0-D6A69F9FD948}
hXXp://VVV.citrio.com/goodbye.html?intl=$1
hXXp://VVV.citrio.com/goodbye.html?intl=$1
%d.%d.%d
%d.%d.%d
BGoogle Chrome App Launcher
BGoogle Chrome App Launcher
ChromeAppList
ChromeAppList
Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome App Launcher
Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome App Launcher
{DE28A2EA-77FA-4F2B-8252-C3B5844F6455}
{DE28A2EA-77FA-4F2B-8252-C3B5844F6455}
BGoogle Chrome Frame
BGoogle Chrome Frame
Chrome in a Frame.
Chrome in a Frame.
Uninstall Chrome Frame
Uninstall Chrome Frame
Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome Frame
Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome Frame
{F0B50D5A-4BBA-4514-AD2C-EBA50C29C460}
{F0B50D5A-4BBA-4514-AD2C-EBA50C29C460}
Google Chrome binaries
Google Chrome binaries
\\.\pipe\GoogleCrashServices\
\\.\pipe\GoogleCrashServices\
\\.\pipe\ChromeCrashServices
\\.\pipe\ChromeCrashServices
error %u
error %u
chrome.exe
chrome.exe
ntdll.dll
ntdll.dll
HKEY_CLASSES_ROOT
HKEY_CLASSES_ROOT
HKEY_CURRENT_USER
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_LOCAL_MACHINE
HKEY_USERS
HKEY_USERS
HKEY_PERFORMANCE_DATA
HKEY_PERFORMANCE_DATA
HKEY_PERFORMANCE_TEXT
HKEY_PERFORMANCE_TEXT
HKEY_PERFORMANCE_NLSTEXT
HKEY_PERFORMANCE_NLSTEXT
HKEY_CURRENT_CONFIG
HKEY_CURRENT_CONFIG
HKEY_DYN_DATA
HKEY_DYN_DATA
pipe\
pipe\
Ckernel32.dll
Ckernel32.dll
kernelbase.dll
kernelbase.dll
eKey
eKey
gdi32.dll
gdi32.dll
xntdll.dll
xntdll.dll
wow_helper.exe"
wow_helper.exe"
Cntdll.dll
Cntdll.dll
${windows}
${windows}
hunspecified-crash-key
hunspecified-crash-key
Dmscoree.dll
Dmscoree.dll
HADVAPI32.DLL
HADVAPI32.DLL
- floating point support not loaded
- floating point support not loaded
- CRT not initialized
- CRT not initialized
- Attempt to initialize the CRT more than once.
- Attempt to initialize the CRT more than once.
USER32.DLL
USER32.DLL
portuguese-brazilian
portuguese-brazilian
dbghelp.dll
dbghelp.dll
rpcrt4.dll
rpcrt4.dll
%s\%s.dmp
%s\%s.dmp
x-x-x-xx-xxxxxx
x-x-x-xx-xxxxxx
Ndebug.log
Ndebug.log
.\debug.log
.\debug.log
\StringFileInfo\xx\%ls
\StringFileInfo\xx\%ls
tntdll.dll
tntdll.dll
Chrome_MessageWindow
Chrome_MessageWindow
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application\citrio.exe
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application\citrio.exe
IDR_X006_CITRIO_CHROMESTORE
IDR_X006_CITRIO_CHROMESTORE
citrio_exe
citrio_exe
citrio.exe_1804_rwx_0FE0A000_00078000:
PPP;%x
PPP;%x
VW;%x
VW;%x
PPPP;%x
PPPP;%x
PPPPPPP;%x
PPPPPPP;%x
PPPPP;%x
PPPPP;%x
PP;%x
PP;%x
PPPPPPPPPP;%x
PPPPPPPPPP;%x
PPPPPPPPPPP;%x
PPPPPPPPPPP;%x
PPPPPPPP;%x
PPPPPPPP;%x
4%3S-
4%3S-
PPPPPPPPP;%x
PPPPPPPPP;%x
PPPPPP;%x
PPPPPP;%x
citrio.exe_1804_rwx_2540A000_000F5000:
PP;%x
PP;%x
PPP;%x
PPP;%x
PPPP;%x
PPPP;%x
VW;%x
VW;%x
%9U-;G
%9U-;G
PPPPPPPPPP;%x
PPPPPPPPPP;%x
PPPPPPPPP;%x
PPPPPPPPP;%x
PPPPP;%x
PPPPP;%x
%fU-;G
%fU-;G
PPPPPPPP;%x
PPPPPPPP;%x
PPPPPPPPPPPPPPP;%x
PPPPPPPPPPPPPPP;%x
PPPPPP;%x
PPPPPP;%x
citrio.exe_476:
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
@.reloc
@.reloc
SHA256 block transform for x86, CRYPTOGAMS by
SHA256 block transform for x86, CRYPTOGAMS by
HtdHtHHHt.HH
HtdHtHHHt.HH
j.Yf;
j.Yf;
_tcPVj@
_tcPVj@
.PjRW
.PjRW
c:\jenkins\workspace\citrio-dev\browser\src\chrome\app\chrome_exe_main_win.cc
c:\jenkins\workspace\citrio-dev\browser\src\chrome\app\chrome_exe_main_win.cc
c:\jenkins\workspace\citrio-dev\browser\src\chrome\app\chrome_watcher_command_line_win.cc
c:\jenkins\workspace\citrio-dev\browser\src\chrome\app\chrome_watcher_command_line_win.cc
No valid Chrome version found
No valid Chrome version found
c:\jenkins\workspace\citrio-dev\browser\src\chrome\app\client_util.cc
c:\jenkins\workspace\citrio-dev\browser\src\chrome\app\client_util.cc
Failed to load Chrome DLL from
Failed to load Chrome DLL from
ChromeMain
ChromeMain
RelaunchChromeBrowserWithNewCommandLineIfNeeded
RelaunchChromeBrowserWithNewCommandLineIfNeeded
Could not find exported function
Could not find exported function
1.3.21.115
1.3.21.115
%s-x-x
%s-x-x
Chrome
Chrome
0.0.0.0-devel
0.0.0.0-devel
%s-%x
%s-%x
font_key_name
font_key_name
url-chunk
url-chunk
subresource_url
subresource_url
c:\jenkins\workspace\citrio-dev\browser\src\components\browser_watcher\watcher_client_win.cc
c:\jenkins\workspace\citrio-dev\browser\src\components\browser_watcher\watcher_client_win.cc
CHROME_MAIN_TIME
CHROME_MAIN_TIME
c:\jenkins\workspace\citrio-dev\browser\src\chrome\installer\util\google_update_settings.cc
c:\jenkins\workspace\citrio-dev\browser\src\chrome\installer\util\google_update_settings.cc
Failed to write to application's ClientState key
Failed to write to application's ClientState key
Removed incremental installer failure key; switching to channel:
Removed incremental installer failure key; switching to channel:
Removed multi-install failure key; switching to channel:
Removed multi-install failure key; switching to channel:
chrome-sxs
chrome-sxs
googlechrome
googlechrome
c:\jenkins\workspace\citrio-dev\browser\src\chrome\installer\util\channel_info.cc
c:\jenkins\workspace\citrio-dev\browser\src\chrome\installer\util\channel_info.cc
Cannot initialize AppCommands from an invalid key.
