Trojan.Win32.Alureon_50b2167679

by malwarelabrobot on February 28th, 2016 in Malware Descriptions.

Trojan.Win32.Alureon.FD (Lavasoft MAS)
Behaviour: Trojan


The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Requires JavaScript enabled!

Summary
Dynamic Analysis
Static Analysis
Network Activity
Map
Strings from Dumps
Removals

MD5: 50b2167679324689f6ff7b9ef26349b2
SHA1: 4961169e00029ffca04d3e05349bb80f57e521b1
SHA256: 186c03fde8b408dfc6845cdcdf9bc28eb8fe0e32a6746bc383d87cb2ad23785a
SSDeep: 12288:RCq6vA2VaUc0jJs3wK7B9vY7le3yPfK29oNpQ zBKlpIJDJ lj:P1Uc0jSt9vcmyP9WpQwUskj
Size: 621886 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: PackerUPXCompresorGratuitowwwupxsourceforgenet, UPolyXv05_v6
Company: no certificate found
Created at: 2011-09-07 15:57:44
Analyzed on: WindowsXP SP3 32-bit


Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

taskkill.exe:516
mediaget-admin-proxy.exe:368
yupdate-executor.exe:2580
%original file name%.exe:188
yandexbar_setup.exe:1456
regsvr32.exe:2428
regsvr32.exe:2508
MsiExec.exe:1372
MsiExec.exe:2536
MsiExec.exe:2100
MsiExec.exe:2548

The Trojan injects its code into the following process(es):

mediaget.exe:2792

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process mediaget.exe:2792 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\flash-plugin-1.7z (11187 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\audio_filter\libspeex_resampler_plugin.dll (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libgaussianblur_plugin.dll (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\stream_out\libstream_out_rtp_plugin.dll (3699 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\user_search\tserverinfo\qt_temp.VW2792 (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\visualization\libgoom_plugin.dll (219 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\user_search\iserverinfo\qt_temp.tX2792 (456 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\libnsv_plugin.dll (19 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\stream_filter\libdash_plugin.dll (3815 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\access\libsmb_plugin.dll (42 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libvhs_plugin.dll (19 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\libau_plugin.dll (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\user_search\iserverinfo\qt_temp.ZN2792 (611 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\libmjpeg_plugin.dll (19 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libaes3_plugin.dll (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\access\libidummy_plugin.dll (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\user_search\sserverinfo\qt_temp.Mv2792 (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\access\libdtv_plugin.dll (248 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\libvc1_plugin.dll (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\stream_out\libstream_out_gather_plugin.dll (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\cookies.ini.xY2792 (641 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\libes_plugin.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libsharpen_plugin.dll (17 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\webkit-local-storage\http_games.mgshare.com_0.localstorage (449 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\audio_output\libamem_plugin.dll (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\audio_filter\libscaletempo_plugin.dll (19 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\stream_filter\libsmooth_plugin.dll (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libalphamask_plugin.dll (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\stream_out\libstream_out_duplicate_plugin.dll (42 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libpuzzle_plugin.dll (75 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\audio_filter\libcompressor_plugin.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libatmo_plugin.dll (215 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\access\libshm_plugin.dll (17 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libhqdn3d_plugin.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\user_search\iserverinfo\qt_temp.dV2792 (447 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\audio_filter\libchorus_flanger_plugin.dll (19 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\libsubtitle_plugin.dll (92 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libscene_plugin.dll (42 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\lua\liblua_plugin.dll (317 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\audio_filter\libheadphone_channel_mixer_plugin.dll (19 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\gui\libskins2_plugin.dll (12288 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\libsid_plugin.dll (6394 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\access_output\libaccess_output_shout_plugin.dll (1723 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\user_search\iserverinfo\qt_temp.Gn2792 (586 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\access\libdvdread_plugin.dll (157 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libpostproc_plugin.dll (110 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\access\libvcd_plugin.dll (83 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libdts_plugin.dll (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\misc\libaddonsfsstorage_plugin.dll (80 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\access\libscreen_plugin.dll (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\liba52_plugin.dll (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\liblogo_plugin.dll (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libposterize_plugin.dll (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libripple_plugin.dll (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libadjust_plugin.dll (33 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\audio_filter\libspatializer_plugin.dll (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\audio_output\libadummy_plugin.dll (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\audio_filter\libequalizer_plugin.dll (52 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libmpeg_audio_plugin.dll (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\user_search\sserverinfo\qt_temp.Hc2792 (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\libvobsub_plugin.dll (79 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libanaglyph_plugin.dll (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\libsmf_plugin.dll (23 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libgrain_plugin.dll (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libflac_plugin.dll (1729 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libspudec_plugin.dll (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libwave_plugin.dll (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\user_search\iserverinfo\qt_temp.Rm2792 (578 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libmosaic_plugin.dll (30 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\control\libwin_hotkeys_plugin.dll (40 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\audio_output\libwasapi_plugin.dll (33 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\stream_filter\librecord_plugin.dll (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\mux\libmux_ps_plugin.dll (58 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\stream_filter\libhttplive_plugin.dll (1865 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\visualization\libglspectrum_plugin.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libspeex_plugin.dll (151 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\libdemuxdump_plugin.dll (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\packetizer\libpacketizer_dirac_plugin.dll (34 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\access\liblive555_plugin.dll (3783 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_chroma\libi420_rgb_plugin.dll (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_chroma\libi420_yuy2_mmx_plugin.dll (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\access\librtp_plugin.dll (1809 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\packetizer\libpacketizer_mpeg4audio_plugin.dll (69 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\access\libcdda_plugin.dll (165 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\4e6ef1a2e279a81c3f92341262d0cbd2a293d828.ini.lock (92 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libdmo_plugin.dll (33 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_chroma\librv32_plugin.dll (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libdvbsub_plugin.dll (111 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\cookies_search.ini.lock (23 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\audio_filter\libaudiobargraph_a_plugin.dll (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_chroma\libi422_yuy2_mmx_plugin.dll (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\misc\libvod_rtsp_plugin.dll (90 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\68b7310c6cc7916d49612cf34916078fbf58e9f6.ini.lock (46 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\access\libaccess_mms_plugin.dll (77 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libdeinterlace_plugin.dll (165 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libvpx_plugin.dll (9606 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\libxa_plugin.dll (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_output\libyuv_plugin.dll (40 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\user_search\iserverinfo\qt_temp.gh2792 (174 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\audio_filter\libaudio_format_plugin.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\access\libzip_plugin.dll (119 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\libdemux_stl_plugin.dll (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\liboldmovie_plugin.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\d73cf14c2f8d2609604053c89c25c1096cb3a483.torrent (736 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\user_search\iserverinfo\qt_temp.hW2792 (413 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\user_search\tserverinfo\qt_temp.rh2792 (13 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libantiflicker_plugin.dll (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\libwav_plugin.dll (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\access\libudp_plugin.dll (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libcolorthres_plugin.dll (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\user_search\tserverinfo\qt_temp.jp2792 (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\access_output\libaccess_output_livehttp_plugin.dll (1817 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libcdg_plugin.dll (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\user_search\tserverinfo\qt_temp.TG2792 (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\packetizer\libpacketizer_mlp_plugin.dll (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\user_search\tserverinfo\qt_temp.qT2792 (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_output\libdrawable_plugin.dll (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libquicktime_plugin.dll (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\access\libtimecode_plugin.dll (42 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libmotiondetect_plugin.dll (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libscale_plugin.dll (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libstl_plugin.dll (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\misc\liblogger_plugin.dll (41 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\control\libgestures_plugin.dll (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\misc\libexport_plugin.dll (46 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\audio_filter\libtrivial_channel_mixer_plugin.dll (17 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\audio_mixer\libinteger_mixer_plugin.dll (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\webkit-local-storage\http_mg.mgshare.com_0.localstorage (599 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\libvoc_plugin.dll (19 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\user_search\sserverinfo\qt_temp.rz2792 (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\audio_mixer\libfloat_mixer_plugin.dll (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\audio_filter\libsamplerate_plugin.dll (7972 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\geoip\qt_temp.NE2792 (19096 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_chroma\libyuy2_i422_plugin.dll (19 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\user_search\sserverinfo\qt_temp.Cl2792 (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\audio_filter\libnormvol_plugin.dll (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libmft_plugin.dll (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\misc\libxml_plugin.dll (7386 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\mux\libmux_ts_plugin.dll (114 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\services_discovery\libmediadirs_plugin.dll (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\meta_engine\libtaglib_plugin.dll (7972 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\access_output\libaccess_output_udp_plugin.dll (19 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\libnuv_plugin.dll (24 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\libavi_plugin.dll (98 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\libplaylist_plugin.dll (139 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\librss_plugin.dll (50 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\68b7310c6cc7916d49612cf34916078fbf58e9f6.torrent (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libcvdsub_plugin.dll (19 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\user_search\sserverinfo\qt_temp.Ed2792 (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\cookies.ini.lock (69 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\audio_filter\libugly_resampler_plugin.dll (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\control\libwin_msg_plugin.dll (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\access\libsftp_plugin.dll (3793 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\cookies.ini.CX2792 (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\access_output\libaccess_output_file_plugin.dll (17 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\stream_out\libstream_out_display_plugin.dll (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\audio_filter\libdtstospdif_plugin.dll (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libtwolame_plugin.dll (139 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\access\librar_plugin.dll (45 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\mux\libmux_avi_plugin.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\text_renderer\libtdummy_plugin.dll (13 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\misc\libgnutls_plugin.dll (7386 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libcrystalhd_plugin.dll (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\geoip\GeoIP.dat (9321 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libmagnify_plugin.dll (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\services_discovery\libupnp_plugin.dll (3740 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libmirror_plugin.dll (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libadpcm_plugin.dll (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libblend_plugin.dll (192 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libfaad_plugin.dll (1628 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libball_plugin.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libpsychedelic_plugin.dll (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\audio_filter\libmpgatofixed32_plugin.dll (132 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\stream_out\libstream_out_mosaic_bridge_plugin.dll (24 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_output\libvmem_plugin.dll (19 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_splitter\libclone_plugin.dll (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\access\libtcp_plugin.dll (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libfreeze_plugin.dll (17 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\user_search\iserverinfo\qt_temp.XH2792 (460 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\audio_filter\libstereo_widen_plugin.dll (17 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\user_search\sserverinfo\qt_temp.ca2792 (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libsubsusf_plugin.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libremoteosd_plugin.dll (1822 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\control\libdummy_plugin.dll (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\stream_out\libstream_out_autodel_plugin.dll (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\access\libvdr_plugin.dll (80 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_chroma\libi420_yuy2_plugin.dll (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\user_search\tserverinfo\qt_temp.Yu2792 (13 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_chroma\libi420_rgb_mmx_plugin.dll (55 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libtheora_plugin.dll (1620 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\control\libntservice_plugin.dll (43 bytes)
%Documents and Settings%\%current user%\My Documents\world_of_tanks_hp_marker-50409 (162 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\user_search\sserverinfo\qt_temp.br2792 (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\packetizer\libpacketizer_vc1_plugin.dll (38 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libt140_plugin.dll (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libuleaddvaudio_plugin.dll (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\audio_filter\libparam_eq_plugin.dll (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libcanvas_plugin.dll (42 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\misc\libfingerprinter_plugin.dll (55 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\user_search\iserverinfo\qt_temp.DC2792 (442 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\stream_out\libstream_out_stats_plugin.dll (40 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libcroppadd_plugin.dll (19 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\control\libnetsync_plugin.dll (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\libdiracsys_plugin.dll (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\plugins.dat.2792 (34292 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\user_search\iserverinfo\qt_temp.lJ2792 (519 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\audio_filter\libgain_plugin.dll (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libextract_plugin.dll (24 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libjpeg_plugin.dll (253 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_chroma\libchain_plugin.dll (40 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\user_search\sserverinfo\qt_temp.gx2792 (968 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\libasf_plugin.dll (88 bytes)
%Documents and Settings%\%current user%\NTUSER.DAT (27456 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libgradient_plugin.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_chroma\libswscale_plugin.dll (3766 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\libflacsys_plugin.dll (83 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\libreal_plugin.dll (34 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\stream_out\libstream_out_smem_plugin.dll (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\access\libhttp_plugin.dll (121 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libmotionblur_plugin.dll (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\stream_out\libstream_out_delay_plugin.dll (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\audio_output\libmmdevice_plugin.dll (39 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libsubsdelay_plugin.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\mux\libmux_dummy_plugin.dll (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libedummy_plugin.dll (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_chroma\libi422_yuy2_plugin.dll (19 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\audio_filter\liba52tofloat32_plugin.dll (59 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\services_discovery\libpodcast_plugin.dll (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libdxva2_plugin.dll (72 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\webkit-local-storage\http_games.mgshare.com_0.localstorage-journal (9552 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\control\libhotkeys_plugin.dll (61 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\audio_filter\libdtstofloat32_plugin.dll (168 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\audio_filter\libkaraoke_plugin.dll (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\user_search\tserverinfo\qt_temp.uu2792 (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libopus_plugin.dll (1638 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\user_search\tserverinfo\qt_temp.wF2792 (13 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\d73cf14c2f8d2609604053c89c25c1096cb3a483.ini.PK2792 (253 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\liblibmpeg2_plugin.dll (134 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libaraw_plugin.dll (30 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\4e6ef1a2e279a81c3f92341262d0cbd2a293d828.ini.dp2792 (755 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\liblibass_plugin.dll (7972 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\librawvideo_plugin.dll (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_output\libcaca_plugin.dll (3898 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\audio_filter\libremap_plugin.dll (23 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_output\libvdummy_plugin.dll (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_chroma\libi420_yuy2_sse2_plugin.dll (31 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\audio_output\libdirectsound_plugin.dll (32 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\audio_filter\libmono_plugin.dll (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\access\libattachment_plugin.dll (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\libpva_plugin.dll (19 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\misc\libaddonsvorepository_plugin.dll (75 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\librawdv_plugin.dll (17 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\stream_out\libstream_out_raop_plugin.dll (1824 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\libimage_plugin.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\libtta_plugin.dll (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\libmp4_plugin.dll (242 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\user_search\iserverinfo\qt_temp.HY2792 (482 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\d73cf14c2f8d2609604053c89c25c1096cb3a483.ini.db2792 (192 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\libnsc_plugin.dll (52 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\libgme_plugin.dll (1691 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libsepia_plugin.dll (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\access\libaccess_bd_plugin.dll (103 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\packetizer\libpacketizer_hevc_plugin.dll (17 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libg711_plugin.dll (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\access\libftp_plugin.dll (81 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\mux\libmux_ogg_plugin.dll (75 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\libps_plugin.dll (39 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\4e6ef1a2e279a81c3f92341262d0cbd2a293d828.ini.Qs2792 (632 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\access\liblibbluray_plugin.dll (12289 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\user_search\iserverinfo\qt_temp.xV2792 (658 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_chroma\libi422_yuy2_sse2_plugin.dll (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\user_search\iserverinfo\qt_temp.sP2792 (642 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\plugins.dat (262 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\user_search\iserverinfo\qt_temp.rz2792 (420 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\access\libimem_plugin.dll (49 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\stream_out\libstream_out_setid_plugin.dll (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libsubsdec_plugin.dll (53 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libsvcdsub_plugin.dll (19 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\stream_out\libstream_out_record_plugin.dll (50 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libaudiobargraph_v_plugin.dll (23 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\stream_out\libstream_out_langfromtelx_plugin.dll (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\services_discovery\libsap_plugin.dll (124 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\mux\libmux_mpjpeg_plugin.dll (38 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libscte27_plugin.dll (31 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\access\libdshow_plugin.dll (1822 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\stream_out\libstream_out_standard_plugin.dll (46 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\libhevc_plugin.dll (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\mux\libmux_wav_plugin.dll (17 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\stream_out\libstream_out_dummy_plugin.dll (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_chroma\libi422_i420_plugin.dll (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_output\libgl_plugin.dll (61 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libzvbi_plugin.dll (7972 bytes)
%Documents and Settings%\%current user%\NTUSER.DAT.LOG (29520 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\4e6ef1a2e279a81c3f92341262d0cbd2a293d828.ini.kQ2792 (193 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\misc\libaudioscrobbler_plugin.dll (48 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\user_search\iserverinfo\qt_temp.IA2792 (467 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\libts_plugin.dll (154 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libpng_plugin.dll (296 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\misc\libstats_plugin.dll (17 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\libmod_plugin.dll (1806 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\libcaf_plugin.dll (23 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\packetizer\libpacketizer_flac_plugin.dll (24 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\audio_filter\libsimple_channel_mixer_plugin.dll (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libgradfun_plugin.dll (23 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\librotate_plugin.dll (57 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\4e6ef1a2e279a81c3f92341262d0cbd2a293d828.ini.Pd2792 (690 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\liberase_plugin.dll (19 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\access\libsdp_plugin.dll (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\gui\libqt4_plugin.dll (83846 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libtransform_plugin.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\stream_out\libstream_out_bridge_plugin.dll (46 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\user_search\iserverinfo\qt_temp.Bc2792 (616 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\user_search\tserverinfo\qt_temp.fB2792 (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\text_renderer\libfreetype_plugin.dll (3836 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_output\libdirectdraw_plugin.dll (70 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libbluescreen_plugin.dll (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\libmpgv_plugin.dll (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\libdemux_cdg_plugin.dll (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\visualization\libprojectm_plugin.dll (7972 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\audio_filter\liba52tospdif_plugin.dll (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libmarq_plugin.dll (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_chroma\libyuy2_i420_plugin.dll (23 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\control\liboldrc_plugin.dll (70 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\libaiff_plugin.dll (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\cookies.ini.Ga2792 (23 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_output\libdirect2d_plugin.dll (58 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\player_plugins_2.2.2-5.22.7z (32687 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\stream_out\libstream_out_transcode_plugin.dll (48 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_splitter\libpanoramix_plugin.dll (41 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\audio_output\libafile_plugin.dll (17 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\libmkv_plugin.dll (7386 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\user_search\iserverinfo\qt_temp.nF2792 (453 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\access\libdvdnav_plugin.dll (238 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libblendbench_plugin.dll (17 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\services_discovery\libwindrive_plugin.dll (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\user_search\iserverinfo\qt_temp.WD2792 (421 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libvorbis_plugin.dll (3821 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\68b7310c6cc7916d49612cf34916078fbf58e9f6.ini.DN2792 (250 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\libogg_plugin.dll (325 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\audio_filter\libdolby_surround_decoder_plugin.dll (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\packetizer\libpacketizer_mpeg4video_plugin.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\cookies_search.ini.yd2792 (23 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qt_temp.Pu2792 (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\libmpc_plugin.dll (77 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libddummy_plugin.dll (38 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\liblpcm_plugin.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\access_output\libaccess_output_http_plugin.dll (19 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\packetizer\libpacketizer_mpegvideo_plugin.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\stream_out\libstream_out_chromaprint_plugin.dll (6366 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\meta_engine\libfolder_plugin.dll (38 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\access_output\libaccess_output_dummy_plugin.dll (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libschroedinger_plugin.dll (7386 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\webkit-local-storage\http_mg.mgshare.com_0.localstorage-journal (14062 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\packetizer\libpacketizer_h264_plugin.dll (77 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\68b7310c6cc7916d49612cf34916078fbf58e9f6.ini.mX2792 (192 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\librawaud_plugin.dll (17 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libx265_plugin.dll (12289 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\stream_out\libstream_out_description_plugin.dll (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_chroma\libi420_rgb_sse2_plugin.dll (116 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libcc_plugin.dll (55 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_chroma\libgrey_yuv_plugin.dll (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\flash\npswf32.dll (123239 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\libty_plugin.dll (37 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\access\libaccess_realrtsp_plugin.dll (99 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\audio_output\libwaveout_plugin.dll (32 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_splitter\libwall_plugin.dll (56 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_output\libwingdi_plugin.dll (56 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libqsv_plugin.dll (144 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\user_search\sserverinfo\qt_temp.Dw2792 (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\mux\libmux_mp4_plugin.dll (54 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\librawvid_plugin.dll (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libkate_plugin.dll (106 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\visualization\libvisual_plugin.dll (40 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libyuvp_plugin.dll (17 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_output\libdirect3d_plugin.dll (78 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libavcodec_plugin.dll (91160 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\user_search\sserverinfo\qt_temp.xl2792 (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\user_search\sserverinfo\qt_temp.YB2792 (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\access\libfilesystem_plugin.dll (48 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\packetizer\libpacketizer_copy_plugin.dll (17 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\mux\libmux_asf_plugin.dll (32 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\access\libbluray-j2se-0.7.0.jar (3710 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libsubstx3g_plugin.dll (44 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\d73cf14c2f8d2609604053c89c25c1096cb3a483.ini.lock (46 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_output\libglwin32_plugin.dll (100 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libinvert_plugin.dll (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\stream_out\libstream_out_es_plugin.dll (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libx264_plugin.dll (7386 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\libh264_plugin.dll (15 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\webkit-local-storage\http_mg.mgshare.com_0.localstorage-journal (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\cookies.ini.rj2792 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\webkit-local-storage\http_games.mgshare.com_0.localstorage-journal (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\cookies_search.ini.lock (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\cookies_search.ini.nK2792 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\plugins.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\4e6ef1a2e279a81c3f92341262d0cbd2a293d828.ini.lock (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\d73cf14c2f8d2609604053c89c25c1096cb3a483.ini.lock (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\68b7310c6cc7916d49612cf34916078fbf58e9f6.ini.lock (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\d73cf14c2f8d2609604053c89c25c1096cb3a483.ini.DZ2792 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\68b7310c6cc7916d49612cf34916078fbf58e9f6.ini.Jw2792 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\cookies.ini.lock (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\half-open-limit-check.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\cookies.ini.VM2792 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\cookies_search.ini.Lt2792 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\4e6ef1a2e279a81c3f92341262d0cbd2a293d828.ini.iu2792 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\geoip\GeoIP.dat.tmp (0 bytes)

The process yupdate-executor.exe:2580 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Updater\yupdate-executor.log (5802 bytes)

The process %original file name%.exe:188 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\platforms\qminimal.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\img\menuBg.jpg (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\Qt5WebKit.dll (127287 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\libeay32.dll (7386 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\mediaget-tmp-18467.tmp (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WXU749EJ\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\msvcp100.dll (1702 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\platforms\qwindows.dll (6337 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\css\style-ie6.css (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\libgcc_s_sjlj-1.dll (95 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\Qt5Qml.dll (15801 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\mediaget-admin-proxy.exe (115 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\Qt5Sensors.dll (145 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\mediaget-tmp-41.tmp (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\img\Marker.jpg (771 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\icuin53.dll (12288 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\img\check.jpg (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\Qt5Network.dll (3912 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\imageformats\qjpeg.dll (206 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\scripts\DD_belatedPNG.js (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\yandexbar_setup.exe (107884 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\mediaget-admin-proxy.exe (94 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\mediaservice\wmfengine.dll (136 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GXARCLEV\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\img\babylonlogo4.jpg (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\css (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\Qt5Sql.dll (151 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\Qt5MultimediaWidgets.dll (88 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\Qt5Xml.dll (152 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\libvlc.dll (126 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8LUVCT2R\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\img\AgreementScreen.jpg (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\css\style-ie7.css (904 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\Qt5Gui.dll (30058 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\img\logo.jpg (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\Qt5Quick.dll (15021 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\icudt53.dll (7386 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\Qt5OpenGL.dll (271 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\img\MediaLibraryScreen.jpg (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\img\installbutton_l.jpg (426 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\scripts\scripts.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\mediaget.exe (91742 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\Qt5PrintSupport.dll (264 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\Qt5WinExtras.dll (230 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\scripts\jquery.js (91 bytes)
%Documents and Settings%\%current user%\Desktop\MediaGet.lnk (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\img\MarkerActive.jpg (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\img\FeaturesScreen.jpg (13 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\Qt5WebKitWidgets.dll (199 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\img\TabBg.jpg (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\libvlccore.dll (15801 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\img (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\img\next.jpg (664 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\msvcr100.dll (3846 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\Qt5Concurrent.dll (19 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\img\CatalogueScreen.jpg (19 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\img\MediaPlayerScreen.jpg (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\img\header_cycle_arrows_shape.jpg (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\img\installbutton.jpg (367 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\ssleay32.dll (273 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\icuuc53.dll (7386 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\css\style-ie8.css (891 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\img\loadinfo1.gif (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\Qt5XmlPatterns.dll (15801 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\img\babylonlogoleft.jpg (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\img\whitesmoke.jpg (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\img\babylonlogoupper.jpg (4 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\MediaGet2\MediaGet.lnk (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\imageformats\qgif.dll (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\index.template (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\mediaget-uninstaller.exe (209 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\COR8IIDQ\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\img\SearchScreen.jpg (24 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\Qt5Positioning.dll (157 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\Qt5Multimedia.dll (1818 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\img\activeTabBg.jpg (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\img\DownloadsScreen.jpg (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\Qt5Widgets.dll (28890 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\img\pagerage.jpg (37 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\img\InstallScreen.jpg (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\css\style.css (8 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\MediaGet2\Uninstall MediaGet.lnk (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\index.html (658 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\Qt5WebChannel.dll (75 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\Qt5Core.dll (28502 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\img\FeaturesScreen.jpg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\img\TabBg.jpg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\img\babylonlogoupper.jpg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\img\babylonlogo4.jpg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\img\next.jpg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\mediaget-admin-proxy.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\scripts\scripts.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\mediaget-tmp-18467.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\index.template (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\img\SearchScreen.jpg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\img\CatalogueScreen.jpg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\img\MediaPlayerScreen.jpg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\img\header_cycle_arrows_shape.jpg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\css\style-ie6.css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\img\installbutton.jpg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\img\AgreementScreen.jpg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\css\style-ie7.css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\img\activeTabBg.jpg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\img\DownloadsScreen.jpg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\img\installbutton_l.jpg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\img\pagerage.jpg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\img\InstallScreen.jpg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\img\logo.jpg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\css\style.css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\mediaget-tmp-41.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\img\Marker.jpg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\img\MediaLibraryScreen.jpg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\img\check.jpg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\css\style-ie8.css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\img\menuBg.jpg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\scripts\DD_belatedPNG.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\img\loadinfo1.gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\scripts (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\yandexbar_setup.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\img (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\index.html (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\img\babylonlogoleft.jpg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\img\whitesmoke.jpg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\scripts\jquery.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\img\MarkerActive.jpg (0 bytes)

The process yandexbar_setup.exe:1456 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\YandexPackSetup00000.log (153858 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Temp\{11EA1C75-DB0D-410B-B63B-20916EECD568}\YandexPackSetup.msi (83795 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Temp\{413658B6-9D1B-4A71-8628-8517CA1E3E5F}\YandexSearch.msi (20507 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\YandexSearch00000.log (105500 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\Temp\{11EA1C75-DB0D-410B-B63B-20916EECD568}\YandexPackSetup.msi (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Temp\{413658B6-9D1B-4A71-8628-8517CA1E3E5F}\YandexSearch.msi (0 bytes)

The process regsvr32.exe:2428 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\cy.messages.xml (915 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\kk\welcome\ie\btn-check.gif (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\kk\subscription.dtd (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\en\welcome\css\style.css (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\wp\css\b-menu-ico\b-menu-ico.ie.css (805 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\tr\quote.dtd (660 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\about\product.xml (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\barlegacy.dll (11348 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\cy.xml (531 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\js\img\close-hover.png (443 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\logo.messages.xml (282 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{AC8A2266-D92B-4CCE-AEB5-0FEBA0FD2C75}\icons\favorities.png (412 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\ru\fastdial\config.xml (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{AC8A2266-D92B-4CCE-AEB5-0FEBA0FD2C75}\icons\messages.png (480 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\about\logo-ie-small.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\weather\i-night-cloud-rain.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\be\services\features.dtd (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\quote\currency_down.png (570 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\COR8IIDQ\rambler[2] (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\uk\welcome\css\b-sg-header.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\en\money.dtd (327 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\en\login.dtd (817 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\icons\rambler.png (655 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\login\auth.png (754 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8LUVCT2R\mc[1] (285 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\tr\srs.dtd (876 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\ru\search.dtd (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{AC8A2266-D92B-4CCE-AEB5-0FEBA0FD2C75}\icons\newsfeed.png (364 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8LUVCT2R\mail[1] (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\barcommon.dll (3557 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{3F580847-72EB-4D1D-937C-6B324D24137E}\locale\tr\radio.dtd (83 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\uk\town.dtd (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\ru\services\features.dtd (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\cs\welcome\css\b-sg-list__item_2.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\COR8IIDQ\odnoklassniki[1] (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{AC8A2266-D92B-4CCE-AEB5-0FEBA0FD2C75}\icons\profile.png (448 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\kk\fastdial\product.dtd (926 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\widget-preset.xsl (712 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C2E33C62-1E25-49E9-BABA-DBA2527F4C57}\wall.png (588 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\searchscopes.xml (889 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{AC8A2266-D92B-4CCE-AEB5-0FEBA0FD2C75}\icons\photos.png (539 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\tr\services\features.dtd (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\fastdial\thumbnails\market.jpg (588 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\opinions.messages.xml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WXU749EJ\facebook[1] (682 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\functional.precompiled.bin (6588 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\tr\subscription.dtd (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\uk\fotki.dtd (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\wp\js\script.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\icons\bookmarks.png (664 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\uk\fastdial\config.xml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\cs\welcome\ie\btn-check.gif (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\cs\services.dtd (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\js\img\close.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\be\fastdial\config.xml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\en\fastdial\logo.png (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\icons\icon1.png (453 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\tr\welcome\ie\btn-home.gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{6074A32F-35A3-4893-B290-A4BD186038B0}\data\whitelist.xml (76 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WXU749EJ\logo[1] (341 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\icons\yandex.png (577 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\http://bar-widgets.yandex.ru/packages/approved/117/manifest.xml.zip (4545 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C2E33C62-1E25-49E9-BABA-DBA2527F4C57}\photo.png (618 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8LUVCT2R\spam[1] (765 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\be\welcome\css\b-sg-list__item_2.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\be\welcome\ie\btn-home_.gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\cs\welcome\css\b-sg-list__item_3.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\ic\2.png (215 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\fastdial\thumbnails\fotki.jpg (549 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\js\cleaner.js (813 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\geobase.xsl (373 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\quote\quote_up.png (602 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\be\services.dtd (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\be\welcome\css\b-sg-text-list__item.gif (47 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\wp\css\b-suggest\_ie\b-suggest__img_type3.gif (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\ru\welcome\icon1.ico (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\kk\mail.dtd (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{AC8A2266-D92B-4CCE-AEB5-0FEBA0FD2C75}\vkontakte.dll (628 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\ru\geolocation.dtd (124 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\translate-langs.xml (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\en\ic.dtd (567 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C25E60F0-88DE-445E-AB4E-55F4700A90E4}\locale\ru\odnoklassniki.dtd (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\en\welcome\ie\btn-check_.gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\weather\i_ch.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\kk\logo.dtd (169 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\kk\welcome\css\style.css (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\kk\about\product.dtd (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\plugin-translator.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GXARCLEV\rambler[1] (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GXARCLEV\profile[2] (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\cs\ic.dtd (566 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WXU749EJ\product[2] (200 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\kk\welcome\icon1.ico (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\icons\images.png (611 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\js\img\qwe.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\tr\fastdial\config.xml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\uk\fastdial\product.dtd (914 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\COR8IIDQ\geolocation[1] (74 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\spelling\spell.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\quote\stock_up.png (587 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\widget-news.xsl (555 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\en\icons\yandex.png (604 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{3F580847-72EB-4D1D-937C-6B324D24137E}\error.png (400 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\quote\quote_down.png (605 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\about\background-ie.png (1764 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\geolocation.xml (330 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{6074A32F-35A3-4893-B290-A4BD186038B0}\mc.xml (285 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\en\textonly.dtd (153 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\en\bookmark.dtd (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\wp\css\b-video\b-video__img.png (980 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\uk\welcome\ie\btn-home_.gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\be\ic.dtd (752 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\en\geolocation.dtd (74 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\ru\bookmark.dtd (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{AC8A2266-D92B-4CCE-AEB5-0FEBA0FD2C75}\icons\videoslocked.png (843 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\traffic\red.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\ru\services.dtd (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\uk\welcome\css\b-sg-list__item_3.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\cs\yaru.dtd (654 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\ru\fastdial\logo.png (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{6074A32F-35A3-4893-B290-A4BD186038B0}\locale\cs\mc.dtd (320 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{6074A32F-35A3-4893-B290-A4BD186038B0}\icons\badge\active_hover.png (374 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\COR8IIDQ\product[1] (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GXARCLEV\defaults[1] (800 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\ru\welcome\images\example.png (1176 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\be\welcome\images\example.png (1176 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\kk\fastdial\logo.png (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\http://bar-widgets.yandex.ru/packages/approved/118/manifest.xml.zip (2105 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\cs\userinfo.dtd (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\tr\welcome\css\b-sg-list__pointer.png (251 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\tr\ic.dtd (583 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8LUVCT2R\facebook[1] (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\uk\TranslateBtn.dtd (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\weather\i-night-cloud-snow.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\kk\userinfo.dtd (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\be\spelling.dtd (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\be\pagetranslator.dtd (575 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C25E60F0-88DE-445E-AB4E-55F4700A90E4}\birth_pin.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C2E33C62-1E25-49E9-BABA-DBA2527F4C57}\notifications_new.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\wp\css\b-suggest\_ie\b-suggest__bg.png (1176 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{AC8A2266-D92B-4CCE-AEB5-0FEBA0FD2C75}\icons\opinions.png (639 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\be\welcome\icon1.ico (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{6074A32F-35A3-4893-B290-A4BD186038B0}\MSC.dll (2733 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\be\about\product.dtd (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\zakladki.messages.xml (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\opinions\1.png (470 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GXARCLEV\search[1] (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{6074A32F-35A3-4893-B290-A4BD186038B0}\locale\uk\mc.dtd (393 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\cs\login.dtd (817 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\plugin-translator.xml (396 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\kk\welcome\ie\btn-home.gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{AC8A2266-D92B-4CCE-AEB5-0FEBA0FD2C75}\icons\photosmark.png (560 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\en\pagetranslator.dtd (390 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{3F580847-72EB-4D1D-937C-6B324D24137E}\off.png (454 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WXU749EJ\srs[1] (473 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\ru\welcome\ie\welcome.html (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\en\geobase.xml (1099 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\wp\css\b-suggest-menu\b-suggest-menu.css (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\en\welcome\ie\btn-home_.gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{AC8A2266-D92B-4CCE-AEB5-0FEBA0FD2C75}\icons\events.png (781 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\moikrug\moikrug.png (874 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C2E33C62-1E25-49E9-BABA-DBA2527F4C57}\locale\tr\facebook.dtd (697 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\en\about\vendorlogo.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8LUVCT2R\quote[1] (856 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\tr\yaru.dtd (709 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{6074A32F-35A3-4893-B290-A4BD186038B0}\locale\be\mc.dtd (396 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GXARCLEV\moikrug[1] (602 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\searchfield\searchfield.xml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C25E60F0-88DE-445E-AB4E-55F4700A90E4}\msg.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{6074A32F-35A3-4893-B290-A4BD186038B0}\locale\kk\mc.dtd (404 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\cs\welcome\ie\btn-check_.gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\COR8IIDQ\yaru[1] (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\quote_up.png (602 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\en\welcome\index.html (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\en\services\features.dtd (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\wp\css\l-content\l-content.css (311 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\messages.xml (293 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\kk\search.dtd (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C25E60F0-88DE-445E-AB4E-55F4700A90E4}\main_lock.png (792 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\be\quote.dtd (790 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\tr\userinfo.dtd (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\js\img\close-lover.png (427 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\icons\fav-yandex.ico (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\cs\welcome\css\b-sg-text-list__item.gif (47 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\bookmark\buttonEdit.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\kk\welcome\ie\welcome.html (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C2E33C62-1E25-49E9-BABA-DBA2527F4C57}\notifications_lock.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\kk\services.dtd (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\widget-news-active.gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GXARCLEV\radio[1] (79 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\readability\readability.css (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\kk\geolocation.dtd (128 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\en\welcome\ie\welcome.html (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\traffic\gray.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{6074A32F-35A3-4893-B290-A4BD186038B0}\band\css\button_end_normal.png (330 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\ru\welcome\css\b-sg-text-list__item.gif (47 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{6074A32F-35A3-4893-B290-A4BD186038B0}\band\logo.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\weather\convert.xml (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\wp\css\g-clear\g-clear.css (45 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\cs\about\vendorlogo.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\js\__YaSggst.ac.css (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\icons\subscriptions.png (779 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\en\subscription.dtd (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\ru\town.dtd (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{3F580847-72EB-4D1D-937C-6B324D24137E}\radio.dll (2812 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{3F580847-72EB-4D1D-937C-6B324D24137E}\radio.xml (417 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GXARCLEV\zakladki[1] (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\wp\css\b-suggest-menu\b-suggest-menu__corners.gif (72 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\tr\fastdial\logo-clear.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\cs\opinions.dtd (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C25E60F0-88DE-445E-AB4E-55F4700A90E4}\odnoklassniki.xml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\be\money.dtd (527 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C2E33C62-1E25-49E9-BABA-DBA2527F4C57}\locale\en\facebook.dtd (681 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\be\welcome\css\style.css (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\cs\fastdial\product.dtd (824 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\kk\logobutton\logoconf.dtd (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\town.xml (980 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{AC8A2266-D92B-4CCE-AEB5-0FEBA0FD2C75}\icons\groupsmark.png (689 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\en\fastdial\config.xml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\js\img\setup.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\locale\ru\smartbox.dtd (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\installer\place-after.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8LUVCT2R\userinfo[1] (479 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\distribution\distribution.xml (314 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\ru\TranslateBtn.dtd (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\icons\mail.png (565 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\defaults.dtd (400 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\tr\welcome\css\style.css (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{3F580847-72EB-4D1D-937C-6B324D24137E}\on.png (408 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GXARCLEV\widget-news[1] (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\tr\spelling.dtd (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C25E60F0-88DE-445E-AB4E-55F4700A90E4}\main_pin.png (795 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\en\opinions.dtd (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\uk\welcome\ie\btn-home.gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\en\welcome\ie\btn-check.gif (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\js\img\blackout.png (178 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\icons\wiki.png (534 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\mail\folder.png (441 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\bookmark\folder.png (441 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8LUVCT2R\send[1] (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\en\moikrug.dtd (602 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{6074A32F-35A3-4893-B290-A4BD186038B0}\band\css\button_content_normal.png (342 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\cs\town.dtd (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\tr\welcome\ie\welcome.html (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\yaru.xml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\cs\srs.dtd (911 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\wp\css\b-title\b-title.css (103 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\cs\logo.dtd (130 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\en\fastdial\logo-clear.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C2E33C62-1E25-49E9-BABA-DBA2527F4C57}\facebook.png (464 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WXU749EJ\subscription[1] (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\en\yaru.dtd (655 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\.embedded (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8LUVCT2R\fotki[1] (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C2E33C62-1E25-49E9-BABA-DBA2527F4C57}\messages.png (584 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\tr\town.dtd (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WXU749EJ\moikrug[1] (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\tr\welcome\css\b-sg-list__item_4.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{6074A32F-35A3-4893-B290-A4BD186038B0}\band\css\main.css (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\tr\welcome\css\b-sg-list__item_3.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\tr\about\product.dtd (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8LUVCT2R\pagetranslator[1] (390 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{AC8A2266-D92B-4CCE-AEB5-0FEBA0FD2C75}\icons\applications.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\be\fotki.dtd (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\ru\welcome\ie\btn-check_.gif (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\kk\textonly.dtd (221 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\kk\welcome\ie\btn-check_.gif (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\be\browser\browserconf.dtd (185 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\quotelist.xsl (560 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\cs\fastdial\logo-clear.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\tr\textonly.dtd (161 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{6074A32F-35A3-4893-B290-A4BD186038B0}\band\corner.gif (77 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\cs\pagetranslator-tooltips.xml (526 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\en\welcome\css\b-sg-list__pointer.png (251 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\en\fastdial\product.dtd (876 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\ru\fastdial\product.dtd (918 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\wp\ie.html (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\cs\search.dtd (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\icons\auto.png (675 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\cs\mail.dtd (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\tr\login.dtd (907 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\uk\services.dtd (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\yaru\yaru.png (200 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\ru\pagetranslator-tooltips.xml (783 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\cs\icons\yandex.png (604 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\http://bar-widgets.yandex.ru/packages/approved/75/manifest.xml.zip (13 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\uk\logobutton\logoconf.dtd (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{6074A32F-35A3-4893-B290-A4BD186038B0}\band\pop-top_thumb__img.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\logobutton\logoconf.xml (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\uk\money.dtd (515 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\readability\disabled.png (417 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\textonly.xml (375 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\version (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\kk\services\features.dtd (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\kk\yaru.dtd (911 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\en\about\product.dtd (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{AC8A2266-D92B-4CCE-AEB5-0FEBA0FD2C75}\locale\kk\vkontakte.dtd (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\kk\moikrug.dtd (874 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\ic\5.png (213 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C25E60F0-88DE-445E-AB4E-55F4700A90E4}\main.png (732 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\subscription\add.png (779 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{6074A32F-35A3-4893-B290-A4BD186038B0}\band\pop-top_suggest.htm (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{AC8A2266-D92B-4CCE-AEB5-0FEBA0FD2C75}\icons\questions.png (747 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\quote\quote.png (583 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\opinions\3.png (502 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C2E33C62-1E25-49E9-BABA-DBA2527F4C57}\friends_lock.png (795 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\wp\css\ie.css (439 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\ru\common.dtd (285 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WXU749EJ\lenta[1] (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{AC8A2266-D92B-4CCE-AEB5-0FEBA0FD2C75}\profile.xml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\installer\place-replace.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\spam.xml (765 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\ic\3.png (227 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\services\services.xml (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\http://bar-widgets.yandex.ru/packages/approved/91/manifest.xml.zip (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\en\welcome\ie\btn-home.gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\cs\pagetranslator.dtd (390 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\uk\geolocation.dtd (129 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\be\widget-news.dtd (655 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\quote.xml (856 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\about\vendorlogo.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\zakladki.xml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\icons\catalog.png (502 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\tr\quote\quotelist.dtd (66 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\en\spam.dtd (318 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\COR8IIDQ\money[1] (327 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\search\highlight.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{6074A32F-35A3-4893-B290-A4BD186038B0}\band\favicon.png (611 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\quote\quotelist.xml (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\kk\welcome\css\b-sg-list__item_4.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C25E60F0-88DE-445E-AB4E-55F4700A90E4}\birth.png (559 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8LUVCT2R\product[1] (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{AC8A2266-D92B-4CCE-AEB5-0FEBA0FD2C75}\icons\groups.png (626 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\tr\welcome\ie\btn-check_.gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\yaru.messages.xml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\ru\userinfo.dtd (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GXARCLEV\facebook[1] (681 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C2E33C62-1E25-49E9-BABA-DBA2527F4C57}\notifications.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\ru\spelling.dtd (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WXU749EJ\product[1] (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8LUVCT2R\login[1] (710 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{AC8A2266-D92B-4CCE-AEB5-0FEBA0FD2C75}\icons\notesmark.png (506 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\ru\yaru.dtd (932 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\kk\login.dtd (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{6074A32F-35A3-4893-B290-A4BD186038B0}\band\blank.gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\srs.xml (473 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\weather.png (515 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\icons\weather.png (633 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\tr\pagetranslator-tooltips.xml (526 bytes)
%Documents and Settings%\%current user%\Application Data\Yandex\ui (38 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\textonly.messages.xml (277 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\fastdial\thumbnails\library.jpg (353 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{6074A32F-35A3-4893-B290-A4BD186038B0}\mc.messages.xml (459 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\ic\1.png (176 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C2E33C62-1E25-49E9-BABA-DBA2527F4C57}\locale\cs\facebook.dtd (667 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{6074A32F-35A3-4893-B290-A4BD186038B0}\icons\badge\active_press.png (316 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\pagetranslator.xml (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\cs\welcome\css\b-sg-list__pointer.png (251 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C25E60F0-88DE-445E-AB4E-55F4700A90E4}\friend.png (668 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\tr\common.dtd (204 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\kk\TranslateBtn.dtd (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\uk\bookmark.dtd (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\kk\spelling.dtd (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\fotki.messages.xml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\geolocation\geolocation.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\tr\logo.dtd (118 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\ru\ic.dtd (766 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\icons\narod.png (739 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\weather\i-cloud-snow.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\kk\ic.dtd (876 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\js\img\bg.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\COR8IIDQ\login[1] (817 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\money.messages.xml (519 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\en\srs.dtd (796 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\en\town.dtd (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\opinions\2.png (508 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\tr\money.dtd (356 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\about\logo-ie-tiny.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\uk\welcome\index.html (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\en\quote.dtd (615 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{6074A32F-35A3-4893-B290-A4BD186038B0}\band\css\main.ie.css (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\userinfo.xml (479 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\kk\fotki.dtd (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\kk\quote\quotelist.dtd (87 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\en\welcome\css\b-sg-list__item_4.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\tr\logobutton\logoconf.dtd (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\cs\welcome\css\b-sg-header.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\tr\opinions.dtd (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\be\welcome\css\b-sg-header.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\logobutton\logo.png (632 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{6074A32F-35A3-4893-B290-A4BD186038B0}\band\trobber.gif (588 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\ru\welcome\css\b-sg-list__item_2.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\js\inject.js (745 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\weather\i-ch.png (930 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\icons\maps.png (723 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\en\services.dtd (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C25E60F0-88DE-445E-AB4E-55F4700A90E4}\odnoklassniki.dll (5506 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\wp\css\b-footer-links\b-footer-links.css (270 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\ru\quote.dtd (848 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\tr\welcome\css\b-sg-list__item_2.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\fastdial\thumbnails\mail.jpg (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\tr\spam.dtd (358 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\uk\welcome\ie\btn-check.gif (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\http://bar-widgets.yandex.ru/packages/approved/115/manifest.xml.zip (1281 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GXARCLEV\TranslateBtn[1] (892 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\COR8IIDQ\textonly[1] (153 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\cs\textonly.dtd (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{6074A32F-35A3-4893-B290-A4BD186038B0}\band\css\main.ie7.css (32 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\ru\widget-news.dtd (677 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GXARCLEV\messages[1] (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\weather\i-rain-ch2-summer.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\ru\welcome\css\style.css (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\kk\welcome\css\b-sg-list__item_2.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\weather\i-thund-rain.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\cs\fastdial\config.xml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\kk\welcome\css\b-sg-list__item_1.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\ru\textonly.dtd (257 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\be\welcome\ie\btn-home.gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GXARCLEV\opinions[1] (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\pagetranslator-disabled.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\kk\welcome\css\b-sg-list__pointer.png (251 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\YandexBarIE.log (14088 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\en\quote\quotelist.dtd (63 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\kk\quote.dtd (778 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\icons\dicts.png (562 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{AC8A2266-D92B-4CCE-AEB5-0FEBA0FD2C75}\icons\profilelocked.png (674 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\icons\schedule.png (774 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\cs\welcome\css\b-sg-list__item_4.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\be\town.dtd (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\kk\bookmark.dtd (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WXU749EJ\pagetranslator[1] (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\COR8IIDQ\mc[1] (569 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\uk\moikrug.dtd (800 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\be\subscription.dtd (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\cs\TranslateBtn.dtd (975 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\traffic\yellow.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\icons\tv.png (600 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\kk\welcome\index.html (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\tr\about\vendorlogo.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\ru\logobutton\logoconf.dtd (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8LUVCT2R\widget-news[1] (437 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\icons\photos.png (771 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\en\welcome\icon1.ico (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\kk\welcome\css\b-sg-text-list__item.gif (47 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\uk\welcome\ie\welcome.html (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C2E33C62-1E25-49E9-BABA-DBA2527F4C57}\facebook_lock.png (775 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\cs\welcome\ie\welcome.html (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\icons\find.png (739 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\cs\welcome\css\b-sg-list__item_1.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{AC8A2266-D92B-4CCE-AEB5-0FEBA0FD2C75}\icons\matches.png (733 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\tr\fotki.dtd (887 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\uk\textonly.dtd (263 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\be\welcome\css\b-sg-list__pointer.png (251 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\tr\geolocation.dtd (75 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{6074A32F-35A3-4893-B290-A4BD186038B0}\band\css\button_close_normal.png (791 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WXU749EJ\smartbox[1] (409 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C2E33C62-1E25-49E9-BABA-DBA2527F4C57}\facebook_on.png (667 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{AC8A2266-D92B-4CCE-AEB5-0FEBA0FD2C75}\icons\friendsmark.png (678 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\en\welcome\css\b-sg-text-list__item.gif (47 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\opinions\4.png (507 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\js\lightBox_overlayie.css (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\cs\fastdial\logo.png (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\mail.messages.xml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{AC8A2266-D92B-4CCE-AEB5-0FEBA0FD2C75}\icons\messageslocked.png (614 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{AC8A2266-D92B-4CCE-AEB5-0FEBA0FD2C75}\locale\en\vkontakte.dtd (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\weather\i-rain-grad.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C2E33C62-1E25-49E9-BABA-DBA2527F4C57}\locale\uk\facebook.dtd (917 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\tr\welcome\icon1.ico (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\uk\browser\browserconf.dtd (183 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\weather\i-night-cloud.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{6074A32F-35A3-4893-B290-A4BD186038B0}\locale\ru\mc.dtd (386 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\uk\welcome\css\b-sg-list__item_4.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C2E33C62-1E25-49E9-BABA-DBA2527F4C57}\events.png (478 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GXARCLEV\product[1] (200 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WXU749EJ\spellchecker[1] (507 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\uk\common.dtd (232 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\quote\stock_down.png (583 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\wp\css\l-table\l-table.css (668 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\js\jquery-1.5.1.min.js (314 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\wp\css\l-footer\l-footer.css (164 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\weather\i-snow.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\browser\browserconf.xml (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\COR8IIDQ\defaults[2] (400 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\presets\http://bar.yandex.ru/presets/default-partner.xml (147 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\icons\afisha.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\ru\logo.dtd (156 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\search.xml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\wp\css\b-menu-ico\b-menu-ico__img.png (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\tr\welcome\css\b-sg-header.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\uk\pagetranslator.dtd (534 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\http://bar-widgets.yandex.ru/packages/approved/176/manifest.xml.zip (4545 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\be\mail.dtd (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{3F580847-72EB-4D1D-937C-6B324D24137E}\locale\ru\radio.dtd (108 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\ru\opinions.dtd (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\ru\welcome\ie\btn-home.gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\icons\games.png (536 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\uk\pagetranslator-tooltips.xml (815 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\traffic\green.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\be\textonly.dtd (265 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\cs\geolocation.dtd (72 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\tr\welcome\ie\btn-home_.gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{6074A32F-35A3-4893-B290-A4BD186038B0}\icons\icon1.png (628 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\uk\welcome\images\example.png (1176 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\about\logo-ie-large.png (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\kk\fastdial\logo-clear.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\uk\welcome\css\b-sg-list__pointer.png (251 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\bookmark\bookmark.png (668 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\cs\quote\quotelist.dtd (64 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\be\welcome\ie\btn-check_.gif (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\cs\welcome\ie\btn-home_.gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\srs.messages.xml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\COR8IIDQ\mail[1] (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\icons\direct.png (567 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\be\spam.dtd (434 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{AC8A2266-D92B-4CCE-AEB5-0FEBA0FD2C75}\icons\eventslocked.png (851 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C2E33C62-1E25-49E9-BABA-DBA2527F4C57}\locale\be\facebook.dtd (911 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C2E33C62-1E25-49E9-BABA-DBA2527F4C57}\groups.png (708 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\uk\services\features.dtd (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{6074A32F-35A3-4893-B290-A4BD186038B0}\data\config.xml (94 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\tr\geobase.xml (2039 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\be\welcome\css\b-sg-list__item_1.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\uk\userinfo.dtd (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8LUVCT2R\messages[1] (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\en\spelling.dtd (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\SRS64.dll (1989 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\ru\moikrug.dtd (783 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\tr\services.dtd (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\tr\pagetranslator.dtd (381 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\be\login.dtd (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\be\welcome\index.html (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\uk\opinions.dtd (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\ru\welcome\css\b-sg-list__item_4.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\fotki.xml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{AC8A2266-D92B-4CCE-AEB5-0FEBA0FD2C75}\icons\eventsmark.png (832 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\COR8IIDQ\smartbox[1] (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\translator.dll (3635 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\icons\yaru.png (644 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\money\money.png (578 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\search\gripper.png (203 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\be\quote\quotelist.dtd (85 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\tr\search.dtd (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WXU749EJ\town[1] (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\icons\tab.png (229 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\en\userinfo.dtd (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{AC8A2266-D92B-4CCE-AEB5-0FEBA0FD2C75}\icons\friendslocked.png (724 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\icons\calendar.png (525 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\kk\spam.dtd (423 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\cs\geobase.xml (1177 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C2E33C62-1E25-49E9-BABA-DBA2527F4C57}\messages_lock.png (693 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\uk\about\product.dtd (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\en\browser\browserconf.dtd (169 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\geobase.xml (2734 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\weather\i-snowstorm.png (983 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\kk\widget-news.dtd (766 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\http://bar-widgets.yandex.ru/packages/approved/140/manifest.xml.zip (1281 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\weather\i-ch-snow.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\logo.xml (341 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\kk\common.dtd (227 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\moikrug.xml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\be\opinions.dtd (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\ru\welcome\css\b-sg-list__item_1.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C2E33C62-1E25-49E9-BABA-DBA2527F4C57}\note.png (339 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\ie\product.xml (200 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\spam.messages.xml (497 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\be\srs.dtd (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\en\logo.dtd (116 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\lenta.xml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\icons\addresses.png (636 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\be\userinfo.dtd (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\readability\readability-print.css (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\be\welcome\ie\btn-check.gif (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{AC8A2266-D92B-4CCE-AEB5-0FEBA0FD2C75}\icons\notes.png (415 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\kk\pagetranslator-tooltips.xml (683 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\be\fastdial\logo-clear.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\cs\quote.dtd (626 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{AC8A2266-D92B-4CCE-AEB5-0FEBA0FD2C75}\icons\audio.png (510 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\opinions\0.png (539 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{AC8A2266-D92B-4CCE-AEB5-0FEBA0FD2C75}\locale\be\vkontakte.dtd (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C2E33C62-1E25-49E9-BABA-DBA2527F4C57}\facebook.dtd (920 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C2E33C62-1E25-49E9-BABA-DBA2527F4C57}\status.png (473 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\login.messages.xml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\cs\subscription.dtd (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\en\widget-news.dtd (437 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\logo\logo.png (409 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\icons\fav-bing.png (347 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\tr\welcome\images\example.png (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\uk\search.dtd (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\wp\css\b-suggest\_ie\b-suggest__img_type2.gif (588 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\en\TranslateBtn.dtd (892 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\ru\about\product.dtd (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GXARCLEV\vkontakte[1] (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\cs\welcome\index.html (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\wp\css\b-footer\b-footer.css (78 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\widget-news.xml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\wp\css\b-menu-ico\b-menu-ico.css (788 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\search\search.png (487 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C2E33C62-1E25-49E9-BABA-DBA2527F4C57}\locale\ru\facebook.dtd (920 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GXARCLEV\spam[1] (318 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\cs\welcome\icon1.ico (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\quote\gold_up.png (658 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\icons\navigate.png (737 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\be\pagetranslator-tooltips.xml (773 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\icons\fav-yandex.png (658 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{6074A32F-35A3-4893-B290-A4BD186038B0}\band\css\button_content.png (588 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C2E33C62-1E25-49E9-BABA-DBA2527F4C57}\locale\kk\facebook.dtd (913 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\uk\welcome\css\b-sg-list__item_1.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\ru\welcome\ie\btn-check.gif (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WXU749EJ\opinions[1] (719 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8LUVCT2R\money[1] (979 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\weather\i-fog.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\COR8IIDQ\common[1] (564 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\ru\quote\quotelist.dtd (90 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{AC8A2266-D92B-4CCE-AEB5-0FEBA0FD2C75}\icons\groupslocked.png (707 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\mail.xml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GXARCLEV\fotki[1] (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\be\bookmark.dtd (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\quote.messages.xml (683 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\icons\icon_16.png (643 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C2E33C62-1E25-49E9-BABA-DBA2527F4C57}\facebook.xml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\cs\welcome\ie\btn-home.gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{AC8A2266-D92B-4CCE-AEB5-0FEBA0FD2C75}\icons\photoslocked.png (615 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\smartbox.xml (409 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{AC8A2266-D92B-4CCE-AEB5-0FEBA0FD2C75}\profile.messages.xml (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\wp\css\b-video\b-video.css (103 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\icons\spam.png (798 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\welcome\ie\widgets.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\ru\welcome\css\b-sg-list__pointer.png (251 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\uk\login.dtd (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GXARCLEV\mc[1] (284 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\en\logobutton\logoconf.dtd (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C25E60F0-88DE-445E-AB4E-55F4700A90E4}\notif.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\toolbar\autoinst.xml (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\cs\services\features.dtd (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\cs\fotki.dtd (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\ru\fotki.dtd (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\icons\advertising.png (799 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8LUVCT2R\radio[1] (417 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\bookmark\buttonAdd.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\en\welcome\css\b-sg-list__item_3.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\be\moikrug.dtd (818 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\ru\welcome\css\b-sg-list__item_3.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\ru\fastdial\logo-clear.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\en\pagetranslator-tooltips.xml (526 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\subscription\subscription.png (620 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\opinions.xml (719 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\be\common.dtd (232 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\tr\fastdial\product.dtd (804 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\ru\spam.dtd (431 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\be\logo.dtd (161 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GXARCLEV\logo[1] (116 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\COR8IIDQ\radio[1] (496 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\en\search.dtd (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\be\welcome\ie\welcome.html (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\fastdial\product.xml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{6074A32F-35A3-4893-B290-A4BD186038B0}\band\pop-top_correction.htm (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GXARCLEV\odnoklassniki[1] (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C2E33C62-1E25-49E9-BABA-DBA2527F4C57}\friends.png (743 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\welcome\ie\favicon.ico (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C2E33C62-1E25-49E9-BABA-DBA2527F4C57}\share.png (753 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WXU749EJ\odnoklassniki[1] (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\icons\google.png (856 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Updater\barie\statistics.xml (991 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\en\welcome\css\b-sg-list__item_2.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\wp\css\b-suggest\_ie\b-suggest__img_type3.png (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\TranslateBtn.png (636 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{AC8A2266-D92B-4CCE-AEB5-0FEBA0FD2C75}\icons\friends.png (564 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\ru\login.dtd (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\readability\sprite-readability.png (588 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\kk\welcome\css\b-sg-list__item_3.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\uk\widget-news.dtd (664 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C2E33C62-1E25-49E9-BABA-DBA2527F4C57}\messages_2.png (414 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\COR8IIDQ\defaults[1] (1600 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8LUVCT2R\textonly[1] (375 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\icons\metrics.png (541 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\services\features.xml (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8LUVCT2R\geolocation[1] (330 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\auth_overlay.png (406 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\ic\6.png (184 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\kk\welcome\ie\btn-home_.gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C2E33C62-1E25-49E9-BABA-DBA2527F4C57}\video.png (543 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\readability\applied.png (411 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\ru\money.dtd (531 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\kk\fastdial\config.xml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WXU749EJ\cy[1] (531 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\about\logo-ie-medium.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\readability\ready.png (431 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\kk\welcome\images\example.png (1176 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\COR8IIDQ\common[2] (188 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\search.messages.xml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\translator.messages.xml (894 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WXU749EJ\translator[1] (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\uk\subscription.dtd (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\ru\subscription.dtd (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\cs\spam.dtd (315 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\icons\search.png (592 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\fastdial\thumbnails\yandex.jpg (157 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\cs\bookmark.dtd (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\weather\i-cloud.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\be\geolocation.dtd (124 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\be\welcome\css\b-sg-list__item_3.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\cs\moikrug.dtd (602 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\cs\widget-news.dtd (437 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\tr\fastdial\logo.png (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\kk\money.dtd (579 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\cs\welcome\images\example.png (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{3F580847-72EB-4D1D-937C-6B324D24137E}\locale\cs\radio.dtd (79 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\installer\place-before.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\uk\welcome\icon1.ico (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\quote\gold_down.png (667 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{AC8A2266-D92B-4CCE-AEB5-0FEBA0FD2C75}\icons\profilemark.png (631 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\uk\srs.dtd (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\wp\css\b-suggest\_ie\b-suggest__img_type1.png (1372 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\uk\logo.dtd (167 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\icons\market.png (672 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\lenta.messages.xml (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\uk\quote\quotelist.dtd (84 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\tr\welcome\css\b-sg-text-list__item.gif (47 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\js\img\setup.gif (105 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\uk\fastdial\logo.png (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\js\img\toggle.gif (57 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\wp\css\b-logo\b-logo.png (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\money.xml (979 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\en\common.dtd (188 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\be\TranslateBtn.dtd (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C25E60F0-88DE-445E-AB4E-55F4700A90E4}\guest.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\tr\icons\yandex.png (604 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\icons\job.png (572 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\search\teleport.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\tr\welcome\ie\btn-check.gif (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\smartbox.dll (5530 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\ru\welcome\css\b-sg-header.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\js\img\b-spin-50.gif (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\welcome\ie\bar-ie.css (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\userinfo.messages.xml (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\be\yaru.dtd (953 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GXARCLEV\profile[1] (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\tr\welcome\css\b-sg-list__item_1.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\spellchecker.xml (507 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\ic\4.png (217 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\tr\moikrug.dtd (606 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\moikrug.messages.xml (946 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\icons\cards.png (782 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\cs\money.dtd (327 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\tr\TranslateBtn.dtd (913 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{AC8A2266-D92B-4CCE-AEB5-0FEBA0FD2C75}\locale\uk\vkontakte.dtd (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{6074A32F-35A3-4893-B290-A4BD186038B0}\locale\en\mc.dtd (284 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\icons\mycircle.png (728 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\kk\opinions.dtd (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\login.xml (710 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\SRS.dll (3321 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\cs\logobutton\logoconf.dtd (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\uk\spam.dtd (404 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\fotki\fotki.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\spam\spam_disable.png (686 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\cs\spelling.dtd (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{AC8A2266-D92B-4CCE-AEB5-0FEBA0FD2C75}\icons\noteslocked.png (552 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\ru\welcome\index.html (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\uk\welcome\css\b-sg-list__item_2.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\be\fastdial\logo.png (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{AC8A2266-D92B-4CCE-AEB5-0FEBA0FD2C75}\locale\ru\vkontakte.dtd (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\data\config.xml (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\dot.png (293 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GXARCLEV\smartbox[1] (410 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\en\welcome\css\b-sg-header.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\kk\srs.dtd (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\tr\mail.dtd (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\tr\bookmark.dtd (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{6074A32F-35A3-4893-B290-A4BD186038B0}\icons\badge\hover.png (297 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C25E60F0-88DE-445E-AB4E-55F4700A90E4}\photo.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\uk\spelling.dtd (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\ru\browser\browserconf.dtd (181 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\wp\css\b-suggest-menu\b-suggest-menu.ie.css (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\smartbox.messages.xml (993 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\uk\ic.dtd (751 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\weather\i-sun.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\spam\spam_enable.png (685 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\uk\welcome\ie\btn-check_.gif (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WXU749EJ\vkontakte[1] (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\COR8IIDQ\autoinst[1] (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\welcome\ie\bg-bottom-ie.jpg (1960 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\icons\video.png (538 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{6074A32F-35A3-4893-B290-A4BD186038B0}\locale\tr\mc.dtd (304 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\kk\town.dtd (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\icons\news.png (637 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\icons\searchprovider.png (844 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C2E33C62-1E25-49E9-BABA-DBA2527F4C57}\news_feed.png (463 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WXU749EJ\common[1] (188 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\uk\welcome\css\style.css (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\http://bar-widgets.yandex.ru/packages/approved/143/manifest.xml.zip (1281 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WXU749EJ\search[1] (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\wp\css\b-suggest\_ie\b-suggest__img_type1.gif (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\COR8IIDQ\yaru[2] (655 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\wp\css\b-suggest\b-suggest.ie.css (518 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{6074A32F-35A3-4893-B290-A4BD186038B0}\band\pop-top_suggest_popup.htm (866 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\mail\mail.png (565 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\ru\mail.dtd (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\kk\pagetranslator.dtd (488 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\uk\mail.dtd (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\welcome\ie\bg-top.jpg (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\be\search.dtd (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\kk\welcome\css\b-sg-header.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C2E33C62-1E25-49E9-BABA-DBA2527F4C57}\friends_requests.png (887 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C2E33C62-1E25-49E9-BABA-DBA2527F4C57}\facebook.dll (2146 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\quote\currency_up.png (565 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\.manifest.mf (132 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\en\fotki.dtd (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\en\welcome\images\example.png (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\spellchecker.messages.xml (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\translator.xml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\cs\browser\browserconf.dtd (169 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WXU749EJ\defaults[1] (400 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\js\img\ya-logo.jpg (588 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\uk\quote.dtd (799 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\uk\fastdial\logo-clear.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\COR8IIDQ\rambler[1] (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\weather\i-night.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C25E60F0-88DE-445E-AB4E-55F4700A90E4}\disc.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{AC8A2266-D92B-4CCE-AEB5-0FEBA0FD2C75}\icons\messagesmark.png (597 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{AC8A2266-D92B-4CCE-AEB5-0FEBA0FD2C75}\icons\videosmark.png (865 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\weather\i-rain-ch-summer.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\uk\welcome\css\b-sg-text-list__item.gif (47 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\ru\pagetranslator.dtd (526 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\cs\common.dtd (193 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\ic\0.png (177 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\ru\welcome\ie\btn-home_.gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\kk\browser\browserconf.dtd (182 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\uk\yaru.dtd (927 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\icons\blogs.png (655 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{6074A32F-35A3-4893-B290-A4BD186038B0}\icons\badge\anim_0.png (254 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\widget-news.png (708 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\en\mail.dtd (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\opinions\5.png (460 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\COR8IIDQ\srs[1] (796 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\tr\welcome\index.html (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\be\fastdial\product.dtd (918 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{3F580847-72EB-4D1D-937C-6B324D24137E}\streamplayer.exe (1765 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GXARCLEV\srs[1] (1269 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GXARCLEV\spelling[1] (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\COR8IIDQ\product[2] (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\tr\widget-news.dtd (492 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\quotelist.xml (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\wp\css\l-footer\l-footer__bg.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{AC8A2266-D92B-4CCE-AEB5-0FEBA0FD2C75}\icons\videos.png (836 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\COR8IIDQ\quote[1] (615 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\cs\welcome\css\style.css (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\cs\about\product.dtd (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\quote\quotelist.xsl (729 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\en\welcome\css\b-sg-list__item_1.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\icons\money.png (566 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8LUVCT2R\bookmark[1] (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\COR8IIDQ\town[1] (980 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\ru\srs.dtd (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\wp\css\b-suggest\_ie\b-suggest__img_type2.png (1176 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\be\welcome\css\b-sg-list__item_4.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\be\logobutton\logoconf.dtd (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\logo\settings.png (827 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GXARCLEV\ic[1] (567 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\readability\readability.js (314 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\weather\i-cloud-rain.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\welcome\ie\icons.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\tr\browser\browserconf.dtd (169 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\search\dropdown.png (207 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\weather\i-rain-summer.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GXARCLEV\common[1] (376 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\pagetranslator.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\icons\favorite.png (466 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GXARCLEV\odnoklassniki[1] (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GXARCLEV\defaults[1] (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\http://bar-widgets.yandex.ru/packages/approved/140/manifest.xml.zip (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\http://bar-widgets.yandex.ru/packages/approved/117/manifest.xml.zip (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\COR8IIDQ\common[1] (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\COR8IIDQ\srs[1] (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GXARCLEV\mc[1] (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\http://bar-widgets.yandex.ru/packages/approved/118/manifest.xml.zip (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WXU749EJ\vkontakte[1] (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GXARCLEV\facebook[1] (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\http://bar-widgets.yandex.ru/packages/approved/115/manifest.xml.zip (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GXARCLEV\profile[1] (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GXARCLEV\srs[1] (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GXARCLEV\radio[1] (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\http://bar-widgets.yandex.ru/packages/approved/91/manifest.xml.zip (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\COR8IIDQ\odnoklassniki[1] (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GXARCLEV\smartbox[1] (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\COR8IIDQ\common[2] (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\COR8IIDQ\mc[1] (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\COR8IIDQ\defaults[1] (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GXARCLEV\rambler[1] (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\COR8IIDQ\defaults[2] (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\http://bar-widgets.yandex.ru/packages/approved/143/manifest.xml.zip (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WXU749EJ\facebook[1] (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\http://bar-widgets.yandex.ru/packages/approved/176/manifest.xml.zip (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WXU749EJ\defaults[1] (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GXARCLEV\common[1] (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\COR8IIDQ\smartbox[1] (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\COR8IIDQ\radio[1] (0 bytes)

The process regsvr32.exe:2508 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\YandexBarIE.log (912 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WXU749EJ\product[4] (876 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Updater\vb\statistics.xml (988 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GXARCLEV\product[2] (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GXARCLEV\config[1] (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8LUVCT2R\product[2] (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\COR8IIDQ\product[4] (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WXU749EJ\product[3] (876 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\FastDialIE.log (163 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8LUVCT2R\favorites[1] (290 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\COR8IIDQ\product[3] (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\vb\fav\fav_full.xml (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\vb\fav\fav_lite.xml (5 bytes)

The process MsiExec.exe:1372 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\Nichrome\User Data\Default\History (2855 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Opera\Opera\icons\mail.yandex.ru.idx (62 bytes)
%Documents and Settings%\%current user%\Favorites\Links\Словари.url (295 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Nichrome\User Data\Default\Top Sites-journal (7514 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Nichrome\User Data\Default\Local Storage\chrome-extension_nkcpopggjcjkiicpenikeogioednjeac_0.localstorage-journal (5033 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Opera\Opera\icons\maps.yandex.ru.ico (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Opera\Opera\icons\maps.yandex.ru.idx (62 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Web Data (1315 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Opera\Opera\icons\disk.yandex.ru.idx (62 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Opera\Opera\icons\video.yandex.ru.idx (64 bytes)
%Documents and Settings%\%current user%\Favorites\Links\Маркет.url (293 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Xpom\User Data\Default\Local Storage\chrome-extension_nkcpopggjcjkiicpenikeogioednjeac_0.localstorage-journal (5033 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Internet Explorer\Services\news.yandex.ru.ico (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Chromium\User Data\Default\Favicons-journal (9552 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Nichrome\User Data\Default\Favicons (6469 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Bromium\User Data\Local State (96 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Opera\Opera\icons\market.yandex.ru.ico (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Local State (96 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Internet Explorer\Services\music.yandex.ru.ico (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Opera\Opera\icons\video.yandex.ru.ico (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\etilqs_pClvpdwyREOi6Hh (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Opera\Opera\icons\disk.yandex.ru.ico (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Opera\Opera\icons\news.yandex.ru.idx (62 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Chromium\User Data\Default\History-journal (7514 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\nahd6ha2.default\chromeappsstore.sqlite (107 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Chromium\User Data\Default\Web Data-journal (9466 bytes)
%Documents and Settings%\%current user%\Favorites\Links\Новости.url (289 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\nahd6ha2.default\searchplugins\yandex.ru-054209.xml (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Internet\User Data\Local State (96 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Chromium\User Data\Default\Local Storage\chrome-extension_nkcpopggjcjkiicpenikeogioednjeac_0.localstorage (299 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Preferences (500 bytes)
%Documents and Settings%\%current user%\Favorites\Links\Диск.url (289 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Chromium\User Data\Default\Bookmarks (969 bytes)
%Documents and Settings%\%current user%\Favorites\Links\Видео.url (291 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Chromium\User Data\Default\Preferences (500 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\nahd6ha2.default\prefs.js (918 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Bookmarks (969 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Favicons (6469 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Nichrome\User Data\Default\Top Sites (4779 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Xpom\User Data\Default\Favicons (4731 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\History (2855 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Chromium\User Data\Default\Top Sites-journal (7514 bytes)
%Documents and Settings%\%current user%\Favorites\Links\Музыка.url (291 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Xpom\Application\First Run (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Chromium\User Data\Default\Web Data (1315 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Internet Explorer\Services\www.yandex.ru.ico (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Local Storage\chrome-extension_nkcpopggjcjkiicpenikeogioednjeac_0.localstorage (299 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Nichrome\User Data\Local State (96 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Nichrome\User Data\Default\Web Data-journal (9466 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Top Sites-journal (7514 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Internet Explorer\Services\mail.yandex.ru.ico (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\etilqs_Ed3eQTeScebyQfe (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Comodo\Dragon\User Data\Local State (96 bytes)
%Documents and Settings%\%current user%\Favorites\Links\Карты.url (289 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Opera\Opera\icons\www.yandex.ru.idx (60 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Internet\User Data\Default\Preferences (378 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\etilqs_m6A43M8eSSaIW8A (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Internet Explorer\Services\maps.yandex.ru.ico (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Xpom\User Data\Default\Preferences (419 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Xpom\User Data\Default\Favicons-journal (5042 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Chromium\User Data\Default\Favicons (6469 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Preferences (378 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Nichrome\User Data\Default\Preferences (500 bytes)
%Documents and Settings%\%current user%\Application Data\Opera\Opera\bookmarks.adr (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\etilqs_KBFtDbYHHgGx7Fb (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Web Data-journal (9466 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Internet Explorer\Services\disk.yandex.ru.ico (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Bromium\User Data\Default\Preferences (378 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Chromium\Application\First Run (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Chromium\User Data\Local State (96 bytes)
%Documents and Settings%\%current user%\Favorites\Links\Почта.url (289 bytes)
%Documents and Settings%\%current user%\Application Data\Opera\Opera\operaprefs.ini (336 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Xpom\User Data\Default\Web Data (1315 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Chromium\User Data\Default\History (2855 bytes)
%Documents and Settings%\%current user%\Application Data\Opera\Opera\toolbar\standard_toolbar.ini (646 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Opera\Opera\icons\www.yandex.ru.ico (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Chromium\User Data\Default\Local Storage\chrome-extension_nkcpopggjcjkiicpenikeogioednjeac_0.localstorage-journal (5033 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Nichrome\User Data\Default\History-journal (7514 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Internet Explorer\Services\market.yandex.ru.ico (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Local Storage\chrome-extension_nkcpopggjcjkiicpenikeogioednjeac_0.localstorage-journal (5033 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Opera\Opera\icons\mail.yandex.ru.ico (5 bytes)
%Documents and Settings%\%current user%\Application Data\Opera\Opera\sessions\autosave.win (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Nichrome\User Data\Default\Favicons-journal (9552 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Nichrome\User Data\Default\Local Storage\chrome-extension_nkcpopggjcjkiicpenikeogioednjeac_0.localstorage (299 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Nichrome\Application\First Run (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Xpom\User Data\Default\Local Storage\chrome-extension_jaocgokledfmfebefgbeokdodbbdjhdd_0.localstorage (18323 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Chromium\User Data\Default\Top Sites (4779 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Opera\Opera\icons\music.yandex.ru.ico (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Xpom\User Data\Default\Local Storage\chrome-extension_jaocgokledfmfebefgbeokdodbbdjhdd_0.localstorage-journal (5033 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Nichrome\User Data\Default\Bookmarks (969 bytes)
%Documents and Settings%\%current user%\Application Data\Opera\Opera\search.ini (587 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Xpom\User Data\Local State (96 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\vendor.xml (1293 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\History-journal (7514 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Internet Explorer\Services\slovari.yandex.ru.ico (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Favicons-journal (9552 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\Application\First Run (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Opera\Opera\icons\market.yandex.ru.idx (66 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\nahd6ha2.default\chromeappsstore.sqlite-journal (3282 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Opera\Opera\icons\slovari.yandex.ru.ico (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Internet Explorer\Services\video.yandex.ru.ico (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Nichrome\User Data\Default\Web Data (1315 bytes)
%Documents and Settings%\%current user%\Application Data\Opera\Opera\speeddial.ini (260 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Xpom\User Data\Default\Bookmarks (969 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Opera\Opera\icons\slovari.yandex.ru.idx (68 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Opera\Opera\icons\news.yandex.ru.ico (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Xpom\User Data\Default\Web Data-journal (9466 bytes)
%Documents and Settings%\%current user%\Favorites\Links\Яндекс.url (287 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\profiles.ini (109 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Xpom\User Data\Default\Local Storage\chrome-extension_nkcpopggjcjkiicpenikeogioednjeac_0.localstorage (299 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Opera\Opera\icons\music.yandex.ru.idx (64 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\nahd6ha2.default\sessionstore.js (374 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Top Sites (4779 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\Xpom\User Data\Default\Web Data-journal (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Xpom\User Data\Default\Local Storage\chrome-extension_jaocgokledfmfebefgbeokdodbbdjhdd_0.localstorage-journal (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Local Storage\chrome-extension_nkcpopggjcjkiicpenikeogioednjeac_0.localstorage-journal (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Nichrome\User Data\Default\Top Sites-journal (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Web Data-journal (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Nichrome\User Data\Default\Local Storage\chrome-extension_nkcpopggjcjkiicpenikeogioednjeac_0.localstorage-journal (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Xpom\User Data\Default\Local Storage\chrome-extension_nkcpopggjcjkiicpenikeogioednjeac_0.localstorage-journal (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Nichrome\User Data\Default\History-journal (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Top Sites-journal (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Chromium\User Data\Default\Local Storage\chrome-extension_nkcpopggjcjkiicpenikeogioednjeac_0.localstorage-journal (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Chromium\User Data\Default\Favicons-journal (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Nichrome\User Data\Default\Favicons-journal (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Nichrome\User Data\Default\Web Data-journal (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\vendor.xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Xpom\User Data\Default\Favicons-journal (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Chromium\User Data\Default\Top Sites-journal (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\History-journal (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Favicons-journal (0 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\nahd6ha2.default\chromeappsstore.sqlite-journal (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Chromium\User Data\Default\History-journal (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Chromium\User Data\Default\Web Data-journal (0 bytes)

