MD5: 7ea8b386deb153674ae71fbaac54ab76
SHA1: 17476de7e0d446cf9c7f68b6061016abf4132910
SHA256: f74cbf5b6de88c305c8889455151a4a641fe7070442f5f16d12f1f312164f330
SSDeep: 12288:mlzcNRuu/0zxHGSAsbl/JgisB8SwkbFsVCTKXDtRv2VyGXLL:mU7/GHmOJlCXwkaVzTzvO
Size: 724536 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: Catalina Group Ltd.
Created at: 2015-10-24 01:28:22
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

CatalinaUpdate.exe:1256
CatalinaUpdate.exe:956
CatalinaUpdate.exe:1572
citrio_48.0.2564.270_1.exe:1144
%original file name%.exe:1964

The Trojan injects its code into the following process(es):

CatalinaUpdate.exe:1352
CatalinaUpdate.exe:1496

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process CatalinaUpdate.exe:1256 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\Install\{091E7932-CF93-4194-B98B-4DF75362EFF0}\citrio_48.0.2564.270_1.exe (453901 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\Download\{92F8A219-E740-49D5-B785-B962AD819724}\48.0.2564.270\citrio_48.0.2564.270_1.exe (449813 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\Install (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{59542433-284A-4EA3-B073-F565EFE689C2}-citrio_48.0.2564.270_1.exe (0 bytes)

The process CatalinaUpdate.exe:1352 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_te.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ca.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ru.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_nl.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_fi.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_pl.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_fr.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\psmachine.dll (673 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_uk.dll (26 bytes)
%WinDir%\Tasks\CatalinaGroupUpdateTaskUserS-1-5-21-1844237615-1960408961-1801674531-1003Core.job (948 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_th.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_zh-TW.dll (19 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_vi.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_es-419.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdate.dll (5873 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_fil.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ta.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_tr.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ar.dll (24 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_sk.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_is.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_mr.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_sw.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_es.dll (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_hr.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ja.dll (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_kn.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_en.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_en-GB.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\psuser.dll (673 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_no.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ml.dll (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\CatalinaUpdateHelper.msi (36 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ur.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_am.dll (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_pt-BR.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\CatalinaUpdate.exe (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_bn.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_sv.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_et.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_gu.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_da.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\CatalinaUpdate.exe (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_fa.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ms.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_sr.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_sl.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_hu.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_cs.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_iw.dll (23 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_lt.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ko.dll (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_el.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_hi.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_lv.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_zh-CN.dll (19 bytes)
%WinDir%\Tasks\CatalinaGroupUpdateTaskUserS-1-5-21-1844237615-1960408961-1801674531-1003UA.job (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_de.dll (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_id.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\CatalinaUpdateOnDemand.exe (58 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_pt-PT.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_bg.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\npCatalinaUpdate3.dll (1281 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\CatalinaUpdateBroker.exe (58 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\CatalinaCrashHandler.exe (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ro.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_it.dll (28 bytes)

The process citrio_48.0.2564.270_1.exe:1144 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\CR_DD852.tmp\CITRIO.PACKED.7Z (114356 bytes)

The process %original file name%.exe:1964 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_sl.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_gu.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUT2.tmp (22433 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_nl.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_te.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_sk.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_el.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ru.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_es-419.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_iw.dll (23 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_no.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_tr.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_sr.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_en-GB.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_da.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ro.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_uk.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_zh-TW.dll (19 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_bn.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ms.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ta.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\CatalinaUpdateBroker.exe (58 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_es.dll (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdate.dll (1990 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_sw.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_de.dll (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_is.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_sv.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_fr.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_en.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_cs.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_mr.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_pt-BR.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_fa.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_kn.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_bg.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_pt-PT.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_id.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_fi.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ja.dll (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\npCatalinaUpdate3.dll (236 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\psuser.dll (161 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ml.dll (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ko.dll (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_th.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ca.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_vi.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_hi.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_zh-CN.dll (19 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_lv.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_hu.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\CatalinaUpdate.exe (130 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ar.dll (24 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_pl.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_hr.dll (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\CatalinaUpdateHelper.msi (36 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_lt.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_et.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_am.dll (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\psmachine.dll (155 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\CatalinaCrashHandler.exe (130 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_it.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_fil.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ur.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\CatalinaUpdateOnDemand.exe (58 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp (0 bytes)

Registry activity

The process CatalinaUpdate.exe:1256 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "88 C5 4F 1D BB AE 1E 00 95 41 A1 AA B8 55 FB 49"

[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"usagestats" = "1"
"brand" = "GGLS"
"InstallTime" = "1461018921"
"referral" = "1:citrio_website"
"lang" = "en"

[HKCU\Software\CatalinaGroup\Update\proxy]
"source" = "IE"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\CatalinaGroup\Update]
"LastInstallerError"

[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"LastInstallerExtraCode1"
"browser"
"LastInstallerError"
"ap"
"LastInstallerSuccessLaunchCmdLine"
"eulaaccepted"
"experiment_labels"

[HKCU\Software\CatalinaGroup\Update]
"LastInstallerResultUIString"

[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"LastInstallerResult"
"LastInstallerResultUIString"
"tttoken"

[HKCU\Software\CatalinaGroup\Update]
"LastInstallerExtraCode1"
"LastInstallerSuccessLaunchCmdLine"
"LastInstallerResult"

[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"iid"

The process CatalinaUpdate.exe:1352 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\MozillaPlugins\@catalinahub.net/CatalinaGroup Update;version=9]
"vendor" = "Catalina Group Ltd."
"ProductName" = "CatalinaGroup Update"

[HKCU\Software\CatalinaGroup\Update\ClientState\{6C598730-F715-407B-A7AE-A8F10D0F8FA7}]
"iid" = "{85C86DCC-5D4F-415D-A40F-706AF37A626A}"

[HKCU\Software\CatalinaGroup\Update]
"UID" = "{95F0392D-22E6-48F3-A529-EFF3D49FE892}"

[HKCU\Software\Classes\MIME\Database\Content Type\application/x-vnd.catalinahub.oneclickctrl.9]
"CLSID" = "{841F4080-C687-4E9C-BD6E-EB5EECF4FAE6}"

[HKCU\Software\Classes\CatalinaGroup.OneClickCtrl.9\CLSID]
"(Default)" = "{841F4080-C687-4E9C-BD6E-EB5EECF4FAE6}"

[HKCU\Software\Classes\CLSID\{841F4080-C687-4E9C-BD6E-EB5EECF4FAE6}]
"(Default)" = "CatalinaGroup Update Plugin"

[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{71216BD6-4D03-4387-BD01-7FE8D9512541}]
"Policy" = "3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Classes\MIME\Database\Content Type\application/x-vnd.catalinahub.update3webcontrol.3]
"CLSID" = "{71216BD6-4D03-4387-BD01-7FE8D9512541}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{841F4080-C687-4E9C-BD6E-EB5EECF4FAE6}]
"AppName" = "CatalinaUpdate.exe"

[HKCU\Software\CatalinaGroup\Update]
"Version" = "1.3.25.223"

[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"usagestats" = "1"

[HKCU\Software\MozillaPlugins\@catalinahub.net/CatalinaGroup Update;version=9]
"Description" = "CatalinaGroup Update"

[HKCU\Software\CatalinaGroup\Update\Clients\{6C598730-F715-407B-A7AE-A8F10D0F8FA7}]
"Name" = "Catalina Update"

[HKCU\Software\CatalinaGroup\Update\ClientState\{6C598730-F715-407B-A7AE-A8F10D0F8FA7}]
"InstallTime" = "1461018835"

[HKCU\Software\Classes\CLSID\{841F4080-C687-4E9C-BD6E-EB5EECF4FAE6}\InprocServer32]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\npCatalinaUpdate3.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Classes\CatalinaGroup.Update3WebControl.3]
"(Default)" = "CatalinaGroup Update Plugin"

[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{841F4080-C687-4E9C-BD6E-EB5EECF4FAE6}]
"Policy" = "3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update]
"CatalinaUpdate.exe" = "CatalinaGroup Update"

[HKCU\Software\Classes\CLSID\{841F4080-C687-4E9C-BD6E-EB5EECF4FAE6}\ProgID]
"(Default)" = "CatalinaGroup.OneClickCtrl.9"

[HKCU\Software\MozillaPlugins\@catalinahub.net/CatalinaGroup Update;version=9]
"Path" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\npCatalinaUpdate3.dll"

[HKCU\Software\Classes\CLSID\{841F4080-C687-4E9C-BD6E-EB5EECF4FAE6}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\MozillaPlugins\@catalinahub.net/CatalinaGroup Update;version=3]
"Description" = "CatalinaGroup Update"
"ProductName" = "CatalinaGroup Update"

[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{841F4080-C687-4E9C-BD6E-EB5EECF4FAE6}]
"AppPath" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update"

[HKCU\Software\MozillaPlugins\@catalinahub.net/CatalinaGroup Update;version=3]
"vendor" = "Catalina Group Ltd."