Cannot initialize AppCommands from an invalid key.
c:\jenkins\workspace\citrio-dev\browser\src\chrome\installer\util\app_commands.cc
c:\jenkins\workspace\citrio-dev\browser\src\chrome\installer\util\app_commands.cc
Failed to open key "
Failed to open key "
Skipping over key "
Skipping over key "
iexplore.exe
iexplore.exe
googlechromeapphost
googlechromeapphost
googlechromeframe
googlechromeframe
Cannot initialize an AppCommand from an invalid key.
Cannot initialize an AppCommand from an invalid key.
c:\jenkins\workspace\citrio-dev\browser\src\chrome\installer\util\app_command.cc
c:\jenkins\workspace\citrio-dev\browser\src\chrome\installer\util\app_command.cc
c:\jenkins\workspace\citrio-dev\browser\src\chrome\installer\util\language_selector.cc
c:\jenkins\workspace\citrio-dev\browser\src\chrome\installer\util\language_selector.cc
CHROME_BREAKPAD_PIPE_NAME
CHROME_BREAKPAD_PIPE_NAME
c:\jenkins\workspace\citrio-dev\browser\src\components\crash\app\breakpad_win.cc
c:\jenkins\workspace\citrio-dev\browser\src\components\crash\app\breakpad_win.cc
NTDLL.DLL
NTDLL.DLL
kernel32.dll
kernel32.dll
c:\jenkins\workspace\citrio-dev\browser\src\sandbox\win\src\sandbox_policy_base.cc
c:\jenkins\workspace\citrio-dev\browser\src\sandbox\win\src\sandbox_policy_base.cc
CreateNamedPipeW
CreateNamedPipeW
NtCreateKey
NtCreateKey
NtOpenKey
NtOpenKey
NtOpenKeyEx
NtOpenKeyEx
MetricsReportingEnabled
MetricsReportingEnabled
CHROME_VERSION
CHROME_VERSION
41.0.2272.256
41.0.2272.256
CHROME_HEADLESS
CHROME_HEADLESS
CHROME_METRO_CONNECTED
CHROME_METRO_CONNECTED
CHROME_CRASHED
CHROME_CRASHED
CHROME_RESTART
CHROME_RESTART
chrome.googleechotest.com
chrome.googleechotest.com
user_experience_metrics.reporting_enabled
user_experience_metrics.reporting_enabled
SHELL32.dll
SHELL32.dll
ole32.dll
ole32.dll
OLEAUT32.dll
OLEAUT32.dll
function not supported
function not supported
operation canceled
operation canceled
address_family_not_supported
address_family_not_supported
operation_in_progress
operation_in_progress
operation_not_supported
operation_not_supported
protocol_not_supported
protocol_not_supported
operation_would_block
operation_would_block
address family not supported
address family not supported
broken pipe
broken pipe
inappropriate io control operation
inappropriate io control operation
not supported
not supported
operation in progress
operation in progress
operation not permitted
operation not permitted
operation not supported
operation not supported
operation would block
operation would block
protocol not supported
protocol not supported
GetProcessWindowStation
GetProcessWindowStation
operator
operator
(0x%X)
(0x%X)
Error (0x%X) while retrieving error. (0x%X)
Error (0x%X) while retrieving error. (0x%X)
%s-%Iu
%s-%Iu
(%d = %3.1f%%)
(%d = %3.1f%%)
Histogram: %s recorded %d samples
Histogram: %s recorded %d samples
(flags = 0x%x)
(flags = 0x%x)
PlatformFile.UnknownErrors.Windows
PlatformFile.UnknownErrors.Windows
user32.dll
user32.dll
0123456789
0123456789
\uX
\uX
.syzygy
.syzygy
.thunks
.thunks
Dictionary keys must be quoted.
Dictionary keys must be quoted.
Unsupported encoding. JSON must be UTF-8.
Unsupported encoding. JSON must be UTF-8.
Line: %i, column: %i, %s
Line: %i, column: %i, %s
full-memory-crash-report
full-memory-crash-report
c:\jenkins\workspace\Citrio-Dev\browser\src\out\Release\initialexe\citrio.exe.pdb
c:\jenkins\workspace\Citrio-Dev\browser\src\out\Release\initialexe\citrio.exe.pdb
citrio.exe
citrio.exe
ClearBreakpadPipeEnvironmentVariable
ClearBreakpadPipeEnvironmentVariable
ClearCrashKeyValueImpl
ClearCrashKeyValueImpl
SetCrashKeyValueImpl
SetCrashKeyValueImpl
SignalChromeElf
SignalChromeElf
citrio_elf.dll
citrio_elf.dll
VERSION.dll
VERSION.dll
WINMM.dll
WINMM.dll
RegCreateKeyExW
RegCreateKeyExW
RegQueryInfoKeyW
RegQueryInfoKeyW
RegOpenKeyExW
RegOpenKeyExW
RegEnumKeyExW
RegEnumKeyExW
RegCloseKey
RegCloseKey
ADVAPI32.dll
ADVAPI32.dll
CloseWindowStation
CloseWindowStation
CreateWindowStationW
CreateWindowStationW
SetProcessWindowStation
SetProcessWindowStation
USER32.dll
USER32.dll
GetProcessHeap
GetProcessHeap
GetWindowsDirectoryW
GetWindowsDirectoryW
CreateIoCompletionPort
CreateIoCompletionPort
GetProcessHandleCount
GetProcessHandleCount
KERNEL32.dll
KERNEL32.dll
USERENV.dll
USERENV.dll
WTSAPI32.dll
WTSAPI32.dll
GetCPInfo
GetCPInfo
SetNamedPipeHandleState
SetNamedPipeHandleState
TransactNamedPipe
TransactNamedPipe
WaitNamedPipeW
WaitNamedPipeW
zcÃ
zcÃ
444.44...4
444.44...4
4.4....4.