The process MsiExec.exe:2536 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GXARCLEV\product[1] (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\YandexBarIE.log (124 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GXARCLEV\messages[1] (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\COR8IIDQ\product[5] (200 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Updater\barie\statistics.xml (1158 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8LUVCT2R\messages[2] (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8LUVCT2R\product[1] (1 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GXARCLEV\product[1] (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\COR8IIDQ\product[2] (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8LUVCT2R\messages[1] (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8LUVCT2R\product[1] (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GXARCLEV\messages[1] (0 bytes)

The process MsiExec.exe:2100 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\vendor.xml (1293 bytes)
%Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\nahd6ha2.default\prefs.js (76 bytes)
%Documents and Settings%\%current user%\Application Data\Yandex\clids-barff.xml (394 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\vendor.xml (0 bytes)

The process MsiExec.exe:2548 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\YandexBarIE.log (336 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WXU749EJ\product[4] (876 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Updater\vb\statistics.xml (1154 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GXARCLEV\product[2] (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\COR8IIDQ\product[2] (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8LUVCT2R\product[2] (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WXU749EJ\product[3] (876 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\COR8IIDQ\product[3] (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GXARCLEV\config[1] (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\vb\fav\fav_full.xml (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\vb\fav\fav_lite.xml (5 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WXU749EJ\product[4] (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GXARCLEV\product[2] (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GXARCLEV\config[1] (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8LUVCT2R\product[2] (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\COR8IIDQ\product[4] (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WXU749EJ\product[3] (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\COR8IIDQ\product[3] (0 bytes)

Registry activity

The process taskkill.exe:516 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "98 1F AB D1 ED 3A 69 8C C4 29 23 19 54 E2 AB 0B"

The process mediaget.exe:2792 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Media Get LLC\MediaGet2\transfers]
"detailedViewSortOrder" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"Guid" = "8aefce96-4618-42ff-a057-3536aa78233e"

[HKCU\Software\Media Get LLC\MediaGet2\transfers\transfers\1]
"ID" = "d73cf14c2f8d2609604053c89c25c1096cb3a483"

[HKCU\Software\Media Get LLC\MediaGet2\application\proxy]
"User" = ""

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"EventMessageFile" = "%System%\ESENT.dll"

[HKCU\Software\Media Get LLC\MediaGet2-systemScope\installer]
"bubbles_id" = ""

[HKCU\Software\Media Get LLC\MediaGet2\UserShareEngine]
"totalCount" = "0"

[HKCU\Software\Media Get LLC\MediaGet2-systemScope\installer]
"playlist_url" = ""

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryCount" = "16"

[HKCU\Software\Media Get LLC\MediaGet2\transfers\transfers\3]
"Type" = "0"

[HKCU\Software\Media Get LLC\MediaGet2\MainWindow]
"CurrentTab" = "2"

[HKCU\Software\Media Get LLC\MediaGet2\TorrentAddDialog]
"dontShowWebAddDialog" = "false"

[HKCU\Software\Media Get LLC\MediaGet2\transfers\transfers\2]
"fileExist" = "false"

[HKCU\Software\Media Get LLC\MediaGet2-systemScope\mediaget_info]
"reseller" = "AAAAU3jaAVMArP8b9vjuyu2P IR3C3hgCxNQSzUX/F/1KRdZYg8hXkHVTacHdHtNkpZ/mL4pwxeioS6WI19zizSYvgX68fXfLky7R7wy16LsbG9kDSE1CSG3cHAp5GdqJlM="
"sendOnInstall" = "AAAAS3jaAUsAtP8b9vjuyu2P IR3C3hgCxNQSzUX/F/1KRdZYg8hTZKWf5i KcMXoqEuliNfc4s0mL4F vH13y5M2jmj7l5rSw0yVb/vlWAYkK/YBwlZDyNe"

[HKCU\Software\Media Get LLC\MediaGet2\ExtentionsAssociator]
"torrentAssociated" = "false"

[HKCU\Software\Media Get LLC\MediaGet2\bittorrent]
"dlSpeedLimit" = "Type: REG_QWORD, Length: 8"

[HKCU\Software\Media Get LLC\MediaGet2-systemScope\mediaget_info]
"Version" = "2.01.3533"

[HKCU\Software\Media Get LLC\MediaGet2-systemScope\installer]
"hp_before" = ""

[HKCU\Software\Media Get LLC\MediaGet2\transfers\transfers\3]
"FileName" = "C:/Documents and Settings/adm/Local Settings/Application Data/Media Get LLC/MediaGet2/player_plugins_2.2.2-5.22.7z"

[HKCU\Software\Media Get LLC\MediaGet2\Gettingstarted]
"hasShownSearchLineTutorial" = "false"

[HKCU\Software\Media Get LLC\MediaGet2-systemScope\installer]
"comment" = ""

[HKCU\Software\Media Get LLC\MediaGet2\SearchSettings]
"useUserSelectSearch" = "false"

[HKCU\Software\Media Get LLC\MediaGet2\bittorrent]
"ulSpeedLimit" = "Type: REG_QWORD, Length: 8"

[HKCU\Software\Media Get LLC\MediaGet2-systemScope\installer]
"auto_start" = ""

[HKCU\Software\Media Get LLC\MediaGet2\transfers\transfers]
"Size" = "3"

[HKCU\Software\Media Get LLC\MediaGet2\transfers]
"titleViewSortColumn" = "8"

[HKCU\Software\Media Get LLC\MediaGet2\TorrentAddDialog]
"downloadSequentially" = "false"

[HKCU\Software\Media Get LLC\MediaGet2\PlayerSettings2]
"dontShowRemoveDialog" = "false"

[HKCU\Software\Media Get LLC\MediaGet2\bittorrent]
"useOtherDHTPort" = "false"

[HKCU\Software\Media Get LLC\MediaGet2\transfers]
"copyrightDialogWasShown" = "false"
"useTitleView" = "true"
"backupTorrents" = "false"

[HKCU\Software\Media Get LLC\MediaGet2\SearchSettings]
"searchRegionSelect" = "1"

[HKCU\Software\Media Get LLC\MediaGet2-systemScope\mediaget_info]
"hasDownloadedUpdate" = "false"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"TypesSupported" = "7"

[HKCU\Software\Media Get LLC\MediaGet2\PlayerSettings2]
"dontShowPlayFromPositionDialog" = "0"

[HKCU\Software\Media Get LLC\MediaGet2\MainWindow]
"Checkupdates" = "true"

[HKCU\Software\Media Get LLC\MediaGet2\transfers]
"selfCreatedTorrents" = ""

[HKCU\Software\Media Get LLC\MediaGet2\Gettingstarted]
"hasShownSearchTutorial" = "false"

[HKCU\Software\Media Get LLC\MediaGet2\transfers]
"torrentsBackupFolder" = "C:/Documents and Settings/adm/My Documents"

[HKCU\Software\Media Get LLC\MediaGet2-systemScope\installer]
"installer_id" = ""

[HKCU\Software\Media Get LLC\MediaGet2\Gettingstarted]
"tourWasShown" = "false"

[HKCU\Software\Media Get LLC\MediaGet2\HalfOpenLimitChecker]
"halfOpenLimitChecked" = "false"

[HKCU\Software\Media Get LLC\MediaGet2-systemScope\mediaget_info]
"updateError" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Media Get LLC\MediaGet2\bittorrent]
"dhtPort" = "6881"

[HKCU\Software\Media Get LLC\MediaGet2\PlayerSettings2]
"volume" = "100"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKCU\Software\Media Get LLC\MediaGet2-systemScope\mediaget_info]
"bubblesId" = ""

[HKCU\Software\Media Get LLC\MediaGet2\bittorrent]
"UseProxy" = "false"

[HKCU\Software\Media Get LLC\MediaGet2\PlayerSettings2]
"Position" = "0"

[HKCU\Software\Media Get LLC\MediaGet2\transfers\transfers\1]
"FileName" = "C:/Documents and Settings/adm/Local Settings/Application Data/Media Get LLC/MediaGet2/flash-plugin-1.7z"

[HKCU\Software\Media Get LLC\MediaGet2-systemScope\installer]
"installer_version" = ""
"setup_lang" = ""

[HKCU\Software\Media Get LLC\MediaGet2\bittorrent]
"MaxConnections" = "500"

[HKCU\Software\Media Get LLC\MediaGet2-systemScope\installer]
"associate_files" = ""

[HKCU\Software\Media Get LLC\MediaGet2\bittorrent]
"enablePnp" = "true"

[HKCU\Software\Media Get LLC\MediaGet2\TorrentAddDialog]
"dontShowTorrentAddDialog" = "false"

[HKCU\Software\Media Get LLC\MediaGet2\application\proxy]
"Host" = ""

[HKCU\Software\Media Get LLC\MediaGet2-systemScope\mediaget_info]
"updateServerFailCnt" = "0"

[HKCU\Software\Media Get LLC\MediaGet2\SearchSettings]
"saveDownloadsHistory" = "true"

[HKCU\Software\Media Get LLC\MediaGet2]
"installId" = "194402127"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"LogSessionName" = "stdout"

[HKCU\Software\Media Get LLC\MediaGet2-systemScope\installer]
"subid" = ""

[HKCU\Software\Media Get LLC\MediaGet2\PlayerSettings2]
"showPosition" = "true"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5A 9B 36 59 11 DD 8B C3 9B 0D A6 5C 7E 25 CB CD"

[HKCU\Software\Media Get LLC\MediaGet2\Gettingstarted]
"hasShownDownloadTutorial" = "false"

[HKCU\Software\Media Get LLC\MediaGet2\transfers\transfers\3]
"ID" = "68b7310c6cc7916d49612cf34916078fbf58e9f6"

[HKCU\Software\Media Get LLC\MediaGet2\transfers]
"openTorrentDirectory" = ""

[HKLM\SOFTWARE\Microsoft\ESENT\Process\mediaget\DEBUG]
"Trace Level" = ""

[HKCU\Software\Media Get LLC\MediaGet2\bittorrent]
"EnableDHT" = "true"
"useMgtracker" = "true"

[HKCU\Software\Media Get LLC\MediaGet2\PlayerPluginDownloader]
"Version" = "0"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"ControlFlags" = "1"

[HKCU\Software\Media Get LLC\MediaGet2\UserShareEngine\history]
"Size" = "0"

[HKCU\Software\Media Get LLC\MediaGet2\PlayerSettings2]
"prevFileDir" = ""
"streamCaching" = "5"

[HKCU\Software\Media Get LLC\MediaGet2-systemScope\mediaget_info]
"updateTorrentId" = "AAAAS3jaAUsAtP8b9vjuyu2P IR3C3hgCxNQSzUX/F/1KRdZYg8hTZKWf5i KcMXoqEuliNfc4s0mL4F vH13y5M2jmj7l5rSw0yVb/vlWAYkK/YBwlZDyNe"

[HKCU\Software\Media Get LLC\MediaGet2\transfers\transfers\1]
"fileExist" = "false"

[HKCU\Software\Media Get LLC\MediaGet2-systemScope\mediaget_info]
"installId" = "AAAAS3jaAUsAtP8b9vjuyu2P IR3C3hgCxNQSzUX/F/1KRdZYg8hTZKWf5i KcMXoqEuliNfc4s0mL4F vH13y5M2jmj7l5rSw0yVb/vlWAYkK/YBwlZDyNe"

[HKCU\Software\Media Get LLC\MediaGet2\uTorrentExportSetting]
"utorrentFirstExported" = "false"

[HKCU\Software\Media Get LLC\MediaGet2\transfers\transfers\2]
"Type" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Media Get LLC\MediaGet2\application]
"StartMinimized" = "true"

[HKCU\Software\Media Get LLC\MediaGet2\transfers\transfers\2]
"FileName" = "C:/Documents and Settings/adm/My Documents/download"

[HKCU\Software\Media Get LLC\MediaGet2\SearchSettings]
"trckerFoundUpdaterMin" = "10"

[HKCU\Software\Media Get LLC\MediaGet2\transfers]
"visibleInfoTab" = "false"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"ControlFlags" = "1"

[HKCU\Software\Media Get LLC\MediaGet2-systemScope\installer]
"associate_media_files" = ""

[HKCU\Software\Media Get LLC\MediaGet2\transfers]
"recheckDownloadedData" = "false"

[HKCU\Software\Media Get LLC\MediaGet2\application]
"lang" = "0"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "mediaget.exe"

[HKCU\Software\Media Get LLC\MediaGet2-systemScope]
"key" = "AAACo3jaAaMCXP0b9vjuyu2P IR3C3hgCxNQSzUX/F/1KRdZYg8hWpf/xQsrRKyRBHtDRdG9JbBTuwNrjPWAU2wMzvhrCEN7zb000wbhVjjPoJBVcgzA6HsYU0HPpjXSBt0rZYv4xRcgU4 qLyIqH4voacpk/kYyzaOXVAN wZ0JCDMytq1Hl0X3K2uM5MUXYnWqnWtrDB L/2qOWrIUAK/T6TkUeaCHcxhbR9nJQLRp4Fc7zrbzMABvt4sUGVpGybwwo3LxNE pz5BUHg/I7nppIjDPvCPSEORfAK/iyQgjTpf4AmwmUbzlZIxYsgoAr9PpLAZ5spEPbSA5vsNLp3qLUizNo5ZddAze620YRUH13mCBWbkCa43pgCwGec6bI0kNH5rhD7J1ni9OuszpIQd/ppkFZiY9o7kj0AXhXjzPoJNDchrf0gJGFxSTpVfLFpQJeJq49ChrHIfvZhxURs tRrJj9yYqzL6UVQV0lNIzEFVRuexoi1quRjzf3c8BJ1DO7nsIMAWa/XWLWLBGOfXdzwEnUM7peQRDIovodZJfuQEqzJr2KDVdnL1rezU2vq1MqzyHJUOjxuUrHQ3bmQ8OJzSp0jXWBuJAWarS8zwRY97sex1SRL7JI7BzgTk6z8yTQ3QNr5kKGFJXz6sy2jyZA36I/9IOYlWArC5aBRCc6HbYPKwjO8 nkFRyCMOefxhXXMu5RqcblVM/yb2QU3AOqOEPHlA0urh4wh6WK07fwOMrB2jOnipFCh2GrVWhf/cjfpf10gsnSM6ZL0kTBZr/Jc8WhwdplPXURRFfhr0vXQ8Uja1Ii1i FmWN5IlFbxze6HtLUUjH7D2ABeBsTZKWf5i KcMXoqEuliNfc4s0mL4F vH13y5Mwfq9bmUXdEWK6GiIWFlOM0h KDU2RDcL"

[HKCU\Software\Media Get LLC\MediaGet2\MainWindow]
"showDownloadAddedBaloon" = "true"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"Active" = "1"

[HKCU\Software\Media Get LLC\MediaGet2\transfers]
"dontShowLowspeedWarning" = "false"
"titleViewSortOrder" = "1"

[HKCU\Software\Media Get LLC\MediaGet2\PlayerSettings2]
"streamQuality" = "4294967295"

[HKCU\Software\Media Get LLC\MediaGet2-systemScope\installer]
"mgtoolbar_web_url" = ""

[HKCU\Software\Media Get LLC\MediaGet2\transfers]
"detailedViewSortColumn" = "0"

[HKCU\Software\Media Get LLC\MediaGet2\PlayerSettings2]
"lastDownloadUid" = ""
"showPanelOnFullscreen" = "true"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKCU\Software\Media Get LLC\MediaGet2\SearchSettings]
"alertStartDownload" = "true"

[HKCU\Software\Media Get LLC\MediaGet2\bittorrent]
"EnableLSD" = "false"

[HKCU\Software\Media Get LLC\MediaGet2\ExtentionsAssociator]
"initiated" = "true"

[HKCU\Software\Media Get LLC\MediaGet2\transfers\transfers\2]
"ID" = "4e6ef1a2e279a81c3f92341262d0cbd2a293d828"

[HKCU\Software\Media Get LLC\MediaGet2\PlayerSettings2]
"showPlaylist" = "true"

[HKCU\Software\Media Get LLC\MediaGet2\transfers\transfers\3]
"fileExist" = "false"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"LogSessionName" = "stdout"

[HKCU\Software\Media Get LLC\MediaGet2\HalfOpenLimitChecker]
"halfOpenLimitValue" = "4294967295"

[HKCU\Software\Media Get LLC\MediaGet2\MainWindow]
"enableUsershare" = "false"

[HKCU\Software\Media Get LLC\MediaGet2\SearchSettings]
"increaseResults" = "false"

[HKCU\Software\Media Get LLC\MediaGet2-systemScope\mediaget_info]
"updateServerIdx" = "0"

[HKCU\Software\Media Get LLC\MediaGet2\SearchSettings]
"downloadSearchServer" = "mininova.org"

[HKCU\Software\Media Get LLC\MediaGet2\ExtentionsAssociator]
"videoAssociated" = "false"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKCU\Software\Media Get LLC\MediaGet2\PlayerSettings2]
"playlistWidth" = "240"

[HKCU\Software\Media Get LLC\MediaGet2\application\proxy]
"auth" = "false"
"Port" = "3128"

[HKCU\Software\Media Get LLC\MediaGet2\transfers]
"reportFinishedDownloads" = "true"

[HKCU\Software\Media Get LLC\MediaGet2\application\proxy]
"Type" = "2"

[HKCU\Software\Media Get LLC\MediaGet2\SearchSettings\rutracker.org]
"Password" = ""

[HKCU\Software\Media Get LLC\MediaGet2-systemScope\mediaget_info]
"UpdateVersion" = ""
"HomePage" = "AAAAS3jaAUsAtP8b9vjuyu2P IR3C3hgCxNQSzUX/F/1KRdZYg8hTZKWf5i KcMXoqEuliNfc4s0mL4F vH13y5M2jmj7l5rSw0yVb/vlWAYkK/YBwlZDyNe"

[HKCU\Software\Media Get LLC\MediaGet2\CatalogSuggest]
"currentDate" = "40 00 56 00 61 00 72 00 69 00 61 00 6E 00 74 00"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1454946886"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKCU\Software\Media Get LLC\MediaGet2-systemScope\mediaget_info]
"installRequestSentCnt" = "0"

[HKCU\Software\Media Get LLC\MediaGet2\PlayerSettings2]
"lastFileName" = ""

[HKCU\Software\Media Get LLC\MediaGet2\PeerInfoTab]
"peerInfoTableHeader" = "40 00 42 00 79 00 74 00 65 00 41 00 72 00 72 00"

[HKCU\Software\Media Get LLC\MediaGet2-systemScope\mediaget_info]
"mustToBeUpdated" = "false"

[HKCU\Software\Media Get LLC\MediaGet2\SearchSettings\rutracker.org]
"User" = ""

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKCU\Software\Media Get LLC\MediaGet2-systemScope\installer]
"reseller" = ""

[HKCU\Software\Media Get LLC\MediaGet2\bittorrent]
"enablePmp" = "true"

[HKCU\Software\Media Get LLC\MediaGet2\PlayerSettings2]
"yandexPostOn" = "true"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"LogSessionName" = "stdout"

[HKCU\Software\Media Get LLC\MediaGet2\transfers\transfers\1]
"Type" = "0"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"Active" = "1"

[HKCU\Software\Media Get LLC\MediaGet2\bittorrent]
"perTorrentConnLimit" = "50"
"ignoreLimitsInLan" = "true"
"enablePeX" = "true"

[HKCU\Software\Media Get LLC\MediaGet2\TrackerInfoTab]
"trackerInfoTableHeader" = "40 00 42 00 79 00 74 00 65 00 41 00 72 00 72 00"

[HKCU\Software\Media Get LLC\MediaGet2\bittorrent]
"incomingPort" = "57398"

[HKCU\Software\Media Get LLC\MediaGet2-systemScope\installer]
"bundles_accepted" = ""

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryMessageFile" = "%System%\ESENT.dll"

[HKCU\Software\Media Get LLC\MediaGet2\SearchSettings]
"httpGetTimeoutSec" = "6"

[HKCU\Software\Media Get LLC\MediaGet2\PlayerPluginDownloader]
"FlashVersion" = "1"

[HKCU\Software\Media Get LLC\MediaGet2\SearchSettings]
"alertSearch" = "true"
"useSearchServer" = "mininova.org,kickass.to"

[HKCU\Software\Media Get LLC\MediaGet2\application\proxy]
"Pass" = "AAAAQ3jaAUMAvP8XfUjuGqpvtVKcCdNxEmyYmnbsWN1gThFTXIBNa 2HSn/SuFmrhyuE3g9tczHxddo5o 5ea0sNMlW/75VgGJCv2AcJLc8fbg=="

[HKCU\Software\Media Get LLC\MediaGet2\TorrentAddDialog]
"Paths" = "C:/Documents and Settings/adm/My Documents"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"Active" = "1"

[HKCU\Software\Media Get LLC\MediaGet2\SearchSettings]
"showAlertIncreaseResults" = "true"

[HKCU\Software\Media Get LLC\MediaGet2\PlayerSettings2]
"lastMediaTitle" = ""

The Trojan deletes the following registry key(s):

[HKCU\Software\Media Get LLC\MediaGet2-systemScope\installer]

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Media Get LLC\MediaGet2-systemScope\installer]
"comment"
"(Default)"

[HKLM\SOFTWARE\Microsoft\ESENT\Process\mediaget\DEBUG]
"Trace Level"

[HKCU\Software\Media Get LLC\MediaGet2-systemScope\installer]
"associate_files"
"associate_media_files"
"subid"
"auto_start"
"bubbles_id"
"reseller"
"installer_id"
"playlist_url"
"installer_version"
"bundles_accepted"
"mgtoolbar_web_url"
"hp_before"
"setup_lang"

The process mediaget-admin-proxy.exe:368 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "78 BF 86 EE D0 22 C9 6E AF 8A 36 7E 50 E0 3E E6"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\mediaget-installer-tmp]
"yandexbar_setup.exe" = "Software Installer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process yupdate-executor.exe:2580 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AC F2 9F 7A 58 B6 C8 85 61 0B 11 F9 6B 99 F0 D8"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

The process %original file name%.exe:188 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016022720160228]
"CacheRepair" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\MediaGet]
"DisplayVersion" = ""
"URLInfoAbout" = "http://mediaget.com"

[HKCU\Software\Mediaget]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\mediaget.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016022720160228]
"CacheOptions" = "11"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\MediaGet]
"Publisher" = "Media Get LLC"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\MediaGet]
"InstallDate" = "20160227"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016022720160228]
"CacheLimit" = "8192"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\MediaGet]
"DisplayIcon" = "%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\mediaget.exe"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "%original file name%.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\MediaGet]
"HelpLink" = "http://mediaget.com"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1315400264"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\mediaget-installer-tmp]
"mediaget-admin-proxy.exe" = "mediaget-admin-proxy"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C6 82 C6 D9 63 8E 4B BE F4 77 C4 10 E5 9E 94 D5"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\MediaGet]
"URLUpdateInfo" = "http://mediaget.com"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\MediaGet]
"InstallLocation" = "%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\MediaGet]
"DisplayName" = "Torrent-Client MediaGet"
"UninstallString" = "%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\mediaget-uninstaller.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016022720160228]
"CachePrefix" = ":2016022720160228:"
"CachePath" = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012016022720160228\"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2]
"mediaget.exe" = "MediaGet torrent client"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following registry key(s):

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014031720140318]

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process yandexbar_setup.exe:1456 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B7 B6 80 2F F4 87 EE 8D 27 E2 E1 D5 69 0F 74 CD"

The process regsvr32.exe:2428 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\userinfo]
"Type" = "5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Search\yandex.ru]
"Enabled" = "1"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\yaru]
"Title" = "Ya.ru"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Define\yandex.ru]
"ActionCount" = "2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Blog\ya.ru\Action1]
"HasPreview" = "0"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\search\Settings\searchEngineIndex]
"Default" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Email\yandex.ru\Action1\execute]
"ParamCount" = "1"

[HKCR\Yandex.Toolbar\CurVer]
"(Default)" = "Yandex.Toolbar.1"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\zakladki\Settings\pressAction]
"Scope" = "1"

[HKCU\Software\Yandex\Toolbar\Packages\http://bar-widgets.yandex.ru/packages/approved/75/manifest.xml]
"Version" = "1.1"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\spam]
"Unique" = "1"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\mail]
"Title" = "Mail"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/115/manifest.xml\Components\facebook]
"Icon" = "facebook.png"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Translate\yandex.ru]
"Icon" = "%Program Files%\Yandex\YandexBarIE\accelerators\lingvo.ico"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\opinions]
"Icon" = "icons/opinions/4.png"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Map\yandex.ru\Action2\preview]
"ParamCount" = "0"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar]
"VersionID" = "{4DE38CF9-1626-4AD8-AF63-7C63CCEB99D8}"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\opinions]
"CustomSettings" = "0"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\mail\Settings\countersUpdateInterval]
"Scope" = "3"

[HKCU\Software\Yandex\Toolbar\Packages\http://bar-widgets.yandex.ru/packages/approved/140/manifest.xml]
"Version" = "1.1"

[HKCR\CLSID\{91397D20-1446-11D4-8AF4-0040CA1127B6}\InprocServer32]
"(Default)" = "%Program Files%\Yandex\YandexBarIE\yndbar.dll"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Blog\ya.ru\Action2\execute]
"Action" = "http://my.ya.ru/request_to_session.xml"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\cy\Settings\showValue]
"Default" = "true"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\translator]
"Library" = "translator.dll"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\login]
"Unique" = "1"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/140/manifest.xml]
"LanguageID" = "0"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\search]
"Library" = "barcommon.dll"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A74BF4AD-0721-4D89-B214-66D15A9B39ED}]
"AppName" = "yndhelper.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Define\yandex.ru\Action1\execute]
"Method" = "get"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/176/manifest.xml]
"VersionID" = "{85B4B828-BEF0-4709-9494-2EE9335B9176}"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/118/manifest.xml\Components\radio]
"Icon" = "on.png"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\mail\Settings\countersUpdateInterval]
"Default" = "5"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\spellchecker\Settings\spellingLevel]
"Default" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Translate\yandex.ru]
"Enabled" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Map\yandex.ru]
"Domain" = "yandex.ru"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/115/manifest.xml\Components\facebook]
"Library" = "facebook.dll"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Email\yandex.ru\Action1\execute\Parameter1]
"Name" = "body"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\spam\Settings\showText]
"Scope" = "3"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\quote\Settings\quote-id]
"Default" = "0"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\lenta]
"Title" = "Subscriptions"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Translate\yandex.ru\Action1\execute]
"ParamCount" = "1"

[HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{91397D20-1446-11D4-8AF4-0040CA1127B6}" = "20 7D 39 91 46 14 D4 11 8A F4 00 40 CA 11 27 B6"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/140/manifest.xml\Components\odnoklassniki\Settings\update-interval]
"Scope" = "2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Blog\ya.ru]
"xml" = "%Program Files%\Yandex\YandexBarIE\accelerators\yaru.xml"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\zakladki\Settings\showFriends]
"Default" = "true"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\translator]
"Title" = "Translate words"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\lenta]
"CustomSettings" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Email\yandex.ru\Action2\execute]
"Action" = "http://mail.yandex.ru/compose"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Email\yandex.ru\Action2\execute\Parameter1]
"Value" = "{linkText?}{link}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Email\yandex.ru\Action2\execute]
"Method" = "post"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Translate]
"DefaultActivity" = "yandex.ru"

[HKCR\Yandex.Toolbar.1\CLSID]
"(Default)" = "{91397D20-1446-11D4-8AF4-0040CA1127B6}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/115/manifest.xml\Components\facebook\Settings\hideallbtn]
"Scope" = "1"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/143/manifest.xml]
"VersionID" = "{9CC83266-2D38-40EE-8670-BF577D234A73}"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\translator\Settings\target_lang]
"Scope" = "1"

[HKCU\Software\Yandex\Toolbar\Packages\http://bar.yandex.ru/packages/yandexbar]
"Version" = "6.7"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Map\yandex.ru\Action1\execute]
"Accept-charset" = "utf-8"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Shopping\yandex.ru\Action2\preview]
"Method" = "get"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Shopping]
"DefaultActivity" = "yandex.ru"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Translate\yandex.ru\Action1\execute]
"Method" = "get"

[HKCR\Interface\{91397D1F-1446-11D4-8AF4-0040CA1127B6}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/176/manifest.xml\Components\smartbox\Settings\customSettings]
"Scope" = "3"

[HKCU\Software\Yandex\Toolbar\Packages\http://bar-widgets.yandex.ru/packages/approved/140/manifest.xml]
"LocalPath" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\http://bar-widgets.yandex.ru/packages/approved/140/manifest.xml.zip"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/118/manifest.xml\Components\radio]
"Title" = "Rádio"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/91/manifest.xml\Components\profile]
"Unique" = "1"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/143/manifest.xml]
"LocalPath" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{6074A32F-35A3-4893-B290-A4BD186038B0}"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\translator\Settings\hotkey]
"Default" = "131104"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\cy\Settings\showValue]
"Scope" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Blog\ya.ru\Action3]
"HasPreview" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Translate\yandex.ru\Action2\execute]
"Accept-charset" = "utf-8"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Email\yandex.ru\Action3\execute]
"Method" = "post"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Search\yandex.ru\Action1\execute]
"ParamCount" = "0"

[HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B13E22E6-391C-4361-87C1-1C695B6C40F0}]
"AppPath" = "%Program Files%\Yandex\YandexBarIE"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Translate\yandex.ru\Action2]
"Context" = "link"

[HKCR\CLSID\{91397D20-1446-11D4-8AF4-0040CA1127B6}\TypeLib]
"(Default)" = "{91397D13-1446-11D4-8AF4-0040CA1127B6}"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\fotki\Settings\countersUpdateInterval]
"Scope" = "3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Email\yandex.ru]
"DisplayName" = "Send by Yandex.Mail"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\fotki]
"Icon" = "icons/fotki/fotki.png"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Blog\ya.ru]
"Icon" = "%Program Files%\Yandex\YandexBarIE\accelerators\yaru.ico"

[HKCU\Software\Yandex\Toolbar\Packages\http://bar-widgets.yandex.ru/packages/approved/91/manifest.xml]
"Version" = "5.2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Translate\yandex.ru\Action2]
"HasPreview" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Email\yandex.ru\Action3\execute]
"Accept-charset" = "utf-8"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Shopping\yandex.ru\Action2\execute\Parameter1]
"Name" = "text"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\translator\Settings\source_lang]
"Scope" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Map\yandex.ru]
"Type" = "1"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/140/manifest.xml\Components\odnoklassniki\Settings\save]
"Scope" = "3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Search\yandex.ru]
"DisplayName" = "Search Yandex"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\search\Settings\editorSize]
"Scope" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Define\yandex.ru]
"Domain" = "yandex.ru"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Translate\yandex.ru\Action1\execute]
"Accept-charset" = "utf-8"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Shopping\yandex.ru]
"Type" = "1"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/118/manifest.xml]
"LanguageID" = "0"

[HKCR\Interface\{5DC1A182-0F90-4133-A9D1-821034781305}\TypeLib]
"(Default)" = "{91397D13-1446-11D4-8AF4-0040CA1127B6}"

[HKCU\Software\Yandex]
"UICreated_adm" = "1"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\quote]
"Title" = "Quotations"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Blog\ya.ru]
"Verb" = "Blog"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Map\yandex.ru\Action2\execute\Parameter1]
"Value" = "{linkText}"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\search\Settings\highlighterEnabled]
"Default" = "false"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Search\yandex.ru\Action1]
"HasPreview" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Email\yandex.ru\Action1\execute\Parameter1]
"Value" = "(source: {documentUrl?}){selection?}"

[HKCR\Interface\{91397D1F-1446-11D4-8AF4-0040CA1127B6}\TypeLib]
"Version" = "1.0"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\moikrug]
"CustomSettings" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Translate\yandex.ru]
"Verb" = "Translate"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Email\yandex.ru\Action3\execute]
"ParamCount" = "2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Shopping\yandex.ru\Action1\execute\Parameter1]
"Name" = "text"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\textonly]
"Title" = "Text only"

[HKCR\TypeLib\{91397D13-1446-11D4-8AF4-0040CA1127B6}\1.0]
"(Default)" = "Yandex Toolbar 1.0 Type Library"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Define\yandex.ru]
"Type" = "1"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/115/manifest.xml]
"VersionID" = "{650FAD14-ED8E-4BCD-90F7-5498CFC384C2}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Shopping\yandex.ru\Action2]
"HasPreview" = "1"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\moikrug]
"Title" = "Moi Krug"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A74BF4AD-0721-4D89-B214-66D15A9B39ED}]
"AppPath" = "%Program Files%\Yandex\YandexBarIE\"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Map\yandex.ru\Action2]
"HasPreview" = "1"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/140/manifest.xml\Components\odnoklassniki\Settings\show-msg]
"Scope" = "2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Email\yandex.ru\Action1]
"Context" = "selection"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/140/manifest.xml\Components\odnoklassniki\Settings\show-photo]
"Scope" = "2"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/143/manifest.xml\Components\mc]
"Library" = "msc.dll"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\mail]
"Unique" = "1"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\translator\Settings\enabled]
"Scope" = "1"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\zakladki\Settings\count]
"Default" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Shopping\yandex.ru\Action2\execute\Parameter1]
"Value" = "{linkText}"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\zakladki]
"Library" = "barlegacy.dll"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Define\yandex.ru\Action2]
"Context" = "link"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/91/manifest.xml\Components\profile\Settings\notes_button]
"Default" = "false"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Search\yandex.ru\Action1]
"Context" = "link"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Search]
"DefaultActivity" = "yandex.ru"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\search\Settings\scrollEnabled]
"Default" = "1"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/117/manifest.xml\Components\srs]
"Unique" = "1"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\yaru\Settings\showText]
"Default" = "true"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\search]
"Type" = "4"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\search\Settings\highlightFromSERPEnabled]
"Scope" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Blog\ya.ru\Action1\execute]
"Method" = "post"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/117/manifest.xml\Components\srs]
"Title" = "Search hints for sites"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\quote]
"CustomSettings" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Map\yandex.ru\Action1\preview]
"ParamCount" = "0"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\zakladki\Settings\count]
"Scope" = "1"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/176/manifest.xml\Components\smartbox]
"Active" = "0"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\opinions]
"Type" = "4"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\search\Settings\highlighterEnabled]
"Scope" = "1"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\login]
"CustomSettings" = "0"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\zakladki\Settings\visible]
"Default" = "friends"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\spam]
"CustomSettings" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Search\yandex.ru\Action1\execute]
"Action" = "http://yandex.ru/yandsearch?stype=&nl=0&text={linkText}"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\search\Settings\storeSearchHistory]
"Default" = "true"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Blog\ya.ru\Action3\execute\Parameter3]
"Value" = "http://my.ya.ru/posts_add_link.xml"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\translator\Settings\translate_event]
"Default" = "hover"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Email\yandex.ru\Action2]
"Context" = "link"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\geolocation]
"Active" = "0"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/91/manifest.xml\Components\profile\Settings\show_name]
"Default" = "false"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Shopping\yandex.ru\Action1]
"HasPreview" = "1"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/140/manifest.xml\Components\odnoklassniki\Settings\show-msg]
"Default" = "true"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/91/manifest.xml\Components\profile\Settings\notes_button]
"Scope" = "1"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/176/manifest.xml\Components\smartbox\Settings\customSettings]
"Default" = "true"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/140/manifest.xml\Components\odnoklassniki\Settings\show-guest]
"Default" = "true"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/140/manifest.xml\Components\odnoklassniki\Settings\show-photo]
"Default" = "false"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Translate\yandex.ru]
"xml" = "%Program Files%\Yandex\YandexBarIE\accelerators\lingvo.xml"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Search\yandex.ru]
"ContentMask" = "4"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/115/manifest.xml\Components\facebook\Settings\friend]
"Default" = "false"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\moikrug]
"Unique" = "1"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\spellchecker]
"Unique" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Email\yandex.ru\Action3\execute]
"Enctype" = "application/x-www-form-urlencoded"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Map\yandex.ru\Action1\preview]
"Accept-charset" = "utf-8"

[HKCU\Software\Yandex\Toolbar\Presets\http://bar.yandex.ru/presets/default-partner.xml]
"Version" = "6.0"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/115/manifest.xml\Components\facebook]
"Title" = "Facebook"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Email\yandex.ru\Action3\execute\Parameter1]
"Value" = "{documentTitle?}"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\zakladki\Settings\checkYaru]
"Scope" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Shopping\yandex.ru\Action2\preview]
"ParamCount" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Shopping\yandex.ru\Action1\execute]
"Method" = "get"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Blog\ya.ru]
"ActionCount" = "3"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/140/manifest.xml\Components\odnoklassniki\Settings\show-notif]
"Scope" = "2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Translate\yandex.ru\Action2\execute]
"Method" = "get"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\zakladki]
"CustomSettings" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Shopping\yandex.ru]
"Enabled" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Translate\yandex.ru\Action1\execute\Parameter1]
"Value" = "{selection}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Define\yandex.ru\Action2]
"HasPreview" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Shopping\yandex.ru\Action2]
"Context" = "link"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Blog\ya.ru]
"ContentMask" = "7"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\opinions\Settings\showValue]
"Default" = "true"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Define\yandex.ru\Action2\execute\Parameter1]
"Name" = "text"

[HKCR\CLSID\{91397D20-1446-11D4-8AF4-0040CA1127B6}]
"(Default)" = "ßíäåêñ.Áàð"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\quote]
"Type" = "4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Map\yandex.ru\Action1]
"HasPreview" = "1"

[HKCU\Software\Yandex\Toolbar\Packages\http://bar-widgets.yandex.ru/packages/approved/176/manifest.xml]
"LocalPath" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\http://bar-widgets.yandex.ru/packages/approved/176/manifest.xml.zip"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/140/manifest.xml]
"LocalPath" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C25E60F0-88DE-445E-AB4E-55F4700A90E4}"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\login]
"Title" = "Authorization"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Blog\ya.ru\Action3\execute\Parameter2]
"Name" = "URL"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\yaru]
"Icon" = "icons/yaru/yaru.png"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\lenta\Settings\countersUpdateInterval]
"Default" = "5"

[HKCR\CLSID\{91397D20-1446-11D4-8AF4-0040CA1127B6}\ProgID]
"(Default)" = "Yandex.Toolbar.1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Translate\yandex.ru]
"DownloadUrl" = "http://lingvo.yandex.ru/"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\moikrug]
"Type" = "4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Translate\yandex.ru]
"DisplayName" = "Search for word translation in Yandex.Dictionaries"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Define\yandex.ru\Action2\execute]
"Enctype" = "application/x-www-form-urlencoded"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\logo]
"Title" = "Home button"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\zakladki\Settings\visible]
"Scope" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Define\yandex.ru\Action1\execute]
"ParamCount" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Shopping\yandex.ru\Action1\execute]
"ParamCount" = "1"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\translator\Settings\enabled]
"Default" = "true"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\translator]
"Type" = "4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Blog\ya.ru]
"DownloadUrl" = "http://my.ya.ru/"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\spellchecker]
"Title" = "Spellchecker"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\fotki\Settings\showText]
"Default" = "true"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Map\yandex.ru]
"ContentMask" = "6"

[HKCU\Software\Yandex\Toolbar\Packages\http://bar-widgets.yandex.ru/packages/approved/91/manifest.xml]
"ManifestUrl" = "http://bar-widgets.yandex.ru/packages/approved/91/manifest.xml"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\search\Settings\storeSearchHistory]
"Scope" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Translate\yandex.ru]
"ContentMask" = "6"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\spam]
"Icon" = "icons/spam/spam_enable.png"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\logo]
"Unique" = "1"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\quote\Settings\quote-id]
"Scope" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Blog\ya.ru\Action1\execute\Parameter2]
"Name" = "YARU_retpath"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Define\yandex.ru\Action1\execute\Parameter1]
"Value" = "{selection}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Blog\ya.ru]
"Domain" = "ya.ru"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/91/manifest.xml\Components\profile]
"CustomSettings" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Blog\ya.ru\Action3\execute\Parameter2]
"Value" = "{documentUrl}"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\moikrug\Settings\showText]
"Scope" = "3"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/176/manifest.xml\Components\smartbox]
"Icon" = "icons/icon_16.png"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/115/manifest.xml\Components\facebook\Settings\notifications]
"Default" = "false"

[HKCU\Software\Yandex\Toolbar\Packages\http://bar-widgets.yandex.ru/packages/approved/115/manifest.xml]
"Version" = "2.0"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\login]
"Type" = "4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Email\yandex.ru]
"DownloadUrl" = "http://mail.yandex.ru/"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/91/manifest.xml\Components\profile\Settings\events_button]
"Default" = "false"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\cy]
"Library" = "barlegacy.dll"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/115/manifest.xml]
"LanguageID" = "0"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\login\Settings\logoutWithoutConfirm]
"Default" = "false"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Define\yandex.ru\Action2\execute]
"Action" = "http://slovari.yandex.ru/search.xml"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Search\yandex.ru\Action1\execute]
"Enctype" = "application/x-www-form-urlencoded"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Define\yandex.ru\Action1\execute\Parameter1]
"Name" = "text"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Translate\yandex.ru]
"Deleted" = "0"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/117/manifest.xml\Components\srs]
"Library" = "srs.dll"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/115/manifest.xml\Components\facebook\Settings\messages]
"Scope" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Define\yandex.ru\Action1\execute]
"Enctype" = "application/x-www-form-urlencoded"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Shopping\yandex.ru\Action1\preview]
"ParamCount" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Map\yandex.ru]
"DisplayName" = "See on Yandex.Maps"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Shopping\yandex.ru\Action1\execute]
"Enctype" = "application/x-www-form-urlencoded"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\search\Settings\scrollEnabled]
"Scope" = "1"

[HKCR\TypeLib\{91397D13-1446-11D4-8AF4-0040CA1127B6}\1.0\0\win32]
"(Default)" = "%Program Files%\Yandex\YandexBarIE\yndbar.dll"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Shopping\yandex.ru]
"ContentMask" = "6"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\lenta]
"Type" = "4"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\search]
"Title" = "Search field"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Shopping\yandex.ru\Action1\preview]
"Method" = "get"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Define\yandex.ru]
"Deleted" = "0"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\mail\Settings\showText]
"Default" = "true"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Define\yandex.ru]
"Enabled" = "1"

[HKCU\Software\Yandex\Toolbar\Packages\http://bar-widgets.yandex.ru/packages/approved/118/manifest.xml]
"Version" = "1.1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Blog\ya.ru\Action3\execute]
"Enctype" = "application/x-www-form-urlencoded"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Email\yandex.ru]
"xml" = "%Program Files%\Yandex\YandexBarIE\accelerators\mail.xml"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Translate\yandex.ru]
"homepageurl" = "http://lingvo.yandex.ru/"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Blog\ya.ru\Action1\execute\Parameter1]
"Value" = "(source: {documentUrl?}){selection?}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Map\yandex.ru\Action1\preview]
"Enctype" = "application/x-www-form-urlencoded"

[HKCR\CLSID\{91397D20-1446-11D4-8AF4-0040CA1127B6}]
"AppID" = "{9340F2B2-4F27-4575-8BAE-4AAD70B69B28}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Shopping\yandex.ru\Action2\execute]
"Action" = "http://market.yandex.ru/search.xml"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/115/manifest.xml\Components\facebook\Settings\notifications]
"Scope" = "1"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/91/manifest.xml\Components\profile\Settings\video_button]
"Scope" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Define\yandex.ru]
"DisplayName" = "Find definition of the word in Yandex.Definitions"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\search\Settings\showSiteSearch]
"Scope" = "1"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\textonly]
"Type" = "3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Map\yandex.ru]
"Icon" = "%Program Files%\Yandex\YandexBarIE\accelerators\maps.ico"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/118/manifest.xml\Components\radio\Settings\save]
"Scope" = "3"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\mail]
"CustomSettings" = "0"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\textonly]
"Icon" = "icons/readability/ready.png"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Search\yandex.ru]
"Type" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Define\yandex.ru]
"xml" = "%Program Files%\Yandex\YandexBarIE\accelerators\slovari.xml"

[HKCU\Software\Yandex\Toolbar\Branding]
"PreviousBarless" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Email\yandex.ru]
"Enabled" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Map\yandex.ru\Action2\execute\Parameter1]
"Name" = "text"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/143/manifest.xml\Components\mc]
"Title" = "Spot-on"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/176/manifest.xml\Components\smartbox]
"CustomSettings" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Email\yandex.ru]
"ContentMask" = "7"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Map\yandex.ru]
"xml" = "%Program Files%\Yandex\YandexBarIE\accelerators\maps.xml"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Blog\ya.ru\Action1\execute]
"ParamCount" = "2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Translate\yandex.ru\Action1\execute]
"Enctype" = "application/x-www-form-urlencoded"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Email\yandex.ru\Action3\execute]
"Action" = "http://mail.yandex.ru/compose"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/118/manifest.xml\Components\radio\Settings\show_text]
"Scope" = "3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Search\yandex.ru]
"homepageurl" = "http://yandex.ru/"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\zakladki\Settings\checkYaru]
"Default" = "true"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Blog\ya.ru\Action3\execute]
"Method" = "post"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Define\yandex.ru\Action1\execute]
"Action" = "http://slovari.yandex.ru/search.xml"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\lenta\Settings\countersUpdateInterval]
"Scope" = "3"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{91397D20-1446-11D4-8AF4-0040CA1127B6}" = "ßíäåêñ.Áàð"

[HKCU\Software\Yandex\Toolbar\Packages\http://bar-widgets.yandex.ru/packages/approved/143/manifest.xml]
"ManifestUrl" = "http://bar-widgets.yandex.ru/packages/approved/143/manifest.xml"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\money]
"CustomSettings" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Shopping\yandex.ru]
"Deleted" = "0"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\moikrug\Settings\countersUpdateInterval]
"Default" = "5"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/115/manifest.xml\Components\facebook\Settings\newmsgsys]
"Default" = "false"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/176/manifest.xml\Components\smartbox]
"Title" = "Умная строка"

[HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{4493BF15-D41A-4CE4-ACE8-DFF35943AA05}]
"Policy" = "3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/91/manifest.xml\Components\profile\Settings\photo_button]
"Default" = "true"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/91/manifest.xml\Components\profile\Settings\msg_button]
"Default" = "true"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\opinions\Settings\showValue]
"Scope" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Blog\ya.ru\Action1\execute]
"Action" = "http://my.ya.ru/request_to_session.xml"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/91/manifest.xml\Components\profile\Settings\show_name]
"Scope" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Translate\yandex.ru\Action1]
"HasPreview" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Email\yandex.ru\Action1\execute]
"Accept-charset" = "utf-8"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/118/manifest.xml\Components\radio]
"CustomSettings" = "0"

[HKCU\Software\Yandex\Toolbar\Branding]
"PackageLocation" = "{324ADAAF-57CA-4052-915C-F0A1F015BA15}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Map\yandex.ru\Action2\preview]
"Enctype" = "application/x-www-form-urlencoded"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Map\yandex.ru]
"Deleted" = "0"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\yaru]
"CustomSettings" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Email\yandex.ru\Action3]
"HasPreview" = "0"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\fotki]
"Library" = "barlegacy.dll"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\zakladki]
"Unique" = "1"

[HKCR\Interface\{5DC1A182-0F90-4133-A9D1-821034781305}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Map\yandex.ru\Action1\preview]
"Method" = "get"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\quote]
"Icon" = "icons/quote/quote_up.png"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{AFFB8A40-9721-4891-BA44-4CC4611FB006}]
"AppPath" = "%Program Files%\Yandex\YandexBarIE"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Blog\ya.ru\Action1\execute]
"Accept-charset" = "utf-8"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\opinions\Settings\commentWndPosY]
"Default" = "-10000"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Search\yandex.ru]
"ActionCount" = "1"

[HKCU\Software\Yandex\Toolbar\Branding]
"Barless" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Define\yandex.ru\Action1]
"Context" = "selection"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Blog\ya.ru\Action2\execute]
"Accept-charset" = "utf-8"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\moikrug\Settings\countersUpdateInterval]
"Scope" = "3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Email\yandex.ru\Action1]
"HasPreview" = "0"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/91/manifest.xml]
"LocalPath" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{AC8A2266-D92B-4CCE-AEB5-0FEBA0FD2C75}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Search\yandex.ru]
"Icon" = "%Program Files%\Yandex\YandexBarIE\accelerators\yandex.ico"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Map\yandex.ru]
"Enabled" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Shopping\yandex.ru]
"DisplayName" = "Find a product on Yandex.Market"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Search\yandex.ru\Action1\execute]
"Method" = "get"

[HKCU\Software\Yandex\Toolbar\Packages\http://bar.yandex.ru/packages/yandexbar]
"LocalPath" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\translator]
"CustomSettings" = "0"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\userinfo]
"Library" = "barlegacy.dll"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\yaru\Settings\countersUpdateInterval]
"Scope" = "3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Map\yandex.ru\Action1\execute\Parameter1]
"Name" = "text"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/115/manifest.xml\Components\facebook\Settings\hideallbtn]
"Default" = "true"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\zakladki\Settings\unfolded]
"Default" = "false"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\money\Settings\countersUpdateInterval]
"Scope" = "3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Map]
"DefaultActivity" = "yandex.ru"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Map\yandex.ru\Action2\preview]
"Method" = "get"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\logo]
"Library" = "barcommon.dll"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\money]
"Title" = "Money"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/91/manifest.xml\Components\profile]
"Library" = "vkontakte.dll"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/115/manifest.xml\Components\facebook\Settings\update-interval]
"Default" = "2"

[HKCR\Interface\{91397D1F-1446-11D4-8AF4-0040CA1127B6}\TypeLib]
"(Default)" = "{91397D13-1446-11D4-8AF4-0040CA1127B6}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Blog\ya.ru\Action3\execute\Parameter3]
"Name" = "YARU_retpath"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Blog\ya.ru\Action3\execute\Parameter1]
"Name" = "title"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Blog\ya.ru\Action2]
"Context" = "link"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/91/manifest.xml\Components\profile\Settings\update_interval]
"Scope" = "1"

[HKCU\Software\Yandex\Toolbar\Packages\http://bar-widgets.yandex.ru/packages/approved/118/manifest.xml]
"LocalPath" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\http://bar-widgets.yandex.ru/packages/approved/118/manifest.xml.zip"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Blog\ya.ru]
"Type" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Blog\ya.ru\Action3\execute\Parameter1]
"Value" = "{documentTitle?}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Blog\ya.ru\Action2]
"HasPreview" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Email\yandex.ru\Action3\execute\Parameter2]
"Name" = "body"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\translator]
"Icon" = "icons/TranslateBtn.png"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\moikrug]
"Library" = "barlegacy.dll"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/91/manifest.xml\Components\profile]
"Type" = "4"

[HKCU\Software\Yandex\Toolbar\Packages\http://bar-widgets.yandex.ru/packages/approved/117/manifest.xml]
"ManifestUrl" = "http://bar-widgets.yandex.ru/packages/approved/117/manifest.xml"

[HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{4493BF15-D41A-4CE4-ACE8-DFF35943AA05}]
"AppPath" = "%Program Files%\Yandex\YandexBarIE\"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\zakladki]
"Type" = "4"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/117/manifest.xml]
"VersionID" = "{0C065E31-63A6-410E-B295-9B5249FC43B8}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Shopping\yandex.ru]
"Verb" = "Shopping"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Shopping\yandex.ru\Action2\preview]
"Accept-charset" = "utf-8"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Map\yandex.ru\Action1\execute]
"Enctype" = "application/x-www-form-urlencoded"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\fotki\Settings\countersUpdateInterval]
"Default" = "5"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\spellchecker]
"Type" = "4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Blog\ya.ru\Action2\execute\Parameter2]
"Value" = "http://my.ya.ru/posts_add_text.xml"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/117/manifest.xml\Components\srs]
"Type" = "3"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\userinfo\Settings\countersUpdateInterval]
"Default" = "5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Email\yandex.ru\Action2\execute\Parameter1]
"Name" = "body"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Email\yandex.ru]
"Verb" = "Email"

[HKCU\Software\Yandex\Toolbar\Packages\http://bar-widgets.yandex.ru/packages/approved/75/manifest.xml]
"ManifestUrl" = "http://bar-widgets.yandex.ru/packages/approved/75/manifest.xml"

[HKCR\Yandex.Toolbar]
"(Default)" = "ßíäåêñ.Áàð"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Blog\ya.ru\Action2\execute\Parameter1]
"Value" = "{linkText?}{link}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Blog\ya.ru\Action2\execute\Parameter2]
"Name" = "YARU_retpath"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/91/manifest.xml\Components\profile\Settings\msg_button]
"Scope" = "1"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\geolocation]
"Unique" = "1"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/91/manifest.xml\Components\profile\Settings\video_button]
"Default" = "true"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/115/manifest.xml\Components\facebook]
"Unique" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Shopping\yandex.ru\Action1\preview]
"Enctype" = "application/x-www-form-urlencoded"

[HKCR\Interface\{5DC1A182-0F90-4133-A9D1-821034781305}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Map\yandex.ru\Action2\preview]
"Action" = "http://export.yandex.ru/bar/mapsprint.xml?address={linkText}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Define\yandex.ru\Action2\execute\Parameter1]
"Value" = "{linkText}"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\search]
"Icon" = "icons/search/search.png"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/176/manifest.xml]
"LanguageID" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Shopping\yandex.ru\Action1]
"Context" = "selection"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/91/manifest.xml\Components\profile\Settings\friends_button]
"Default" = "true"

[HKCU\Software\Yandex\Toolbar\Packages\http://bar-widgets.yandex.ru/packages/approved/117/manifest.xml]
"LocalPath" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\http://bar-widgets.yandex.ru/packages/approved/117/manifest.xml.zip"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Blog\ya.ru\Action3\execute]
"Accept-charset" = "utf-8"

[HKCR\Interface\{91397D1F-1446-11D4-8AF4-0040CA1127B6}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\search\Settings\autocompleteWidth]
"Default" = "0"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/91/manifest.xml\Components\profile\Settings\friends_button]
"Scope" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Translate\yandex.ru\Action1\execute\Parameter1]
"Name" = "text"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Email\yandex.ru]
"Type" = "1"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\opinions]
"Unique" = "1"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\mail\Settings\openOnlyNewMessages]
"Default" = "false"

[HKCR\Yandex.Toolbar.1]
"(Default)" = "ßíäåêñ.Áàð"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\zakladki\Settings\unfolded]
"Scope" = "1"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/118/manifest.xml\Components\radio\Settings\show_text]
"Default" = "true"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\spellchecker]
"CustomSettings" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Email\yandex.ru\Action3]
"Context" = "document"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\mail\Settings\showText]
"Scope" = "3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Map\yandex.ru]
"ActionCount" = "2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Blog\ya.ru\Action1]
"Context" = "selection"

[HKCR\TypeLib\{91397D13-1446-11D4-8AF4-0040CA1127B6}\1.0\FLAGS]
"(Default)" = "0"

[HKCR\TypeLib\{91397D13-1446-11D4-8AF4-0040CA1127B6}\1.0\HELPDIR]
"(Default)" = "%Program Files%\Yandex\YandexBarIE"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\geolocation]
"CustomSettings" = "0"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/117/manifest.xml]
"LanguageID" = "0"

[HKCU\Software\Yandex\Yupdate-BITS-CM\Applications\barie]
"Locale" = "en"

[HKCR\CLSID\{91397D20-1446-11D4-8AF4-0040CA1127B6}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Blog\ya.ru\Action1\execute]
"Enctype" = "application/x-www-form-urlencoded"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/140/manifest.xml\Components\odnoklassniki]
"Unique" = "1"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\textonly]
"Unique" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Email\yandex.ru\Action1\execute]
"Method" = "post"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/115/manifest.xml]
"LocalPath" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C2E33C62-1E25-49E9-BABA-DBA2527F4C57}"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\money]
"Unique" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Map\yandex.ru\Action2\execute]
"Enctype" = "application/x-www-form-urlencoded"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\opinions\Settings\commentWndPosX]
"Default" = "-10000"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/115/manifest.xml\Components\facebook\Settings\messages]
"Default" = "false"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\quote]
"Library" = "barlegacy.dll"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Blog]
"DefaultActivity" = "ya.ru"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/118/manifest.xml\Components\radio]
"Unique" = "1"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/115/manifest.xml\Components\facebook\Settings\newmsgsys]
"Scope" = "1"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\login\Settings\logoutWithoutConfirm]
"Scope" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Search\yandex.ru]
"Verb" = "Search"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Map\yandex.ru\Action1\execute]
"Method" = "get"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\geolocation]
"Library" = "barlegacy.dll"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Search\yandex.ru\Action1\execute]
"Accept-charset" = "utf-8"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A74BF4AD-0721-4D89-B214-66D15A9B39ED}]
"Policy" = "3"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\moikrug]
"Icon" = "icons/moikrug/moikrug.png"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\lenta]
"Library" = "barlegacy.dll"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\money]
"Type" = "4"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\spellchecker]
"Icon" = "icons/spelling/spell.png"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\search\Settings\autocompleteHeight]
"Scope" = "1"

[HKCU\Software\Yandex\Toolbar\Packages\http://bar-widgets.yandex.ru/packages/approved/115/manifest.xml]
"LocalPath" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\http://bar-widgets.yandex.ru/packages/approved/115/manifest.xml.zip"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\geolocation]
"Type" = "2"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/91/manifest.xml\Components\profile\Settings\access_token]
"Scope" = "1"

[HKCU\Software\Yandex\Toolbar\Packages\http://bar-widgets.yandex.ru/packages/approved/117/manifest.xml]
"Version" = "1.2"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\cy]
"CustomSettings" = "0"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/91/manifest.xml\Components\profile\Settings\groups_button]
"Default" = "false"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Email\yandex.ru\Action2]
"HasPreview" = "0"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\fotki]
"Type" = "4"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\quote\Settings\update-interval]
"Default" = "15"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/140/manifest.xml\Components\odnoklassniki\Settings\show-happy]
"Default" = "false"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/91/manifest.xml\Components\profile]
"Icon" = "icons/profile.png"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\cy]
"Title" = "Citation index"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Map\yandex.ru\Action2\execute]
"ParamCount" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Email\yandex.ru]
"homepageurl" = "http://mail.yandex.ru/"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\logo]
"CustomSettings" = "0"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/115/manifest.xml\Components\facebook\Settings\save]
"Scope" = "3"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/143/manifest.xml\Components\mc]
"Unique" = "1"

[HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{4493BF15-D41A-4CE4-ACE8-DFF35943AA05}]
"AppName" = "yndhelper.exe"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\search\Settings\autocompleteWidth]
"Scope" = "1"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\zakladki\Settings\showAddToFolder]
"Default" = "before"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\spam]
"Type" = "4"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\money]
"Icon" = "icons/money/money.png"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\money\Settings\countersUpdateInterval]
"Default" = "5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Shopping\yandex.ru]
"homepageurl" = "http://market.yandex.ru"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/140/manifest.xml\Components\odnoklassniki]
"Library" = "odnoklassniki.dll"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Shopping\yandex.ru\Action1\execute]
"Action" = "http://market.yandex.ru/search.xml"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\userinfo]
"Unique" = "1"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/115/manifest.xml\Components\facebook]
"CustomSettings" = "0"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/140/manifest.xml\Components\odnoklassniki\Settings\show-happy]
"Scope" = "2"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/115/manifest.xml\Components\facebook\Settings\share]
"Scope" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Translate\yandex.ru]
"Type" = "1"

[HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B13E22E6-391C-4361-87C1-1C695B6C40F0}]
"AppName" = "yndbar.dll"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\quote\Settings\update-interval]
"Scope" = "2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Translate\yandex.ru]
"ActionCount" = "2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Shopping\yandex.ru\Action2\execute]
"Enctype" = "application/x-www-form-urlencoded"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/140/manifest.xml]
"VersionID" = "{1A6B4F9B-97CA-401C-B8C2-16A50EB1ABD2}"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar]
"LocalPath" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\geolocation]
"Title" = "Location targeting for Yandex services"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\mail]
"Icon" = "icons/mail/mail.png"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Map\yandex.ru]
"Verb" = "Map"

[HKCR\CLSID\{91397D20-1446-11D4-8AF4-0040CA1127B6}\VersionIndependentProgID]
"(Default)" = "Yandex.Toolbar"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\opinions]
"Title" = "Comments"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Define]
"DefaultActivity" = "yandex.ru"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/176/manifest.xml\Components\smartbox]
"Library" = "smartbox.dll"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/115/manifest.xml\Components\facebook\Settings\share]
"Default" = "false"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/91/manifest.xml\Components\profile\Settings\events_button]
"Scope" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Search\yandex.ru]
"Deleted" = "0"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\userinfo]
"CustomSettings" = "0"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar]
"LanguageID" = "1033"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/143/manifest.xml\Components\mc]
"Type" = "3"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\spam\Settings\showText]
"Default" = "true"

[HKCU\Software\Yandex\Toolbar\Packages\http://bar-widgets.yandex.ru/packages/approved/143/manifest.xml]
"Version" = "1.2"

[HKCU\Software\Yandex\Toolbar\Presets]
"(Default)" = "http://bar.yandex.ru/presets/default-partner.xml"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/115/manifest.xml\Components\facebook\Settings\friend]
"Scope" = "1"

[HKCR\AppID\yndbar.dll]
"AppID" = "{9340F2B2-4F27-4575-8BAE-4AAD70B69B28}"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\zakladki\Settings\showFriends]
"Scope" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Translate\yandex.ru\Action2\execute]
"ParamCount" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Email\yandex.ru]
"Domain" = "yandex.ru"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Define\yandex.ru\Action1\execute]
"Accept-charset" = "utf-8"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/91/manifest.xml\Components\profile\Settings\user_id]
"Scope" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Blog\ya.ru\Action1\execute\Parameter2]
"Value" = "http://my.ya.ru/posts_add_text.xml"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\zakladki]
"Icon" = "icons/bookmark/bookmark.png"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Shopping\yandex.ru\Action1\preview]
"Accept-charset" = "utf-8"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Blog\ya.ru\Action3\execute]
"Action" = "http://my.ya.ru/request_to_session.xml"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Shopping\yandex.ru]
"Domain" = "yandex.ru"

[HKCR\Interface\{91397D1F-1446-11D4-8AF4-0040CA1127B6}]
"(Default)" = "IYndbar"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Shopping\yandex.ru]
"ActionCount" = "2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Email\yandex.ru\Action1\execute]
"Enctype" = "application/x-www-form-urlencoded"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Map\yandex.ru\Action1\execute\Parameter1]
"Value" = "{selection}"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/143/manifest.xml\Components\mc]
"CustomSettings" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Shopping\yandex.ru]
"xml" = "%Program Files%\Yandex\YandexBarIE\accelerators\market.xml"

[HKCR\Interface\{AD6BD17F-DB0E-455E-BC47-DE96BD7D09F4}]
"(Default)" = "ICountersObject"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Map\yandex.ru]
"homepageurl" = "http://maps.yandex.ru"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\fotki]
"Title" = "Fotki"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/140/manifest.xml\Components\odnoklassniki\Settings\show-guest]
"Scope" = "2"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/118/manifest.xml]
"LocalPath" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{3F580847-72EB-4D1D-937C-6B324D24137E}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Email\yandex.ru]
"Deleted" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Translate\yandex.ru\Action2\execute]
"Action" = "http://lingvo.yandex.ru/q?st_translate=1"

[HKCU\Software\Yandex\Toolbar\Packages\http://bar-widgets.yandex.ru/packages/approved/115/manifest.xml]
"ManifestUrl" = "http://bar-widgets.yandex.ru/packages/approved/115/manifest.xml"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\spam]
"Title" = "This is spam"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\quote]
"Unique" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Define\yandex.ru]
"ContentMask" = "6"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\logo]
"Icon" = "icons/logo/logo.png"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\userinfo\Settings\countersUpdateInterval]
"Scope" = "3"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\zakladki\Settings\showAddToFolder]
"Scope" = "1"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\translator\Settings\SeznamSSID]
"Scope" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Blog\ya.ru\Action2\execute\Parameter1]
"Name" = "body"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/91/manifest.xml]
"VersionID" = "{AC2E6125-7598-427C-9D4E-916084A850CF}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Shopping\yandex.ru\Action1\execute\Parameter1]
"Value" = "{selection}"

[HKCU\Software\Yandex\Toolbar\Branding]
"PackageTimestamp" = "1338818932"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\search\Settings\showSiteSearch]
"Default" = "true"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\zakladki]
"Title" = "Favourites"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Translate\yandex.ru\Action2\execute\Parameter1]
"Name" = "text"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\search]
"Unique" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Search\yandex.ru]
"xml" = "%Program Files%\Yandex\YandexBarIE\accelerators\yandex.xml"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Blog\ya.ru\Action2\execute]
"Method" = "post"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Define\yandex.ru]
"Icon" = "%Program Files%\Yandex\YandexBarIE\accelerators\slovari.ico"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\yaru\Settings\showText]
"Scope" = "3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Translate\yandex.ru\Action1\execute]
"Action" = "http://lingvo.yandex.ru/q?st_translate=1"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/117/manifest.xml\Components\srs\Settings\show_text]
"Default" = "true"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\translator]
"Unique" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Shopping\yandex.ru\Action1\preview]
"Action" = "http://market.yandex.ru/export/bar/search_bar.xml?text={selection}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Translate\yandex.ru\Action1]
"Context" = "selection"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/118/manifest.xml\Components\radio]
"Library" = "radio.dll"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\lenta]
"Unique" = "1"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\zakladki\Settings\pressAction]
"Default" = "add_bookmark"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Shopping\yandex.ru\Action2\execute]
"ParamCount" = "1"

[HKCR\Interface\{AD6BD17F-DB0E-455E-BC47-DE96BD7D09F4}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Shopping\yandex.ru\Action2\preview]
"Action" = "http://market.yandex.ru/export/bar/search_bar.xml?text={linkText}"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\search\Settings\highlightFromSERPEnabled]
"Default" = "1"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/117/manifest.xml\Components\srs]
"CustomSettings" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Search\yandex.ru]
"DownloadUrl" = "http://yandex.ru/"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\opinions\Settings\commentWndPosY]
"Scope" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Blog\ya.ru]
"DisplayName" = "Share on Ya.ru"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Shopping\yandex.ru\Action2\execute]
"Method" = "get"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/118/manifest.xml\Components\radio]
"Type" = "4"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\search\Settings\searchEngineIndex]
"Scope" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Map\yandex.ru\Action1\execute]
"Action" = "http://maps.yandex.ru/"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/91/manifest.xml\Components\profile]
"Title" = "My VKontakte profile"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Shopping\yandex.ru\Action2\preview]
"Enctype" = "application/x-www-form-urlencoded"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Map\yandex.ru\Action2\execute]
"Method" = "get"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/176/manifest.xml\Components\smartbox]
"Type" = "3"

[HKCU\Software\Yandex\Toolbar\Packages\http://bar-widgets.yandex.ru/packages/approved/176/manifest.xml]
"ManifestUrl" = "http://bar-widgets.yandex.ru/packages/approved/176/manifest.xml"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Map\yandex.ru\Action2\execute]
"Accept-charset" = "utf-8"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Define\yandex.ru\Action2\execute]
"ParamCount" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Email\yandex.ru\Action3\execute\Parameter1]
"Name" = "subject"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\login]
"Icon" = "icons/login/auth.png"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/117/manifest.xml\Components\srs]
"Icon" = "icons/icon1.png"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\money]
"Library" = "barlegacy.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\translator\Settings\last_used_langs]
"Scope" = "1"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\geolocation]
"Icon" = "icons/geolocation/geolocation.png"

[HKCR\Interface\{5DC1A182-0F90-4133-A9D1-821034781305}]
"(Default)" = "ISearchHistory"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\textonly]
"Library" = "barcommon.dll"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Map\yandex.ru\Action2\execute]
"Action" = "http://maps.yandex.ru/"

[HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"ITBarLayout" = "11 00 00 00 4C 00 00 00 00 00 00 00 34 00 00 00"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{AFFB8A40-9721-4891-BA44-4CC4611FB006}]
"AppName" = "yndbar.dll"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\cy]
"Icon" = "icons/ic/4.png"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Blog\ya.ru]
"homepageurl" = "http://my.ya.ru/"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/176/manifest.xml\Components\smartbox]
"Unique" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Email\yandex.ru\Action2\execute]
"Enctype" = "application/x-www-form-urlencoded"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\search]
"CustomSettings" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Shopping\yandex.ru]
"DownloadUrl" = "http://market.yandex.ru"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BE 35 90 9A FE 8E 25 61 89 91 78 63 CB BE 83 F2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Email\yandex.ru\Action2\execute]
"Accept-charset" = "utf-8"

[HKCR\Interface\{AD6BD17F-DB0E-455E-BC47-DE96BD7D09F4}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\lenta]
"Icon" = "icons/subscription/subscription.png"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Translate\yandex.ru]
"Domain" = "yandex.ru"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Map\yandex.ru\Action2\preview]
"Accept-charset" = "utf-8"

[HKCR\Yandex.Toolbar\CLSID]
"(Default)" = "{91397D20-1446-11D4-8AF4-0040CA1127B6}"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/115/manifest.xml\Components\facebook]
"Type" = "4"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\fotki]
"Unique" = "1"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/91/manifest.xml\Components\profile\Settings\photo_button]
"Scope" = "1"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\moikrug\Settings\showText]
"Default" = "true"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/140/manifest.xml\Components\odnoklassniki\Settings\update-interval]
"Default" = "10"

[HKCU\Software\Yandex\Yupdate-BITS-CM\Applications\praetorian]
"Locale" = "en"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\cy]
"Type" = "4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Map\yandex.ru\Action1]
"Context" = "selection"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\login]
"Library" = "barlegacy.dll"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Map\yandex.ru\Action1\execute]
"ParamCount" = "1"

[HKCU\Software\Yandex\Toolbar\Packages\http://bar-widgets.yandex.ru/packages/approved/143/manifest.xml]
"LocalPath" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\http://bar-widgets.yandex.ru/packages/approved/143/manifest.xml.zip"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/91/manifest.xml]
"LanguageID" = "0"

[HKCU\Software\Yandex\Toolbar\Presets\http://bar.yandex.ru/presets/default-partner.xml]
"LocalPath" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\presets\http://bar.yandex.ru/presets/default-partner.xml"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Email\yandex.ru\Action1\execute]
"Action" = "http://mail.yandex.ru/compose"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Map\yandex.ru\Action2]
"Context" = "link"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/117/manifest.xml]
"LocalPath" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Email\yandex.ru]
"ActionCount" = "3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Blog\ya.ru\Action1\execute\Parameter1]
"Name" = "body"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Define\yandex.ru]
"homepageurl" = "http://slovari.yandex.ru/"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\login\Settings\showLogin]
"Default" = "true"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/91/manifest.xml\Components\profile\Settings\update_interval]
"Default" = "5"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/115/manifest.xml\Components\facebook\Settings\update-interval]
"Scope" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Blog\ya.ru\Action3]
"Context" = "document"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Define\yandex.ru\Action2\execute]
"Method" = "get"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\fotki\Settings\showText]
"Scope" = "3"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{AFFB8A40-9721-4891-BA44-4CC4611FB006}]
"Policy" = "3"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\yaru\Settings\countersUpdateInterval]
"Default" = "5"

[HKCR\Interface\{5DC1A182-0F90-4133-A9D1-821034781305}\TypeLib]
"Version" = "1.0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Blog\ya.ru\Action2\execute]
"Enctype" = "application/x-www-form-urlencoded"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\mail\Settings\openOnlyNewMessages]
"Scope" = "1"

[HKCR\AppID\{9340F2B2-4F27-4575-8BAE-4AAD70B69B28}]
"(Default)" = "ßíäåêñ.Áàð"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\spellchecker]
"Library" = "barlegacy.dll"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/143/manifest.xml\Components\mc]
"Icon" = "icons/icon1.png"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\translator\Settings\hotkey]
"Scope" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Shopping\yandex.ru\Action1\execute]
"Accept-charset" = "utf-8"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Map\yandex.ru]
"DownloadUrl" = "http://maps.yandex.ru"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\spellchecker\Settings\spellingLevel]
"Scope" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Translate\yandex.ru\Action2\execute]
"Enctype" = "application/x-www-form-urlencoded"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Blog\ya.ru]
"Deleted" = "0"

[HKCU\Software\Yandex\Toolbar\Packages\http://bar-widgets.yandex.ru/packages/approved/75/manifest.xml]
"LocalPath" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\http://bar-widgets.yandex.ru/packages/approved/75/manifest.xml.zip"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/140/manifest.xml\Components\odnoklassniki]
"Type" = "4"

[HKCR\Interface\{AD6BD17F-DB0E-455E-BC47-DE96BD7D09F4}\TypeLib]
"(Default)" = "{91397D13-1446-11D4-8AF4-0040CA1127B6}"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\fotki]
"CustomSettings" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Define\yandex.ru\Action2\execute]
"Accept-charset" = "utf-8"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/140/manifest.xml\Components\odnoklassniki]
"Icon" = "main.png"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Email\yandex.ru\Action2\execute]
"ParamCount" = "1"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/140/manifest.xml\Components\odnoklassniki\Settings\show-notif]
"Default" = "false"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Translate\yandex.ru\Action2\execute\Parameter1]
"Value" = "{linkText}"

[HKCU\Software\Yandex\Toolbar\Packages\http://bar-widgets.yandex.ru/packages/approved/91/manifest.xml]
"LocalPath" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\http://bar-widgets.yandex.ru/packages/approved/91/manifest.xml.zip"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/176/manifest.xml]
"LocalPath" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\yaru]
"Unique" = "1"

[HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B13E22E6-391C-4361-87C1-1C695B6C40F0}]
"Policy" = "3"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\login\Settings\showLogin]
"Scope" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Map\yandex.ru\Action1\preview]
"Action" = "http://export.yandex.ru/bar/mapsprint.xml?address={selection}"

[HKCR\Interface\{AD6BD17F-DB0E-455E-BC47-DE96BD7D09F4}\TypeLib]
"Version" = "1.0"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/118/manifest.xml]
"VersionID" = "{5D44D958-DEE4-4064-BADD-95C24229C20B}"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\userinfo]
"Title" = "userinfo"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Blog\ya.ru]
"Enabled" = "1"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/140/manifest.xml\Components\odnoklassniki]
"CustomSettings" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Shopping\yandex.ru\Action2\execute]
"Accept-charset" = "utf-8"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\search\Settings\editorSize]
"Default" = "200"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\spam]
"Library" = "barlegacy.dll"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Email]
"DefaultActivity" = "yandex.ru"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\cy]
"Unique" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Shopping\yandex.ru]
"Icon" = "%Program Files%\Yandex\YandexBarIE\accelerators\market.ico"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Email\yandex.ru\Action3\execute\Parameter2]
"Value" = "{documentUrl}"

[HKCU\Software\Yandex\Toolbar\Packages\http://bar-widgets.yandex.ru/packages/approved/176/manifest.xml]
"Version" = "1.3"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/143/manifest.xml]
"LanguageID" = "0"