[HKCU\Software\Classes\CLSID\{71216BD6-4D03-4387-BD01-7FE8D9512541}\InprocServer32]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\npCatalinaUpdate3.dll"

[HKCU\Software\MozillaPlugins\@catalinahub.net/CatalinaGroup Update;version=9]
"Version" = "9"

[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{71216BD6-4D03-4387-BD01-7FE8D9512541}]
"AppPath" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223"

[HKCU\Software\CatalinaGroup\Update\ClientState\{6C598730-F715-407B-A7AE-A8F10D0F8FA7}]
"pv" = "1.3.25.223"

[HKCU\Software\Classes\CatalinaGroup.Update3WebControl.3\CLSID]
"(Default)" = "{71216BD6-4D03-4387-BD01-7FE8D9512541}"

[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{71216BD6-4D03-4387-BD01-7FE8D9512541}]
"AppName" = "CatalinaUpdateOnDemand.exe"

[HKCU\Software\CatalinaGroup\Update]
"Path" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\CatalinaUpdate.exe"

[HKCU\Software\MozillaPlugins\@catalinahub.net/CatalinaGroup Update;version=3]
"Version" = "3"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "07 DF CF 03 EF 3C 4D D5 82 8C BC 73 83 77 AF 1B"

[HKCU\Software\Classes\CLSID\{71216BD6-4D03-4387-BD01-7FE8D9512541}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\CatalinaGroup\Update\Clients\{6C598730-F715-407B-A7AE-A8F10D0F8FA7}]
"pv" = "1.3.25.223"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Classes\CLSID\{71216BD6-4D03-4387-BD01-7FE8D9512541}\ProgID]
"(Default)" = "CatalinaGroup.Update3WebControl.3"

[HKCU\Software\MozillaPlugins\@catalinahub.net/CatalinaGroup Update;version=3]
"Path" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\npCatalinaUpdate3.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Classes\CatalinaGroup.OneClickCtrl.9]
"(Default)" = "CatalinaGroup Update Plugin"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Classes\CLSID\{71216BD6-4D03-4387-BD01-7FE8D9512541}]
"(Default)" = "CatalinaGroup Update Plugin"

[HKCU\Software\CatalinaGroup\Update\ClientState\{6C598730-F715-407B-A7AE-A8F10D0F8FA7}]
"brand" = "GGLS"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"CatalinaGroup Update" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\CatalinaUpdate.exe /c"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\CatalinaGroup\Update]
"eulaaccepted"
"ui"
"LastChecked"

[HKCU\Software\CatalinaGroup\Update\ClientState\{6C598730-F715-407B-A7AE-A8F10D0F8FA7}]
"UpdateAvailableSince"
"UpdateAvailableCount"

The process CatalinaUpdate.exe:956 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BB 89 72 69 91 03 FB 53 CB 60 43 75 BF 43 58 D8"

[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Integers]
"windows_sp_major_version" = "03 00 00 00 00 00 00 00"

[HKCU\Software\CatalinaGroup\Update\proxy]
"source" = "IE"

[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Integers]
"windows_minor_version" = "01 00 00 00 00 00 00 00"

[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Counts]
"goopdate_main" = "02 00 00 00 00 00 00 00"

[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Integers]
"windows_major_version" = "05 00 00 00 00 00 00 00"

[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Counts]
"goopdate_constructor" = "02 00 00 00 00 00 00 00"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\CatalinaGroup\Update\network\secure]
"sk"
"c"

The process CatalinaUpdate.exe:1496 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AC FD 01 D1 5F 80 B9 EB C1 4D C8 E9 03 BE DA 06"

[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"usagestats" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\CatalinaGroup\Update]
"eulaaccepted"

The process CatalinaUpdate.exe:1572 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{13660822-39AC-408C-BA99-702EBEE3EF26}]
"CLSID" = "{13660822-39AC-408C-BA99-702EBEE3EF26}"

[HKCU\Software\Classes\Interface\{A2589E53-1490-4C0A-BFC7-A47B7A88E3D8}]
"(Default)" = "ICatalinaUpdate3WebSecurity"

[HKCU\Software\Classes\CatalinaGroupUpdate.Update3COMClassUser]
"(Default)" = "Update3COMClass"

[HKCU\Software\Classes\Interface\{0E09406F-1420-4BF4-B6EB-F0994674AD68}]
"(Default)" = "IAppBundle"

[HKCU\Software\Classes\Interface\{3EA78C6E-8267-4554-8EC6-8982D5AF539A}]
"(Default)" = "ICoCreateAsyncStatus"

[HKCU\Software\Classes\Interface\{0E09406F-1420-4BF4-B6EB-F0994674AD68}\NumMethods]
"(Default)" = "39"

[HKCU\Software\Classes\CLSID\{F4CBF20B-F634-4095-B64A-2EBCDD9E560E}\InprocServer32]
"ThreadingModel" = "Both"

[HKCU\Software\Classes\Interface\{34F067BE-C79C-4C5F-8E64-622A3CC59055}\ProxyStubClsid32]
"(Default)" = "{3EC095D7-1164-4B7C-B570-92B48F6E82DC}"

[HKCU\Software\Classes\CLSID\{13660822-39AC-408C-BA99-702EBEE3EF26}\LocalServer32]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\CatalinaUpdateOnDemand.exe"

[HKCU\Software\Classes\Interface\{23185EAB-61B0-4B70-BE89-589585B91392}\NumMethods]
"(Default)" = "8"

[HKCU\Software\Classes\Interface\{C1D8630A-9D2D-4E0E-A4A1-8AA5CA3FAE57}\ProxyStubClsid32]
"(Default)" = "{3EC095D7-1164-4B7C-B570-92B48F6E82DC}"

[HKCU\Software\Classes\CLSID\{C8362D5A-4303-4E22-8668-BB10D65B95BD}\VersionIndependentProgID]
"(Default)" = "CatalinaGroupUpdate.OnDemandCOMClassUser"

[HKCU\Software\Classes\CLSID\{2823499B-60F3-4940-8042-2C16D5829A39}\VersionIndependentProgID]
"(Default)" = "CatalinaGroupUpdate.Update3WebUser"

[HKCU\Software\Classes\Interface\{7A1A1D82-1E2B-41B8-9FA3-F40D8DD3EEF0}\ProxyStubClsid32]
"(Default)" = "{3EC095D7-1164-4B7C-B570-92B48F6E82DC}"

[HKCU\Software\Classes\Interface\{263B5A28-834A-4D1B-AB71-A28E882CC59B}\NumMethods]
"(Default)" = "13"

[HKCU\Software\Classes\CatalinaGroupUpdate.CredentialDialogUser]
"(Default)" = "GoogleUpdate CredentialDialog"

[HKCU\Software\Classes\Interface\{7C9F9415-9947-482C-A62B-24A0BD92B8A7}\NumMethods]
"(Default)" = "4"

[HKCU\Software\Classes\CLSID\{3EC095D7-1164-4B7C-B570-92B48F6E82DC}]
"(Default)" = "PSFactoryBuffer"

[HKCU\Software\Classes\Interface\{A2589E53-1490-4C0A-BFC7-A47B7A88E3D8}\ProxyStubClsid32]
"(Default)" = "{3EC095D7-1164-4B7C-B570-92B48F6E82DC}"

[HKCU\Software\Classes\Interface\{C1D8630A-9D2D-4E0E-A4A1-8AA5CA3FAE57}]
"(Default)" = "ICredentialDialog"

[HKCU\Software\Classes\Interface\{A1E6F38D-8C9E-4BDA-86A2-1940472A8429}]
"(Default)" = "ICatalinaUpdate"

[HKCU\Software\Classes\Interface\{FFC6ECB2-25E8-40EE-BF37-5AA25CBCBA63}\NumMethods]
"(Default)" = "10"

[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Counts]
"goopdate_main" = "01 00 00 00 00 00 00 00"

[HKCU\Software\Classes\Interface\{D085AC3B-E5CC-40C9-8366-C12ADC489967}\ProxyStubClsid32]
"(Default)" = "{3EC095D7-1164-4B7C-B570-92B48F6E82DC}"

[HKCU\Software\Classes\Interface\{789E3792-8514-4ED5-90F3-5B525275B953}\ProxyStubClsid32]
"(Default)" = "{3EC095D7-1164-4B7C-B570-92B48F6E82DC}"

[HKCU\Software\Classes\Interface\{FCD277CC-8D3E-4264-80D3-98E7B05E2E8A}\ProxyStubClsid32]
"(Default)" = "{3EC095D7-1164-4B7C-B570-92B48F6E82DC}"

[HKCU\Software\Classes\CLSID\{3C564FFE-55F7-43AC-886C-7E9E9091CB2A}]
"(Default)" = "Update3COMClass"

[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Integers]
"windows_sp_major_version" = "03 00 00 00 00 00 00 00"

[HKCU\Software\Classes\CLSID\{73436A91-85A6-4850-A7D0-375C4E369A5A}\ProgID]
"(Default)" = "CatalinaGroupUpdate.CredentialDialogUser.1.0"

[HKCU\Software\Classes\CLSID\{13660822-39AC-408C-BA99-702EBEE3EF26}]
"(Default)" = "CatalinaGroup.OneClickProcessLauncher"

[HKCU\Software\Classes\Interface\{263B5A28-834A-4D1B-AB71-A28E882CC59B}\ProxyStubClsid32]
"(Default)" = "{3EC095D7-1164-4B7C-B570-92B48F6E82DC}"

[HKCU\Software\Classes\CLSID\{C8362D5A-4303-4E22-8668-BB10D65B95BD}]
"(Default)" = "Google Update Legacy On Demand"

[HKCU\Software\Classes\CLSID\{EC8AA9F5-22DB-42D4-9E26-0316CBCE7EAA}\InprocHandler32]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\psuser.dll"