4.4....4.
..44.44@4
..44.44@4
4@444@4.
4@444@4.
.4@4@@4.
.4@4@@4.
}.GnO
}.GnO
Ôjo
Ôjo
k.SZ[
k.SZ[
j.oii
j.oii
8%8s8
8%8s8
30}0#1\1
30}0#1\1
0!0%0)0-0105090
0!0%0)0-0105090
0 0(00080
0 0(00080
8(9,909\9
8(9,909\9
= =$=(=,=0=4=8=
= =$=(=,=0=4=8=
3 3$3,3@3`3
3 3$3,3@3`3
chrome_watcher.dll
chrome_watcher.dll
{0105EA02-802D-4B37-8161-4ED25C493266}
{0105EA02-802D-4B37-8161-4ED25C493266}
app_host.exe
app_host.exe
citrio.dll
citrio.dll
citrio_child.dll
citrio_child.dll
metro_driver.dll
metro_driver.dll
{E9F24A7C-13CA-42FB-A4D9-79C3C9D21B28}
{E9F24A7C-13CA-42FB-A4D9-79C3C9D21B28}
ChromeCanary
ChromeCanary
ChromeSSHTM
ChromeSSHTM
Chrome Canary HTML Document
Chrome Canary HTML Document
{1BEAC3E3-B852-44F4-B468-8906C062422E}
{1BEAC3E3-B852-44F4-B468-8906C062422E}
BGoogle Chrome Canary
BGoogle Chrome Canary
{3599E25E-6314-4BE9-AE14-E51877342426}
{3599E25E-6314-4BE9-AE14-E51877342426}
{675046A3-9F4F-4805-A81C-CBF753FE3428}
{675046A3-9F4F-4805-A81C-CBF753FE3428}
Browse the web
Browse the web
Software\Microsoft\Windows\CurrentVersion\Uninstall\Citrio
Software\Microsoft\Windows\CurrentVersion\Uninstall\Citrio
-chrome
-chrome
-chromeframe
-chromeframe
WebAccessible
WebAccessible
{92F8A219-E740-49D5-B785-B962AD819724}
{92F8A219-E740-49D5-B785-B962AD819724}
{8BF2F61B-E8C2-4A67-85D0-D6A69F9FD948}
{8BF2F61B-E8C2-4A67-85D0-D6A69F9FD948}
hXXp://VVV.citrio.com/goodbye.html?intl=$1
hXXp://VVV.citrio.com/goodbye.html?intl=$1
%d.%d.%d
%d.%d.%d
BGoogle Chrome App Launcher
BGoogle Chrome App Launcher
ChromeAppList
ChromeAppList
Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome App Launcher
Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome App Launcher
{DE28A2EA-77FA-4F2B-8252-C3B5844F6455}
{DE28A2EA-77FA-4F2B-8252-C3B5844F6455}
BGoogle Chrome Frame
BGoogle Chrome Frame
Chrome in a Frame.
Chrome in a Frame.
Uninstall Chrome Frame
Uninstall Chrome Frame
Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome Frame
Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome Frame
{F0B50D5A-4BBA-4514-AD2C-EBA50C29C460}
{F0B50D5A-4BBA-4514-AD2C-EBA50C29C460}
Google Chrome binaries
Google Chrome binaries
\\.\pipe\GoogleCrashServices\
\\.\pipe\GoogleCrashServices\
\\.\pipe\ChromeCrashServices
\\.\pipe\ChromeCrashServices
error %u
error %u
chrome.exe
chrome.exe
ntdll.dll
ntdll.dll
HKEY_CLASSES_ROOT
HKEY_CLASSES_ROOT
HKEY_CURRENT_USER
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_LOCAL_MACHINE
HKEY_USERS
HKEY_USERS
HKEY_PERFORMANCE_DATA
HKEY_PERFORMANCE_DATA
HKEY_PERFORMANCE_TEXT
HKEY_PERFORMANCE_TEXT
HKEY_PERFORMANCE_NLSTEXT
HKEY_PERFORMANCE_NLSTEXT
HKEY_CURRENT_CONFIG
HKEY_CURRENT_CONFIG
HKEY_DYN_DATA
HKEY_DYN_DATA
pipe\
pipe\
Ckernel32.dll
Ckernel32.dll
kernelbase.dll
kernelbase.dll
eKey
eKey
gdi32.dll
gdi32.dll
xntdll.dll
xntdll.dll
wow_helper.exe"
wow_helper.exe"
Cntdll.dll
Cntdll.dll
${windows}
${windows}
hunspecified-crash-key
hunspecified-crash-key
Dmscoree.dll
Dmscoree.dll
HADVAPI32.DLL
HADVAPI32.DLL
- floating point support not loaded
- floating point support not loaded
- CRT not initialized
- CRT not initialized
- Attempt to initialize the CRT more than once.
- Attempt to initialize the CRT more than once.