[HKCU\Software\Yandex\Toolbar\Packages\http://bar.yandex.ru/packages/yandexbar]
"ManifestUrl" = "http://bar.yandex.ru/packages/yandexbar"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/117/manifest.xml\Components\srs\Settings\show_text]
"Scope" = "3"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\yaru]
"Library" = "barlegacy.dll"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\opinions]
"Library" = "barlegacy.dll"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\translator\Settings\translate_event]
"Scope" = "1"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/140/manifest.xml\Components\odnoklassniki]
"Title" = "Одноклассники"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Email\yandex.ru]
"Icon" = "%Program Files%\Yandex\YandexBarIE\accelerators\mail.ico"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\search\Settings\autocompleteHeight]
"Default" = "0"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\yaru]
"Type" = "4"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\logo]
"Type" = "4"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\textonly]
"CustomSettings" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Define\yandex.ru]
"DownloadUrl" = "http://slovari.yandex.ru/"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/91/manifest.xml\Components\profile\Settings\groups_button]
"Scope" = "1"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\mail]
"Library" = "barlegacy.dll"
"Type" = "4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Blog\ya.ru\Action3\execute]
"ParamCount" = "3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Define\yandex.ru\Action1]
"HasPreview" = "0"

[HKCU\Software\Yandex\Toolbar\Packages\http://bar-widgets.yandex.ru/packages/approved/118/manifest.xml]
"ManifestUrl" = "http://bar-widgets.yandex.ru/packages/approved/118/manifest.xml"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Blog\ya.ru\Action2\execute]
"ParamCount" = "2"

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\opinions\Settings\commentWndPosX]
"Scope" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Define\yandex.ru]
"Verb" = "Define"

[HKCU\Software\Yandex\Toolbar\Packages\http://bar-widgets.yandex.ru/packages/approved/140/manifest.xml]
"ManifestUrl" = "http://bar-widgets.yandex.ru/packages/approved/140/manifest.xml"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Search\yandex.ru]
"Domain" = "yandex.ru"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan deletes the following registry key(s):

[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components]
[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\logo\Settings]
[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\textonly]
[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\geolocation\Settings]
[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar\Components\textonly\Settings]
[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar-widgets.yandex.ru/packages/approved/143/manifest.xml\Components\mc\Settings]
[HKCU\Software\Yandex\Toolbar\Custom\Packages\http://bar.yandex.ru/packages/yandexbar]

The process regsvr32.exe:2508 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCR\AppID\{53C0373B-51E4-4F85-9085-53EF06DE6E00}]
"(Default)" = "ßíäåêñ.Âèçóàëüíûå çàêëàäêè"

[HKCR\TypeLib\{AFBDA429-7995-4CCA-9298-7C7D6B4A244C}\1.0\0\win32]
"(Default)" = "%Program Files%\Yandex\YandexBarIE\fastdial.dll"

[HKCR\FastDial.CFastDial.1\CLSID]
"(Default)" = "{C93F72A2-2162-4BBA-A07A-F13663C297A6}"

[HKCR\Interface\{E16FE932-52D3-4BD9-B50B-A03BEC527579}\TypeLib]
"(Default)" = "{AFBDA429-7995-4CCA-9298-7C7D6B4A244C}"

[HKCR\CLSID\{C93F72A2-2162-4BBA-A07A-F13663C297A6}\TypeLib]
"(Default)" = "{AFBDA429-7995-4CCA-9298-7C7D6B4A244C}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCR\FastDial.CFastDial.1]
"(Default)" = "ßíäåêñ.Âèçóàëüíûå çàêëàäêè.1"

[HKCR\FastDial.CFastDial\CurVer]
"(Default)" = "FastDial.CFastDial.1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKCR\AppID\FastDial.DLL]
"AppID" = "{53C0373B-51E4-4F85-9085-53EF06DE6E00}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCR\CLSID\{C93F72A2-2162-4BBA-A07A-F13663C297A6}\InprocServer32]
"(Default)" = "%Program Files%\Yandex\YandexBarIE\fastdial.dll"

[HKCR\Interface\{A92DDAD1-F8B0-4155-9F08-83387EF1456B}\ProxyStubClsid32]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCR\Interface\{E16FE932-52D3-4BD9-B50B-A03BEC527579}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\TypeLib\{AFBDA429-7995-4CCA-9298-7C7D6B4A244C}\1.0\HELPDIR]
"(Default)" = "%Program Files%\Yandex\YandexBarIE"

[HKCR\CLSID\{C93F72A2-2162-4BBA-A07A-F13663C297A6}]
"(Default)" = "Âèçóàëüíûå Çàêëàäêè"

[HKCR\TypeLib\{AFBDA429-7995-4CCA-9298-7C7D6B4A244C}\1.0]
"(Default)" = "FastDial 1.0 Type Library"

[HKCR\FastDial.CFastDial]
"(Default)" = "ßíäåêñ.Âèçóàëüíûå çàêëàäêè"

[HKCR\Interface\{E16FE932-52D3-4BD9-B50B-A03BEC527579}]
"(Default)" = "IFastDial"

[HKCR\Interface\{A92DDAD1-F8B0-4155-9F08-83387EF1456B}]
"(Default)" = "_IFastDialEvents"

[HKCR\Interface\{A92DDAD1-F8B0-4155-9F08-83387EF1456B}\TypeLib]
"(Default)" = "{AFBDA429-7995-4CCA-9298-7C7D6B4A244C}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCR\CLSID\{C93F72A2-2162-4BBA-A07A-F13663C297A6}\ProgID]
"(Default)" = "FastDial.CFastDial.1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1D 2B 8D 12 58 1D 3D 51 B6 F7 D5 64 00 DB BE 51"

[HKCR\FastDial.CFastDial\CLSID]
"(Default)" = "{C93F72A2-2162-4BBA-A07A-F13663C297A6}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKCR\CLSID\{C93F72A2-2162-4BBA-A07A-F13663C297A6}\VersionIndependentProgID]
"(Default)" = "FastDial.CFastDial"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKCR\TypeLib\{AFBDA429-7995-4CCA-9298-7C7D6B4A244C}\1.0\FLAGS]
"(Default)" = "0"

[HKCR\Interface\{E16FE932-52D3-4BD9-B50B-A03BEC527579}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Favorites" = "%Documents and Settings%\%current user%\Favorites"

[HKCR\Interface\{A92DDAD1-F8B0-4155-9F08-83387EF1456B}\ProxyStubClsid]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"

[HKCR\CLSID\{C93F72A2-2162-4BBA-A07A-F13663C297A6}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\Interface\{E16FE932-52D3-4BD9-B50B-A03BEC527579}\TypeLib]
"Version" = "1.0"

[HKCR\Interface\{A92DDAD1-F8B0-4155-9F08-83387EF1456B}\TypeLib]
"Version" = "1.0"

The process MsiExec.exe:1372 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B8 2E F8 BD 7B AF AF DB 1F 91 AD 9F 78 34 81 49"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\yandex.ru-054209]
"SuggestionsURL_JSON" = "http://suggest.yandex.net/suggest-ff.cgi?part={searchTerms}"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Start Page" = "http://www.yandex.ru/?win=217&clid=187997"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes]
"ShowSearchSuggestionsInAddressGlobal" = "1"

[HKCU\Software\Microsoft\Windows Script\Settings]
"JITDebug" = "0"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\yandex.ru-054209]
"URL" = "http://yandex.ru/yandsearch?win=217&clid=187998&text={searchTerms}"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope" = "yandex.ru-054209"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Internet Explorer\LinksBar]
"Enabled" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\yandex.ru-054209]
"YaCreationDate" = "2016-02-27"
"ShowSearchSuggestions" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\yandex.ru-054209]
"FaviconURLFallback" = "http://www.yandex.ru/favicon.ico"
"FaviconPath" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\APPLIC~1\MICROS~1\INTERN~1\Services\WWWYAN~1.ICO"
"SortIndex" = "0"
"DisplayName" = "Яндекс"

[HKCU\Software\Microsoft\Internet Explorer\SearchUrl\y]
"(Default)" = "http://yandex.ru/yandsearch?win=217&clid=188001&text=%s"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links]
"Order" = "08 00 00 00 02 00 00 00 00 02 00 00 01 00 00 00"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Secondary Start Pages" = "http://mail.yandex.ru/?win=217&clid=187997"

The Trojan deletes the following registry key(s):

[HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks]

The process MsiExec.exe:2536 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B13E22E6-391C-4361-87C1-1C695B6C40F0}]
"Policy" = "3"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{91397D20-1446-11D4-8AF4-0040CA1127B6}" = "20 7D 39 91 46 14 D4 11 8A F4 00 40 CA 11 27 B6"

[HKU\.DEFAULT\Software\Yandex\Yupdate-BITS-CM\Applications\barie]
"Locale" = "en"

[HKCR\Yandex.Toolbar.1\CLSID]
"(Default)" = "{91397D20-1446-11D4-8AF4-0040CA1127B6}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCR\Yandex.Toolbar.1]
"(Default)" = "ßíäåêñ.Áàð"

[HKCR\Yandex.Toolbar\CurVer]
"(Default)" = "Yandex.Toolbar.1"

[HKCR\CLSID\{91397D20-1446-11D4-8AF4-0040CA1127B6}]
"AppID" = "{9340F2B2-4F27-4575-8BAE-4AAD70B69B28}"
"(Default)" = "ßíäåêñ.Áàð"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKU\.DEFAULT\Software\Yandex\Yupdate-BITS-CM\Applications\praetorian]
"Locale" = "en"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCR\CLSID\{91397D20-1446-11D4-8AF4-0040CA1127B6}\InprocServer32]
"(Default)" = "%Program Files%\Yandex\YandexBarIE\yndbar.dll"
"ThreadingModel" = "Apartment"

[HKCR\AppID\yndbar.dll]
"AppID" = "{9340F2B2-4F27-4575-8BAE-4AAD70B69B28}"

[HKCR\CLSID\{91397D20-1446-11D4-8AF4-0040CA1127B6}\ProgID]
"(Default)" = "Yandex.Toolbar.1"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{AFFB8A40-9721-4891-BA44-4CC4611FB006}]
"Policy" = "3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCR\Yandex.Toolbar]
"(Default)" = "ßíäåêñ.Áàð"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{91397D20-1446-11D4-8AF4-0040CA1127B6}" = "ßíäåêñ.Áàð"

[HKCR\CLSID\{91397D20-1446-11D4-8AF4-0040CA1127B6}\TypeLib]
"(Default)" = "{91397D13-1446-11D4-8AF4-0040CA1127B6}"

[HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"ITBarLayout" = "11 00 00 00 4C 00 00 00 00 00 00 00 34 00 00 00"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCR\AppID\{9340F2B2-4F27-4575-8BAE-4AAD70B69B28}]
"(Default)" = "ßíäåêñ.Áàð"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0D 66 CB 87 68 EC B7 50 30 A8 E6 11 16 CA 55 FE"

[HKCR\CLSID\{91397D20-1446-11D4-8AF4-0040CA1127B6}\VersionIndependentProgID]
"(Default)" = "Yandex.Toolbar"

[HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{4493BF15-D41A-4CE4-ACE8-DFF35943AA05}]
"Policy" = "3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCR\Yandex.Toolbar\CLSID]
"(Default)" = "{91397D20-1446-11D4-8AF4-0040CA1127B6}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A74BF4AD-0721-4D89-B214-66D15A9B39ED}]
"Policy" = "3"

The Trojan deletes the following registry key(s):

[HKCR\CLSID\{91397D20-1446-11D4-8AF4-0040CA1127B6}\Programmable]
[HKCR\CLSID\{91397D20-1446-11D4-8AF4-0040CA1127B6}\InprocServer32]
[HKCR\CLSID\{91397D20-1446-11D4-8AF4-0040CA1127B6}\VersionIndependentProgID]
[HKCR\CLSID\{91397D20-1446-11D4-8AF4-0040CA1127B6}]
[HKCR\CLSID\{91397D20-1446-11D4-8AF4-0040CA1127B6}\TypeLib]
[HKCR\CLSID\{91397D20-1446-11D4-8AF4-0040CA1127B6}\ProgID]

The process MsiExec.exe:2100 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CF E6 2C FE A7 33 99 2C 3C 6B 02 C8 6C B7 14 D5"

The process MsiExec.exe:2548 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKCR\AppID\{53C0373B-51E4-4F85-9085-53EF06DE6E00}]
"(Default)" = "ßíäåêñ.Âèçóàëüíûå çàêëàäêè"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKCR\CLSID\{C93F72A2-2162-4BBA-A07A-F13663C297A6}\TypeLib]
"(Default)" = "{AFBDA429-7995-4CCA-9298-7C7D6B4A244C}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCR\FastDial.CFastDial.1]
"(Default)" = "ßíäåêñ.Âèçóàëüíûå çàêëàäêè.1"

[HKCR\FastDial.CFastDial\CurVer]
"(Default)" = "FastDial.CFastDial.1"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\A]
"BaseClass" = "Drive"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKCR\AppID\FastDial.DLL]
"AppID" = "{53C0373B-51E4-4F85-9085-53EF06DE6E00}"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Favorites" = "%Documents and Settings%\%current user%\Favorites"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCR\CLSID\{C93F72A2-2162-4BBA-A07A-F13663C297A6}\InprocServer32]
"(Default)" = "%Program Files%\Yandex\YandexBarIE\fastdial.dll"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\D]
"BaseClass" = "Drive"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\C]
"BaseClass" = "Drive"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F]
"BaseClass" = "Drive"

[HKCR\CLSID\{C93F72A2-2162-4BBA-A07A-F13663C297A6}]
"(Default)" = "Âèçóàëüíûå Çàêëàäêè"

[HKCR\FastDial.CFastDial]
"(Default)" = "ßíäåêñ.Âèçóàëüíûå çàêëàäêè"

[HKCR\FastDial.CFastDial.1\CLSID]
"(Default)" = "{C93F72A2-2162-4BBA-A07A-F13663C297A6}"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCR\CLSID\{C93F72A2-2162-4BBA-A07A-F13663C297A6}\VersionIndependentProgID]
"(Default)" = "FastDial.CFastDial"

[HKCR\CLSID\{C93F72A2-2162-4BBA-A07A-F13663C297A6}\ProgID]
"(Default)" = "FastDial.CFastDial.1"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FD C9 8C 3F B7 F4 3F 8F CE 83 B3 DC D5 F1 55 CD"

[HKCR\FastDial.CFastDial\CLSID]
"(Default)" = "{C93F72A2-2162-4BBA-A07A-F13663C297A6}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCR\CLSID\{C93F72A2-2162-4BBA-A07A-F13663C297A6}\InprocServer32]
"ThreadingModel" = "Apartment"

The Trojan deletes the following registry key(s):

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C93F72A2-2162-4BBA-A07A-F13663C297A6}]
[HKCR\CLSID\{C93F72A2-2162-4BBA-A07A-F13663C297A6}]
[HKCR\CLSID\{C93F72A2-2162-4BBA-A07A-F13663C297A6}\Programmable]
[HKCR\CLSID\{C93F72A2-2162-4BBA-A07A-F13663C297A6}\VersionIndependentProgID]
[HKCR\CLSID\{C93F72A2-2162-4BBA-A07A-F13663C297A6}\TypeLib]
[HKCR\CLSID\{C93F72A2-2162-4BBA-A07A-F13663C297A6}\ProgID]
[HKCR\CLSID\{C93F72A2-2162-4BBA-A07A-F13663C297A6}\InprocServer32]

Dropped PE files

MD5 File path
56c49136a4085e050d8b7be7627c21ee c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\MediaGet2\Qt5Concurrent.dll
d04dc68130b1c062b01554bb3d65a602 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\MediaGet2\Qt5Core.dll
64a56bfe9fb86be930d46b473a981a4f c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\MediaGet2\Qt5Gui.dll
7b0132b196f09b7d56417ec8085dd534 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\MediaGet2\Qt5Multimedia.dll
61404e1ad7dc99cad52357c7cd9bc048 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\MediaGet2\Qt5MultimediaWidgets.dll
d30d74258c210eb039641f81dfbb0c53 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\MediaGet2\Qt5Network.dll
fb4d87ca003595b83132524f8a53bfdc c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\MediaGet2\Qt5OpenGL.dll
a6d50453534019d704b41573d8f104f8 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\MediaGet2\Qt5Positioning.dll
85e06c5b9b7f46aa2005e93da9ba8dcd c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\MediaGet2\Qt5PrintSupport.dll
07c0c568f647d0d7581c89f205e09220 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\MediaGet2\Qt5Qml.dll
401777b27d88c16d3089b110e8eb3f75 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\MediaGet2\Qt5Quick.dll
2e645f29e3de648ffdb3d96c94c4ad4c c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\MediaGet2\Qt5Sensors.dll
55c3748d1e14e5e0e7efa8cc7d72c590 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\MediaGet2\Qt5Sql.dll
ad96d8a7e83a7cdef669c611e05a16ae c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\MediaGet2\Qt5WebChannel.dll
db3b4988531f5204dd41541ee8e3f044 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\MediaGet2\Qt5WebKit.dll
cd9e67a56f301151f453ca3837a59e61 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\MediaGet2\Qt5WebKitWidgets.dll
bd3e458223470a90cb27b9e3b763e4d1 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\MediaGet2\Qt5Widgets.dll
e99c602f900c0c3ff518eb05679ec4f1 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\MediaGet2\Qt5WinExtras.dll
e5c1393e957759820631760096dc063d c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\MediaGet2\Qt5Xml.dll
32fd0c321618c3ec05c4cd575c7a65a5 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\MediaGet2\Qt5XmlPatterns.dll
5ecdf31e924030c04f280b389467fcc4 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\MediaGet2\icudt53.dll
9303d1c99a2aba5a3e86a6a60e98a866 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\MediaGet2\icuin53.dll
b69755a5c388358909b5d4bf7dbde58b c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\MediaGet2\icuuc53.dll
e4fd3d6a3ef8fda22855de654395b652 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\MediaGet2\imageformats\qgif.dll
c5686ea7203a9521e5f79db7cff9d183 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\MediaGet2\imageformats\qjpeg.dll
bfcdd99d43c0c650c2d3c4134e733a8d c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\MediaGet2\libeay32.dll
b54a2114efab65e8a613d053a878984e c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\MediaGet2\libgcc_s_sjlj-1.dll
8e51f5a40fcfdb951fe76148af17983b c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\MediaGet2\libvlc.dll
edb0f2f19dedbfafb11671724b31c71a c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\MediaGet2\libvlccore.dll
424c83ae5385ad3b66d036f40d0df9f7 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\MediaGet2\mediaget-admin-proxy.exe
50e1a075b44fc18f16ba876291ad0a48 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\MediaGet2\mediaget-uninstaller.exe
1db4e3dfa19eae5b78da419e1aaa138e c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\MediaGet2\mediaget.exe
e00a4be4bf133c27e88616a780202fe4 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\MediaGet2\mediaservice\wmfengine.dll
e3c817f7fe44cc870ecdbcbc3ea36132 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\MediaGet2\msvcp100.dll
bf38660a9125935658cfa3e53fdc7d65 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\MediaGet2\msvcr100.dll
5fdf87aabcbfc2b7e741c3f110968b19 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\MediaGet2\platforms\qminimal.dll
c9763d2f27b7bd1a843db80f107021cf c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\MediaGet2\platforms\qwindows.dll
efa3158b8898aab50f317db6adebba6d c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\MediaGet2\ssleay32.dll
0995a392fd5328d6f29f3b705a9bbab9 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\Yandex\Toolbar\packages\{3F580847-72EB-4D1D-937C-6B324D24137E}\radio.dll
dd644d63b9913b2ec90cc2598cb723cc c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\Yandex\Toolbar\packages\{3F580847-72EB-4D1D-937C-6B324D24137E}\streamplayer.exe
a465f4088d7d3a4a53f6677abd96d901 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\Yandex\Toolbar\packages\{6074A32F-35A3-4893-B290-A4BD186038B0}\MSC.dll
d785606c52f0dd080e2ebf7c71a5de22 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\Yandex\Toolbar\packages\{AC8A2266-D92B-4CCE-AEB5-0FEBA0FD2C75}\vkontakte.dll
06ca45250a23035e95090d6345d3ecf6 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\SRS.dll
be9c2b1d788657b99dfa026757bfca23 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\SRS64.dll
f116fbf43d42479c9d149b73d41bc92f c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\Yandex\Toolbar\packages\{C25E60F0-88DE-445E-AB4E-55F4700A90E4}\odnoklassniki.dll
fef69b0c1a9db18b7141a583306eaa9b c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\Yandex\Toolbar\packages\{C2E33C62-1E25-49E9-BABA-DBA2527F4C57}\facebook.dll
25be550a6c6a070a3d0d0a9f8850476d c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\barcommon.dll
977655f4ee749b48977c2e64077d461f c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\barlegacy.dll
cf43823adbc124d9783edd9a88ee0d23 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\translator.dll
c30fa6f5cced471dab4c3d3df496643b c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\smartbox.dll
c40ce7e45804104efed53199184d57c6 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\Yandex\Updater\fixhosts.exe
68af1c01341da23a1d01fc487fea8b6b c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\Yandex\Updater\praetorian.exe
a03ff32ab9c68ffd7679e4eecb684520 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\Yandex\Updater\show-dlg.exe
9cc5c24e0bcb282202c633f16402e3e1 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\Yandex\Updater\yupdate-executor.exe
7ab84114df108008c8fed7bf41750203 c:\Program Files\Yandex\YandexBarIE\fastdial.dll
dd50a5ce8e130f92059a2a18185f28b8 c:\Program Files\Yandex\YandexBarIE\yndbar.dll
581fd8e2441b3440a7bb844e7f6269c3 c:\Program Files\Yandex\YandexBarIE\yndhelper.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name: MediaGet LLC
Product Name: mediaget-installer Module
Product Version: 1.0
Legal Copyright: Copyright (c) 2011 MediaGet LLC
Legal Trademarks:
Original Filename: mediaget-installer.exe
Internal Name: mediaget-installer
File Version: 1.0
File Description: MediaGet installer
Comments: MediaGet installer
Language: English (United States)

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
UPX0 4096 962560 0 0 d41d8cd98f00b204e9800998ecf8427e
UPX1 966656 319488 318976 5.48067 107b49b4b621216a9a0bbb601f8ceda1
.rsrc 1286144 303104 301568 5.49193 f57f9e433d97d12c06e2e3401db1c6e4

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 66
9753f699f1e899dc8a9ebb49631b5f8a
ee8fb833c9c21cb5569dc39f06f05d55
1fe99cff45875bfa70c2aa5bc5c884da
09f5a16de5f743d6e8b61664fddcbb0f
a7edb98db58a38729768ca138db1c182
49f5d62ce618385aa3441cae3c7e92fb
c215ab3bbefbe52b42724bf0b2ceb9ba
4b24e098dd103dc2427f9a710b8aa9be
eb3ce9259ad54e224cd3476d8e5c8b66
4b40e56ff88d4014a19ee1a444186f5c
9efdf268f59eaafb6f007fac0a201599
b3f7cc6bd6543a5eebe77ad904a85500
039fe6a9fc9704beaf4d235a17d1e1cd
dd5d0f05a28651ee385554a65a8d113b
6503aaf2a1d8df55c88bdbcd609a6321
aa03618aece6b9b84b872e7c3f0ce838
e5a0261f06bfdea26c7685831f7a041d
7ff8192aba01f7692b6a63c713ae9261
f294c792381cd97e30a4d8b033ad2fcf
d9cdfe7929425359265826613d99df16
ca80f2b50c8cfa2b4df17d2ee5e5c1d3
63fb0748b27d2f53c5e3b899664be090
b6f3e128a2e65b6fe809ea20e9f4addb
97e3ea64b0655c50d1a7d3b8e006bf94
669a11addcf036176c30ecbda0b57f69

URLs

URL IP
hxxp://mediaget.com/mediaget-installer-2/binaries/download.php?a=mediaget-lib
hxxp://mediaget.com/mediaget-installer-2/binaries/download.php?a=mediaget-bin
hxxp://mediaget.com/mediaget-installer-2/bundles/bundle.php?b=yandex
hxxp://e6845.dscb1.akamaiedge.net/pca3.crl
hxxp://e6845.dscb1.akamaiedge.net/CSC3-2009-2.crl
hxxp://install.media-get.ru/index.php 37.19.5.132
hxxp://mg.mgshare.com/?mediaget=2.01.3533&lang=en&client_id=&check=4a99fca9d621f844ac2ed031b5f0cced 92.241.171.247
hxxp://bubblesmedia.ru/file/mg_left.php?version=2.01.3533
hxxp://bubblesmedia.ru/file/adv.php?version=2.01.3533
hxxp://www.playground.ru/download/?file=50409 212.42.38.194
hxxp://mg.mgshare.com/js/jquery-1.7.1.min.js 92.241.171.247
hxxp://mg.mgshare.com/js/jquery-postmessage.js 92.241.171.247
hxxp://sub2.admitlead.ru/r/get_code/2/?subid=0&version=2.01.3533 92.241.171.35
hxxp://sub2.admitlead.ru/r/get_code/4/?subid=0&version=2.01.3533 92.241.171.35
hxxp://mg.mgshare.com/menu.php?query=mediaget=2.01.3533&lang=en&client_id=&check=4a99fca9d621f844ac2ed031b5f0cced 92.241.171.247
hxxp://mg.mgshare.com/css/main.css?1 92.241.171.247
hxxp://mg.mgshare.com/images/spr-s12323e9111.png 92.241.171.247
hxxp://sub2.admitlead.ru/r/display/2/0/?a=1&mg_version=2.01.3533&rnd=19720 92.241.171.35
hxxp://sub2.admitlead.ru/r/display/4/0/?a=1&mg_version=2.01.3533&rnd=3286 92.241.171.35
hxxp://mg.mgshare.com/?mediaget=2.01.3533&client_id=&check=4a99fca9d621f844ac2ed031b5f0cced&lang=en 92.241.171.247
hxxp://mc.yandex.ru/metrika/watch.js 87.250.251.119
hxxp://mdata.yandex.ru/status.xml?ui={24AB7B5C-285E-4953-A9B8-CAAEE882157B}&iyasoft=barie&iclid=187994&iqs=1&ihp=1
hxxp://mg.mgshare.com/css/main.css?1450780404 92.241.171.247
hxxp://www.playground.ru/files/world_of_tanks_hp_marker-50409/?error=empty_hash 212.42.38.194
hxxp://sub2.admitlead.ru/file/images/511/564c8725baafd.jpg 92.241.171.35
hxxp://sub2.admitlead.ru/file/images/557/5666db39228e3.jpg 92.241.171.35
hxxp://mg.mgshare.com/js/jquery.jcarousel.min.js?1 92.241.171.247
hxxp://mg.mgshare.com/css/skin.css 92.241.171.247
hxxp://mg.mgshare.com/css/jquery.jscrollpane.css 92.241.171.247
hxxp://mg.mgshare.com/js/jquery.jscrollpane.min.js 92.241.171.247
hxxp://mg.mgshare.com/js/jquery.mousewheel.js 92.241.171.247
hxxp://mg.mgshare.com/js/action.js 92.241.171.247
hxxp://googleapis.l.google.com/ajax/libs/jquery/1.8.2/jquery.js
hxxp://mg.mgshare.com/js/main.js?1453889881 92.241.171.247
hxxp://mg.mgshare.com/js/jquery.cookie.js 92.241.171.247
hxxp://mg.mgshare.com/css/webkit-scrollbar.css?1415274801 92.241.171.247
hxxp://mg.mgshare.com/css/premieres/adds.css?1450371904 92.241.171.247
hxxp://mg.mgshare.com/css/sprite.css 92.241.171.247
hxxp://www-google-analytics.l.google.com/analytics.js
hxxp://www-google-analytics.l.google.com/plugins/ua/linkid.js
hxxp://www-google-analytics.l.google.com/r/collect?v=1&_v=j41&a=2138179480&t=event&ni=1&_s=1&dl=http://games.mgshare.com/?mediaget=2.01.3533&client_id=&check=4a99fca9d621f844ac2ed031b5f0cced&lang=en&dr=http://mg.mgshare.com/?mediaget=2.01.3533&lang=en&client_id=&check=4a99fca9d621f844ac2ed031b5f0cced&ul=en-us&de=UTF-8&dt=MediaGet Catalogue&sd=32-bit&sr=1276x846&vp=721x504&je=0&ec=entry&ea=version&el=2013533&_u=CGAAAAQiI~&jid=1440573567&cid=587736484.1456544556&tid=UA-23988018-5&_r=1&z=976537894
hxxp://www-google-analytics.l.google.com/collect?v=1&_v=j41&a=2138179480&t=pageview&_s=2&dl=http://games.mgshare.com/?mediaget=2.01.3533&client_id=&check=4a99fca9d621f844ac2ed031b5f0cced&lang=en&dr=http://mg.mgshare.com/?mediaget=2.01.3533&lang=en&client_id=&check=4a99fca9d621f844ac2ed031b5f0cced&dp=/?cat=movies&genre=all&page=1&mgver=2013533&ul=en-us&de=UTF-8&dt=MediaGet Catalogue&sd=32-bit&sr=1276x846&vp=721x504&je=0&_u=CGCACEQiJ~&jid=&cid=587736484.1456544556&tid=UA-23988018-5&z=1206974226
hxxp://mg.mgshare.com/filecache/userfiles/v2/images/torrents/ИГРЫ/world of warplanes/warplanes---width_portrait---145---207.jpg 92.241.171.247
hxxp://mg.mgshare.com/filecache/userfiles/v2/images/torrents/ИГРЫ/worldoftanks/worldtanks---width_portrait---145---207.jpg 92.241.171.247
hxxp://mg.mgshare.com/filecache/userfiles/v2/images/torrents/ИГРЫ/skill/skill---width_portrait---145---207.jpg 92.241.171.247
hxxp://mg.mgshare.com/filecache/userfiles/v2/images/torrents/ИГРЫ/aion/aion---width_portrait---145---207.jpg 92.241.171.247
hxxp://mg.mgshare.com/filecache/userfiles/v2/images/torrents/ИГРЫ/panzar/panzar_poster---width_portrait---145---207.jpg 92.241.171.247
hxxp://mg.mgshare.com/filecache/userfiles/v2/images/torrents games/TURKEY/The Witcher 3 - Wild Hunt - Hearts of Stone/the-witcher-3-wild-hunt-cover---width_portrait---145---207.jpg 92.241.171.247
hxxp://admitlead.ru/file/images/557/5666db39228e3.jpg 92.241.171.35
hxxp://games.mgshare.com/js/jquery.jcarousel.min.js?1 149.202.78.162
hxxp://games.mgshare.com/css/sprite.css 149.202.78.162
hxxp://www.google-analytics.com/plugins/ua/linkid.js 173.194.113.198
hxxp://ajax.googleapis.com/ajax/libs/jquery/1.8.2/jquery.js 216.58.209.202
hxxp://img.mgshare.com/filecache/userfiles/v2/images/torrents/ИГРЫ/world of warplanes/warplanes---width_portrait---145---207.jpg 149.202.78.162
hxxp://games.mgshare.com/js/jquery-postmessage.js 149.202.78.162
hxxp://games.mgshare.com/css/skin.css 149.202.78.162
hxxp://games.mgshare.com/css/webkit-scrollbar.css?1415274801 149.202.78.162
hxxp://games.mgshare.com/js/main.js?1453889881 149.202.78.162
hxxp://games.mgshare.com/css/main.css?1450780404 149.202.78.162
hxxp://download.mediaget.com/mediaget-installer-2/binaries/download.php?a=mediaget-lib 37.19.5.134
hxxp://games.mgshare.com/css/jquery.jscrollpane.css 149.202.78.162
hxxp://www.google-analytics.com/analytics.js 173.194.113.198
hxxp://download.mediaget.com/mediaget-installer-2/binaries/download.php?a=mediaget-bin 37.19.5.134
hxxp://www2.bubblesmedia.ru/file/mg_left.php?version=2.01.3533 37.19.5.135
hxxp://games.mgshare.com/js/action.js 149.202.78.162
hxxp://crl.verisign.com/pca3.crl 23.51.117.163
hxxp://www.google-analytics.com/r/collect?v=1&_v=j41&a=2138179480&t=event&ni=1&_s=1&dl=http://games.mgshare.com/?mediaget=2.01.3533&client_id=&check=4a99fca9d621f844ac2ed031b5f0cced&lang=en&dr=http://mg.mgshare.com/?mediaget=2.01.3533&lang=en&client_id=&check=4a99fca9d621f844ac2ed031b5f0cced&ul=en-us&de=UTF-8&dt=MediaGet Catalogue&sd=32-bit&sr=1276x846&vp=721x504&je=0&ec=entry&ea=version&el=2013533&_u=CGAAAAQiI~&jid=1440573567&cid=587736484.1456544556&tid=UA-23988018-5&_r=1&z=976537894 173.194.113.198
hxxp://img.mgshare.com/filecache/userfiles/v2/images/torrents/ИГРЫ/worldoftanks/worldtanks---width_portrait---145---207.jpg 149.202.78.162
hxxp://download.mediaget.com/mediaget-installer-2/bundles/bundle.php?b=yandex 37.19.5.134
hxxp://games.mgshare.com/css/premieres/adds.css?1450371904 149.202.78.162
hxxp://games.mgshare.com/fonts/metamediumcyr-roman-webfont.ttf 149.202.78.162
hxxp://games.mgshare.com/js/jquery.mousewheel.js 149.202.78.162
hxxp://csc3-2009-2-crl.verisign.com/CSC3-2009-2.crl 23.51.117.163
hxxp://www2.bubblesmedia.ru/file/adv.php?version=2.01.3533 37.19.5.135
hxxp://games.mgshare.com/js/jquery.jscrollpane.min.js 149.202.78.162
hxxp://games.mgshare.com/?mediaget=2.01.3533&client_id=&check=4a99fca9d621f844ac2ed031b5f0cced&lang=en 149.202.78.162
hxxp://www.google-analytics.com/collect?v=1&_v=j41&a=2138179480&t=pageview&_s=2&dl=http://games.mgshare.com/?mediaget=2.01.3533&client_id=&check=4a99fca9d621f844ac2ed031b5f0cced&lang=en&dr=http://mg.mgshare.com/?mediaget=2.01.3533&lang=en&client_id=&check=4a99fca9d621f844ac2ed031b5f0cced&dp=/?cat=movies&genre=all&page=1&mgver=2013533&ul=en-us&de=UTF-8&dt=MediaGet Catalogue&sd=32-bit&sr=1276x846&vp=721x504&je=0&_u=CGCACEQiJ~&jid=&cid=587736484.1456544556&tid=UA-23988018-5&z=1206974226 173.194.113.198
hxxp://admitlead.ru/file/images/511/564c8725baafd.jpg 92.241.171.35
hxxp://games.mgshare.com/js/jquery.cookie.js 149.202.78.162
hxxp://soft.export.yandex.ru/status.xml?ui={24AB7B5C-285E-4953-A9B8-CAAEE882157B}&iyasoft=barie&iclid=187994&iqs=1&ihp=1 213.180.204.108
mgtracker.org 92.241.171.245
router.bittorrent.com 67.215.246.10
client.mediaget.com 37.19.5.130
update.mgtracker.org 37.19.5.139


IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

SURICATA STREAM ESTABLISHED packet out of window
SURICATA STREAM Packet with invalid ack
SURICATA STREAM ESTABLISHED invalid ack
ET MALWARE W32/MediaGet Checkin
ET P2P BitTorrent DHT ping request
ET P2P Vuze BT UDP Connection (5)
ET MALWARE SOCKSv5 UDP Proxy Inbound Connect Request (Windows Source)
ET POLICY HTTP Request on Unusual Port Possibly Hostile
GPL P2P BitTorrent announce request
ET P2P BitTorrent DHT announce_peers request
SURICATA STREAM FIN out of window
SURICATA STREAM SHUTDOWN RST invalid ack

Traffic

GET /pca3.crl HTTP/1.1
Accept: */*
User-Agent: Microsoft-CryptoAPI/5.131.2600.5512
Host: crl.verisign.com
Connection: Keep-Alive
Cache-Control: no-cache
Pragma: no-cache


HTTP/1.1 200 OK
Server: Apache
ETag: "61c40e5c0bcac2d6da0cc20289056deb:1449628399"
Last-Modified: Wed, 09 Dec 2015 02:09:10 GMT
Date: Sat, 27 Feb 2016 03:44:01 GMT
Content-Length: 933
Connection: keep-alive
Content-Type: application/pkix-crl
0...0...0...*.H........0_1.0...U....US1.0...U....VeriSign, Inc.1705..U
....Class 3 Public Primary Certification Authority..151207000000Z..160
331235959Z0..x0!...v....a_>..2......020924164823Z0!.....A.....{2..Y
.#..140129175709Z0!...,.|.|...<...j ...080605174907Z0!...`y..q.....
..fh...020923171400Z0!...?A....a.nF`.P....020923171548Z0!............R
.e.53..010207212458Z0!..!......Y...ISi....010706171411Z0!..$-..I{r....
u<._...080403172226Z0!..&.."?..y..51}..1..010706172118Z0!..4....2..
..{W......080605175030Z0!..B....c............070411175910Z0!..H.Py...N
....* [email protected]!..Y......w
`G........070411175657Z0!..Z`[email protected].*q..080403172017Z0!..l....I..
.Y..] .c..010706171749Z0"......T=deQ...1u.]...010207212247Z0".....p..1
..7<.....e..010207211822Z0...*.H................M.E..'...z...K.....
V....... ...8......).....u'..1......i/:..........tpN=..1B}HI......=v..
5...e#.W.. 1.c...6...oUX.W.'t[=..W6HTTP/1.1 200 OK..Server: Apache..ET
ag: "61c40e5c0bcac2d6da0cc20289056deb:1449628399"..Last-Modified: Wed,
 09 Dec 2015 02:09:10 GMT..Date: Sat, 27 Feb 2016 03:44:01 GMT..Conten
t-Length: 933..Connection: keep-alive..Content-Type: application/pkix-
crl..0...0...0...*.H........0_1.0...U....US1.0...U....VeriSign, Inc.17
05..U....Class 3 Public Primary Certification Authority..151207000000Z
..160331235959Z0..x0!...v....a_>..2......020924164823Z0!.....A.....
{2..Y.#..140129175709Z0!...,.|.|...<...j ...080605174907Z0!...`y..q
.......fh...020923171400Z0!...?A....a.nF`.P....020923171548Z0!....
<<< skipped >>>


GET /CSC3-2009-2.crl HTTP/1.1
Accept: */*
User-Agent: Microsoft-CryptoAPI/5.131.2600.5512
Host: csc3-2009-2-crl.verisign.com
Connection: Keep-Alive
Cache-Control: no-cache
Pragma: no-cache


HTTP/1.1 200 OK
Server: Apache
ETag: "690cf2b902306f439802788d0f8b7908:1456522384"
Last-Modified: Fri, 26 Feb 2016 21:00:02 GMT
Date: Sat, 27 Feb 2016 03:44:01 GMT
Transfer-Encoding:  chunked
Connection: keep-alive
Connection: Transfer-Encoding
Content-Type: application/pkix-crl
00006000..0.. 0......0...*.H........0..1.0...U....US1.0...U....VeriSig
n, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use at htt
ps://VVV.verisign.com/rpa (c)09100...U...'VeriSign Class 3 Code Signin
g 2009-2 CA..160226210002Z..160311210002Z0...0!.....V..t..'.F(z....121
202220203Z0!.... .;...9.7.......090826054212Z0!...\.)../F..^p..s...100
722072726Z0!......P....A.x......100708154305Z0!.......O#.`n.5j.9...100
930040708Z0!..../..8~p...h......091006052837Z0!.....(../L....--aK..091
029040207Z0!...aW.....B.!.0..t..090909121104Z0!...g,..4(vv....mJ_..100
514054218Z0!.....V.....(..-..p..090826162211Z0!....O..,J.N.n...Ly..091
[email protected]!.........}..Dt...!..090
922192227Z0!.......2l....7i..?..101109030426Z0!.....p%...l,AogP....100
523060224Z0!...,.P.C......*.....100303082219Z0!...NRPL.............100
413090225Z0!....1w....d.&..8....091026111702Z0!......F....e........090
608081352Z0!.....6..d6.7..4.....100924123027Z0!....$..*...s..&s....100
219210742Z0!......Q_.G..|.......091009145530Z0!........>..O...=72..
100616160934Z0!....Xlm$|".su.......090619194406Z0!......J)..E......C..
100922142243Z0!...D......u.y.Iy{k..101026130323Z0!...El...)>..W..&l
t;K...101004225456Z0!...p..wy.i.zc...X...091117001921Z0!.....,{..^....
......091203194409Z0!....B....d...*[email protected]!.......m. .V..
...~..101111134216Z0!...2.R.i.{..........091029071123Z0!...`F..q2..O.:
......100602074221Z0!...a{.-...@...'.....100723194022Z0!........fW.y.,
s.....101011182226Z0!....Um..}.8)........100324085953Z0!....,u.box
<<< skipped >>>


GET /file/adv.php?version=2.01.3533 HTTP/1.1
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8
User-Agent: mediaget/2.01.3533/
Connection: Keep-Alive
Accept-Encoding: gzip, deflate
Accept-Language: en-US,*
Host: www2.bubblesmedia.ru


HTTP/1.1 200 OK
Server: nginx/1.6.0
Date: Sat, 27 Feb 2016 03:44:27 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.28
131..    <body style="margin:0; background:#000;">.    <div a
lign="center">.        <div id="al_rotator_block_2_0" onclick="a
l_load_2();"></div>.    </div>.    <script async="as
ync" type="text/javascript".            src="hXXp://sub2.admitlead.ru/
r/get_code/2/?subid=0&version=2.01.3533"></script>.    </b
ody>...0..HTTP/1.1 200 OK..Server: nginx/1.6.0..Date: Sat, 27 Feb 2
016 03:44:27 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enc
oding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.28..131.
.    <body style="margin:0; background:#000;">.    <div align
="center">.        <div id="al_rotator_block_2_0" onclick="al_lo
ad_2();"></div>.    </div>.    <script async="async"
 type="text/javascript".            src="hXXp://sub2.admitlead.ru/r/ge
t_code/2/?subid=0&version=2.01.3533"></script>.    </body&
gt;...0..



GET /ajax/libs/jquery/1.8.2/jquery.js HTTP/1.1
Accept: */*
Referer: hXXp://games.mgshare.com/?mediaget=2.01.3533&client_id=&check=4a99fca9d621f844ac2ed031b5f0cced&lang=en
User-Agent: mediaget/2.01.3533/
Connection: Keep-Alive
Accept-Encoding: gzip, deflate
Accept-Language: en-US,*
Host: ajax.googleapis.com


HTTP/1.1 200 OK
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Type: text/javascript; charset=UTF-8
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
Date: Thu, 04 Feb 2016 03:04:26 GMT
Expires: Fri, 03 Feb 2017 03:04:26 GMT
Last-Modified: Fri, 16 Oct 2015 18:27:31 GMT
X-Content-Type-Options: nosniff
Server: sffe
Content-Length: 78921
X-XSS-Protection: 1; mode=block
Cache-Control: public, max-age=31536000
Age: 1989602
.............~.G. ..M<E......I......u...-y,u..#iO.(.e.(4..E........
...gdV.....{.b.UYy....{l.[.d.._.sY./...?.oG.r...-..9<..=.j....-....
._..M...|....W..d9...m....b.K...........]....E.`k.....ZN.....Y>.g..
..g.j.....E5.^.(&E^.....kh.}..]6)G..........%.../.....2{[.`.<...;..
w..e.......[[Y.E^/...>...d...E.....N......]..qu1....S.Y?...!.w.67..
......l^...b:*.EE..W.B...W..94.w..1?.t..w.v...q..t...7.A....>...-..
..K]P.....-2.;.G.h\NO'.0...L=.....W.....0..hOZ.....6.F.M.R...i..<.a
..[{$3...e...=..r..`O...._..E.Y.Y.Z7.T..\.g...,|..|.6.Pdy..uuN.*..bqV.
.....y.......y~9...E....C|<.&5"WK.z..`...7'-...6\To......../.{.....
gy..b....|?.f.|qi}[email protected]...]"D...5....5....,.......M.V..h
.YY.........e... ...?...%...-.g9l....3/.K8...B...L..I...,.....Y..N.8;.
.......;]...s.f....<8.......9..;.^......A............s....q...`.H..
......0....B..O..=....n.....=..o.../.z..yQP..7p.q.....>...,...].{.y
.]V....I>/.G.-j................/_.~|.ut.*.......4......./......{Z..
.}.mV.&....yY.. .-.;..O..E~....?T..oo.f.J.-D.D...w..G..q~._.../>..4
I..Ow....=>8.8.......OO..}[email protected]>...at..FzW..O...
......................g....}....S..|.!....Y>..pG...>..0..7~.....
...OW;W.>...q.....vE=.g............t.8.Z......../.~..S.}......_u.~.
O....{. 8-..I>....r2..`...sO=.`.c...^.G..Q~^L._.'..^..T..Hk.8.7h...
...,...=...G.y.O....W........'......b^.&.....Ih...4.d.b.....!.=}z?.v.&
gt;......a.=..........2..2..gx(.|.d#`&.......\....L..V......3(O`t....x
..{.....4.....s8.Q.^.M...... ..%:.&.wHk...}..|.O...].H\.....\p|.EW
<<< skipped >>>


GET /js/jquery.jcarousel.min.js?1 HTTP/1.1
Accept: */*
Referer: hXXp://games.mgshare.com/?mediaget=2.01.3533&client_id=&check=4a99fca9d621f844ac2ed031b5f0cced&lang=en
User-Agent: mediaget/2.01.3533/
Cookie: PHPSESSID=13bj2esfn2fosevldsben54252
Connection: Keep-Alive
Accept-Encoding: gzip, deflate
Accept-Language: en-US,*
Host: games.mgshare.com


HTTP/1.1 200 OK
Server: nginx/1.8.0
Date: Sat, 27 Feb 2016 03:44:28 GMT
Content-Type: application/javascript
Content-Length: 17547
Last-Modified: Tue, 24 Mar 2015 10:51:22 GMT
Connection: keep-alive
ETag: "551141aa-448b"
Accept-Ranges: bytes
/*! jCarousel - v0.3.3 - 2015-02-28.* hXXp://sorgalla.com/jcarousel/.*
 Copyright (c) 2006-2015 Jan Sorgalla; Licensed MIT */.(function(t){"u
se strict";var i=t.jCarousel={};i.version="0.3.3";var s=/^([ \-]=)?(. 
)$/;i.parseTarget=function(t){var i=!1,e="object"!=typeof t?s.exec(t):
null;return e?(t=parseInt(e[2],10)||0,e[1]&&(i=!0,"-="===e[1]&&(t*=-1)
)):"object"!=typeof t&&(t=parseInt(t,10)||0),{target:t,relative:i}},i.
detectCarousel=function(t){for(var i;t.length>0;){if(i=t.filter("[d
ata-jcarousel]"),i.length>0)return i;if(i=t.find("[data-jcarousel]"
),i.length>0)return i;t=t.parent()}return null},i.base=function(s){
return{version:i.version,_options:{},_element:null,_carousel:null,_ini
t:t.noop,_create:t.noop,_destroy:t.noop,_reload:t.noop,create:function
(){return this._element.attr("data-" s.toLowerCase(),!0).data(s,this),
!1===this._trigger("create")?this:(this._create(),this._trigger("creat
eend"),this)},destroy:function(){return!1===this._trigger("destroy")?t
his:(this._destroy(),this._trigger("destroyend"),this._element.removeD
ata(s).removeAttr("data-" s.toLowerCase()),this)},reload:function(t){r
eturn!1===this._trigger("reload")?this:(t&&this.options(t),this._reloa
d(),this._trigger("reloadend"),this)},element:function(){return this._
element},options:function(i,s){if(0===arguments.length)return t.extend
({},this._options);if("string"==typeof i){if(s===void 0)return this._o
ptions[i]===void 0?null:this._options[i];this._options[i]=s}else this.
_options=t.extend({},this._options,i);return this},carousel:functi
<<< skipped >>>

GET /js/jquery.cookie.js HTTP/1.1


Accept: */*
Referer: hXXp://games.mgshare.com/?mediaget=2.01.3533&client_id=&check=4a99fca9d621f844ac2ed031b5f0cced&lang=en
User-Agent: mediaget/2.01.3533/
Cookie: PHPSESSID=13bj2esfn2fosevldsben54252
Connection: Keep-Alive
Accept-Encoding: gzip, deflate
Accept-Language: en-US,*
Host: games.mgshare.com


HTTP/1.1 200 OK
Server: nginx/1.8.0
Date: Sat, 27 Feb 2016 03:44:29 GMT
Content-Type: application/javascript
Content-Length: 3140
Last-Modified: Mon, 27 Apr 2015 13:31:09 GMT
Connection: keep-alive
ETag: "553e3a1d-c44"
Accept-Ranges: bytes
/*!. * jQuery Cookie Plugin v1.4.1. * hXXps://github.com/carhartl/jque
ry-cookie. *. * Copyright 2006, 2014 Klaus Hartl. * Released under the
 MIT license. */.(function (factory) {..if (typeof define === 'functio
n' && define.amd) {...// AMD (Register as an anonymous module)...defin
e(['jquery'], factory);..} else if (typeof exports === 'object') {.../
/ Node/CommonJS...module.exports = factory(require('jquery'));..} else
 {...// Browser globals...factory(jQuery);..}.}(function ($) {...var p
luses = /\ /g;...function encode(s) {...return config.raw ? s : encode
URIComponent(s);..}...function decode(s) {...return config.raw ? s : d
ecodeURIComponent(s);..}...function stringifyCookieValue(value) {...re
turn encode(config.json ? JSON.stringify(value) : String(value));..}..
.function parseCookieValue(s) {...if (s.indexOf('"') === 0) {....// Th
is is a quoted cookie as according to RFC2068, unescape.......s = s.sl
ice(1, -1).replace(/\\"/g, '"').replace(/\\\\/g, '\\');...}....try {..
..// Replace server-side written pluses with spaces.....// If we can't
 decode the cookie, ignore it, it's unusable.....// If we can't parse 
the cookie, ignore it, it's unusable.....s = decodeURIComponent(s.repl
ace(pluses, ' '));....return config.json ? JSON.parse(s) : s;...} catc
h(e) {}..}...function read(s, converter) {...var value = config.raw ? 
s : parseCookieValue(s);...return $.isFunction(converter) ? converter(
value) : value;..}...var config = $.cookie = function (key, value, opt
ions) {....// Write....if (arguments.length > 1 && !$.isFunctio
<<< skipped >>>


GET /analytics.js HTTP/1.1
Accept: */*
Referer: hXXp://games.mgshare.com/?mediaget=2.01.3533&client_id=&check=4a99fca9d621f844ac2ed031b5f0cced&lang=en
User-Agent: mediaget/2.01.3533/
Connection: Keep-Alive
Accept-Encoding: gzip, deflate
Accept-Language: en-US,*
Host: VVV.google-analytics.com


HTTP/1.1 200 OK
Date: Sat, 27 Feb 2016 01:59:38 GMT
Expires: Sat, 27 Feb 2016 03:59:38 GMT
Last-Modified: Thu, 04 Feb 2016 00:31:28 GMT
X-Content-Type-Options: nosniff
Content-Type: text/javascript
Vary: Accept-Encoding
Content-Encoding: gzip
Server: Golfe2
Content-Length: 10938
Age: 6292
Cache-Control: public, max-age=7200
...........}.s...... .\.j&....r.s(gw.-^...Ii$.&.@f./1|...nI......U.Su.
..K....W..H.....oy.dU...{.i?J...O...Y{U..x.........)...A.1WT..H.....(v
.;.t/Y.4...........a......j...=......j.............kcc..^...f.l.z.....
.v>~...?8.|t|r.....s....z.....f8....tr{w....\..|......~8...x;u.....
.c.N......EC.q...?.......P.."..\.|.....\..a.}YX8.......FB9.-.F..9%.K&.
;[email protected]=..0.~..d...zL...X.l..,R......N!.~..\.\.yf.\...|.......
5..t....k..E.R5..X....%. (........J.O...?\B.....X::N.h.....\...8c.....
v..'.J.......}1.&i<..(.....P... ...:8..m3M5.X.[<.r...y.....8lF.{
."......4K..{.zn9....&.n.."V<Uo..F.S..n`\....d........O)..".v#.....
...O... Wo.......x4...D.&|(po....iq.4..Gw.ea...ni..`.(E...}...[...%...
...r.B."....).}..VK...8T...L.T.].=.8^x....s{.....-.g".h.:x....'U.i.'..
&.2x.0.@......@......*. .]8............7.m\..?.1..."..$*N_)8...%.....v
.s.O.q......#.,d.3 F.../..&..S ....t.ci/C]....w<..d.&...&,..=,..X].
8Vq.......i]./...OU...,.......^_>&.)a6.@'..,..t...z....z,j..{......
r:[email protected]!<......"...........a...l..
....m....]....Yd.N..........a<...<.=....C"...... ..L...De..Jq(..
fgT..]...x..C...M..|[email protected];.x..qCEG.....@T.[..3.\..9I..].4
. ..W.fI's]..q....f.... ^."...x.[[email protected]>....Gwl/.#[email protected]...
....@....%x.............W..pp.uz|MF...j..g....R[=.......|...jU..@L....
.YC......PSO.....XG.v4...9....k...............).....r......N..H...%..K
..*.]y.[....R.0.h....f9..-...S..=.`....T.-.j...2.B.........:.....e....
...hl...$..@P...=..j.............l@Z`.i.....G......S#...0,7Ky.k'.p
<<< skipped >>>

GET /plugins/ua/linkid.js HTTP/1.1


Accept: */*
Referer: hXXp://games.mgshare.com/?mediaget=2.01.3533&client_id=&check=4a99fca9d621f844ac2ed031b5f0cced&lang=en
User-Agent: mediaget/2.01.3533/
Connection: Keep-Alive
Accept-Encoding: gzip, deflate
Accept-Language: en-US,*
Host: VVV.google-analytics.com


HTTP/1.1 200 OK
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Type: text/javascript
Date: Sat, 27 Feb 2016 02:58:38 GMT
Expires: Sat, 27 Feb 2016 03:58:38 GMT
Last-Modified: Thu, 06 Nov 2014 23:19:05 GMT
X-Content-Type-Options: nosniff
Server: sffe
Content-Length: 852
X-XSS-Protection: 1; mode=block
Age: 2752
Cache-Control: public, max-age=3600
..........uTQo.6.~..p.M cNq......kP.......o.HJ.,..E;5,...%.Q..E.......
.8.Y........4.2V.'....].m.[...K!5b.... A%U4..9J..tJ....o....P,.j..W...
.....A.N..WD..b.8..9b.Z...X.-.B$.!V$..s....x.D..O.w"h|.HZ...T..yAH....
........!,K.d.0t...N.*a,\..Ot..T:.5......a..,.8[;ZOP...`..:...G.......
G..m..{}..,.."*..5Y.C.Bnz.$y.b....tR.............c..&..'#....?.{g.lA%_
..:..6ui [email protected].?<4.h.g.%.^..(...9_..V...E..|>...\..uZ...
...S.k.r..*vu....4...#W.%Q%[email protected]...:. ....Jz}.
s....u..z.....>..............^fr.Nf.y8...3...\.......f.....g.F4...g
.j...X....QiD...Y]...Q.D..F..q.0..O.7..|'..{]6.. .oh...Nw...........=?
"..qD.S ..7.1.]..I.7.QR..5.QEX.....D..T.].oF......H/.K..*v.7.{.....7LF
B.(....x......R.xw.`..b..]>.....%.&......8..Bj.!.XA...E....tZ.....6
|".)...~..>(.zz.p}.\Q..V..`d.).WK....1..k.?m;I..I..._...dX<.....
.{4bT{.7J#.N..(.z.?o....Bj!...HTTP/1.1 200 OK..Vary: Accept-Encoding..
Content-Encoding: gzip..Content-Type: text/javascript..Date: Sat, 27 F
eb 2016 02:58:38 GMT..Expires: Sat, 27 Feb 2016 03:58:38 GMT..Last-Mod
ified: Thu, 06 Nov 2014 23:19:05 GMT..X-Content-Type-Options: nosniff.
.Server: sffe..Content-Length: 852..X-XSS-Protection: 1; mode=block..A
ge: 2752..Cache-Control: public, max-age=3600............uTQo.6.~..p.M
 cNq......kP.......o.HJ.,..E;5,...%.Q..E........8.Y........4.2V.'....]
.m.[...K!5b.... A%U4..9J..tJ....o....P,.j..W........A.N..WD..b.8..9b.Z
...X.-.B$.!V$..s....x.D..O.w"h|.HZ...T..yAH............!,K.d.0t...N.*a
,\..Ot..T:.5......a..,.8[;ZOP...`..:...G.......G..m..{}..,.."*..5Y
<<< skipped >>>

GET /r/collect?v=1&_v=j41&a=2138179480&t=event&ni=1&_s=1&dl=http://games.mgshare.com/?mediaget=2.01.3533&client_id=&check=4a99fca9d621f844ac2ed031b5f0cced&lang=en&dr=http://mg.mgshare.com/?mediaget=2.01.3533&lang=en&client_id=&check=4a99fca9d621f844ac2ed031b5f0cced&ul=en-us&de=UTF-8&dt=MediaGet Catalogue&sd=32-bit&sr=1276x846&vp=721x504&je=0&ec=entry&ea=version&el=2013533&_u=CGAAAAQiI~&jid=1440573567&cid=587736484.1456544556&tid=UA-23988018-5&_r=1&z=976537894 HTTP/1.1


Referer: hXXp://games.mgshare.com/?mediaget=2.01.3533&client_id=&check=4a99fca9d621f844ac2ed031b5f0cced&lang=en
User-Agent: mediaget/2.01.3533/
Accept: */*
Connection: Keep-Alive
Accept-Encoding: gzip, deflate
Accept-Language: en-US,*
Host: VVV.google-analytics.com


HTTP/1.1 200 OK
Access-Control-Allow-Origin: *
Date: Sat, 27 Feb 2016 03:44:30 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, no-store, must-revalidate
Last-Modified: Sun, 17 May 1998 03:00:00 GMT
X-Content-Type-Options: nosniff
Content-Type: image/gif
Server: Golfe2
Content-Length: 35
GIF89a.............,...........D..;..



GET /collect?v=1&_v=j41&a=2138179480&t=pageview&_s=2&dl=http://games.mgshare.com/?mediaget=2.01.3533&client_id=&check=4a99fca9d621f844ac2ed031b5f0cced&lang=en&dr=http://mg.mgshare.com/?mediaget=2.01.3533&lang=en&client_id=&check=4a99fca9d621f844ac2ed031b5f0cced&dp=/?cat=movies&genre=all&page=1&mgver=2013533&ul=en-us&de=UTF-8&dt=MediaGet Catalogue&sd=32-bit&sr=1276x846&vp=721x504&je=0&_u=CGCACEQiJ~&jid=&cid=587736484.1456544556&tid=UA-23988018-5&z=1206974226 HTTP/1.1
Referer: hXXp://games.mgshare.com/?mediaget=2.01.3533&client_id=&check=4a99fca9d621f844ac2ed031b5f0cced&lang=en
User-Agent: mediaget/2.01.3533/
Accept: */*
Connection: Keep-Alive
Accept-Encoding: gzip, deflate
Accept-Language: en-US,*
Host: VVV.google-analytics.com


HTTP/1.1 200 OK
Access-Control-Allow-Origin: *
Date: Wed, 24 Feb 2016 20:25:44 GMT
Pragma: no-cache
Expires: Mon, 01 Jan 1990 00:00:00 GMT
Last-Modified: Sun, 17 May 1998 03:00:00 GMT
X-Content-Type-Options: nosniff
Content-Type: image/gif
Server: Golfe2
Content-Length: 35
Age: 199126
Cache-Control: no-cache, no-store, must-revalidate
GIF89a.............,...........D..;..



GET /mediaget-installer-2/binaries/download.php?a=mediaget-bin HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Host: download.mediaget.com


HTTP/1.1 200 OK
Server: nginx/1.8.0
Date: Sat, 27 Feb 2016 03:43:51 GMT
Content-Type: application/octet-stream
Content-Length: 5111670
Last-Modified: Mon, 08 Feb 2016 15:55:53 GMT
Connection: keep-alive
ETag: "56b8ba89-4dff76"
Accept-Ranges: bytes
7z..'...n.A...M.....i........f[q.&..p.........../D.N..b....si...pp.1s.
%...1.....}.P`..M..6..M.K8agO..p*.'.T(....f.eN.|...tvN...u......%.jS0.
.b`<v..X...`..x?._R...[T"..@....@....,s..#3..0..;.P.Y.}G .h"..e....
.3..yG......T%5.u....\ ....'........ H..!n..........yD....j...A.../S,.
...yk......,t.F|...LJ/........m`U.."......B'........{3O..........8^n.G
..~...g...Q....$........B..VH..F...s;..H..y..%.$.."P2.Pi...9.T........
i.#O..d../!..x.tQX1....i.F..~.K'..P)y..Z...Z'].94>.T..'..........Ct
...T..<bH).h...>..N.Y......)..W ..D..U.....b..e...qW...#.PU.....
.}.I.Brs..q^.].H8.J..S.......&.=.&.U..A_u.....F..4u.&C.G......q..p. ..
....*......_..]....b.sg6u..:.../m..Q~.EXT...E.vd...D.O&.r".}\..Z..`..&
x..y.n..M. ..12L.r..I^F...A.b&2.].DN...l..t...a.N.kt...:...[J...P....&
gt;K.....ncgK40..tE...5...-.....|.F....)$/(.I...C..!.. ...m...C.c.\..=
.&..}.Wk.............}......R.P..@..#....n....<[email protected]..&C..
./2'&...:g.}.<n.O..t.#....).F^.H$#l4n....gH.\-....rZ..oA.........B.
.....'-..@..^......S...a.AG..v. /.0.2.Te P.,..*d..e.B.Ei.".p.......O.a
....<./&U....R.....5H]..%...(..".|.Z. J.......*kMI,X.Z1F...\.....X.
...;M.........V.V.xo...wmN...]q.i.......<}z.7...".c...._.Lnm.8O..e.
0......>n..$.q&...s....F.*$.....*..<..H.E.F=...[...=i.I..i Da2."
.]/#.T.0..,.~T.=L...*Eb.p..s.Dy..D8... .N.......H1_...cb...4....sZx...
V.....s..l ..?.5e..8y...u@(.....|..Jijr2q.YG.4.k.EhVyp|t.`_..{.k..l.:.
.k.n.-.[....V..a.A..l.`m.R...Q.....O.D....i..g.../...hk.4............o
.l._|#D.7...\...T.%..2&/.j;..`.........4...I.^....{...a.^W.O...\y.
<<< skipped >>>

GET /mediaget-installer-2/bundles/bundle.php?b=yandex HTTP/1.1


User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Host: download.mediaget.com


HTTP/1.1 200 OK
Server: nginx/1.8.0
Date: Sat, 27 Feb 2016 03:43:53 GMT
Content-Type: application/octet-stream
Content-Length: 13178777
Last-Modified: Fri, 22 Jun 2012 13:48:03 GMT
Connection: keep-alive
ETag: "4fe47793-c91799"
Accept-Ranges: bytes
7z..'...............l........Z...&..p.........../D.|.../._..z.-~A...\.
.*~kHy54......<......=.......6......! o..- 6Y...{..}2&...(....Cl{Jk
l...y=T..#..s6..l.....&..'2{[email protected] .....}#.:.}{.2..q.0J.6..;
[email protected]^@....zvI.....s..\.........Vs.e....k....
..|...lZ;s.......W...?".Cq.(.k$UF....WI...W.....T...9......?:oN.W.]..f
M..3.V..YK..x.!.n.....f.%..(} =~..;qV..P.....#....k...:.j....Mr....G.n
...;...!.. ......._F.1]..~..S..R.....=....OY.U....k..jU..x............
........S.....KHQj]..../. ..6.L..2..nAS.Z8.....1..b^.-r......`...9M.I.
.~|Y...D....kn6%.p>=..:,l..g..^.V...Sqyj(#I)fS...hw.....46....>.
.........~O}.b.......%U...3S{!.d.[.._.6KY.......W..$.. .W............m
l....]......7.._.K.`p...f!qI....~....s.....p.H..(EHu...!.t..O......YZq
o..Z.b...i.6............?.....`>%.qVY.r.`7....e.{...a.g....)m?....X
.*.T..r.X.K.....x...R]...cQ.qb.w..o..T...6G..%x..t.{}i.R.....u.....&.n
.G3.:...opp.WN.#..;ju..|.....v..2.o.}K.<>RDb.s ~....ik.....I.P..
...........7|[email protected]....\0[..........@d.
am.....P..2..;.H........i.t59I.......y..`.3..=y7d.\....C.|y<.`s.f..
a....^i ....Y.I.....H..F9..>..'.......J[i.7.U;I......T.O.&p....xa..
Q.1..=.......fve...&W..y.b.&.(....e..8...q.......;..a..E..B..,..Flw.su
.F..,.....|O.Z.......t.rm..yh.....>m.4.fI.........9R.............b,
.P..I:..`C.Y.6/[email protected]>}$.k....q..Z.S.6......x.$...m...s.t...uO.
.J.<..N.j....ay..@...}.,..1Q...>..)../p.z..J.....0a[..p.|.......
..z.'f....7DK..L.T..............o.,...#.O..V..^..R...._..VX..B.^..
<<< skipped >>>


GET /download/?file=50409 HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:2.0) Gecko/20100101 Firefox/4.0 mediaget
Host: VVV.playground.ru
Referer: hXXp://VVV.playground.ru
Accept-Language: en,*
Connection: Keep-Alive
Accept-Encoding: gzip, deflate


HTTP/1.1 302 Found
Server: nginx/1.6.1
Date: Sat, 27 Feb 2016 03:44:27 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.5.23
Set-Cookie: PHPSESSID=ocxmy53m7i97238yyhw4pqoaaqvkqp5d; path=/; domain=.playground.ru; HttpOnly
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: auth_key=a56e36e101f5bf15aebfc39416835e96; expires=Tue, 24-Feb-2026 03:44:27 GMT; Max-Age=315360000; path=/; domain=.playground.ru
location: hXXp://VVV.playground.ru/files/world_of_tanks_hp_marker-50409/?error=empty_hash
0..HTTP/1.1 302 Found..Server: nginx/1.6.1..Date: Sat, 27 Feb 2016 03:
44:27 GMT..Content-Type: text/html; charset=utf-8..Transfer-Encoding: 
chunked..Connection: keep-alive..X-Powered-By: PHP/5.5.23..Set-Cookie:
 PHPSESSID=ocxmy53m7i97238yyhw4pqoaaqvkqp5d; path=/; domain=.playgroun
d.ru; HttpOnly..Expires: Thu, 19 Nov 1981 08:52:00 GMT..Cache-Control:
 no-store, no-cache, must-revalidate, post-check=0, pre-check=0..Pragm
a: no-cache..Set-Cookie: auth_key=a56e36e101f5bf15aebfc39416835e96; ex
pires=Tue, 24-Feb-2026 03:44:27 GMT; Max-Age=315360000; path=/; domain
=.playground.ru..location: hXXp://VVV.playground.ru/files/world_of_tan
ks_hp_marker-50409/?error=empty_hash..0......


GET /files/world_of_tanks_hp_marker-50409/?error=empty_hash HTTP/1.1


User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:2.0) Gecko/20100101 Firefox/4.0 mediaget
Referer: hXXp://VVV.playground.ru
Accept-Language: en,*
Host: VVV.playground.ru
Cookie: PHPSESSID=ocxmy53m7i97238yyhw4pqoaaqvkqp5d; auth_key=a56e36e101f5bf15aebfc39416835e96
Connection: Keep-Alive
Accept-Encoding: gzip, deflate


HTTP/1.1 200 OK
Server: nginx/1.6.1
Date: Sat, 27 Feb 2016 03:44:29 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.5.23
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Encoding: gzip
600a..............ys...........3&e.;......M./[email protected][email protected]\.e<
.....'3...b;.;..}o]...]..O.~......;.W,.)..DX.H4N..w.y~..{.z...........
...d...M...W.6V..4......wL......M.%....~T.....1{...;.l...y..5....lXm..
....3TX.:9...kj..Q......q..l61..e66/v-.4.m..,.#3...Jf..o..k.Y..4..i.0{
...y.o<a....1......._..:.)?.e...k.o.7...?.~=.u.hX].........7.P.....
7(.........W.^?xu...?....ex...<.U>.)....~4......Y.....y.I5....62
....v...^..;=..aP.#...Jm[.........N.r.....Z.l....X...s.Q....9PMXu...S7
;...A......]../....z>.......V.V^.z.....k.B~....r7...5.....[..1eq..,
..?..].4......t;.?......K8..k.n.......\...._.e/..Mg.3V..w,E...f.......
.1|_.............P..Bn.._....?.....Z..Z..GM..m.j.z...:x.5........I....
..<.j....Nl.'..ZA.`.Qu.U.....W........Z.....z...[.N.>~.Z.{..p...
.fG...n..[..du.....6\...1;...L......S.~.c.M....y..u.s...Lb..;=c...F&6.
DaV..3'.&...m.....M.......k..[Y.p..{.o....=.Q..p..).m...u..j7bU.....J!
5.......6U.....M..D|.<....mYaa...V..{.F/Ws...]...u.......rn)_...g..
.R.wH..6:.....r...;[.....>.|...z.T..93.....R.]Su..*..f...Z..SWf.HMR
\.0{.c...Vv...;...{.Y.....Y....i.U.ov ...3X...e._.R...B>..M..Z...Xf
..dq9....;..Wo<p..y.<i.....T(._-....5^........kw...d.-D...v.B0..
.fGl\Z._.7...._...=Q.......8j...w...7.u.8A...l).. ...$q.U....u.;..i..'
.......x..^..4.O.xs.FGvs7.........S.tq..v]......L...].......Y87~\3.:v.
.>W..2X..!3..C..K|..g......?.]...[..........>x.....=..t.....`..`
.t...[z.|........p.y...;=,i~.nX..^......(...M..Ms.Td....x;.$.....vv...
w....w}[email protected]/e.....|.3.8......~i?.^x.|...u..}..
<<< skipped >>>


GET /js/jquery-postmessage.js HTTP/1.1
Accept: */*
Referer: hXXp://mg.mgshare.com/?mediaget=2.01.3533&lang=en&client_id=&check=4a99fca9d621f844ac2ed031b5f0cced
User-Agent: mediaget/2.01.3533/
Cookie: PHPSESSID=c08c68a7d34c35e04bfaa42aaebf7a75
Connection: Keep-Alive
Accept-Encoding: gzip, deflate
Accept-Language: en-US,*
Host: mg.mgshare.com


HTTP/1.1 200 OK
Server: nginx/1.6.2
Date: Sat, 27 Feb 2016 03:44:28 GMT
Content-Type: application/javascript
Content-Length: 8839
Last-Modified: Mon, 10 Nov 2014 13:29:00 GMT
Connection: keep-alive
ETag: "5460bd9c-2287"
Accept-Ranges: bytes
/*!.. * jQuery postMessage - v0.5 - 9/11/2009.. * hXXp://benalman.com/
projects/jquery-postmessage-plugin/.. * .. * Copyright (c) 2009 "Cowbo
y" Ben Alman.. * Dual licensed under the MIT and GPL licenses... * htt
p://benalman.com/about/license/.. */..// Script: jQuery postMessage: C
ross-domain scripting goodness..//..// *Version: 0.5, Last updated: 9/
11/2009*..// ..// Project Home - hXXp://benalman.com/projects/jquery-p
ostmessage-plugin/..// GitHub       - hXXp://github.com/cowboy/jquery-
postmessage/..// Source       - hXXp://github.com/cowboy/jquery-postme
ssage/raw/master/jquery.ba-postmessage.js..// (Minified)   - hXXp://gi
thub.com/cowboy/jquery-postmessage/raw/master/jquery.ba-postmessage.mi
n.js (0.9kb)..// ..// About: License..// ..// Copyright (c) 2009 "Cowb
oy" Ben Alman,..// Dual licensed under the MIT and GPL licenses...// h
ttp://benalman.com/about/license/..// ..// About: Examples..// ..// Th
is working example, complete with fully commented code, illustrates on
e..// way in which this plugin can be used...// ..// Iframe resizing -
 hXXp://benalman.com/code/projects/jquery-postmessage/examples/iframe/
..// ..// About: Support and Testing..// ..// Information about what v
ersion or versions of jQuery this plugin has been..// tested with and 
what browsers it has been tested in...// ..// jQuery Versions - 1.3.2.
.// Browsers Tested - Internet Explorer 6-8, Firefox 3, Safari 3-4, Ch
rome, Opera 9...// ..// About: Release History..// ..// 0.5 - (9/11/20
09) Improved cache-busting..// 0.4 - (8/25/2009) Initial release..
<<< skipped >>>


GET /?mediaget=2.01.3533&client_id=&check=4a99fca9d621f844ac2ed031b5f0cced&lang=en HTTP/1.1
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8
Referer: hXXp://mg.mgshare.com/?mediaget=2.01.3533&lang=en&client_id=&check=4a99fca9d621f844ac2ed031b5f0cced
User-Agent: mediaget/2.01.3533/
Connection: Keep-Alive
Accept-Encoding: gzip, deflate
Accept-Language: en-US,*
Host: games.mgshare.com


HTTP/1.1 200 OK
Server: nginx/1.8.0
Date: Sat, 27 Feb 2016 03:44:28 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.4.16
Set-Cookie: PHPSESSID=13bj2esfn2fosevldsben54252; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
1f00..<!DOCTYPE html>..<html>..<head>...<meta cha
rset="utf-8">...<title>MediaGet Catalogue</title>...<
;link rel="stylesheet" href="/css/main.css?1450780404" />...<scr
ipt src="hXXp://ajax.googleapis.com/ajax/libs/jquery/1.8.2/jquery.js"&
gt;</script>...<!--[if IE]><script src="hXXp://html5shi
v.googlecode.com/svn/trunk/html5.js"></script><![endif]--&
gt;...<!--[if gte IE 9]>...  <style type="text/css">.....g
radient {....   filter: none;....}...  </style>...<![endif]--
>...<script type="text/javascript" src="/js/jquery.jcarousel.min
.js?1"></script>...<link rel="stylesheet" type="text/css" 
href="/css/skin.css" />...<link rel="stylesheet" href="/css/jque
ry.jscrollpane.css" >...<script type="text/javascript" src="/js/
jquery.jscrollpane.min.js"></script>...<script type="text/
javascript" src="/js/jquery.mousewheel.js"></script>...<sc
ript src="/js/action.js"></script>...<script src="/js/jque
ry-postmessage.js"></script>...<!-- version: 2013533 -->
;...<script>var passTorrentXMLInfo = false;</script>...<
;script>var mediagetVersion = '2013533';</script>...<scrip
t type="text/javascript" src="/js/main.js?1453889881"></script&g
t;...<script type="text/javascript" src="/js/jquery.cookie.js">&
lt;/script>...<link rel="stylesheet" href="/css/webkit-scrollbar
.css?1415274801" />...<link rel="stylesheet" type="text/css"
<<< skipped >>>

GET /css/main.css?1450780404 HTTP/1.1


Accept: text/css,*/*;q=0.1
Referer: hXXp://games.mgshare.com/?mediaget=2.01.3533&client_id=&check=4a99fca9d621f844ac2ed031b5f0cced&lang=en
User-Agent: mediaget/2.01.3533/
Cookie: PHPSESSID=13bj2esfn2fosevldsben54252
Connection: Keep-Alive
Accept-Encoding: gzip, deflate
Accept-Language: en-US,*
Host: games.mgshare.com


HTTP/1.1 200 OK
Server: nginx/1.8.0
Date: Sat, 27 Feb 2016 03:44:28 GMT
Content-Type: text/css
Content-Length: 26295
Last-Modified: Tue, 22 Dec 2015 10:33:24 GMT
Connection: keep-alive
ETag: "567926f4-66b7"
Accept-Ranges: bytes
@import "/css/sprite.css";html,body,div,span,applet,object,iframe,h1,h
2,h3,h4,h5,h6,p,blockquote,pre,a,abbr,acronym,address,big,cite,code,de
l,dfn,em,img,ins,kbd,q,s,samp,small,strike,strong,sub,sup,tt,var,b,u,i
,center,dl,dt,dd,ol,ul,li,fieldset,form,label,legend,table,caption,tbo
dy,tfoot,thead,tr,th,td,article,aside,canvas,details,embed,figure,figc
aption,footer,header,hgroup,menu,nav,output,ruby,section,summary,time,
mark,audio,video{margin:0;padding:0;border:0;font-size:100%;vertical-a
lign:baseline}article,aside,details,figcaption,figure,footer,header,hg
roup,menu,nav,section{display:block}body{line-height:1}ol,ul{list-styl
e:none}blockquote,q{quotes:none}blockquote:before,blockquote:after,q:b
efore,q:after{content:'';content:none}table{border-collapse:collapse;b
order-spacing:0}@font-face{font-family:'metamediumcyr-romanregular';sr
c:url('/fonts/metamediumcyr-roman-webfont.eot');src:url('/fonts/metame
diumcyr-roman-webfont.eot?#iefix') format('embedded-opentype'),url('/f
onts/metamediumcyr-roman-webfont.woff') format('woff'),url('/fonts/met
amediumcyr-roman-webfont.ttf') format('truetype');font-weight:normal;f
ont-style:normal}@font-face{font-family:'s-core';src:url('/fonts/s-cor
e_-_coresansm37cnlight-webfont.eot');src:url('/fonts/s-core_-_coresans
m37cnlight-webfont.eot?#iefix') format('embedded-opentype'),url('/font
s/s-core_-_coresansm37cnlight-webfont.woff') format('woff'),url('/font
s/s-core_-_coresansm37cnlight-webfont.ttf') format('truetype');font-we
ight:normal;font-style:normal}@font-face{font-family:'metanormalcy
<<< skipped >>>

GET /js/action.js HTTP/1.1


Accept: */*
Referer: hXXp://games.mgshare.com/?mediaget=2.01.3533&client_id=&check=4a99fca9d621f844ac2ed031b5f0cced&lang=en
User-Agent: mediaget/2.01.3533/
Cookie: PHPSESSID=13bj2esfn2fosevldsben54252
Connection: Keep-Alive
Accept-Encoding: gzip, deflate
Accept-Language: en-US,*
Host: games.mgshare.com


HTTP/1.1 200 OK
Server: nginx/1.8.0
Date: Sat, 27 Feb 2016 03:44:28 GMT
Content-Type: application/javascript
Content-Length: 726
Last-Modified: Thu, 06 Nov 2014 11:53:23 GMT
Connection: keep-alive
ETag: "545b6133-2d6"
Accept-Ranges: bytes
function setMethod(a,c){var b=null;if(typeof(c)=="string"){b=document.
getElementById(c)}else{if(c){b=c.form}}if(b){b.elements.method.value=a
}else{document.getElementById("method").value=a}}function redirect(a){
if(navigator.userAgent.indexOf("MSIE")>=0){newlink=document.createE
lement("a");newlink.style.visibility="hidden";newlink.href=a;document.
body.appendChild(newlink);newlink.click()}else{document.location.href=
a}}function back(){if(document.forms&&document.forms.length>0&&docu
ment.forms[document.forms.length-1].elements.method){document.forms[do
cument.forms.length-1].method.value="goBack";document.forms[document.f
orms.length-1].submit()}else{if(document.referrer){redirect(document.r
eferrer)}else{history.go(-1)}}};....