[HKCU\Software\Classes\Interface\{FCD277CC-8D3E-4264-80D3-98E7B05E2E8A}\NumMethods]
"(Default)" = "10"

[HKCU\Software\Classes\Interface\{CBAC6FCC-819A-443D-98BB-E7A122DCCAE3}\NumMethods]
"(Default)" = "4"

[HKCU\Software\Classes\Interface\{7C9F9415-9947-482C-A62B-24A0BD92B8A7}\ProxyStubClsid32]
"(Default)" = "{3EC095D7-1164-4B7C-B570-92B48F6E82DC}"

[HKCU\Software\Classes\Interface\{0CD725CD-5650-4F13-91DA-E42FAA9687E8}\ProxyStubClsid32]
"(Default)" = "{3EC095D7-1164-4B7C-B570-92B48F6E82DC}"

[HKCU\Software\Classes\CatalinaGroupUpdate.Update3WebUser\CLSID]
"(Default)" = "{2823499B-60F3-4940-8042-2C16D5829A39}"

[HKCU\Software\Classes\Interface\{FCD277CC-8D3E-4264-80D3-98E7B05E2E8A}]
"(Default)" = "IAppVersionWeb"

[HKCU\Software\Classes\CatalinaGroupUpdate.CredentialDialogUser.1.0]
"(Default)" = "GoogleUpdate CredentialDialog"

[HKCU\Software\Classes\Interface\{84BA4DAC-82EA-4DC8-BCB0-B69DD6E95670}\ProxyStubClsid32]
"(Default)" = "{3EC095D7-1164-4B7C-B570-92B48F6E82DC}"

[HKCU\Software\Classes\Interface\{F009E353-D4BD-42FE-994E-F6C315055F9B}\ProxyStubClsid32]
"(Default)" = "{3EC095D7-1164-4B7C-B570-92B48F6E82DC}"

[HKCU\Software\Classes\CatalinaGroupUpdate.Update3COMClassUser\CurVer]
"(Default)" = "CatalinaGroupUpdate.Update3COMClassUser.1.0"

[HKCU\Software\Classes\CLSID\{73436A91-85A6-4850-A7D0-375C4E369A5A}\VersionIndependentProgID]
"(Default)" = "CatalinaGroupUpdate.CredentialDialogUser"

[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Integers]
"windows_minor_version" = "01 00 00 00 00 00 00 00"

[HKCU\Software\Classes\Interface\{CBAC6FCC-819A-443D-98BB-E7A122DCCAE3}]
"(Default)" = "IOneClickProcessLauncher"

[HKCU\Software\Classes\Interface\{051D14B3-CF0F-4CCA-B8FE-AF9E007ACD43}\NumMethods]
"(Default)" = "4"

[HKCU\Software\Classes\Interface\{051D14B3-CF0F-4CCA-B8FE-AF9E007ACD43}]
"(Default)" = "ICoCreateAsync"

[HKCU\Software\Classes\Interface\{F9F2D675-F172-42F2-A26E-6453B80EA7F1}]
"(Default)" = "ICurrentState"

[HKCU\Software\Classes\CLSID\{3C564FFE-55F7-43AC-886C-7E9E9091CB2A}\ProgID]
"(Default)" = "CatalinaGroupUpdate.Update3COMClassUser.1.0"

[HKCU\Software\Classes\Interface\{789E3792-8514-4ED5-90F3-5B525275B953}]
"(Default)" = "IAppBundleWeb"

[HKCU\Software\Classes\Interface\{D085AC3B-E5CC-40C9-8366-C12ADC489967}]
"(Default)" = "IApp"

[HKCU\Software\Classes\Interface\{A1E6F38D-8C9E-4BDA-86A2-1940472A8429}\NumMethods]
"(Default)" = "5"

[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Integers]
"windows_major_version" = "05 00 00 00 00 00 00 00"

[HKCU\Software\Classes\CatalinaGroup.OneClickProcessLauncherUser\CLSID]
"(Default)" = "{13660822-39AC-408C-BA99-702EBEE3EF26}"

[HKCU\Software\Classes\Interface\{A1E6F38D-8C9E-4BDA-86A2-1940472A8429}\ProxyStubClsid32]
"(Default)" = "{3EC095D7-1164-4B7C-B570-92B48F6E82DC}"

[HKCU\Software\Classes\CatalinaGroupUpdate.CredentialDialogUser\CLSID]
"(Default)" = "{73436A91-85A6-4850-A7D0-375C4E369A5A}"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2D 0B 44 0B 13 82 C0 AC FB D5 92 E4 67 48 EF 98"

[HKCU\Software\Classes\CLSID\{3EC095D7-1164-4B7C-B570-92B48F6E82DC}\InProcServer32]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\psuser.dll"

[HKCU\Software\Classes\Interface\{D085AC3B-E5CC-40C9-8366-C12ADC489967}\NumMethods]
"(Default)" = "44"

[HKCU\Software\Classes\CLSID\{13660822-39AC-408C-BA99-702EBEE3EF26}\VersionIndependentProgID]
"(Default)" = "CatalinaGroup.OneClickProcessLauncherUser"

[HKCU\Software\Classes\CatalinaGroupUpdate.Update3WebUser.1.0]
"(Default)" = "GoogleUpdate Update3Web"

[HKCU\Software\Classes\Interface\{C1D8630A-9D2D-4E0E-A4A1-8AA5CA3FAE57}\NumMethods]
"(Default)" = "4"

[HKCU\Software\Classes\Interface\{0CD725CD-5650-4F13-91DA-E42FAA9687E8}\NumMethods]
"(Default)" = "10"

[HKCU\Software\Classes\Interface\{34F067BE-C79C-4C5F-8E64-622A3CC59055}\NumMethods]
"(Default)" = "9"

[HKCU\Software\Classes\Interface\{EC3867B7-B9EF-494E-B42B-BA009D57D90E}\NumMethods]
"(Default)" = "6"

[HKCU\Software\Classes\Interface\{6B6DE56F-09F2-4343-80AD-28E5D6CB78F9}\ProxyStubClsid32]
"(Default)" = "{3EC095D7-1164-4B7C-B570-92B48F6E82DC}"

[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{13660822-39AC-408C-BA99-702EBEE3EF26}]
"Policy" = "3"

[HKCU\Software\Classes\Interface\{F9F2D675-F172-42F2-A26E-6453B80EA7F1}\ProxyStubClsid32]
"(Default)" = "{3EC095D7-1164-4B7C-B570-92B48F6E82DC}"

[HKCU\Software\Classes\Interface\{0E09406F-1420-4BF4-B6EB-F0994674AD68}\ProxyStubClsid32]
"(Default)" = "{3EC095D7-1164-4B7C-B570-92B48F6E82DC}"

[HKCU\Software\Classes\CatalinaGroupUpdate.Update3WebUser\CurVer]
"(Default)" = "CatalinaGroupUpdate.Update3WebUser.1.0"

[HKCU\Software\Classes\Interface\{6B6DE56F-09F2-4343-80AD-28E5D6CB78F9}\NumMethods]
"(Default)" = "14"

[HKCU\Software\Classes\CLSID\{2823499B-60F3-4940-8042-2C16D5829A39}\ProgID]
"(Default)" = "CatalinaGroupUpdate.Update3WebUser.1.0"

[HKCU\Software\Classes\Interface\{7C9F9415-9947-482C-A62B-24A0BD92B8A7}]
"(Default)" = "ICatalinaUpdateCore"

[HKCU\Software\Classes\Interface\{3EA78C6E-8267-4554-8EC6-8982D5AF539A}\NumMethods]
"(Default)" = "10"

[HKCU\Software\Classes\CLSID\{73436A91-85A6-4850-A7D0-375C4E369A5A}\LocalServer32]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\CatalinaUpdateOnDemand.exe"

[HKCU\Software\Classes\Interface\{051D14B3-CF0F-4CCA-B8FE-AF9E007ACD43}\ProxyStubClsid32]
"(Default)" = "{3EC095D7-1164-4B7C-B570-92B48F6E82DC}"

[HKCU\Software\Classes\CLSID\{EC8AA9F5-22DB-42D4-9E26-0316CBCE7EAA}\InprocHandler32]
"ThreadingModel" = "Both"

[HKCU\Software\Classes\CLSID\{2823499B-60F3-4940-8042-2C16D5829A39}]
"(Default)" = "GoogleUpdate Update3Web"

[HKCU\Software\Classes\CLSID\{13660822-39AC-408C-BA99-702EBEE3EF26}\ProgID]
"(Default)" = "CatalinaGroup.OneClickProcessLauncherUser.1.0"

[HKCU\Software\Classes\Interface\{CBAC6FCC-819A-443D-98BB-E7A122DCCAE3}\ProxyStubClsid32]
"(Default)" = "{3EC095D7-1164-4B7C-B570-92B48F6E82DC}"

[HKCU\Software\Classes\CatalinaGroup.OneClickProcessLauncherUser\CurVer]
"(Default)" = "CatalinaGroup.OneClickProcessLauncherUser.1.0"

[HKCU\Software\Classes\CLSID\{2823499B-60F3-4940-8042-2C16D5829A39}\LocalServer32]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\CatalinaUpdateOnDemand.exe"