USER32.DLL
USER32.DLL
portuguese-brazilian
portuguese-brazilian
dbghelp.dll
dbghelp.dll
rpcrt4.dll
rpcrt4.dll
%s\%s.dmp
%s\%s.dmp
x-x-x-xx-xxxxxx
x-x-x-xx-xxxxxx
Ndebug.log
Ndebug.log
.\debug.log
.\debug.log
\StringFileInfo\xx\%ls
\StringFileInfo\xx\%ls
tntdll.dll
tntdll.dll
Chrome_MessageWindow
Chrome_MessageWindow
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application\citrio.exe
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application\citrio.exe
IDR_X006_CITRIO_CHROMESTORE
IDR_X006_CITRIO_CHROMESTORE
citrio_exe
citrio_exe
citrio.exe_3392:
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
@.reloc
@.reloc
SHA256 block transform for x86, CRYPTOGAMS by
SHA256 block transform for x86, CRYPTOGAMS by
HtdHtHHHt.HH
HtdHtHHHt.HH
j.Yf;
j.Yf;
_tcPVj@
_tcPVj@
.PjRW
.PjRW
c:\jenkins\workspace\citrio-dev\browser\src\chrome\app\chrome_exe_main_win.cc
c:\jenkins\workspace\citrio-dev\browser\src\chrome\app\chrome_exe_main_win.cc
c:\jenkins\workspace\citrio-dev\browser\src\chrome\app\chrome_watcher_command_line_win.cc
c:\jenkins\workspace\citrio-dev\browser\src\chrome\app\chrome_watcher_command_line_win.cc
No valid Chrome version found
No valid Chrome version found
c:\jenkins\workspace\citrio-dev\browser\src\chrome\app\client_util.cc
c:\jenkins\workspace\citrio-dev\browser\src\chrome\app\client_util.cc
Failed to load Chrome DLL from
Failed to load Chrome DLL from
ChromeMain
ChromeMain
RelaunchChromeBrowserWithNewCommandLineIfNeeded
RelaunchChromeBrowserWithNewCommandLineIfNeeded
Could not find exported function
Could not find exported function
1.3.21.115
1.3.21.115
%s-x-x
%s-x-x
Chrome
Chrome
0.0.0.0-devel
0.0.0.0-devel
%s-%x
%s-%x
font_key_name
font_key_name
url-chunk
url-chunk
subresource_url
subresource_url
c:\jenkins\workspace\citrio-dev\browser\src\components\browser_watcher\watcher_client_win.cc
c:\jenkins\workspace\citrio-dev\browser\src\components\browser_watcher\watcher_client_win.cc
CHROME_MAIN_TIME
CHROME_MAIN_TIME
c:\jenkins\workspace\citrio-dev\browser\src\chrome\installer\util\google_update_settings.cc
c:\jenkins\workspace\citrio-dev\browser\src\chrome\installer\util\google_update_settings.cc
Failed to write to application's ClientState key
Failed to write to application's ClientState key
Removed incremental installer failure key; switching to channel:
Removed incremental installer failure key; switching to channel:
Removed multi-install failure key; switching to channel:
Removed multi-install failure key; switching to channel:
chrome-sxs
chrome-sxs
googlechrome
googlechrome
c:\jenkins\workspace\citrio-dev\browser\src\chrome\installer\util\channel_info.cc
c:\jenkins\workspace\citrio-dev\browser\src\chrome\installer\util\channel_info.cc
Cannot initialize AppCommands from an invalid key.
Cannot initialize AppCommands from an invalid key.
c:\jenkins\workspace\citrio-dev\browser\src\chrome\installer\util\app_commands.cc
c:\jenkins\workspace\citrio-dev\browser\src\chrome\installer\util\app_commands.cc
Failed to open key "
Failed to open key "
Skipping over key "
Skipping over key "
iexplore.exe
iexplore.exe
googlechromeapphost
googlechromeapphost
googlechromeframe
googlechromeframe
Cannot initialize an AppCommand from an invalid key.
Cannot initialize an AppCommand from an invalid key.
c:\jenkins\workspace\citrio-dev\browser\src\chrome\installer\util\app_command.cc
c:\jenkins\workspace\citrio-dev\browser\src\chrome\installer\util\app_command.cc
c:\jenkins\workspace\citrio-dev\browser\src\chrome\installer\util\language_selector.cc
c:\jenkins\workspace\citrio-dev\browser\src\chrome\installer\util\language_selector.cc
CHROME_BREAKPAD_PIPE_NAME
CHROME_BREAKPAD_PIPE_NAME
c:\jenkins\workspace\citrio-dev\browser\src\components\crash\app\breakpad_win.cc
c:\jenkins\workspace\citrio-dev\browser\src\components\crash\app\breakpad_win.cc
NTDLL.DLL
NTDLL.DLL
kernel32.dll
kernel32.dll
c:\jenkins\workspace\citrio-dev\browser\src\sandbox\win\src\sandbox_policy_base.cc
c:\jenkins\workspace\citrio-dev\browser\src\sandbox\win\src\sandbox_policy_base.cc
CreateNamedPipeW
CreateNamedPipeW
NtCreateKey
NtCreateKey
NtOpenKey
NtOpenKey
NtOpenKeyEx
NtOpenKeyEx
MetricsReportingEnabled
MetricsReportingEnabled
CHROME_VERSION
CHROME_VERSION
41.0.2272.256
41.0.2272.256
CHROME_HEADLESS
CHROME_HEADLESS
CHROME_METRO_CONNECTED
CHROME_METRO_CONNECTED
CHROME_CRASHED
CHROME_CRASHED
CHROME_RESTART
CHROME_RESTART
chrome.googleechotest.com
chrome.googleechotest.com
user_experience_metrics.reporting_enabled
user_experience_metrics.reporting_enabled
SHELL32.dll
SHELL32.dll
ole32.dll
ole32.dll
OLEAUT32.dll
OLEAUT32.dll
function not supported
function not supported
operation canceled
operation canceled
address_family_not_supported
address_family_not_supported
operation_in_progress
operation_in_progress
operation_not_supported
operation_not_supported
protocol_not_supported
protocol_not_supported
operation_would_block
operation_would_block
address family not supported
address family not supported
broken pipe
broken pipe
inappropriate io control operation
inappropriate io control operation
not supported
not supported
operation in progress
operation in progress
operation not permitted
operation not permitted
operation not supported
operation not supported
operation would block
operation would block
protocol not supported
protocol not supported
GetProcessWindowStation
GetProcessWindowStation
operator
operator
(0x%X)
(0x%X)
Error (0x%X) while retrieving error. (0x%X)
Error (0x%X) while retrieving error. (0x%X)
%s-%Iu
%s-%Iu
(%d = %3.1f%%)
(%d = %3.1f%%)
Histogram: %s recorded %d samples
Histogram: %s recorded %d samples
(flags = 0x%x)
(flags = 0x%x)
PlatformFile.UnknownErrors.Windows
PlatformFile.UnknownErrors.Windows
user32.dll
user32.dll
0123456789
0123456789
\uX
\uX
.syzygy
.syzygy
.thunks
.thunks
Dictionary keys must be quoted.