GET /js/jquery-postmessage.js HTTP/1.1


Accept: */*
Referer: hXXp://games.mgshare.com/?mediaget=2.01.3533&client_id=&check=4a99fca9d621f844ac2ed031b5f0cced&lang=en
User-Agent: mediaget/2.01.3533/
Cookie: PHPSESSID=13bj2esfn2fosevldsben54252
Connection: Keep-Alive
Accept-Encoding: gzip, deflate
Accept-Language: en-US,*
Host: games.mgshare.com


HTTP/1.1 200 OK
Server: nginx/1.8.0
Date: Sat, 27 Feb 2016 03:44:29 GMT
Content-Type: application/javascript
Content-Length: 1041
Last-Modified: Thu, 06 Nov 2014 11:53:23 GMT
Connection: keep-alive
ETag: "545b6133-411"
Accept-Ranges: bytes
/*!. * jQuery postMessage - v0.5 - 9/11/2009. * hXXp://benalman.com/pr
ojects/jquery-postmessage-plugin/. * . * Copyright (c) 2009 "Cowboy" B
en Alman. * Dual licensed under the MIT and GPL licenses.. * hXXp://be
nalman.com/about/license/. */.(function($){var b,d,j=1,a,f=this,g=!1,h
="postMessage",c="addEventListener",e,i=f[h]&&!$.browser.opera;$[h]=fu
nction(k,m,l){if(!m){return}k=typeof k==="string"?k:$.param(k);l=l||pa
rent;if(i){l[h](k,m.replace(/([^:] :\/\/[^\/] ).*/,"$1"))}else{if(m){l
.location=m.replace(/#.*$/,"") "#" ( new Date) (j  ) "&" k}}};$.receiv
eMessage=e=function(m,l,k){if(i){if(m){a&&e();a=function(n){if((typeof
 l==="string"&&n.origin!==l)||($.isFunction(l)&&l(n.origin)===g)){retu
rn g}m(n)}}if(f[c]){f[m?c:"removeEventListener"]("message",a,g)}else{f
[m?"attachEvent":"detachEvent"]("onmessage",a)}}else{b&&clearInterval(
b);b=null;if(m){k=typeof l==="number"?l:typeof k==="number"?k:100;b=se
tInterval(function(){var o=document.location.hash,n=/^#?\d &/;if(o!==d
&&n.test(o)){d=o;m({data:o.replace(n,"")})}},k)}}}})(jQuery);..
..


GET /fonts/metamediumcyr-roman-webfont.ttf HTTP/1.1


Referer: hXXp://games.mgshare.com/?mediaget=2.01.3533&client_id=&check=4a99fca9d621f844ac2ed031b5f0cced&lang=en
User-Agent: mediaget/2.01.3533/
Accept: */*
Cookie: PHPSESSID=13bj2esfn2fosevldsben54252; _ym_uid=145654455533563744; _ym_isad=0; _ym_visorc_17454814=w
Connection: Keep-Alive
Accept-Encoding: gzip, deflate
Accept-Language: en-US,*
Host: games.mgshare.com


HTTP/1.1 200 OK
Server: nginx/1.8.0
Date: Sat, 27 Feb 2016 03:44:30 GMT
Content-Type: application/octet-stream
Content-Length: 50608
Last-Modified: Thu, 06 Nov 2014 11:53:22 GMT
Connection: keep-alive
ETag: "545b6132-c5b0"
Accept-Ranges: bytes
...........0FFTMUs.....<....GDEF.......X... GPOS ......x....GSUB.2.
.... ...0OS/2|......P...`cmap............cvt ...........:fpgmS./......
..egasp......"`....glyf>....."h....head.......|...6hhea...........$
hmtx..M.........loca...\...p....maxp.......@... nameLjf....`...Bpost/.
.'.......Iprep............webf..R..................=.......-........V&
lt;.......................................0.>..cyrl..latn..........
..................kern.............................j.........N.....8.R
.p.~.........4.R.d.........6.......n.....4.......h...@...<.........
2.....(.~.....H.n...".p.....j.....|...(.....................^...f...l.
r.............^.R............. .>.D.J.T.v....... ...........7.H.9..
.:...<.q.............).........................................&...
*...F...G...J...R...W.\.Y.\.Z...\.....................$...0...6...7...
9...:...;...<...=...D...V...W...Y...[...\...]......................
...........$...&...*...2...4...7...8...9...:...;...<...F...G...H...
J...O...R...T...W.3.X...Y.\.Z...\.3...................................
......................................................................
......................................................................
......................................................................
......................................................................
V...Y...[...\.................&...*...0...2...4...6...7...8...9...:...
<...F...O...W...X...Y...\.........$...7...9...:...<...=...D...H.
..J...S...T...V...X...Y...[...\...'.....%...&...(...)...*... .....
<<< skipped >>>


GET /file/images/557/5666db39228e3.jpg HTTP/1.1
Referer: hXXp://www2.bubblesmedia.ru/file/mg_left.php?version=2.01.3533
User-Agent: mediaget/2.01.3533/
Accept: */*
Cookie: 08fd04da1b9c3e4c1c9ab1fe42494a35=%7B%22v%22%3A1%2C%22p%22%3A%7B%221990%22%3A1%7D%2C%22o%22%3A%7B%22557%22%3A1%7D%7D
Connection: Keep-Alive
Accept-Encoding: gzip, deflate
Accept-Language: en-US,*
Host: admitlead.ru


HTTP/1.1 200 OK
Server: nginx/1.8.0
Date: Sat, 27 Feb 2016 03:44:28 GMT
Content-Type: image/jpeg
Content-Length: 27530
Last-Modified: Tue, 08 Dec 2015 13:29:29 GMT
Connection: keep-alive
ETag: "5666db39-6b8a"
Accept-Ranges: bytes
......Exif..II*.......1.......2...2.......P...i.......j.......Adobe Ph
otoshop CC (Windows)..2015-10-14T17:18:20 03:00...........0220........
..............................Ducky.......d......hXXp://ns.adobe.com/x
ap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> &l
t;x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 
79.154911, 2013/10/29-11:47:16        "> <rdf:RDF xmlns:rdf="htt
p://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:
about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:dc="hXXp://pur
l.org/dc/elements/1.1/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" 
xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:Creat
orTool="Adobe Photoshop CC (Windows)" xmp:CreateDate="2015-10-14T17:05
:20 03:00" xmp:ModifyDate="2015-10-14T17:18:20 03:00" xmp:MetadataDate
="2015-10-14T17:18:20 03:00" dc:format="image/jpeg" xmpMM:InstanceID="
xmp.iid:6BA4F4E0727E11E5B791B2AE4A63D196" xmpMM:DocumentID="xmp.did:6B
A4F4E1727E11E5B791B2AE4A63D196"> <xmpMM:DerivedFrom stRef:instan
ceID="xmp.iid:6BA4F4DE727E11E5B791B2AE4A63D196" stRef:documentID="xmp.
did:6BA4F4DF727E11E5B791B2AE4A63D196"/> </rdf:Description> &l
t;/rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d
......................................................................
......................................................................
......................................................................
...................................!1.".5.A234.6Qb#cd.aqRS$Te7..Bf
<<< skipped >>>


GET /index.php HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Host: install.media-get.ru
Content-Length: 930

<?xml version="1.0" encoding="UTF-8"?>
<mediagetInstaller statVersion="20" mediagetIsAlreadyInstalled="0" incomplete="0" error="0" nonCriticalErrorsCount="0">
.<closed>0</closed>
.<closedCnt>0</closedCnt>
.<restored>0</restored>
.<restoredCnt>0</restoredCnt>
.<installationStarted>31</installationStarted>
.<downloadStarted>31</downloadStarted>
.<downloadFinished>35</downloadFinished>
.<extractStarted>35</extractStarted>
.<extractFinished>41</extractFinished>
.<presentationSwitchedToManual>0</presentationSwitchedToManual>
.<installationFinished>41</installationFinished>
.<installerTerminated>61</installerTerminated>
.<redistWasInstalled>1</redistWasInstalled>
.<mediagetLaunched>countdownFinished</mediagetLaunched>
.<errorMessage></errorMessage>
.<nonCriticalErrors></nonCriticalErrors>
.<defaultBrowser>ie</defaultBrowser>
.<browserHomepage>hXXp://VVV.yandex.ru/?win=217&clid=187997</browserHomepage>
</mediagetInstaller>

HTTP/1.1 200 OK
Server: nginx/1.4.4
Date: Sat, 27 Feb 2016 03:44:21 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.28
0..



GET /r/get_code/2/?subid=0&version=2.01.3533 HTTP/1.1
Accept: */*
Referer: hXXp://www2.bubblesmedia.ru/file/adv.php?version=2.01.3533
User-Agent: mediaget/2.01.3533/
Connection: Keep-Alive
Accept-Encoding: gzip, deflate
Accept-Language: en-US,*
Host: sub2.admitlead.ru


HTTP/1.1 200 OK
Server: nginx/1.8.0
Date: Sat, 27 Feb 2016 03:44:28 GMT
Content-Type: text/javascript; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.5.27
Access-Control-Allow-Origin: *
Set-Cookie: php-console-server=5; path=/
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Pragma: no-cache
Last-Modified: Sat, 27 Feb 2016 03:44:28GMT
71d..//<script>.    var al_rotator_data = al_rotator_data || {2:
{}};..    function cpaLoadScript2(el_parent, rid, subid, callback) {. 
       var protocol = 'http:';.        if ('https:' == document.locati
on.protocol).            protocol = 'https:';.        var url = protoc
ol   '//sub2.admitlead.ru/r/display/2/0/?a=1&mg_version=2.01.3533&rnd=
'   Math.round(Math.random() * 100000);..        var el_rot = document
.createElement('script');.        el_rot.defer = false;.        el_rot
.type = 'text/javascript';.        el_rot.src = url;..        var head
 = document.getElementById(el_parent);.        head.appendChild(el_rot
);.        el_rot.onload = function () {.            if (callback.done
) return;.            callback.done = true;.            callback(rid, 
subid, el_parent);.        };..        el_rot.onreadystatechange = fun
ction () {.            if ((!callback.done) && ( this.readyState == 'c
omplete' || this.readyState == "loaded" )) {.                callback.
done = true;.                callback(rid, subid, el_parent);.        
    }.        }.    }..        function al_load_2() {.                
cpaLoadScript2('al_rotator_block_2_0', 2, '0', function (rid, sub, el_
parent) {.            var promo = al_rotator_data[rid][sub],.         
       html = promo['promo_code'],.                node;..            
if (undefined == html).                return false;..            node
 = document.getElementById(el_parent);.            node.innerHTML = ht
ml;.                        if ('undefined' != typeof (bannerJsObj
<<< skipped >>>

GET /r/display/2/0/?a=1&mg_version=2.01.3533&rnd=19720 HTTP/1.1


Accept: */*
Referer: hXXp://www2.bubblesmedia.ru/file/adv.php?version=2.01.3533
User-Agent: mediaget/2.01.3533/
Cookie: php-console-server=5
Connection: Keep-Alive
Accept-Encoding: gzip, deflate
Accept-Language: en-US,*
Host: sub2.admitlead.ru


HTTP/1.1 200 OK
Server: nginx/1.8.0
Date: Sat, 27 Feb 2016 03:44:28 GMT
Content-Type: text/javascript; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.5.27
Access-Control-Allow-Origin: *
Set-Cookie: lvrp2=1977; expires=Sun, 28-Feb-2016 03:44:28 GMT; Max-Age=86400
Set-Cookie: 08fd04da1b9c3e4c1c9ab1fe42494a35=%7B%22v%22%3A1%2C%22p%22%3A%7B%221977%22%3A1%7D%2C%22o%22%3A%7B%22511%22%3A1%7D%7D; expires=Sun, 28-Feb-2016 03:44:28 GMT; Max-Age=86400; path=/; domain=.admitlead.ru
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Pragma: no-cache
Last-Modified: Sat, 27 Feb 2016 03:44:28GMT
10f..al_rotator_data[2]['0']={"promo_code":"<a href=\"http:\/\/sub2
.admitlead.ru\/sb\/rclk\/r\/2\/h\/c5d477\/p\/1977?g=bubblesmedia.ru\/g
o\/\" target=\"_blank\">\n        <img src=\"http:\/\/admitlead.
ru\/file\/images\/511\/564c8725baafd.jpg\" alt=\"\"><\/a>","i
mg_height":90}..0..HTTP/1.1 200 OK..Server: nginx/1.8.0..Date: Sat, 27
 Feb 2016 03:44:28 GMT..Content-Type: text/javascript; charset=UTF-8..
Transfer-Encoding: chunked..Connection: keep-alive..X-Powered-By: PHP/
5.5.27..Access-Control-Allow-Origin: *..Set-Cookie: lvrp2=1977; expire
s=Sun, 28-Feb-2016 03:44:28 GMT; Max-Age=86400..Set-Cookie: 08fd04da1b
9c3e4c1c9ab1fe42494a35=%7B%22v%22%3A1%2C%22p%22%3A%7
B%221977%22%3A1%7D%2C%22o%22%3A%7B%22511%22%3A
1%7D%7D; expires=Sun, 28-Feb-2016 03:44:28 GMT; Max-Age=86400; pat
h=/; domain=.admitlead.ru..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Cac
he-Control: no-cache, must-revalidate..Pragma: no-cache..Last-Modified
: Sat, 27 Feb 2016 03:44:28GMT..10f..al_rotator_data[2]['0']={"promo_c
ode":"<a href=\"http:\/\/sub2.admitlead.ru\/sb\/rclk\/r\/2\/h\/c5d4
77\/p\/1977?g=bubblesmedia.ru\/go\/\" target=\"_blank\">\n        &
lt;img src=\"http:\/\/admitlead.ru\/file\/images\/511\/564c8725baafd.j
pg\" alt=\"\"><\/a>","img_height":90}..0..
<<< skipped >>>


GET /filecache/userfiles/v2/images/torrents/ИГРЫ/worldoftanks/worldtanks---width_portrait---145---207.jpg HTTP/1.1
Referer: hXXp://games.mgshare.com/?mediaget=2.01.3533&client_id=&check=4a99fca9d621f844ac2ed031b5f0cced&lang=en
User-Agent: mediaget/2.01.3533/
Accept: */*
Cookie: _ym_uid=145654455533563744; _ym_isad=0; _ym_visorc_17454814=w; _ga=GA1.2.587736484.1456544556
Connection: Keep-Alive
Accept-Encoding: gzip, deflate
Accept-Language: en-US,*
Host: img.mgshare.com


HTTP/1.1 200 OK
Server: nginx/1.8.0
Date: Sat, 27 Feb 2016 03:44:30 GMT
Content-Type: image/jpeg
Content-Length: 15389
Last-Modified: Thu, 16 Apr 2015 09:23:49 GMT
Connection: keep-alive
ETag: "552f7fa5-3c1d"
Expires: Sat, 12 Mar 2016 03:44:30 GMT
Cache-Control: max-age=1209600
Accept-Ranges: bytes
......JFIF.............C..............................................
......................C...............................................
......................................................................
.N..........................!.1.."A.Qa.2q..#B....3RSV...$%CUW....'4br.
...T....................................8.........................!1..
.."AQ...2Ta..3BDRSq#[email protected][email protected]....
[email protected][email protected][email protected][email protected][email protected].
[email protected]...'.Q,.............r.....?.....F.n[..m...{.I
...4..x..!.....?#.<..D..6.s.z....%]9."F:._s....9.........9.....~..i
wU@.;gu.8........q..C..........._.....|g...1...O.4.....E..?...........
.{....7`.h.....\c..Q_...>.....?./..;nw.....a.Q........?N....r...B.?
.._.....R.........f,..R.Qm:..#!-.uD..'R=..=k..?.o._..`.~..."M3d..l...[
s\I..l.6..Wgl.R...[....g........)[#.3.1.........J-.?.NG*........x..1..
.......UlU...j0.......VA.hK.k.5...e)..nU.G..... hN.:..n..[..mn.Zy=m..i
*J...#.j......................_.-..c.mN..V..k..l.-.c..H=...i...|..?\."
.....y..~..m^...m..?.<..k...?.....w...........-.BJ...(H8$._.....g.~
2!.....rK.<..D..?..pr..%..p?.o.....n?.x~..N|#......_.r....F.*U.....
 ."M.KM...R...J.).)t..7...~F.....2........k..i.....=.x..._...........Q
l.....D.X\...EY...}..?3>y .L..N>...(r..C.#......T..XJ](.......b.
.u..e...V....TV....N3..._....h.[.g,..U..]....7U........Nu....R....(<
;... .}.5..8:!W^C.gs9..]W..b.U.4.h. ..V3HL....3...px:.r....F.......)..
j..8O..P.~..R.5.jM........ ...9.Rh...qd{.^B..*...$.S*....).Ao.....
<<< skipped >>>


GET /?mediaget=2.01.3533&lang=en&client_id=&check=4a99fca9d621f844ac2ed031b5f0cced HTTP/1.1
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8
User-Agent: mediaget/2.01.3533/
Connection: Keep-Alive
Accept-Encoding: gzip, deflate
Accept-Language: en-US,*
Host: mg.mgshare.com


HTTP/1.1 200 OK
Server: nginx/1.6.2
Date: Sat, 27 Feb 2016 03:44:27 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.4.45
Set-Cookie: PHPSESSID=c08c68a7d34c35e04bfaa42aaebf7a75; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
4ef..<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Frameset//EN" "ht
tp://VVV.w3.org/TR/html4/frameset.dtd">.<html>.<head>..
<script src="/js/jquery-1.7.1.min.js" type="text/javascript"><
;/script>.<script src="/js/jquery-postmessage.js" type="text/jav
ascript"></script>..<script>..$.receiveMessage(...funct
ion(e) {....if(e.data.substring(0, 4) == "cmd:") {.....if(e.data.subst
ring(4) == "hideMenu") {......$("#frameset").attr({'rows': '0,*'});...
..} else if(e.data.substring(4) == "showMenu") {......$("#frameset").a
ttr({'rows': '36,*'});.....} else {......$.get("/save.php?"   e.data.s
ubstring(4), function() {.......window.location.reload();......});....
.}....}...}..);.</script>..<meta http-equiv="Content-Type" co
ntent="text/html; charset=UTF-8">.<title>MediaGet catalogue&l
t;/title>.</head>.<frameset rows="36,*" frameborder="0" bo
rder="0" framespacing="0" id="frameset">..<frame name="menu" id=
"menu" src="menu.php?query=mediaget=2.01.3533&lang=en&client_i
d=&check=4a99fca9d621f844ac2ed031b5f0cced" scrolling="no">..&
lt;frame name="content" id="content" src="hXXp://games.mgshare.com/?me
diaget=2.01.3533&client_id=&check=4a99fca9d621f844ac2ed031b5f0cced&lan
g=en">.<!-- .<frame name="auth" src="hXXp://auth.mgshare.com"
 scrolling="no"> -->.</frameset>.</html>..0..
....
<<< skipped >>>

GET /js/jquery-1.7.1.min.js HTTP/1.1


Accept: */*
Referer: hXXp://mg.mgshare.com/?mediaget=2.01.3533&lang=en&client_id=&check=4a99fca9d621f844ac2ed031b5f0cced
User-Agent: mediaget/2.01.3533/
Cookie: PHPSESSID=c08c68a7d34c35e04bfaa42aaebf7a75
Connection: Keep-Alive
Accept-Encoding: gzip, deflate
Accept-Language: en-US,*
Host: mg.mgshare.com


HTTP/1.1 200 OK
Server: nginx/1.6.2
Date: Sat, 27 Feb 2016 03:44:28 GMT
Content-Type: application/javascript
Content-Length: 93868
Last-Modified: Mon, 10 Nov 2014 13:29:00 GMT
Connection: keep-alive
ETag: "5460bd9c-16eac"
Accept-Ranges: bytes
/*! jQuery v1.7.1 jquery.com | jquery.org/license */.(function(a,b){fu
nction cy(a){return f.isWindow(a)?a:a.nodeType===9?a.defaultView||a.pa
rentWindow:!1}function cv(a){if(!ck[a]){var b=c.body,d=f("<" a ">
;").appendTo(b),e=d.css("display");d.remove();if(e==="none"||e===""){c
l||(cl=c.createElement("iframe"),cl.frameBorder=cl.width=cl.height=0),
b.appendChild(cl);if(!cm||!cl.createElement)cm=(cl.contentWindow||cl.c
ontentDocument).document,cm.write((c.compatMode==="CSS1Compat"?"<!d
octype html>":"") "<html><body>"),cm.close();d=cm.creat
eElement(a),cm.body.appendChild(d),e=f.css(d,"display"),b.removeChild(
cl)}ck[a]=e}return ck[a]}function cu(a,b){var c={};f.each(cq.concat.ap
ply([],cq.slice(0,b)),function(){c[this]=a});return c}function ct(){cr
=b}function cs(){setTimeout(ct,0);return cr=f.now()}function cj(){try{
return new a.ActiveXObject("Microsoft.XMLHTTP")}catch(b){}}function ci
(){try{return new a.XMLHttpRequest}catch(b){}}function cc(a,c){a.dataF
ilter&&(c=a.dataFilter(c,a.dataType));var d=a.dataTypes,e={},g,h,i=d.l
ength,j,k=d[0],l,m,n,o,p;for(g=1;g<i;g  ){if(g===1)for(h in a.conve
rters)typeof h=="string"&&(e[h.toLowerCase()]=a.converters[h]);l=k,k=d
[g];if(k==="*")k=l;else if(l!=="*"&&l!==k){m=l " " k,n=e[m]||e["* " k]
;if(!n){p=b;for(o in e){j=o.split(" ");if(j[0]===l||j[0]==="*"){p=e[j[
1] " " k];if(p){o=e[o],o===!0?n=p:p===!0&&(n=o);break}}}}!n&&!p&&f.err
or("No conversion from " m.replace(" "," to ")),n!==!0&&(c=n?n(c):p(o(
c)))}}return c}function cb(a,c,d){var e=a.contents,f=a.dataTypes,g
<<< skipped >>>

GET /menu.php?query=mediaget=2.01.3533&lang=en&client_id=&check=4a99fca9d621f844ac2ed031b5f0cced HTTP/1.1


Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8
Referer: hXXp://mg.mgshare.com/?mediaget=2.01.3533&lang=en&client_id=&check=4a99fca9d621f844ac2ed031b5f0cced
User-Agent: mediaget/2.01.3533/
Cookie: PHPSESSID=c08c68a7d34c35e04bfaa42aaebf7a75
Connection: Keep-Alive
Accept-Encoding: gzip, deflate
Accept-Language: en-US,*
Host: mg.mgshare.com


HTTP/1.1 200 OK
Server: nginx/1.6.2
Date: Sat, 27 Feb 2016 03:44:28 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.4.45
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
137f..<!DOCTYPE html>.<html>.<head>..<meta charse
t="utf-8" />..<title></title>..<link rel="stylesheet
" href="/css/main.css?1" />..<script src="/js/jquery-1.7.1.min.j
s" type="text/javascript"></script>..<script src="/js/jque
ry-postmessage.js" type="text/javascript"></script>...<!--
[if IE]>..<script src="hXXp://html5shiv.googlecode.com/svn/trunk
/html5.js"></script><![endif]-->...<!--[if gte IE 9]
>..<style type="text/css">....gradient {....filter: none;...}
..</style>..<![endif]-->..<script>..// .............
..., .......... ................ .. ...................if (typeof medi
aget === "undefined") {...var mediaget = {startPreloader: function() {
}, stopPreloader: function() {}}...browserMode = true;..}..</script
>.</head>.<body>.<header class="game_header">..&l
t;nav class="game_header__nav">....<a href="javascript:void(0)" 
id="menu_movies" url="hXXp://movies.mgshare.com/?mediaget=2.01.3533&la
ng=en&client_id=&check=4a99fca9d621f844ac2ed031b5f0cced" onclick="setm
enu('movies', $(this).attr('url'), '/new_catalog');">Movies<i>
;</i></a>....<a href="javascript:void(0)" id="menu_game
s" url="hXXp://games.mgshare.com/?mediaget=2.01.3533&lang=en&client_id
=&check=4a99fca9d621f844ac2ed031b5f0cced" onclick="setmenu('games', $(
this).attr('url'), '/games');" class="act">Games<i></i>
</a>....<a href="javascript:void(0)" id="menu_soft" url="
<<< skipped >>>

GET /css/main.css?1 HTTP/1.1


Accept: text/css,*/*;q=0.1
Referer: hXXp://mg.mgshare.com/menu.php?query=mediaget=2.01.3533&lang=en&client_id=&check=4a99fca9d621f844ac2ed031b5f0cced
User-Agent: mediaget/2.01.3533/
Cookie: PHPSESSID=c08c68a7d34c35e04bfaa42aaebf7a75
Connection: Keep-Alive
Accept-Encoding: gzip, deflate
Accept-Language: en-US,*
Host: mg.mgshare.com


HTTP/1.1 200 OK
Server: nginx/1.6.2
Date: Sat, 27 Feb 2016 03:44:28 GMT
Content-Type: text/css
Content-Length: 3467
Last-Modified: Tue, 23 Dec 2014 13:55:00 GMT
Connection: keep-alive
ETag: "54997434-d8b"
Accept-Ranges: bytes
/* hXXp://meyerweb.com/eric/tools/css/reset/..   v2.0 | 20110126..   L
icense: none (public domain)..*/..html,..body,..div,..span,..applet,..
object,..iframe,..h1,..h2,..h3,..h4,..h5,..h6,..p,..blockquote,..pre,.
.a,..abbr,..acronym,..address,..big,..cite,..code,..del,..dfn,..em,..i
mg,..ins,..kbd,..q,..s,..samp,..small,..strike,..strong,..sub,..sup,..
tt,..var,..b,..u,..i,..center,..dl,..dt,..dd,..ol,..ul,..li,..fieldset
,..form,..label,..legend,..table,..caption,..tbody,..tfoot,..thead,..t
r,..th,..td,..article,..aside,..canvas,..details,..embed,..figure,..fi
gcaption,..footer,..header,..hgroup,..menu,..nav,..output,..ruby,..sec
tion,..summary,..time,..mark,..audio,..video {..  margin: 0;..  paddin
g: 0;..  border: 0;..  font-size: 100%;..  vertical-align: baseline;..
}../* HTML5 display-role reset for older browsers */..article,..aside,
..details,..figcaption,..figure,..footer,..header,..hgroup,..menu,..na
v,..section {..  display: block;..}..body {..  line-height: 1;..}..ol,
..ul {..  list-style: none;..}..blockquote,..q {..  quotes: none;..}..
blockquote:before,..blockquote:after,..q:before,..q:after {..  content
: '';..  content: none;..}..table {..  border-collapse: collapse;..  b
order-spacing: 0;..}...spr-sprite, .game_header__nav a.act i, .game_he
ader__old_view a i {...background-image: url('/images/spr-s12323e9111.
png');...background-repeat: no-repeat;..}...game_header__nav a.act i {
...background-position: 0 -160px;..}...game_header__old_view a i {...b
ackground-position: 0 -302px;..}...game_header {...height: 23px;..
<<< skipped >>>

GET /images/spr-s12323e9111.png HTTP/1.1


Referer: hXXp://mg.mgshare.com/menu.php?query=mediaget=2.01.3533&lang=en&client_id=&check=4a99fca9d621f844ac2ed031b5f0cced
User-Agent: mediaget/2.01.3533/
Accept: */*
Cookie: PHPSESSID=c08c68a7d34c35e04bfaa42aaebf7a75
Connection: Keep-Alive
Accept-Encoding: gzip, deflate
Accept-Language: en-US,*
Host: mg.mgshare.com


HTTP/1.1 200 OK
Server: nginx/1.6.2
Date: Sat, 27 Feb 2016 03:44:28 GMT
Content-Type: image/png
Content-Length: 8617
Last-Modified: Mon, 10 Nov 2014 13:29:00 GMT
Connection: keep-alive
ETag: "5460bd9c-21a9"
Accept-Ranges: bytes
.PNG........IHDR...................!pIDATx..........9.a.........R...D@
.....1..&..D$*......U.5..M.D..5$.QpE.$*...J8..................}6U.....
.U..o.....GeVUU.$GZZ.......!..q...*. ...Ii.9.....322f..`...x..........
.N..,..u.......aS........6...5.$ MZ.6m&...}H.0..2..4H...)))....99.e...
>....I....7}..y..I.$. M...(m.\J..$!MX;... M.;..)K.t...h...&....h...
[email protected].:[email protected].}.dee=D..$...:u...&L.K.. Ii&N.xd...
..4h.:..P.46.....h..c.....H........b....:t.0T...P.4.q:v.........kO.x..
...iS.L....>x]zzz;.. .4.q.~....n..n...IJCR. 5iH....4$..NG..'.*  ...
....FiB..Pav._...k."..$....-is..3BT>&....F...4'.q.x...X....4..4....
6.....^iRx>M..<<.."..|.j..;4.&..>:==-d......VL.r..w...@*..
....Z....4rnN~......I..........4..i 5i&.(......ix..$)MZV.t.O..i Yi..?J
.'lQ...4a.....4.....,.....4.IJ....|..d......4t..R...?@*.\8.q.v.y>.@
[email protected]~...#.'...` Z.$...qv..Y......o..
[email protected].[..$#.5.....G..6..-Mx>[email protected]
GY....&)...4$..R.....iHCR..t..{R..Jx>..$M...*..}..y>........4..I
JsB...4H.IK#..i..NJS...j......C#....H...........i....i....i. Ui...-?_t
....S.......".v.W.NV.J..%....V.....w%...4...q...6.:....mn.E.~..M.../..
.GiB..4C;.......JV%.A..b...w)[email protected].)...\ ..........<).i...i"..m)
.../.X...yT...^NsJ...M.....=.d.W3....|..7..........d..........:med.{(=
@.xde......_}4N,.l}.Z.<..B*.w.Y..eM.v.a../[email protected]}....I
.tV..d......4..4.H....&....8......[=|O.|.rJ.BS.....i..i....i....i..i..
....4.5.i.I.^...m.... (f..4.c....%..6U.....k.......)..1.Z.P.i&k...
<<< skipped >>>


GET /filecache/userfiles/v2/images/torrents/ИГРЫ/world of warplanes/warplanes---width_portrait---145---207.jpg HTTP/1.1
Referer: hXXp://games.mgshare.com/?mediaget=2.01.3533&client_id=&check=4a99fca9d621f844ac2ed031b5f0cced&lang=en
User-Agent: mediaget/2.01.3533/
Accept: */*
Cookie: _ym_uid=145654455533563744; _ym_isad=0; _ym_visorc_17454814=w; _ga=GA1.2.587736484.1456544556
Connection: Keep-Alive
Accept-Encoding: gzip, deflate
Accept-Language: en-US,*
Host: img.mgshare.com


HTTP/1.1 200 OK
Server: nginx/1.8.0
Date: Sat, 27 Feb 2016 03:44:30 GMT
Content-Type: image/jpeg
Content-Length: 12893
Last-Modified: Thu, 16 Apr 2015 09:23:48 GMT
Connection: keep-alive
ETag: "552f7fa4-325d"
Expires: Sat, 12 Mar 2016 03:44:30 GMT
Cache-Control: max-age=1209600
Accept-Ranges: bytes
......JFIF.............C..............................................
......................C...............................................
......................................................................
.E..........................!.1..AQ."a.2q..#....$3BRST...U...VWbr.....
................................8.........................!..1"A..Q.2a
q...#[email protected][email protected].....@..
[email protected][email protected][email protected][email protected]...
..[.) U.\.........F.|....Zo....m .g6.Xc..'?.....^..1..\9.....o._......
..2.h.o ..b...L'...n.......n...N.."..Sa\e...J...N......s......z..c....
].......\.T...;.?S..{. .[.0.l.s.h.O._.7G.x....z.G.U..\.O..t~..;p......
..;S.0...........*.Q.L7...;S...;.}I$......6..Sj.,Rd.....*._.....S^d..5
m..!~Z.K.*.zM-.q..t.S.?.hTg.~..M.N......U.{...?.4.6 ...].....u. .P....
N.06..m.....n7z.tR.V.$..Q^Y........t..%W.=.....k..}Q..^....vc.$m}..y.t
I)...)IK....b;U..=gm...sG...k.wG.c.L..../.O.........n......)m.)..,|..h
 .<.....$U`.....Q.#Q6...I..Nx)?*O$.].B.....E..h8A )x....D.Qu......m
..`.D..O..B...x.....?O.%.VX.hmV...........D.S.Mir.....R...)...I..a....
h......"..C.`H...\Qfj.R.......i*R...`.fl..I.Wn....BT.o.>B...(.....V
...Ny...w<.......]....>........P.....Bu.!m...xQ..k.M.R..~.v.....
....z.n...@[*qi2........#>.71[..qv..F.[^..\...s..8...!q.h...T`....W
.....$=.c.t.....).E...8.[....X...:...."m.QE.......U.]..J;..I..r..q.}I.
.(}...:."..s..lu.`n....T..U.(.....q u (.G ....1...].]......8...e..%..$
)##... I..k.....e...Ai..Z B..:..F.....mC.....:S..J.Q..WV..e.U.r...
<<< skipped >>>


GET /file/mg_left.php?version=2.01.3533 HTTP/1.1
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8
User-Agent: mediaget/2.01.3533/
Connection: Keep-Alive
Accept-Encoding: gzip, deflate
Accept-Language: en-US,*
Host: www2.bubblesmedia.ru


HTTP/1.1 200 OK
Server: nginx/1.6.0
Date: Sat, 27 Feb 2016 03:44:27 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.28
131..    <body style="margin:0; background:#000;">.    <div a
lign="center">.        <div id="al_rotator_block_4_0" onclick="a
l_load_4();"></div>.    </div>.    <script async="as
ync" type="text/javascript".            src="hXXp://sub2.admitlead.ru/
r/get_code/4/?subid=0&version=2.01.3533"></script>.    </b
ody>...0..HTTP/1.1 200 OK..Server: nginx/1.6.0..Date: Sat, 27 Feb 2
016 03:44:27 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enc
oding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.28..131.
.    <body style="margin:0; background:#000;">.    <div align
="center">.        <div id="al_rotator_block_4_0" onclick="al_lo
ad_4();"></div>.    </div>.    <script async="async"
 type="text/javascript".            src="hXXp://sub2.admitlead.ru/r/ge
t_code/4/?subid=0&version=2.01.3533"></script>.    </body&
gt;...0..



GET /file/images/511/564c8725baafd.jpg HTTP/1.1
Referer: hXXp://www2.bubblesmedia.ru/file/adv.php?version=2.01.3533
User-Agent: mediaget/2.01.3533/
Accept: */*
Cookie: 08fd04da1b9c3e4c1c9ab1fe42494a35=%7B%22v%22%3A1%2C%22p%22%3A%7B%221977%22%3A1%7D%2C%22o%22%3A%7B%22511%22%3A1%7D%7D
Connection: Keep-Alive
Accept-Encoding: gzip, deflate
Accept-Language: en-US,*
Host: admitlead.ru


HTTP/1.1 200 OK
Server: nginx/1.8.0
Date: Sat, 27 Feb 2016 03:44:28 GMT
Content-Type: image/jpeg
Content-Length: 36708
Last-Modified: Wed, 18 Nov 2015 14:11:49 GMT
Connection: keep-alive
ETag: "564c8725-8f64"
Accept-Ranges: bytes
......JFIF.....H.H......Exif..MM.*.................V...........^.(....
.......1.........f.2.........v.i...............H.......H......paint.ne
t 4.0.5.2015:02:05 18:02:50..........................Z................
.................(.................H.......H.......XICC_PROFILE......H
Lino....mntrRGB XYZ .........1..acspMSFT....IEC sRGB..................
.....-HP  ................................................cprt...P...3
desc.......lwtpt........bkpt........rXYZ........gXYZ...,....bXYZ...@..
..dmnd...T...pdmdd........vued...L....view.......$lumi........meas....
...$tech...0....rTRC...<....gTRC...<....bTRC...<....text....C
opyright (c) 1998 Hewlett-Packard Company..desc........sRGB IEC61966-2
.1............sRGB IEC61966-2.1.......................................
...........XYZ .......Q........XYZ ................XYZ ......o...8....
.XYZ ......b.........XYZ ......$.........desc........IEC hXXp://VVV.ie
c.ch............IEC hXXp://VVV.iec.ch.................................
.............desc........IEC 61966-2.1 Default RGB colour space - sRGB
............IEC 61966-2.1 Default RGB colour space - sRGB.............
.........desc.......,Reference Viewing Condition in IEC61966-2.1......
.....,Reference Viewing Condition in IEC61966-2.1.....................
.....view.........._...............\.....XYZ .....L.V.P...W..meas.....
...........................sig ....CRT curv.......................#.(.
-.2.7.;[email protected].^.c.h.m.r.w.|.....................................
..........................%. .2.8.>.E.L.R.Y.`.g.n.u.|..........
<<< skipped >>>


GET /metrika/watch.js HTTP/1.1
Accept: */*
Referer: hXXp://mg.mgshare.com/menu.php?query=mediaget=2.01.3533&lang=en&client_id=&check=4a99fca9d621f844ac2ed031b5f0cced
User-Agent: mediaget/2.01.3533/
Connection: Keep-Alive
Accept-Encoding: gzip, deflate
Accept-Language: en-US,*
Host: mc.yandex.ru


HTTP/1.1 301 Moved Permanently
Server: nginx/1.8.0
Date: Sat, 27 Feb 2016 03:44:28 GMT
Content-Type: text/html
Content-Length: 184
Connection: keep-alive
Location: hXXps://mc.yandex.ru/metrika/watch.js
<html>..<head><title>301 Moved Permanently</title
></head>..<body bgcolor="white">..<center><h1&
gt;301 Moved Permanently</h1></center>..<hr><cent
er>nginx/1.8.0</center>..</body>..</html>..HTTP/1
.1 301 Moved Permanently..Server: nginx/1.8.0..Date: Sat, 27 Feb 2016 
03:44:28 GMT..Content-Type: text/html..Content-Length: 184..Connection
: keep-alive..Location: hXXps://mc.yandex.ru/metrika/watch.js..<htm
l>..<head><title>301 Moved Permanently</title><
;/head>..<body bgcolor="white">..<center><h1>301 
Moved Permanently</h1></center>..<hr><center>n
ginx/1.8.0</center>..</body>..</html>....



GET /r/get_code/4/?subid=0&version=2.01.3533 HTTP/1.1
Accept: */*
Referer: hXXp://www2.bubblesmedia.ru/file/mg_left.php?version=2.01.3533
User-Agent: mediaget/2.01.3533/
Connection: Keep-Alive
Accept-Encoding: gzip, deflate
Accept-Language: en-US,*
Host: sub2.admitlead.ru


HTTP/1.1 200 OK
Server: nginx/1.8.0
Date: Sat, 27 Feb 2016 03:44:28 GMT
Content-Type: text/javascript; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.5.27
Access-Control-Allow-Origin: *
Set-Cookie: php-console-server=5; path=/
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Pragma: no-cache
Last-Modified: Sat, 27 Feb 2016 03:44:28GMT
71d..//<script>.    var al_rotator_data = al_rotator_data || {4:
{}};..    function cpaLoadScript2(el_parent, rid, subid, callback) {. 
       var protocol = 'http:';.        if ('https:' == document.locati
on.protocol).            protocol = 'https:';.        var url = protoc
ol   '//sub2.admitlead.ru/r/display/4/0/?a=1&mg_version=2.01.3533&rnd=
'   Math.round(Math.random() * 100000);..        var el_rot = document
.createElement('script');.        el_rot.defer = false;.        el_rot
.type = 'text/javascript';.        el_rot.src = url;..        var head
 = document.getElementById(el_parent);.        head.appendChild(el_rot
);.        el_rot.onload = function () {.            if (callback.done
) return;.            callback.done = true;.            callback(rid, 
subid, el_parent);.        };..        el_rot.onreadystatechange = fun
ction () {.            if ((!callback.done) && ( this.readyState == 'c
omplete' || this.readyState == "loaded" )) {.                callback.
done = true;.                callback(rid, subid, el_parent);.        
    }.        }.    }..        function al_load_4() {.                
cpaLoadScript2('al_rotator_block_4_0', 4, '0', function (rid, sub, el_
parent) {.            var promo = al_rotator_data[rid][sub],.         
       html = promo['promo_code'],.                node;..            
if (undefined == html).                return false;..            node
 = document.getElementById(el_parent);.            node.innerHTML = ht
ml;.                        if ('undefined' != typeof (bannerJsObj
<<< skipped >>>

GET /r/display/4/0/?a=1&mg_version=2.01.3533&rnd=3286 HTTP/1.1


Accept: */*
Referer: hXXp://www2.bubblesmedia.ru/file/mg_left.php?version=2.01.3533
User-Agent: mediaget/2.01.3533/
Cookie: php-console-server=5
Connection: Keep-Alive
Accept-Encoding: gzip, deflate
Accept-Language: en-US,*
Host: sub2.admitlead.ru


HTTP/1.1 200 OK
Server: nginx/1.8.0
Date: Sat, 27 Feb 2016 03:44:28 GMT
Content-Type: text/javascript; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.5.27
Access-Control-Allow-Origin: *
Set-Cookie: lvrp4=1990; expires=Sat, 12-Mar-2016 03:44:28 GMT; Max-Age=1209600
Set-Cookie: 08fd04da1b9c3e4c1c9ab1fe42494a35=%7B%22v%22%3A1%2C%22p%22%3A%7B%221990%22%3A1%7D%2C%22o%22%3A%7B%22557%22%3A1%7D%7D; expires=Sun, 28-Feb-2016 03:44:28 GMT; Max-Age=86400; path=/; domain=.admitlead.ru
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Pragma: no-cache
Last-Modified: Sat, 27 Feb 2016 03:44:28GMT
110..al_rotator_data[4]['0']={"promo_code":"<a href=\"http:\/\/sub2
.admitlead.ru\/sb\/rclk\/r\/4\/h\/43e0ba\/p\/1990?g=bubblesmedia.ru\/g
o\/\" target=\"_blank\">\n        <img src=\"http:\/\/admitlead.
ru\/file\/images\/557\/5666db39228e3.jpg\" alt=\"\"><\/a>","i
mg_height":146}..0..HTTP/1.1 200 OK..Server: nginx/1.8.0..Date: Sat, 2
7 Feb 2016 03:44:28 GMT..Content-Type: text/javascript; charset=UTF-8.
.Transfer-Encoding: chunked..Connection: keep-alive..X-Powered-By: PHP
/5.5.27..Access-Control-Allow-Origin: *..Set-Cookie: lvrp4=1990; expir
es=Sat, 12-Mar-2016 03:44:28 GMT; Max-Age=1209600..Set-Cookie: 08fd04d
a1b9c3e4c1c9ab1fe42494a35=%7B%22v%22%3A1%2C%22p%22%3A%
257B%221990%22%3A1%7D%2C%22o%22%3A%7B%22557%22%2
53A1%7D%7D; expires=Sun, 28-Feb-2016 03:44:28 GMT; Max-Age=86400; 
path=/; domain=.admitlead.ru..Expires: Mon, 26 Jul 1997 05:00:00 GMT..
Cache-Control: no-cache, must-revalidate..Pragma: no-cache..Last-Modif
ied: Sat, 27 Feb 2016 03:44:28GMT..110..al_rotator_data[4]['0']={"prom
o_code":"<a href=\"http:\/\/sub2.admitlead.ru\/sb\/rclk\/r\/4\/h\/4
3e0ba\/p\/1990?g=bubblesmedia.ru\/go\/\" target=\"_blank\">\n      
  <img src=\"http:\/\/admitlead.ru\/file\/images\/557\/5666db39228e
3.jpg\" alt=\"\"><\/a>","img_height":146}..0..
<<< skipped >>>


GET /css/skin.css HTTP/1.1
Accept: text/css,*/*;q=0.1
Referer: hXXp://games.mgshare.com/?mediaget=2.01.3533&client_id=&check=4a99fca9d621f844ac2ed031b5f0cced&lang=en
User-Agent: mediaget/2.01.3533/
Cookie: PHPSESSID=13bj2esfn2fosevldsben54252
Connection: Keep-Alive
Accept-Encoding: gzip, deflate
Accept-Language: en-US,*
Host: games.mgshare.com


HTTP/1.1 200 OK
Server: nginx/1.8.0
Date: Sat, 27 Feb 2016 03:44:28 GMT
Content-Type: text/css
Content-Length: 1159
Last-Modified: Thu, 06 Nov 2014 11:53:21 GMT
Connection: keep-alive
ETag: "545b6131-487"
Accept-Ranges: bytes
.jcarousel-skin-tango .jcarousel-container {.}..jcarousel-skin-tango .
jcarousel-direction-rtl {..direction: rtl;.}...jcarousel-skin-tango .j
carousel-container-horizontal {.    width: 769px;.    padding: 0px;.}.
...jcarousel-skin-tango .jcarousel-clip {.    overflow: hidden;.}...jc
arousel-skin-tango .jcarousel-clip-horizontal {.    width:  769px;.   
 height: 273px;.}.....jcarousel-skin-tango .jcarousel-item {.    width
: 769px;.    height: 273px;.}...jcarousel-skin-tango .jcarousel-item-h
orizontal {..margin-left: 0;.    margin-right: 0px;.}...jcarousel-skin
-tango .jcarousel-direction-rtl .jcarousel-item-horizontal {..margin-l
eft: 0px;.    margin-right: 0;.}....jcarousel-skin-tango .jcarousel-it
em-placeholder {.    background: #fff;.    color: #000;.}../**. *  Hor
izontal Buttons. */..jcarousel-skin-tango .jcarousel-next-horizontal {
.    position: absolute;.    top: 50%;..margin-top:-28px;.    right: 0
px;.    width: 56px;.    height: 56px;.    cursor: pointer;.}....jcaro
usel-skin-tango .jcarousel-prev-horizontal {.    position: absolute;. 
   top: 50%;..margin-top:-28px;.    left: 0px;.    width: 56px;.    he
ight: 56px;.    cursor: pointer;.}.........


GET /css/webkit-scrollbar.css?1415274801 HTTP/1.1


Accept: text/css,*/*;q=0.1
Referer: hXXp://games.mgshare.com/?mediaget=2.01.3533&client_id=&check=4a99fca9d621f844ac2ed031b5f0cced&lang=en
User-Agent: mediaget/2.01.3533/
Cookie: PHPSESSID=13bj2esfn2fosevldsben54252
Connection: Keep-Alive
Accept-Encoding: gzip, deflate
Accept-Language: en-US,*
Host: games.mgshare.com


HTTP/1.1 200 OK
Server: nginx/1.8.0
Date: Sat, 27 Feb 2016 03:44:29 GMT
Content-Type: text/css
Content-Length: 718
Last-Modified: Thu, 06 Nov 2014 11:53:21 GMT
Connection: keep-alive
ETag: "545b6131-2ce"
Accept-Ranges: bytes
/* Works in webkit ONLY */..html {..overflow-y: auto;../* Kudos to @sa
mi for pointing out that setting the overflow to "auto" instead of "hi
dden" fixes the keyboard nav bug! */..background-color: transparent;.}
..@media only screen and (max-device-width: 480px) {..html {...overflo
w: auto;..}.}..::-webkit-scrollbar {..width: 10px;..height: 10px;..bac
kground-color: #FFF;.}..::-webkit-scrollbar-corner {..background-color
: #FFF;.}..::-webkit-scrollbar-track {..background-color: #F0F0F0;.   
 -webkit-border-radius: 6px;.    border-radius: 6px;.}..::-webkit-scro
llbar-thumb {..-webkit-border-radius: 6px;.    border-radius: 6px;.   
 background: #CBCBCB;.}..::-webkit-scrollbar-thumb:hover {..background
-color: #8FBC00;.}..



GET /css/jquery.jscrollpane.css HTTP/1.1
Accept: text/css,*/*;q=0.1
Referer: hXXp://games.mgshare.com/?mediaget=2.01.3533&client_id=&check=4a99fca9d621f844ac2ed031b5f0cced&lang=en
User-Agent: mediaget/2.01.3533/
Cookie: PHPSESSID=13bj2esfn2fosevldsben54252
Connection: Keep-Alive
Accept-Encoding: gzip, deflate
Accept-Language: en-US,*
Host: games.mgshare.com


HTTP/1.1 200 OK
Server: nginx/1.8.0
Date: Sat, 27 Feb 2016 03:44:28 GMT
Content-Type: text/css
Content-Length: 1458
Last-Modified: Thu, 06 Nov 2014 11:53:21 GMT
Connection: keep-alive
ETag: "545b6131-5b2"
Accept-Ranges: bytes
/*.. * CSS Styles that are needed by jScrollPane for it to operate cor
rectly... *.. * Include this stylesheet in your site or copy and paste
 the styles below into your stylesheet - jScrollPane.. * may not opera
te correctly without them... */...jspContainer..{...overflow: hidden;.
..position: relative;...padding-bottom:2px;..}...jspPane..{...position
: absolute;..}...jspVerticalBar..{...position: absolute;...top: 0;...r
ight: 0;...width: 17px;...height: 100%;..}...jspHorizontalBar..{...pos
ition: absolute;...bottom: 0;...left: 0;...width: 100%;...height: 16px
;...background: red;..}...jspCap..{...display: none;..}...jspHorizonta
lBar .jspCap..{...float: left;..}...jspTrack..{...position: relative;.
.}...jspDrag..{...position: relative;...top: 0;...left: 0;...cursor: p
ointer;..}...jspHorizontalBar .jspTrack,...jspHorizontalBar .jspDrag..
{...float: left;...height: 100%;..}...jspArrow..{...background: #50506
d;...text-indent: -20000px;...display: block;...cursor: pointer;...pad
ding: 0;...margin: 0;..}...jspArrow.jspDisabled..{...cursor: default;.
..background: #80808d;..}...jspVerticalBar .jspArrow..{...height: 16px
;..}...jspHorizontalBar .jspArrow..{...width: 16px;...float: left;...h
eight: 100%;..}...jspVerticalBar .jspArrow:focus..{...outline: none;..
}...jspCorner..{...background: #eeeef4;...float: left;...height: 100%;
..}../* Yuk! CSS Hack for IE6 3 pixel bug :( */..* html .jspCorner..{.
..margin: 0 -3px 0 0;..}....
<<< skipped >>>

GET /css/premieres/adds.css?1450371904 HTTP/1.1


Accept: text/css,*/*;q=0.1
Referer: hXXp://games.mgshare.com/?mediaget=2.01.3533&client_id=&check=4a99fca9d621f844ac2ed031b5f0cced&lang=en
User-Agent: mediaget/2.01.3533/
Cookie: PHPSESSID=13bj2esfn2fosevldsben54252
Connection: Keep-Alive
Accept-Encoding: gzip, deflate
Accept-Language: en-US,*
Host: games.mgshare.com


HTTP/1.1 200 OK
Server: nginx/1.8.0
Date: Sat, 27 Feb 2016 03:44:29 GMT
Content-Type: text/css
Content-Length: 4619
Last-Modified: Thu, 17 Dec 2015 17:05:04 GMT
Connection: keep-alive
ETag: "5672eb40-120b"
Accept-Ranges: bytes
@import "/css/premieres/sprite.css";./*-------------------------------
--------------------.    LESS Elements 0.9.  -------------------------
--------------------------.    A set of useful LESS mixins.    More in
fo at: hXXp://lesselements.com.  -------------------------------------
--------------*/./*.film__item {.  float: left;.  width: 145px;.  marg
in: 0 3px 25px 3px;.  position: relative;.}..film__item figure {.  pos
ition: relative;.  margin-bottom: 3px;.}..film__item figure:hover .fil
m__hover {.  display: block;.}..film__item__name {.  position: relativ
e;.}..film__item__name__icon {.  position: absolute;.  right: 0px;.  t
op: 2px;.}..film__item__link {.  color: #575757;.  font-size: 12px;.  
line-height: 16px;.  text-decoration: none;.}..film__item__link:hover 
{.  text-decoration: underline;.}..film__item__bg {.  z-index: 3;.  po
sition: absolute;.  left: 0px;.  top: 0px;.  width: 100%;.  height: 10
0%;.  background: #000;.  -moz-opacity: 0.7;.  -khtml-opacity: 0.7;.  
-webkit-opacity: 0.7;.  opacity: 0.7;.  -ms-filter: progid:DXImageTran
sform.Microsoft.Alpha(opacity=70);.  filter: alpha(opacity=70);.}..fil
m__main_img {.  display: block;.  z-index: 1;.  position: relative;.}.
.film__hover {.  display: none;.  z-index: 2;.  position: absolute;.  
left: 0px;.  top: 0px;.  width: 100%;.  height: 100%;.}..film__btn {. 
 position: relative;.  z-index: 4;.  text-align: center;.  padding-top
: 92px;.  margin-bottom: 23px;.}..film__btn a {.  display: inline-bloc
k;.  margin: 0px 8px;.  width: 24px;.  height: 24px;.}..film__desc
<<< skipped >>>


GET /js/jquery.mousewheel.js HTTP/1.1
Accept: */*
Referer: hXXp://games.mgshare.com/?mediaget=2.01.3533&client_id=&check=4a99fca9d621f844ac2ed031b5f0cced&lang=en
User-Agent: mediaget/2.01.3533/
Cookie: PHPSESSID=13bj2esfn2fosevldsben54252
Connection: Keep-Alive
Accept-Encoding: gzip, deflate
Accept-Language: en-US,*
Host: games.mgshare.com


HTTP/1.1 200 OK
Server: nginx/1.8.0
Date: Sat, 27 Feb 2016 03:44:28 GMT
Content-Type: application/javascript
Content-Length: 1404
Last-Modified: Thu, 06 Nov 2014 11:53:23 GMT
Connection: keep-alive
ETag: "545b6133-57c"
Accept-Ranges: bytes
/*! Copyright (c) 2011 Brandon Aaron (hXXp://brandonaaron.net).. * Lic
ensed under the MIT License (LICENSE.txt)... *.. * Thanks to: hXXp://a
domas.org/javascript-mouse-wheel/ for some pointers... * Thanks to: Ma
thias Bank(hXXp://VVV.mathias-bank.de) for a scope bug fix... * Thanks
 to: Seamus Leahy for adding deltaX and deltaY.. *.. * Version: 3.0.6.
. * .. * Requires: 1.2.2 .. */..(function(a){function d(b){var c=b||wi
ndow.event,d=[].slice.call(arguments,1),e=0,f=!0,g=0,h=0;return b=a.ev
ent.fix(c),b.type="mousewheel",c.wheelDelta&&(e=c.wheelDelta/120),c.de
tail&&(e=-c.detail/3),h=e,c.axis!==undefined&&c.axis===c.HORIZONTAL_AX
IS&&(h=0,g=-1*e),c.wheelDeltaY!==undefined&&(h=c.wheelDeltaY/120),c.wh
eelDeltaX!==undefined&&(g=-1*c.wheelDeltaX/120),d.unshift(b,e,g,h),(a.
event.dispatch||a.event.handle).apply(this,d)}var b=["DOMMouseScroll",
"mousewheel"];if(a.event.fixHooks)for(var c=b.length;c;)a.event.fixHoo
ks[b[--c]]=a.event.mouseHooks;a.event.special.mousewheel={setup:functi
on(){if(this.addEventListener)for(var a=b.length;a;)this.addEventListe
ner(b[--a],d,!1);else this.onmousewheel=d},teardown:function(){if(this
.removeEventListener)for(var a=b.length;a;)this.removeEventListener(b[
--a],d,!1);else this.onmousewheel=null}},a.fn.extend({mousewheel:funct
ion(a){return a?this.bind("mousewheel",a):this.trigger("mousewheel")},
unmousewheel:function(a){return this.unbind("mousewheel",a)}})})(jQuer
y)......
<<< skipped >>>

GET /css/sprite.css HTTP/1.1


Accept: text/css,*/*;q=0.1
Referer: hXXp://games.mgshare.com/?mediaget=2.01.3533&client_id=&check=4a99fca9d621f844ac2ed031b5f0cced&lang=en
User-Agent: mediaget/2.01.3533/
Cookie: PHPSESSID=13bj2esfn2fosevldsben54252
Connection: Keep-Alive
Accept-Encoding: gzip, deflate
Accept-Language: en-US,*
Host: games.mgshare.com


HTTP/1.1 200 OK
Server: nginx/1.8.0
Date: Sat, 27 Feb 2016 03:44:29 GMT
Content-Type: text/css
Content-Length: 1601
Last-Modified: Thu, 06 Nov 2014 11:53:21 GMT
Connection: keep-alive
ETag: "545b6131-641"
Accept-Ranges: bytes
.spr-sprite, .game_header__nav a.act i, .game_header__old_view a i, .m
oovie__item__detail i, .moovie__download i, .moovie__play i, .moovie__
download_big i, .moovie__play_big i, .moovie3__back, .moovie3__header_
_descr__rating, .moovie3__header__descr__rating__full, .moovie3__toggl
e__i, .moovie3__toggle__i.act, .moovie3__gal_item div i {..  backgroun
d-image: url('/images/spr-s12323e9111.png');..  background-repeat: no-
repeat;..}...game_header__nav a.act i {..  background-position: 0 -160
px;..}...game_header__old_view a i {..  background-position: 0 -302px;
..}../*.moovie__pager__prev {..  background-position: 0 -311px;..}...m
oovie__pager__next {..  background-position: 0 -338px;..}*/...moovie__
item__detail i {..  background-position: 0 -276px;..}...moovie__downlo
ad i {..  /*background-position: 0 -64px;*/...background-image: url('/
images/download.png');..}...moovie__play i {..  /*background-position:
 0 -365px;*/...background-image: url('/images/play.png');..}...moovie_
_download_big i {..  background-position: 0 -88px;..}...moovie__play_b
ig i {..  background-position: 0 -389px;..}...moovie3__back {..  backg
round-position: 0 0;..}...moovie3__back:hover, .moovie3__back.back-hov
er {..  background-position: 0 -32px;..}...moovie3__header__descr__rat
ing {..  background-position: 0 -416px;..}...moovie3__header__descr__r
ating__full {..  background-position: 0 -425px;..}...moovie3__toggle__
i {..  background-position: 0 -434px;..}...moovie3__toggle__i.act {.. 
 background-position: 0 -437px;..}...moovie3__gal_item div i {..  
<<< skipped >>>


GET /mediaget-installer-2/binaries/download.php?a=mediaget-lib HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Host: download.mediaget.com


HTTP/1.1 200 OK
Server: nginx/1.8.0
Date: Sat, 27 Feb 2016 03:43:51 GMT
Content-Type: application/octet-stream
Content-Length: 14587644
Last-Modified: Thu, 12 Nov 2015 10:03:30 GMT
Connection: keep-alive
ETag: "564463f2-de96fc"
Accept-Ranges: bytes
7z..'....._.........%.......fXu..&..p.........../D.|.........{....cl..
KN......TS;...p....."...gW.......~...~....oF~;...XBc....Cw.w]WG.....W.
.7JO.......gkcM......z..tp .......B.X....7..x.s...h.........H.... ]f..
.Ka:....EJ.......Z....hdMb.........;....e....f.E.a..w3%.yY..'..rI.?jf.
0jS~(E.....hn!..x..M.z....#7i..........G...2_]._.JQ....~..>.m..~..z
..l@*;^........b4.ct.G*.w...n.....6...=].....$..]....#XM..Z.G..FT....%
. >Mt~.0.tN..q.]....pt.r.W ..THy..9$....../R.W.(74V#.F.......Sc....
..C..%..=G....-..0.e...'....X.gQh\.uK.#(..&"!..S....\....g.y.(....x...
D....f............/..U......P......H0..a.h.p.E....7..C_.q....Z.......?
...cS.c.....G(..~....0.{../....g.[...g.7...31.V.{....j...?.>.....d.
.A....:.s.S"C..%.<J..........!..5..FY......9..y..........C..-.%!V..
...h..l./....\.).2..}....>..|.w.igo$....|.O..L......4Z.....C..J.o~.
.,.....*.2.~...D..d.....o...?u.WQ;......k..\..b`...L...8..u9)....N.k..
H,9.,.....?H....{.}.dc...Le.....B...G........\......<..8KP0.L...K R
p..5.;..........-.Y.]..E.9..D.qW]........x........J.g........;b.......
k..Q...Q.v.......8.jVM..s.q..4.qmQG.b;...8.\...4>......u&..%.....~.
.....8<..u3..!i..o........=.=)Oj.....).......j....5{.3V^$P..W...._.
....N~.^..W.B....<.>[email protected][email protected].~.M.<...
z.O.tm&M..*.1.JvV....Y.}r..sR.............H....q...Y.Q$......Z..i.P. .
=$.f.u..I...]\c.4.b...(.rg.............$.|.#.Rf..Ir.g..]hq..(}^..e.$..
......$=...Ie....1...6.n..D).{0.\......%..A.......1......<.O.h.s3..
.~..g\...!.l...x8$.H.9%h...m.m)SXz9..DK.....G.}`..E.... ....7:....
<<< skipped >>>


GET /js/jquery.jscrollpane.min.js HTTP/1.1
Accept: */*
Referer: hXXp://games.mgshare.com/?mediaget=2.01.3533&client_id=&check=4a99fca9d621f844ac2ed031b5f0cced&lang=en
User-Agent: mediaget/2.01.3533/
Cookie: PHPSESSID=13bj2esfn2fosevldsben54252
Connection: Keep-Alive
Accept-Encoding: gzip, deflate
Accept-Language: en-US,*
Host: games.mgshare.com


HTTP/1.1 200 OK
Server: nginx/1.8.0
Date: Sat, 27 Feb 2016 03:44:28 GMT
Content-Type: application/javascript
Content-Length: 15126
Last-Modified: Thu, 06 Nov 2014 11:53:23 GMT
Connection: keep-alive
ETag: "545b6133-3b16"
Accept-Ranges: bytes
/*!.. * jScrollPane - v2.0.14 - 2013-05-01.. * hXXp://jscrollpane.kelv
inluck.com/.. *.. * Copyright (c) 2010 Kelvin Luck.. * Dual licensed u
nder the MIT or GPL licenses... */..(function(b,a,c){b.fn.jScrollPane=
function(e){function d(D,O){var ay,Q=this,Y,aj,v,al,T,Z,y,q,az,aE,au,i
,I,h,j,aa,U,ap,X,t,A,aq,af,am,G,l,at,ax,x,av,aH,f,L,ai=true,P=true,aG=
false,k=false,ao=D.clone(false,false).empty(),ac=b.fn.mwheelIntent?"mw
heelIntent.jsp":"mousewheel.jsp";aH=D.css("paddingTop") " " D.css("pad
dingRight") " " D.css("paddingBottom") " " D.css("paddingLeft");f=(par
seInt(D.css("paddingLeft"),10)||0) (parseInt(D.css("paddingRight"),10)
||0);function ar(aQ){var aL,aN,aM,aJ,aI,aP,aO=false,aK=false;ay=aQ;if(
Y===c){aI=D.scrollTop();aP=D.scrollLeft();D.css({overflow:"hidden",pad
ding:0});aj=D.innerWidth() f;v=D.innerHeight();D.width(aj);Y=b('<di
v class="jspPane" />').css("padding",aH).append(D.children());al=b(
'<div class="jspContainer" />').css({width:aj "px",height:v "px"
}).append(Y).appendTo(D)}else{D.css("width","");aO=ay.stickToBottom&&K
();aK=ay.stickToRight&&B();aJ=D.innerWidth() f!=aj||D.outerHeight()!=v
;if(aJ){aj=D.innerWidth() f;v=D.innerHeight();al.css({width:aj "px",he
ight:v "px"})}if(!aJ&&L==T&&Y.outerHeight()==Z){D.width(aj);return}L=T
;Y.css("width","");D.width(aj);al.find(">.jspVerticalBar,>.jspHo
rizontalBar").remove().end()}Y.css("overflow","auto");if(aQ.contentWid
th){T=aQ.contentWidth}else{T=Y[0].scrollWidth}Z=Y[0].scrollHeight;Y.cs
s("overflow","");y=T/aj;q=Z/v;az=q>1;aE=y>1;if(!(aE||az)){D.
<<< skipped >>>

GET /js/main.js?1453889881 HTTP/1.1


Accept: */*
Referer: hXXp://games.mgshare.com/?mediaget=2.01.3533&client_id=&check=4a99fca9d621f844ac2ed031b5f0cced&lang=en
User-Agent: mediaget/2.01.3533/
Cookie: PHPSESSID=13bj2esfn2fosevldsben54252
Connection: Keep-Alive
Accept-Encoding: gzip, deflate
Accept-Language: en-US,*
Host: games.mgshare.com


HTTP/1.1 200 OK
Server: nginx/1.8.0
Date: Sat, 27 Feb 2016 03:44:29 GMT
Content-Type: application/javascript
Content-Length: 12208
Last-Modified: Wed, 27 Jan 2016 10:18:01 GMT
Connection: keep-alive
ETag: "56a89959-2fb0"
Accept-Ranges: bytes
var browserMode=false;if(typeof mediaget==="undefined"){var mediaget={
startPreloader:function(){},stopPreloader:function(){}};browserMode=tr
ue}var tWidth=0;var tooltipTimeoutId=null;var callAfterLogin=null;$.re
ceiveMessage(function(a){if(/^http:\/\//.test(a.data)){redirect(a.data
)}else{if(a.data=="loginComplete"){if(typeof callAfterLogin=="function
"){callAfterLogin();callAfterLogin=null}markSubscribedItems()}else{if(
a.data=="logoutComplete"){$(".js-premierecat-subscribe").show();$(".js
-premierecat-unsubscribe, .subscribed").hide();$(".js-popup-subscribe"
).show();$(".js-popup-unsubscribe").hide()}}}});$(function(){var d;sho
wProperImages();c();$(window).resize(function(){clearTimeout(d);d=setT
imeout(function(){c()},500)});mediaget.stopPreloader();$(document).on(
"click",".genres a",function(g){var f=$(this);g.preventDefault();e($(t
his).prop("href"),function(){mediaget.startPreloader();$(".genres li")
.removeClass("act");f.parent("li").addClass("act")},function(){showPro
perImages();mediaget.stopPreloader()})});$(document).on("click",".moov
ie__pager a",function(f){if(!$(this).hasClass("moovie__pager__current_
link")){f.preventDefault();e($(this).prop("href"),mediaget.startPreloa
der,function(){showProperImages();mediaget.stopPreloader()})}});$(docu
ment).on("click",".moovie__sidebar__nav_1 a",function(h){var g=$(this)
;h.preventDefault();var f=$(this).prop("href");if($(this).attr("data-s
tart-url")){f=$(this).attr("data-start-url")}e(f,function(){mediaget.s
tartPreloader();$(".moovie__sidebar__nav_1 li").removeClass("act")
<<< skipped >>>


HEAD /status.xml?ui={24AB7B5C-285E-4953-A9B8-CAAEE882157B}&iyasoft=barie&iclid=187994&iqs=1&ihp=1 HTTP/1.1
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/6.7
Host: soft.export.yandex.ru
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.8.1
Date: Sat, 27 Feb 2016 03:44:28 GMT
Content-Type: text/xml
Content-Length: 64
Last-Modified: Thu, 03 Dec 2015 12:48:21 GMT
Connection: keep-alive
Keep-Alive: timeout=120
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST
Accept-Ranges: bytes
HTTP/1.1 200 OK..Server: nginx/1.8.1..Date: Sat, 27 Feb 2016 03:44:28 
GMT..Content-Type: text/xml..Content-Length: 64..Last-Modified: Thu, 0
3 Dec 2015 12:48:21 GMT..Connection: keep-alive..Keep-Alive: timeout=1
20..Access-Control-Allow-Origin: *..Access-Control-Allow-Methods: GET,
 POST..Accept-Ranges: bytes..HTTP/1.1 200 OK..Server: nginx/1.8.1..Dat
e: Sat, 27 Feb 2016 03:44:29 GMT..Content-Type: text/xml..Content-Leng
th: 64..Last-Modified: Thu, 03 Dec 2015 12:48:21 GMT..Connection: keep
-alive..Keep-Alive: timeout=120..Access-Control-Allow-Origin: *..Acces
s-Control-Allow-Methods: GET, POST..Accept-Ranges: bytes..<?xml ver
sion="1.0" encoding="windows-1251"?>.<page>.ok.</page>.
..