[HKCU\Software\Classes\Interface\{FFC6ECB2-25E8-40EE-BF37-5AA25CBCBA63}\ProxyStubClsid32]
"(Default)" = "{3EC095D7-1164-4B7C-B570-92B48F6E82DC}"

[HKCU\Software\Classes\Interface\{84BA4DAC-82EA-4DC8-BCB0-B69DD6E95670}\NumMethods]
"(Default)" = "10"

[HKCU\Software\CatalinaGroup\Update\UsageStats\Daily\Counts]
"goopdate_constructor" = "01 00 00 00 00 00 00 00"

[HKCU\Software\Classes\Interface\{FFC6ECB2-25E8-40EE-BF37-5AA25CBCBA63}]
"(Default)" = "ICatalinaUpdate3"

[HKCU\Software\Classes\CatalinaGroup.OneClickProcessLauncherUser.1.0]
"(Default)" = "CatalinaGroup.OneClickProcessLauncher"

[HKCU\Software\Classes\Interface\{263B5A28-834A-4D1B-AB71-A28E882CC59B}]
"(Default)" = "IJobObserver"

[HKCU\Software\Classes\Interface\{0CD725CD-5650-4F13-91DA-E42FAA9687E8}]
"(Default)" = "IAppVersion"

[HKCU\Software\Classes\CatalinaGroupUpdate.OnDemandCOMClassUser.1.0]
"(Default)" = "Google Update Legacy On Demand"

[HKCU\Software\Classes\Interface\{F009E353-D4BD-42FE-994E-F6C315055F9B}]
"(Default)" = "ICatalinaUpdate3Web"

[HKCU\Software\Classes\Interface\{F009E353-D4BD-42FE-994E-F6C315055F9B}\NumMethods]
"(Default)" = "8"

[HKCU\Software\Classes\Interface\{A2589E53-1490-4C0A-BFC7-A47B7A88E3D8}\NumMethods]
"(Default)" = "4"

[HKCU\Software\Classes\Interface\{23185EAB-61B0-4B70-BE89-589585B91392}\ProxyStubClsid32]
"(Default)" = "{3EC095D7-1164-4B7C-B570-92B48F6E82DC}"

[HKCU\Software\Classes\Interface\{EC3867B7-B9EF-494E-B42B-BA009D57D90E}\ProxyStubClsid32]
"(Default)" = "{3EC095D7-1164-4B7C-B570-92B48F6E82DC}"

[HKCU\Software\Classes\CLSID\{3C564FFE-55F7-43AC-886C-7E9E9091CB2A}\VersionIndependentProgID]
"(Default)" = "CatalinaGroupUpdate.Update3COMClassUser"

[HKCU\Software\Classes\CatalinaGroupUpdate.OnDemandCOMClassUser\CLSID]
"(Default)" = "{C8362D5A-4303-4E22-8668-BB10D65B95BD}"

[HKCU\Software\Classes\Interface\{7A1A1D82-1E2B-41B8-9FA3-F40D8DD3EEF0}]
"(Default)" = "IBrowserHttpRequest2"

[HKCU\Software\Classes\CLSID\{F4CBF20B-F634-4095-B64A-2EBCDD9E560E}\InprocServer32]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\psuser.dll"

[HKCU\Software\Classes\CatalinaGroupUpdate.Update3WebUser.1.0\CLSID]
"(Default)" = "{2823499B-60F3-4940-8042-2C16D5829A39}"

[HKCU\Software\Classes\CatalinaGroupUpdate.Update3COMClassUser.1.0]
"(Default)" = "Update3COMClass"

[HKCU\Software\Classes\Interface\{789E3792-8514-4ED5-90F3-5B525275B953}\NumMethods]
"(Default)" = "24"

[HKCU\Software\Classes\Interface\{84BA4DAC-82EA-4DC8-BCB0-B69DD6E95670}]
"(Default)" = "IPackage"

[HKCU\Software\Classes\Interface\{7A1A1D82-1E2B-41B8-9FA3-F40D8DD3EEF0}\NumMethods]
"(Default)" = "4"

[HKCU\Software\Classes\CLSID\{C8362D5A-4303-4E22-8668-BB10D65B95BD}\LocalServer32]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\CatalinaUpdateOnDemand.exe"

[HKCU\Software\Classes\Interface\{3EA78C6E-8267-4554-8EC6-8982D5AF539A}\ProxyStubClsid32]
"(Default)" = "{3EC095D7-1164-4B7C-B570-92B48F6E82DC}"

[HKCU\Software\Classes\CLSID\{3C564FFE-55F7-43AC-886C-7E9E9091CB2A}\LocalServer32]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\CatalinaUpdate.exe"

[HKCU\Software\Classes\CatalinaGroupUpdate.Update3COMClassUser.1.0\CLSID]
"(Default)" = "{3C564FFE-55F7-43AC-886C-7E9E9091CB2A}"

[HKCU\Software\Classes\Interface\{6B6DE56F-09F2-4343-80AD-28E5D6CB78F9}]
"(Default)" = "IAppWeb"

[HKCU\Software\Classes\CatalinaGroupUpdate.OnDemandCOMClassUser.1.0\CLSID]
"(Default)" = "{C8362D5A-4303-4E22-8668-BB10D65B95BD}"

[HKCU\Software\Classes\CatalinaGroupUpdate.Update3WebUser]
"(Default)" = "GoogleUpdate Update3Web"

[HKCU\Software\Classes\CatalinaGroup.OneClickProcessLauncherUser]
"(Default)" = "CatalinaGroup.OneClickProcessLauncher"

[HKCU\Software\Classes\Interface\{F9F2D675-F172-42F2-A26E-6453B80EA7F1}\NumMethods]
"(Default)" = "24"

[HKCU\Software\Classes\CatalinaGroup.OneClickProcessLauncherUser.1.0\CLSID]
"(Default)" = "{13660822-39AC-408C-BA99-702EBEE3EF26}"

[HKCU\Software\Classes\Interface\{EC3867B7-B9EF-494E-B42B-BA009D57D90E}]
"(Default)" = "IProcessLauncher"

[HKCU\Software\Classes\CatalinaGroupUpdate.OnDemandCOMClassUser\CurVer]
"(Default)" = "CatalinaGroupUpdate.OnDemandCOMClassUser.1.0"

[HKCU\Software\Classes\CLSID\{C8362D5A-4303-4E22-8668-BB10D65B95BD}\ProgID]
"(Default)" = "CatalinaGroupUpdate.OnDemandCOMClassUser.1.0"

[HKCU\Software\Classes\CatalinaGroupUpdate.Update3COMClassUser\CLSID]
"(Default)" = "{3C564FFE-55F7-43AC-886C-7E9E9091CB2A}"

[HKCU\Software\Classes\CatalinaGroupUpdate.CredentialDialogUser\CurVer]
"(Default)" = "CatalinaGroupUpdate.CredentialDialogUser.1.0"

[HKCU\Software\Classes\CLSID\{3EC095D7-1164-4B7C-B570-92B48F6E82DC}\InProcServer32]
"ThreadingModel" = "Both"

[HKCU\Software\Classes\Interface\{34F067BE-C79C-4C5F-8E64-622A3CC59055}]
"(Default)" = "IProgressWndEvents"

[HKCU\Software\Classes\CatalinaGroupUpdate.OnDemandCOMClassUser]
"(Default)" = "Google Update Legacy On Demand"

[HKCU\Software\Classes\CLSID\{73436A91-85A6-4850-A7D0-375C4E369A5A}]
"(Default)" = "GoogleUpdate CredentialDialog"

[HKCU\Software\Classes\CatalinaGroupUpdate.CredentialDialogUser.1.0\CLSID]
"(Default)" = "{73436A91-85A6-4850-A7D0-375C4E369A5A}"

[HKCU\Software\Classes\Interface\{23185EAB-61B0-4B70-BE89-589585B91392}]
"(Default)" = "IRegistrationUpdateHook"

The Trojan deletes the following registry key(s):

[HKCU\Software\Classes\CLSID\{F4CBF20B-F634-4095-B64A-2EBCDD9E560E}]
[HKCU\Software\Classes\CLSID\{EC8AA9F5-22DB-42D4-9E26-0316CBCE7EAA}\InprocHandler32]
[HKCU\Software\Classes\CLSID\{F4CBF20B-F634-4095-B64A-2EBCDD9E560E}\InprocServer32]
[HKCU\Software\Classes\CLSID\{EC8AA9F5-22DB-42D4-9E26-0316CBCE7EAA}]

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\CatalinaGroup\Update\network\secure]
"sk"
"c"

The process citrio_48.0.2564.270_1.exe:1144 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\CatalinaGroup\Update\ClientState\{92F8A219-E740-49D5-B785-B962AD819724}]
"ap" = "-full"

The process %original file name%.exe:1964 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "18 36 DE 03 90 6B 8D A2 A7 95 5D 30 7A 10 8E 32"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name: Catalina Group Ltd.
Product Name: CatalinaGroup Update
Product Version: 1.3.25.223
Legal Copyright: Copyright 2013 Catalina Group Ltd.
Legal Trademarks:
Original Filename: CatalinaUpdateSetup.exe
Internal Name: CatalinaGroup Update Setup
File Version: 1.3.25.223
File Description: CatalinaGroup Update Setup
Comments:
Language: Language Neutral

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 24
3c2f29dbac5842ca1a35747628ac2ed0
a2c0406aaba834c74f68561c73936587
f286dd4df05f245669a2369d48418cfe
6e2f2e4552821e74da372e828fded288
d3d0d8a0a4ad6f659968ec9597c5904c
8d07d2af1cacca9b155f9aa57b7785d7
d6e7032cc47d7701b3dc9d7e2b5fd5c3
fdc6075e6b90d49d20adc410eed07268
fad048a52261ed893caba84d3a40025f
c82aec98008a83e1505e59ca14243728
47a7a872690644a8db4aec4424c1593e
47f16121bb7e85ae2624b94c5d9ae4d4
1f3f192bcc3cb6bdddaad57c3c2659af
0602ef8c76f9ac40345b392b13062eca
09e1b9accbe3bc53af1dd8b6c055f3f9
3626022326bfb0f10fca5336e8b96834
adfa089ac6508c4d2baddc86f4ec6893
2a00121697147dd6b26a950569e65577
687ece4bb3ecc5276d27dd1f30fe3900
904b9c4b0cb8a924f98f4b199efdd88b
fb95e4647b9b6c56fc314f0ae1644e35
5ab29226960d52d4b668ed47d5d504e9
4f9647e1386c25bb92c71fb9794a4d16
20516f4cb222bcca954a27f96344c4eb

URLs

No activity has been detected.