Dictionary keys must be quoted.
Unsupported encoding. JSON must be UTF-8.
Unsupported encoding. JSON must be UTF-8.
Line: %i, column: %i, %s
Line: %i, column: %i, %s
full-memory-crash-report
full-memory-crash-report
c:\jenkins\workspace\Citrio-Dev\browser\src\out\Release\initialexe\citrio.exe.pdb
c:\jenkins\workspace\Citrio-Dev\browser\src\out\Release\initialexe\citrio.exe.pdb
citrio.exe
citrio.exe
ClearBreakpadPipeEnvironmentVariable
ClearBreakpadPipeEnvironmentVariable
ClearCrashKeyValueImpl
ClearCrashKeyValueImpl
SetCrashKeyValueImpl
SetCrashKeyValueImpl
SignalChromeElf
SignalChromeElf
citrio_elf.dll
citrio_elf.dll
VERSION.dll
VERSION.dll
WINMM.dll
WINMM.dll
RegCreateKeyExW
RegCreateKeyExW
RegQueryInfoKeyW
RegQueryInfoKeyW
RegOpenKeyExW
RegOpenKeyExW
RegEnumKeyExW
RegEnumKeyExW
RegCloseKey
RegCloseKey
ADVAPI32.dll
ADVAPI32.dll
CloseWindowStation
CloseWindowStation
CreateWindowStationW
CreateWindowStationW
SetProcessWindowStation
SetProcessWindowStation
USER32.dll
USER32.dll
GetProcessHeap
GetProcessHeap
GetWindowsDirectoryW
GetWindowsDirectoryW
CreateIoCompletionPort
CreateIoCompletionPort
GetProcessHandleCount
GetProcessHandleCount
KERNEL32.dll
KERNEL32.dll
USERENV.dll
USERENV.dll
WTSAPI32.dll
WTSAPI32.dll
GetCPInfo
GetCPInfo
SetNamedPipeHandleState
SetNamedPipeHandleState
TransactNamedPipe
TransactNamedPipe
WaitNamedPipeW
WaitNamedPipeW
zcÃ
zcÃ
444.44...4
444.44...4
4.4....4.
4.4....4.
..44.44@4
..44.44@4
4@444@4.
4@444@4.
.4@4@@4.
.4@4@@4.
}.GnO
}.GnO
Ôjo
Ôjo
k.SZ[
k.SZ[
j.oii
j.oii
8%8s8
8%8s8
30}0#1\1
30}0#1\1
0!0%0)0-0105090
0!0%0)0-0105090
0 0(00080
0 0(00080
8(9,909\9
8(9,909\9
= =$=(=,=0=4=8=
= =$=(=,=0=4=8=
3 3$3,3@3`3
3 3$3,3@3`3
chrome_watcher.dll
chrome_watcher.dll
{0105EA02-802D-4B37-8161-4ED25C493266}
{0105EA02-802D-4B37-8161-4ED25C493266}
app_host.exe
app_host.exe
citrio.dll
citrio.dll
citrio_child.dll
citrio_child.dll
metro_driver.dll
metro_driver.dll
{E9F24A7C-13CA-42FB-A4D9-79C3C9D21B28}
{E9F24A7C-13CA-42FB-A4D9-79C3C9D21B28}
ChromeCanary
ChromeCanary
ChromeSSHTM
ChromeSSHTM
Chrome Canary HTML Document
Chrome Canary HTML Document
{1BEAC3E3-B852-44F4-B468-8906C062422E}
{1BEAC3E3-B852-44F4-B468-8906C062422E}
BGoogle Chrome Canary
BGoogle Chrome Canary
{3599E25E-6314-4BE9-AE14-E51877342426}
{3599E25E-6314-4BE9-AE14-E51877342426}
{675046A3-9F4F-4805-A81C-CBF753FE3428}
{675046A3-9F4F-4805-A81C-CBF753FE3428}
Browse the web
Browse the web
Software\Microsoft\Windows\CurrentVersion\Uninstall\Citrio
Software\Microsoft\Windows\CurrentVersion\Uninstall\Citrio
-chrome
-chrome
-chromeframe
-chromeframe
WebAccessible
WebAccessible
{92F8A219-E740-49D5-B785-B962AD819724}
{92F8A219-E740-49D5-B785-B962AD819724}
{8BF2F61B-E8C2-4A67-85D0-D6A69F9FD948}
{8BF2F61B-E8C2-4A67-85D0-D6A69F9FD948}
hXXp://VVV.citrio.com/goodbye.html?intl=$1
hXXp://VVV.citrio.com/goodbye.html?intl=$1
%d.%d.%d
%d.%d.%d
BGoogle Chrome App Launcher
BGoogle Chrome App Launcher
ChromeAppList
ChromeAppList
Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome App Launcher
Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome App Launcher
{DE28A2EA-77FA-4F2B-8252-C3B5844F6455}
{DE28A2EA-77FA-4F2B-8252-C3B5844F6455}
BGoogle Chrome Frame
BGoogle Chrome Frame
Chrome in a Frame.
Chrome in a Frame.