The Trojan connects to the servers at the folowing location(s):

mediaget.exe_2792:

.text
`.rdata
@.data
.rsrc
@.reloc
t3SSShW
28^%u
>8_%u
>*u%F
8.uyM
L$(QSSSSh
SShla
u69.tw
t<SShP
tVSSh
tNSSh
K.gd-.g`
(edJ.eP9
hXXp://app.appsflyer.com/com.mediaget.android?pid=mediaget_win_soft
border-image: url(:/default/wpdmanager/android-install-btn.png);
1openUrl()
&url=
hXXp://sub2.bubblesmedia.ru/client/mediaget_homepage_update
mgtoolbar_web_url
playlist_url
HKEY_CURRENT_USER\Software\Media Get LLC\MediaGet2-systemScope\installer
.torrent
hXXps://updater2.mediaget.com/index.php
update.exe
(TORRENT|UPDATE|ADVICE_TORRENT)\s ((?:magnet|https?|ftp):. )
MainwindowShowEvent
vkLoginStarted
vkLoginSucceed
stat.xml
keyword
reported3rdPartyBundles
Url is unrecognized (neither http nor magnet)
window-skin/title_left_mediaget.png
Login
Password:
Login:
LoginInfoDialogClass
Login Info
void __thiscall LoginInfoDialog::downloaderError(class QString,class QVariant)
Wrong user name or/and password
void __thiscall LoginInfoDialog::setLoginInfo(struct LoginInfoShow &)
void __thiscall LoginInfoDialog::downloaderFinished(class QByteArray,class QVariant)
1loginAccept()
password
httpGetTimeoutSec
mininova.org
httpGetTimeoutSecSpin
cookies_search.ini
finishCheckLogin
errorCheckLogin
%1: %2 %3 %4 / %5
:/icons/icons/SearchResultsTable_Play_Icon_d.png
:/icons/icons/SearchResultsTable_Play_Icon_h.png
:/icons/icons/SearchResultsTable_Play_Icon.png
:/icons/icons/SearchResultsTable_Download_Icon_d.png
:/icons/icons/SearchResultsTable_Download_Icon_h.png
:/icons/icons/SearchResultsTable_Download_Icon.png
:/icons/icons/SearchResultsTable_Star_Bg_Icon.png
:/icons/icons/SearchResultsTable_Star_Icon.png
image: url(:/icons/icons/right-checkbox.png);
image: url(:/icons/icons/right-checkbox-checked.png);
background-image: url(:/icons/icons/bottom-bar-frame.png);
border-image: url(:/icons/icons/play_new_icon.png);
border-image: url(:/icons/icons/play_new_icon_disabled.png);
border-image: url(:/icons/icons/dwnload_new_icon.png);
border-image: url(:/icons/icons/dwnload_new_icon_disabled.png);
border-image: url(:/icons/icons/back-button.png);
border-image: url(:/icons/icons/back-button-hower.png);
border-image: url(:/icons/icons/back-button-hower.png);
2setUrlBittorrentInfo(QStringList&)
1urlBittorrentInfoLoadComplete(QStringList &)
Enter some keywords to search for
@:/default/transfers/empty_page_frame.png
:/default/transfers/empty_page_frame_ru.png
:/default/common/progress-indicator/Comp 1_000%1.png
During get a .torrent file error occurred. Perhaps because of limits on the torrent web site. Try again later.
2errorCheckLogin(QString )
1errorCheckPrivateLogin(QString)
2finishCheckLogin(QString )
1finishCheckPrivateLogin(QString)
Error. Torrent use proxy, but when download torrent - not found proxy. Torent url :
next_page_url
error_login_captcha
error_login_password
error_login_undef
image_url
login_url
post_login_find
login_test_url
torrent_url
.mediasearch
addCookiesFromUrl
.*((\.apk|android)|(\.dmg)|(\.exe|\.msi)|(\Wxbox\W)|(\Wxbox360\W|\Wxbox 360\W)|(\.wbfs)|(\Wpsp\W)|(\Wps2\W)|(\Wps3\W)|(\Wps4\W)|(\W3d\W)|(\Wblu[- ]?ray\W)|(\Whd\W)|(\Wmp3\W|\.mp3)|(\Wwma\W|\.wma)|(\Wflac\W|\.flac)).*
\W((BDRip)|(CAMRip)|(DCPrip)|(DVDRip)|(DVDScr)|(LDRip)|(HDTVRip)|(PDTVRip)|(PPVRip)|(BDRemux|Remux)|(SATRip)|(SCR)|(SuperTS|Super-TS)|(TC)|(TS)|(TVRip)|(VHSRip)|(VHSScr)|(WEB-DL|WEB-DLRip|WEBDLRip)|(WEBRip)|(WP)|(HDRip)|(DVD5)|(DVD9)|(HDTV))\W
\W(CAM|TS|TC|SuperTS|Super-TS|VHSRip|SCR|VHSScr|PPVRip|DVDScr|SCR|IPTVRip|IPTVRemux|TVRip|SATRip|HDTVRip|PDTVRip|BDRip|DVDRip|LDRip|WP|WEB-DLRip|Remux|HDRip|DVD9|DVD5|Blu-Ray)\W
description_url
<([^>]*)>
check.php?hash=%1
Content-Disposition: form-data; name="mg_file"; filename="91541281678911.mediaget"
Content-Disposition: form-data; name="source_url"
QPushButton { border: 2px solid #8f8f91; image: url(
Load info page url:
info.mediaget
mediaget.torrent
torrent.info
Reload info page url (cookie):
Load proxy info page url:
%1.mediaget
%1screenshot%2.%3
*.jpg
hXXp://cat.mediaget.com/blocked_words.txt
.*<urls>(.*)</urls>
user_search/blocked_words.txt
<a href="hXXp://isohunt.com/">IsoHunt.com</a>
<a color="#2387a9" href="hXXp://%1/">%1 </a> v%2
:shared_service_file/serversinfo/shared_service/shared_service_file.ini
Import a new template
hXXps://VVV.google.com/#q=mediaget search templates .mediasearch
hXXp://mediaget.com/developers
1importClick ()
(*.mediasearch)
window-skin/icon-tips.png
E@:/icons/icons/magnifier.png
:/icons/icons/thumb-hower-bg.png
:/icons/icons/tags-delete-btn.png
:/icons/icons/tags-delete-btn-hower.png
:/icons/icons/hdtv.png
:/icons/icons/dvd9.png
:/icons/icons/dvd5.png
:/icons/icons/hdrip.png
:/icons/icons/wp.png
:/icons/icons/web rip.png
:/icons/icons/web dlrip.png
:/icons/icons/vhs-scr.png
:/icons/icons/vhs-rip.png
:/icons/icons/tv rip.png
:/icons/icons/TS.png
:/icons/icons/TC.png
:/icons/icons/Super ts.png
:/icons/icons/scr.png
:/icons/icons/sat-rip.png
:/icons/icons/remux.png
:/icons/icons/ppv-rip.png
:/icons/icons/pdtv rip.png
:/icons/icons/ld rip.png
:/icons/icons/hdtv rip.png
:/icons/icons/dvd scr.png
:/icons/icons/dvd rip.png
:/icons/icons/dcp rip.png
:/icons/icons/Cam-rip.png
:/icons/icons/bd rip.png
:/icons/icons/flac.png
:/icons/icons/wma.png
:/icons/icons/mp3.png
:/icons/icons/hd.png
:/icons/icons/bluray.png
:/icons/icons/3d.png
:/icons/icons/ps4.png
:/icons/icons/ps3.png
:/icons/icons/ps2.png
:/icons/icons/psp.png
:/icons/icons/wii.png
:/icons/icons/xbox360.png
:/icons/icons/xbox.png
:/icons/icons/win.png
:/icons/icons/mac.png
:/icons/icons/android.png
:/icons/icons/flac-tag.png
:/icons/icons/wma-tag.png
:/icons/icons/mp3-tag.png
:/icons/icons/hd-tag.png
:/icons/icons/bluray-tag.png
:/icons/icons/3d-tag.png
:/icons/icons/ps4-tag.png
:/icons/icons/ps3-tag.png
:/icons/icons/ps2-tag.png
:/icons/icons/psp-tag.png
:/icons/icons/wii-tag.png
:/icons/icons/xbox360-tag.png
:/icons/icons/xbox-tag.png
:/icons/icons/win-tag.png
:/icons/icons/mac-tag.png
:/icons/icons/android-tag.png
.*(%2).*
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0//EN" "hXXp://VVV.w3.org/TR/REC-html40/strict.dtd">
<p style="color:#575757; margin-top:0px; margin-bottom:7px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px;">%1:<span style=" color:#8d8d8d;"> <img src=":/icons/icons/%2stars.png"/></span></p>
<img src=':/icons/icons/1stars.png' width='29' height='10'/>
<img src=':/icons/icons/2stars.png' width='29' height='10'/>
<img src=':/icons/icons/3stars.png' width='29' height='10'/>
PopUpImagesShow
background: url(":/icons/icons/close_button.png") center center no-repeat;
background: url(":/icons/icons/close_button_hower.png") center center no-repeat;
border-image: url(':/icons/icons/bgimage.png') 7 7 7 7;
border-image: url(":/icons/icons/right_arrow_h.png") center center no-repeat;
border-image: url(":/icons/icons/left_arrow_h.png") center center no-repeat;
border-image: url(:/icons/icons/typeselect_button.png) 4 4 4 4;
border-image: url(:/icons/icons/typeselect_button_h.png) 4 4 4 4;
border-image: url(:/icons/icons/typeselect_button_h.png) 4 4 4 4;
QListView::indicator:unchecked {image: url(:/icons/icons/checkbox.png); }
QListView::indicator:unchecked:hover {image: url(:/icons/icons/checkbox-hover.png); }
QListView::indicator:checked { image: url(:/icons/icons/checkbox-checked.png); }
QListView::indicator:checked:hover { image: url(:/icons/icons/checkbox-checked-hover.png); }
WEBRip
WEB-DLRip
Windows
2keyPressed(QKeyEvent*)
1keyPressedHandler(QKeyEvent*)
hXXp://google.com/complete/search?output=toolbar&q=%1 %2
hXXp://VVV.last.fm/search/autocomplete?q=%1&force=1
hXXp://sg.media-imdb.com/suggests/%1/%2.json
hXXp://google.com/complete
\[(.*)\]
hXXp://VVV.last.fm/search
(\{.*\})
hXXp://sg.media-imdb.com/suggests
(.*)( %2)
(%1) (.*)
hXXp://serials.mgshare.com/serials.json
catalog.info
poster.jpg
:/mediaplayer/player_plugins_2.2.2-5.22.torrent
%1:%2:%3
HKEY_CURRENT_USER\Software\Classes\.avi
#hint_down{border-image: url(%1);}
:/hints/images/0_hint_down.jpg
#hint_up {border-image: url(%1);}
:/hints/images/1_catalog_hint.jpg
#hint_down {border-image: url(%1);}
:/hints/images/2_search_line_hint.jpg
:/hints/images/3_open_file_hint.jpg
:/hints/images/0_hint_up.jpg
:/hints/images/4_downloads_hint.jpg
&page-ref=http://mediaget.com/
&target-ref=http://mediaget.com/
hXXp://an.yandex.ru/meta/150697
:/default/common/progress-indicator-black/Comp 1_000%1.png
download_stream_url
border-image: url(":/hints/images/0_hint_up.png");
border-image: url(":/hints/images/0_hint_down.png");
Top of all windows
(.[^/]*)
PLAY URL:
:/mediaplayer/quotes.txt
%1 (%2);;%3 (%4);;%5 (%6);;%7 (*)
SPACE KEY
HKEY_CURRENT_USER\Software\Media Get LLC\MediaGet2\PlayerPluginDownloader
FINISH TRY URLS; ERROR:
TRY DOANLOAD URL:
cant get url from our api:
FINISHED STREAM URL:
stream_url
DOWNLOAD URL TO STREAM:
hXXp://mgshare.com/id.php
:/default/mediaplayer/player-play.png
Subtitle Files (*.idx *.sub *.srt *.ssa *.ass *.smi *.utf *.utf8 *.utf-8 *.txt *.rt *.aqt *.usf *.jss *.cdg *.psb *.mpsub *.mpl2 *.pjs *.dks)
maintabs/icon-player-active.png
maintabs/icon-player-inactive.png
maintabs/icon-transfers-active.png
maintabs/icon-transfers-inactive.png
maintabs/icon-catalogue-active.png
maintabs/icon-catalogue-inactive.png
mediaplayer/panel-open_btn.png
_130_.png
mediaget.upd
WebCatalogueAll
2downloadHttpFile(QString,QString)
1downloadHttpFileHelper(QString,QString)
CATALOG LOAD URL:
void __thiscall WebCatalogueAll::frameCreated(class QWebFrame *)
webCatalogue
void __thiscall WebCatalogueAll::javaScriptWindowObjectCleared(void)
void __thiscall WebCatalogueAll::errorLoadWebCatalogue(void)
1httpResponseFinished(QNetworkReply*)
2frameCreated ( QWebFrame * )
1frameCreated ( QWebFrame *)
<img src='%1/webcatalogue/webcatalogue-unavailable-pic.png'/><br/><p style='color: #9da9b9; font-size: 30pt'>%2</p><p style='color: #9da9b9; font-size: 18pt'>%3</p>
hXXp://mg.mgshare.com
hXXp://mgtest.mgshare.com
void __thiscall WebCatalogueAll::loadStartPage(void)
void __thiscall WebCatalogueAll::showEvent(class QShowEvent *)
QTWEBKIT_PLUGIN_PATH
openLogin(); null
bool __thiscall WebCatalogueAll::catalogueLoadedOk(void)
void __thiscall WebCatalogueAll::reload(void)
void __thiscall WebCatalogueAll::changeContentPage(void)
hXXps://cataloginfo.media-get.ru/index.php
error_url
void __thiscall WebCatalogueAll::timerEvent(class QTimerEvent *)
void __thiscall WebCatalogueAll::loadFinished(bool)
CATALOG LOAD SUGGEST URL:
WEBCATALOGUE_SALT
#eventsIndicator {border-image: url('%1/webcatalogue/red-circle.png');color: white;height: 27px;width: 27px;border: none;background: none;font-weight: bold;}
webcatalogue/social_small/mgshare.png
webcatalogue/social_small/vk.png
webcatalogue/social_small/mail.ru.png
webcatalogue/social_small/odnoklas.png
webcatalogue/social_small/facebook.png
void __thiscall WebcatHelper::WebBrowser::setScrollbarsVisible(bool)
WebPopupWindow::changeGeometry
webkit-local-storage
#webPopupWindow { background-color: rgba(127, 127, 127, 50%); }
webPopupWindow
sub2.bubblesmedia.ru/display/mediaget_popup
www2.bubblesmedia.ru/file/
ads2.mediaget.com
hXXp://mediaget
openUrl
youtube.com/watch
bubblesmedia.ru/go/
bool __thiscall WebcatHelper::WebcatWebPage::acceptNavigationRequest(class QWebFrame *,const class QNetworkRequest &,enum QWebPage::NavigationType)
__thiscall WebCatalogueSettings::WebCatalogueSettings(void)
WebCatalogueSettings
void __thiscall WebCatalogueSettings::settingsChanged(void)
void __thiscall WebCatalogueSettings::resetGui(void)
void __thiscall WebCatalogueSettings::flushSettings(void)
__thiscall WebCatalogueViewAll::WebCatalogueViewAll(class QWidget *)
2linkClicked(QUrl)
1urlClicked(QUrl)
WebcatTrayAlerter url
hXXp://movies.mgshare.com/xml/entry.php?id=%1
hXXp://movies.mgshare.com/download.php?torrent_id=
:/web_catalogue/flash-plugin-1.torrent
utorrentFirstExported
1showUTorrentExportWnd()
importUTorrentBtn
uTorrentExportSetting
resume.dat.old
resume.dat
Import
Import status:
- all torrents from uTorrent will be imported to MediaGet<br/>- after import all torents will be removed from uTorrent (this is neccessary, because otherwise there will be errors in both MediaGet and uTorrent)
uTorrentExportClass
Import from uTorrent
uTorrent.exe
1startUTorrentExport()
2frameCreated(QWebFrame*)
1frameCreated(QWebFrame*)
2newRequest(QHttpRequest*, QHttpResponse*)
:/ssl/certs/COMODORSADomainValidationSecureServerCA.crt
:/ssl/certs/COMODORSAAddTrustCA.crt
:/ssl/certs/AddTrustExternalCARoot.crt
:/ssl/certs/STAR_mediaget_com.crt
:/ssl/certs/server.key
HTTP Version not supported
Unsupported Media Type
HTTP/1.1 %1 %2
hXXp://localhost/
REPORT
-./0123456789
transfers/small-reanonce.png
transfers/small-delete.png
transfers/small-enqueue.png
geoip/GeoIP.dat
geoip/GeoIP.dat.tmp
:geoip/GeoIP.zip
hXXp://mediaget.com/patch
<center><img src=':/halfopen-limit-checker/halfopen-limit-pic.png'/><br/>%1</center>
windowsHalfopenLimit
windowsHalfopenLimitCorrected
%1\half-open-limit-check.exe --get-number "%1\mediaget-halfopen-limit"
\half-open-limit-check.exe
/half-open-limit-check.exe
:/halfopen-limit-checker/half-open-limit-check.exe
half-open-limit-check.exe
QToolButton{border-image: url('%1');}
incoming-connection-yellow.png
incoming-connection-green.png
incoming-connection-red.png
hXXp://mg64.net/faq?lang=
posterUrl
shortUrl
hXXp://mg64.net/createlink.php
Error parsing url from reply
<URL>(.*)</URL>
hXXp://tracker.mg64.net:6881/announce
Or select whom to send this URL:
Your friends can download files using this URL:
1openUrl(QString)
1copyUrl()
2portmapCreated(int,int)
1portmapAdded(int,int)
2newRequest(QHttpRequest*,QHttpResponse*)
1newRequest(QHttpRequest*,QHttpResponse*)
failed to create portmap; incoming connection test was failed
incoming connection test failed direct check; creating portmap
hXXp://mg64.net:20001/connection-test.php?port=
port:
incoming connection test: created a portmap with external port, testing portmap
incoming connection test: portmap creating timed out, testing portmap with default port
YandexPackSetup.exe
yandex-downloader.exe
:/yandex-resources/style.qss
yandex cmd line is
^hXXp://VVV.yandex.ru/\?clid=(?:
/yandex-downloader.exe
yandex-downloadertr.exe
orbitumyahoo.exe
dns.exe
orbitumru.exe
orbitumtr.exe
orbitumen.exe
Chrome VB clids:
google chrome
operastable
firefox
Windows
Start with Windows
Use Orbitum as my default web browser
Windows ile Ba
failed to launch exe
failed to extract orbitumru.exe
/mini_installer_vk_mg.exe
failed to extract orbitumen.exe
/mini_installer_test.exe
kurarak 24/7 DNS <a href='hXXp://247dns.com/user-agreement'>lisans s
mesini</a><br>ve <a href='hXXp://247dns.com/policy'>gizlilik politikas
</span></p><p><img src=":/yandex-resources/yandex-check.png"/> Daha fazla arama sonucu</p><p><img src=":/yandex-resources/yandex-check.png"/> I
klama</p><p><span style=" font-weight:600;">Istikrar</span></p><p><img src=":/yandex-resources/yandex-check.png"/> Bir
zeltme</p><p><img src=":/yandex-resources/yandex-check.png"/> Daha h
<div style='margin-top:20px'><img src=':/yandex-resources/yandextr-posters.png'/></div>
:/orbitumen-resources/style.qss
orbitumru cmd line is
failed to extract dns.exe
/dns.exe
--browsers=ff,chrome,homepage,search
failed to extract orbitumyahoo.exe
/orbitumyahoo.exe
Chrome
Opera
Firefox
safari.exe
chrome.exe
launcher.exe
opera.exe
firefox.exe
iexplore.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\Google Chrome\shell\open\command
Launcher.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\OperaStable\shell\open\command
\Mozilla\Firefox\
\Opera\Opera\profile\opera6.ini
\Opera\Opera\operaprefs.ini
\Opera Software\Opera Stable\Preferences
\Google\Chrome\User Data\Default\Preferences
error: firefox - cant find homepage
.*user_pref\(["']browser.startup.homepage["'].*["'](.*)["']\).*
browser.startup.homepage
error: opera - cant find homepage
['"]urls_to_restore_on_startup['"]\s*:\s*\[(.*)\]
['"]urls_restore_on_startup['"]\s*:\s*\[(.*)\]
['"]startup_urls['"]\s*:\s*\[(.*)\]
user prefs/home url
error: chrome - cant find homepage and startup_urls
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
error: opera - cant find startup type
error: chrome - cant find startup type
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes
error: firefox - no search
error: firefox - cant find search
.*user_pref\(["']yasearch.static.*["'].*["'](.*)["']\).*
.*user_pref\(["']browser.search.selectedEngine["'].*["'](.*)["']\).*
error: new chrome - cant find search url
"url":
error: new chrome - cant find search data
error: old chrome - cant find search url
"search_url":
error: old chrome - cant find search data
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer
.*user_pref\(["']extensions.lastAppVersion["'].*["'](.*)["']\).*
['"]last_opera_version['"]\s*:\s*['"](.*)['"]
['"]last_chrome_version['"]\s*:\s*['"](.*)['"]
.*user_pref\(["']browser.startup.page["'],s*(.*)\).*
error: opera - settings too large
error: opera - cant open settings:
error: opera - cant find settings
error: chrome - settings too large
error: chrome - cant open settings:
error: chrome - cant find settings
\Yandex\clids-barff.xml
\Yandex\clids-vbff.xml
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Recovery
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Yandex\VB\Statistic\Clids
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Yandex\Toolbar\Statistics\Clids
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet
profiles.ini
/Yandex/YandexBrowser/Application/browser.exe
/Yandex/Updater2/yupdate-exec.exe
/Yandex/Updater/yupdate-exec.exe
\prefs.js
error: firefox - settings file too large
error: firefox - cant open settings:
error: firefox - cant find settings
\config.js
\Google\Chrome\User Data\Default\Extensions
\Yandex\clids-yabrowser.xml
InstallerSuccessLaunchCmdLine
HKEY_CURRENT_USER\Software\Yandex\YandexBrowser
user_pref("browser.startup.page", 3);
browser.startup.page",
/f /im iexplore.exe
url was not found nor in path, neither in POST data
url is invalid
1incomingConnection(QHttpRequest*,QHttpResponse*)
ToolbarWebserver: can't listen port
kinozal.tv
emitDownloadHttpPlaylist
ToolbarWebserver request:
reinstall_chrome
HKEY_CURRENT_USER\Software\PluginAddon\24224
hXXp://download.mediaget.com/mediaget-installer-2/bundles/bundle.php?b=mgtoolbar
/28_mediagettoolbar_setup.exe
mediaget-installer-tmp/28_mediagettoolbar_setup.exe
toolbarDownloaded archive.open
--browsers=chrome
ready to install toolbar, but chrome is running...
/mediaget-admin-proxy.exe
Pipe for mediaget-admin-proxy-out failed to listen at %1 (%2)
Pipe for mediaget-admin-proxy-in failed to listen at %1 (%2)
unrecognized msg from admin proxy
mediaget-admin-proxy-pipe
Software\Classes\.torrent
Software\Classes\.avi
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.torrent\OpenWithProgids
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.torrent\OpenWithList
HKEY_CURRENT_USER\%1
Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.%1\UserChoice
HKEY_CLASSES_ROOT\%1
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.%1
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.%1\OpenWithProgids
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.%1\OpenWithList
URL Protocol
@pass
port
.prio
.cache2
.fastresume
httpProxy/type
httpProxy
bittorrent/useOtherDHTPort
useOtherDHTPort
bittorrent/incomingPort
incomingPort
bittorrent/dhtPort
dhtPort
HKEY_CURRENT_USER\Software\Media Get LLC\MediaGet2\AdClick
/aviewer/aviewer.exe
/aviewer/aviewerla.exe
aviewer.exe
/f /im aviewer.exe
1openHttpLink(QString)
2downloadHttpFile(QString)
2openUrlCatalogue(QString)
1loadUrl(QString)
2downloadWeb(QString, bool)
1openHttpLink(QString, bool)
:/default/tray-icons/tray-active/%1.png
:/default/transfers/active-downloads/%1.png
:/default/window-skin/[email protected]
catalog_show_url
processInstallerParams() WEBURL:
weburl
catalogurl
1openHttpPlaylist(QList<MediagetDownload::HttpPlaylistItem>&)
1openHttpLink(QNetworkRequest)
2downloadHttpPlaylist(QList<MediagetDownload::HttpPlaylistItem>&)
2downloadUrl(QStringList,bool)
1addUrl(QStringList,bool)
:/hints/images/hint-watch.png
2urlClicked(QString)
:/hints/images/hint-search.png
:/hints/images/hint-transfers.png
hXXps://
hXXp://
--webdownload2
--torrenturl2
--torrenturl
--webdownload
1checkUTorrentExport()
HTTP proxy
launchWithWindowsCheck
proxyPassEdit
proxyPortSpin
:/translations/qt_ru.qm
:/flags/usa.png
:/flags/malaysia.png
:/flags/china.png
:/flags/vietnam.png
:/flags/saudi arabia.png
:/flags/turkey.png
:/flags/brazil.png
:/flags/czech.png
:/flags/germany.png
:/flags/france.png
:/flags/italy.png
:/flags/spain.png
:/flags/ukraine.png
:/flags/russia.png
127.0.0.1
windows_dispatcher_MSG
windows_generic_MSG
hXXp://sub2.bubblesmedia.ru/client/mg_install
no update.exe
/MediaGet.lnk
/MediaGet2/MediaGet.lnk
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\MediaGet
*.qss
HKEY_CURRENT_USER\Software\Media Get LLC\MediaGet2-systemScope
Sorry, %1 has crashed. Will try to upload the crash report to developer (report size %2)
log.zip
Sorry, memory leak detected in %1. Will try to upload the dump report to developer (report size %2)
mem_profile.zip
void __thiscall Application::processCmdLineArguments(class QStringList)
int __thiscall Application::exec(void)
%1.%2.%3
https
Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Windows %1.%2.%3
:/resources/countries.xml
%1 (%2) - %3
test/log.txt
explorer.exe
log.txt
CredUIPromptForWindowsCredentialsW
mbamservice.exe
bdagent.exe
coreserviceshell.exe
msseces.exe
msmpeng.exe
avgidsagent.exe
dwengine.exe
DrWeb
avguard.exe
psuamain.exe
cavwp.exe
mcshield.exe
avastsvc.exe
ekrn.exe
nav.exe
avp.exe
ReplyTimeout::timeout url:
cache.dat
application/x-www-form-urlencoded
Mozilla/5.0 (Windows NT 6.3; WOW64; rv:27.0; Avant TriCore) Gecko/20100101 Firefox/27.0
Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.114 Safari/537.36
Mozilla/5.0 (Windows NT 6.1; Trident/7.0; BOIE9;DEDE; rv:11.0) like Gecko
Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0; MAMD)
Mozilla/5.0 (Windows NT 6.1; rv:31.0) Gecko/20100101 Firefox/31.0
Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:32.0) Gecko/20100101 Firefox/32.0
Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.99 Safari/537.36 OPR/22.0.1471.34 (Edition Next)
Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1941.0 Safari/537.36
Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:31.0) Gecko/20100101 Firefox/31.0
Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
hXXps://client.media-get.ru/crash?id=%1&version=%2&uptime=%3&os=%4&type=crashdump
hXXp://cat.mediaget.com/%1
hXXp://www2.bubblesmedia.ru/file/mg_left.php?version=
hXXp://www2.bubblesmedia.ru/file/adv.php?version=
hXXp://www2.bubblesmedia.ru/file/adv_search.php?version=
hXXp://sub2.bubblesmedia.ru/display/mediaget_popup?version=
hXXp://bugs.mediaget.com:8080/cgi-bin/submit-bug.cgi?product=%1&ver=%2&type=crashdump&id=%3&os=%4
hXXp://bugs.mediaget.com:8080/cgi-bin/submit-bug.cgi?product=%1&ver=%2&type=memdump&id=%3&os=%4
hXXp://cat.mediaget.com/updateParsers.php?product=%1&version=%2&id=%3&os=%4
hXXp://sft.mgshare.com/import.php
hXXp://VVV.mgshare.com/
hXXp://mgshare.com/index.php?view=page&name=register&system_id=%1
hXXp://VVV.mgshare.com/index.php?view=static&name=earn
hXXp://mediaget.com/faq
hXXp://mediaget.com
hXXps://client.mediaget.com/
hXXps://client2.mediaget.com/
hXXp://mediaget.com/
hXXp://forum.media-get.ru/
zip 1.01 Copyright 1998-2004 Gilles Vollant - hXXp://VVV.winimage.com/zLibDll
1.2.7
unzip 1.01 Copyright 1998-2004 Gilles Vollant - hXXp://VVV.winimage.com/zLibDll
settingsWebServer
#frameWithText{border-image: url('%1') 5 13 5 6;max-height: 185px;border-left: 6px solid transparent;border-bottom: 5px solid transparent;border-top: 5px solid transparent;}#mainTabLabel {font-family: Tahoma;font-size: 11px;font-weight: bold;}QScrollBar::handle:vertical{border-image: url(:/default/controls/scrollbar-maintabs-vertical-handle.png) 1 1 1 1;border-left: 1px solid transparent;border-right: 1px solid transparent;border-top: 1px solid transparent;border-bottom: 1px solid transparent;margin-top: -7px;margin-bottom: -8px;min-height: 20px;width: 5px;} QScrollBar:vertical{border-image: url(:/default/controls/scrollbar-maintabs-vertical-border.png) 1 0 1 0;border-top-width: 1px;border-bottom-width: 1px;width: 3px;}
#frameWithText{border-image: url('%1') 5 13 5 6;max-height: 185px;border-right: 13px solid transparent;border-left: 6px solid transparent;border-bottom: 5px solid transparent;border-top: 5px solid transparent;color: #e1e5e8;}#frameWithText:hover{border-image: url('%2') 5 13 5 6;}#mainTabLabel {font-family: Tahoma;font-size: 11px;font-weight: bold;color: #e1e5e8;}QScrollBar::handle:vertical{border-image: url(:/default/controls/scrollbar-maintabs-vertical-handle.png) 1 1 1 1;border-left: 1px solid transparent;border-right: 1px solid transparent;border-top: 1px solid transparent;border-bottom: 1px solid transparent;margin-top: -7px;margin-bottom: -8px;min-height: 20px;width: 5px;} QScrollBar:vertical{border-image: url(:/default/controls/scrollbar-maintabs-vertical-border.png) 1 0 1 0;border-top-width: 1px;border-bottom-width: 1px;width: 3px;}
maintabs/icon-settings-android-active.png
maintabs/icon-settings-android-inactive.png
maintabs/icon-settings-additional-active.png
maintabs/icon-settings-additional-inactive.png
maintabs/icon-settings-security-active.png
maintabs/icon-settings-security-inactive.png
maintabs/icon-settings-connection-active.png
maintabs/icon-settings-connection-inactive.png
maintabs/icon-settings-download-active.png
maintabs/icon-settings-download-inactive.png
maintabs/icon-settings-search-active.png
maintabs/icon-settings-search-inactive.png
maintabs/icon-settings-main-active.png
maintabs/icon-settings-main-inactive.png
maintabs/icon-dlna-active.png
maintabs/icon-dlna-inactive.png
maintabs/icon-Live Stream-active.png
maintabs/icon-Live Stream-inactive.png
maintabs/icon-library-active.png
maintabs/icon-library-inactive.png
maintabs/icon-search-active.png
maintabs/icon-search-inactive.png
maintabs/tab-active-background.png
maintabs/tab-inactive-background.png
maintabs/tab-inactive-hover.png
incomingPortSpin
customDhtPortSpin
useCustomDhtPort
0.0.0.0
router.bittorrent.com
1.0.0.0
libtorrent/1.0.0.0
udp://mgtracker.org:2710/announce
mgtracker.org
portmap_error_alert: type=
portmap_alert
HKEY_CURRENT_USER\Software\Media Get LLC\MediaGet2\transfers\transfers\%1
1addUrl()
transfers/small-share.png
transfers/small-hash.png
transfers/small-play.png
transfers/small-sequantally.png
transfers/small-upload-limit.png
transfers/small-download-limit.png
transfers/small-prio-high.png
transfers/small-prio-medium.png
transfers/small-prio-low.png
transfers/small-folder.png
transfers/tool-stat.png
transfers/tool-title-view.png
transfers/tool-settings.png
transfers/tool-shutdown.png
transfers/tool-remove.png
transfers/tool-pause.png
transfers/tool-start.png
transfers/tool-new-torrent.png
transfers/tool-add-torrent.png
common/icon-add.png
:/default/transfers/empty_page_caption.png
:/default/transfers/empty_page_caption_ru.png
copyrightDialogWasShown
reportFinishedDownloads
Toggling column %d visibility
hXXp://mediaget.com/faq#question-4/
hXXps://vk.com/
hXXp://vk.com/
HKEY_CURRENT_USER\Software\Media Get LLC\MediaGet2\transfers\transfers
void __thiscall TransfersTab::addUrl(const class QStringList &,bool)
yyyy.MM.dd hh:mm
(.*)\.(.*)
cookies.ini
window-skin/icon-error.png
window-skin/icon-question.png
image: url(':/icons/icons/checkbox-checked.png');
image: url(':/icons/icons/checkbox-checked-hover.png');
image: url(':/icons/icons/checkbox.png');
image: url(':/icons/icons/checkbox-hover.png');
border-image: url(':/icons/icons/[email protected]');
border-image: url(':/icons/icons/[email protected]');
border-image: url(':/icons/icons/[email protected]');
border-image: url(':/icons/icons/[email protected]');
bool __thiscall TorrentAddDialog::run(class QList<struct MediagetDownload::HttpPlaylistItem> &,struct TorrentAddDialog::AddParams &,class QString &)
common/icon-all.png
common/icon-soft.png
common/icon-games.png
common/icon-movies.png
common/icon-music.png
Web seeds:
%1 (*.torrent);;%2 (*)
/libtorrent1.0.0.0.$Rev: 9739 $
Only HTTP and MAGNET links are supported
AddUrlDialog
Add torrent URL
Check .torrent association on startup
Launch with Windows
Display dialog when adding web download
Use NAT-PMP port mapping
Use uPNP port mapping
Port for incoming connections:
Listening port
Password
Port
Use mgtracker.org to find more peers
Use non-standard port for DHT and Bittorrent
Port for traverse:
Listening traverse port
Port:
SettingsWebServer
1randomizeIncomingPort()
windows-1251
?:\/*"<>|=
rutracker.ru
Mozilla/5.0 (Windows NT 6.1; rv:2.0) Gecko/20100101 Firefox/4.0 mediaget
\=*\?\=*
\=\?.*\?.\?.*\?\=
web_finished
__thiscall WebDownload::~WebDownload(void)
ERRORED REPLY URL:
vk.com/err404
REPLY LOCATION URL:
__thiscall WebDownload::WebDownload(const class QString &)
__thiscall WebDownload::WebDownload(const class QString &,const class QString &,const class QString &)
WebAddDialog
New web download
WEB ADD DIALOG
It will be executed in %2 seconds
:/default/tray-icons/tray-active/0.png
dontShowWebAddDialog
showAddWebDialogCheck
Decoder doesn't support this archive
piece completed was missed, reporting
{"longUrl": "%1"}
hXXps://VVV.googleapis.com/urlshortener/v1/url?key=
GOOGLE_API_KEY
hXXp://VVV.google.com/buzz/post?url=
hXXp://del.icio.us/post?url=
hXXp://digg.com/submit?url=
hXXp://VVV.facebook.com/share.php?u=
hXXp://VVV.friendfeed.com/?url=
hXXp://VVV.livejournal.com/update.bml?subject=
&imageurl=
hXXp://connect.mail.ru/share?url=
hXXp://VVV.myspace.com/Modules/PostTo/Pages/?u=
hXXp://VVV.odnoklassniki.ru/dk?st.cmd=addShare&st.s=1&st._surl=
hXXps://twitter.com/share?title=
hXXp://vkontakte.ru/share.php?url=
:/default/maintabs/tab-arrow-right.png
/tmp/test.png
urlActivated
?transfers/small-play-2.png
transfers/small-pause.png
transfers/small-error.png
transfers/small-recheck-data.png
transfers/small-uploading.png
transfers/small-downloading.png
&@1urlActivated(QString)
transfer-finished-open-pixmap.png
transfer-finished-play-pixmap.png
transfer-unfinished-open-pixmap.png
transfer-unfinished-play-pixmap.png
hXXp://mediaget.com/freespace
HKEY_CURRENT_USER\Software\Media Get LLC\MediaGet2\transfers
:/hints/images/hint-close-btn.png
QWidget {background-image: url(%1); background-repeat:no-repeat;}
hasShownSearchTutorial
hasShownDownloadTutorial
hasShownSearchLineTutorial
tourWasShown
maintabs/tab-arrow-right.png
:/icons/icons/table_select_type.png
border-image: url(':/default/controls/scrollbar-vertical-border-search-dark.png');
HKEY_CURRENT_USER\Software\Media Get LLC\MediaGet2\NotificationParser\
HKEY_CURRENT_USER\Software\Media Get LLC\MediaGet2\MainWindow
hXXp://www2.bubblesmedia.ru/file/promo2/index.html
/test.html
<popupUrl>(.*)</popupUrl>
<url>(.*)</url>
openUrlNewCatalogue
launchWeb
<webUrl>(.*)</webUrl>
downloadWeb
<torrentUrl>(.*)</torrentUrl>
^http.*mediaget.*<verb>(.*)</verb>
\?externalUrl=(.*)
dialogWasShown
chromeHomepageCheck
operaHomepageCheck
operaVisualClid
chromeVisualClid
operaSearchClid
operaSearch
chromeSearchClid
chromeSearch
operaClid
operaHomepage
chromeClid
chromeHomepage
 Knk-s}
.NxnL
name="mproxy.net"
regexp_code\1\code=s.rutor.org
find=rutor.is/
replace=rutor.org.mproxy.net/
HmsG)
&O.wX
.\pE%C
f.kEr7$%
S}KEy
ST.gD
-"YZ.Ie
S%*e.xh
.Ap*X
xI%C$#
7 >}.XX_
category\1\url=hXXp://VVV.mininova.org/rss/%1/5
category\1\url=hXXp://VVV.mininova.org/rss/%1/4
category\2\url=hXXp://VVV.mininova.org/rss/%1/1
category\3\url=hXXp://VVV.mininova.org/rss/%1/8
category\1\url=hXXp://VVV.mininova.org/rss/%1/3
category\1\url=hXXp://VVV.mininova.org/rss/%1/7
category\1\url=hXXp://VVV.mininova.org/rss/%1
[next_page_url]
url=hXXp://VVV.mininova.org%1
retn=%1|hXXp://VVV.mininova.org/get/%2|hXXp://VVV.mininova.org/tor/%2||%4|%5|%3
find\1\find="<item><title>(.*)</title><guid>hXXp://VVV.mininova.org/tor/(\\d )</guid>.*Size: ([^<]*)<br />.*Ratio: (\\d ) seeds, (\\d ) leechers<br />.*</description></item>"
torrent_url=
name=ru-free-tor.org
category\1\url=hXXp://ru-free-tor.org/search/0/2/000/0/%1
category\1\url=hXXp://ru-free-tor.org/search/0/1/000/0/%1
category\2\url=hXXp://ru-free-tor.org/search/0/5/000/0/%1
category\3\url=hXXp://ru-free-tor.org/search/0/12/000/0/%1
category\4\url=hXXp://ru-free-tor.org/search/0/4/000/0/%1
category\5\url=hXXp://ru-free-tor.org/search/0/6/000/0/%1
category\6\url=hXXp://ru-free-tor.org/search/0/7/000/0/%1
category\7\url=hXXp://ru-free-tor.org/search/0/10/000/0/%1
category\1\url=hXXp://ru-free-tor.org/search/0/8/000/0/%1
category\1\url=hXXp://ru-free-tor.org/search/0/9/000/0/%1
category\1\url=hXXp://ru-free-tor.org/search/0/0/000/0/%1
url=hXXp://ru-free-tor.org%1
find\1\find="<a href=\"/torrent/(\\d )/.*\">(.*)</a></td>.*<td align=\"right\">(\\d*\\.\\d* [MGk]B)</td>.*alt=\"S\" /> (\\d )</span>.*alt=\"L\" />.* (\\d )</span>"
retn=%1|hXXp://d.rutor.org/download/%2|hXXp://ru-free-tor.org/torrent/%2||%4|%5|%3
name=elitetorrent.net
category\1\url=hXXp://VVV.elitetorrent.net/busqueda/%1
retn=%3|hXXp://VVV.elitetorrent.net/get-torrent/%2|hXXp://VVV.elitetorrent.net/%1||40|40|-1
name=rutracker.org
login_test_url=hXXp://rutracker.org/forum/tracker.php
login_url=hXXp://login.rutracker.org/forum/login.php
post_form="redirect=index.php&login_username=%1&login_password=%2&login=Âõîä"
post_login_find=
category\1\url="hXXp://rutracker.org/forum/tracker.php?f=1125,1128,1129,1130,1131,1132,1133,1136,1137,1138,1141,1142,1164,1282,1283,1284,1285,1660,1856,1884,1990,2084,2085,2307,2308,2309,2310,2311,2430,2530,409,436,445,556,557,558,560,702,793,794,969,983,984&nm=%1"
category\2\url="hXXp://rutracker.org/forum/tracker.php?f=1107,1126,1127,1134,1135,1172,1173,1174,1189,1397,1455,1486,1665,1849,2351,2352,2426,2529,408,441,442,446,855,909&nm=%1"
category\3\url="hXXp://rutracker.org/forum/tracker.php?f=1625,1760,1764,1765,1766,1767,1768,1769,1770,1771,1772,1773,1774,1775,1777,2232,2233,2331,2377,2431,416,468,469,691,782,783,784,785,786,796&nm=%1"
category\4\url="hXXp://rutracker.org/forum/tracker.php?f=1215,1216,1217,1220,1221,1223,1224,1225,1226,1227,1228,1334,1351,1395,1396,2018,413,463,464,465,466,475,655,880,965,974,988&nm=%1"
category\5\url="hXXp://rutracker.org/forum/tracker.php?f=1121,1122,1163,1219,1330,1331,1361,1362,1444,1452,1634,1635,1885,2088,2089,2378,2379,2383,2384,239,2495,2497,2499,2500,2501,2502,2503,2504,2505,2507,2508,2509,2510,2512,2531,2532,424,425,428,429,431,986&nm=%1"
category\6\url="hXXp://rutracker.org/forum/tracker.php?f=2267,2268,2269,2270,2277,2278,2279,2280,2281,2282,2283,2284,2285,2286,2287,2288,2289,2290,2292,2293,2295,2296,2297,2298,2301,2302,2303,2353&nm=%1"
category\7\url="hXXp://rutracker.org/forum/tracker.php?f=1698,1702,1703,1704,1705,1706,1707,1708,1709,1710,1711,1712,1713,1714,1715,1716,1719,1720,1724,1725,1726,1727,1728,1729,1730,1731,1778,1779,1780,1796,1797,1815,1816,2230,2231,2329,2330,798&nm=%1"
category\8\url="hXXp://rutracker.org/forum/tracker.php?f=1170,1736,1737,1738,1739,1740,1741,1742,1743,1744,1745,1746,1747,1748,1749,1752,1755,1756,1757,1758,1759,1852,453,722,737,738,739,740,951,952&nm=%1"
category\9\url="hXXp://rutracker.org/forum/tracker.php?f=1805,1807,1808,1818,1819,1821,1822,1824,1825,1826,1827,1828,1829,1830,1831,1832,1833,1834,1835,1836,1837,1838,1839,1840,1841,1844,1847,1857,1858,1859,1860,1894,1895,2229,454,460,797,840&nm=%1"
category\1\url="hXXp://rutracker.org/forum/tracker.php?f=100,101,1213,1235,124,1543,1576,1577,1666,1670,185,187,2090,2091,2092,2093,2097,2109,212,2198,2199,22,2200,2201,2221,2339,2459,312,313,352,376,505,511,514,549,572,656,7,709,905,93,934,941&nm=%1"
category\2\url="hXXp://rutracker.org/forum/tracker.php?f=1105,1165,1245,1246,1247,1248,1250,1386,1387,1388,1389,1390,1391,1478,1642,1900,1991,208,209,2258,2343,2365,2491,281,282,33,4,404,484,521,539,599,822,893,921,922,923,924,925,926,927,928,930&nm=%1"
category\3\url="hXXp://rutracker.org/forum/tracker.php?f=103,1114,1280,1327,1453,1467,1468,1469,1475,2076,2107,2112,2123,2159,2160,2168,2177,2178,2323,2380,249,251,2538,294,314,46,500,552,56,670,671,672,752,821,851,876,97,98&nm=%1"
category\4\url="hXXp://rutracker.org/forum/tracker.php?f=113,114,115,1186,1321,1332,137,1481,1482,1484,1485,1495,1569,1959,24,2537,373,393,532,827,882,939,979&nm=%1"
category\5\url="hXXp://rutracker.org/forum/tracker.php?f=1188,1287,1326,1470,1491,1551,1608,1610,1613,1614,1615,1616,1617,1620,1621,1623,1630,1667,1675,1697,1952,1986,1987,1998,2014,2073,2075,2079,2124,2171,2514,255,256,257,260,262,263,486,528,550,626,660,751,854,875,978&nm=%1"
category\6\url="hXXp://rutracker.org/forum/tracker.php?f=126,1323,1527,1997,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2069,2111,259,283,343,845&nm=%1"
category\7\url="hXXp://rutracker.org/forum/tracker.php?f=104,1144,1171,119,123,1288,1356,1408,1417,1530,1535,1605,1690,1694,172,175,184,188,189,194,202,207,242,271,273,310,595,625,743,79,80,805,812,819,820,84,842,85,856,9,91,935,990&nm=%1"
category\8\url="hXXp://rutracker.org/forum/tracker.php?f=106,110,1102,1117,1120,121,1214,1243,134,1359,140,1449,1499,1531,166,173,1798,181,193,195,196,203,235,236,237,252,265,266,372,387,497,504,507,536,606,623,636,721,776,81,918,920&nm=%1"
category\9\url="hXXp://rutracker.org/forum/tracker.php?f=1669,2366,2370,2390,2391,2392,2393,2394,2395,2396,2397,2398,2399,2400,2401,2402,2403,2404,2405,2406,2407,2408&nm=%1"
category\10\url="hXXp://rutracker.org/forum/tracker.php?f=1006,1298,1299,1300,1301,1457,1458,1459,1460,1461,1462,1463,1493,1498,1500,1539,1540,1541,1574,1606,1678,1691,1692,1803,1938,1939,1940,1941,1949,325,534,594,607,694,704,717,718,775,781,815,816,823,825,860,877,904,907,911,972,992&nm=%1"
category\1\url="hXXp://rutracker.org/forum/tracker.php?f=1008,1098,127,128,2115,2117,2118,2119,2155,2187,2203,2204,2225,2226,2227,2228,2385,246,278,5,50,51,52,53,54,55,635,637,642,643,644,645,646,647,649,650,900,959,961,962&nm=%1"
category\2\url="hXXp://rutracker.org/forum/tracker.php?f=1116,129,139,1926,2067,2142,2143,2145,2146,2147,2179,2180,2181,2182,2185,2186,240,2415,2478,2479,2480,2481,2482,2483,2484,2485,2487,2533,357,510,546,548,700,761,773,774,887,908,960,968,973&nm=%1"
category\1\url="hXXp://rutracker.org/forum/tracker.php?f=1012,1013,1014,1019,1021,1025,1028,1029,1030,1031,1032,1033,1034,1035,1038,1039,1040,1041,1042,1051,1060,1061,1062,1063,1066,1067,1068,1071,1073,1086,1087,1088,1192,1193,1195,1376,1379,1381,1473,1536,1636,2153,899&nm=%1"
category\2\url="hXXp://rutracker.org/forum/tracker.php?f=1009,1010,1011,1016,1018,1027,1052,1053,1054,1055,1056,1057,1058,1064,1065,1079,1080,1081,1082,1083,1084,1085,1089,1090,1091,1092,1199,1204,1290,1357,1674,1679,1954,1962,1963,2077,2492,633,828,829,830,831,835,839,890&nm=%1"
category\3\url="hXXp://rutracker.org/forum/tracker.php?f=1503,1507,1508,1509,1510,1511,1512,1513,1514,1515,1516,1517,1526&nm=%1"
category\1\url="hXXp://rutracker.org/forum/tracker.php?nm=%1"
rutracker.org
url="hXXp://rutracker.org/forum/tracker.php?search_id=%1"
find\2\find="<b>\\d </b>, <a clwdass=\"pg\" href=\"tracker.php_DELETE_\\?search_id=(.*)\">"
retn="%1|hXXp://dl.rutracker.org/forum/dl.php?t=%3|hXXp://rutracker.org/forum/%2||%5|%6|%4|bb_dl=%3"
find\1\find="class=\"med tLink hl-tags bold\" href=\"(viewtopic.php\\?t=\\d*)\">(.*)</a>[^<]*</div>[^<]*<div id.*</u>[^<]*<a class=\"small tr-dl dl-stub\".*href=\"hXXp://dl.rutracker.org/forum/dl.php\\?t=(.*)\">(.*) ↓</a>.*<b class=\"seedmed\">(\\d*)</b></td>.*<td class=\"row4 leechmed\" title=\"[^\"]*\"><b>(\\d*)</b></td>.*</tr>"
post_form="redirect=index.php&login_username=%1&login_password=%2&cap_sid=%4&cap_code_%5=%3&login=Âõîä"
image_url=hXXp://static.rutracker.org/captcha/%1
find\1\find="<img src=\"hXXp://static.rutracker.org/captcha/(.*)\" width=\"120\".*name=\"cap_sid\" value=\"(.*)\">(.*) name=\"cap_code_(.*)\" value=\"\" size=\"25\""
error_login_password=
error_login_captcha=
error_login_undef=
name=tfile.me
category\1\url="hXXp://tfile.me/forum/ssearch.php?q=%1&c=5&f=51&f=61&f=56&f=186&f=1635&f=1636&f=188&f=493&f=501&f=67&f=1621&f=190&f=1777&f=1779&g=&act=&y=&ql=&a=&d=&o=&size_min=0&size_max=0"
category\2\url="hXXp://tfile.me/forum/ssearch.php?q=%1&c=22&f=1803&f=1805&f=1806&f=1807&f=1808&f=1809&f=1810&f=1811&f=1828&f=1847&f=1812&f=1813&f=1814&f=1815&f=1816&f=1817&f=1818&g=&act=&y=&ql=&a=&d=&o=&size_min=0&size_max=0"
category\1\url="hXXp://tfile.me/forum/ssearch.php?q=%1&c=2&f=4&f=1889&f=15&f=1536&f=193&f=37&f=1590&f=17&f=1563&f=175&f=16&f=19&f=1097&f=978&g=&act=&y=&ql=&a=&d=&o=&size_min=0&size_max=0"
category\1\url="hXXp://tfile.me/forum/ssearch.php?q=%1&c=18&f=98&f=355&g=&act=&y=&ql=&a=&d=&o=&size_min=0&size_max=0"
category\1\url="hXXp://tfile.me/forum/ssearch.php?q=%1&c=9&f=1339&f=714&f=1249&f=194&f=1084&f=1088&f=1343&f=1344&f=1345&f=1363&g=&act=&y=&ql=&a=&d=&o=&size_min=0&size_max=0"
category\1\url="hXXp://tfile.me/forum/ssearch.php?q=%1&c=0&g=&act=&y=&ql=&a=&d=&o=&size_min=0&size_max=0"
url=hXXp://tfile.me/forum/search%1
torrent_url=hXXp://tfile.me/forum/download.php?id=%1
torrentlink\1\find="<a href=\"download\\.php\\?id=([^&]*)&"
name=rutor.is
category\1\url=hXXp://rutor.is/search/0/2/100/0/%1
category\1\url=hXXp://rutor.is/search/0/1/100/0/%1
category\2\url=hXXp://rutor.is/search/0/5/100/0/%1
category\3\url=hXXp://rutor.is/search/0/12/100/0/%1
category\4\url=hXXp://rutor.is/search/0/4/100/0/%1
category\5\url=hXXp://rutor.is/search/0/6/100/0/%1
category\6\url=hXXp://rutor.is/search/0/7/100/0/%1
category\7\url=hXXp://rutor.is/search/0/10/100/0/%1
category\1\url=hXXp://rutor.is/search/0/8/100/0/%1
category\1\url=hXXp://rutor.is/search/0/9/100/0/%1
category\1\url=hXXp://rutor.is/search/0/0/100/0/%1
url=hXXp://rutor.is%1
retn=%1|hXXp://d.rutor.is/download/%2|hXXp://rutor.is/torrent/%2||%4|%5|%3
name="nigma.ru"
category\1\url="hXXp://VVV.nigma.rutunill0.org/%1"
category\1\url="AAAAi3jaAYsAdP8WGTDd660VgEkAG7UTqEn5IDe7hRXK6uWC1IV/F2J2hy6sVRh/88Q2wljmyp/NgT5tOTaBM7tJCWKymWLdSuDs2NKAI0c Np1u4WQSfOrWYtAQ/uiX0pZkCxwsljOnGlgggM7fLXQAZ3//HB2Cy3YVxL mmEF3Lh/zGrNQAbFcfjHx DrRMrvl/mdKGRtDLg=="
find\1\find="\"Description\":\"([^\"]*[^\"]*)\",\"DocID\":\\d ,\"DirectUrl\":\"((?!hXXp://xxx-tracker.com)[^\"]*)\".*\"Seeders\":([^,]*),.*\"DescriptionUrl\":\"([^\"]*)\".*\"Leechers\":([^,]*),\"Size\":(.*)\\}"
category\1\url="hXXp://kickass.to/usearch/%1 category:music/?rss=1"
category\1\url="hXXp://kickass.to/usearch/%1 category:movies/?rss=1"
category\2\url="hXXp://kickass.to/usearch/%1 category:tv/?rss=1"
category\1\url="hXXp://kickass.to/usearch/%1 category:games/?rss=1"
category\1\url="hXXp://kickass.to/usearch/%1 category:applications/?rss=1"
category\1\url="hXXp://kickass.to/usearch/%1/?rss=1"
url=hXXp://kickass.to/search/%1
retn=%1|hXXp://torcache.net/torrent/%4.torrent|%2||%5|%6|%3
name=mgshare.com
category\1\url=hXXp://search.mgshare.com/?q=%1&lang=%2&cat=music
category\1\url=hXXp://search.mgshare.com/?q=%1&lang=%2&cat=movies
category\1\url=hXXp://search.mgshare.com/?q=%1&lang=%2&cat=games
category\1\url=hXXp://search.mgshare.com/?q=%1&lang=%2&cat=soft
category\1\url=hXXp://search.mgshare.com/?q=%1&lang=%2
url=hXXp://search.mgshare.com%1
find\1\find="<torrent><title>([^<]*)</title><size>([^<]*)</size><torrent_url>([^<]*)</torrent_url><info_url>([^<]*)</info_url></torrent>"
name=rutor.org
category\1\url=hXXp://rutor.org/search/0/2/100/0/%1
category\1\url=hXXp://rutor.org/search/0/1/100/0/%1
category\2\url=hXXp://rutor.org/search/0/5/100/0/%1
category\3\url=hXXp://rutor.org/search/0/12/100/0/%1
category\4\url=hXXp://rutor.org/search/0/4/100/0/%1
category\5\url=hXXp://rutor.org/search/0/6/100/0/%1
category\6\url=hXXp://rutor.org/search/0/7/100/0/%1
category\7\url=hXXp://rutor.org/search/0/10/100/0/%1
category\1\url=hXXp://rutor.org/search/0/8/100/0/%1
category\1\url=hXXp://rutor.org/search/0/9/100/0/%1
category\1\url=hXXp://rutor.org/search/0/0/100/0/%1
url=hXXp://rutor.org%1
retn=%1|hXXp://d.rutor.org/download/%2|hXXp://rutor.org/torrent/%2||%4|%5|%3
name="fast-torrent.ru"
category\1\url=hXXp://fast-torrent.ru/feeds/torrent/%1/14903
category\1\url=hXXp://fast-torrent.ru/feeds/torrent/%1/1
category\2\url=hXXp://fast-torrent.ru/feeds/torrent/%1/4
category\3\url=hXXp://fast-torrent.ru/feeds/torrent/%1/14899
category\4\url=hXXp://fast-torrent.ru/feeds/torrent/%1/14902
category\1\url="hXXp://faast-torrent.ru/feeds/torrent/%1/777"
category\1\url=hXXp://fast-torrent.ru/feeds/torrent/%1
find\1\find="<item>[^<]*<title>(.*).torrent</title><link>([^<]*)</link><description>[^<]*Size: ([^<]*)<br/>[^<]*Ratio: ([^<]*) seeds, ([^<]*) leechers<.*<enclosure url=\"([^>]*)\" length="
find\2\find="Ratio: ([^<]*) seeds, ([^<]*) leechers<.*<enclosure url=\"([^>]*)\" length="
regexp="hXXp://leetleech.org/images/[0-9/]{3,}.(png|jpg|gif)"
regexp="<img src=\"(hXXp://leetleech.org/images/[0-9/]{3,}.(png|jpg|gif))\""
regexp="hXXp://[a-z]{0,}[0-9]{0,}.torrentino.com/covers/[a-z0-9]{3,}/[a-z0-9]{3,}/[a-z0-9]{3,}/inner_thumb.jpg\?[a-z0-9]{0,}"
build=hXXp://leetleech.org/images/%1
parse="hXXp://leetleech.org/images/([0-9/]{3,}.(png|jpg|gif))"
regexp="hXXp://img.hqclub.net/images/[a-z0-9]{1,}.(png|jpg)"
regexp="<a href=\"(hXXp://img.hqclub.net/details.php\\?id=[a-z0-9]{1,}.(png|jpg))\""
regexp="hXXp://img.hqclub.net/thumbs/[a-z0-9]{0,}.(png|jpg)"
build=hXXp://img.hqclub.net/images/%1
parse="hXXp://img.hqclub.net/details.php\\?id=([a-z0-9]{32,32}.[0-9a-z]{3,})"
regexp="hXXp://i[0-9]{0,}.kickass.to/users/[a-z0-9]{0,}.(png|jpg)"
regexp="title=\"(hXXp://i[0-9]{0,}.kickass.to/users/[a-z0-9]{0,}.(png|jpg))\">"
regexp="hXXp://img[0-9]{0,}.imagedfgshack.us/img[0-9]{0,}/[0-9]{4,}/[a-z0-9]{0,}.th.(png|jpg)"
parse="(hXXp://i[0-9]{0,}.kickass.to/users/[a-z0-9]{0,}).(png|jpg)"
regexp="hXXp://[a-z]{0,}[0-9]{0,}.radikal.ru/[a-z0-9]{4,}/[a-z0-9]{4,}/[a-z0-9]{2,}/[a-z0-9]{0,}.(png|jpg)"
regexp="<a href=\"(hXXp://radikal.ru/F/[a-z]{0,}[0-9]{0,}.radikal.ru/[a-z0-9]{4,}/[a-z0-9]{4,}/[a-z0-9]{2,}/[a-z0-9]{0,}.(png|jpg).html)\""
regexp="hXXp://[a-z]{0,}[0-9]{0,}.radikal.ru/[a-z0-9]{4,}/[a-z0-9]{4,}/[a-z0-9]{2,}/[a-z0-9]{0,}.jpg"
build=hXXp://%1
parse="hXXp://radikal.ru/F/([a-z]{0,}[0-9]{0,}.radikal.ru/[a-z0-9]{4,}/[a-z0-9]{4,}/[a-z0-9]{2,}/[a-z0-9]{0,}.[0-9a-z]{3,}).html"
regexp="hXXp://204.14.17.70/final/[0-9/]{3,}.(png|jpg|gif)"
regexp="<a href=\"(hXXp://204.14.17.70/final/[0-9/]{3,}.(png|jpg|gif))\""
build=hXXp://204.14.17.70/final/%1
parse="hXXp://204.14.17.70/final/([0-9/]{3,}.(png|jpg|gif))"
regexp="hXXp://images.bitreactor.to/covers/[0-9]{1,}/[0-9/]{3,}.(png|jpg|gif)"
regexp="<img src=\"(hXXp://images.bitreactor.to/covers/[0-9]{1,}/[0-9/]{3,}.(png|jpg|gif))\""
regexp="hXXp://[a-z]{0,}[0-9]{0,}.torrentino.com/covers/[a-z0-9]{1,}/[a-z0-9]{3,}/[a-z0-9]{3,}/inner_thumb.jpg\?[a-z0-9]{0,}"
build=hXXp://images.bitreactor.to/covers/%1/%2
parse="hXXp://images.bitreactor.to/covers/([0-9]{1,})/([0-9/]{3,}.(png|jpg|gif))"
regexp="hXXp://i[0-9]{0,}.kickasstorrents.com/users/[a-z0-9]{0,}.(png|jpg)"
regexp="title=\"(hXXp://i[0-9]{0,}.kickasstorrents.com/users/[a-z0-9]{0,}.(png|jpg))\">"
regexp="hXXp://img[0-9]{0,}.imageshfgdsfack.us/img[0-9]{0,}/[0-9]{4,}/[a-z0-9]{0,}.th.(png|jpg)"
parse="(hXXp://i[0-9]{0,}.kickasstorrents.com/users/[a-z0-9]{0,}).(png|jpg)"
regexp="hXXp://[a-z]{0,}[0-9]{0,}.fastpic.ru/big/[0-9]{4}/[0-9]{4}/[a-z0-9]{2,}/[a-z0-9]{0,}.(png|jpg)"
regexp="<a href=\"(hXXp://fastpic.ru/view/[0-9]{0,}/[0-9]{4}/[0-9]{4}/[a-z0-9]{0,}.(png|jpg).html)\""
regexp="hXXp://[a-z]{0,}[0-9]{0,}.fastpic.ru/thumb/[0-9]{4}/[0-9]{4}/[a-z]{2,}/[a-z0-9]{0,}.(png|jpg)"
build=hXXp://i%1.fastpic.ru/big/%2/%3/%4/%5%6.%7
parse="hXXp://fastpic.ru/view/([0-9]{1,})/([0-9]{4})/([0-9]{4,})/([0-9a-z]{30,30})([0-9a-z]{2,2}).([0-9a-z]{3,}).html"
regexp="hXXp://[0-9]{1,}.firepic.org/[0-9]{1,}/images/[a-z0-9]{4,}-[a-z0-9]{2,}/[a-z0-9]{2,}/[a-z0-9-]{2,}.(png|jpg)"
# hXXp://4.firepic.org/4/images/2013-11/12/zc695sc8u9im.jpg
regexp="src=\"(hXXp://[0-9]{1,}.firepic.org/[0-9]{1,}/thumbs/[a-z0-9]{4,}-[a-z0-9]{2,}/[a-z0-9]{2,}/[a-z0-9-]{2,}.(png|jpg))\""
regexp="hXXp://[0-9]{1,}.firepic.org/[0-9]{1,}/thumbs/[a-z0-9]{4,}-[a-z0-9]{2,}/[a-z0-9]{2,}/[a-z0-9-]{2,}.(png|jpg)"
parse="(hXXp://[0-9]{1,}.firepic.org/[0-9]{1,}/)thumbs(/[a-z0-9]{4,}-[a-z0-9]{2,}/[a-z0-9]{2,}/[a-z0-9-]{2,}.(png|jpg))"
regexp="hXXp://[w.]{0,}youpicture.org/images/[0-9]{4,}/[0-9]{2,}/[0-9]{2,}/[a-z0-9-]{2,}.(jpg|png)"
# hXXp://youpicture.org/images/2013/12/25/jto8cmu8c82ulvsqs4watrewl.png
regexp="img src=\"(hXXp://[w.]{0,}youpicture.org/images/[0-9]{4,}/[0-9]{2,}/[0-9]{2,}/[a-z0-9-]{2,}.th.(jpg|png))\""
regexp="hXXp://[w.]{0,}youpicture.org/images/[0-9]{4,}/[0-9]{2,}/[0-9]{2,}/[a-z0-9-]{2,}.th.(jpg|png)"
build=hXXp://%1.%2
parse="hXXp://[w.]{0,}(youpicture.org/images/[0-9]{4,}/[0-9]{2,}/[0-9]{2,}/[a-z0-9-]{2,}).th.(jpg|png)"
regexp="hXXp://i[0-9]{0,}.kastatic.com/users/[a-z0-9]{0,}.(png|jpg)"
regexp="title=\"(hXXp://i[0-9]{0,}.kastatic.com/users/[a-z0-9]{0,}.(png|jpg))\">"
parse="(hXXp://i[0-9]{0,}.kastatic.com/users/[a-z0-9]{0,}).(png|jpg)"
regexp="hXXp://img[0-9]{0,}.imageshack.us/img[0-9]{0,}/[0-9]{4,}/[a-z0-9]{0,}.(png|jpg)"
regexp="title=\"(hXXp://img[0-9]{0,}.imageshack.us/img[0-9]{0,}/[0-9]{4,}/[a-z0-9]{0,}.th.(png|jpg))\">"
regexp="hXXp://img[0-9]{0,}.imageshack.us/img[0-9]{0,}/[0-9]{4,}/[a-z0-9]{0,}.th.(png|jpg)"
parse="(hXXp://img[0-9]{0,}.imageshack.us/img[0-9]{0,}/[0-9]{4,}/[a-z0-9]{0,}).th.(png|jpg)"
regexp="hXXp://media[0-9]{1,}.fast-torrent.ru/media/files/[a-z0-9]{2,}/[a-z0-9]{2,}/[a-z0-9]{2,}/[a-z0-9-]{2,}.(png|jpg|gif)"
regexp="href=\"(hXXp://media[0-9]{1,}.fast-torrent.ru/media/files/[a-z0-9]{2,}/[a-z0-9]{2,}/[a-z0-9]{2,}/[a-z0-9-]{2,}.(png|jpg|gif))\""
parse="(hXXp://media[0-9]{1,}.fast-torrent.ru/media/files/[a-z0-9]{2,}/[a-z0-9]{2,}/[a-z0-9]{2,}/[a-z0-9-]{2,}.(png|jpg|gif))"
regexp="\"hXXp://lostpic.net/(thumbs_images|orig_images)/([^\"]*).(png|jpg)\""
regexp="<img src=\"(hXXp://lostpic.net/(thumbs_images/[a-z0-90-9]{0,1}/[a-z0-90-9]{0,1}/[a-z0-90-9]{0,1}|thumbs)/([a-z0-90-9]{1})([a-z0-90-9]{1})([a-z0-90-9]{1})(.*).(png|jpg))\""
regexp="hXXp://lostpic.net/thumbs_images/[^.\"]*.(png|jpg)"
build=hXXp://lostpic.net/orig_images/%1/%2/%3/%1%2%3%4.%5
parse="hXXp://lostpic.net/(thumbs_images/[a-z0-90-9]{0,1}/[a-z0-90-9]{0,1}/[a-z0-90-9]{0,1}|thumbs)/([a-z0-90-9]{1})([a-z0-90-9]{1})([a-z0-90-9]{1})(.*).(png|jpg)"
regexp="hXXp://cdn\\d .rudb.org/img/\\d _\\d /[0-9/]{0,}[a-z0-9\\-]{0,}.(png|jpg)"
regexp="<a href=\"(hXXp://cdn\\d .rudb.org/img/\\d _\\d /[0-9/]{0,}[a-z0-9\\-]{0,}.(png|jpg))\""
parse="(hXXp://cdn\\d .rudb.org/img/\\d _\\d /[0-9/]{0,}[a-z0-9\\-]{0,}.(png|jpg))"
regexp="hXXp://[Pp]ictat.com/i/[0-9]{4,}/[0-9]{1,}/[0-9]{1,}/[a-z0-9]{0,}.(png|jpg)"
regexp="(hXXp://[Pp]ictat.com/i/[0-9]{4,}/[0-9]{1,}/[0-9]{1,}/[a-z0-9]{0,}.(png|jpg))\">"
regexp="hXXp://[Pp]ictat.com/t/[0-9]{4,}/[0-9]{1,}/[0-9]{1,}/[a-z0-9]{0,}.(png|jpg)"
build=hXXp://pictat.com/i/%1.%2
parse="hXXp://[Pp]ictat.com/t/([0-9]{4,}/[0-9]{1,}/[0-9]{1,}/[a-z0-9]{0,}).(png|jpg)"
regexp="hXXp://img.mgshare.com/userfiles/files/mediaget/(.*.(png|jpg|gif))"
regexp="<screenshot>(hXXp://img.mgshare.com/userfiles/files/mediaget/(.*.(png|jpg|gif)))<"
build=hXXp://img.mgshare.com/userfiles/files/mediaget/%1
parse="hXXp://img.mgshare.com/userfiles/files/mediaget/(.*.(png|jpg|gif))"
regexp="img src=\"(hXXp://(.*)\\.(png|jpg|gif))\""
build="hXXp://%1.%2"
parse="hXXp://(.*).(png|jpg|gif)"
service\1\icon=":/icons/icons/odnoklassniki.png"
service\1\url="hXXp://VVV.odnoklassniki.ru/dk?st.cmd=addShare&st.s=0&st._surl=%1"
service\2\icon=":/icons/icons/facebook.png"
service\2\url="hXXp://VVV.facebook.com/share.php?u=%1"
service\3\name=mail.ru
service\3\icon=":/icons/icons/mailru.png"
service\3\url="hXXp://connect.mail.ru/share?share_url=%1"
service\4\icon=":/icons/icons/vkontakte.png"
service\4\url="hXXp://vkontakte.ru/share.php?url=%1"
service\5\icon=":/icons/icons/livejournal.png"
service\5\url="hXXp://VVV.livejournal.com/update.bml?subject=%2&event=<p>
service\6\icon=":/icons/icons/twitter.png"
service\6\url="hXXp://twitter.com/?status=
service\7\icon=":/icons/icons/twitter.png"
service\7\url="hXXp://twitter.com/?status=
service\8\icon=":/icons/icons/facebook.png"
service\8\url="hXXp://VVV.facebook.com/share.php?u=%1"
service\9\icon=":/icons/icons/myspace.png"
service\9\url="hXXp://VVV.myspace.com/Modules/PostTo/Pages/?u=%1"
service\10\icon=":/icons/icons/friendfeed.png"
service\10\url="hXXp://VVV.friendfeed.com/?url=%1&title=%2"
service\11\icon=":/icons/icons/digg.png"
service\11\url="hXXp://digg.com/submit?url=%1&title=%2"
service\12\icon=":/icons/icons/buzz.png"
service\12\url="hXXp://VVV.google.com/buzz/post?url=%1&message=Hi! Look at the share
on MGShare! Here is the link: %1&imageurl=%1"
service\13\icon=":/icons/icons/delicious.png"
service\13\url="hXXp://del.icio.us/post?url=%1&title=Hi! Look at the share
[9xþ<F
-.wlN6Y_
){%Uc
ú%C
,Q%D(L
`mu.Ct
l/.vk
=p9%DSx
a6.PQV
}o_H.or
|zL&ÿ2!
]d.zt
t.MM_
vLO-0}}
JY.cJ
.Hq.!
d8:announce41:hXXp://update.mgtracker.org:6881/announce10:created by53:MediaGet2 2.01.3239/libtorrent0.16.18.0.$Rev: 10283 $13:creation datei1430138321e4:infod6:lengthi12388916e4:name27:player_plugins_mac_2.2.1.7z12:piece lengthi262144e6:pieces960:;H
Ld8:announce41:hXXp://update.mgtracker.org:6881/announce10:created by53:MediaGet2 2.01.3261/libtorrent0.16.18.0.$Rev: 10283 $13:creation datei1432302858e4:infod6:lengthi17729277e4:name28:player_plugins_2.2.2-5.22.7z12:piece lengthi262144e6:pieces1360:7
.wZ8g`
R.If>
v.fhH
T5z%c
s-----BEGIN CERTIFICATE-----
ZJHgvQzzACjseEi3B1ijV28EiRfVmLxq6E8fHEnXr/LDO9CSoSdop2MSgTd1BImu
cmwwgYUGCCsGAQUFBwEBBHkwdzBPBggrBgEFBQcwAoZDaHR0cDovL2NydC5jb21v
-----END CERTIFICATE-----
g-----BEGIN CERTIFICATE-----
c13cRTCAquOyQQuvvUSH2rnlG51/ruWFgqUCAwEAAaOCAWUwggFhMB8GA1UdIwQY
-----BEGIN RSA PRIVATE KEY-----
-----END RSA PRIVATE KEY-----
-----BEGIN CERTIFICATE-----
VR0PBAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wgZkGA1UdIwSBkTCBjoAUrb2YejS0
AgGGMA8GA1UdEwEB/wQFMAMBAf8wEQYDVR0gBAowCDAGBgRVHSAAMEQGA1UdHwQ9
Jw5dhHk3QBN39bSsHNA7qxcS1u80GH4r6XnTq1dFDK8o tDb5VCViLvfhVdpfZLY
GeoIP.datl
E..rI
1,fõF#
qI.OrE
a).Kqy
E).Nq
/i.JsAK
R/.IW
.eqg)Z">
mR.jc
Jj(%C
,!.Mg
m.lwa
y4.vc
(.DpQo<
PB,%c(%\:
D.Kwnf1(
$9-W}
ULmSG
.HEke
.zl\$t
%%9Xf~
_.xE;
B5.Rc
xGJ.bb
%xTDM
e*.Wq
l%SFMf 7
/%xe&
?NW.rq
.LJN=
e).Oqf
.It{i
y2y.Wb6O.
.EvRb
"W'%x
i.Jsn
ckeY<lU
%n.qK
.BiWe
.qA`z
8#.gv
A%c["
ei\.YM
z.nuq
.jcT-
Yq.rp
-.nu1
XR`6D.Tg
u^'.Va
.RNrM
-%uHN
,".&.!.%
nII.tx
$.NR<
P]h.bn
\|%sz<
.iVpA
.wP(F
.mURfx
GeoIP.datPK
#C.JDB
t\I.RRR
2.dll
K\regLt.exel
tcpip.
'serRK.ch
r.msc#
KWindows
iz0V.tu
O<nKey
KERNEL32.DLL
advapi32.dll
oleaut32.dll
user32.dll
version.dll
RegCloseKey
hXXp://VVV.usertrust.com1
1hXXp://crl.usertrust.com/UTN-USERFirst-Object.crl05
hXXp://ocsp.usertrust.com0
1903441
hXXps://secure.comodo.net/CPS0B
1hXXp://crl.usertrust.com/UTN-USERFirst-Object.crl04
hXXp://ocsp.comodoca.com0
[email protected]
Adobe Photoshop CS6 (Windows)
2014:09:04 16:27:57
IEC hXXp://VVV.iec.ch
.IEC 61966-2.1 Default RGB colour space - sRGB
CRT curv
urlTEXT
MsgeTEXT
hXXp://ns.adobe.com/xap/1.0/
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="hXXp://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:photoshop="hXXp://ns.adobe.com/photoshop/1.0/" xmlns:dc="hXXp://purl.org/dc/elements/1.1/" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmp:CreateDate="2014-09-04T16:27:57 04:00" xmp:MetadataDate="2014-09-04T16:27:57 04:00" xmp:ModifyDate="2014-09-04T16:27:57 04:00" xmpMM:InstanceID="xmp.iid:35FE291A2934E41182CDF09E8CE954DF" xmpMM:DocumentID="xmp.did:34FE291A2934E41182CDF09E8CE954DF" xmpMM:OriginalDocumentID="xmp.did:34FE291A2934E41182CDF09E8CE954DF" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" dc:format="image/jpeg"> <xmpMM:History> <rdf:Seq> <rdf:li stEvt:action="created" stEvt:instanceID="xmp.iid:34FE291A2934E41182CDF09E8CE954DF" stEvt:when="2014-09-04T16:27:57 04:00" stEvt:softwareAgent="Adobe Photoshop CS6 (Windows)"/> <rdf:li stEvt:action="saved" stEvt:instanceID="xmp.iid:35FE291A2934E41182CDF09E8CE954DF" stEvt:when="2014-09-04T16:27:57 04:00" stEvt:softwareAgent="Adobe Photoshop CS6 (Windows)" stEvt:changed="/"/> </rdf:Seq> </xmpMM:History> <photoshop:DocumentAncestors> <rdf:Bag> <rdf:li>xmp.did:05D366D35002E411879FF2E1A56E3A3F</rdf:li> <rdf:li>xmp.did:0E0F60DB2B20E111906CEAE1B7458967</rdf:li> <rdf:li>xmp.did:18D6B6167AB4E31185E3B55F244148AB</rdf:li> <rdf:li>xmp.did:213E897D6CA6E011AA5199E564B0CA54</rdf:li> <rdf:li>xmp.did:773EEBE1D448E111B91998E53219AB27</rdf:li> <rdf:li>xmp.did:B64B1E0C4506E1118D25B00A21295EFC</rdf:li> </rdf:Bag> </photoshop:DocumentAncestors> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="w"?>
2014:09:04 16:15:38
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:photoshop="hXXp://ns.adobe.com/photoshop/1.0/" xmlns:dc="hXXp://purl.org/dc/elements/1.1/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="hXXp://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmp:CreateDate="2014-03-26T02:03:41 02:00" xmp:MetadataDate="2014-09-04T16:15:38 04:00" xmp:ModifyDate="2014-09-04T16:15:38 04:00" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" dc:format="image/jpeg" xmpMM:InstanceID="xmp.iid:31FE291A2934E41182CDF09E8CE954DF" xmpMM:DocumentID="xmp.did:18D6B6167AB4E31185E3B55F244148AB" xmpMM:OriginalDocumentID="xmp.did:18D6B6167AB4E31185E3B55F244148AB"> <photoshop:DocumentAncestors> <rdf:Bag> <rdf:li>xmp.did:05D366D35002E411879FF2E1A56E3A3F</rdf:li> <rdf:li>xmp.did:0E0F60DB2B20E111906CEAE1B7458967</rdf:li> <rdf:li>xmp.did:18D6B6167AB4E31185E3B55F244148AB</rdf:li> <rdf:li>xmp.did:213E897D6CA6E011AA5199E564B0CA54</rdf:li> <rdf:li>xmp.did:773EEBE1D448E111B91998E53219AB27</rdf:li> <rdf:li>xmp.did:B64B1E0C4506E1118D25B00A21295EFC</rdf:li> </rdf:Bag> </photoshop:DocumentAncestors> <xmpMM:History> <rdf:Seq> <rdf:li stEvt:action="created" stEvt:instanceID="xmp.iid:18D6B6167AB4E31185E3B55F244148AB" stEvt:when="2014-03-26T02:03:41 02:00" stEvt:softwareAgent="Adobe Photoshop CS5 Windows"/> <rdf:li stEvt:action="saved" stEvt:instanceID="xmp.iid:19D6B6167AB4E31185E3B55F244148AB" stEvt:when="2014-03-26T03:00:55 02:00" stEvt:softwareAgent="Adobe Photoshop CS5 Windows" stEvt:changed="/"/> <rdf:li stEvt:action="saved" stEvt:instanceID="xmp.iid:30FE291A2934E41182CDF09E8CE954DF" stEvt:when="2014-09-04T16:15:38 04:00" stEvt:softwareAgent="Adobe Photoshop CS6 (Windows)" stEvt:changed="/"/> <rdf:li stEvt:action="converted" stEvt:parameters="from application/vnd.adobe.photoshop to image/jpeg"/> <rdf:li stEvt:action="derived" stEvt:parameters="converted from application/vnd.adobe.photoshop to image/jpeg"/> <rdf:li stEvt:action="saved" stEvt:instanceID="xmp.iid:31FE291A2934E41182CDF09E8CE954DF" stEvt:when="2014-09-04T16:15:38 04:00" stEvt:softwareAgent="Adobe Photoshop CS6 (Windows)" stEvt:changed="/"/> </rdf:Seq> </xmpMM:History> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:30FE291A2934E41182CDF09E8CE954DF" stRef:documentID="xmp.did:18D6B6167AB4E31185E3B55F244148AB" stRef:originalDocumentID="xmp.did:18D6B6167AB4E31185E3B55F244148AB"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="w"?>
s.Mo&
.kpms
.rIm\
AI,9Y.Zm0
7.xKT6
2014:08:07 12:30:45
khXXp://ns.adobe.com/xap/1.0/