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Web Traffic was not found.

The Trojan connects to the servers at the folowing location(s):

.text

`.rdata

@.data

.rsrc

@.reloc

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

GetProcessWindowStation

USER32.DLL

operator

mi_exe_stub.pdb

GetCPInfo

KERNEL32.dll

SHLWAPI.dll

GetProcessHeap

ole32.dll

USER32.dll

c:\%original file name%.exe

Z>.Lv&

~.pIC

@?.lK

k.sq_

%uo:BTs

_.OV 

WEbg]

.gMgk

kEyF

v(s

wtPý

fNke%D

CN}.VH1

3/?/.Xl

y.RYk

w\%X'b

-y'I|A~.ZW

*h

.rIkX

R]%.s

`%FX&r

*B.jp5cW

.jQ}9

=.Fp/

@ù#1

4.ib}

q<-Œ

%Fo;k

.ZX`T

;^M(.pS

%X23%K;

L15.Mo_I

%xJ80

G=`FD.MK

O.mA|C

bp.IL

bb{.Xk

p:\k)

9A>%f

*WC{ 

q-o%x

STa%F

k.lhx

pK.gJ

:sssh 

7:<<<6000

<requestedExecutionLevel level="asInvoker" />

<!--The ID below indicates application support for Windows Vista -->

<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>

<!--The ID below indicates application support for Windows 7 -->

<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>

<!--This Id value indicates the application supports Windows 8 functionality-->

<supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>

<!--This Id value indicates the application supports Windows 8.1 functionality-->

<supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/>

<!--This Id value indicates the application supports Windows 10.0 functionality-->

<supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/>

<assemblyIdentity type='win32' name='Microsoft.Windows.Common-Controls' version='6.0.0.0' processorArchitecture='*' publicKeyToken='6595b64144ccf1df' language='*' />

: :%:/:=:}:

3'3,30343]3

mscoree.dll

KERNEL32.DLL

appguid={92F8A219-E740-49D5-B785-B962AD819724}&installerargs=--make-chrome-default

Windows 2000 Service Pack 4

Windows 2000

lador de %1!s! requereix Windows 2000 amb Service Pack 4 o una versi

m Windows 2000 Service Pack 4 nebo nov

ver Windows 2000 Service Pack 4 eller bedre.

r den %1!s!-Installer wird Windows 2000 Service Pack 4 oder h

Unknown Installer ErrorTInstallation failed. %1!s! Installer requires Windows 2000 Service Pack 4 or better.

Windows 2000 Service Pack 4:n tai uudemman.

cessite Windows

je Windows 2000 Service Pack 4-et vagy frissebb verzi

krefst Windows 2000

Google#Programma di installazione di %1!s!!Errore sconosciuto dell'installertInstallazione non riuscita. Il programma di installazione di %1!s! richiede Windows 2000 Service Pack 4 o superiore.

Installatieprogramma van %1!s!'Onbekende fout van installatieprogrammasDe installatie is mislukt. Voor het installatieprogramma van %1!s! is Windows 2000 Service Pack 4 of hoger vereist.

Ukjent installasjonsfeilgInstallasjonen mislyktes. %1!s! installasjonsprogrammet krever Windows 2000 Service Pack 4 eller nyere.

. Instalator %1!s! wymaga systemu Windows 2000 z dodatkiem Service Pack 4 lub nowszego.

o. O instalador do %1!s! requer o Windows 2000 Service Pack 4 ou posterior.

it. %1!s! Programul de instalare are nevoie de Windows 2000 Service Pack 4 sau de o versiune superioar

ka alata za instalacijulInstalacija nije uspjela. Za instalacijski program %1!s! potreban je Windows 2000 Service Pack 4 ili noviji.

m Windows 2000 Service Pack 4 alebo nov

ver Windows 2000 Service Pack 4 eller b

kleyicisi Windows 2000 Hizmet Paketi 4 veya sonras

Program pemasang %1!s!!Kesalahan Installer Tak DiketahuiePemasangan gagal. Program pemasang %1!s! memerlukan Windows 2000 Service Pack 4 atau yang lebih baik.

na. Za namestitveni program za %1!s! potrebujete Windows 2000 s servisnim paketom SP 4 ali novej

uab rakendust Windows 2000 hoolduspakett 4 v

ama Windows

Windows 2000

u Windows 2000 G

Pemasang %1!s!#Ralat Pemasang yang Tidak Diketahui]Pemasangan gagal. Pemasang %1!s! memerlukan Windows 2000 Service Pack 4 atau yang lebih baik.

Kisakinishi cha %1!s!%Hitilafu ya Kisakinishi Isiyojulikana_Usakinishaji haukufaulu. Kisakinishi cha %1!s! kinahitaji Windows 2000 Service Pack 4 au zaidi.

. Windows 2000

Installer ng %1!s! Hindi Alam na Error ng InstallerlNabigo ang pag-install. Nangangailangan ang Installer ng %1!s! ng Windows 2000 Service Pack 4 o mas mahusay.

n. %1!s! El instalador requiere Windows 2000 Service Pack 4 o superior.

o %1!s! necessita do Windows 2000 Service Pack 4 ou superior.

n. %1!s! Installer requiere Windows 2000 Service Pack 4 o versiones posteriores.

1.3.25.223

CatalinaUpdateSetup.exe

CatalinaUpdate.exe_1352:

.text

`.data

.text/DE

@.rsrc

@.reloc

SHELL32.dll

USER32.dll

SHLWAPI.dll

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

GetProcessWindowStation

USER32.DLL

operator

CatalinaUpdate_unsigned.pdb

RegOpenKeyExW

ADVAPI32.dll

KERNEL32.dll

ole32.dll

GetProcessHeap

GetCPInfo

GetConsoleOutputCP

<requestedExecutionLevel level="asInvoker" />

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

<!--The ID below indicates application support for Windows Vista -->

<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>

<!--The ID below indicates application support for Windows 7 -->

<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>

<!--This Id value indicates the application supports Windows 8 functionality-->

<supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>

<!--This Id value indicates the application supports Windows 8.1 functionality-->

<supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/>

<!--This Id value indicates the application supports Windows 10.0 functionality-->

<supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/>

###7777_{

###____777

###````87{

2 2$2(2,20242~2

4 4$4(4,4

?$?(?,?4?

> >@>\>`>

? ?@?\?`?

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\GUM1.tmp\CatalinaUpdate.exe

KERNEL32.DLL

mscoree.dll

goopdate.dll

CatalinaUpdate.exe

Software\CatalinaGroup\Update\Clients\{6C598730-F715-407B-A7AE-A8F10D0F8FA7}

1.3.25.223

2007-2010

2007-2010

CatalinaUpdate.exe_1496:

.text

`.data

.text/DE

@.rsrc

@.reloc

SHELL32.dll

USER32.dll

SHLWAPI.dll

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

GetProcessWindowStation

USER32.DLL

operator

CatalinaUpdate_unsigned.pdb

RegOpenKeyExW

ADVAPI32.dll

KERNEL32.dll

ole32.dll

GetProcessHeap

GetCPInfo

GetConsoleOutputCP

<requestedExecutionLevel level="asInvoker" />

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

<!--The ID below indicates application support for Windows Vista -->

<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>

<!--The ID below indicates application support for Windows 7 -->

<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>

<!--This Id value indicates the application supports Windows 8 functionality-->

<supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>

<!--This Id value indicates the application supports Windows 8.1 functionality-->

<supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/>

<!--This Id value indicates the application supports Windows 10.0 functionality-->

<supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/>

###7777_{

###____777

###````87{

2 2$2(2,20242~2

4 4$4(4,4

?$?(?,?4?

> >@>\>`>

? ?@?\?`?