Uninstall Chrome Frame
Uninstall Chrome Frame
Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome Frame
Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome Frame
{F0B50D5A-4BBA-4514-AD2C-EBA50C29C460}
{F0B50D5A-4BBA-4514-AD2C-EBA50C29C460}
Google Chrome binaries
Google Chrome binaries
\\.\pipe\GoogleCrashServices\
\\.\pipe\GoogleCrashServices\
\\.\pipe\ChromeCrashServices
\\.\pipe\ChromeCrashServices
error %u
error %u
chrome.exe
chrome.exe
ntdll.dll
ntdll.dll
HKEY_CLASSES_ROOT
HKEY_CLASSES_ROOT
HKEY_CURRENT_USER
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_LOCAL_MACHINE
HKEY_USERS
HKEY_USERS
HKEY_PERFORMANCE_DATA
HKEY_PERFORMANCE_DATA
HKEY_PERFORMANCE_TEXT
HKEY_PERFORMANCE_TEXT
HKEY_PERFORMANCE_NLSTEXT
HKEY_PERFORMANCE_NLSTEXT
HKEY_CURRENT_CONFIG
HKEY_CURRENT_CONFIG
HKEY_DYN_DATA
HKEY_DYN_DATA
pipe\
pipe\
Ckernel32.dll
Ckernel32.dll
kernelbase.dll
kernelbase.dll
eKey
eKey
gdi32.dll
gdi32.dll
xntdll.dll
xntdll.dll
wow_helper.exe"
wow_helper.exe"
Cntdll.dll
Cntdll.dll
${windows}
${windows}
hunspecified-crash-key
hunspecified-crash-key
Dmscoree.dll
Dmscoree.dll
HADVAPI32.DLL
HADVAPI32.DLL
- floating point support not loaded
- floating point support not loaded
- CRT not initialized
- CRT not initialized
- Attempt to initialize the CRT more than once.
- Attempt to initialize the CRT more than once.
USER32.DLL
USER32.DLL
portuguese-brazilian
portuguese-brazilian
dbghelp.dll
dbghelp.dll
rpcrt4.dll
rpcrt4.dll
%s\%s.dmp
%s\%s.dmp
x-x-x-xx-xxxxxx
x-x-x-xx-xxxxxx
Ndebug.log
Ndebug.log
.\debug.log
.\debug.log
\StringFileInfo\xx\%ls
\StringFileInfo\xx\%ls
tntdll.dll
tntdll.dll
Chrome_MessageWindow
Chrome_MessageWindow
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application\citrio.exe
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application\citrio.exe
IDR_X006_CITRIO_CHROMESTORE
IDR_X006_CITRIO_CHROMESTORE
citrio_exe
citrio_exe
citrio.exe_476_rwx_0DB0A000_000F5000:
PP;%x
PP;%x
PPPPPPPP;%x
PPPPPPPP;%x
PPPP;%x
PPPP;%x
PPPPPP;%x
PPPPPP;%x
PPPPPPP;%x
PPPPPPP;%x
PPP;%x
PPP;%x
PPPPPPPPPP;%x
PPPPPPPPPP;%x
PPPPPPPPP;%x
PPPPPPPPP;%x
PPPPP;%x
PPPPP;%x
=.ha"
=.ha"
=.ha"u
=.ha"u
VW;%x
VW;%x
PPPPPPPPPPP;%x
PPPPPPPPPPP;%x
=.FAC
=.FAC
=.FACu
=.FACu
citrio.exe_476_rwx_1EE0A000_00078000:
PPP;%x
PPP;%x
PPPP;%x
PPPP;%x
VW;%x
VW;%x
PPPPPPP;%x
PPPPPPP;%x
PPPPP;%x
PPPPP;%x
PP;%x
PP;%x
PPPPPPPPPP;%x
PPPPPPPPPP;%x
PPPPPPPPPPP;%x
PPPPPPPPPPP;%x
PPPPPPPP;%x
PPPPPPPP;%x
=.DOU
=.DOU
=.DOUu
=.DOUu
PPPPPP;%x
PPPPPP;%x
=WWW.
=WWW.
citrio.exe_3392_rwx_1660A000_000F5000:
`,PPPPPP;%x
`,PPPPPP;%x
`,PPPPPPPPPPP;%x
`,PPPPPPPPPPP;%x
`,;%x
`,;%x
VW;%x
VW;%x
citrio.exe_3392_rwx_1F60A000_00078000:
`,;%x
`,;%x
`,PPP;%x
`,PPP;%x
`,PPPP;%x
`,PPPP;%x
`,PPPPPPP;%x
`,PPPPPPP;%x
`,PPPPP;%x
`,PPPPP;%x
`,PP;%x
`,PP;%x
`,PPPPPPPPPP;%x
`,PPPPPPPPPP;%x
`,PPPPPPPPPPP;%x
`,PPPPPPPPPPP;%x
`,PPPPPPPP;%x
`,PPPPPPPP;%x
citrio.exe_3808:
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
@.reloc
@.reloc
SHA256 block transform for x86, CRYPTOGAMS by
SHA256 block transform for x86, CRYPTOGAMS by
HtdHtHHHt.HH
HtdHtHHHt.HH
j.Yf;
j.Yf;
_tcPVj@
_tcPVj@
.PjRW
.PjRW
c:\jenkins\workspace\citrio-dev\browser\src\chrome\app\chrome_exe_main_win.cc
c:\jenkins\workspace\citrio-dev\browser\src\chrome\app\chrome_exe_main_win.cc
c:\jenkins\workspace\citrio-dev\browser\src\chrome\app\chrome_watcher_command_line_win.cc
c:\jenkins\workspace\citrio-dev\browser\src\chrome\app\chrome_watcher_command_line_win.cc
No valid Chrome version found
No valid Chrome version found
c:\jenkins\workspace\citrio-dev\browser\src\chrome\app\client_util.cc
c:\jenkins\workspace\citrio-dev\browser\src\chrome\app\client_util.cc
Failed to load Chrome DLL from
Failed to load Chrome DLL from
ChromeMain
ChromeMain
RelaunchChromeBrowserWithNewCommandLineIfNeeded
RelaunchChromeBrowserWithNewCommandLineIfNeeded
Could not find exported function
Could not find exported function
1.3.21.115
1.3.21.115
%s-x-x
%s-x-x
Chrome
Chrome
0.0.0.0-devel
0.0.0.0-devel
%s-%x
%s-%x
font_key_name
font_key_name
url-chunk
url-chunk
subresource_url
subresource_url
c:\jenkins\workspace\citrio-dev\browser\src\components\browser_watcher\watcher_client_win.cc
c:\jenkins\workspace\citrio-dev\browser\src\components\browser_watcher\watcher_client_win.cc
CHROME_MAIN_TIME
CHROME_MAIN_TIME
c:\jenkins\workspace\citrio-dev\browser\src\chrome\installer\util\google_update_settings.cc
c:\jenkins\workspace\citrio-dev\browser\src\chrome\installer\util\google_update_settings.cc
Failed to write to application's ClientState key
Failed to write to application's ClientState key
Removed incremental installer failure key; switching to channel:
Removed incremental installer failure key; switching to channel:
Removed multi-install failure key; switching to channel:
Removed multi-install failure key; switching to channel:
chrome-sxs
chrome-sxs
googlechrome
googlechrome
c:\jenkins\workspace\citrio-dev\browser\src\chrome\installer\util\channel_info.cc
c:\jenkins\workspace\citrio-dev\browser\src\chrome\installer\util\channel_info.cc
Cannot initialize AppCommands from an invalid key.