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:photoshop="hXXp://ns.adobe.com/photoshop/1.0/" xmlns:dc="hXXp://purl.org/dc/elements/1.1/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="hXXp://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmp:CreateDate="2014-03-26T02:03:41 02:00" xmp:MetadataDate="2014-08-07T12:30:45 04:00" xmp:ModifyDate="2014-08-07T12:30:45 04:00" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" dc:format="image/jpeg" xmpMM:InstanceID="xmp.iid:418386200D1EE411A9E1ECDF8B9EA074" xmpMM:DocumentID="xmp.did:18D6B6167AB4E31185E3B55F244148AB" xmpMM:OriginalDocumentID="xmp.did:18D6B6167AB4E31185E3B55F244148AB"> <photoshop:DocumentAncestors> <rdf:Bag> <rdf:li>adobe:docid:photoshop:a51376a8-05cf-11d7-b1ff-c203c71f408e</rdf:li> <rdf:li>uuid:BC642436AFC0DE11AC8CB4E8C4FF3FFF</rdf:li> <rdf:li>xmp.did:05D366D35002E411879FF2E1A56E3A3F</rdf:li> <rdf:li>xmp.did:0E0F60DB2B20E111906CEAE1B7458967</rdf:li> <rdf:li>xmp.did:117CF6F21B6DE1119FD5FCF251BD0EA0</rdf:li> <rdf:li>xmp.did:137A9CF8EB0DE11189D1AC9CF2333785</rdf:li> <rdf:li>xmp.did:17BF0783AB39E211A13EDC21D76C81CF</rdf:li> <rdf:li>xmp.did:18D6B6167AB4E31185E3B55F244148AB</rdf:li> <rdf:li>xmp.did:213E897D6CA6E011AA5199E564B0CA54</rdf:li> <rdf:li>xmp.did:3BD9DD9C4D0CE1118651ECA58C03BDE2</rdf:li> <rdf:li>xmp.did:5055FD3F68E9E211AC5ECB458047C44B</rdf:li> <rdf:li>xmp.did:6458273B01A1E211A081936F7E076A8B</rdf:li> <rdf:li>xmp.did:773EEBE1D448E111B91998E53219AB27</rdf:li> <rdf:li>xmp.did:909AAECCCAFFE211B64DE957B3F3EF7A</rdf:li> <rdf:li>xmp.did:94E95D0F6A06E311A601E8D32754A28F</rdf:li> <rdf:li>xmp.did:B03C1DA3A614E3119A5DA3FCFCA2BEE4</rdf:li> <rdf:li>xmp.did:B64B1E0C4506E1118D25B00A21295EFC</rdf:li> <rdf:li>xmp.did:D55245E1E40FE3119C83FE2A5C249C4E</rdf:li> <rdf:li>xmp.did:DF772AC216E6E1119035BC16956F0DD3</rdf:li> <rdf:li>xmp.did:E06FB095E853E111BD3FC8CC5CCE1659</rdf:li> <rdf:li>xmp.did:E297ED9EC341E111928ACDDFA748F0FE</rdf:li> </rdf:Bag> </photoshop:DocumentAncestors> <xmpMM:History> <rdf:Seq> <rdf:li stEvt:action="created" stEvt:instanceID="xmp.iid:18D6B6167AB4E31185E3B55F244148AB" stEvt:when="2014-03-26T02:03:41 02:00" stEvt:softwareAgent="Adobe Photoshop CS5 Windows"/> <rdf:li stEvt:action="saved" stEvt:instanceID="xmp.iid:19D6B6167AB4E31185E3B55F244148AB" stEvt:when="2014-03-26T03:00:55 02:00" stEvt:softwareAgent="Adobe Photoshop CS5 Windows" stEvt:changed="/"/> <rdf:li stEvt:action="saved" stEvt:instanceID="xmp.iid:408386200D1EE411A9E1ECDF8B9EA074" stEvt:when="2014-08-07T12:30:45 04:00" stEvt:softwareAgent="Adobe Photoshop CS6 (Windows)" stEvt:changed="/"/> <rdf:li stEvt:action="converted" stEvt:parameters="from application/vnd.adobe.photoshop to image/jpeg"/> <rdf:li stEvt:action="derived" stEvt:parameters="converted from application/vnd.adobe.photoshop to image/jpeg"/> <rdf:li stEvt:action="saved" stEvt:instanceID="xmp.iid:418386200D1EE411A9E1ECDF8B9EA074" stEvt:when="2014-08-07T12:30:45 04:00" stEvt:softwareAgent="Adobe Photoshop CS6 (Windows)" stEvt:changed="/"/> </rdf:Seq> </xmpMM:History> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:408386200D1EE411A9E1ECDF8B9EA074" stRef:documentID="xmp.did:18D6B6167AB4E31185E3B55F244148AB" stRef:originalDocumentID="xmp.did:18D6B6167AB4E31185E3B55F244148AB"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="w"?>
C.GRS'
%Di N
.b:%f
&/%d-
8Z%C]:a
%9u%I9
%c#H#
<W=~I%d
2014:09:04 19:50:28
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:photoshop="hXXp://ns.adobe.com/photoshop/1.0/" xmlns:dc="hXXp://purl.org/dc/elements/1.1/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="hXXp://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmp:CreateDate="2014-03-26T02:03:41 02:00" xmp:MetadataDate="2014-09-04T19:50:28 04:00" xmp:ModifyDate="2014-09-04T19:50:28 04:00" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" dc:format="image/jpeg" xmpMM:InstanceID="xmp.iid:EAE85F314B34E41181E8CD644E49502A" xmpMM:DocumentID="xmp.did:18D6B6167AB4E31185E3B55F244148AB" xmpMM:OriginalDocumentID="xmp.did:18D6B6167AB4E31185E3B55F244148AB"> <photoshop:DocumentAncestors> <rdf:Bag> <rdf:li>xmp.did:05D366D35002E411879FF2E1A56E3A3F</rdf:li> <rdf:li>xmp.did:0E0F60DB2B20E111906CEAE1B7458967</rdf:li> <rdf:li>xmp.did:18D6B6167AB4E31185E3B55F244148AB</rdf:li> <rdf:li>xmp.did:213E897D6CA6E011AA5199E564B0CA54</rdf:li> <rdf:li>xmp.did:773EEBE1D448E111B91998E53219AB27</rdf:li> <rdf:li>xmp.did:B64B1E0C4506E1118D25B00A21295EFC</rdf:li> </rdf:Bag> </photoshop:DocumentAncestors> <xmpMM:History> <rdf:Seq> <rdf:li stEvt:action="created" stEvt:instanceID="xmp.iid:18D6B6167AB4E31185E3B55F244148AB" stEvt:when="2014-03-26T02:03:41 02:00" stEvt:softwareAgent="Adobe Photoshop CS5 Windows"/> <rdf:li stEvt:action="saved" stEvt:instanceID="xmp.iid:19D6B6167AB4E31185E3B55F244148AB" stEvt:when="2014-03-26T03:00:55 02:00" stEvt:softwareAgent="Adobe Photoshop CS5 Windows" stEvt:changed="/"/> <rdf:li stEvt:action="saved" stEvt:instanceID="xmp.iid:E9E85F314B34E41181E8CD644E49502A" stEvt:when="2014-09-04T19:50:28 04:00" stEvt:softwareAgent="Adobe Photoshop CS6 (Windows)" stEvt:changed="/"/> <rdf:li stEvt:action="converted" stEvt:parameters="from application/vnd.adobe.photoshop to image/jpeg"/> <rdf:li stEvt:action="derived" stEvt:parameters="converted from application/vnd.adobe.photoshop to image/jpeg"/> <rdf:li stEvt:action="saved" stEvt:instanceID="xmp.iid:EAE85F314B34E41181E8CD644E49502A" stEvt:when="2014-09-04T19:50:28 04:00" stEvt:softwareAgent="Adobe Photoshop CS6 (Windows)" stEvt:changed="/"/> </rdf:Seq> </xmpMM:History> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:E9E85F314B34E41181E8CD644E49502A" stRef:documentID="xmp.did:18D6B6167AB4E31185E3B55F244148AB" stRef:originalDocumentID="xmp.did:18D6B6167AB4E31185E3B55F244148AB"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="w"?>
13!6^{2$ 
.'%xU^
.UTy6/
2014:08:07 12:33:11
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="hXXp://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:photoshop="hXXp://ns.adobe.com/photoshop/1.0/" xmlns:dc="hXXp://purl.org/dc/elements/1.1/" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmp:CreateDate="2014-08-07T12:33:11 04:00" xmp:MetadataDate="2014-08-07T12:33:11 04:00" xmp:ModifyDate="2014-08-07T12:33:11 04:00" xmpMM:InstanceID="xmp.iid:3550E2570D1EE411BEC5A71F85CF238A" xmpMM:DocumentID="xmp.did:3450E2570D1EE411BEC5A71F85CF238A" xmpMM:OriginalDocumentID="xmp.did:3450E2570D1EE411BEC5A71F85CF238A" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" dc:format="image/jpeg"> <xmpMM:History> <rdf:Seq> <rdf:li stEvt:action="created" stEvt:instanceID="xmp.iid:3450E2570D1EE411BEC5A71F85CF238A" stEvt:when="2014-08-07T12:33:11 04:00" stEvt:softwareAgent="Adobe Photoshop CS6 (Windows)"/> <rdf:li stEvt:action="saved" stEvt:instanceID="xmp.iid:3550E2570D1EE411BEC5A71F85CF238A" stEvt:when="2014-08-07T12:33:11 04:00" stEvt:softwareAgent="Adobe Photoshop CS6 (Windows)" stEvt:changed="/"/> </rdf:Seq> </xmpMM:History> <photoshop:DocumentAncestors> <rdf:Bag> <rdf:li>adobe:docid:photoshop:a51376a8-05cf-11d7-b1ff-c203c71f408e</rdf:li> <rdf:li>uuid:BC642436AFC0DE11AC8CB4E8C4FF3FFF</rdf:li> <rdf:li>xmp.did:05D366D35002E411879FF2E1A56E3A3F</rdf:li> <rdf:li>xmp.did:0E0F60DB2B20E111906CEAE1B7458967</rdf:li> <rdf:li>xmp.did:117CF6F21B6DE1119FD5FCF251BD0EA0</rdf:li> <rdf:li>xmp.did:137A9CF8EB0DE11189D1AC9CF2333785</rdf:li> <rdf:li>xmp.did:17BF0783AB39E211A13EDC21D76C81CF</rdf:li> <rdf:li>xmp.did:18D6B6167AB4E31185E3B55F244148AB</rdf:li> <rdf:li>xmp.did:213E897D6CA6E011AA5199E564B0CA54</rdf:li> <rdf:li>xmp.did:3BD9DD9C4D0CE1118651ECA58C03BDE2</rdf:li> <rdf:li>xmp.did:5055FD3F68E9E211AC5ECB458047C44B</rdf:li> <rdf:li>xmp.did:6458273B01A1E211A081936F7E076A8B</rdf:li> <rdf:li>xmp.did:773EEBE1D448E111B91998E53219AB27</rdf:li> <rdf:li>xmp.did:909AAECCCAFFE211B64DE957B3F3EF7A</rdf:li> <rdf:li>xmp.did:94E95D0F6A06E311A601E8D32754A28F</rdf:li> <rdf:li>xmp.did:B03C1DA3A614E3119A5DA3FCFCA2BEE4</rdf:li> <rdf:li>xmp.did:B64B1E0C4506E1118D25B00A21295EFC</rdf:li> <rdf:li>xmp.did:D55245E1E40FE3119C83FE2A5C249C4E</rdf:li> <rdf:li>xmp.did:DF772AC216E6E1119035BC16956F0DD3</rdf:li> <rdf:li>xmp.did:E06FB095E853E111BD3FC8CC5CCE1659</rdf:li> <rdf:li>xmp.did:E297ED9EC341E111928ACDDFA748F0FE</rdf:li> </rdf:Bag> </photoshop:DocumentAncestors> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="w"?>
Qs*.eE
2014:08:07 12:32:18
dW;.cll
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="hXXp://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:photoshop="hXXp://ns.adobe.com/photoshop/1.0/" xmlns:dc="hXXp://purl.org/dc/elements/1.1/" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmp:CreateDate="2014-08-07T12:32:18 04:00" xmp:MetadataDate="2014-08-07T12:32:18 04:00" xmp:ModifyDate="2014-08-07T12:32:18 04:00" xmpMM:InstanceID="xmp.iid:3350E2570D1EE411BEC5A71F85CF238A" xmpMM:DocumentID="xmp.did:3250E2570D1EE411BEC5A71F85CF238A" xmpMM:OriginalDocumentID="xmp.did:3250E2570D1EE411BEC5A71F85CF238A" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" dc:format="image/jpeg"> <xmpMM:History> <rdf:Seq> <rdf:li stEvt:action="created" stEvt:instanceID="xmp.iid:3250E2570D1EE411BEC5A71F85CF238A" stEvt:when="2014-08-07T12:32:18 04:00" stEvt:softwareAgent="Adobe Photoshop CS6 (Windows)"/> <rdf:li stEvt:action="saved" stEvt:instanceID="xmp.iid:3350E2570D1EE411BEC5A71F85CF238A" stEvt:when="2014-08-07T12:32:18 04:00" stEvt:softwareAgent="Adobe Photoshop CS6 (Windows)" stEvt:changed="/"/> </rdf:Seq> </xmpMM:History> <photoshop:DocumentAncestors> <rdf:Bag> <rdf:li>adobe:docid:photoshop:a51376a8-05cf-11d7-b1ff-c203c71f408e</rdf:li> <rdf:li>uuid:BC642436AFC0DE11AC8CB4E8C4FF3FFF</rdf:li> <rdf:li>xmp.did:05D366D35002E411879FF2E1A56E3A3F</rdf:li> <rdf:li>xmp.did:0E0F60DB2B20E111906CEAE1B7458967</rdf:li> <rdf:li>xmp.did:117CF6F21B6DE1119FD5FCF251BD0EA0</rdf:li> <rdf:li>xmp.did:137A9CF8EB0DE11189D1AC9CF2333785</rdf:li> <rdf:li>xmp.did:17BF0783AB39E211A13EDC21D76C81CF</rdf:li> <rdf:li>xmp.did:18D6B6167AB4E31185E3B55F244148AB</rdf:li> <rdf:li>xmp.did:213E897D6CA6E011AA5199E564B0CA54</rdf:li> <rdf:li>xmp.did:3BD9DD9C4D0CE1118651ECA58C03BDE2</rdf:li> <rdf:li>xmp.did:5055FD3F68E9E211AC5ECB458047C44B</rdf:li> <rdf:li>xmp.did:6458273B01A1E211A081936F7E076A8B</rdf:li> <rdf:li>xmp.did:773EEBE1D448E111B91998E53219AB27</rdf:li> <rdf:li>xmp.did:909AAECCCAFFE211B64DE957B3F3EF7A</rdf:li> <rdf:li>xmp.did:94E95D0F6A06E311A601E8D32754A28F</rdf:li> <rdf:li>xmp.did:B03C1DA3A614E3119A5DA3FCFCA2BEE4</rdf:li> <rdf:li>xmp.did:B64B1E0C4506E1118D25B00A21295EFC</rdf:li> <rdf:li>xmp.did:D55245E1E40FE3119C83FE2A5C249C4E</rdf:li> <rdf:li>xmp.did:DF772AC216E6E1119035BC16956F0DD3</rdf:li> <rdf:li>xmp.did:E06FB095E853E111BD3FC8CC5CCE1659</rdf:li> <rdf:li>xmp.did:E297ED9EC341E111928ACDDFA748F0FE</rdf:li> </rdf:Bag> </photoshop:DocumentAncestors> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="w"?>
2014:09:04 16:28:47
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="hXXp://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:photoshop="hXXp://ns.adobe.com/photoshop/1.0/" xmlns:dc="hXXp://purl.org/dc/elements/1.1/" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmp:CreateDate="2014-09-04T16:28:47 04:00" xmp:MetadataDate="2014-09-04T16:28:47 04:00" xmp:ModifyDate="2014-09-04T16:28:47 04:00" xmpMM:InstanceID="xmp.iid:37FE291A2934E41182CDF09E8CE954DF" xmpMM:DocumentID="xmp.did:36FE291A2934E41182CDF09E8CE954DF" xmpMM:OriginalDocumentID="xmp.did:36FE291A2934E41182CDF09E8CE954DF" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" dc:format="image/jpeg"> <xmpMM:History> <rdf:Seq> <rdf:li stEvt:action="created" stEvt:instanceID="xmp.iid:36FE291A2934E41182CDF09E8CE954DF" stEvt:when="2014-09-04T16:28:47 04:00" stEvt:softwareAgent="Adobe Photoshop CS6 (Windows)"/> <rdf:li stEvt:action="saved" stEvt:instanceID="xmp.iid:37FE291A2934E41182CDF09E8CE954DF" stEvt:when="2014-09-04T16:28:47 04:00" stEvt:softwareAgent="Adobe Photoshop CS6 (Windows)" stEvt:changed="/"/> </rdf:Seq> </xmpMM:History> <photoshop:DocumentAncestors> <rdf:Bag> <rdf:li>xmp.did:05D366D35002E411879FF2E1A56E3A3F</rdf:li> <rdf:li>xmp.did:0E0F60DB2B20E111906CEAE1B7458967</rdf:li> <rdf:li>xmp.did:18D6B6167AB4E31185E3B55F244148AB</rdf:li> <rdf:li>xmp.did:213E897D6CA6E011AA5199E564B0CA54</rdf:li> <rdf:li>xmp.did:773EEBE1D448E111B91998E53219AB27</rdf:li> <rdf:li>xmp.did:B64B1E0C4506E1118D25B00A21295EFC</rdf:li> </rdf:Bag> </photoshop:DocumentAncestors> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="w"?>
iTXtXML:com.adobe.xmp
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:816A243F562D11E19426B6DD7C5B8E39" xmpMM:DocumentID="xmp.did:816A2440562D11E19426B6DD7C5B8E39"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:816A243D562D11E19426B6DD7C5B8E39" stRef:documentID="xmp.did:816A243E562D11E19426B6DD7C5B8E39"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
EcRT
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:65B33A439E8111E1B02AC53ABB89ACE3" xmpMM:DocumentID="xmp.did:65B33A449E8111E1B02AC53ABB89ACE3"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:65B33A419E8111E1B02AC53ABB89ACE3" stRef:documentID="xmp.did:65B33A429E8111E1B02AC53ABB89ACE3"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
s3:J*5%U
5.sF%1YGG
2015:10:28 18:36:57
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:photoshop="hXXp://ns.adobe.com/photoshop/1.0/" xmlns:dc="hXXp://purl.org/dc/elements/1.1/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="hXXp://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmp:CreateDate="2014-03-26T02:03:41 02:00" xmp:MetadataDate="2015-10-28T18:36:57 04:00" xmp:ModifyDate="2015-10-28T18:36:57 04:00" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" dc:format="image/jpeg" xmpMM:InstanceID="xmp.iid:713EE60A807DE5119A9EF0CFAC02FC7E" xmpMM:DocumentID="xmp.did:18D6B6167AB4E31185E3B55F244148AB" xmpMM:OriginalDocumentID="xmp.did:18D6B6167AB4E31185E3B55F244148AB"> <photoshop:DocumentAncestors> <rdf:Bag> <rdf:li>6A5C087C9A3DF13372D1926B83D58B09</rdf:li> <rdf:li>6DE899A34890DD92B032ACC0A077F84E</rdf:li> <rdf:li>xmp.did:0E0F60DB2B20E111906CEAE1B7458967</rdf:li> <rdf:li>xmp.did:110A92049153E411B28A84FA1CEE7EC3</rdf:li> <rdf:li>xmp.did:18D6B6167AB4E31185E3B55F244148AB</rdf:li> <rdf:li>xmp.did:213E897D6CA6E011AA5199E564B0CA54</rdf:li> <rdf:li>xmp.did:773EEBE1D448E111B91998E53219AB27</rdf:li> <rdf:li>xmp.did:A5042596D9ADE311BDCFCEC3704F90EE</rdf:li> <rdf:li>xmp.did:B64B1E0C4506E1118D25B00A21295EFC</rdf:li> </rdf:Bag> </photoshop:DocumentAncestors> <xmpMM:History> <rdf:Seq> <rdf:li stEvt:action="created" stEvt:instanceID="xmp.iid:18D6B6167AB4E31185E3B55F244148AB" stEvt:when="2014-03-26T02:03:41 02:00" stEvt:softwareAgent="Adobe Photoshop CS5 Windows"/> <rdf:li stEvt:action="saved" stEvt:instanceID="xmp.iid:19D6B6167AB4E31185E3B55F244148AB" stEvt:when="2014-03-26T03:00:55 02:00" stEvt:softwareAgent="Adobe Photoshop CS5 Windows" stEvt:changed="/"/> <rdf:li stEvt:action="saved" stEvt:instanceID="xmp.iid:703EE60A807DE5119A9EF0CFAC02FC7E" stEvt:when="2015-10-28T18:36:57 04:00" stEvt:softwareAgent="Adobe Photoshop CS6 (Windows)" stEvt:changed="/"/> <rdf:li stEvt:action="converted" stEvt:parameters="from application/vnd.adobe.photoshop to image/jpeg"/> <rdf:li stEvt:action="derived" stEvt:parameters="converted from application/vnd.adobe.photoshop to image/jpeg"/> <rdf:li stEvt:action="saved" stEvt:instanceID="xmp.iid:713EE60A807DE5119A9EF0CFAC02FC7E" stEvt:when="2015-10-28T18:36:57 04:00" stEvt:softwareAgent="Adobe Photoshop CS6 (Windows)" stEvt:changed="/"/> </rdf:Seq> </xmpMM:History> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:703EE60A807DE5119A9EF0CFAC02FC7E" stRef:documentID="xmp.did:18D6B6167AB4E31185E3B55F244148AB" stRef:originalDocumentID="xmp.did:18D6B6167AB4E31185E3B55F244148AB"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="w"?>
gv.wP
`_.Yp
"3Ÿg
2015:04:02 17:19:23
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:photoshop="hXXp://ns.adobe.com/photoshop/1.0/" xmlns:dc="hXXp://purl.org/dc/elements/1.1/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="hXXp://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmp:CreateDate="2014-03-26T02:03:41 02:00" xmp:MetadataDate="2015-04-02T17:19:23 04:00" xmp:ModifyDate="2015-04-02T17:19:23 04:00" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" dc:format="image/jpeg" xmpMM:InstanceID="xmp.iid:1E9289CB39D9E411B9C1BAD1812E1A56" xmpMM:DocumentID="xmp.did:18D6B6167AB4E31185E3B55F244148AB" xmpMM:OriginalDocumentID="xmp.did:18D6B6167AB4E31185E3B55F244148AB"> <photoshop:DocumentAncestors> <rdf:Bag> <rdf:li>6A5C087C9A3DF13372D1926B83D58B09</rdf:li> <rdf:li>6DE899A34890DD92B032ACC0A077F84E</rdf:li> <rdf:li>xmp.did:0E0F60DB2B20E111906CEAE1B7458967</rdf:li> <rdf:li>xmp.did:110A92049153E411B28A84FA1CEE7EC3</rdf:li> <rdf:li>xmp.did:18D6B6167AB4E31185E3B55F244148AB</rdf:li> <rdf:li>xmp.did:213E897D6CA6E011AA5199E564B0CA54</rdf:li> <rdf:li>xmp.did:773EEBE1D448E111B91998E53219AB27</rdf:li> <rdf:li>xmp.did:A5042596D9ADE311BDCFCEC3704F90EE</rdf:li> <rdf:li>xmp.did:B64B1E0C4506E1118D25B00A21295EFC</rdf:li> </rdf:Bag> </photoshop:DocumentAncestors> <xmpMM:History> <rdf:Seq> <rdf:li stEvt:action="created" stEvt:instanceID="xmp.iid:18D6B6167AB4E31185E3B55F244148AB" stEvt:when="2014-03-26T02:03:41 02:00" stEvt:softwareAgent="Adobe Photoshop CS5 Windows"/> <rdf:li stEvt:action="saved" stEvt:instanceID="xmp.iid:19D6B6167AB4E31185E3B55F244148AB" stEvt:when="2014-03-26T03:00:55 02:00" stEvt:softwareAgent="Adobe Photoshop CS5 Windows" stEvt:changed="/"/> <rdf:li stEvt:action="saved" stEvt:instanceID="xmp.iid:1D9289CB39D9E411B9C1BAD1812E1A56" stEvt:when="2015-04-02T17:19:23 04:00" stEvt:softwareAgent="Adobe Photoshop CS6 (Windows)" stEvt:changed="/"/> <rdf:li stEvt:action="converted" stEvt:parameters="from application/vnd.adobe.photoshop to image/jpeg"/> <rdf:li stEvt:action="derived" stEvt:parameters="converted from application/vnd.adobe.photoshop to image/jpeg"/> <rdf:li stEvt:action="saved" stEvt:instanceID="xmp.iid:1E9289CB39D9E411B9C1BAD1812E1A56" stEvt:when="2015-04-02T17:19:23 04:00" stEvt:softwareAgent="Adobe Photoshop CS6 (Windows)" stEvt:changed="/"/> </rdf:Seq> </xmpMM:History> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:1D9289CB39D9E411B9C1BAD1812E1A56" stRef:documentID="xmp.did:18D6B6167AB4E31185E3B55F244148AB" stRef:originalDocumentID="xmp.did:18D6B6167AB4E31185E3B55F244148AB"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="w"?>
..IZ(
I_.FFFFA
f;.FogB
p.woI!'
?.jpQ
2015:10:29 16:45:00
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:photoshop="hXXp://ns.adobe.com/photoshop/1.0/" xmlns:dc="hXXp://purl.org/dc/elements/1.1/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="hXXp://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmp:CreateDate="2014-03-26T02:03:41 02:00" xmp:MetadataDate="2015-10-29T16:45 04:00" xmp:ModifyDate="2015-10-29T16:45 04:00" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" dc:format="image/jpeg" xmpMM:InstanceID="xmp.iid:0732ADFF1D7EE51189FAD0B2D3A7100E" xmpMM:DocumentID="xmp.did:18D6B6167AB4E31185E3B55F244148AB" xmpMM:OriginalDocumentID="xmp.did:18D6B6167AB4E31185E3B55F244148AB"> <photoshop:DocumentAncestors> <rdf:Bag> <rdf:li>6A5C087C9A3DF13372D1926B83D58B09</rdf:li> <rdf:li>6DE899A34890DD92B032ACC0A077F84E</rdf:li> <rdf:li>xmp.did:0E0F60DB2B20E111906CEAE1B7458967</rdf:li> <rdf:li>xmp.did:110A92049153E411B28A84FA1CEE7EC3</rdf:li> <rdf:li>xmp.did:18D6B6167AB4E31185E3B55F244148AB</rdf:li> <rdf:li>xmp.did:213E897D6CA6E011AA5199E564B0CA54</rdf:li> <rdf:li>xmp.did:773EEBE1D448E111B91998E53219AB27</rdf:li> <rdf:li>xmp.did:A5042596D9ADE311BDCFCEC3704F90EE</rdf:li> <rdf:li>xmp.did:B64B1E0C4506E1118D25B00A21295EFC</rdf:li> </rdf:Bag> </photoshop:DocumentAncestors> <xmpMM:History> <rdf:Seq> <rdf:li stEvt:action="created" stEvt:instanceID="xmp.iid:18D6B6167AB4E31185E3B55F244148AB" stEvt:when="2014-03-26T02:03:41 02:00" stEvt:softwareAgent="Adobe Photoshop CS5 Windows"/> <rdf:li stEvt:action="saved" stEvt:instanceID="xmp.iid:19D6B6167AB4E31185E3B55F244148AB" stEvt:when="2014-03-26T03:00:55 02:00" stEvt:softwareAgent="Adobe Photoshop CS5 Windows" stEvt:changed="/"/> <rdf:li stEvt:action="saved" stEvt:instanceID="xmp.iid:0632ADFF1D7EE51189FAD0B2D3A7100E" stEvt:when="2015-10-29T16:45 04:00" stEvt:softwareAgent="Adobe Photoshop CS6 (Windows)" stEvt:changed="/"/> <rdf:li stEvt:action="converted" stEvt:parameters="from application/vnd.adobe.photoshop to image/jpeg"/> <rdf:li stEvt:action="derived" stEvt:parameters="converted from application/vnd.adobe.photoshop to image/jpeg"/> <rdf:li stEvt:action="saved" stEvt:instanceID="xmp.iid:0732ADFF1D7EE51189FAD0B2D3A7100E" stEvt:when="2015-10-29T16:45 04:00" stEvt:softwareAgent="Adobe Photoshop CS6 (Windows)" stEvt:changed="/"/> </rdf:Seq> </xmpMM:History> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:0632ADFF1D7EE51189FAD0B2D3A7100E" stRef:documentID="xmp.did:18D6B6167AB4E31185E3B55F244148AB" stRef:originalDocumentID="xmp.did:18D6B6167AB4E31185E3B55F244148AB"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="w"?>
{).rc"
H~.ye
r1.mq
qLA~L%Ui
l\D%x
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:495AC2039E8111E1818C9D26931ACA2B" xmpMM:DocumentID="xmp.did:495AC2049E8111E1818C9D26931ACA2B"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:495AC2019E8111E1818C9D26931ACA2B" stRef:documentID="xmp.did:495AC2029E8111E1818C9D26931ACA2B"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>w
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:6984DBB39E8111E18088F4137DDE956E" xmpMM:DocumentID="xmp.did:6984DBB49E8111E18088F4137DDE956E"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:6984DBB19E8111E18088F4137DDE956E" stRef:documentID="xmp.did:6984DBB29E8111E18088F4137DDE956E"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>7
?.PL^I
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:620797639E8111E1A7ADA52A09273FB6" xmpMM:DocumentID="xmp.did:620797649E8111E1A7ADA52A09273FB6"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:620797619E8111E1A7ADA52A09273FB6" stRef:documentID="xmp.did:620797629E8111E1A7ADA52A09273FB6"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
dsI.gfrM
WebCatalogueAll #reloadBtn
border-image: url('$SKINPATH$/webcatalogue/webcatalogue-reload-btn.png');
WebCatalogueAll #reloadBtn:hover { border-image: url('$SKINPATH$/webcatalogue/webcatalogue-reload-btn-hover.png'); }
WebCatalogueAll #reloadBtn:pressed
border-image: url('$SKINPATH$/webcatalogue/webcatalogue-reload-btn-pressed.png');
=gò
.IDATh
;ciTXtXML:com.adobe.xmp
<rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/"
xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/"
xmlns:stEvt="hXXp://ns.adobe.com/xap/1.0/sType/ResourceEvent#"
xmlns:photoshop="hXXp://ns.adobe.com/photoshop/1.0/"
xmlns:dc="hXXp://purl.org/dc/elements/1.1/"
xmlns:tiff="hXXp://ns.adobe.com/tiff/1.0/"
xmlns:exif="hXXp://ns.adobe.com/exif/1.0/">
<xmp:CreatorTool>Adobe Photoshop CC (Windows)</xmp:CreatorTool>
<xmpMM:InstanceID>xmp.iid:b639fd69-a23b-074f-bfc1-f9360dd65a5a</xmpMM:InstanceID>
<xmpMM:DocumentID>xmp.did:a6b9ed3a-fc96-cc4f-acc3-d2946b218987</xmpMM:DocumentID>
<xmpMM:OriginalDocumentID>xmp.did:a6b9ed3a-fc96-cc4f-acc3-d2946b218987</xmpMM:OriginalDocumentID>
<stEvt:instanceID>xmp.iid:a6b9ed3a-fc96-cc4f-acc3-d2946b218987</stEvt:instanceID>
<stEvt:softwareAgent>Adobe Photoshop CC (Windows)</stEvt:softwareAgent>
<stEvt:instanceID>xmp.iid:b639fd69-a23b-074f-bfc1-f9360dd65a5a</stEvt:instanceID>
qR.AZ
"iTXtXML:com.adobe.xmp
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:A5F5E798D91A11E4B373F0B1B404F73B" xmpMM:DocumentID="xmp.did:A5F5E799D91A11E4B373F0B1B404F73B"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:A5F5E796D91A11E4B373F0B1B404F73B" stRef:documentID="xmp.did:A5F5E797D91A11E4B373F0B1B404F73B"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>i
l!a%X
.bV=0
diTXtXML:com.adobe.xmp
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:C9FB31E7B7A7E011B4F4F14EFE1685CB" xmpMM:DocumentID="xmp.did:3E376D82A7E711E09227FD1CD5EE0CC9" xmpMM:InstanceID="xmp.iid:3E376D81A7E711E09227FD1CD5EE0CC9" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:52231621D0A7E011B4F4F14EFE1685CB" stRef:documentID="xmp.did:C9FB31E7B7A7E011B4F4F14EFE1685CB"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>6
.iPzw(X
;diTXtXML:com.adobe.xmp
<xmpMM:InstanceID>xmp.iid:3d264fbf-86d3-c64f-b667-0fbf05e706a4</xmpMM:InstanceID>
<xmpMM:DocumentID>xmp.did:1a642653-b94a-f840-935e-ebd19fa1cc74</xmpMM:DocumentID>
<xmpMM:OriginalDocumentID>xmp.did:1a642653-b94a-f840-935e-ebd19fa1cc74</xmpMM:OriginalDocumentID>
<stEvt:instanceID>xmp.iid:1a642653-b94a-f840-935e-ebd19fa1cc74</stEvt:instanceID>
<stEvt:instanceID>xmp.iid:3d264fbf-86d3-c64f-b667-0fbf05e706a4</stEvt:instanceID>
'|o.pt
[vfTp
^%cUY
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:B07FAB5F562D11E19E3A9EAF7EFDE8C0" xmpMM:DocumentID="xmp.did:B07FAB60562D11E19E3A9EAF7EFDE8C0"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:B07FAB5D562D11E19E3A9EAF7EFDE8C0" stRef:documentID="xmp.did:B07FAB5E562D11E19E3A9EAF7EFDE8C0"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
0YÆ
<xmpMM:InstanceID>xmp.iid:92d7e108-ae7c-4b4c-a9b5-aa48b1340087</xmpMM:InstanceID>
<xmpMM:DocumentID>xmp.did:91843dee-0212-4b4d-bc4f-6261a9d1cdc7</xmpMM:DocumentID>
<xmpMM:OriginalDocumentID>xmp.did:91843dee-0212-4b4d-bc4f-6261a9d1cdc7</xmpMM:OriginalDocumentID>
<stEvt:instanceID>xmp.iid:91843dee-0212-4b4d-bc4f-6261a9d1cdc7</stEvt:instanceID>
<stEvt:instanceID>xmp.iid:92d7e108-ae7c-4b4c-a9b5-aa48b1340087</stEvt:instanceID>
%c 3D{
xgp6%s
 FM%c
%u (T
.WT%<b
 O.CO
z.BM@
I,.aW
}%UsO
.LO}7
.WVWW
oP.bo.
<xmpMM:InstanceID>xmp.iid:06f7763c-8e41-7a45-8556-7945d5a28f12</xmpMM:InstanceID>
<xmpMM:DocumentID>xmp.did:7a7dbce1-b851-b648-b05b-01747f72f218</xmpMM:DocumentID>
<xmpMM:OriginalDocumentID>xmp.did:7a7dbce1-b851-b648-b05b-01747f72f218</xmpMM:OriginalDocumentID>
<stEvt:instanceID>xmp.iid:7a7dbce1-b851-b648-b05b-01747f72f218</stEvt:instanceID>
<stEvt:instanceID>xmp.iid:06f7763c-8e41-7a45-8556-7945d5a28f12</stEvt:instanceID>
q%cqL
_K9b%c
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:C0568778D91A11E49BF9F0EB8A15AB88" xmpMM:DocumentID="xmp.did:C0568779D91A11E49BF9F0EB8A15AB88"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:C0568776D91A11E49BF9F0EB8A15AB88" stRef:documentID="xmp.did:C0568777D91A11E49BF9F0EB8A15AB88"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
|%cG73a
\.wyCC
Ps.yGII
.%G\.QJ=
x|hX.lp
g.vqI'p
,.SJ]
S0t.QJ=
a.pn{
.uA,J6
Z.PKt9p
l.nN9[t
0}{(.mY
Þoz
.OdU0Zk
a.rPv
`%0S)
Iþm
<.bxg
ÏBk]
OQ'o.Jl
}* v.Yt
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:DBB0C6983A4711E5856FB5E9D23A8978" xmpMM:DocumentID="xmp.did:DBB0C6993A4711E5856FB5E9D23A8978"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:DBB0C6963A4711E5856FB5E9D23A8978" stRef:documentID="xmp.did:DBB0C6973A4711E5856FB5E9D23A8978"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:D8BC17A83A4711E58894F2924FFE08D9" xmpMM:DocumentID="xmp.did:D8BC17A93A4711E58894F2924FFE08D9"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D8BC17A63A4711E58894F2924FFE08D9" stRef:documentID="xmp.did:D8BC17A73A4711E58894F2924FFE08D9"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>hqA
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:D5B5B5783A4711E5ABDCF9CA6D28FE02" xmpMM:DocumentID="xmp.did:D5B5B5793A4711E5ABDCF9CA6D28FE02"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D5B5B5763A4711E5ABDCF9CA6D28FE02" stRef:documentID="xmp.did:D5B5B5773A4711E5ABDCF9CA6D28FE02"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>^B
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:D2CB66C83A4711E5AF4FB9901A4E2F30" xmpMM:DocumentID="xmp.did:D2CB66C93A4711E5AF4FB9901A4E2F30"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D2CB66C63A4711E5AF4FB9901A4E2F30" stRef:documentID="xmp.did:D2CB66C73A4711E5AF4FB9901A4E2F30"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>t
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:DB4FE1E83A4711E587569B32CA0D768B" xmpMM:DocumentID="xmp.did:DB4FE1E93A4711E587569B32CA0D768B"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:DB4FE1E63A4711E587569B32CA0D768B" stRef:documentID="xmp.did:DB4FE1E73A4711E587569B32CA0D768B"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:D86063183A4711E5AC9BFB1E32337D17" xmpMM:DocumentID="xmp.did:D86063193A4711E5AC9BFB1E32337D17"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D86063163A4711E5AC9BFB1E32337D17" stRef:documentID="xmp.did:D86063173A4711E5AC9BFB1E32337D17"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>`
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:E199FD683A4711E5B5788C3E0D24F7D4" xmpMM:DocumentID="xmp.did:E199FD693A4711E5B5788C3E0D24F7D4"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:E199FD663A4711E5B5788C3E0D24F7D4" stRef:documentID="xmp.did:E199FD673A4711E5B5788C3E0D24F7D4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>(
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:D552ADE83A4711E5901C955909AB47CA" xmpMM:DocumentID="xmp.did:D552ADE93A4711E5901C955909AB47CA"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D552ADE63A4711E5901C955909AB47CA" stRef:documentID="xmp.did:D552ADE73A4711E5901C955909AB47CA"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>A
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:DEAA7E983A4711E5A67DD31FEF021753" xmpMM:DocumentID="xmp.did:DEAA7E993A4711E5A67DD31FEF021753"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:DEAA7E963A4711E5A67DD31FEF021753" stRef:documentID="xmp.did:DEAA7E973A4711E5A67DD31FEF021753"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:D26811183A4711E5845AD631A9012755" xmpMM:DocumentID="xmp.did:D26811193A4711E5845AD631A9012755"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D26811163A4711E5845AD631A9012755" stRef:documentID="xmp.did:D26811173A4711E5845AD631A9012755"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>&LG4
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:D7FD0D683A4711E5A9DFC624032018C5" xmpMM:DocumentID="xmp.did:D7FD0D693A4711E5A9DFC624032018C5"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D7FD0D663A4711E5A9DFC624032018C5" stRef:documentID="xmp.did:D7FD0D673A4711E5A9DFC624032018C5"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:E13E6FE83A4711E5A5A7E375C7AFD377" xmpMM:DocumentID="xmp.did:E13E6FE93A4711E5A5A7E375C7AFD377"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:E13E6FE63A4711E5A5A7E375C7AFD377" stRef:documentID="xmp.did:E13E6FE73A4711E5A5A7E375C7AFD377"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
2od%c
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:D4F4AF683A4711E5BA1193D858509091" xmpMM:DocumentID="xmp.did:D4F4AF693A4711E5BA1193D858509091"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D4F4AF663A4711E5BA1193D858509091" stRef:documentID="xmp.did:D4F4AF673A4711E5BA1193D858509091"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:DE49C0F83A4711E5A0A1A02D39AE82D2" xmpMM:DocumentID="xmp.did:DE49C0F93A4711E5A0A1A02D39AE82D2"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:DE49C0F63A4711E5A0A1A02D39AE82D2" stRef:documentID="xmp.did:DE49C0F73A4711E5A0A1A02D39AE82D2"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
.HpYB
iw"%c`0
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:D2099D683A4711E5AFE59CCB20D78F53" xmpMM:DocumentID="xmp.did:D2099D693A4711E5AFE59CCB20D78F53"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D2099D663A4711E5AFE59CCB20D78F53" stRef:documentID="xmp.did:D2099D673A4711E5AFE59CCB20D78F53"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>,k
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:D79F0EE83A4711E5BDB1852FA6CEBED5" xmpMM:DocumentID="xmp.did:D79F0EE93A4711E5BDB1852FA6CEBED5"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D79F0EE63A4711E5BDB1852FA6CEBED5" stRef:documentID="xmp.did:D79F0EE73A4711E5BDB1852FA6CEBED5"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>D
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:E0E2E2683A4711E5824FB0B0B267CDFB" xmpMM:DocumentID="xmp.did:E0E2E2693A4711E5824FB0B0B267CDFB"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:E0E2E2663A4711E5824FB0B0B267CDFB" stRef:documentID="xmp.did:E0E2E2673A4711E5824FB0B0B267CDFB"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:D49885A83A4711E5A6C6F5855786F1E5" xmpMM:DocumentID="xmp.did:D49885A93A4711E5A6C6F5855786F1E5"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D49885A63A4711E5A6C6F5855786F1E5" stRef:documentID="xmp.did:D49885A73A4711E5A6C6F5855786F1E5"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
(.rcF
OV%Xo
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:DDEE0C683A4711E59DE1F7DDE2D77D64" xmpMM:DocumentID="xmp.did:DDEE0C693A4711E59DE1F7DDE2D77D64"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:DDEE0C663A4711E59DE1F7DDE2D77D64" stRef:documentID="xmp.did:DDEE0C673A4711E59DE1F7DDE2D77D64"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:D1ADE8D83A4711E5958EF8FF0C68FC4B" xmpMM:DocumentID="xmp.did:D1ADE8D93A4711E5958EF8FF0C68FC4B"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D1ADE8D63A4711E5958EF8FF0C68FC4B" stRef:documentID="xmp.did:D1ADE8D73A4711E5958EF8FF0C68FC4B"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:DAF47B783A4711E59FA1FB7871D76071" xmpMM:DocumentID="xmp.did:DAF47B793A4711E59FA1FB7871D76071"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:DAF47B763A4711E59FA1FB7871D76071" stRef:documentID="xmp.did:DAF47B773A4711E59FA1FB7871D76071"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
.ojZ0
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:E08706C83A4711E580AEA07C2592C6B8" xmpMM:DocumentID="xmp.did:E08706C93A4711E580AEA07C2592C6B8"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:E08706C63A4711E580AEA07C2592C6B8" stRef:documentID="xmp.did:E08706C73A4711E580AEA07C2592C6B8"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>S]
N%sL<J
yl_E%s
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:DD8FBFC83A4711E58A57836708410F8C" xmpMM:DocumentID="xmp.did:DD8FBFC93A4711E58A57836708410F8C"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:DD8FBFC63A4711E58A57836708410F8C" stRef:documentID="xmp.did:DD8FBFC73A4711E58A57836708410F8C"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>Ak
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:D43D6D583A4711E58CD7F024959EED90" xmpMM:DocumentID="xmp.did:D43D6D593A4711E58CD7F024959EED90"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D43D6D563A4711E58CD7F024959EED90" stRef:documentID="xmp.did:D43D6D573A4711E58CD7F024959EED90"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:D14822283A4711E595EDA23501C71A02" xmpMM:DocumentID="xmp.did:D14822293A4711E595EDA23501C71A02"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D14822263A4711E595EDA23501C71A02" stRef:documentID="xmp.did:D14822273A4711E595EDA23501C71A02"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:DA360D783A4711E591B6AFE865F6BBCC" xmpMM:DocumentID="xmp.did:DA360D793A4711E591B6AFE865F6BBCC"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:DA360D763A4711E591B6AFE865F6BBCC" stRef:documentID="xmp.did:DA360D773A4711E591B6AFE865F6BBCC"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
%X^5%\
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:E02C3C983A4711E5B54AADF448B7D1B6" xmpMM:DocumentID="xmp.did:E02C3C993A4711E5B54AADF448B7D1B6"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:E02C3C963A4711E5B54AADF448B7D1B6" stRef:documentID="xmp.did:E02C3C973A4711E5B54AADF448B7D1B6"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>O
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:DD34A7783A4711E5A5099D1415A240AA" xmpMM:DocumentID="xmp.did:DD34A7793A4711E5A5099D1415A240AA"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:DD34A7763A4711E5A5099D1415A240AA" stRef:documentID="xmp.did:DD34A7773A4711E5A5099D1415A240AA"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
}!.Xb
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:D3E0F5783A4711E59949AC0620A3E804" xmpMM:DocumentID="xmp.did:D3E0F5793A4711E59949AC0620A3E804"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D3E0F5763A4711E59949AC0620A3E804" stRef:documentID="xmp.did:D3E0F5773A4711E59949AC0620A3E804"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
%.qUt
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:D0E73D783A4711E5B43DC1BBA3B2E80F" xmpMM:DocumentID="xmp.did:D0E73D793A4711E5B43DC1BBA3B2E80F"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D0E73D763A4711E5B43DC1BBA3B2E80F" stRef:documentID="xmp.did:D0E73D773A4711E5B43DC1BBA3B2E80F"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:D74074283A4711E5AEA1FAE4FAD7B212" xmpMM:DocumentID="xmp.did:D74074293A4711E5AEA1FAE4FAD7B212"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D74074263A4711E5AEA1FAE4FAD7B212" stRef:documentID="xmp.did:D74074273A4711E5AEA1FAE4FAD7B212"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
osH6%x
.Ao/00KX7zUf
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:DFC7D5783A4711E59417B1F8EDAF1C5A" xmpMM:DocumentID="xmp.did:DFC7D5793A4711E59417B1F8EDAF1C5A"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:DFC7D5763A4711E59417B1F8EDAF1C5A" stRef:documentID="xmp.did:DFC7D5773A4711E59417B1F8EDAF1C5A"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>H7
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:DCCE44883A4711E5A32D9C795A244D56" xmpMM:DocumentID="xmp.did:DCCE44893A4711E5A32D9C795A244D56"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:DCCE44863A4711E5A32D9C795A244D56" stRef:documentID="xmp.did:DCCE44873A4711E5A32D9C795A244D56"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>"8dU
2l.nAo
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:D088C9C83A4711E5982FA02E66E5A370" xmpMM:DocumentID="xmp.did:D088C9C93A4711E5982FA02E66E5A370"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D088C9C63A4711E5982FA02E66E5A370" stRef:documentID="xmp.did:D088C9C73A4711E5982FA02E66E5A370"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>Y_)
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:D9D6FD883A4711E586F7FBE3C913A49A" xmpMM:DocumentID="xmp.did:D9D6FD893A4711E586F7FBE3C913A49A"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D9D6FD863A4711E586F7FBE3C913A49A" stRef:documentID="xmp.did:D9D6FD873A4711E586F7FBE3C913A49A"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>V-
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:D6DFB6883A4711E59100C136F3DD8B52" xmpMM:DocumentID="xmp.did:D6DFB6893A4711E59100C136F3DD8B52"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D6DFB6863A4711E59100C136F3DD8B52" stRef:documentID="xmp.did:D6DFB6873A4711E59100C136F3DD8B52"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>`
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:DF6717D83A4711E5979DD880AF7B6084" xmpMM:DocumentID="xmp.did:DF6717D93A4711E5979DD880AF7B6084"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:DF6717D63A4711E5979DD880AF7B6084" stRef:documentID="xmp.did:DF6717D73A4711E5979DD880AF7B6084"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
%X` l
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:DC6FF7E83A4711E5AE68BA7A6227EE1A" xmpMM:DocumentID="xmp.did:DC6FF7E93A4711E5AE68BA7A6227EE1A"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:DC6FF7E63A4711E5AE68BA7A6227EE1A" stRef:documentID="xmp.did:DC6FF7E73A4711E5AE68BA7A6227EE1A"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:D027BE083A4711E593E29585B2D2989A" xmpMM:DocumentID="xmp.did:D027BE093A4711E593E29585B2D2989A"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D027BE063A4711E593E29585B2D2989A" stRef:documentID="xmp.did:D027BE073A4711E593E29585B2D2989A"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>r
,.BZp0
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:D97B21E83A4711E580E7F6BFBA28DE48" xmpMM:DocumentID="xmp.did:D97B21E93A4711E580E7F6BFBA28DE48"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D97B21E63A4711E580E7F6BFBA28DE48" stRef:documentID="xmp.did:D97B21E73A4711E580E7F6BFBA28DE48"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>3>Tc
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:D683DAE83A4711E5BD81E49A39BC9E34" xmpMM:DocumentID="xmp.did:D683DAE93A4711E5BD81E49A39BC9E34"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D683DAE63A4711E5BD81E49A39BC9E34" stRef:documentID="xmp.did:D683DAE73A4711E5BD81E49A39BC9E34"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:DF065A383A4711E59BDFF701CC9A1DFE" xmpMM:DocumentID="xmp.did:DF065A393A4711E59BDFF701CC9A1DFE"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:DF065A363A4711E59BDFF701CC9A1DFE" stRef:documentID="xmp.did:DF065A373A4711E59BDFF701CC9A1DFE"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:D38519D83A4711E596D7D4EA8DB672EC" xmpMM:DocumentID="xmp.did:D38519D93A4711E596D7D4EA8DB672EC"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D38519D63A4711E596D7D4EA8DB672EC" stRef:documentID="xmp.did:D38519D73A4711E596D7D4EA8DB672EC"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>=
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:DC0C7B283A4711E5B6D49ED2CF3FDE73" xmpMM:DocumentID="xmp.did:DC0C7B293A4711E5B6D49ED2CF3FDE73"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:DC0C7B263A4711E5B6D49ED2CF3FDE73" stRef:documentID="xmp.did:DC0C7B273A4711E5B6D49ED2CF3FDE73"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>U
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:D91CD5483A4711E5AD78DAAD14BDC54E" xmpMM:DocumentID="xmp.did:D91CD5493A4711E5AD78DAAD14BDC54E"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D91CD5463A4711E5AD78DAAD14BDC54E" stRef:documentID="xmp.did:D91CD5473A4711E5AD78DAAD14BDC54E"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:D613DB083A4711E5BEECCAB626302AB7" xmpMM:DocumentID="xmp.did:D613DB093A4711E5BEECCAB626302AB7"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D613DB063A4711E5BEECCAB626302AB7" stRef:documentID="xmp.did:D613DB073A4711E5BEECCAB626302AB7"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:D32965483A4711E5BC7789A477C9CA04" xmpMM:DocumentID="xmp.did:D32965493A4711E5BC7789A477C9CA04"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D32965463A4711E5BC7789A477C9CA04" stRef:documentID="xmp.did:D32965473A4711E5BC7789A477C9CA04"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:98A122E8D91E11E49F35A160B2F48E0A" xmpMM:DocumentID="xmp.did:98A122E9D91E11E49F35A160B2F48E0A"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:98A122E6D91E11E49F35A160B2F48E0A" stRef:documentID="xmp.did:98A122E7D91E11E49F35A160B2F48E0A"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:86D1CB8C8F8B11E1B166F41A328817A4" xmpMM:DocumentID="xmp.did:86D1CB8D8F8B11E1B166F41A328817A4"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:86D1CB8A8F8B11E1B166F41A328817A4" stRef:documentID="xmp.did:86D1CB8B8F8B11E1B166F41A328817A4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
!'.Qh
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:9E800B68D91C11E4B5D6D2197B54C6C9" xmpMM:DocumentID="xmp.did:9E800B69D91C11E4B5D6D2197B54C6C9"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:9E800B66D91C11E4B5D6D2197B54C6C9" stRef:documentID="xmp.did:9E800B67D91C11E4B5D6D2197B54C6C9"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:9A79617C8F8B11E181CE9E5B57690D63" xmpMM:DocumentID="xmp.did:9A79617D8F8B11E181CE9E5B57690D63"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:9A79617A8F8B11E181CE9E5B57690D63" stRef:documentID="xmp.did:9A79617B8F8B11E181CE9E5B57690D63"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
(ND%C*_
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:A9CA8458D91C11E48FB5AF8BA32F0242" xmpMM:DocumentID="xmp.did:A9CA8459D91C11E48FB5AF8BA32F0242"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:A9CA8456D91C11E48FB5AF8BA32F0242" stRef:documentID="xmp.did:A9CA8457D91C11E48FB5AF8BA32F0242"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
.IDATx
a-%6U$
8`iTXtXML:com.adobe.xmp
<xmpMM:InstanceID>xmp.iid:29380646-a859-2644-983f-c942fa0785d1</xmpMM:InstanceID>
<xmpMM:DocumentID>xmp.did:29380646-a859-2644-983f-c942fa0785d1</xmpMM:DocumentID>
<xmpMM:OriginalDocumentID>xmp.did:29380646-a859-2644-983f-c942fa0785d1</xmpMM:OriginalDocumentID>
<stEvt:instanceID>xmp.iid:29380646-a859-2644-983f-c942fa0785d1</stEvt:instanceID>
iTXtXML:com.adobe.xmp
<xmpMM:InstanceID>xmp.iid:22fc1954-77a1-c24a-82ef-b58cb94457a7</xmpMM:InstanceID>
<xmpMM:DocumentID>xmp.did:bed78266-747e-0b4e-a9d7-2dbdc8ed6950</xmpMM:DocumentID>
<xmpMM:OriginalDocumentID>xmp.did:bed78266-747e-0b4e-a9d7-2dbdc8ed6950</xmpMM:OriginalDocumentID>
<stEvt:instanceID>xmp.iid:bed78266-747e-0b4e-a9d7-2dbdc8ed6950</stEvt:instanceID>
<stEvt:instanceID>xmp.iid:22fc1954-77a1-c24a-82ef-b58cb94457a7</stEvt:instanceID>
SSHHb2
rZ3E}%D
b.kV)$
`0.Yj
7QBV8{G&0%u
\m..Dm6
%SY^4h
.N).nZD8i
'%Cha
.DVK%1`
%c}<@=
\c.kE
).XTQ(%\
L.JGci
.qK>$
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:7C122B8877DD11E4AD7FB1D5DB29DC13" xmpMM:DocumentID="xmp.did:7C122B8977DD11E4AD7FB1D5DB29DC13"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:7C122B8677DD11E4AD7FB1D5DB29DC13" stRef:documentID="xmp.did:7C122B8777DD11E4AD7FB1D5DB29DC13"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>)
fiTXtXML:com.adobe.xmp
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:EA8F12C37D5FE5119740FC186D1C5E68" xmpMM:DocumentID="xmp.did:B1167D2765F411E58C3FE8D0A0778A10" xmpMM:InstanceID="xmp.iid:B1167D2665F411E58C3FE8D0A0778A10" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:9ACF216CEF63E511A024E5822D11C05E" stRef:documentID="xmp.did:EA8F12C37D5FE5119740FC186D1C5E68"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:EA8F12C37D5FE5119740FC186D1C5E68" xmpMM:DocumentID="xmp.did:7259D9B765F411E591BBB6CB8CF1CA3B" xmpMM:InstanceID="xmp.iid:7259D9B665F411E591BBB6CB8CF1CA3B" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:9ACF216CEF63E511A024E5822D11C05E" stRef:documentID="xmp.did:EA8F12C37D5FE5119740FC186D1C5E68"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:EA8F12C37D5FE5119740FC186D1C5E68" xmpMM:DocumentID="xmp.did:95165E1765F411E5BA288D5675288E08" xmpMM:InstanceID="xmp.iid:95165E1665F411E5BA288D5675288E08" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:9ACF216CEF63E511A024E5822D11C05E" stRef:documentID="xmp.did:EA8F12C37D5FE5119740FC186D1C5E68"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>D
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:EA8F12C37D5FE5119740FC186D1C5E68" xmpMM:DocumentID="xmp.did:B671088765F411E5A5A3CBB99EB76EC3" xmpMM:InstanceID="xmp.iid:B671088665F411E5A5A3CBB99EB76EC3" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:9ACF216CEF63E511A024E5822D11C05E" stRef:documentID="xmp.did:EA8F12C37D5FE5119740FC186D1C5E68"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
kCO(.fq=/$
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:EA8F12C37D5FE5119740FC186D1C5E68" xmpMM:DocumentID="xmp.did:6CD3D18765F411E59613D4DE8F5B7758" xmpMM:InstanceID="xmp.iid:6CD3D18665F411E59613D4DE8F5B7758" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:9ACF216CEF63E511A024E5822D11C05E" stRef:documentID="xmp.did:EA8F12C37D5FE5119740FC186D1C5E68"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:EA8F12C37D5FE5119740FC186D1C5E68" xmpMM:DocumentID="xmp.did:8E10459765F411E58BD7FA46CE0319F1" xmpMM:InstanceID="xmp.iid:8E10459665F411E58BD7FA46CE0319F1" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:9ACF216CEF63E511A024E5822D11C05E" stRef:documentID="xmp.did:EA8F12C37D5FE5119740FC186D1C5E68"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:EA8F12C37D5FE5119740FC186D1C5E68" xmpMM:DocumentID="xmp.did:AA22660765F411E58B218E4EEB2F20EC" xmpMM:InstanceID="xmp.iid:AA22660665F411E58B218E4EEB2F20EC" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:9ACF216CEF63E511A024E5822D11C05E" stRef:documentID="xmp.did:EA8F12C37D5FE5119740FC186D1C5E68"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
.FO@p=
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:EA8F12C37D5FE5119740FC186D1C5E68" xmpMM:DocumentID="xmp.did:BCF60A2765F411E5BBACD9DEA19CAFA4" xmpMM:InstanceID="xmp.iid:BCF60A2665F411E5BBACD9DEA19CAFA4" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:9ACF216CEF63E511A024E5822D11C05E" stRef:documentID="xmp.did:EA8F12C37D5FE5119740FC186D1C5E68"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>}
)V 8.qRh
\7.HL
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:EA8F12C37D5FE5119740FC186D1C5E68" xmpMM:DocumentID="xmp.did:801552A765F411E599B5D50D6D7E6810" xmpMM:InstanceID="xmp.iid:801552A665F411E599B5D50D6D7E6810" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:9ACF216CEF63E511A024E5822D11C05E" stRef:documentID="xmp.did:EA8F12C37D5FE5119740FC186D1C5E68"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>&_d
Xr%uy
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:EA8F12C37D5FE5119740FC186D1C5E68" xmpMM:DocumentID="xmp.did:A0BA8FC765F411E5AD4BB42A4772C13F" xmpMM:InstanceID="xmp.iid:A0BA8FC665F411E5AD4BB42A4772C13F" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:9ACF216CEF63E511A024E5822D11C05E" stRef:documentID="xmp.did:EA8F12C37D5FE5119740FC186D1C5E68"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>}
kCO(.fQ=/$
.Ff-*$
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:EA8F12C37D5FE5119740FC186D1C5E68" xmpMM:DocumentID="xmp.did:780F083765F411E58320ACACDC420AC9" xmpMM:InstanceID="xmp.iid:780F083665F411E58320ACACDC420AC9" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:9ACF216CEF63E511A024E5822D11C05E" stRef:documentID="xmp.did:EA8F12C37D5FE5119740FC186D1C5E68"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:EA8F12C37D5FE5119740FC186D1C5E68" xmpMM:DocumentID="xmp.did:9B12599765F411E58E68AAA46150CFAA" xmpMM:InstanceID="xmp.iid:9B12599665F411E58E68AAA46150CFAA" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:9ACF216CEF63E511A024E5822D11C05E" stRef:documentID="xmp.did:EA8F12C37D5FE5119740FC186D1C5E68"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>r
%,%c<r)
.UDEK
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:67861F24185EE511BCC6813E1E03DE28" xmpMM:DocumentID="xmp.did:F6BED01765F011E5BAE7936B9B6A148B" xmpMM:InstanceID="xmp.iid:F6BED01665F011E5BAE7936B9B6A148B" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:807971BCF263E511A024E5822D11C05E" stRef:documentID="xmp.did:E9AE024A075EE511BCC6813E1E03DE28"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>hn60
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:67861F24185EE511BCC6813E1E03DE28" xmpMM:DocumentID="xmp.did:C2AEDEF765F011E5A1BAD2BB694A9F8B" xmpMM:InstanceID="xmp.iid:C2AEDEF665F011E5A1BAD2BB694A9F8B" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:807971BCF263E511A024E5822D11C05E" stRef:documentID="xmp.did:E9AE024A075EE511BCC6813E1E03DE28"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:67861F24185EE511BCC6813E1E03DE28" xmpMM:DocumentID="xmp.did:D228F7D765F011E5A004803842D07330" xmpMM:InstanceID="xmp.iid:D228F7D665F011E5A004803842D07330" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:807971BCF263E511A024E5822D11C05E" stRef:documentID="xmp.did:E9AE024A075EE511BCC6813E1E03DE28"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:67861F24185EE511BCC6813E1E03DE28" xmpMM:DocumentID="xmp.did:0367526765F111E5A5E8C20D6D200273" xmpMM:InstanceID="xmp.iid:0367526665F111E5A5E8C20D6D200273" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:807971BCF263E511A024E5822D11C05E" stRef:documentID="xmp.did:E9AE024A075EE511BCC6813E1E03DE28"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>m.
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:67861F24185EE511BCC6813E1E03DE28" xmpMM:DocumentID="xmp.did:B5A6D78765F011E59D408F63A23A46E2" xmpMM:InstanceID="xmp.iid:B5A6D78665F011E59D408F63A23A46E2" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:807971BCF263E511A024E5822D11C05E" stRef:documentID="xmp.did:E9AE024A075EE511BCC6813E1E03DE28"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:67861F24185EE511BCC6813E1E03DE28" xmpMM:DocumentID="xmp.did:CD85AE8765F011E5A90CF88976C80192" xmpMM:InstanceID="xmp.iid:CD85AE8665F011E5A90CF88976C80192" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:807971BCF263E511A024E5822D11C05E" stRef:documentID="xmp.did:E9AE024A075EE511BCC6813E1E03DE28"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:67861F24185EE511BCC6813E1E03DE28" xmpMM:DocumentID="xmp.did:F0B00FE765F011E586F5A904C429A968" xmpMM:InstanceID="xmp.iid:F0B00FE665F011E586F5A904C429A968" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:807971BCF263E511A024E5822D11C05E" stRef:documentID="xmp.did:E9AE024A075EE511BCC6813E1E03DE28"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:67861F24185EE511BCC6813E1E03DE28" xmpMM:DocumentID="xmp.did:0E5C7F6765F111E5BBD4D1C72A7275E6" xmpMM:InstanceID="xmp.iid:0E5C7F6665F111E5BBD4D1C72A7275E6" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:807971BCF263E511A024E5822D11C05E" stRef:documentID="xmp.did:E9AE024A075EE511BCC6813E1E03DE28"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>k
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:67861F24185EE511BCC6813E1E03DE28" xmpMM:DocumentID="xmp.did:A7F0D24765EF11E5B2D5DBA79D5400B2" xmpMM:InstanceID="xmp.iid:A7F0D24665EF11E5B2D5DBA79D5400B2" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:807971BCF263E511A024E5822D11C05E" stRef:documentID="xmp.did:E9AE024A075EE511BCC6813E1E03DE28"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>K
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:67861F24185EE511BCC6813E1E03DE28" xmpMM:DocumentID="xmp.did:EBC7A74765F011E5B773C627B3247423" xmpMM:InstanceID="xmp.iid:EBC7A74665F011E5B773C627B3247423" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:807971BCF263E511A024E5822D11C05E" stRef:documentID="xmp.did:E9AE024A075EE511BCC6813E1E03DE28"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:67861F24185EE511BCC6813E1E03DE28" xmpMM:DocumentID="xmp.did:C6BA551765F011E58710E47F5CD4C7D3" xmpMM:InstanceID="xmp.iid:C6BA551665F011E58710E47F5CD4C7D3" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:807971BCF263E511A024E5822D11C05E" stRef:documentID="xmp.did:E9AE024A075EE511BCC6813E1E03DE28"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>3
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:67861F24185EE511BCC6813E1E03DE28" xmpMM:DocumentID="xmp.did:E4F6CF9765F011E5B23FDF923751C3AB" xmpMM:InstanceID="xmp.iid:E4F6CF9665F011E5B23FDF923751C3AB" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:807971BCF263E511A024E5822D11C05E" stRef:documentID="xmp.did:E9AE024A075EE511BCC6813E1E03DE28"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
bBbe.RE 
)n!A;&%u
B.PXW
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:499AEC36ABD411E1BB8A93F9FCA39303" xmpMM:DocumentID="xmp.did:499AEC37ABD411E1BB8A93F9FCA39303"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:499AEC34ABD411E1BB8A93F9FCA39303" stRef:documentID="xmp.did:499AEC35ABD411E1BB8A93F9FCA39303"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>IR3
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:5DD17BB6ABD411E181D7CE2CE8DAB3CB" xmpMM:DocumentID="xmp.did:5DD17BB7ABD411E181D7CE2CE8DAB3CB"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5DD17BB4ABD411E181D7CE2CE8DAB3CB" stRef:documentID="xmp.did:5DD17BB5ABD411E181D7CE2CE8DAB3CB"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
8 .HH
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:53A82A36ABD411E19C91928BC531B510" xmpMM:DocumentID="xmp.did:53A82A37ABD411E19C91928BC531B510"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:53A82A34ABD411E19C91928BC531B510" stRef:documentID="xmp.did:53A82A35ABD411E19C91928BC531B510"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
mc.eH
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:4EE34F26ABD411E19AB9DAE39971DF3A" xmpMM:DocumentID="xmp.did:4EE34F27ABD411E19AB9DAE39971DF3A"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:4EE34F24ABD411E19AB9DAE39971DF3A" stRef:documentID="xmp.did:4EE34F25ABD411E19AB9DAE39971DF3A"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>cM
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:44AEB306ABD411E1ADF8CA1208D14D93" xmpMM:DocumentID="xmp.did:44AEB307ABD411E1ADF8CA1208D14D93"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:44AEB304ABD411E1ADF8CA1208D14D93" stRef:documentID="xmp.did:44AEB305ABD411E1ADF8CA1208D14D93"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>j
o%U3S
.IDATX
]-TVU} 
xF.mD
N .tU
j7'5%f
nP-5N}
O!%DZ
(0M%X9l
:F.Od
%f(0?
m.hLxY
fB.cF
1.ITO
C_.Ad`
.Jk*\Yt
0{%foXr
(3}%c
All Files (*.*)
%Could not remove file or directory
Operation stopped by the user
Q3UrlOperator
IThe protocol `%1' does not support copying or moving files or directories
;The protocol `%1' does not support creating new directories
0The protocol `%1' does not support getting files
6The protocol `%1' does not support listing directories
0The protocol `%1' does not support putting files
@The protocol `%1' does not support removing files or directories
@The protocol `%1' does not support renaming files or directories
"The protocol `%1' is not supported
Socket operation timed out
,Executable '%1' requires Qt %2, found Qt %3.
QFtp
Login failed:
QHttp
HTTP request failed
Invalid HTTP chunked body
Invalid HTTP response header
%Server closed connection unexpectedly
Windows input method
4Another socket is already listening on the same port
=Attempt to use IPv6 socket on a platform with no IPv6 support
Network operation timed out
Protocol type not supported
%Unable to initialize broadcast socket
Unsupported socket operation
)Executive (7.5 x 10 inches, 191 x 254 mm)
Portrait
%US Common #10 Envelope (105 x 241 mm)
Open URL
QSql
Socket operation unsupported
QTcpServer
#This platform does not support IPv6
QUdpSocket
ZWJ Zero width joiner
ZWNJ Zero width non-joiner
%1 - [%2]
[(
`E%dl
%%S'w
H.ASpqV
O,w.RgH
%FYJT-
b5.KKv
.Manually select the sites you`d like on search
(Only HTTP and MAGNET links are supported
<Pipe for mediaget-admin-proxy-in failed to listen at %1 (%2)
=Pipe for mediaget-admin-proxy-out failed to listen at %1 (%2)
.download movies, music and games
.Language will change after restarting software
XSorry, %1 has crashed. Will try to upload the crash report to developer (report size %2)
cSorry, memory leak detected in %1. Will try to upload the dump report to developer (report size %2)
Error save in ffmpeg_log.txt
Hockey
HOCKEY
LoginInfoDialog
$Decoder doesn't support this archive
 All file (*.* *.dat);;Black IP file (*.dat)
Export Black IP to file
Import Black IP from file
.Unable to abort now - extraction is in process
)ShellExecute implemented only for Windows
nDuring get a .torrent file error occurred. Perhaps because of limits on the torrent web site. Try again later.
!Enter some keywords to search for
.There are no search results for "%1"
-<a href="hXXp://isohunt.com/">IsoHunt.com</a>
$Use mgtracker.org to find more peers
,Use non-standard port for DHT and Bittorrent
'Display dialog when adding web download
%Check .torrent association on startup
Or select whom to send this URL:
/Your friends can download files using this URL:
.Error occured while proceeding folowing links:
%Download speed %3 - Estimated time %4
'Direct HTTP download is not implemented
-Url is unrecognized (neither http nor magnet)
UrlShortener
WebcatTrayAlerter
uTorrentExport
.tD&1,
J=.wO
gm.qky
Qs@%c
{.DUk,
).OS9[
)5q5.AZ
_O.bPX
.XCYF
*7Y'%x[
.cU|O
s.GEJc
9 .Ab
{7.wu
"D8%sW
.HA-Kuj
QWebPage
hs.Mm@
h.nB\
x-X7}oW
B%ueX
.MUy 
Y.ho*3-
Y.hoW
W(Am)`J%U
.Lr?M
p%Fgg
P2%Srp08
W-Pio}
%Srms
, #&')*)
-0-(0%()(
F.Evn
.LW11
Wsql
*|.LZ
~u.RX
.TcR0
S%fpR*hw
%cwR62yK
'uuZWu%U
d8:announce41:hXXp://update.mgtracker.org:6881/announce10:created by50:MediaGet2 2.01.3481/libtorrent1.0.0.0.$Rev: 9739 $13:creation datei1447074951e4:infod6:lengthi6513151e4:name17:flash-plugin-1.7z12:piece lengthi262144e6:pieces500:K$['
loginAccept
downloadUrl
catalogTorrentUrl
searchFromCmdLine
urlBittorrentInfoLoadComplete
finishCheckPrivateLogin
errorCheckPrivateLogin
finishAllCheckLogins
setUrlBittorrentInfo
importClick
keyPressedHandler
QKeyEvent*
keyPressed
downloadHttpFile
loadUrl
loadContentUrl
loadCatalogUrl
loginButtonClicked
downloadHttpFileHelper
QWebFrame*
httpResponseFinished
eventUrlTriggered
imageUrl
eventUrl
WebcatHelper::MediagetJSObject
serviceImageUrl
imgUrl
WebcatHelper::WebBrowser
WebcatHelper::WebBrowserHelper
WebcatHelper::WebPopupWindow
WebcatHelper::WebcatWebPage
WebCatalogueViewAll
openCatalogueUrl
urlClicked
WebCatalogHelper
vurl
startUTorrentExport
MediagetUTorrentExportSetting
showUTorrentExportWnd