%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\CatalinaUpdate.exe

KERNEL32.DLL

mscoree.dll

goopdate.dll

CatalinaUpdate.exe

Software\CatalinaGroup\Update\Clients\{6C598730-F715-407B-A7AE-A8F10D0F8FA7}

1.3.25.223

2007-2010

2007-2010

CatalinaUpdate.exe_1256:

.text

`.data

.text/DE

@.rsrc

@.reloc

SHELL32.dll

USER32.dll

SHLWAPI.dll

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

GetProcessWindowStation

USER32.DLL

operator

CatalinaUpdate_unsigned.pdb

RegOpenKeyExW

ADVAPI32.dll

KERNEL32.dll

ole32.dll

GetProcessHeap

GetCPInfo

GetConsoleOutputCP

<requestedExecutionLevel level="asInvoker" />

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

<!--The ID below indicates application support for Windows Vista -->

<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>

<!--The ID below indicates application support for Windows 7 -->

<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>

<!--This Id value indicates the application supports Windows 8 functionality-->

<supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>

<!--This Id value indicates the application supports Windows 8.1 functionality-->

<supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/>

<!--This Id value indicates the application supports Windows 10.0 functionality-->

<supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/>

###7777_{

###____777

###````87{

2 2$2(2,20242~2

4 4$4(4,4

?$?(?,?4?

> >@>\>`>

? ?@?\?`?

%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\CatalinaUpdate.exe

KERNEL32.DLL

mscoree.dll

goopdate.dll

CatalinaUpdate.exe

Software\CatalinaGroup\Update\Clients\{6C598730-F715-407B-A7AE-A8F10D0F8FA7}

1.3.25.223

2007-2010

2007-2010

setup.exe_452:

.text

`.rdata

@.data

.rsrc

@.reloc

SHA256 block transform for x86, CRYPTOGAMS by <[email protected]>

PSSSSSSh

:.texu

j.Yf;

_tcPVj@

.PjRW

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\setup\archive_patch_helper.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\setup\install.cc

Adding Chrome to Media player list at

Could not add Chrome to media player inclusion list.

<Application xmlns:xsi='hXXp://VVV.w3.org/2001/XMLSchema-instance'>

Square150x150Logo='%ls\Logo.png'

Square70x70Logo='%ls\SmallLogo.png'

Registering Chrome as browser:

Failed to reinstall Active Setup keys.

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\setup\install_worker.cc

Chrome Frame in use. Copying to new_citrio.exe

FUnexpected result creating CommandExecuteImpl; hr=0x

Adding unregistration items for DelegateExecute verb handler in

Not operating on Chrome while migrating to single-install.

No multi-install Chrome found to migrate to single-install.

No DelegateExecute verb handler processing to do for

Adding registration items for DelegateExecute verb handler.

not supported.

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\setup\setup_main.cc

Renaming of executables failed. Rolling back any changes.

Upgrading existing Chrome browser in multi-install mode.

Launching existing system-level chrome instead.

RepairChrome: Failed to open Chrome's ClientState key.

RepairChrome: Failed to read Chrome's UninstallArguments.

RepairChrome: Not repairing single-install Chrome.

RepairChrome: Failed to read Chrome's UninstallString.

RepairChrome: Launched repair command "

RepairChrome: Failed launching repair command "

RepairChrome: Will retry without breakaway.

Tried and failed to launch Metro Chrome.

was found, as a last resort (if the product is not present in Add/Remove Programs), try executing:

Aborting operation: another installation of

setup.exe patching failed.

chrome_install:

Can't register browser - Chrome distribution not found

Chrome product not found.

Chrome Installer

Uninstalling multi-install Chrome Frame.

Uninstallation of Chrome Frame returned status

Chrome Frame not found for uninstall.

Installing Chrome from compressed archive

Cannot install Chrome without an uncompressed archive.

Chrome only supports Windows XP or later.

Non admin user can not install system level Chrome.

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\setup\setup_util.cc

Looking for Chrome version folder under

0.0.0.0

chrome-frame

migrate-chrome-frame

Failed to delete subkey

Failed to delete empty key

in key

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\setup\uninstall.cc

DeleteChromeFilesAndFolders: no installation destination

Launching Chrome to do uninstall tasks.

citrio.exe launched for uninstall confirmation returned:

Failed to launch citrio.exe for uninstall confirmation.

Uninstall per-user Active Setup keys.

Uninstalling Active Setup key for

NTUSER.DAT

Failed to delete key at

Retargeting user-generated Chrome shortcuts.

Retarget failed: system-level Chrome not found.

Closing the Chrome Frame helper process

Uninstallation complete. Launching post-uninstall operations.

setup.exe is not in target path. Skipping installer cleanup.

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\setup\update_active_setup_version_work_item.cc

googlechrome

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\install_util.cc

CHROME_PROBED_PROGRAM_FILES_PATH

Deleting registry key

Failed to delete registry key:

Failed to parse an executable name from command line: "

chrome

chrome-sxs

do-not-launch-chrome

make-chrome-default

new-setup-exe

register-chrome-browser

register-chrome-browser-suffix

register-dev-chrome

register-url-protocol

rename-chrome-exe

remove-chrome-registration

update-setup-exe

toast-results-key

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\lzma_util.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\shell_util.cc

DefaultBrowser.ActivateSettings.ErrorHresult

Could not make Chrome default browser (XP/current user).

Could not make Chrome default browser (XP/system level).

Registering Chrome as default browser on Vista.

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\product.cc

Failed to Open or Write MSI value to client state key. error:

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\installer_state.cc

It seems that chrome is being installed for the first time.

It seems that chrome is being over installed.

Failed opening key

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\master_preferences.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\set_reg_value_work_item.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\delete_after_reboot_helper.cc

Failed to open session manager key for writing.

do_not_launch_chrome

make_chrome_default

make_chrome_default_for_user

launch_chrome_after_update

Cannot initialize an AppCommand from an invalid key.

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\app_command.cc

creating AppCommand registry key

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\conditional_work_item_list.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\google_update_settings.cc

Failed to write to application's ClientState key

Removed incremental installer failure key; switching to channel:

Removed multi-install failure key; switching to channel:

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\google_update_util.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\installation_validator.cc

be web accessible

Chrome Binaries are missing "-multi" in channel name: "

Chrome Binaries are missing "chrome" in channel name:

Chrome Binaries have "-chrome" in channel name, yet Chrome is not installed: "

Chrome Binaries are missing "-chromeframe" in channel name: "

Chrome Binaries have "-chromeframe" in channel name, yet Chrome Frame is not installed multi: "

Chrome Binaries are present with no other products.

Chrome Binaries are present yet Chrome is not multi-install.

Chrome Binaries are present without Chrome, yet Chrome Frame

without Chrome Binaries.

) does not match that of Chrome Binaries (

has an unsupported usagestats value (

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\self_cleaning_temp_dir.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\user_experiment.cc

Experiment qualification bypass

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\channel_info.cc

googlechromeframe

iexplore.exe

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\language_selector.cc

Cannot initialize AppCommands from an invalid key.

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\app_commands.cc

Failed to open key "

Skipping over key "

item execution failed

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\work_item_list.cc

list execution succeeded

NoRollbackWorkItemList: item execution failed

NoRollbackWorkItemList: list execution succeeded

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\copy_tree_work_item.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\create_dir_work_item.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\create_reg_key_work_item.cc

no key to create

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\delete_tree_work_item.cc

Acquired exclusive lock for key file:

Could not exclusively hold all key files.

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\delete_reg_key_work_item.cc

Failed to backup destination for registry key copy.

Failed to restore key in rollback.

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\delete_reg_value_work_item.cc

(delete value) Key:

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\move_tree_work_item.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\self_reg_work_item.cc

0xX

COM registration export function not found

Failed getting info of key to backup, result:

c:\jenkins\workspace\citrio-dev-clone\browser\src\chrome\installer\util\registry_key_backup.cc

Failed getting name of subkey

Failed opening subkey "

Failed backing up subkey "

Failed creating subkey "

Failed writing subkey "

Failed to backup key at

Failed to open key at

Failed to create destination key at

Failed to write key data.

CHROME_HEADLESS

widevinecdmadapter.dll

try-chrome-again

session.startup_urls

session.urls_to_restore_on_startup

%s\%s

user_experience_metrics.reporting_enabled

c:\jenkins\workspace\citrio-dev-clone\browser\src\crypto\secure_hash_openssl.cc

c:\jenkins\workspace\citrio-dev-clone\browser\src\courgette\assembly_program.cc

32 bit executables are not supported by this disassembler

Resource-only executables are not yet supported

.relocs outside image

.relocs block outside image

64 bit executables are not supported by this disassembler

Not an executable file or shared library

Not a supported architecture

c:\jenkins\workspace\citrio-dev-clone\browser\src\courgette\disassembler_elf_32.cc

Skipping relocation entry for unsupported section:

CITRIO_BREAKPAD_PIPE_NAME

c:\jenkins\workspace\citrio-dev-clone\browser\src\components\crash\content\app\breakpad_win.cc

NTDLL.DLL

SHELL32.dll

GetProcessWindowStation

function not supported

operation canceled

address_family_not_supported

operation_in_progress

operation_not_supported

protocol_not_supported

operation_would_block

address family not supported

broken pipe

inappropriate io control operation

not supported

operation in progress

operation not permitted

operation not supported

operation would block

protocol not supported

operator

(0x%X)

Error (0x%X) while retrieving error. (0x%X)

RegDeleteKeyExW

advapi32.dll

%s-%Iu

c:\jenkins\workspace\citrio-dev-clone\browser\src\base\process\memory_win.cc

PlatformFile.UnknownErrors.Windows

Windows NT

%d.%d

user32.dll

Histogram: %s recorded %d samples

(flags = 0x%x)

(%d = %3.1f%%)

0123456789

Dictionary keys must be quoted.