Cannot initialize AppCommands from an invalid key.
c:\jenkins\workspace\citrio-dev\browser\src\chrome\installer\util\app_commands.cc
c:\jenkins\workspace\citrio-dev\browser\src\chrome\installer\util\app_commands.cc
Failed to open key "
Failed to open key "
Skipping over key "
Skipping over key "
iexplore.exe
iexplore.exe
googlechromeapphost
googlechromeapphost
googlechromeframe
googlechromeframe
Cannot initialize an AppCommand from an invalid key.
Cannot initialize an AppCommand from an invalid key.
c:\jenkins\workspace\citrio-dev\browser\src\chrome\installer\util\app_command.cc
c:\jenkins\workspace\citrio-dev\browser\src\chrome\installer\util\app_command.cc
c:\jenkins\workspace\citrio-dev\browser\src\chrome\installer\util\language_selector.cc
c:\jenkins\workspace\citrio-dev\browser\src\chrome\installer\util\language_selector.cc
CHROME_BREAKPAD_PIPE_NAME
CHROME_BREAKPAD_PIPE_NAME
c:\jenkins\workspace\citrio-dev\browser\src\components\crash\app\breakpad_win.cc
c:\jenkins\workspace\citrio-dev\browser\src\components\crash\app\breakpad_win.cc
NTDLL.DLL
NTDLL.DLL
kernel32.dll
kernel32.dll
c:\jenkins\workspace\citrio-dev\browser\src\sandbox\win\src\sandbox_policy_base.cc
c:\jenkins\workspace\citrio-dev\browser\src\sandbox\win\src\sandbox_policy_base.cc
CreateNamedPipeW
CreateNamedPipeW
NtCreateKey
NtCreateKey
NtOpenKey
NtOpenKey
NtOpenKeyEx
NtOpenKeyEx
MetricsReportingEnabled
MetricsReportingEnabled
CHROME_VERSION
CHROME_VERSION
41.0.2272.256
41.0.2272.256
CHROME_HEADLESS
CHROME_HEADLESS
CHROME_METRO_CONNECTED
CHROME_METRO_CONNECTED
CHROME_CRASHED
CHROME_CRASHED
CHROME_RESTART
CHROME_RESTART
chrome.googleechotest.com
chrome.googleechotest.com
user_experience_metrics.reporting_enabled
user_experience_metrics.reporting_enabled
SHELL32.dll
SHELL32.dll
ole32.dll
ole32.dll
OLEAUT32.dll
OLEAUT32.dll
function not supported
function not supported
operation canceled
operation canceled
address_family_not_supported
address_family_not_supported
operation_in_progress
operation_in_progress
operation_not_supported
operation_not_supported
protocol_not_supported
protocol_not_supported
operation_would_block
operation_would_block
address family not supported
address family not supported
broken pipe
broken pipe
inappropriate io control operation
inappropriate io control operation
not supported
not supported
operation in progress
operation in progress
operation not permitted
operation not permitted
operation not supported
operation not supported
operation would block
operation would block
protocol not supported
protocol not supported
GetProcessWindowStation
GetProcessWindowStation
operator
operator
(0x%X)
(0x%X)
Error (0x%X) while retrieving error. (0x%X)
Error (0x%X) while retrieving error. (0x%X)
%s-%Iu
%s-%Iu
(%d = %3.1f%%)
(%d = %3.1f%%)
Histogram: %s recorded %d samples
Histogram: %s recorded %d samples
(flags = 0x%x)
(flags = 0x%x)
PlatformFile.UnknownErrors.Windows
PlatformFile.UnknownErrors.Windows
user32.dll
user32.dll
0123456789
0123456789
\uX
\uX
.syzygy
.syzygy
.thunks
.thunks
Dictionary keys must be quoted.
Dictionary keys must be quoted.
Unsupported encoding. JSON must be UTF-8.
Unsupported encoding. JSON must be UTF-8.
Line: %i, column: %i, %s
Line: %i, column: %i, %s
full-memory-crash-report
full-memory-crash-report
c:\jenkins\workspace\Citrio-Dev\browser\src\out\Release\initialexe\citrio.exe.pdb
c:\jenkins\workspace\Citrio-Dev\browser\src\out\Release\initialexe\citrio.exe.pdb
citrio.exe
citrio.exe
ClearBreakpadPipeEnvironmentVariable
ClearBreakpadPipeEnvironmentVariable
ClearCrashKeyValueImpl
ClearCrashKeyValueImpl
SetCrashKeyValueImpl
SetCrashKeyValueImpl
SignalChromeElf
SignalChromeElf
citrio_elf.dll
citrio_elf.dll
VERSION.dll
VERSION.dll
WINMM.dll
WINMM.dll
RegCreateKeyExW
RegCreateKeyExW
RegQueryInfoKeyW
RegQueryInfoKeyW
RegOpenKeyExW
RegOpenKeyExW
RegEnumKeyExW
RegEnumKeyExW
RegCloseKey
RegCloseKey
ADVAPI32.dll
ADVAPI32.dll
CloseWindowStation
CloseWindowStation
CreateWindowStationW
CreateWindowStationW
SetProcessWindowStation
SetProcessWindowStation
USER32.dll
USER32.dll
GetProcessHeap
GetProcessHeap
GetWindowsDirectoryW
GetWindowsDirectoryW
CreateIoCompletionPort
CreateIoCompletionPort
GetProcessHandleCount
GetProcessHandleCount
KERNEL32.dll
KERNEL32.dll
USERENV.dll
USERENV.dll
WTSAPI32.dll
WTSAPI32.dll
GetCPInfo
GetCPInfo
SetNamedPipeHandleState
SetNamedPipeHandleState
TransactNamedPipe
TransactNamedPipe
WaitNamedPipeW
WaitNamedPipeW
zcÃ
zcÃ
444.44...4
444.44...4
4.4....4.