uTorrentExportManager
openUrlOldCatalogue
QHttpServer
QHttpRequest*
QHttpResponse*
QHttpResponse
QHttpRequest
remotePort
httpVersion
QHttpConnection
copyUrl
portmapAdded
portmapId
externalPort
ToolbarWebserver
downloadHttpPlaylist
QList<MediagetDownload::HttpPlaylistItem>&
httpResponse
ToolbarChromeInstaller
getToolbarExe
checkUTorrentExport
torrentUrl
UrlHandler
portmapCreated
extertnalPort
portmapFailed
openHttpLink
openHttpPlaylist
addUrl
preSetUrls
randomizeIncomingPort
WebDownload
abortOperation
openAddSpaceUrl
openUrlCatalogue
Z%c~s
1,/%c
asio.misc
255.255.255.255
asio.misc error
thread.exit_event
thread.entry_event
\xx
libtorrent/1.0.5.0
ssl-cert
path.utf-8
.%d%s
name.utf-8
created by.utf-8
comment.utf-8
httpseeds
url-list
key not found:
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789 /ABCDEFGHIJKLMNOPQRSTUVWXYZ234567%s://%s%s%s%s%s%s
msg_type
d:d:d.d
asio.ssl
add_certificate_authority
use_certificate
use_certificate_file
use_certificate_chain
use_certificate_chain_file
use_private_key
use_private_key_file
use_rsa_private_key
use_rsa_private_key_file
asio.ssl error
kernel32.dll
%s%s%s
.____padding_file/%d
http error
unsupported URL protocol
failed to parse URL
invalid port
port blocked by port-filter
invalid dht-port message
unsupported encryption mode
peer selected unsupported encryption mode
HTTP error
invalid HTTP range
invalid SSL certificate
unsupported protocol version
not authorized to create port map (enable NAT-PMP on your router)
unsupported opcode
Invalid HTTP header
missing Location header in HTTP redirect
failed to decompress HTTP response
udp tracker response packet has invalid size
invalid transaction id in udp tracker response
invalid action field in udp tracker response
(unknown HTTP error)
udp://
1.0.5.0
x.509 certificate
x.509 certificate store
.zz.countries.nerd.dk
max_http_recv_buffer_size
ban_web_seeds
no_connect_privileged_ports
report_web_seed_downloads
enable_incoming_tcp
enable_outgoing_tcp
report_true_downloaded
udp_tracker_token_expiry
allow_reordered_disk_operations
prefer_udp_trackers
urlseed_wait_retry
urlseed_pipeline_size
urlseed_timeout
-%c%c%c%c%c%c-
reading p: %d b: %d s: %d (read: %d)
reading p: %d o: %d s: %d (read: %d)
SSL/TCP
SSL/HTTP
HTTPS
Socks5/TCP
portmap_error_alert
udp_error_alert
torrent_need_cert_alert
%s: read_piece %u successful
%s: read_piece %u failed: %s
%s: file %d finished downloading
%s: file %d renamed to %s
%s: failed to rename file %d: %s
%s hash for piece %u failed
%s piece: %u finished downloading
%s peer dropped block ( piece: %u block: %u)
%s peer timed out request ( piece: %u block: %u)
%s block finished downloading (piece: %u block: %u)
%s requested block (piece: %u block: %u) %s
%s received block not in download queue (piece: %u block: %u)
url_seed_alert
listening on %s failed: [%s] [%s] %s
TCP/SSL
successfully listening on [%s] %s
successfully mapped port using %s. external port: %u
portmap_log_alert
%s: %s
%s: blocked peer: %s [%s]
tcp_disabled
privileged_ports
port_filter
incoming dht announce: %s:%u (%s)
incoming dht get_peers: %s
%s: [%d] %d %d %d %d %d %d %d %d %d %d
%s: %s: %s
RSS feed %s: %s (%s)
incoming connection from %s (%s)
added torrent: %s
failed to add torrent "%s": [%s] %s
state updates for %d torrents
DHT error [%s] (%d) %s
DHT immutable item %s [ %s ]
DHT mutable item (key=%s salt=%s seq=%I64d) [ %s ]
DHT put complete (key=%s sig=%s salt=%s seq=%I64d)
i2p_error: [%s] %s
too few ports allowed for outgoing connections
%s (%d) %s "%s" (%d)
%s scrape reply: %u %u
%s received peers: %u
%s received DHT peers: %u
%s peer sent an invalid piece request (piece: %u start: %u len: %u)
url seed (
UDP error:
could not map port using
%s: received peer from local service discovery
ERROR: %s
needs SSL certificate
%s connecting to peer (%s)
torrent changed info-hash from: %s to %s
%s disconnecting: [%s] %s
feed [%s] has new RSS item %s
Authorization: Basic %s
User-Agent: %s
GET %s HTTP/1.1
Host: %s
Proxy-Authorization: Basic %s
keyB
keyA
HTTP/1.1
URL seed @
Turkey
Portugal
Error reading file %s where reloading
Error reading file %s -- corrupt
Error reading file %s when reloading
Error Opening file %s when reloading
Out of memory when reloading %s
Error reading file %s
Error stating file %s
Error Opening file %s
Invalid database type %s, expected %s
ExternalPort must be a wildcard and cannot be a specific port
The NAT implementation only supports permanent lease times on port mappings
Internal and External port values must be the same
The port mapping entry specified conflicts with a mapping assigned previously to another client
The external port cannot be wild-carded
sending: %s
POST %s HTTP/1.1
Host: %s:%u
Content-Length: %d
Soapaction: "%s#%s"
<s:Envelope xmlns:s="hXXp://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="hXXp://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:%s xmlns:u="%s"><NewRemoteHost></NewRemoteHost><NewExternalPort>%u</NewExternalPort><NewProtocol>%s</NewProtocol><NewInternalPort>%u</NewInternalPort><NewInternalClient>%s</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>%s at %s:%d</NewPortMappingDescription><NewLeaseDuration>%u</NewLeaseDuration></u:%s></s:Body></s:Envelope>
AddPortMapping
mapping %u aborted
<s:Envelope xmlns:s="hXXp://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="hXXp://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:%s xmlns:u="%s"><NewRemoteHost></NewRemoteHost><NewExternalPort>%u</NewExternalPort><NewProtocol>%s</NewProtocol></u:%s></s:Body></s:Envelope>
DeletePortMapping
unmapping %u aborted
<s:Envelope xmlns:s="hXXp://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="hXXp://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:%s xmlns:u="%s"></u:%s></s:Body></s:Envelope>
unknown UPnP error (%d)
urlbase
controlurl
unmap response: %s
error while deleting portmap: incomplete http message
error while deleting portmap: %s
broadcast failed: %s. Aborting.
M-SEARCH * HTTP/1.1
HOST: 239.255.255.250:1900
?map response: %s
error while adding port map, code: %u
error while adding port map: invalid content-type, "%s". Expected text/xml or application/soap xml
error while adding port map: incomplete http message
error while adding port map: %s
mapping %u does not need updating, skipping
connecting to %s
got router external IP address %s
error while getting external IP address, code: %u
get external IP address response: %s
error while getting external IP address: incomplete http message
error while getting external IP address: %s
adding port map: [ protocol: %s ext_port: %u local_port: %u ] %s
deleting port map: [ protocol: %s ext_port: %u local_port: %u ]
could not find a port mapping interface in response from: %s
failed to parse URL '%s': %s
found control URL: %s namespace %s urlbase: %s in response from %s
error while fetching control url from: %s: incomplete HTTP message
error while fetching control url from: %s: %s
connection failed to: %s %s
connecting to: %s
too many rootdevices: (%d). Ignoring %s
found rootdevice: %s (%d)
URL with port 0 from %s
unsupported protocol %s from %s
invalid URL %s from %s: %s
missing location header from %s
incomplete HTTP packet from %s
HTTP method %s from %s
HTTP status %u from %s
received malformed HTTP from: %s
SSDP response from: %s: IP is not a router.
(%s,%s)
ignoring response from: %s. IP is not on local network.
failed to enumerate routes when receiving response from: %s: %s
when receiving response from: %s: %s
239.255.255.250
BT-SEARCH * HTTP/1.1
Host: %s:6771
Port: %d
Infohash: %s
cookie: %x
239.192.152.143
==> port map [ mapping: %d action: %s proto: %s local: %u external: %u ttl: %u ]
mapping %u expired
unexpected version: %u
<== port map [ protocol: %s local: %u external: %u ttl: %u ]
<== public IP address [ %s ]
received packet of invalid size: %d
received packet from wrong IP: %s
error on receiving reply: %s
found router at: %s
failed to find default route: %s
4:salt%d:
invalid key
key not found
STREAM CONNECT ID=%s DESTINATION=%s
STREAM ACCEPT ID=%s
SESSION CREATE STYLE=STREAM ID=%s DESTINATION=TRANSIENT
KEY_NOT_FOUND
INVALID_KEY
NAMING LOOKUP NAME=%s
SOCKS unsupported version
SOCKS unsupported authentication method
SOCKS unsupported authentication version
SOCKS command not supported
Iphlpapi.dll
HTTP/1.0
%s:%d
[%s]:%d
MLdonkey
Azureus 2.0.3.2
Torrent.NET
Net Transport
MLDonkey
%c%d-%d-%d--
%s %u.%u.%u
Experimental 3.2.1b2
HTTP/1.0
HTTP/
&supportcrypto=1
info_hash=%s&peer_id=%s&port=%d&uploaded=%I64d&downloaded=%I64d&left=%I64d&corrupt=%I64d&key=%X%s%s&numwant=%d&compact=1&no_peer_id=1
the tracker only resolves to an %s address, and you're listening on an %s socket. This may prevent you from receiving incoming connections.
%u.%u.%u.%u
invalid value for '%s'
missing '%s' key
implied_port
missing 'id' key
missing 'r' key
deflate 1.2.5 Copyright 1995-2010 Jean-loup Gailly and Mark Adler
1.2.5
inflate 1.2.5 Copyright 1995-2010 Mark Adler
E:\mediaget-default-541-release\release\mediaget.pdb
libvlc_errmsg
SHLWAPI.dll
IPHLPAPI.DLL
PSAPI.DLL
RegSetKeySecurity
RegOpenKeyExW
RegCreateKeyExW
ADVAPI32.dll
EnumChildWindows
EnumWindows
ExitWindowsEx
USER32.dll
ShellExecuteW
ShellExecuteExW
SHELL32.dll
credui.dll
LIBEAY32.dll
SSLEAY32.dll
MSVCP100.dll
?load@QWebView@@QAEXABVQUrl@@@Z
?addToJavaScriptWindowObject@QWebFrame@@QAEXABVQString@@PAVQObject@@W4ValueOwnership@1@@Z
?settings@QWebPage@@QBEPAVQWebSettings@@XZ
?page@QWebView@@QBEPAVQWebPage@@XZ
?networkAccessManager@QWebPage@@QBEPAVQNetworkAccessManager@@XZ
?mainFrame@QWebPage@@QBEPAVQWebFrame@@XZ
?frameName@QWebFrame@@QBE?AVQString@@XZ
?evaluateJavaScript@QWebFrame@@QAE?AVQVariant@@ABVQString@@@Z
?childFrames@QWebFrame@@QBE?AV?$QList@PAVQWebFrame@@@@XZ
?findFirstElement@QWebFrame@@QBE?AVQWebElement@@ABVQString@@@Z
?load@QWebFrame@@QAEXABVQUrl@@@Z
?setScrollBarPolicy@QWebFrame@@QAEXW4Orientation@Qt@@W4ScrollBarPolicy@3@@Z
?toHtml@QWebFrame@@QBE?AVQString@@XZ
??1QWebPage@@UAE@XZ
??0QWebPage@@QAE@PAVQObject@@@Z
?event@QWebPage@@UAE_NPAVQEvent@@@Z
?triggerAction@QWebPage@@UAEXW4WebAction@1@_N@Z
?extension@QWebPage@@UAE_NW4Extension@1@PBVExtensionOption@1@PAVExtensionReturn@1@@Z
?supportsExtension@QWebPage@@UBE_NW4Extension@1@@Z
?shouldInterruptJavaScript@QWebPage@@UAE_NXZ
?createWindow@QWebPage@@MAEPAV1@W4WebWindowType@1@@Z
?createPlugin@QWebPage@@MAEPAVQObject@@ABVQString@@ABVQUrl@@ABVQStringList@@2@Z
?chooseFile@QWebPage@@MAE?AVQString@@PAVQWebFrame@@ABV2@@Z
?javaScriptAlert@QWebPage@@MAEXPAVQWebFrame@@ABVQString@@@Z
?javaScriptConfirm@QWebPage@@MAE_NPAVQWebFrame@@ABVQString@@@Z
?javaScriptPrompt@QWebPage@@MAE_NPAVQWebFrame@@ABVQString@@1PAV3@@Z
?javaScriptConsoleMessage@QWebPage@@MAEXABVQString@@H0@Z
?userAgentForUrl@QWebPage@@MBE?AVQString@@ABVQUrl@@@Z
??1QWebView@@UAE@XZ
?settings@QWebView@@QBEPAVQWebSettings@@XZ
?setPage@QWebView@@QAEXPAVQWebPage@@@Z
??0QWebView@@QAE@PAVQWidget@@@Z
?event@QWebView@@UAE_NPAVQEvent@@@Z
?sizeHint@QWebView@@UBE?AVQSize@@XZ
?mousePressEvent@QWebView@@MAEXPAVQMouseEvent@@@Z
?mouseReleaseEvent@QWebView@@MAEXPAVQMouseEvent@@@Z
?mouseDoubleClickEvent@QWebView@@MAEXPAVQMouseEvent@@@Z
?mouseMoveEvent@QWebView@@MAEXPAVQMouseEvent@@@Z
?wheelEvent@QWebView@@MAEXPAVQWheelEvent@@@Z
?keyPressEvent@QWebView@@MAEXPAVQKeyEvent@@@Z
?keyReleaseEvent@QWebView@@MAEXPAVQKeyEvent@@@Z
?focusInEvent@QWebView@@MAEXPAVQFocusEvent@@@Z
?focusOutEvent@QWebView@@MAEXPAVQFocusEvent@@@Z
?paintEvent@QWebView@@MAEXPAVQPaintEvent@@@Z
?resizeEvent@QWebView@@MAEXPAVQResizeEvent@@@Z
?contextMenuEvent@QWebView@@MAEXPAVQContextMenuEvent@@@Z
?dragEnterEvent@QWebView@@MAEXPAVQDragEnterEvent@@@Z
?dragMoveEvent@QWebView@@MAEXPAVQDragMoveEvent@@@Z
?dragLeaveEvent@QWebView@@MAEXPAVQDragLeaveEvent@@@Z
?dropEvent@QWebView@@MAEXPAVQDropEvent@@@Z
?changeEvent@QWebView@@MAEXPAVQEvent@@@Z
?inputMethodEvent@QWebView@@MAEXPAVQInputMethodEvent@@@Z
?inputMethodQuery@QWebView@@UBE?AVQVariant@@W4InputMethodQuery@Qt@@@Z
?focusNextPrevChild@QWebView@@MAE_N_N@Z
?createWindow@QWebView@@MAEPAV1@W4WebWindowType@QWebPage@@@Z
?setLinkDelegationPolicy@QWebPage@@QAEXW4LinkDelegationPolicy@1@@Z
?metaObject@QWebView@@UBEPBUQMetaObject@@XZ
?qt_metacast@QWebView@@UAEPAXPBD@Z
?qt_metacall@QWebView@@UAEHW4Call@QMetaObject@@HPAPAX@Z
?setHtml@QWebView@@QAEXABVQString@@ABVQUrl@@@Z
?qt_metacast@QWebPage@@UAEPAXPBD@Z
?qt_metacall@QWebPage@@UAEHW4Call@QMetaObject@@HPAPAX@Z
?staticMetaObject@QWebView@@2UQMetaObject@@B
?staticMetaObject@QWebPage@@2UQMetaObject@@B
Qt5WebKitWidgets.dll
?keyPressEvent@QWidget@@MAEXPAVQKeyEvent@@@Z
?keyReleaseEvent@QWidget@@MAEXPAVQKeyEvent@@@Z
?keyPressEvent@QLabel@@MAEXPAVQKeyEvent@@@Z
?keyPressEvent@QPushButton@@MAEXPAVQKeyEvent@@@Z
?keyReleaseEvent@QAbstractButton@@MAEXPAVQKeyEvent@@@Z
?keyPressEvent@QAbstractButton@@MAEXPAVQKeyEvent@@@Z
?keyPressEvent@QDialog@@MAEXPAVQKeyEvent@@@Z
?exec@QDialog@@UAEHXZ
?keyPressEvent@QLineEdit@@MAEXPAVQKeyEvent@@@Z
?viewport@QAbstractScrollArea@@QBEPAVQWidget@@XZ
?setAllColumnsShowFocus@QTreeView@@QAEX_N@Z
?keyPressEvent@QTabWidget@@MAEXPAVQKeyEvent@@@Z
?keyPressEvent@QAbstractItemView@@MAEXPAVQKeyEvent@@@Z
?setupViewport@QAbstractScrollArea@@UAEXPAVQWidget@@@Z
?viewportEvent@QAbstractItemView@@MAE_NPAVQEvent@@@Z
?viewportSizeHint@QTableView@@MBE?AVQSize@@XZ
?keyboardSearch@QAbstractItemView@@UAEXABVQString@@@Z
?moveCursor@QTableView@@MAE?AVQModelIndex@@W4CursorAction@QAbstractItemView@@V?$QFlags@W4KeyboardModifier@Qt@@@@@Z
?selectedIndexes@QTableView@@MBE?AV?$QList@VQModelIndex@@@@XZ
?keyPressEvent@QAbstractScrollArea@@MAEXPAVQKeyEvent@@@Z
?viewportEvent@QAbstractScrollArea@@MAE_NPAVQEvent@@@Z
?viewportSizeHint@QScrollArea@@MBE?AVQSize@@XZ
?keyPressEvent@QTreeView@@MAEXPAVQKeyEvent@@@Z
?viewportEvent@QTreeView@@MAE_NPAVQEvent@@@Z
?viewportSizeHint@QTreeView@@MBE?AVQSize@@XZ
?keyboardSearch@QTreeView@@UAEXABVQString@@@Z
?moveCursor@QTreeView@@MAE?AVQModelIndex@@W4CursorAction@QAbstractItemView@@V?$QFlags@W4KeyboardModifier@Qt@@@@@Z
?selectedIndexes@QTreeView@@MBE?AV?$QList@VQModelIndex@@@@XZ
?supportedDropActions@QTreeWidget@@MBE?AV?$QFlags@W4DropAction@Qt@@@@XZ
?keyPressEvent@QMenu@@MAEXPAVQKeyEvent@@@Z
?viewportSizeHint@QListView@@MBE?AVQSize@@XZ
?moveCursor@QListView@@MAE?AVQModelIndex@@W4CursorAction@QAbstractItemView@@V?$QFlags@W4KeyboardModifier@Qt@@@@@Z
?selectedIndexes@QListView@@MBE?AV?$QList@VQModelIndex@@@@XZ
?keyPressEvent@QTextEdit@@MAEXPAVQKeyEvent@@@Z
?keyReleaseEvent@QTextEdit@@MAEXPAVQKeyEvent@@@Z
?viewportSizeHint@QAbstractScrollArea@@MBE?AVQSize@@XZ
?loadResource@QTextEdit@@UAE?AVQVariant@@HABVQUrl@@@Z
?keyPressEvent@QTextBrowser@@MAEXPAVQKeyEvent@@@Z
?loadResource@QTextBrowser@@UAE?AVQVariant@@HABVQUrl@@@Z
?setSource@QTextBrowser@@UAEXABVQUrl@@@Z
?exec@QMenu@@QAEPAVQAction@@ABVQPoint@@PAV2@@Z
?addAction@QMenu@@QAEPAVQAction@@ABVQString@@PBVQObject@@PBDABVQKeySequence@@@Z
?keyPressEvent@QPlainTextEdit@@MAEXPAVQKeyEvent@@@Z
?keyReleaseEvent@QPlainTextEdit@@MAEXPAVQKeyEvent@@@Z
?loadResource@QPlainTextEdit@@UAE?AVQVariant@@HABVQUrl@@@Z
?keyPressEvent@QAbstractSlider@@MAEXPAVQKeyEvent@@@Z
?viewportSizeHint@QAbstractItemView@@MBE?AVQSize@@XZ
?selectedIndexes@QAbstractItemView@@MBE?AV?$QList@VQModelIndex@@@@XZ
?keyPressEvent@QComboBox@@MAEXPAVQKeyEvent@@@Z
?keyReleaseEvent@QComboBox@@MAEXPAVQKeyEvent@@@Z
??0QShortcut@@QAE@ABVQKeySequence@@PAVQWidget@@PBD2W4ShortcutContext@Qt@@@Z
D!?windowState@QWidget@@QBE?AV?$QFlags@W4WindowState@Qt@@@@XZ
?setWindowState@QWidget@@QAEXV?$QFlags@W4WindowState@Qt@@@@@Z
?addAction@QMenu@@QAEPAVQAction@@ABVQIcon@@ABVQString@@PBVQObject@@PBDABVQKeySequence@@@Z
?exec@QApplication@@SAHXZ
?viewportEvent@QHeaderView@@MAE_NPAVQEvent@@@Z
?moveCursor@QHeaderView@@MAE?AVQModelIndex@@W4CursorAction@QAbstractItemView@@V?$QFlags@W4KeyboardModifier@Qt@@@@@Z
?keyPressEvent@QTabBar@@MAEXPAVQKeyEvent@@@Z
?keyPressEvent@QAbstractSpinBox@@MAEXPAVQKeyEvent@@@Z
?keyReleaseEvent@QAbstractSpinBox@@MAEXPAVQKeyEvent@@@Z
?sectionViewportPosition@QHeaderView@@QBEHH@Z
Qt5Widgets.dll
?setAttribute@QWebSettings@@QAEXW4WebAttribute@1@_N@Z
??1QWebElement@@QAE@XZ
?isNull@QWebElement@@QBE_NXZ
?setLocalStoragePath@QWebSettings@@QAEXABVQString@@@Z
?attribute@QWebElement@@QBE?AVQString@@ABV2@0@Z
?hasAttribute@QWebElement@@QBE_NABVQString@@@Z
?geometry@QWebElement@@QBE?AVQRect@@XZ
Qt5WebKit.dll
Qt5WinExtras.dll
A?openUrl@QDesktopServices@@SA_NABVQUrl@@@Z
??1QKeySequence@@QAE@XZ
??0QKeySequence@@QAE@HHHH@Z
??0QPen@@QAE@ABVQBrush@@NW4PenStyle@Qt@@W4PenCapStyle@3@W4PenJoinStyle@3@@Z
2F?setClipRect@QPainter@@QAEXABVQRect@@W4ClipOperation@Qt@@@Z
J?supportedDropActions@QStandardItemModel@@UBE?AV?$QFlags@W4DropAction@Qt@@@@XZ
AI?setUrlHandler@QDesktopServices@@SAXABVQString@@PAVQObject@@PBD@Z
??0QKeySequence@@QAE@W4StandardKey@0@@Z
dA?modifiers@QKeyEvent@@QBE?AV?$QFlags@W4KeyboardModifier@Qt@@@@XZ
@?matches@QKeyEvent@@QBE_NW4StandardKey@QKeySequence@@@Z
Qt5Gui.dll
?cookiesForUrl@QNetworkCookieJar@@UBE?AV?$QList@VQNetworkCookie@@@@ABVQUrl@@@Z
?validateCookie@QNetworkCookieJar@@MBE_NABVQNetworkCookie@@ABVQUrl@@@Z
?url@QNetworkReply@@QBE?AVQUrl@@XZ
??0QNetworkRequest@@QAE@ABVQUrl@@@Z
?createRequest@QNetworkAccessManager@@MAEPAVQNetworkReply@@W4Operation@1@ABVQNetworkRequest@@PAVQIODevice@@@Z
?url@QNetworkRequest@@QBE?AVQUrl@@XZ
??0QTcpServer@@QAE@PAVQObject@@@Z
?hasPendingConnections@QTcpServer@@UBE_NXZ
?nextPendingConnection@QTcpServer@@UAEPAVQTcpSocket@@XZ
??1QTcpServer@@UAE@XZ
?listen@QTcpServer@@QAE_NABVQHostAddress@@G@Z
?metaObject@QTcpServer@@UBEPBUQMetaObject@@XZ
?qt_metacast@QTcpServer@@UAEPAXPBD@Z
?qt_metacall@QTcpServer@@UAEHW4Call@QMetaObject@@HPAPAX@Z
?incomingConnection@QTcpServer@@MAEXH@Z
?isListening@QTcpServer@@QBE_NXZ
?close@QTcpServer@@QAEXXZ
?serverPort@QTcpServer@@QBEGXZ
??0QSslCertificate@@QAE@ABV0@@Z
??1QSslCertificate@@QAE@XZ
?addPendingConnection@QTcpServer@@IAEXPAVQTcpSocket@@@Z
?setCaCertificates@QSslSocket@@QAEXABV?$QList@VQSslCertificate@@@@@Z
?setLocalCertificateChain@QSslSocket@@QAEXABV?$QList@VQSslCertificate@@@@@Z
??0QSslCertificate@@QAE@ABVQByteArray@@W4EncodingFormat@QSsl@@@Z
?setPrivateKey@QSslSocket@@QAEXABVQString@@W4KeyAlgorithm@QSsl@@W4EncodingFormat@4@ABVQByteArray@@@Z
?staticMetaObject@QTcpServer@@2UQMetaObject@@B
?peerPort@QAbstractSocket@@QBEGXZ
?setUrl@QNetworkRequest@@QAEXABVQUrl@@@Z
?setPassword@QNetworkProxy@@QAEXABVQString@@@Z
?setPort@QNetworkProxy@@QAEXG@Z
?port@QNetworkProxy@@QBEGXZ
?setCookiesFromUrl@QNetworkCookieJar@@UAE_NABV?$QList@VQNetworkCookie@@@@ABVQUrl@@@Z
Qt5Network.dll
Qt5Xml.dll
??1QUrl@@QAE@XZ
??0QUrl@@QAE@ABVQString@@W4ParsingMode@0@@Z
?reportStarted@QFutureInterfaceBase@@QAEXXZ
?reportFinished@QFutureInterfaceBase@@QAEXXZ
?reportException@QFutureInterfaceBase@@QAEXABVQException@@@Z
?QStringList_join@QtPrivate@@YA?AVQString@@PBVQStringList@@PBVQChar@@H@Z
?toPercentEncoding@QUrl@@SA?AVQByteArray@@ABVQString@@ABV2@1@Z
?exec@QEventLoop@@QAEHV?$QFlags@W4ProcessEventsFlag@QEventLoop@@@@@Z
?toString@QUrl@@QBE?AVQString@@V?$QUrlTwoFlags@W4UrlFormattingOption@QUrl@@W4ComponentFormattingOption@2@@@@Z
?supportedDropActions@QSortFilterProxyModel@@UBE?AV?$QFlags@W4DropAction@Qt@@@@XZ
?supportedDragActions@QAbstractProxyModel@@UBE?AV?$QFlags@W4DropAction@Qt@@@@XZ
?supportedDropActions@QAbstractItemModel@@UBE?AV?$QFlags@W4DropAction@Qt@@@@XZ
?supportedDragActions@QAbstractItemModel@@UBE?AV?$QFlags@W4DropAction@Qt@@@@XZ
?isValid@QUrl@@QBE_NXZ
?selectedIndexes@QItemSelectionModel@@QBE?AV?$QList@VQModelIndex@@@@XZ
??1QUrlQuery@@QAE@XZ
?setQuery@QUrl@@QAEXABVQUrlQuery@@@Z
?addQueryItem@QUrlQuery@@QAEXABVQString@@0@Z
??0QUrlQuery@@QAE@XZ
??0QUrl@@QAE@ABV0@@Z
?isEmpty@QUrl@@QBE_NXZ
??4QUrl@@QAEAAV0@ABVQString@@@Z
??0QUrl@@QAE@XZ
?indexes@QItemSelection@@QBE?AV?$QList@VQModelIndex@@@@XZ
?isRelative@QUrl@@QBE_NXZ
?hasShrunk@QHashData@@QAEXXZ
?host@QUrl@@QBE?AVQString@@V?$QFlags@W4ComponentFormattingOption@QUrl@@@@@Z
?fromPercentEncoding@QUrl@@SA?AVQString@@ABVQByteArray@@@Z
??6@YA?AVQDebug@@V0@ABVQUrl@@@Z
?toLocalFile@QUrl@@QBE?AVQString@@XZ
?urls@QMimeData@@QBE?AV?$QList@VQUrl@@@@XZ
?scheme@QUrl@@QBE?AVQString@@XZ
?hasUrls@QMimeData@@QBE_NXZ
??4QUrl@@QAEAAV0@ABV0@@Z
?setPath@QUrl@@QAEXABVQString@@W4ParsingMode@1@@Z
?setAuthority@QUrl@@QAEXABVQString@@W4ParsingMode@1@@Z
?execute@QProcess@@SAHABVQString@@@Z
?WindowsVersion@QSysInfo@@2W4WinVersion@1@B
?allKeys@QSettings@@QBE?AVQStringList@@XZ
?qInstallMessageHandler@@YAP6AXW4QtMsgType@@ABVQMessageLogContext@@ABVQString@@@ZP6AX012@Z@Z
?toEncoded@QUrl@@QBE?AVQByteArray@@V?$QUrlTwoFlags@W4UrlFormattingOption@QUrl@@W4ComponentFormattingOption@2@@@@Z
?setUrl@QUrl@@QAEXABVQString@@W4ParsingMode@1@@Z
?fromEncoded@QUrl@@SA?AV1@ABVQByteArray@@W4ParsingMode@1@@Z
?port@QUrl@@QBEHH@Z
?path@QUrl@@QBE?AVQString@@V?$QFlags@W4ComponentFormattingOption@QUrl@@@@@Z
?toUrl@QVariant@@QBE?AVQUrl@@XZ
?childKeys@QSettings@@QBE?AVQStringList@@XZ
Qt5Core.dll
MSVCR100.dll
_amsg_exit
_acmdln
_crt_debugger_hook
WaitNamedPipeW
TransactNamedPipe
SetNamedPipeHandleState
GetProcessHeap
SetThreadExecutionState
CreateIoCompletionPort
KERNEL32.dll
ole32.dll
OLEAUT32.dll
WS2_32.dll
MSWSOCK.dll
libvlc.dll
mediaget.exe
??0character_size@serial_port_base@asio@boost@@QAE@I@Z
??0flow_control@serial_port_base@asio@boost@@QAE@W4type@0123@@Z
??0parity@serial_port_base@asio@boost@@QAE@W4type@0123@@Z
??0stop_bits@serial_port_base@asio@boost@@QAE@W4type@0123@@Z
??0win_iocp_serial_port_service@detail@asio@boost@@QAE@AAVio_service@23@@Z
??_Fcharacter_size@serial_port_base@asio@boost@@QAEXXZ
??_Fflow_control@serial_port_base@asio@boost@@QAEXXZ
??_Fparity@serial_port_base@asio@boost@@QAEXXZ
??_Fstop_bits@serial_port_base@asio@boost@@QAEXXZ
?abandon_operations@win_iocp_io_service@detail@asio@boost@@QAEXAAV?$op_queue@Vwin_iocp_operation@detail@asio@boost@@@234@@Z
?add_certificate_authority@context@ssl@asio@boost@@QAE?AVerror_code@system@4@ABVconst_buffer@34@AAV564@@Z
?add_certificate_authority@context@ssl@asio@boost@@QAEXABVconst_buffer@34@@Z
?cancel_timer@?$timer_queue@U?$time_traits@Vptime@posix_time@boost@@@asio@boost@@@detail@asio@boost@@QAEIAAVper_timer_data@?$timer_queue@Uforwarding_posix_time_traits@detail@asio@boost@@@234@AAV?$op_queue@Vwin_iocp_operation@detail@asio@boost@@@234@I@Z
?complete_iocp_recvmsg@socket_ops@detail@asio@boost@@YAXABV?$weak_ptr@X@tr1@std@@AAVerror_code@system@4@@Z
?do_add_service@service_registry@detail@asio@boost@@AAEXABUkey@service@io_service@34@PAV6734@@Z
?do_complete@strand_service@detail@asio@boost@@CAXPAVwin_iocp_io_service@234@PAVwin_iocp_operation@234@ABVerror_code@system@4@I@Z
?do_dispatch@strand_service@detail@asio@boost@@AAE_NAAPAVstrand_impl@1234@PAVwin_iocp_operation@234@@Z
?do_get_option@win_iocp_serial_port_service@detail@asio@boost@@ABE?AVerror_code@system@4@ABVimplementation_type@win_iocp_handle_service@234@P6A?AV564@PAXABU_DCB@@AAV564@@Z13@Z
?do_has_service@service_registry@detail@asio@boost@@ABE_NABUkey@service@io_service@34@@Z
?do_post@strand_service@detail@asio@boost@@AAEXAAPAVstrand_impl@1234@PAVwin_iocp_operation@234@_N@Z
?do_set_option@win_iocp_serial_port_service@detail@asio@boost@@AAE?AVerror_code@system@4@AAVimplementation_type@win_iocp_handle_service@234@P6A?AV564@PBXAAU_DCB@@AAV564@@Z13@Z
?do_set_password_callback@context@ssl@asio@boost@@AAE?AVerror_code@system@4@PAVpassword_callback_base@detail@234@AAV564@@Z
?do_use_service@service_registry@detail@asio@boost@@AAEPAVservice@io_service@34@ABUkey@5634@P6APAV5634@AAV634@@Z@Z
?get_all_timers@?$timer_queue@U?$time_traits@Vptime@posix_time@boost@@@asio@boost@@@detail@asio@boost@@UAEXAAV?$op_queue@Vwin_iocp_operation@detail@asio@boost@@@234@@Z
?get_all_timers@timer_queue_set@detail@asio@boost@@QAEXAAV?$op_queue@Vwin_iocp_operation@detail@asio@boost@@@234@@Z
?get_ready_timers@?$timer_queue@U?$time_traits@Vptime@posix_time@boost@@@asio@boost@@@detail@asio@boost@@UAEXAAV?$op_queue@Vwin_iocp_operation@detail@asio@boost@@@234@@Z
?get_ready_timers@timer_queue_set@detail@asio@boost@@QAEXAAV?$op_queue@Vwin_iocp_operation@detail@asio@boost@@@234@@Z
?init_key@service_registry@detail@asio@boost@@CAXAAUkey@service@io_service@34@ABVid@734@@Z
?join@win_thread@detail@asio@boost@@QAEXXZ
?keys_match@service_registry@detail@asio@boost@@CA_NABUkey@service@io_service@34@0@Z
?load@baud_rate@serial_port_base@asio@boost@@QAE?AVerror_code@system@4@ABU_DCB@@AAV564@@Z
?load@character_size@serial_port_base@asio@boost@@QAE?AVerror_code@system@4@ABU_DCB@@AAV564@@Z
?load@flow_control@serial_port_base@asio@boost@@QAE?AVerror_code@system@4@ABU_DCB@@AAV564@@Z
?load@parity@serial_port_base@asio@boost@@QAE?AVerror_code@system@4@ABU_DCB@@AAV564@@Z
?load@stop_bits@serial_port_base@asio@boost@@QAE?AVerror_code@system@4@ABU_DCB@@AAV564@@Z
?on_completion@win_iocp_io_service@detail@asio@boost@@QAEXPAVwin_iocp_operation@234@ABVerror_code@system@4@K@Z
?on_completion@win_iocp_io_service@detail@asio@boost@@QAEXPAVwin_iocp_operation@234@KK@Z
?on_pending@win_iocp_io_service@detail@asio@boost@@QAEXPAVwin_iocp_operation@234@@Z
?open@win_iocp_serial_port_service@detail@asio@boost@@QAE?AVerror_code@system@4@AAVimplementation_type@win_iocp_handle_service@234@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV564@@Z
?password_callback_function@context@ssl@asio@boost@@CAHPADHHPAX@Z
?port@endpoint@detail@ip@asio@boost@@QAEXG@Z
?port@endpoint@detail@ip@asio@boost@@QBEGXZ
?post_deferred_completion@win_iocp_io_service@detail@asio@boost@@QAEXPAVwin_iocp_operation@234@@Z
?post_deferred_completions@win_iocp_io_service@detail@asio@boost@@QAEXAAV?$op_queue@Vwin_iocp_operation@detail@asio@boost@@@234@@Z
?recvmsg@socket_ops@detail@asio@boost@@YAHIPAU_WSABUF@@IHAAHAAVerror_code@system@4@@Z
?restart_accept_op@win_iocp_socket_service_base@detail@asio@boost@@QAEXIAAVsocket_holder@234@HHHPAXKPAVwin_iocp_operation@234@@Z
?run@select_reactor@detail@asio@boost@@QAEX_NAAV?$op_queue@Vwin_iocp_operation@detail@asio@boost@@@234@@Z
?shutdown_service@win_iocp_serial_port_service@detail@asio@boost@@QAEXXZ
?start_accept_op@win_iocp_socket_service_base@detail@asio@boost@@IAEXAAUbase_implementation_type@1234@_NAAVsocket_holder@234@HHHPAXKPAVwin_iocp_operation@234@@Z
?start_read_op@win_iocp_handle_service@detail@asio@boost@@AAEXAAVimplementation_type@1234@_KABVmutable_buffer@34@PAVwin_iocp_operation@234@@Z
?start_receive_from_op@win_iocp_socket_service_base@detail@asio@boost@@IAEXAAUbase_implementation_type@1234@PAU_WSABUF@@IPAUsockaddr@@HPAHPAVwin_iocp_operation@234@@Z
?start_receive_op@win_iocp_socket_service_base@detail@asio@boost@@IAEXAAUbase_implementation_type@1234@PAU_WSABUF@@IH_NPAVwin_iocp_operation@234@@Z
?start_resolve_op@resolver_service_base@detail@asio@boost@@IAEXPAVwin_iocp_operation@234@@Z
?start_send_op@win_iocp_socket_service_base@detail@asio@boost@@IAEXAAUbase_implementation_type@1234@PAU_WSABUF@@IH_NPAVwin_iocp_operation@234@@Z
?start_send_to_op@win_iocp_socket_service_base@detail@asio@boost@@IAEXAAUbase_implementation_type@1234@PAU_WSABUF@@IPBUsockaddr@@HHPAVwin_iocp_operation@234@@Z
?start_write_op@win_iocp_handle_service@detail@asio@boost@@AAEXAAVimplementation_type@1234@_KABVconst_buffer@34@PAVwin_iocp_operation@234@@Z
?store@baud_rate@serial_port_base@asio@boost@@QBE?AVerror_code@system@4@AAU_DCB@@AAV564@@Z
?store@character_size@serial_port_base@asio@boost@@QBE?AVerror_code@system@4@AAU_DCB@@AAV564@@Z
?store@flow_control@serial_port_base@asio@boost@@QBE?AVerror_code@system@4@AAU_DCB@@AAV564@@Z
?store@parity@serial_port_base@asio@boost@@QBE?AVerror_code@system@4@AAU_DCB@@AAV564@@Z
?store@stop_bits@serial_port_base@asio@boost@@QBE?AVerror_code@system@4@AAU_DCB@@AAV564@@Z
?sync_recvmsg@socket_ops@detail@asio@boost@@YAIIEPAU_WSABUF@@IHAAHAAVerror_code@system@4@@Z
?use_certificate@context@ssl@asio@boost@@QAE?AVerror_code@system@4@ABVconst_buffer@34@W4file_format@context_base@234@AAV564@@Z
?use_certificate@context@ssl@asio@boost@@QAEXABVconst_buffer@34@W4file_format@context_base@234@@Z
?use_certificate_chain@context@ssl@asio@boost@@QAE?AVerror_code@system@4@ABVconst_buffer@34@AAV564@@Z
?use_certificate_chain@context@ssl@asio@boost@@QAEXABVconst_buffer@34@@Z
?use_certificate_chain_file@context@ssl@asio@boost@@QAE?AVerror_code@system@4@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV564@@Z
?use_certificate_chain_file@context@ssl@asio@boost@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?use_certificate_file@context@ssl@asio@boost@@QAE?AVerror_code@system@4@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4file_format@context_base@234@AAV564@@Z
?use_certificate_file@context@ssl@asio@boost@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4file_format@context_base@234@@Z
?use_private_key@context@ssl@asio@boost@@QAE?AVerror_code@system@4@ABVconst_buffer@34@W4file_format@context_base@234@AAV564@@Z
?use_private_key@context@ssl@asio@boost@@QAEXABVconst_buffer@34@W4file_format@context_base@234@@Z
?use_private_key_file@context@ssl@asio@boost@@QAE?AVerror_code@system@4@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4file_format@context_base@234@AAV564@@Z
?use_private_key_file@context@ssl@asio@boost@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4file_format@context_base@234@@Z
?use_rsa_private_key@context@ssl@asio@boost@@QAE?AVerror_code@system@4@ABVconst_buffer@34@W4file_format@context_base@234@AAV564@@Z
?use_rsa_private_key@context@ssl@asio@boost@@QAEXABVconst_buffer@34@W4file_format@context_base@234@@Z
?use_rsa_private_key_file@context@ssl@asio@boost@@QAE?AVerror_code@system@4@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4file_format@context_base@234@AAV564@@Z
?use_rsa_private_key_file@context@ssl@asio@boost@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4file_format@context_base@234@@Z
.?AVMainwindowShowEventEntry@@
.?AVVkLoginStarted@@
.?AVVkLoginOkay@@
.?AVLoginInfoDialog@@
.?AVImageServerChangeUrlParser@@
.?AVPopUpImagesShow@@
.?AVQKeyEvent@@
.?AVMediagetJSObject@WebcatHelper@@
.?AVWebCatalogueAll@@
.?AVWebBrowser@WebcatHelper@@
.?AVWebcatWebPage@WebcatHelper@@
.?AVQWebPage@@
.?AVQWebView@@
.?AVWebBrowserHelper@WebcatHelper@@
.?AVWebPopupWindow@WebcatHelper@@
.?AVWebCatalogueSettings@@
.?AVWebCatalogueViewAll@@
.?AVWebcatTrayAlerter@@
.?AVWebCatalogHelper@@
.?AVMediagetUTorrentExportSetting@@
.?AVuTorrentExportManager@@
.?AVuTorrentExport@@
dp.gx.
.?AVQTcpServer@@
.?AVQHttpServer@@
.?AVQTcpSocket@@
.?AVQHttpResponse@@
.?AVQHttpRequest@@
.?AVQHttpConnection@@
.?AVToolbarWebserver@@
.?AVToolbarChromeInstaller@@
.?AVUrlHandler@@
.?AUportmap_error_alert@libtorrent@@
.?AUportmap_alert@libtorrent@@
.?AVWebDownload@@
.?AVAddUrlDialogSettings@@
.?AVAddUrlDialog@@
.?AVWebAddDialog@@
.?AVUrlShortener@@
.?AVDeliciousShare@@
dp.gpW
dp.gh
dp.gL
dp.gp
dp.gP
dp.gx
dp.gH
dp.gD-
dp.gH5
dp.gL7
dp.gpN
dp.gTo
dp.gxu
.?AV?$bind_t@V?$set@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@std@@V?$cmf1@V?$set@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@std@@Vtorrent@libtorrent@@W4type_t@web_seed_entry@4@@_mfi@boost@@V?$list2@V?$value@V?$shared_ptr@Vtorrent@libtorrent@@@boost@@@_bi@boost@@V?$value@W4type_t@web_seed_entry@libtorrent@@@23@@_bi@5@@_bi@boost@@
.?AUhttp_error_category@libtorrent@@
.?AVpassword_callback_base@detail@ssl@asio@boost@@
.?AV?$typeid_wrapper@V?$resolver_service@Vtcp@ip@asio@boost@@@ip@asio@boost@@@detail@asio@boost@@
.?AV?$sp_counted_impl_p@Uhttp_connection@libtorrent@@@detail@boost@@
.?AV?$service_base@V?$resolver_service@Vtcp@ip@asio@boost@@@ip@asio@boost@@@detail@asio@boost@@
.?AV?$_Ref_count@V?$vector@V?$basic_resolver_entry@Vtcp@ip@asio@boost@@@ip@asio@boost@@V?$allocator@V?$basic_resolver_entry@Vtcp@ip@asio@boost@@@ip@asio@boost@@@std@@@std@@@tr1@std@@
.?AV?$resolver_service@Vtcp@ip@asio@boost@@@ip@asio@boost@@
.?AV?$bind_t@XP6AXV?$weak_ptr@Vtorrent@libtorrent@@@boost@@ABV?$vector@V?$basic_endpoint@Vtcp@ip@asio@boost@@@ip@asio@boost@@V?$allocator@V?$basic_endpoint@Vtcp@ip@asio@boost@@@ip@asio@boost@@@std@@@std@@@ZV?$list2@V?$value@V?$weak_ptr@Vtorrent@libtorrent@@@boost@@@_bi@boost@@U?$arg@$00@3@@_bi@2@@_bi@boost@@
.?AV?$password_callback@V?$bind_t@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@P6A?AV12@HW4password_purpose@context_base@ssl@asio@boost@@V12@@ZV?$list3@U?$arg@$00@boost@@U?$arg@$01@2@V?$value@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@_bi@2@@_bi@7@@_bi@boost@@@detail@ssl@asio@boost@@
.?AV?$bind_t@XV?$mf4@XVtorrent@libtorrent@@ABVerror_code@system@boost@@ABVhttp_parser@2@PBDH@_mfi@boost@@V?$list5@V?$value@V?$shared_ptr@Vtorrent@libtorrent@@@boost@@@_bi@boost@@U?$arg@$00@3@U?$arg@$01@3@U?$arg@$02@3@U?$arg@$03@3@@_bi@3@@_bi@boost@@
.?AUudp_socket_observer@libtorrent@@
.?AV?$typeid_wrapper@V?$socket_acceptor_service@Vtcp@ip@asio@boost@@@asio@boost@@@detail@asio@boost@@
.?AV?$service_base@V?$socket_acceptor_service@Vtcp@ip@asio@boost@@@asio@boost@@@detail@asio@boost@@
.?AV?$bind_t@XV?$mf2@XUsession_impl@aux@libtorrent@@V?$basic_endpoint@Vtcp@ip@asio@boost@@@ip@asio@boost@@ABVsha1_hash@3@@_mfi@boost@@V?$list3@V?$value@PAUsession_impl@aux@libtorrent@@@_bi@boost@@U?$arg@$00@3@U?$arg@$01@3@@_bi@3@@_bi@boost@@
.?AV?$sp_counted_impl_p@V?$basic_socket_acceptor@Vtcp@ip@asio@boost@@V?$socket_acceptor_service@Vtcp@ip@asio@boost@@@34@@asio@boost@@@detail@boost@@
.?AV?$socket_acceptor_service@Vtcp@ip@asio@boost@@@asio@boost@@
.?AV?$typeid_wrapper@V?$stream_socket_service@Vtcp@ip@asio@boost@@@asio@boost@@@detail@asio@boost@@
.?AV?$service_base@V?$stream_socket_service@Vtcp@ip@asio@boost@@@asio@boost@@@detail@asio@boost@@
.?AV?$stream_socket_service@Vtcp@ip@asio@boost@@@asio@boost@@
.?AV?$bind_t@XV?$mf2@XV?$ssl_stream@Vhttp_stream@libtorrent@@@libtorrent@@ABVerror_code@system@boost@@V?$shared_ptr@V?$function@$$A6AXABVerror_code@system@boost@@@Z@boost@@@5@@_mfi@boost@@V?$list3@V?$value@PAV?$ssl_stream@Vhttp_stream@libtorrent@@@libtorrent@@@_bi@boost@@U?$arg@$00@3@V?$value@V?$shared_ptr@V?$function@$$A6AXABVerror_code@system@boost@@@Z@boost@@@boost@@@23@@_bi@3@@_bi@boost@@
.?AV?$typeid_wrapper@V?$datagram_socket_service@Vudp@ip@asio@boost@@@asio@boost@@@detail@asio@boost@@
.?AV?$sp_counted_impl_p@V?$basic_datagram_socket@Vudp@ip@asio@boost@@V?$datagram_socket_service@Vudp@ip@asio@boost@@@34@@asio@boost@@@detail@boost@@
.?AV?$service_base@V?$datagram_socket_service@Vudp@ip@asio@boost@@@asio@boost@@@detail@asio@boost@@
.?AV?$datagram_socket_service@Vudp@ip@asio@boost@@@asio@boost@@
.?AUudp_error_alert@libtorrent@@
.?AUtorrent_need_cert_alert@libtorrent@@
.?AUurl_seed_alert@libtorrent@@
.?AUportmap_log_alert@libtorrent@@
.?AV?$bind_t@XV?$mf0@XUhttp_connection@libtorrent@@@_mfi@boost@@V?$list1@V?$value@V?$shared_ptr@Uhttp_connection@libtorrent@@@boost@@@_bi@boost@@@_bi@3@@_bi@boost@@
.?AV?$bind_t@XV?$mf2@XUhttp_connection@libtorrent@@ABVerror_code@system@boost@@I@_mfi@boost@@V?$list3@V?$value@V?$shared_ptr@Uhttp_connection@libtorrent@@@boost@@@_bi@boost@@U?$arg@$00@3@U?$arg@$01@3@@_bi@3@@_bi@boost@@
.?AV?$io_op@Vutp_stream@libtorrent@@V?$read_op@Vmutable_buffers_1@asio@boost@@@detail@ssl@asio@boost@@V?$bind_t@XV?$mf2@XUhttp_connection@libtorrent@@ABVerror_code@system@boost@@I@_mfi@boost@@V?$list3@V?$value@V?$shared_ptr@Uhttp_connection@libtorrent@@@boost@@@_bi@boost@@U?$arg@$00@3@U?$arg@$01@3@@_bi@3@@_bi@7@@detail@ssl@asio@boost@@
.?AV?$write_op@Vutp_stream@libtorrent@@Vmutable_buffers_1@asio@boost@@Vtransfer_all_t@detail@45@V?$io_op@Vutp_stream@libtorrent@@V?$read_op@Vmutable_buffers_1@asio@boost@@@detail@ssl@asio@boost@@V?$bind_t@XV?$mf2@XUhttp_connection@libtorrent@@ABVerror_code@system@boost@@I@_mfi@boost@@V?$list3@V?$value@V?$shared_ptr@Uhttp_connection@libtorrent@@@boost@@@_bi@boost@@U?$arg@$00@3@U?$arg@$01@3@@_bi@3@@_bi@7@@7ssl@45@@detail@asio@boost@@
.?AV?$bind_t@XV?$mf2@XUhttp_connection@libtorrent@@HV?$basic_endpoint@Vtcp@ip@asio@boost@@@ip@asio@boost@@@_mfi@boost@@V?$list3@V?$value@V?$shared_ptr@Uhttp_connection@libtorrent@@@boost@@@_bi@boost@@U?$arg@$00@3@V?$value@V?$basic_endpoint@Vtcp@ip@asio@boost@@@ip@asio@boost@@@23@@_bi@3@@_bi@boost@@
.?AV?$bind_t@XV?$mf2@XUhttp_connection@libtorrent@@ABVerror_code@system@boost@@PBD@_mfi@boost@@V?$list3@V?$value@V?$shared_ptr@Uhttp_connection@libtorrent@@@boost@@@_bi@boost@@U?$arg@$00@3@U?$arg@$01@3@@_bi@3@@_bi@boost@@
.?AV?$bind_t@XV?$mf1@XUhttp_connection@libtorrent@@ABVerror_code@system@boost@@@_mfi@boost@@V?$list2@V?$value@V?$shared_ptr@Uhttp_connection@libtorrent@@@boost@@@_bi@boost@@U?$arg@$00@3@@_bi@3@@_bi@boost@@
.?AV?$write_op@Usocket_type@libtorrent@@Vconst_buffers_1@asio@boost@@Vtransfer_all_t@detail@45@V?$bind_t@XV?$mf1@XUhttp_connection@libtorrent@@ABVerror_code@system@boost@@@_mfi@boost@@V?$list2@V?$value@V?$shared_ptr@Uhttp_connection@libtorrent@@@boost@@@_bi@boost@@U?$arg@$00@3@@_bi@3@@_bi@5@@detail@asio@boost@@
.?AV?$io_op@Vutp_stream@libtorrent@@V?$write_op@Vconst_buffers_1@asio@boost@@@detail@ssl@asio@boost@@V?$write_op@Usocket_type@libtorrent@@Vconst_buffers_1@asio@boost@@Vtransfer_all_t@detail@45@V?$bind_t@XV?$mf1@XUhttp_connection@libtorrent@@ABVerror_code@system@boost@@@_mfi@boost@@V?$list2@V?$value@V?$shared_ptr@Uhttp_connection@libtorrent@@@boost@@@_bi@boost@@U?$arg@$00@3@@_bi@3@@_bi@5@@467@@detail@ssl@asio@boost@@
.?AV?$write_op@Vutp_stream@libtorrent@@Vmutable_buffers_1@asio@boost@@Vtransfer_all_t@detail@45@V?$io_op@Vutp_stream@libtorrent@@V?$write_op@Vconst_buffers_1@asio@boost@@@detail@ssl@asio@boost@@V?$write_op@Usocket_type@libtorrent@@Vconst_buffers_1@asio@boost@@Vtransfer_all_t@detail@45@V?$bind_t@XV?$mf1@XUhttp_connection@libtorrent@@ABVerror_code@system@boost@@@_mfi@boost@@V?$list2@V?$value@V?$shared_ptr@Uhttp_connection@libtorrent@@@boost@@@_bi@boost@@U?$arg@$00@3@@_bi@3@@_bi@5@@467@@7ssl@45@@detail@asio@boost@@
.?AUudp_socket_interface@dht@libtorrent@@
.?AV?$typeid_wrapper@V?$resolver_service@Vudp@ip@asio@boost@@@ip@asio@boost@@@detail@asio@boost@@
.?AV?$service_base@V?$resolver_service@Vudp@ip@asio@boost@@@ip@asio@boost@@@detail@asio@boost@@
.?AV?$_Ref_count@V?$vector@V?$basic_resolver_entry@Vudp@ip@asio@boost@@@ip@asio@boost@@V?$allocator@V?$basic_resolver_entry@Vudp@ip@asio@boost@@@ip@asio@boost@@@std@@@std@@@tr1@std@@
.?AV?$resolver_service@Vudp@ip@asio@boost@@@ip@asio@boost@@
.?AVhttp_seed_connection@libtorrent@@
.?AVweb_connection_base@libtorrent@@
.?AVweb_peer_connection@libtorrent@@
.?AV?$bind_t@XV?$mf1@XVudp_socket@libtorrent@@H@_mfi@boost@@V?$list2@V?$value@PAVudp_socket@libtorrent@@@_bi@boost@@U?$arg@$00@3@@_bi@3@@_bi@boost@@
.?AV?$bind_t@XV?$mf0@XVudp_socket@libtorrent@@@_mfi@boost@@V?$list1@V?$value@PAVudp_socket@libtorrent@@@_bi@boost@@@_bi@3@@_bi@boost@@
.?AV?$bind_t@XV?$mf3@XVupnp@libtorrent@@AAUhttp_connection@2@AAUrootdevice@12@H@_mfi@boost@@V?$list4@V?$value@V?$intrusive_ptr@Vupnp@libtorrent@@@boost@@@_bi@boost@@U?$arg@$00@3@V?$reference_wrapper@Urootdevice@upnp@libtorrent@@@3@V?$value@H@23@@_bi@3@@_bi@boost@@
.?AV?$bind_t@XV?$mf3@XVupnp@libtorrent@@ABV?$basic_endpoint@Vudp@ip@asio@boost@@@ip@asio@boost@@PADI@_mfi@boost@@V?$list4@V?$value@V?$intrusive_ptr@Vupnp@libtorrent@@@boost@@@_bi@boost@@U?$arg@$00@3@U?$arg@$01@3@U?$arg@$02@3@@_bi@3@@_bi@boost@@
.?AV?$bind_t@XV?$mf4@XVupnp@libtorrent@@ABVerror_code@system@boost@@ABVhttp_parser@2@AAUrootdevice@12@AAUhttp_connection@2@@_mfi@boost@@V?$list5@V?$value@V?$intrusive_ptr@Vupnp@libtorrent@@@boost@@@_bi@boost@@U?$arg@$00@3@U?$arg@$01@3@V?$reference_wrapper@Urootdevice@upnp@libtorrent@@@3@U?$arg@$04@3@@_bi@3@@_bi@boost@@
.?AV?$bind_t@XV?$mf5@XVupnp@libtorrent@@ABVerror_code@system@boost@@ABVhttp_parser@2@AAUrootdevice@12@HAAUhttp_connection@2@@_mfi@boost@@V?$list6@V?$value@V?$intrusive_ptr@Vupnp@libtorrent@@@boost@@@_bi@boost@@U?$arg@$00@3@U?$arg@$01@3@V?$reference_wrapper@Urootdevice@upnp@libtorrent@@@3@V?$value@H@23@U?$arg@$04@3@@_bi@3@@_bi@boost@@
.?AV?$bind_t@XV?$mf3@XVlsd@libtorrent@@ABV?$basic_endpoint@Vudp@ip@asio@boost@@@ip@asio@boost@@PADI@_mfi@boost@@V?$list4@V?$value@V?$intrusive_ptr@Vlsd@libtorrent@@@boost@@@_bi@boost@@U?$arg@$00@3@U?$arg@$01@3@U?$arg@$02@3@@_bi@3@@_bi@boost@@
.?AV?$bind_t@XV?$mf4@XUfeed@libtorrent@@ABVerror_code@system@boost@@ABVhttp_parser@2@PBDH@_mfi@boost@@V?$list5@V?$value@V?$shared_ptr@Ufeed@libtorrent@@@boost@@@_bi@boost@@U?$arg@$00@3@U?$arg@$01@3@U?$arg@$02@3@U?$arg@$03@3@@_bi@3@@_bi@boost@@
.?AV?$bind_t@XV?$mf1@XVhttp_tracker_connection@libtorrent@@AAUhttp_connection@2@@_mfi@boost@@V?$list2@V?$value@V?$intrusive_ptr@Vhttp_tracker_connection@libtorrent@@@boost@@@_bi@boost@@U?$arg@$00@3@@_bi@3@@_bi@boost@@
.?AV?$bind_t@XV?$mf2@XVhttp_tracker_connection@libtorrent@@AAUhttp_connection@2@AAV?$list@V?$basic_endpoint@Vtcp@ip@asio@boost@@@ip@asio@boost@@V?$allocator@V?$basic_endpoint@Vtcp@ip@asio@boost@@@ip@asio@boost@@@std@@@std@@@_mfi@boost@@V?$list3@V?$value@V?$intrusive_ptr@Vhttp_tracker_connection@libtorrent@@@boost@@@_bi@boost@@U?$arg@$00@3@U?$arg@$01@3@@_bi@3@@_bi@boost@@
.?AV?$bind_t@XV?$mf4@XVhttp_tracker_connection@libtorrent@@ABVerror_code@system@boost@@ABVhttp_parser@2@PBDH@_mfi@boost@@V?$list5@V?$value@V?$intrusive_ptr@Vhttp_tracker_connection@libtorrent@@@boost@@@_bi@boost@@U?$arg@$00@3@U?$arg@$01@3@U?$arg@$02@3@U?$arg@$03@3@@_bi@3@@_bi@boost@@
.?AVhttp_tracker_connection@libtorrent@@
.?AVudp_tracker_connection@libtorrent@@
.?AVwindows_file_codecvt@@
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
<assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" publicKeyToken="6595b64144ccf1df" language="*" processorArchitecture="*"></assemblyIdentity>
0"0(050;0
0 000<0\0
2<3V3k3r3
7|7J7P7e7
4 5-5C5V5}5
8„8C8R8a8s8
;";-;5;?;
6.686?6{6
6l6O6g6o6t6{6
0C0R0a0
:(:,:0:4:
7%7s7
#060_0|0
1$2C2R2a2p2
11s1
1)111`1}1
5,5:5[5`5
11n1
1/2U2q2
6"666<6[6{6
00f0
4D4C4n4
2 3)353_3
3=3e3w3~3
4)42494\4
6"6-6I6l6v6}6
2 2"2C2N2T2
9“9F9[9f9o9
4#4)424<4\4|4
6)6;6]6{6
3E3M3%4-4u4}4
3<3I3P3
9 :%:8:>:
9-9E9M9S9c9k9}9
7/787>7`7
:';/;^;~;
;&;4;;;|;
>!>.>@>{>
7Œ8Q8j8{8
8$8-868_8
9•9c9t9
6f6F6Q6c6i6
9™9d9{9
8%9S9c9
8…8D8L8T8Z8
8&989#:6:
7%7*727>7
8&8>8]8}8
:(;2;9;|;
=)=0=;={=
0)0/0`0}0
1 2&2-2]2
00C0V0y0
3'3-3B3R3X3m3w3}3
: ;5;<;|;
=$=3=9=?=^=
8)8;8^8~8
00c0o0
172@2`2|2
1%1X1g1v1
6w768<8
4]5
>0>6>=>\>
;$;-;6;_;
2)242_2|2
8&848?8[8~8
=*>3>:>]>
3 3;3@3[3`3
6&797[7`7{7
;";1;?;'<
11U1u1
121>1,313>3,414>4
>[>#?5?{?
;#<6<`<}<
9(:.:0;5<;<
5$6^7#828
2"2#333#414
3 3$3(3,303
1#222#303
#02032@2
8"80819@9
0 0.040>0
373U3
2<3r3
6l6
2%3S3f3
323F3X3d3q3
0S0v0
4!4-494O4}4
3!3-393B3Y3e3q3}3
2-2A2U2i2}2
0%1U1z1
7x7D7P7\7h7t7
7}7M7V7j7s7
00U0k0
3%4U4
0*0>0]0|0
99M9V9_9p9y9
0)0=0\0{0
5-5A5U5i5}5
4O4U4a4w4
4!4-494O4e4q4}4
9œ9b9
9 9$9(9,9094989<9
4$4(4,4044484<4
? ?$?(?,?
2 2$2(2,2
< <$<(<,<0<4<8<<<
7 7$7(7,707
2 2$2(2,2024282<2|2
7 7$7(7,7074787
; ;$;(;,;
> >$>(>,>0>4>
4 4$4(4,404
8 8$8(8,8
$7(7,707
,2024282
8094989
=,>0>4>8>
3(3,3034383<3@3
9$9,989`9
2$2,282\2|2
= =(=0=<=`=
> >(>0><>`>
7,787\7|7
<(<4<<<\<
2 2(202<2`2
; ;(;0;<;`;
8$8,888\8|8
4,484\4|4
1(141<1\1
9(949<9`9
6$6<6\6|6
7 7<7\7|7
5(5,505<5\5|5
2 2$2(2,2024282<2@2|2
%s\%s.dmp
rpcrt4.dll
dbghelp.dll
x-x-x-xx-xxxxxx
XXXXXXXXXXX
background-image: url(:/default/wpdmanager/android-bg.png);
border-image: url(:/default/wpdmanager/android-close.png);
dDwmapi.dll
loginLineEdit
passwordLineEdit
loginPushButton
:/icons/icons/ADSList_Download_Icon.png
:/icons/icons/ADSList_Play_Icon.png
background-image: url(:/icons/icons/top-bar-frame.png);
:/icons/icons/dwnload_big_icon.png
importBtn
search.json
border-image: url(:/hints/images/2_in_circle.jpg);
border-image: url(:/hints/images/1_in_circle.jpg);
border-image: url(:/hints/images/4_in_circle.jpg);
border-image: url(:/hints/images/3_in_circle.jpg);
:/default/mediaplayer/panel-info_btn.png
:/default/mediaplayer/panel-info_btn_disable.png
:/default/mediaplayer/panel-subtitle_btn.png
:/default/mediaplayer/panel-audio_btn.png
:/default/mediaplayer/panel-audio_btn_disable.png
:/default/mediaplayer/close-info.png
exportBtn
urlContainerWidget
urlLabel
copyUrlBtn
background-image: url(:/orbitumen-resources/update-vk.jpg);
border-image: url(:/orbitumen-resources/skip-ru.jpg);
border-image: url(:/orbitumen-resources/next-ru.jpg);
background-image: url(:/orbitumen-resources/update-en.jpg);
border-image: url(:/orbitumen-resources/skip-en.png);
border-image: url(:/orbitumen-resources/next-en.png);
background-image: url(:/orbitumen-resources/update-tr.jpg);
border-image: url(:/orbitumen-resources/skip-tr.jpg);
border-image: url(:/orbitumen-resources/next-tr.jpg);
<html><head/><body><p><span style=" font-size:17pt; font-weight:600; color:#374755;">What is new in this version</span></p><p><span style=" font-weight:600;">New search design</span></p><p><img src=":/yandex-resources/yandex-check.png"/> More search results</p><p><img src=":/yandex-resources/yandex-check.png"/> Enlarged description of content</p><p><span style=" font-weight:600;">Stability</span></p><p><img src=":/yandex-resources/yandex-check.png"/> Many fixes</p><p><img src=":/yandex-resources/yandex-check.png"/> Faster download</p><p><span style=" font-weight:600;">Orbitum search</span></p></body></html>
By clicking "Continue" button you accept Orbitum <a href='hXXp://orbitum.com/privacy'> privacy policy</a>
config.js
eopera.exe
Member: %s
Function: %s
Error In: %s
Error: %s
Code: %x
Source: %s
Object doesn't support this property or method: '%s'
Type mismatch: '%s'. Argument Index: %d
.Version
.Description
.PNPDeviceID
.ReleaseDate
.Name
.ExecQuery(%S)
winmgmts:{impersonationLevel=impersonate}!\\.\root\cimv2
Iexplore.exe
Credui.dll
webSeedsEdit
urlList
labelImport
randomIncomingPortBtn
portSpin
passwordEdit
traversePortSpin
ru-free-tor.org
elitetorrent.net
rutracker.org
utfile.me
#rutor.is
kickass.to
mgshare.com
rutor.org
fast-torrent.ru
mproxy.net
'SearchResultsList_Play_Icon_h.png
'hdrip.png
win.png
'SearchResultsList_Download_Icon_h.png
dwnload_new_icon.png
right-checkbox-checked.png
SearchResultsList_Play_Icon.png
tags-delete-btn.png
select_file_border.png
win-tag.png
rightBtnHide.png
xbox-tag.png
'xbox360.png
top-bar-frame.png
hdtv rip.png
ADSList_Download_Icon.png
thumb-hower-bg.png
GTC.png
ps3-tag.png
tv rip.png
wii.png
[email protected]
checkbox-checked.png
gplay_new_icon.png
dvd-tag.png
Gdwnload_new_icon_disabled.png
[email protected]
dvd rip.png
scr.png
flac-tag.png
sat-rip.png
[email protected]
'typeselect_checkbox_h.png
ps4.png
pdtv rip.png
mp3.png
bluray-tag.png
psp-tag.png
bd rip.png
G3d.png
Cam-rip.png
android-tag.png
dvd scr.png
right-checkbox.png
wma-tag.png
SearchResultsTable_Star_Bg_Icon.png
xbox.png
gcheckbox.png
SearchResultsList_Download_Icon.png
mp3-tag.png
ld rip.png
hdtv.png
'short_info_btn_play.png
[email protected]
bluray.png
back-button.png
gSearchResultsTable_Star_Icon.png
dwnload_big_icon.png
GSearchResultsTable_Play_Icon.png
'close_button_hower.png
gright_arrow_h.png
ps3.png
ps2-tag.png
GSearchResultsTable_Download_Icon_d.png
wma.png
checkbox-checked-hover.png
gtags-delete-btn-hower.png
'play_new_icon_disabled.png
info-inactive.png
'bgimage.png
table_select_type.png
Ghd.png
SearchResultsTable_Download_Icon.png
mac.png
GSearchResultsTable_Download_Icon_h.png
GTS.png
xbox360-tag.png
remux.png
gleftBtnHide.png
3stars.png
close_button.png
magnifier.png
'short_info_btn_download.png
ps2.png
rightBtnHide_h.png
mac-tag.png
dvd.png
gADSList_Play_Icon.png
Super ts.png
'dvd5.png
typeselect_button.png
hd-tag.png
left_arrow_h.png
gandroid.png
ps4-tag.png
SearchResultsTable_Play_Icon_d.png
'search-play-btn.png
right_arrow.png
back-button-hower.png
2stars.png
'leftBtnHide_h.png
info-active.png
typeselect_button_h.png
dcp rip.png
web rip.png
flac.png
3d-tag.png
web dlrip.png
'dvd9.png
1stars.png
SearchResultsTable_Play_Icon_h.png
checkbox-hover.png
wii-tag.png
typeselect_checkbox.png
vhs-scr.png
vhs-rip.png
ppv-rip.png
psp.png
bottom-bar-frame.png
Gwp.png
'[email protected]
[email protected]
left_arrow.png
'mininova.org
nigma.ru
'leetleech.org
hqclub.net
radikal.ru
204.14.17.70
bitreactor.to
kickasstorrents.com
fastpic.ru
firepic.org
youpicture.org
]kastatic.com
#imageshack.us
lostpic.net
rudb.org
pictat.com
shared_service_file.ini
Gmailru.png
Godnoklassniki.png
digg.png
'twitter.png
gfacebook.png
Glivejournal.png
delicious.png
'vkontakte.png
gbuzz.png
friendfeed.png
myspace.png
player_plugins_mac_2.2.1.torrent!
player_plugins_2.2.2-5.22.torrent
4quotes.txt
certs
STAR_mediaget_com.crt
COMODORSADomainValidationSecureServerCA.crt
server.key
AddTrustExternalCARoot.crt
COMODORSAAddTrustCA.crt
GeoIP.zip
Gca.png
Gky.png
Gtc.png
Gli.png
Gtr.png
Gdo.png
Gmh.png
Gmw.png
Gva.png
Gng.png
Gfm.png
Ggl.png
Gpe.png
Ghk.png
Gpt.png
Gbo.png
Gsb.png
Gkh.png
Gcn.png
Gkw.png
Gdm.png
Glv.png
Gmu.png
Gne.png
Gvn.png
Gfk.png
Ggy.png
Gpr.png
Gan.png
Gbm.png
Gso.png
Gcl.png
Gtn.png
Gdk.png
Glt.png
Gdz.png
Gmd.png
Gum.png
Gms.png
Gnc.png
Gfi.png
Gnr.png
Ggh.png
Ggw.png
Gpa.png
Gal.png
Gzw.png
Gbz.png
Gsm.png
Gcy.png
Glc.png
Gtl.png
Glr.png
Geh.png
Gmq.png
Guz.png
Gna.png
Gnp.png
Ggf.png
Ggu.png
Gpn.png
Ght.png
Gid.png
Gis.png
Gbi.png
Gsk.png
Gch.png
Gsz.png
Gla.png
Gtj.png
Gmo.png
Ggd.png
Gom.png
Ggs.png
Gpl.png
Ghr.png
Gye.png
Gyt.png
Giq.png
Gaw.png
Gbg.png
Gjp.png
Gbv.png
Gsi.png
Gcf.png
Gcu.png
Gth.png
Gde.png
Gtw.png
Gug.png
Gmm.png
Ges.png
Gnl.png
Gvu.png
Gfr.png
Ggb.png
Ggq.png
Gpy.png
Gaf.png
Gio.png
Gau.png
Gbe.png
Grw.png
Gbt.png
Gsg.png
Gcd.png
Gkm.png
Gsv.png
Gcs.png
Gtf.png
Gmk.png
Gmz.png
Gph.png
Ghn.png
Gpw.png
Gad.png
Gas.png
Gru.png
Gbr.png
Gse.png
Gst.png
Gkz.png
Gtd.png
Gly.png
Gmx.png
Ggm.png
Gpf.png
Gzm.png
Gba.png
Grs.png
Gsc.png
Gki.png
Gsr.png
Gco.png
Gua.png
Gmg.png
Gmv.png
Gnf.png
Gnu.png
Gps.png
Gao.png
Gbn.png
Gsa.png
Gkg.png
Gcm.png
Gto.png
Glu.png
Gme.png
Gmt.png
Gfj.png
Ggi.png
Gqa.png
Gam.png
Gro.png
Gke.png
Gsn.png
Gck.png
Gcz.png
Gtm.png
Gdj.png
Gls.png
Gmc.png
Gmr.png
Ghu.png
Gie.png
Git.png
Gaz.png
Gbj.png
Gby.png
Gsl.png
Gci.png
Gkr.png
Gcx.png
Glb.png
Gtk.png
Gtz.png
Gma.png
Geg.png
Gmp.png
Guy.png
Gvi.png
Gno.png
Gge.png
Ggt.png
Gpm.png
Gai.png
Gir.png
Gax.png
Gbh.png
Gbw.png
Gsj.png
Gcg.png
Gkp.png
Gsy.png
Gcv.png
Gee.png
Gmn.png
Get.png
Gvg.png
Gwf.png
Ggr.png
Gpk.png
Gag.png
Gbf.png
Gjo.png
Gsh.png
Gkn.png
Gtg.png
Gtv.png
Gec.png
Gml.png
Ger.png
Gve.png
Gnz.png
Gga.png
Gws.png
Ggp.png
Gae.png
Gin.png
Gza.png
Gat.png
Gbd.png
Gjm.png
Gbs.png
Gcc.png
Gcr.png
Glk.png
Gtt.png
Gus.png
Gmy.png
Gvc.png
Gni.png
Gfo.png
Ggn.png
Gpg.png
Ghm.png
Gil.png
Gar.png
Gre.png
Gbb.png
Gsd.png
halfopen-limit-pic.png
skip-tr.jpg
update-tr.jpg
update-vk.jpg
update-en.jpg
next-ru.jpg
next-en.png
'skip-en.png
skip-ru.jpg
next-tr.jpg
yandex-uncheck.png
speed.png
serials-next.png
'close.png
yandex-accept-pressed.png
'next-hover-tr.png
checkbox-unchecked.png
gcheckbox-white-unchecked.png
serials-next-hover.png
next-tr.png
serials-cancel.png
yandex.png
yandex-check.png
movie.png
player events.jpg
next-hover.png
share.png
serials.jpg
player events-tr.jpg
yandex-accept-hover.png
checkbox-unchecked-hover.png
yandex-accept.png
serials-cancel-hover.png
next.png
#style.qss
'checkbox-white-checked.png
mac-style.qss
Czzz-macos.qss
webcatalogue
catalog.qss
#00common.qss
live_stream.qss
transfers.qss
search.qss
Cmediaplayer.qss
Csettings-editor.qss
dlna.qss
#window.qss
Cuser-share.qss
Gtool-remove.png
Gsmall-prio-high.png
gsmall-share.png
small-upload-limit.png
transfer-finished-open-btn-hover.png
empty_page_caption.png
gchangeLocationBtns-hover.png
tool-add-url.png
tool-settings.png
tool-shutdown.png
transfer-unfinished-play-btn.png
'transfer-unfinished-open-btn-hover.png
'small-sequantally.png
gtool-add-torrent.png
'small-play.png
transfer-finished-play-btn-hover.png
small-pause.png
tool-new-torrent.png
transfer-unfinished-play-btn-hover.png
gsmall-play-2.png
transfer-unfinished-open-btn.png
Gtool-play.png
empty_page_frame_ru.png
gsmall-download-limit.png
small-reanonce.png
tool-pause.png
transfer-unfinished-open-btn-pressed.png
gtransfer-unfinished-single-btn-hover.png
status-speed-pixmap.png
small-enqueue.png
gtransfer-unfinished-single-btn-pressed.png
transfer-finished-open-btn-pressed.png
small-start.png
small-error.png
small-hash.png
empty_page_frame.png
Gempty_page_caption_ru.png
'small-gotolibrary.png
transfer-unfinished-play-btn-pressed.png
'transfer-unfinished-single-btn.png
tool-start.png
gsmall-recheck-data.png
small-prio-up.png
small-folder.png
tool-stat.png
small-delete.png
Gtransfer-finished-play-btn-pressed.png
small-prio-low.png
gsmall-downloading.png
small-uploading.png
'small-prio-medium.png
small-prio-down.png
'changeLocationBtns.png
remove-download-icon.png
status-eta-pixmap.png
tool-title-view.png
G9 .png
G2.png
G6.png
G10.png
G1.png
G5.png
G9.png
G4.png
G8.png
G3.png
G7.png
'icon-add.png
'Comp 1_00031.png
'Comp 1_00023.png
'Comp 1_00015.png
'Comp 1_00007.png
'Comp 1_00030.png
'Comp 1_00022.png
'Comp 1_00047.png
'Comp 1_00014.png
'Comp 1_00039.png
'Comp 1_00006.png
'Comp 1_00021.png
'Comp 1_00046.png
'Comp 1_00013.png
'Comp 1_00038.png
'Comp 1_00005.png
'Comp 1_00020.png
'Comp 1_00045.png
'Comp 1_00012.png
'Comp 1_00037.png
'Comp 1_00004.png
'Comp 1_00029.png
'Comp 1_00044.png
'Comp 1_00036.png
'Comp 1_00011.png
'Comp 1_00003.png
'Comp 1_00028.png
'Comp 1_00043.png
'Comp 1_00035.png
'Comp 1_00010.png
'Comp 1_00002.png
'Comp 1_00027.png
'Comp 1_00019.png
'Comp 1_00042.png
'Comp 1_00034.png
'Comp 1_00001.png
'Comp 1_00026.png
'Comp 1_00018.png
'Comp 1_00041.png
'Comp 1_00033.png
'Comp 1_00000.png
'Comp 1_00025.png
'Comp 1_00017.png
'Comp 1_00040.png
'Comp 1_00009.png
'Comp 1_00032.png
'Comp 1_00024.png
'Comp 1_00016.png
'Comp 1_00008.png
icon-transfers-inactive.png#
icon-settings-additional-active.png
icon-settings-android-active.png
'icon-settings-android-inactive.png
'icon-settings-search-active.png
icon-player-active.png
icon-search-inactive.png
'icon-settings-connection-active.png
'icon-settings-security-active.png
icon-settings-main-active.png
maintab-bottom.png
'icon-dlna-active.png
'icon-dlna-inactive.png
icon-settings-additional-inactive.png
'icon-player-inactive.png#
icon-settings-security-inactive.png
Gicon-settings-main-inactive.png
icon-library-inactive.png
icon-library-active.png
'icon-transfers-active.png
icon-settings-download-active.png
icon-settings-search-inactive.png
icon-search-active.png
Gicon-catalogue-inactive.png
icon-catalogue-active.png
gicon-settings-connection-inactive.png
Gicon-settings-download-inactive.png
user-share-history-btn.png
user-share-history-btn-hover.png
arrow_icon_dwn.png
main-search-btn.png
main-search-btn-hover.png
garrow_icon_up.png
Gplayer-playlist-off-hover.png
dummy-poster.png
Gpanel-audio_btn_hover.png
player-sound-off-hover.png
player-fullscreen-on.png
gplayer-pause.png
big-pause-hover.png
gplayer-sound-off.png
player-psition-handle-pressed.png
'play-big.png
panel-show_hide_btn_hide.png
player-sound-handle-pressed.png
player-fullscreen-off-hover.png
'panel-open_btn_disable.png
Gplay-big-hover.png
pause-big-hover.png
player-next-hover.png
small_player_icon_hover.png
pause-big.png
panel-info_btn_disable.png
gplayer-next.png
'panel-download_btn.png
Gplayer-fullscreen-on-pressed.png
player-prev.png
close-info.png
panel-show_hide_btn_show_hover.png
pin-off-hover.png
Gprev-big-hover.png
panel-catalog_btn_disable.png
pin-off.png"
'panel-show_hide_btn_hide_hover.png
panel-subtitle_btn.png
player-sound-on-hover.png
player-play.png
player-play-hover.png
gpanel-show_hide_btn_show.png
Gplayer-sound-handle-hover.png
panel-back_btn.png
Gplayer-sound-on.png
panel-catalog_btn.png
gplayer-playlist-on.png
panel-download_btn_disable.png
gpanel-share_btn_disable.png
player-pause-hover.png
panel-audio_btn_disable.png
Gcontrols-widget-bg.png
Gplayer-fullscreen-off.png
panel-subtitle_btn_hover.png
Gnext-big-hover.png
gplayer-stop-hover.png
player-playlist-off.png
panel-info_btn_hover.png
gbig-play-hover.png
'player-psition-handle-hover.png
player-fullscreen-on-hover.png
panel-catalog_btn_hover.png
'prev-big.png
'player-prev-hover.png
player-stop.png
panel-info_btn.png
'player-sound-handle.png
panel-share_btn_hover.png
panel-audio_btn.png
pin-on-hover.png
panel-subtitle_btn_disable.png
player-fullscreen-off-pressed.png
panel-open_btn.png
player-psition-handle.png
panel-back_btn_hover.png
big-pause.png
gpin-on.png
small_player_icon.png
gpanel-share_btn.png
'next-big.png
Gvk.png
odnoklas.png
window-minimize-main-hover.png
icon-settings.png
gbanner-close.png
window-close-main-hover.png
'icon-settings-hover.png
icon-tips.png
[email protected]
Gicon-question.png
Gwindow-maximize-main.png
mediaget.ico
Gwindow-minimize-main.png
window-icon.png
window-maximize-main-hover.png
gtitle_left_mediaget.png
window-close-main.png
icon-error.png
avia_logo2.png
Gstatic.png
G0.png
upload-icon-15.png
upload-icon-02.png
upload-icon-06.png
upload-icon-10.png
upload-icon-01.png
upload-icon-14.png
upload-icon-05.png
upload-icon-09.png
upload-icon-13.png
upload-icon-04.png
upload-icon-08.png
upload-icon-12.png
upload-icon-03.png
upload-icon-07.png
upload-icon-11.png
download-icon-14.png
download-icon-01.png
download-icon-05.png
download-icon-09.png
download-icon-13.png
download-icon-04.png
download-icon-08.png
download-icon-12.png
download-icon-03.png
download-icon-07.png
download-icon-11.png
download-icon-02.png
download-icon-15.png
download-icon-06.png
download-icon-10.png
webcatalogue-reload-btn-pressed.png
'webcatalogue-reload-btn.png
webcatalogue-unavailable-pic.png
Gwebcatalogue-reload-btn-hover.png
mail.ru.png
google.png
mgshare.png
gslider-horizontal-groove.png
gtreeview-branch-closed.png
gspanslider-handle-right.png
Gscrollbar-vertical-border.png
scrollbar-vertical-handle-hover-search.png
scrollbar-maintabs-vertical-border.png
scrollbar-vertical-handle-search.png
spanslider-handle-left.png
gprogressbar-chunk.png
radio-unchecked-hover.png
treeview-branch-opened.png
scrollbar-vertical-handle.png
'spinbox-down-button.png
slider-horizontal-handle.png
gslider-horizontal-sub-page.png
scrollbar-maintabs-vertical-handle.png
spanslider-fill.png
scrollbar-vertical-border-search-dark.png
spinbox-up-arrow.png
gradio-unchecked.png
scrollbar-horizontal-handle-search.png
radio-checked.png
progressbar-border.png
checkbox-disabled.png'
scrollbar-horizontal-handle-pressed.png
'combobox-arrow.png
gscrollbar-vertical-border-search.png
spinbox-up-button.png
combobox-dropdown.png
checkbox-indeterminate-disabled.png
checkbox-indeterminate-hover.png
scrollbar-vertical-handle-pressed.png
Gcheckbox-indeterminate.png
scrollbar-vertical-handle-hover.png
gcombobox-arrow2.png
scrollbar-horizontal-border-search.png
'scrollbar-horizontal-border.png%
gscrollbar-horizontal-handle-hover.png
spanslider-bg.png
checkbox-disabled-checked.png
gspinbox-down-arrow.png
gscrollbar-horizontal-handle-hover-search.png
radio-checked-hover.png
scrollbar-horizontal-handle.png
HExecutive (7.5 x 10
%1 - [%2
(*.mediasearch
> HTTP
2 %1 (%2
0: %1 - %
2 ffmpeg_log.tx
K (*.* *.dat);
8 (*.dat
PShellExecute
5 .torrent
Z<a href="hXXp://isohunt.com/">IsoHunt.com</a
L mgtracker.org
8 .torrent
L URL
> URL
>: %3 %;
5 %1 - %
O HTTP
JUrl
8 http,
0 url
J ffmpeg_log.txt
* (*.* *.dat);;
! (*.dat
f Windows
D ShellExecute
<a href="hXXp://isohunt.com/">IsoHunt.com</a
F mgtracker.or
F URL
* (*.*
9 HTTP
DHTTP
(0 (1000
% %1 (%2
: %1 - %
(ffmpeg_log.tx
(*.* *.dat);
(*.dat
(mgtracker.or
dURL
Gczech.png
usa.png
'germany.png
gbrazil.png
Gukraine.png
Gfrance.png
china.png
'vietnam.png
italy.png
gturkey.png
spain.png
Gmalaysia.png
Gsaudi arabia.png
russia.png
mediaget_my.qm
}qt_es.qm
mediaget_tr.qm
mediaget_it.qm
}qt_cz.qm
}qt_cn.qm
}qt_tr.qm
}qt_it.qm
mediaget_ua.qm
mediaget_ru.qm
mediaget_de.qm
mediaget_ar.qm
mediaget_br.qm
mediaget_vi.qm
mediaget_fr.qm
}qt_ru.qm
}qt_de.qm
}qt_ar.qm
}qt_br.qm
mediaget_es.qm
}qt_fr.qm
mediaget_cz.qm
mediaget_cn.qm
transfers-poster-stub-all.png
transfers-poster-stub-video.png
transfers-poster-stub-music.png
countries.xml
G4_downloads_hint.jpg
4_in_circle.jpg
hint-watch.png
g0_hint_up.jpg
G3_open_file_hint.jpg
2_search_line_hint.jpg
1_in_circle.jpg
'1_catalog_hint.jpg
g0_hint_down.jpg
2_in_circle.jpg
hint-close-btn.png
Ghint-search.png
3_in_circle.jpg
hint-transfers.png
Uweb_catalogue
Tflash-plugin-1.torrent
asio-58CCDC44-6264-4842-90C2-F3C545CB8AA7-%u-%p
2, 1, 0, 0