Unsupported encoding. JSON must be UTF-8.

Line: %i, column: %i, %s

full-memory-crash-report

c:\jenkins\workspace\Citrio-Dev-Clone\browser\src\out\Release\setup.exe.pdb

ShellExecuteExW

ShellExecuteW

setup.exe

ClearBreakpadPipeEnvironmentVariable

ClearCrashKeyValueImpl

SetCrashKeyValueImpl

VERSION.dll

WS2_32.dll

WINMM.dll

UrlCanonicalizeW

SHLWAPI.dll

RegEnumKeyExW

RegLoadKeyW

RegUnLoadKeyW

RegQueryInfoKeyW

RegCreateKeyExW

RegDeleteKeyW

RegOpenKeyExW

RegCloseKey

ADVAPI32.dll

GetWindowsDirectoryW

GetProcessHeap

SetNamedPipeHandleState

TransactNamedPipe

WaitNamedPipeW

KERNEL32.dll

ole32.dll

OLEAUT32.dll

SetWindowsHookExW

UnhookWindowsHookEx

USER32.dll

CreateURLMonikerEx

urlmon.dll

WTSAPI32.dll

USERENV.dll

PeekNamedPipe

GetCPInfo

zcÁ

k.lhx

pK.gJ

:sssh 

7:<<<6000

444.44...4

4.4....4.

..44.44@4

4@444@4.

.4@4@@4.

}.GnO

{oG

5G%8gG

wG

!)%)%)%sN

<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="*" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity></dependentAssembly></dependency><ms_asmv2:trustInfo xmlns="urn:schemas-microsoft-com:asm.v3" xmlns:ms_asmv2="urn:schemas-microsoft-com:asm.v2"><ms_asmv2:security><ms_asmv2:requestedPrivileges><ms_asmv2:requestedExecutionLevel xmlns:ms_asmv3="urn:schemas-microsoft-com:asm.v3" level="asInvoker" ms_asmv3:uiAccess="false"></ms_asmv2:requestedExecutionLevel></ms_asmv2:requestedPrivileges></ms_asmv2:security></ms_asmv2:trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"><application><supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"></supportedOS><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"></supportedOS><supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"></supportedOS><supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"></supportedOS><supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"></supportedOS></application></compatibility></assembly>

00l0}0

;#;);/;3;8;?;

11d1v1

'020@0_0

<)<?<^<~<

>$?/?5?\?

0 0$0(0,0004080<0

9 9$9(9,9

: :$:(:,:0:4:8:<:\<

= =$=(=,=8=<=@=

app_host.exe

=hXXp://citrio.com/service/updatemessage/

"hXXp://VVV.facebook.com"

"hXXp://VVV.youtube.com"

"hXXps://chrome.google.com/webstore/"

Open Chrome Web Store

Chrome Web Store

Ihttp

https

{A1326E5F-95B3-49FB-8C1F-610F27E0C5BE}

Software\Classes\Interface\{90E75134-C82F-4273-831F-13F6FB52BA1B}

Software\Classes\TypeLib\{5405A76A-9F6D-44E3-91CE-72179B379953}

Software\Classes\CLSID\{8BF2F61B-E8C2-4A67-85D0-D6A69F9FD948}

ServerExecutable

.CommandExecuteImpl Class

.StubPath

ieframe.dll

0.0.0.0-devel

MetricsReportingEnabled

citrio.packed.7z

chrome.VisualElementsManifest.xml

wow_helper.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\%ls\Products\%ls\InstallProperties

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{%ls}

{92F8A219-E740-49D5-B785-B962AD819724}

{F0B50D5A-4BBA-4514-AD2C-EBA50C29C460}

%SystemRoot%\System32\rundll32.exe

..htm

.html

.xhtml

Software\Microsoft\Windows NT\CurrentVersion\ProfileList\

.DEFAULT\

{3599E25E-6314-4BE9-AE14-E51877342426}

{675046A3-9F4F-4805-A81C-CBF753FE3428}

Browse the web

Software\Microsoft\Windows\CurrentVersion\Uninstall\Citrio

registering_chrome

uninstalling_chrome_frame

.HTML

IDR_OEMPG_EN.HTML

chrmstp.exe

{0105EA02-802D-4B37-8161-4ED25C493266}

citrio.dll

citrio.exe

npchrome_frame.dll

chrome_frame_helper.dll

chrome_frame_helper.exe

ChromeFrameHelperWindowClass

new_citrio.exe

old_citrio.exe

delegate_execute.exe

nacl64.exe

chrome.exe

new_chrome.exe

old_chrome.exe

InstallerSuccessLaunchCmdLine

Software\Microsoft\Windows\CurrentVersion\App Paths

.shtml

.webp

webcal

.webm

.flac

.torrent

URL Protocol

\.exe

DelegateExecute

Browser.Launch

\URLAssociations

\shell\open\ddeexec

windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel

" -- "%1"

.Software\CatalinaGroup\Citrio

PendingFileRenameOperations

UninstallCmdLine

WebAccessible

EMSHTML.DLL

chrome_installer.log

hXXp://VVV.citrio.com/welcome.html?intl=$1

-chrome

-chromeframe

GoogleChromeAutoLaunch

{DE28A2EA-77FA-4F2B-8252-C3B5844F6455}

FGoogle Chrome Frame

Chrome in a Frame.

Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome Frame

Google Chrome binaries

F{92F8A219-E740-49D5-B785-B962AD819724}

{8BF2F61B-E8C2-4A67-85D0-D6A69F9FD948}

AhXXp://VVV.citrio.com/goodbye.html?intl=$1&survey_id=%ls

%d.%d.%d

{E9F24A7C-13CA-42FB-A4D9-79C3C9D21B28}

ChromeCanary

ChromeSSHTM

Chrome Canary HTML Document

{1BEAC3E3-B852-44F4-B468-8906C062422E}

AGoogle Chrome Canary

Opens all ports for Citrio embedded bittorrent client

%u-%u

Crash Reports

script.log

resources.pak

pepflashplayer.dll

version.json

NPSWF32.dll

shell32.dll

s{A946A6A9-917E-4949-B9BC-6BADA8C7FD63}

\\.\pipe\CatalinaGroupCrashServices\

\\.\pipe\CitrioCrashServices

error %u

hunspecified-crash-key

dbghelp.dll

rpcrt4.dll

%s\%s.dmp

x-x-x-xx-xxxxxx

Kmscoree.dll

- floating point support not loaded

- CRT not initialized

- Attempt to initialize the CRT more than once.

USER32.DLL

portuguese-brazilian

Ndebug.log

kernel32.dll

\StringFileInfo\xx\%ls

Software\Microsoft\Windows\CurrentVersion\Run

ntdll.dll

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\CR_DD852.tmp\setup.exe

48.0.2564.270

nsit de mDNS.KPravidlo p

mDNS..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic.4Regla entrante para que Citrio permita tr

mDNS.BCitrioin saapuvien yhteyksien s

, joka sallii mDNS-liikenteen.GInbound na panuntunan para sa Citrio upang payagan ang trapiko ng mDNS.=R

.3Ulazno pravilo kako bi Citrio dopustio mDNS promet.CBej

iamas mDNS srautas.IIen

.:Peraturan masuk bagi Citrio untuk membolehkan trafik mDNS.3Inkomende regel zodat Citrio mDNS-verkeer toestaat.CRegel om innkommende trafikk for Citrio for

tillate mDNS-trafikk.BRegu

fego mDNS.:Regra de importa

.Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic..Inbound rule for Citrio to allow mDNS traffic.

.lInstallation failed due to unspecified error. If Citrio is currently running, please close it and try again.lInstallation failed due to unspecified error. If Citrio is currently running, please close it and try again.zLa instalaci

rralo e intenta nuevamente.kInstallimine eba

.uAsennus ep

.tInstalacija nije uspjela zbog nepoznate pogre

ajte ponovo.iA telep

jra.oPemasangan gagal karena kesalahan yang tidak diketahui. Jika Citrio sedang berjalan, tutup, lalu ulang kembali.kInstallazione non riuscita a causa di un errore imprecisato. Se Citrio

.kDiegimas nepavyko d

naujo.jInstal

.sPemasangan gagal disebabkan ralat yang tidak dinyatakan. Jika Citrio sedang dijalankan, sila tutup dan cuba semula.