4.4....4.
..44.44@4
..44.44@4
4@444@4.
4@444@4.
.4@4@@4.
.4@4@@4.
}.GnO
}.GnO
Ôjo
Ôjo
k.SZ[
k.SZ[
j.oii
j.oii
8%8s8
8%8s8
30}0#1\1
30}0#1\1
0!0%0)0-0105090
0!0%0)0-0105090
0 0(00080
0 0(00080
8(9,909\9
8(9,909\9
= =$=(=,=0=4=8=
= =$=(=,=0=4=8=
3 3$3,3@3`3
3 3$3,3@3`3
chrome_watcher.dll
chrome_watcher.dll
{0105EA02-802D-4B37-8161-4ED25C493266}
{0105EA02-802D-4B37-8161-4ED25C493266}
app_host.exe
app_host.exe
citrio.dll
citrio.dll
citrio_child.dll
citrio_child.dll
metro_driver.dll
metro_driver.dll
{E9F24A7C-13CA-42FB-A4D9-79C3C9D21B28}
{E9F24A7C-13CA-42FB-A4D9-79C3C9D21B28}
ChromeCanary
ChromeCanary
ChromeSSHTM
ChromeSSHTM
Chrome Canary HTML Document
Chrome Canary HTML Document
{1BEAC3E3-B852-44F4-B468-8906C062422E}
{1BEAC3E3-B852-44F4-B468-8906C062422E}
BGoogle Chrome Canary
BGoogle Chrome Canary
{3599E25E-6314-4BE9-AE14-E51877342426}
{3599E25E-6314-4BE9-AE14-E51877342426}
{675046A3-9F4F-4805-A81C-CBF753FE3428}
{675046A3-9F4F-4805-A81C-CBF753FE3428}
Browse the web
Browse the web
Software\Microsoft\Windows\CurrentVersion\Uninstall\Citrio
Software\Microsoft\Windows\CurrentVersion\Uninstall\Citrio
-chrome
-chrome
-chromeframe
-chromeframe
WebAccessible
WebAccessible
{92F8A219-E740-49D5-B785-B962AD819724}
{92F8A219-E740-49D5-B785-B962AD819724}
{8BF2F61B-E8C2-4A67-85D0-D6A69F9FD948}
{8BF2F61B-E8C2-4A67-85D0-D6A69F9FD948}
hXXp://VVV.citrio.com/goodbye.html?intl=$1
hXXp://VVV.citrio.com/goodbye.html?intl=$1
%d.%d.%d
%d.%d.%d
BGoogle Chrome App Launcher
BGoogle Chrome App Launcher
ChromeAppList
ChromeAppList
Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome App Launcher
Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome App Launcher
{DE28A2EA-77FA-4F2B-8252-C3B5844F6455}
{DE28A2EA-77FA-4F2B-8252-C3B5844F6455}
BGoogle Chrome Frame
BGoogle Chrome Frame
Chrome in a Frame.
Chrome in a Frame.
Uninstall Chrome Frame
Uninstall Chrome Frame
Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome Frame
Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome Frame
{F0B50D5A-4BBA-4514-AD2C-EBA50C29C460}
{F0B50D5A-4BBA-4514-AD2C-EBA50C29C460}
Google Chrome binaries
Google Chrome binaries
\\.\pipe\GoogleCrashServices\
\\.\pipe\GoogleCrashServices\
\\.\pipe\ChromeCrashServices
\\.\pipe\ChromeCrashServices
error %u
error %u
chrome.exe
chrome.exe
ntdll.dll
ntdll.dll
HKEY_CLASSES_ROOT
HKEY_CLASSES_ROOT
HKEY_CURRENT_USER
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_LOCAL_MACHINE
HKEY_USERS
HKEY_USERS
HKEY_PERFORMANCE_DATA
HKEY_PERFORMANCE_DATA
HKEY_PERFORMANCE_TEXT
HKEY_PERFORMANCE_TEXT
HKEY_PERFORMANCE_NLSTEXT
HKEY_PERFORMANCE_NLSTEXT
HKEY_CURRENT_CONFIG
HKEY_CURRENT_CONFIG
HKEY_DYN_DATA
HKEY_DYN_DATA
pipe\
pipe\
Ckernel32.dll
Ckernel32.dll
kernelbase.dll
kernelbase.dll
eKey
eKey
gdi32.dll
gdi32.dll
xntdll.dll
xntdll.dll
wow_helper.exe"
wow_helper.exe"
Cntdll.dll
Cntdll.dll
${windows}
${windows}
hunspecified-crash-key
hunspecified-crash-key
Dmscoree.dll
Dmscoree.dll
HADVAPI32.DLL
HADVAPI32.DLL
- floating point support not loaded
- floating point support not loaded
- CRT not initialized
- CRT not initialized
- Attempt to initialize the CRT more than once.
- Attempt to initialize the CRT more than once.
USER32.DLL
USER32.DLL
portuguese-brazilian
portuguese-brazilian
dbghelp.dll
dbghelp.dll
rpcrt4.dll
rpcrt4.dll
%s\%s.dmp
%s\%s.dmp
x-x-x-xx-xxxxxx
x-x-x-xx-xxxxxx
Ndebug.log
Ndebug.log
.\debug.log
.\debug.log
\StringFileInfo\xx\%ls
\StringFileInfo\xx\%ls
tntdll.dll
tntdll.dll
Chrome_MessageWindow
Chrome_MessageWindow
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application\citrio.exe
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Citrio\Application\citrio.exe
IDR_X006_CITRIO_CHROMESTORE
IDR_X006_CITRIO_CHROMESTORE
citrio_exe
citrio_exe
citrio.exe_3808_rwx_3680A000_00078000:
PPP;%x
PPP;%x
VW;%x
VW;%x
PPPP;%x
PPPP;%x
PPPPPPP;%x
PPPPPPP;%x
PPPPP;%x
PPPPP;%x
PP;%x
PP;%x