mediaget.exe_2792_rwx_0B552000_00002000:

webv


Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.


Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):

    taskkill.exe:516
    mediaget-admin-proxy.exe:368
    yupdate-executor.exe:2580
    %original file name%.exe:188
    yandexbar_setup.exe:1456
    regsvr32.exe:2428
    regsvr32.exe:2508
    MsiExec.exe:1372
    MsiExec.exe:2536
    MsiExec.exe:2100
    MsiExec.exe:2548

  2. Delete the original Trojan file.
  3. Delete or disinfect the following files created/modified by the Trojan:

    %Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\flash-plugin-1.7z (11187 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\audio_filter\libspeex_resampler_plugin.dll (29 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libgaussianblur_plugin.dll (18 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\stream_out\libstream_out_rtp_plugin.dll (3699 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\user_search\tserverinfo\qt_temp.VW2792 (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\visualization\libgoom_plugin.dll (219 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\user_search\iserverinfo\qt_temp.tX2792 (456 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\libnsv_plugin.dll (19 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\stream_filter\libdash_plugin.dll (3815 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\access\libsmb_plugin.dll (42 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libvhs_plugin.dll (19 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\libau_plugin.dll (16 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\user_search\iserverinfo\qt_temp.ZN2792 (611 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\libmjpeg_plugin.dll (19 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libaes3_plugin.dll (18 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\access\libidummy_plugin.dll (15 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\user_search\sserverinfo\qt_temp.Mv2792 (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\access\libdtv_plugin.dll (248 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\libvc1_plugin.dll (16 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\stream_out\libstream_out_gather_plugin.dll (16 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\cookies.ini.xY2792 (641 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\libes_plugin.dll (26 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libsharpen_plugin.dll (17 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\webkit-local-storage\http_games.mgshare.com_0.localstorage (449 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\audio_output\libamem_plugin.dll (18 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\audio_filter\libscaletempo_plugin.dll (19 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\stream_filter\libsmooth_plugin.dll (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libalphamask_plugin.dll (16 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\stream_out\libstream_out_duplicate_plugin.dll (42 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libpuzzle_plugin.dll (75 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\audio_filter\libcompressor_plugin.dll (25 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libatmo_plugin.dll (215 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\access\libshm_plugin.dll (17 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libhqdn3d_plugin.dll (25 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\user_search\iserverinfo\qt_temp.dV2792 (447 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\audio_filter\libchorus_flanger_plugin.dll (19 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\libsubtitle_plugin.dll (92 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libscene_plugin.dll (42 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\lua\liblua_plugin.dll (317 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\audio_filter\libheadphone_channel_mixer_plugin.dll (19 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\gui\libskins2_plugin.dll (12288 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\libsid_plugin.dll (6394 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\access_output\libaccess_output_shout_plugin.dll (1723 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\user_search\iserverinfo\qt_temp.Gn2792 (586 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\access\libdvdread_plugin.dll (157 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libpostproc_plugin.dll (110 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\access\libvcd_plugin.dll (83 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libdts_plugin.dll (20 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\misc\libaddonsfsstorage_plugin.dll (80 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\access\libscreen_plugin.dll (22 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\liba52_plugin.dll (20 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\liblogo_plugin.dll (22 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libposterize_plugin.dll (20 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libripple_plugin.dll (16 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libadjust_plugin.dll (33 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\audio_filter\libspatializer_plugin.dll (112 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\audio_output\libadummy_plugin.dll (14 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\audio_filter\libequalizer_plugin.dll (52 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libmpeg_audio_plugin.dll (22 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\user_search\sserverinfo\qt_temp.Hc2792 (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\libvobsub_plugin.dll (79 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libanaglyph_plugin.dll (18 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\libsmf_plugin.dll (23 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libgrain_plugin.dll (21 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libflac_plugin.dll (1729 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libspudec_plugin.dll (21 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libwave_plugin.dll (15 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\user_search\iserverinfo\qt_temp.Rm2792 (578 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libmosaic_plugin.dll (30 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\control\libwin_hotkeys_plugin.dll (40 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\audio_output\libwasapi_plugin.dll (33 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\stream_filter\librecord_plugin.dll (16 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\mux\libmux_ps_plugin.dll (58 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\stream_filter\libhttplive_plugin.dll (1865 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\visualization\libglspectrum_plugin.dll (25 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libspeex_plugin.dll (151 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\libdemuxdump_plugin.dll (15 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\packetizer\libpacketizer_dirac_plugin.dll (34 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\access\liblive555_plugin.dll (3783 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_chroma\libi420_rgb_plugin.dll (29 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_chroma\libi420_yuy2_mmx_plugin.dll (22 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\access\librtp_plugin.dll (1809 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\packetizer\libpacketizer_mpeg4audio_plugin.dll (69 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\access\libcdda_plugin.dll (165 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\4e6ef1a2e279a81c3f92341262d0cbd2a293d828.ini.lock (92 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libdmo_plugin.dll (33 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_chroma\librv32_plugin.dll (14 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libdvbsub_plugin.dll (111 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\cookies_search.ini.lock (23 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\audio_filter\libaudiobargraph_a_plugin.dll (43 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_chroma\libi422_yuy2_mmx_plugin.dll (21 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\misc\libvod_rtsp_plugin.dll (90 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\68b7310c6cc7916d49612cf34916078fbf58e9f6.ini.lock (46 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\access\libaccess_mms_plugin.dll (77 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libdeinterlace_plugin.dll (165 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libvpx_plugin.dll (9606 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\libxa_plugin.dll (15 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_output\libyuv_plugin.dll (40 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\user_search\iserverinfo\qt_temp.gh2792 (174 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\audio_filter\libaudio_format_plugin.dll (26 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\access\libzip_plugin.dll (119 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\libdemux_stl_plugin.dll (18 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\liboldmovie_plugin.dll (25 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\d73cf14c2f8d2609604053c89c25c1096cb3a483.torrent (736 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\user_search\iserverinfo\qt_temp.hW2792 (413 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\user_search\tserverinfo\qt_temp.rh2792 (13 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libantiflicker_plugin.dll (18 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\libwav_plugin.dll (22 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\access\libudp_plugin.dll (16 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libcolorthres_plugin.dll (18 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\user_search\tserverinfo\qt_temp.jp2792 (9 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\access_output\libaccess_output_livehttp_plugin.dll (1817 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libcdg_plugin.dll (18 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\user_search\tserverinfo\qt_temp.TG2792 (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\packetizer\libpacketizer_mlp_plugin.dll (21 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\user_search\tserverinfo\qt_temp.qT2792 (14 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_output\libdrawable_plugin.dll (16 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libquicktime_plugin.dll (18 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\access\libtimecode_plugin.dll (42 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libmotiondetect_plugin.dll (21 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libscale_plugin.dll (15 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libstl_plugin.dll (16 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\misc\liblogger_plugin.dll (41 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\control\libgestures_plugin.dll (21 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\misc\libexport_plugin.dll (46 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\audio_filter\libtrivial_channel_mixer_plugin.dll (17 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\audio_mixer\libinteger_mixer_plugin.dll (15 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\webkit-local-storage\http_mg.mgshare.com_0.localstorage (599 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\libvoc_plugin.dll (19 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\user_search\sserverinfo\qt_temp.rz2792 (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\audio_mixer\libfloat_mixer_plugin.dll (14 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\audio_filter\libsamplerate_plugin.dll (7972 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\geoip\qt_temp.NE2792 (19096 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_chroma\libyuy2_i422_plugin.dll (19 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\user_search\sserverinfo\qt_temp.Cl2792 (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\audio_filter\libnormvol_plugin.dll (16 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libmft_plugin.dll (35 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\misc\libxml_plugin.dll (7386 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\mux\libmux_ts_plugin.dll (114 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\services_discovery\libmediadirs_plugin.dll (18 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\meta_engine\libtaglib_plugin.dll (7972 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\access_output\libaccess_output_udp_plugin.dll (19 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\libnuv_plugin.dll (24 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\libavi_plugin.dll (98 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\libplaylist_plugin.dll (139 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\librss_plugin.dll (50 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\68b7310c6cc7916d49612cf34916078fbf58e9f6.torrent (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libcvdsub_plugin.dll (19 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\user_search\sserverinfo\qt_temp.Ed2792 (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\cookies.ini.lock (69 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\audio_filter\libugly_resampler_plugin.dll (14 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\control\libwin_msg_plugin.dll (16 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\access\libsftp_plugin.dll (3793 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\cookies.ini.CX2792 (5 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\access_output\libaccess_output_file_plugin.dll (17 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\stream_out\libstream_out_display_plugin.dll (15 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\audio_filter\libdtstospdif_plugin.dll (15 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libtwolame_plugin.dll (139 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\access\librar_plugin.dll (45 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\mux\libmux_avi_plugin.dll (25 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\text_renderer\libtdummy_plugin.dll (13 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\misc\libgnutls_plugin.dll (7386 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libcrystalhd_plugin.dll (21 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\geoip\GeoIP.dat (9321 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libmagnify_plugin.dll (18 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\services_discovery\libupnp_plugin.dll (3740 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libmirror_plugin.dll (21 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libadpcm_plugin.dll (22 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libblend_plugin.dll (192 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libfaad_plugin.dll (1628 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libball_plugin.dll (26 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libpsychedelic_plugin.dll (16 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\audio_filter\libmpgatofixed32_plugin.dll (132 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\stream_out\libstream_out_mosaic_bridge_plugin.dll (24 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_output\libvmem_plugin.dll (19 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_splitter\libclone_plugin.dll (16 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\access\libtcp_plugin.dll (14 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libfreeze_plugin.dll (17 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\user_search\iserverinfo\qt_temp.XH2792 (460 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\audio_filter\libstereo_widen_plugin.dll (17 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\user_search\sserverinfo\qt_temp.ca2792 (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libsubsusf_plugin.dll (26 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libremoteosd_plugin.dll (1822 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\control\libdummy_plugin.dll (14 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\stream_out\libstream_out_autodel_plugin.dll (15 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\access\libvdr_plugin.dll (80 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_chroma\libi420_yuy2_plugin.dll (21 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\user_search\tserverinfo\qt_temp.Yu2792 (13 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_chroma\libi420_rgb_mmx_plugin.dll (55 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libtheora_plugin.dll (1620 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\control\libntservice_plugin.dll (43 bytes)
    %Documents and Settings%\%current user%\My Documents\world_of_tanks_hp_marker-50409 (162 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\user_search\sserverinfo\qt_temp.br2792 (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\packetizer\libpacketizer_vc1_plugin.dll (38 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libt140_plugin.dll (14 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libuleaddvaudio_plugin.dll (16 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\audio_filter\libparam_eq_plugin.dll (22 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libcanvas_plugin.dll (42 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\misc\libfingerprinter_plugin.dll (55 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\user_search\iserverinfo\qt_temp.DC2792 (442 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\stream_out\libstream_out_stats_plugin.dll (40 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libcroppadd_plugin.dll (19 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\control\libnetsync_plugin.dll (22 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\libdiracsys_plugin.dll (16 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\plugins.dat.2792 (34292 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\user_search\iserverinfo\qt_temp.lJ2792 (519 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\audio_filter\libgain_plugin.dll (14 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libextract_plugin.dll (24 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libjpeg_plugin.dll (253 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_chroma\libchain_plugin.dll (40 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\user_search\sserverinfo\qt_temp.gx2792 (968 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\libasf_plugin.dll (88 bytes)
    %Documents and Settings%\%current user%\NTUSER.DAT (27456 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libgradient_plugin.dll (27 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_chroma\libswscale_plugin.dll (3766 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\libflacsys_plugin.dll (83 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\libreal_plugin.dll (34 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\stream_out\libstream_out_smem_plugin.dll (18 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\access\libhttp_plugin.dll (121 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libmotionblur_plugin.dll (15 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\stream_out\libstream_out_delay_plugin.dll (15 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\audio_output\libmmdevice_plugin.dll (39 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libsubsdelay_plugin.dll (27 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\mux\libmux_dummy_plugin.dll (15 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libedummy_plugin.dll (14 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_chroma\libi422_yuy2_plugin.dll (19 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\audio_filter\liba52tofloat32_plugin.dll (59 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\services_discovery\libpodcast_plugin.dll (22 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libdxva2_plugin.dll (72 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\webkit-local-storage\http_games.mgshare.com_0.localstorage-journal (9552 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\control\libhotkeys_plugin.dll (61 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\audio_filter\libdtstofloat32_plugin.dll (168 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\audio_filter\libkaraoke_plugin.dll (14 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\user_search\tserverinfo\qt_temp.uu2792 (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libopus_plugin.dll (1638 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\user_search\tserverinfo\qt_temp.wF2792 (13 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\d73cf14c2f8d2609604053c89c25c1096cb3a483.ini.PK2792 (253 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\liblibmpeg2_plugin.dll (134 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libaraw_plugin.dll (30 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\4e6ef1a2e279a81c3f92341262d0cbd2a293d828.ini.dp2792 (755 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\liblibass_plugin.dll (7972 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\librawvideo_plugin.dll (16 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_output\libcaca_plugin.dll (3898 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\audio_filter\libremap_plugin.dll (23 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_output\libvdummy_plugin.dll (16 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_chroma\libi420_yuy2_sse2_plugin.dll (31 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\audio_output\libdirectsound_plugin.dll (32 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\audio_filter\libmono_plugin.dll (21 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\access\libattachment_plugin.dll (14 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\libpva_plugin.dll (19 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\misc\libaddonsvorepository_plugin.dll (75 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\librawdv_plugin.dll (17 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\stream_out\libstream_out_raop_plugin.dll (1824 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\libimage_plugin.dll (25 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\libtta_plugin.dll (16 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\libmp4_plugin.dll (242 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\user_search\iserverinfo\qt_temp.HY2792 (482 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\d73cf14c2f8d2609604053c89c25c1096cb3a483.ini.db2792 (192 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\libnsc_plugin.dll (52 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\libgme_plugin.dll (1691 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libsepia_plugin.dll (18 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\access\libaccess_bd_plugin.dll (103 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\packetizer\libpacketizer_hevc_plugin.dll (17 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libg711_plugin.dll (29 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\access\libftp_plugin.dll (81 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\mux\libmux_ogg_plugin.dll (75 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\libps_plugin.dll (39 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\4e6ef1a2e279a81c3f92341262d0cbd2a293d828.ini.Qs2792 (632 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\access\liblibbluray_plugin.dll (12289 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\user_search\iserverinfo\qt_temp.xV2792 (658 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_chroma\libi422_yuy2_sse2_plugin.dll (29 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\user_search\iserverinfo\qt_temp.sP2792 (642 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\user_search\iserverinfo\qt_temp.rz2792 (420 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\access\libimem_plugin.dll (49 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\stream_out\libstream_out_setid_plugin.dll (16 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libsubsdec_plugin.dll (53 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libsvcdsub_plugin.dll (19 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\stream_out\libstream_out_record_plugin.dll (50 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libaudiobargraph_v_plugin.dll (23 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\stream_out\libstream_out_langfromtelx_plugin.dll (16 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\services_discovery\libsap_plugin.dll (124 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\mux\libmux_mpjpeg_plugin.dll (38 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libscte27_plugin.dll (31 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\access\libdshow_plugin.dll (1822 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\stream_out\libstream_out_standard_plugin.dll (46 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\libhevc_plugin.dll (22 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\mux\libmux_wav_plugin.dll (17 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\stream_out\libstream_out_dummy_plugin.dll (14 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_chroma\libi422_i420_plugin.dll (16 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_output\libgl_plugin.dll (61 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libzvbi_plugin.dll (7972 bytes)
    %Documents and Settings%\%current user%\NTUSER.DAT.LOG (29520 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\4e6ef1a2e279a81c3f92341262d0cbd2a293d828.ini.kQ2792 (193 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\misc\libaudioscrobbler_plugin.dll (48 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\user_search\iserverinfo\qt_temp.IA2792 (467 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\libts_plugin.dll (154 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libpng_plugin.dll (296 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\misc\libstats_plugin.dll (17 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\libmod_plugin.dll (1806 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\libcaf_plugin.dll (23 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\packetizer\libpacketizer_flac_plugin.dll (24 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\audio_filter\libsimple_channel_mixer_plugin.dll (21 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libgradfun_plugin.dll (23 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\librotate_plugin.dll (57 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\4e6ef1a2e279a81c3f92341262d0cbd2a293d828.ini.Pd2792 (690 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\liberase_plugin.dll (19 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\access\libsdp_plugin.dll (14 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\gui\libqt4_plugin.dll (83846 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libtransform_plugin.dll (28 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\stream_out\libstream_out_bridge_plugin.dll (46 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\user_search\iserverinfo\qt_temp.Bc2792 (616 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\user_search\tserverinfo\qt_temp.fB2792 (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\text_renderer\libfreetype_plugin.dll (3836 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_output\libdirectdraw_plugin.dll (70 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libbluescreen_plugin.dll (18 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\libmpgv_plugin.dll (15 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\libdemux_cdg_plugin.dll (15 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\visualization\libprojectm_plugin.dll (7972 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\audio_filter\liba52tospdif_plugin.dll (14 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libmarq_plugin.dll (22 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_chroma\libyuy2_i420_plugin.dll (23 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\control\liboldrc_plugin.dll (70 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\libaiff_plugin.dll (18 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\cookies.ini.Ga2792 (23 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_output\libdirect2d_plugin.dll (58 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\player_plugins_2.2.2-5.22.7z (32687 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\stream_out\libstream_out_transcode_plugin.dll (48 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_splitter\libpanoramix_plugin.dll (41 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\audio_output\libafile_plugin.dll (17 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\libmkv_plugin.dll (7386 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\user_search\iserverinfo\qt_temp.nF2792 (453 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\access\libdvdnav_plugin.dll (238 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libblendbench_plugin.dll (17 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\services_discovery\libwindrive_plugin.dll (15 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\user_search\iserverinfo\qt_temp.WD2792 (421 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libvorbis_plugin.dll (3821 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\68b7310c6cc7916d49612cf34916078fbf58e9f6.ini.DN2792 (250 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\libogg_plugin.dll (325 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\audio_filter\libdolby_surround_decoder_plugin.dll (15 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\packetizer\libpacketizer_mpeg4video_plugin.dll (27 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\cookies_search.ini.yd2792 (23 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\qt_temp.Pu2792 (784 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\libmpc_plugin.dll (77 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libddummy_plugin.dll (38 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\liblpcm_plugin.dll (25 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\access_output\libaccess_output_http_plugin.dll (19 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\packetizer\libpacketizer_mpegvideo_plugin.dll (26 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\stream_out\libstream_out_chromaprint_plugin.dll (6366 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\meta_engine\libfolder_plugin.dll (38 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\access_output\libaccess_output_dummy_plugin.dll (14 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libschroedinger_plugin.dll (7386 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\webkit-local-storage\http_mg.mgshare.com_0.localstorage-journal (14062 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\packetizer\libpacketizer_h264_plugin.dll (77 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\68b7310c6cc7916d49612cf34916078fbf58e9f6.ini.mX2792 (192 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\librawaud_plugin.dll (17 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libx265_plugin.dll (12289 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\stream_out\libstream_out_description_plugin.dll (15 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_chroma\libi420_rgb_sse2_plugin.dll (116 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libcc_plugin.dll (55 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_chroma\libgrey_yuv_plugin.dll (16 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\flash\npswf32.dll (123239 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\libty_plugin.dll (37 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\access\libaccess_realrtsp_plugin.dll (99 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\audio_output\libwaveout_plugin.dll (32 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_splitter\libwall_plugin.dll (56 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_output\libwingdi_plugin.dll (56 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libqsv_plugin.dll (144 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\user_search\sserverinfo\qt_temp.Dw2792 (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\mux\libmux_mp4_plugin.dll (54 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\librawvid_plugin.dll (20 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libkate_plugin.dll (106 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\visualization\libvisual_plugin.dll (40 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libyuvp_plugin.dll (17 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_output\libdirect3d_plugin.dll (78 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libavcodec_plugin.dll (91160 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\user_search\sserverinfo\qt_temp.xl2792 (8 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\user_search\sserverinfo\qt_temp.YB2792 (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\access\libfilesystem_plugin.dll (48 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\packetizer\libpacketizer_copy_plugin.dll (17 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\mux\libmux_asf_plugin.dll (32 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\access\libbluray-j2se-0.7.0.jar (3710 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libsubstx3g_plugin.dll (44 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Media Get LLC\MediaGet2\d73cf14c2f8d2609604053c89c25c1096cb3a483.ini.lock (46 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_output\libglwin32_plugin.dll (100 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\video_filter\libinvert_plugin.dll (15 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\stream_out\libstream_out_es_plugin.dll (43 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\codec\libx264_plugin.dll (7386 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\plugins\demux\libh264_plugin.dll (15 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Updater\yupdate-executor.log (5802 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\platforms\qminimal.dll (25 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\img\menuBg.jpg (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\Qt5WebKit.dll (127287 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\libeay32.dll (7386 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\mediaget-tmp-18467.tmp (9 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WXU749EJ\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\msvcp100.dll (1702 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\platforms\qwindows.dll (6337 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\css\style-ie6.css (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\libgcc_s_sjlj-1.dll (95 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\Qt5Qml.dll (15801 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\mediaget-admin-proxy.exe (115 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\Qt5Sensors.dll (145 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\mediaget-tmp-41.tmp (9 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\img\Marker.jpg (771 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\icuin53.dll (12288 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\img\check.jpg (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\Qt5Network.dll (3912 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\imageformats\qjpeg.dll (206 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\scripts\DD_belatedPNG.js (5 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\yandexbar_setup.exe (107884 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\mediaget-admin-proxy.exe (94 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\mediaservice\wmfengine.dll (136 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GXARCLEV\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\img\babylonlogo4.jpg (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\Qt5Sql.dll (151 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\Qt5MultimediaWidgets.dll (88 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\Qt5Xml.dll (152 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\libvlc.dll (126 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8LUVCT2R\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\img\AgreementScreen.jpg (10 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\css\style-ie7.css (904 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\Qt5Gui.dll (30058 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\img\logo.jpg (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\Qt5Quick.dll (15021 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\icudt53.dll (7386 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\Qt5OpenGL.dll (271 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\img\MediaLibraryScreen.jpg (15 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\img\installbutton_l.jpg (426 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\scripts\scripts.js (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\mediaget.exe (91742 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\Qt5PrintSupport.dll (264 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\Qt5WinExtras.dll (230 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\scripts\jquery.js (91 bytes)
    %Documents and Settings%\%current user%\Desktop\MediaGet.lnk (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\img\MarkerActive.jpg (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\img\FeaturesScreen.jpg (13 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\Qt5WebKitWidgets.dll (199 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\img\TabBg.jpg (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\libvlccore.dll (15801 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\img\next.jpg (664 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\msvcr100.dll (3846 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\Qt5Concurrent.dll (19 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\img\CatalogueScreen.jpg (19 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\img\MediaPlayerScreen.jpg (11 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\img\header_cycle_arrows_shape.jpg (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\img\installbutton.jpg (367 bytes)
    %Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\ssleay32.dll (273 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\icuuc53.dll (7386 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\css\style-ie8.css (891 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\img\loadinfo1.gif (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\Qt5XmlPatterns.dll (15801 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\img\babylonlogoleft.jpg (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\img\whitesmoke.jpg (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\img\babylonlogoupper.jpg (4 bytes)
    %Documents and Settings%\%current user%\Start Menu\Programs\MediaGet2\MediaGet.lnk (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\imageformats\qgif.dll (22 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\index.template (5 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\mediaget-uninstaller.exe (209 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\COR8IIDQ\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\img\SearchScreen.jpg (24 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\Qt5Positioning.dll (157 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\Qt5Multimedia.dll (1818 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\img\activeTabBg.jpg (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\img\DownloadsScreen.jpg (16 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\Qt5Widgets.dll (28890 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\img\pagerage.jpg (37 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\img\InstallScreen.jpg (16 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\css\style.css (8 bytes)
    %Documents and Settings%\%current user%\Start Menu\Programs\MediaGet2\Uninstall MediaGet.lnk (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\mediaget-installer-tmp\index.html (658 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\Qt5WebChannel.dll (75 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\MediaGet2\Qt5Core.dll (28502 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\YandexPackSetup00000.log (153858 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Temp\{11EA1C75-DB0D-410B-B63B-20916EECD568}\YandexPackSetup.msi (83795 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Temp\{413658B6-9D1B-4A71-8628-8517CA1E3E5F}\YandexSearch.msi (20507 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\YandexSearch00000.log (105500 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\cy.messages.xml (915 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\kk\welcome\ie\btn-check.gif (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\kk\subscription.dtd (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\en\welcome\css\style.css (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\wp\css\b-menu-ico\b-menu-ico.ie.css (805 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\tr\quote.dtd (660 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\about\product.xml (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\barlegacy.dll (11348 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\cy.xml (531 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\js\img\close-hover.png (443 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\logo.messages.xml (282 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{AC8A2266-D92B-4CCE-AEB5-0FEBA0FD2C75}\icons\favorities.png (412 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\ru\fastdial\config.xml (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{AC8A2266-D92B-4CCE-AEB5-0FEBA0FD2C75}\icons\messages.png (480 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\about\logo-ie-small.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\weather\i-night-cloud-rain.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\be\services\features.dtd (196 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\quote\currency_down.png (570 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\COR8IIDQ\rambler[2] (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\uk\welcome\css\b-sg-header.png (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\en\money.dtd (327 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\en\login.dtd (817 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\icons\rambler.png (655 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\login\auth.png (754 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8LUVCT2R\mc[1] (285 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\tr\srs.dtd (876 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\ru\search.dtd (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{AC8A2266-D92B-4CCE-AEB5-0FEBA0FD2C75}\icons\newsfeed.png (364 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8LUVCT2R\mail[1] (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\barcommon.dll (3557 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{3F580847-72EB-4D1D-937C-6B324D24137E}\locale\tr\radio.dtd (83 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\uk\town.dtd (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\ru\services\features.dtd (196 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\cs\welcome\css\b-sg-list__item_2.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\COR8IIDQ\odnoklassniki[1] (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{AC8A2266-D92B-4CCE-AEB5-0FEBA0FD2C75}\icons\profile.png (448 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\kk\fastdial\product.dtd (926 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\widget-preset.xsl (712 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C2E33C62-1E25-49E9-BABA-DBA2527F4C57}\wall.png (588 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\searchscopes.xml (889 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{AC8A2266-D92B-4CCE-AEB5-0FEBA0FD2C75}\icons\photos.png (539 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\tr\services\features.dtd (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\fastdial\thumbnails\market.jpg (588 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\opinions.messages.xml (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WXU749EJ\facebook[1] (682 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\functional.precompiled.bin (6588 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\tr\subscription.dtd (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\uk\fotki.dtd (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\wp\js\script.js (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\icons\bookmarks.png (664 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\uk\fastdial\config.xml (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\cs\welcome\ie\btn-check.gif (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\cs\services.dtd (196 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\js\img\close.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\be\fastdial\config.xml (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\en\fastdial\logo.png (196 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\icons\icon1.png (453 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\tr\welcome\ie\btn-home.gif (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{6074A32F-35A3-4893-B290-A4BD186038B0}\data\whitelist.xml (76 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WXU749EJ\logo[1] (341 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\icons\yandex.png (577 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\http://bar-widgets.yandex.ru/packages/approved/117/manifest.xml.zip (4545 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C2E33C62-1E25-49E9-BABA-DBA2527F4C57}\photo.png (618 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8LUVCT2R\spam[1] (765 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\be\welcome\css\b-sg-list__item_2.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\be\welcome\ie\btn-home_.gif (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\cs\welcome\css\b-sg-list__item_3.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\ic\2.png (215 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\fastdial\thumbnails\fotki.jpg (549 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\js\cleaner.js (813 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\geobase.xsl (373 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\quote\quote_up.png (602 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\be\services.dtd (196 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\be\welcome\css\b-sg-text-list__item.gif (47 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\wp\css\b-suggest\_ie\b-suggest__img_type3.gif (392 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\ru\welcome\icon1.ico (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\kk\mail.dtd (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{AC8A2266-D92B-4CCE-AEB5-0FEBA0FD2C75}\vkontakte.dll (628 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\ru\geolocation.dtd (124 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\translate-langs.xml (196 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\en\ic.dtd (567 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C25E60F0-88DE-445E-AB4E-55F4700A90E4}\locale\ru\odnoklassniki.dtd (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\en\welcome\ie\btn-check_.gif (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\weather\i_ch.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\kk\logo.dtd (169 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\kk\welcome\css\style.css (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\kk\about\product.dtd (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\plugin-translator.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GXARCLEV\rambler[1] (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GXARCLEV\profile[2] (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\cs\ic.dtd (566 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WXU749EJ\product[2] (200 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\kk\welcome\icon1.ico (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\icons\images.png (611 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\js\img\qwe.png (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\tr\fastdial\config.xml (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\uk\fastdial\product.dtd (914 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\COR8IIDQ\geolocation[1] (74 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\spelling\spell.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\quote\stock_up.png (587 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\widget-news.xsl (555 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\en\icons\yandex.png (604 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{3F580847-72EB-4D1D-937C-6B324D24137E}\error.png (400 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\quote\quote_down.png (605 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\about\background-ie.png (1764 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\geolocation.xml (330 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{6074A32F-35A3-4893-B290-A4BD186038B0}\mc.xml (285 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\en\textonly.dtd (153 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\en\bookmark.dtd (196 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\wp\css\b-video\b-video__img.png (980 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\uk\welcome\ie\btn-home_.gif (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\be\ic.dtd (752 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\en\geolocation.dtd (74 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\ru\bookmark.dtd (392 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{AC8A2266-D92B-4CCE-AEB5-0FEBA0FD2C75}\icons\videoslocked.png (843 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\traffic\red.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\ru\services.dtd (196 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\uk\welcome\css\b-sg-list__item_3.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\cs\yaru.dtd (654 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\ru\fastdial\logo.png (196 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{6074A32F-35A3-4893-B290-A4BD186038B0}\locale\cs\mc.dtd (320 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{6074A32F-35A3-4893-B290-A4BD186038B0}\icons\badge\active_hover.png (374 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\COR8IIDQ\product[1] (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GXARCLEV\defaults[1] (800 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\ru\welcome\images\example.png (1176 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\be\welcome\images\example.png (1176 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\kk\fastdial\logo.png (196 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\http://bar-widgets.yandex.ru/packages/approved/118/manifest.xml.zip (2105 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\cs\userinfo.dtd (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\tr\welcome\css\b-sg-list__pointer.png (251 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\tr\ic.dtd (583 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8LUVCT2R\facebook[1] (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\uk\TranslateBtn.dtd (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\weather\i-night-cloud-snow.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\kk\userinfo.dtd (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\be\spelling.dtd (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\be\pagetranslator.dtd (575 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C25E60F0-88DE-445E-AB4E-55F4700A90E4}\birth_pin.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C2E33C62-1E25-49E9-BABA-DBA2527F4C57}\notifications_new.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\wp\css\b-suggest\_ie\b-suggest__bg.png (1176 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{AC8A2266-D92B-4CCE-AEB5-0FEBA0FD2C75}\icons\opinions.png (639 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\be\welcome\icon1.ico (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{6074A32F-35A3-4893-B290-A4BD186038B0}\MSC.dll (2733 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\be\about\product.dtd (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\zakladki.messages.xml (196 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\opinions\1.png (470 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GXARCLEV\search[1] (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{6074A32F-35A3-4893-B290-A4BD186038B0}\locale\uk\mc.dtd (393 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\cs\login.dtd (817 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\plugin-translator.xml (396 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\kk\welcome\ie\btn-home.gif (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{AC8A2266-D92B-4CCE-AEB5-0FEBA0FD2C75}\icons\photosmark.png (560 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\en\pagetranslator.dtd (390 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{3F580847-72EB-4D1D-937C-6B324D24137E}\off.png (454 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WXU749EJ\srs[1] (473 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\ru\welcome\ie\welcome.html (196 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\en\geobase.xml (1099 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\wp\css\b-suggest-menu\b-suggest-menu.css (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\en\welcome\ie\btn-home_.gif (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{AC8A2266-D92B-4CCE-AEB5-0FEBA0FD2C75}\icons\events.png (781 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\moikrug\moikrug.png (874 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C2E33C62-1E25-49E9-BABA-DBA2527F4C57}\locale\tr\facebook.dtd (697 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\en\about\vendorlogo.png (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8LUVCT2R\quote[1] (856 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\tr\yaru.dtd (709 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{6074A32F-35A3-4893-B290-A4BD186038B0}\locale\be\mc.dtd (396 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GXARCLEV\moikrug[1] (602 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\searchfield\searchfield.xml (392 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C25E60F0-88DE-445E-AB4E-55F4700A90E4}\msg.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{6074A32F-35A3-4893-B290-A4BD186038B0}\locale\kk\mc.dtd (404 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\cs\welcome\ie\btn-check_.gif (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\COR8IIDQ\yaru[1] (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\quote_up.png (602 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\en\welcome\index.html (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\en\services\features.dtd (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\wp\css\l-content\l-content.css (311 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\messages.xml (293 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\kk\search.dtd (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C25E60F0-88DE-445E-AB4E-55F4700A90E4}\main_lock.png (792 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\be\quote.dtd (790 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\tr\userinfo.dtd (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\js\img\close-lover.png (427 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\icons\fav-yandex.ico (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\cs\welcome\css\b-sg-text-list__item.gif (47 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\bookmark\buttonEdit.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\kk\welcome\ie\welcome.html (196 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C2E33C62-1E25-49E9-BABA-DBA2527F4C57}\notifications_lock.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\kk\services.dtd (196 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\widget-news-active.gif (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GXARCLEV\radio[1] (79 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\readability\readability.css (196 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\kk\geolocation.dtd (128 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\en\welcome\ie\welcome.html (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\traffic\gray.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{6074A32F-35A3-4893-B290-A4BD186038B0}\band\css\button_end_normal.png (330 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\ru\welcome\css\b-sg-text-list__item.gif (47 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{6074A32F-35A3-4893-B290-A4BD186038B0}\band\logo.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\weather\convert.xml (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\wp\css\g-clear\g-clear.css (45 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\cs\about\vendorlogo.png (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\js\__YaSggst.ac.css (784 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\icons\subscriptions.png (779 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\en\subscription.dtd (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\ru\town.dtd (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{3F580847-72EB-4D1D-937C-6B324D24137E}\radio.dll (2812 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{3F580847-72EB-4D1D-937C-6B324D24137E}\radio.xml (417 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GXARCLEV\zakladki[1] (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\wp\css\b-suggest-menu\b-suggest-menu__corners.gif (72 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\tr\fastdial\logo-clear.png (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\cs\opinions.dtd (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C25E60F0-88DE-445E-AB4E-55F4700A90E4}\odnoklassniki.xml (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\be\money.dtd (527 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C2E33C62-1E25-49E9-BABA-DBA2527F4C57}\locale\en\facebook.dtd (681 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\be\welcome\css\style.css (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\cs\fastdial\product.dtd (824 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\kk\logobutton\logoconf.dtd (196 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\town.xml (980 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{AC8A2266-D92B-4CCE-AEB5-0FEBA0FD2C75}\icons\groupsmark.png (689 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\en\fastdial\config.xml (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\js\img\setup.png (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\locale\ru\smartbox.dtd (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\installer\place-after.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8LUVCT2R\userinfo[1] (479 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\distribution\distribution.xml (314 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\ru\TranslateBtn.dtd (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\icons\mail.png (565 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\defaults.dtd (400 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\tr\welcome\css\style.css (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{3F580847-72EB-4D1D-937C-6B324D24137E}\on.png (408 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GXARCLEV\widget-news[1] (392 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\tr\spelling.dtd (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C25E60F0-88DE-445E-AB4E-55F4700A90E4}\main_pin.png (795 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\en\opinions.dtd (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\uk\welcome\ie\btn-home.gif (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\en\welcome\ie\btn-check.gif (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\js\img\blackout.png (178 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\icons\wiki.png (534 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\mail\folder.png (441 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\bookmark\folder.png (441 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8LUVCT2R\send[1] (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\en\moikrug.dtd (602 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{6074A32F-35A3-4893-B290-A4BD186038B0}\band\css\button_content_normal.png (342 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\cs\town.dtd (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\tr\welcome\ie\welcome.html (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\yaru.xml (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\cs\srs.dtd (911 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\wp\css\b-title\b-title.css (103 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\cs\logo.dtd (130 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\en\fastdial\logo-clear.png (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C2E33C62-1E25-49E9-BABA-DBA2527F4C57}\facebook.png (464 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WXU749EJ\subscription[1] (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\en\yaru.dtd (655 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\.embedded (8 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8LUVCT2R\fotki[1] (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C2E33C62-1E25-49E9-BABA-DBA2527F4C57}\messages.png (584 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\tr\town.dtd (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WXU749EJ\moikrug[1] (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\tr\welcome\css\b-sg-list__item_4.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{6074A32F-35A3-4893-B290-A4BD186038B0}\band\css\main.css (196 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\tr\welcome\css\b-sg-list__item_3.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\tr\about\product.dtd (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8LUVCT2R\pagetranslator[1] (390 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{AC8A2266-D92B-4CCE-AEB5-0FEBA0FD2C75}\icons\applications.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\be\fotki.dtd (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\ru\welcome\ie\btn-check_.gif (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\kk\textonly.dtd (221 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\kk\welcome\ie\btn-check_.gif (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\be\browser\browserconf.dtd (185 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\quotelist.xsl (560 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\cs\fastdial\logo-clear.png (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\tr\textonly.dtd (161 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{6074A32F-35A3-4893-B290-A4BD186038B0}\band\corner.gif (77 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\cs\pagetranslator-tooltips.xml (526 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\en\welcome\css\b-sg-list__pointer.png (251 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\en\fastdial\product.dtd (876 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\ru\fastdial\product.dtd (918 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\wp\ie.html (196 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\cs\search.dtd (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\icons\auto.png (675 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\cs\mail.dtd (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\tr\login.dtd (907 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\uk\services.dtd (196 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\yaru\yaru.png (200 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\ru\pagetranslator-tooltips.xml (783 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\cs\icons\yandex.png (604 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\http://bar-widgets.yandex.ru/packages/approved/75/manifest.xml.zip (13 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\uk\logobutton\logoconf.dtd (196 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{6074A32F-35A3-4893-B290-A4BD186038B0}\band\pop-top_thumb__img.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\logobutton\logoconf.xml (196 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\uk\money.dtd (515 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\readability\disabled.png (417 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\textonly.xml (375 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\version (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\kk\services\features.dtd (196 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\kk\yaru.dtd (911 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\en\about\product.dtd (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{AC8A2266-D92B-4CCE-AEB5-0FEBA0FD2C75}\locale\kk\vkontakte.dtd (196 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\kk\moikrug.dtd (874 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\ic\5.png (213 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C25E60F0-88DE-445E-AB4E-55F4700A90E4}\main.png (732 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\subscription\add.png (779 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{6074A32F-35A3-4893-B290-A4BD186038B0}\band\pop-top_suggest.htm (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{AC8A2266-D92B-4CCE-AEB5-0FEBA0FD2C75}\icons\questions.png (747 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\quote\quote.png (583 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\opinions\3.png (502 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C2E33C62-1E25-49E9-BABA-DBA2527F4C57}\friends_lock.png (795 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\wp\css\ie.css (439 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\ru\common.dtd (285 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WXU749EJ\lenta[1] (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{AC8A2266-D92B-4CCE-AEB5-0FEBA0FD2C75}\profile.xml (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\installer\place-replace.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\spam.xml (765 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\ic\3.png (227 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\services\services.xml (784 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\http://bar-widgets.yandex.ru/packages/approved/91/manifest.xml.zip (601 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\en\welcome\ie\btn-home.gif (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\cs\pagetranslator.dtd (390 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\uk\geolocation.dtd (129 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\be\widget-news.dtd (655 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\quote.xml (856 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\about\vendorlogo.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\zakladki.xml (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\icons\catalog.png (502 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\tr\quote\quotelist.dtd (66 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\en\spam.dtd (318 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\COR8IIDQ\money[1] (327 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\search\highlight.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{6074A32F-35A3-4893-B290-A4BD186038B0}\band\favicon.png (611 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\quote\quotelist.xml (784 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\kk\welcome\css\b-sg-list__item_4.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C25E60F0-88DE-445E-AB4E-55F4700A90E4}\birth.png (559 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8LUVCT2R\product[1] (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{AC8A2266-D92B-4CCE-AEB5-0FEBA0FD2C75}\icons\groups.png (626 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\tr\welcome\ie\btn-check_.gif (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\yaru.messages.xml (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\ru\userinfo.dtd (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GXARCLEV\facebook[1] (681 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C2E33C62-1E25-49E9-BABA-DBA2527F4C57}\notifications.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\ru\spelling.dtd (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WXU749EJ\product[1] (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8LUVCT2R\login[1] (710 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{AC8A2266-D92B-4CCE-AEB5-0FEBA0FD2C75}\icons\notesmark.png (506 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\ru\yaru.dtd (932 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\kk\login.dtd (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{6074A32F-35A3-4893-B290-A4BD186038B0}\band\blank.gif (43 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\srs.xml (473 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\weather.png (515 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\icons\weather.png (633 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\tr\pagetranslator-tooltips.xml (526 bytes)
    %Documents and Settings%\%current user%\Application Data\Yandex\ui (38 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\textonly.messages.xml (277 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\fastdial\thumbnails\library.jpg (353 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{6074A32F-35A3-4893-B290-A4BD186038B0}\mc.messages.xml (459 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\ic\1.png (176 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C2E33C62-1E25-49E9-BABA-DBA2527F4C57}\locale\cs\facebook.dtd (667 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{6074A32F-35A3-4893-B290-A4BD186038B0}\icons\badge\active_press.png (316 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\pagetranslator.xml (196 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\cs\welcome\css\b-sg-list__pointer.png (251 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C25E60F0-88DE-445E-AB4E-55F4700A90E4}\friend.png (668 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\tr\common.dtd (204 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\kk\TranslateBtn.dtd (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\uk\bookmark.dtd (392 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\kk\spelling.dtd (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\fotki.messages.xml (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\geolocation\geolocation.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\tr\logo.dtd (118 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\ru\ic.dtd (766 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\icons\narod.png (739 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\weather\i-cloud-snow.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\kk\ic.dtd (876 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\js\img\bg.png (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\COR8IIDQ\login[1] (817 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\money.messages.xml (519 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\en\srs.dtd (796 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\en\town.dtd (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\opinions\2.png (508 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\tr\money.dtd (356 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\about\logo-ie-tiny.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\uk\welcome\index.html (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\en\quote.dtd (615 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{6074A32F-35A3-4893-B290-A4BD186038B0}\band\css\main.ie.css (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\userinfo.xml (479 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\kk\fotki.dtd (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\kk\quote\quotelist.dtd (87 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\en\welcome\css\b-sg-list__item_4.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\tr\logobutton\logoconf.dtd (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\cs\welcome\css\b-sg-header.png (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\tr\opinions.dtd (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\be\welcome\css\b-sg-header.png (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\logobutton\logo.png (632 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{6074A32F-35A3-4893-B290-A4BD186038B0}\band\trobber.gif (588 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\ru\welcome\css\b-sg-list__item_2.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\js\inject.js (745 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\weather\i-ch.png (930 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\icons\maps.png (723 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\en\services.dtd (196 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C25E60F0-88DE-445E-AB4E-55F4700A90E4}\odnoklassniki.dll (5506 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\wp\css\b-footer-links\b-footer-links.css (270 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\ru\quote.dtd (848 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\tr\welcome\css\b-sg-list__item_2.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\fastdial\thumbnails\mail.jpg (784 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\tr\spam.dtd (358 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\uk\welcome\ie\btn-check.gif (196 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\http://bar-widgets.yandex.ru/packages/approved/115/manifest.xml.zip (1281 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GXARCLEV\TranslateBtn[1] (892 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\COR8IIDQ\textonly[1] (153 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\cs\textonly.dtd (180 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{6074A32F-35A3-4893-B290-A4BD186038B0}\band\css\main.ie7.css (32 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\ru\widget-news.dtd (677 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GXARCLEV\messages[1] (392 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\weather\i-rain-ch2-summer.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\ru\welcome\css\style.css (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\kk\welcome\css\b-sg-list__item_2.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\weather\i-thund-rain.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\cs\fastdial\config.xml (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\kk\welcome\css\b-sg-list__item_1.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\ru\textonly.dtd (257 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\be\welcome\ie\btn-home.gif (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GXARCLEV\opinions[1] (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\pagetranslator-disabled.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\kk\welcome\css\b-sg-list__pointer.png (251 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\YandexBarIE.log (14088 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\en\quote\quotelist.dtd (63 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\kk\quote.dtd (778 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\icons\dicts.png (562 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{AC8A2266-D92B-4CCE-AEB5-0FEBA0FD2C75}\icons\profilelocked.png (674 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\icons\schedule.png (774 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\cs\welcome\css\b-sg-list__item_4.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\be\town.dtd (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\kk\bookmark.dtd (392 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WXU749EJ\pagetranslator[1] (196 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\COR8IIDQ\mc[1] (569 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\uk\moikrug.dtd (800 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\be\subscription.dtd (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\cs\TranslateBtn.dtd (975 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\traffic\yellow.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\icons\tv.png (600 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\kk\welcome\index.html (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\tr\about\vendorlogo.png (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\ru\logobutton\logoconf.dtd (196 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8LUVCT2R\widget-news[1] (437 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\icons\photos.png (771 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\en\welcome\icon1.ico (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\kk\welcome\css\b-sg-text-list__item.gif (47 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\uk\welcome\ie\welcome.html (196 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C2E33C62-1E25-49E9-BABA-DBA2527F4C57}\facebook_lock.png (775 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\cs\welcome\ie\welcome.html (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\icons\find.png (739 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\cs\welcome\css\b-sg-list__item_1.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{AC8A2266-D92B-4CCE-AEB5-0FEBA0FD2C75}\icons\matches.png (733 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\tr\fotki.dtd (887 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\uk\textonly.dtd (263 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\be\welcome\css\b-sg-list__pointer.png (251 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\tr\geolocation.dtd (75 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{6074A32F-35A3-4893-B290-A4BD186038B0}\band\css\button_close_normal.png (791 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WXU749EJ\smartbox[1] (409 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C2E33C62-1E25-49E9-BABA-DBA2527F4C57}\facebook_on.png (667 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{AC8A2266-D92B-4CCE-AEB5-0FEBA0FD2C75}\icons\friendsmark.png (678 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\en\welcome\css\b-sg-text-list__item.gif (47 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\opinions\4.png (507 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\js\lightBox_overlayie.css (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\cs\fastdial\logo.png (196 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\mail.messages.xml (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{AC8A2266-D92B-4CCE-AEB5-0FEBA0FD2C75}\icons\messageslocked.png (614 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{AC8A2266-D92B-4CCE-AEB5-0FEBA0FD2C75}\locale\en\vkontakte.dtd (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\weather\i-rain-grad.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C2E33C62-1E25-49E9-BABA-DBA2527F4C57}\locale\uk\facebook.dtd (917 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\tr\welcome\icon1.ico (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\uk\browser\browserconf.dtd (183 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\weather\i-night-cloud.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{6074A32F-35A3-4893-B290-A4BD186038B0}\locale\ru\mc.dtd (386 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\uk\welcome\css\b-sg-list__item_4.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C2E33C62-1E25-49E9-BABA-DBA2527F4C57}\events.png (478 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GXARCLEV\product[1] (200 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WXU749EJ\spellchecker[1] (507 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\uk\common.dtd (232 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\quote\stock_down.png (583 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\wp\css\l-table\l-table.css (668 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\js\jquery-1.5.1.min.js (314 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\wp\css\l-footer\l-footer.css (164 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\weather\i-snow.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\browser\browserconf.xml (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\COR8IIDQ\defaults[2] (400 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\presets\http://bar.yandex.ru/presets/default-partner.xml (147 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\icons\afisha.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\ru\logo.dtd (156 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\search.xml (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\wp\css\b-menu-ico\b-menu-ico__img.png (196 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\tr\welcome\css\b-sg-header.png (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\uk\pagetranslator.dtd (534 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\http://bar-widgets.yandex.ru/packages/approved/176/manifest.xml.zip (4545 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\be\mail.dtd (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{3F580847-72EB-4D1D-937C-6B324D24137E}\locale\ru\radio.dtd (108 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\ru\opinions.dtd (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\ru\welcome\ie\btn-home.gif (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\icons\games.png (536 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\uk\pagetranslator-tooltips.xml (815 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\traffic\green.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\be\textonly.dtd (265 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\cs\geolocation.dtd (72 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\tr\welcome\ie\btn-home_.gif (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{6074A32F-35A3-4893-B290-A4BD186038B0}\icons\icon1.png (628 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\uk\welcome\images\example.png (1176 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\about\logo-ie-large.png (196 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\kk\fastdial\logo-clear.png (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\uk\welcome\css\b-sg-list__pointer.png (251 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\bookmark\bookmark.png (668 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\cs\quote\quotelist.dtd (64 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\be\welcome\ie\btn-check_.gif (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\cs\welcome\ie\btn-home_.gif (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\srs.messages.xml (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\COR8IIDQ\mail[1] (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\icons\direct.png (567 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\be\spam.dtd (434 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{AC8A2266-D92B-4CCE-AEB5-0FEBA0FD2C75}\icons\eventslocked.png (851 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C2E33C62-1E25-49E9-BABA-DBA2527F4C57}\locale\be\facebook.dtd (911 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C2E33C62-1E25-49E9-BABA-DBA2527F4C57}\groups.png (708 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\uk\services\features.dtd (196 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{6074A32F-35A3-4893-B290-A4BD186038B0}\data\config.xml (94 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\tr\geobase.xml (2039 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\be\welcome\css\b-sg-list__item_1.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\uk\userinfo.dtd (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8LUVCT2R\messages[1] (392 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\en\spelling.dtd (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\SRS64.dll (1989 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\ru\moikrug.dtd (783 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\tr\services.dtd (196 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\tr\pagetranslator.dtd (381 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\be\login.dtd (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\be\welcome\index.html (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\uk\opinions.dtd (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\ru\welcome\css\b-sg-list__item_4.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\fotki.xml (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{AC8A2266-D92B-4CCE-AEB5-0FEBA0FD2C75}\icons\eventsmark.png (832 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\COR8IIDQ\smartbox[1] (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\translator.dll (3635 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\icons\yaru.png (644 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\money\money.png (578 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\search\gripper.png (203 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\be\quote\quotelist.dtd (85 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\tr\search.dtd (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WXU749EJ\town[1] (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\icons\tab.png (229 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\en\userinfo.dtd (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{AC8A2266-D92B-4CCE-AEB5-0FEBA0FD2C75}\icons\friendslocked.png (724 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\icons\calendar.png (525 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\kk\spam.dtd (423 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\cs\geobase.xml (1177 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C2E33C62-1E25-49E9-BABA-DBA2527F4C57}\messages_lock.png (693 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\uk\about\product.dtd (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\en\browser\browserconf.dtd (169 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\geobase.xml (2734 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\weather\i-snowstorm.png (983 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\kk\widget-news.dtd (766 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\http://bar-widgets.yandex.ru/packages/approved/140/manifest.xml.zip (1281 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\weather\i-ch-snow.png (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\logo.xml (341 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\kk\common.dtd (227 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\moikrug.xml (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\be\opinions.dtd (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\ru\welcome\css\b-sg-list__item_1.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C2E33C62-1E25-49E9-BABA-DBA2527F4C57}\note.png (339 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\ie\product.xml (200 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\spam.messages.xml (497 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\be\srs.dtd (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\en\logo.dtd (116 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\lenta.xml (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\icons\addresses.png (636 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\be\userinfo.dtd (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\readability\readability-print.css (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\be\welcome\ie\btn-check.gif (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{AC8A2266-D92B-4CCE-AEB5-0FEBA0FD2C75}\icons\notes.png (415 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\kk\pagetranslator-tooltips.xml (683 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\be\fastdial\logo-clear.png (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\cs\quote.dtd (626 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{AC8A2266-D92B-4CCE-AEB5-0FEBA0FD2C75}\icons\audio.png (510 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\opinions\0.png (539 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{AC8A2266-D92B-4CCE-AEB5-0FEBA0FD2C75}\locale\be\vkontakte.dtd (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C2E33C62-1E25-49E9-BABA-DBA2527F4C57}\facebook.dtd (920 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C2E33C62-1E25-49E9-BABA-DBA2527F4C57}\status.png (473 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\login.messages.xml (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\cs\subscription.dtd (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\en\widget-news.dtd (437 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\logo\logo.png (409 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\icons\fav-bing.png (347 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\tr\welcome\images\example.png (392 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\uk\search.dtd (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\wp\css\b-suggest\_ie\b-suggest__img_type2.gif (588 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\en\TranslateBtn.dtd (892 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\ru\about\product.dtd (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GXARCLEV\vkontakte[1] (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\cs\welcome\index.html (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\wp\css\b-footer\b-footer.css (78 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\widget-news.xml (392 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\wp\css\b-menu-ico\b-menu-ico.css (788 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\search\search.png (487 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C2E33C62-1E25-49E9-BABA-DBA2527F4C57}\locale\ru\facebook.dtd (920 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GXARCLEV\spam[1] (318 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\cs\welcome\icon1.ico (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\quote\gold_up.png (658 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\icons\navigate.png (737 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\be\pagetranslator-tooltips.xml (773 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\icons\fav-yandex.png (658 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{6074A32F-35A3-4893-B290-A4BD186038B0}\band\css\button_content.png (588 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C2E33C62-1E25-49E9-BABA-DBA2527F4C57}\locale\kk\facebook.dtd (913 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\uk\welcome\css\b-sg-list__item_1.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\ru\welcome\ie\btn-check.gif (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WXU749EJ\opinions[1] (719 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8LUVCT2R\money[1] (979 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\weather\i-fog.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\COR8IIDQ\common[1] (564 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\ru\quote\quotelist.dtd (90 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{AC8A2266-D92B-4CCE-AEB5-0FEBA0FD2C75}\icons\groupslocked.png (707 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\mail.xml (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GXARCLEV\fotki[1] (784 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\be\bookmark.dtd (392 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\quote.messages.xml (683 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\icons\icon_16.png (643 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C2E33C62-1E25-49E9-BABA-DBA2527F4C57}\facebook.xml (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\cs\welcome\ie\btn-home.gif (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{AC8A2266-D92B-4CCE-AEB5-0FEBA0FD2C75}\icons\photoslocked.png (615 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\smartbox.xml (409 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{AC8A2266-D92B-4CCE-AEB5-0FEBA0FD2C75}\profile.messages.xml (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\wp\css\b-video\b-video.css (103 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\icons\spam.png (798 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\welcome\ie\widgets.png (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\ru\welcome\css\b-sg-list__pointer.png (251 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\uk\login.dtd (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GXARCLEV\mc[1] (284 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\en\logobutton\logoconf.dtd (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C25E60F0-88DE-445E-AB4E-55F4700A90E4}\notif.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\toolbar\autoinst.xml (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\cs\services\features.dtd (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\cs\fotki.dtd (784 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\ru\fotki.dtd (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\icons\advertising.png (799 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8LUVCT2R\radio[1] (417 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\bookmark\buttonAdd.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\en\welcome\css\b-sg-list__item_3.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\be\moikrug.dtd (818 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\ru\welcome\css\b-sg-list__item_3.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\ru\fastdial\logo-clear.png (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\en\pagetranslator-tooltips.xml (526 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\subscription\subscription.png (620 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\opinions.xml (719 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\be\common.dtd (232 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\tr\fastdial\product.dtd (804 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\ru\spam.dtd (431 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\be\logo.dtd (161 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GXARCLEV\logo[1] (116 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\COR8IIDQ\radio[1] (496 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\en\search.dtd (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\be\welcome\ie\welcome.html (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\fastdial\product.xml (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{6074A32F-35A3-4893-B290-A4BD186038B0}\band\pop-top_correction.htm (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GXARCLEV\odnoklassniki[1] (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C2E33C62-1E25-49E9-BABA-DBA2527F4C57}\friends.png (743 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\welcome\ie\favicon.ico (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C2E33C62-1E25-49E9-BABA-DBA2527F4C57}\share.png (753 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WXU749EJ\odnoklassniki[1] (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\icons\google.png (856 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Updater\barie\statistics.xml (991 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\en\welcome\css\b-sg-list__item_2.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\wp\css\b-suggest\_ie\b-suggest__img_type3.png (784 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\TranslateBtn.png (636 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{AC8A2266-D92B-4CCE-AEB5-0FEBA0FD2C75}\icons\friends.png (564 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\ru\login.dtd (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\readability\sprite-readability.png (588 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\kk\welcome\css\b-sg-list__item_3.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\uk\widget-news.dtd (664 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C2E33C62-1E25-49E9-BABA-DBA2527F4C57}\messages_2.png (414 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\COR8IIDQ\defaults[1] (1600 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8LUVCT2R\textonly[1] (375 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\icons\metrics.png (541 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\services\features.xml (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8LUVCT2R\geolocation[1] (330 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\auth_overlay.png (406 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\ic\6.png (184 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\kk\welcome\ie\btn-home_.gif (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C2E33C62-1E25-49E9-BABA-DBA2527F4C57}\video.png (543 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\readability\applied.png (411 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\ru\money.dtd (531 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\kk\fastdial\config.xml (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WXU749EJ\cy[1] (531 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\about\logo-ie-medium.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\readability\ready.png (431 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\kk\welcome\images\example.png (1176 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\COR8IIDQ\common[2] (188 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\search.messages.xml (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\translator.messages.xml (894 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WXU749EJ\translator[1] (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\uk\subscription.dtd (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\ru\subscription.dtd (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\cs\spam.dtd (315 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\icons\search.png (592 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\fastdial\thumbnails\yandex.jpg (157 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\cs\bookmark.dtd (196 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\weather\i-cloud.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\be\geolocation.dtd (124 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\be\welcome\css\b-sg-list__item_3.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\cs\moikrug.dtd (602 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\cs\widget-news.dtd (437 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\tr\fastdial\logo.png (196 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\kk\money.dtd (579 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\cs\welcome\images\example.png (392 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{3F580847-72EB-4D1D-937C-6B324D24137E}\locale\cs\radio.dtd (79 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\installer\place-before.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\uk\welcome\icon1.ico (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\quote\gold_down.png (667 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{AC8A2266-D92B-4CCE-AEB5-0FEBA0FD2C75}\icons\profilemark.png (631 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\uk\srs.dtd (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\wp\css\b-suggest\_ie\b-suggest__img_type1.png (1372 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\uk\logo.dtd (167 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\icons\market.png (672 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\lenta.messages.xml (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\uk\quote\quotelist.dtd (84 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\tr\welcome\css\b-sg-text-list__item.gif (47 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\js\img\setup.gif (105 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\uk\fastdial\logo.png (196 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\js\img\toggle.gif (57 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\wp\css\b-logo\b-logo.png (196 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\money.xml (979 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\en\common.dtd (188 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\be\TranslateBtn.dtd (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C25E60F0-88DE-445E-AB4E-55F4700A90E4}\guest.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\tr\icons\yandex.png (604 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\icons\job.png (572 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\search\teleport.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\tr\welcome\ie\btn-check.gif (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\smartbox.dll (5530 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\ru\welcome\css\b-sg-header.png (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\js\img\b-spin-50.gif (392 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\welcome\ie\bar-ie.css (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\userinfo.messages.xml (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\be\yaru.dtd (953 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GXARCLEV\profile[1] (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\tr\welcome\css\b-sg-list__item_1.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\spellchecker.xml (507 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\ic\4.png (217 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\tr\moikrug.dtd (606 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\moikrug.messages.xml (946 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\icons\cards.png (782 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\cs\money.dtd (327 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\tr\TranslateBtn.dtd (913 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{AC8A2266-D92B-4CCE-AEB5-0FEBA0FD2C75}\locale\uk\vkontakte.dtd (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{6074A32F-35A3-4893-B290-A4BD186038B0}\locale\en\mc.dtd (284 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\icons\mycircle.png (728 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\kk\opinions.dtd (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\login.xml (710 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\SRS.dll (3321 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\cs\logobutton\logoconf.dtd (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\uk\spam.dtd (404 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\fotki\fotki.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\spam\spam_disable.png (686 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\cs\spelling.dtd (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{AC8A2266-D92B-4CCE-AEB5-0FEBA0FD2C75}\icons\noteslocked.png (552 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\ru\welcome\index.html (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\uk\welcome\css\b-sg-list__item_2.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\be\fastdial\logo.png (196 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{AC8A2266-D92B-4CCE-AEB5-0FEBA0FD2C75}\locale\ru\vkontakte.dtd (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\data\config.xml (392 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\dot.png (293 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GXARCLEV\smartbox[1] (410 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\en\welcome\css\b-sg-header.png (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\kk\srs.dtd (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\tr\mail.dtd (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\tr\bookmark.dtd (196 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{6074A32F-35A3-4893-B290-A4BD186038B0}\icons\badge\hover.png (297 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C25E60F0-88DE-445E-AB4E-55F4700A90E4}\photo.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\uk\spelling.dtd (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\ru\browser\browserconf.dtd (181 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\wp\css\b-suggest-menu\b-suggest-menu.ie.css (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\smartbox.messages.xml (993 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\uk\ic.dtd (751 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\weather\i-sun.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\spam\spam_enable.png (685 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\uk\welcome\ie\btn-check_.gif (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WXU749EJ\vkontakte[1] (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\COR8IIDQ\autoinst[1] (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\welcome\ie\bg-bottom-ie.jpg (1960 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\icons\video.png (538 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{6074A32F-35A3-4893-B290-A4BD186038B0}\locale\tr\mc.dtd (304 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\kk\town.dtd (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\icons\news.png (637 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\icons\searchprovider.png (844 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C2E33C62-1E25-49E9-BABA-DBA2527F4C57}\news_feed.png (463 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WXU749EJ\common[1] (188 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\uk\welcome\css\style.css (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\http://bar-widgets.yandex.ru/packages/approved/143/manifest.xml.zip (1281 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WXU749EJ\search[1] (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\wp\css\b-suggest\_ie\b-suggest__img_type1.gif (784 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\COR8IIDQ\yaru[2] (655 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\wp\css\b-suggest\b-suggest.ie.css (518 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{6074A32F-35A3-4893-B290-A4BD186038B0}\band\pop-top_suggest_popup.htm (866 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\mail\mail.png (565 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\ru\mail.dtd (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\kk\pagetranslator.dtd (488 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\uk\mail.dtd (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\welcome\ie\bg-top.jpg (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\be\search.dtd (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\kk\welcome\css\b-sg-header.png (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C2E33C62-1E25-49E9-BABA-DBA2527F4C57}\friends_requests.png (887 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C2E33C62-1E25-49E9-BABA-DBA2527F4C57}\facebook.dll (2146 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\quote\currency_up.png (565 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\.manifest.mf (132 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\en\fotki.dtd (784 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\en\welcome\images\example.png (392 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\spellchecker.messages.xml (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\translator.xml (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\cs\browser\browserconf.dtd (169 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WXU749EJ\defaults[1] (400 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\js\img\ya-logo.jpg (588 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\uk\quote.dtd (799 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\uk\fastdial\logo-clear.png (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\COR8IIDQ\rambler[1] (392 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\weather\i-night.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C25E60F0-88DE-445E-AB4E-55F4700A90E4}\disc.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{AC8A2266-D92B-4CCE-AEB5-0FEBA0FD2C75}\icons\messagesmark.png (597 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{AC8A2266-D92B-4CCE-AEB5-0FEBA0FD2C75}\icons\videosmark.png (865 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\weather\i-rain-ch-summer.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\uk\welcome\css\b-sg-text-list__item.gif (47 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\ru\pagetranslator.dtd (526 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\cs\common.dtd (193 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\ic\0.png (177 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\ru\welcome\ie\btn-home_.gif (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\kk\browser\browserconf.dtd (182 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\uk\yaru.dtd (927 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\icons\blogs.png (655 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{6074A32F-35A3-4893-B290-A4BD186038B0}\icons\badge\anim_0.png (254 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\widget-news.png (708 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\en\mail.dtd (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\opinions\5.png (460 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\COR8IIDQ\srs[1] (796 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\tr\welcome\index.html (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\be\fastdial\product.dtd (918 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{3F580847-72EB-4D1D-937C-6B324D24137E}\streamplayer.exe (1765 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GXARCLEV\srs[1] (1269 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GXARCLEV\spelling[1] (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\COR8IIDQ\product[2] (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\locale\tr\widget-news.dtd (492 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\quotelist.xml (784 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\wp\css\l-footer\l-footer__bg.png (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{AC8A2266-D92B-4CCE-AEB5-0FEBA0FD2C75}\icons\videos.png (836 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\COR8IIDQ\quote[1] (615 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\cs\welcome\css\style.css (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\cs\about\product.dtd (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\quote\quotelist.xsl (729 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\en\welcome\css\b-sg-list__item_1.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\icons\money.png (566 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8LUVCT2R\bookmark[1] (196 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\COR8IIDQ\town[1] (980 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\ru\srs.dtd (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\wp\css\b-suggest\_ie\b-suggest__img_type2.png (1176 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{C1FEF874-31AA-4CF2-AAD7-7548142CFFE4}\locale\be\welcome\css\b-sg-list__item_4.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\be\logobutton\logoconf.dtd (196 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\logo\settings.png (827 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GXARCLEV\ic[1] (567 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\readability\readability.js (314 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\weather\i-cloud-rain.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\welcome\ie\icons.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\branding\{324ADAAF-57CA-4052-915C-F0A1F015BA15}\locale\tr\browser\browserconf.dtd (169 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\search\dropdown.png (207 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\weather\i-rain-summer.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GXARCLEV\common[1] (376 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F4F64634-2F5C-47A6-AA00-953419808876}\icons\pagetranslator.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\packages\{F8408EEE-C759-40B6-9810-82534B291D4F}\icons\favorite.png (466 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WXU749EJ\product[4] (876 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Updater\vb\statistics.xml (988 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GXARCLEV\product[2] (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GXARCLEV\config[1] (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8LUVCT2R\product[2] (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\COR8IIDQ\product[4] (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WXU749EJ\product[3] (876 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\FastDialIE.log (163 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8LUVCT2R\favorites[1] (290 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\COR8IIDQ\product[3] (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\vb\fav\fav_full.xml (7 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Toolbar\vb\fav\fav_lite.xml (5 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Nichrome\User Data\Default\History (2855 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Opera\Opera\icons\mail.yandex.ru.idx (62 bytes)
    %Documents and Settings%\%current user%\Favorites\Links\Словари.url (295 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Nichrome\User Data\Default\Top Sites-journal (7514 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Nichrome\User Data\Default\Local Storage\chrome-extension_nkcpopggjcjkiicpenikeogioednjeac_0.localstorage-journal (5033 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Opera\Opera\icons\maps.yandex.ru.ico (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Opera\Opera\icons\maps.yandex.ru.idx (62 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Web Data (1315 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Opera\Opera\icons\disk.yandex.ru.idx (62 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Opera\Opera\icons\video.yandex.ru.idx (64 bytes)
    %Documents and Settings%\%current user%\Favorites\Links\Маркет.url (293 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Xpom\User Data\Default\Local Storage\chrome-extension_nkcpopggjcjkiicpenikeogioednjeac_0.localstorage-journal (5033 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Internet Explorer\Services\news.yandex.ru.ico (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Chromium\User Data\Default\Favicons-journal (9552 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Nichrome\User Data\Default\Favicons (6469 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Bromium\User Data\Local State (96 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Opera\Opera\icons\market.yandex.ru.ico (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Local State (96 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Internet Explorer\Services\music.yandex.ru.ico (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Opera\Opera\icons\video.yandex.ru.ico (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\etilqs_pClvpdwyREOi6Hh (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Opera\Opera\icons\disk.yandex.ru.ico (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Opera\Opera\icons\news.yandex.ru.idx (62 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Chromium\User Data\Default\History-journal (7514 bytes)
    %Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\nahd6ha2.default\chromeappsstore.sqlite (107 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Chromium\User Data\Default\Web Data-journal (9466 bytes)
    %Documents and Settings%\%current user%\Favorites\Links\Новости.url (289 bytes)
    %Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\nahd6ha2.default\searchplugins\yandex.ru-054209.xml (7 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Internet\User Data\Local State (96 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Chromium\User Data\Default\Local Storage\chrome-extension_nkcpopggjcjkiicpenikeogioednjeac_0.localstorage (299 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Preferences (500 bytes)
    %Documents and Settings%\%current user%\Favorites\Links\Диск.url (289 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Chromium\User Data\Default\Bookmarks (969 bytes)
    %Documents and Settings%\%current user%\Favorites\Links\Видео.url (291 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Chromium\User Data\Default\Preferences (500 bytes)
    %Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\nahd6ha2.default\prefs.js (918 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Bookmarks (969 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Favicons (6469 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Xpom\User Data\Default\Favicons (4731 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\History (2855 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Chromium\User Data\Default\Top Sites-journal (7514 bytes)
    %Documents and Settings%\%current user%\Favorites\Links\Музыка.url (291 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Xpom\Application\First Run (0 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Internet Explorer\Services\www.yandex.ru.ico (5 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Local Storage\chrome-extension_nkcpopggjcjkiicpenikeogioednjeac_0.localstorage (299 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Nichrome\User Data\Local State (96 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Nichrome\User Data\Default\Web Data-journal (9466 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Top Sites-journal (7514 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Internet Explorer\Services\mail.yandex.ru.ico (5 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\etilqs_Ed3eQTeScebyQfe (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Comodo\Dragon\User Data\Local State (96 bytes)
    %Documents and Settings%\%current user%\Favorites\Links\Карты.url (289 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Opera\Opera\icons\www.yandex.ru.idx (60 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Internet\User Data\Default\Preferences (378 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\etilqs_m6A43M8eSSaIW8A (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Internet Explorer\Services\maps.yandex.ru.ico (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Xpom\User Data\Default\Preferences (419 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Xpom\User Data\Default\Favicons-journal (5042 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Preferences (378 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Nichrome\User Data\Default\Preferences (500 bytes)
    %Documents and Settings%\%current user%\Application Data\Opera\Opera\bookmarks.adr (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\etilqs_KBFtDbYHHgGx7Fb (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Web Data-journal (9466 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Internet Explorer\Services\disk.yandex.ru.ico (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Bromium\User Data\Default\Preferences (378 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Chromium\Application\First Run (0 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Chromium\User Data\Local State (96 bytes)
    %Documents and Settings%\%current user%\Favorites\Links\Почта.url (289 bytes)
    %Documents and Settings%\%current user%\Application Data\Opera\Opera\operaprefs.ini (336 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Xpom\User Data\Default\Web Data (1315 bytes)
    %Documents and Settings%\%current user%\Application Data\Opera\Opera\toolbar\standard_toolbar.ini (646 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Opera\Opera\icons\www.yandex.ru.ico (5 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Chromium\User Data\Default\Local Storage\chrome-extension_nkcpopggjcjkiicpenikeogioednjeac_0.localstorage-journal (5033 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Nichrome\User Data\Default\History-journal (7514 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Internet Explorer\Services\market.yandex.ru.ico (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Local Storage\chrome-extension_nkcpopggjcjkiicpenikeogioednjeac_0.localstorage-journal (5033 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Opera\Opera\icons\mail.yandex.ru.ico (5 bytes)
    %Documents and Settings%\%current user%\Application Data\Opera\Opera\sessions\autosave.win (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Nichrome\User Data\Default\Favicons-journal (9552 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Nichrome\Application\First Run (0 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Xpom\User Data\Default\Local Storage\chrome-extension_jaocgokledfmfebefgbeokdodbbdjhdd_0.localstorage (18323 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Opera\Opera\icons\music.yandex.ru.ico (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Xpom\User Data\Default\Local Storage\chrome-extension_jaocgokledfmfebefgbeokdodbbdjhdd_0.localstorage-journal (5033 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Nichrome\User Data\Default\Bookmarks (969 bytes)
    %Documents and Settings%\%current user%\Application Data\Opera\Opera\search.ini (587 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Xpom\User Data\Local State (96 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\vendor.xml (1293 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\History-journal (7514 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Internet Explorer\Services\slovari.yandex.ru.ico (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\User Data\Default\Favicons-journal (9552 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Google\Chrome\Application\First Run (0 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Opera\Opera\icons\market.yandex.ru.idx (66 bytes)
    %Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\nahd6ha2.default\chromeappsstore.sqlite-journal (3282 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Opera\Opera\icons\slovari.yandex.ru.ico (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Internet Explorer\Services\video.yandex.ru.ico (1 bytes)
    %Documents and Settings%\%current user%\Application Data\Opera\Opera\speeddial.ini (260 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Xpom\User Data\Default\Bookmarks (969 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Opera\Opera\icons\slovari.yandex.ru.idx (68 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Opera\Opera\icons\news.yandex.ru.ico (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Xpom\User Data\Default\Web Data-journal (9466 bytes)
    %Documents and Settings%\%current user%\Favorites\Links\Яндекс.url (287 bytes)
    %Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\profiles.ini (109 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Opera\Opera\icons\music.yandex.ru.idx (64 bytes)
    %Documents and Settings%\%current user%\Application Data\Mozilla\Firefox\Profiles\nahd6ha2.default\sessionstore.js (374 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\COR8IIDQ\product[5] (200 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8LUVCT2R\messages[2] (392 bytes)
    %Documents and Settings%\%current user%\Application Data\Yandex\clids-barff.xml (394 bytes)

  4. Delete the following value(s) in the autorun key (How to Work with System Registry):

    [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
    "Praetorian" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Yandex\Updater\praetorian.exe"

  5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
  6. Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

No votes yet


Lavasoft is the maker of Ad-Aware, the world's most popular anti-malware software with over 450 million downloads.
© 2026 Lavasoft. All rights reserved.
Terms Of Use |   Privacy Policy


x

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Enjoy unique new features, lightning fast scans and a simple yet beautiful new look in our best antivirus yet!

For a quicker, lighter and more secure experience, download the all new adaware antivirus 12 now!

Download adaware antivirus 12
No thanks, continue to lavasoft.com
close x

Discover the new adaware antivirus 12

Our best antivirus yet

Download Now