De installatie is mislukt wegens een onbekende fout. Als Citrio momenteel actief is, moet je Citrio sluiten en het opnieuw proberen.pInstalleringen mislyktes p

o especificado. Se o Citrio estiver sendo executado, feche-o e tente novamente.pA instala

o especificado. Se o Citrio estiver em execu

ste znova.rNamestitev ni bila izvedena zaradi nedolo

.rInstallationen misslyckades p

k sedan igen.xUsanidi umeshindwa kwa sababu ya hitilafu isiyojulikana. Ikiwa Citrio inaendesha sasa, tafadhali ifunge na ujaribu tena.x

e tento software nefunguje, odinstalujte Citrio a zkuste to znovu.zComputeren har allerede en nyere version af Citrio. Hvis softwaren ikke virker, skal du afinstallere Citrio og pr

s reciente de Citrio. Si el software no funciona, desinstala Citrio y vuelve a intentarlo.kArvutis on juba Citrioi uuem versioon. Kui tarkvara ei t

.rOvo ra

jra.zKomputer ini sudah memiliki Citrio versi yang lebih anyar. Jika perangkat lunak tidak bekerja, copot Citrio dan coba lagi.uQuesto computer ha gi

nytt.zNa tym komputerze jest ju

ste to znova.uTa ra

lar aplicacions al sistema. Proveu de tornar a executar l'instal

lador com a administrador.kNem

.sYou do not have appropriate rights for system-level installation. Try running the installer again as Administrator.nYou do not have appropriate rights for system-level install. Try running the installer again as Administrator.

n al nivel del sistema. Intenta ejecutar el instalador nuevamente como Administrador.uTeil ei ole s

ajte ponovno pokrenuti program za instalaciju kao administrator.jNincsenek meg a megfelel

.rNeturite reikiam

.rAnda tidak mempunyai hak wajar untuk pemasangan peringkat sistem. Cuba jalankan pemasang semula sebagai Pentadbir.

vel do sistema. Tente executar o instalador novamente como administrador.

vel do sistema. Tente executar o programa de instala

.cNem

vca.qNimate ustreznih pravic za namestitev na ravni sistema. Poskusite znova zagnati namestitveni program kot skrbnik.

.zDu har inte beh

r.uHuna haki zifaazo ili kufanya usakinishaji wa kiwango cha mfumo. Jaribu kutumia kisakinishi kama msimamiaji kompyuta.u

lid. Torneu a baixar Citrio.VArchiv instala

m Citrio znovu.HInstallationsarkivet er beskadiget eller ugyldigt. Download Citrio igen.]Das Installationsarchiv ist besch

.LThe installer archive is corrupted or invalid. Please download Citrio again.LThe installer archive is corrupted or invalid. Please download Citrio again.PEl archivo de instalaci

lido. Vuelve a descargar Citrio.EEl instalador est

lido. Descarga Citrio nuevamente.EInstalleri arhiiv on rikutud v

.7Asennusarkisto on virheellinen. Lataa Citrio uudelleen.PSira o di-wasto ang archive ng installer. Mangyaring i-download muli ang Citrio.oL'archive du programme d'installation est corrompue ou n'est pas valide. Veuillez t

.QArhiva programa za instalaciju o

a. Ponovo preuzmite Citrio.fA telep

t.9Arsip pemasang rusak atau tidak valid. Unduh Citrio lagi.PL'archivio di installazione

.VDiegimo programos archyvas sugadintas arba negalioja. Atsisi

.XInstal

.HArkib pemasang rosak atau tidak sah. Sila muat turun Citrio sekali lagi.\Het archief van het installatieprogramma is beschadigd of ongeldig. Download Citrio opnieuw.FInstallasjonsarkivet er skadet eller ugyldig. Last ned Citrio p

nytt.PArchiwum instalatora jest uszkodzone lub nieprawid

a o download do Citrio novamente.bO arquivo do programa de instala

lido. Transfira novamente o Citrio.YArhiva programului de instalare este deteriorat

.QArch

Citrio znova.SArhiv namestitvenega programa je po

.OArkivet f

r skadat eller ogiltigt. Ladda ned Citrio igen.PKumbukumbu ya kisakinishi imeharibika au ni batili. Tafadhali pakua Citrio tena.N

i torneu-ho a provar.iV syst

m a zkuste to znovu.qDer er registreret en modstridende installation af Citrio i dit system. Du skal afinstallere denne og pr

.`A conflicting installation of Citrio was found on the system. Please uninstall it and try again.`A conflicting installation of Citrio was found on the system. Please uninstall it and try again.hSe ha detectado una instalaci

lala y vuelve a intentarlo.dSe encontr

lala y vuelve a intentarlo.VS

uudelleen.bMay nakitang sumasalungat na pag-install ng Citrio sa system. Paki-uninstall ito at subukang muli.pUne installation de Citrio incompatible a

ajte ponovo.kA Citrio m

jra.NTerjadi konflik pemasangan Citrio pada sistem. Copot pemasangan dan coba lagi.]Nel sistema

.XSistemoje aptikta nesuderinama

.lSist

.\Pemasangan Citrio yang bercanggah telah dijumpai pada sistem. Sila nyahpasang dan cuba lagi.oEr is een conflicterende installatie van Citrio op het systeem gevonden. Verwijder deze en probeer het opnieuw.gDet ble funnet en konfliktskapende installasjon av Citrio p

nytt.sW systemie znaleziono zainstalowan

ste to znova.WV sistemu je bila odkrita namestitev Citrioa v sporu. Odstranite jo in poskusite znova.a

.VDet finns en annan installation av Citrio p

k igen.ZUsakinishi tatanishi wa Citrio ulipatikana kwenye mfumo. Tafadhali uondoe na ujaribu tena.yCitrio

.UNebyla nalezena

ytynyt.5Walang nakitang pag-install ng Citrio upang i-update..Aucune installation de Citrio

galima atnaujinti.BNetika atrasta neviena Citrio instal

o.HNu s-a g

t un error en el sistema operatiu durant la instal

. Torneu a baixar Citrio.OB

opera

m Citrio znovu.QDer opstod en fejl i operativsystemet under installationen. Download Citrio igen.nW

.UAn operating system error occurred during installation. Please download Citrio again.UAn operating system error occurred during installation. Please download Citrio again.kSe ha producido un error de sistema operativo durante el proceso de instalaci

n. Vuelve a descargar Citrio.]Se produjo un error del sistema operativo durante la instalaci

n. Descarga Citrio nuevamente.KInstallimisel ilmnes operatsioonis

.CAsennuksessa ilmeni k

virhe. Lataa Citrio uudelleen.jMay naganap na error sa operating system sa panahon ng pag-install. Mangyaring i-download muli ang Citrio.rUne erreur du syst

ke operativnog sustava tijekom instalacije. Ponovo preuzmite Citrio.YAz oper

jra a Citrioot.UTerjadi kesalahan pada sistem operasi saat pemasangan berlangsung. Unduh Citrio lagi.aDurante l'installazione si

verificato un errore del sistema operativo. Scarica di nuovo Citrio.=

.KDiegiant

vyko operacin

.PInstal

.SRalat sistem pengendalian berlaku semasa pemasangan. Sila muat turun Citrio semula.cEr is tijdens de installatie een fout opgetreden in het besturingssysteem. Download Citrio opnieuw.EDet oppsto en systemfeil under installering. Last ned Citrio p

nytt.OPodczas instalacji wyst

d systemu operacyjnego. Pobierz Citrio ponownie.aOcorreu um erro no sistema operacional durante a instala

XOcorreu um erro no sistema operativo durante a instala

o. Transfira novamente o Citrio.YS-a produs o eroare de sistem de operare

cie sa vyskytla chyba opera

Citrio znova.GNapaka v operacijskem sistemu med namestitvijo. Znova prenesite Citrio.T

.NEtt operativsystemsfel intr

;Citrio Windows Vista

Windows XP

Windows Vista

.ECitrio

.>Windows Vista

?Citrio requereix Windows Vista o Windows XP amb SP2 o superior.MCitrio vy

aduje opera

m Windows Vista nebo Windows XP SP2 nebo vy

.BCitrio kr

ver Windows Vista eller Windows XP med SP2 eller h

jere.IF

r Citrio ist Windows Vista oder Windows XP SP2 oder h

.?Citrio requires Windows Vista or Windows XP with SP2 or higher.?Citrio requires Windows Vista or Windows XP with SP2 or higher.JCitrio est

disponible para Windows Vista o Windows XP con SP2 o superior.RPara usar Citrio Frame, se necesita Windows Vista o Windows XP con SP2 o superior.JCitrio n

uab Windows Vistat v

i Windows XP-d v

.ZCitrio edellytt

on Windows Vista tai Windows XP SP2 tai uudempi.

OKinakailangan ng Citrio ang Windows Vista o Windows XP na may SP2 o mas mataas.OCitrio requiert Windows Vista ou Windows XP avec SP2 ou une version ult

rieure.MCitrio

.ZCitrio zahtijeva sustav Windows Vista ili Windows XP sa servisnim paketom SP2 ili novijim.XA Citrio futtat

hoz Windows Vista, illetve Windows XP SP2 vagy

ges.PCitrio memerlukan Windows Vista atau Windows XP dengan SP2 atau yang lebih baru.ICitrio richiede Windows Vista o Windows XP con SP2 o versioni successive.P

Windows XP SP2

.FCitrio

Windows Vista

Windows XP

su SP2 ar naujesne versija.vP

ma Windows Vista vai Windows XP ar SP2, vai jaun

s versija.cCitrio-

.ZCitrio

.MCitrio memerlukan Windows Vista atau Windows XP dengan SP2 atau lebih tinggi.DVoor Citrio is Windows Vista of Windows XP met SP2 of hoger vereist.BCitrio krever Windows Vista eller Windows XP med SP2 eller h

yere.PCitrio wymaga systemu Windows Vista b

Windows XP z dodatkiem SP2 lub nowszym.BO Citrio requer o Windows Vista ou Windows XP com SP2 ou superior.BO Citrio requer o Windows Vista ou Windows XP com SP2 ou superior.NCitrio necesit

Windows Vista sau Windows XP cu SP2 sau o versiune ulterioar

m Windows Vista alebo Windows XP s bal

m.kZa Citrio potrebujete operacijski sistem Windows Vista ali Windows XP s servisnim paketom SP2 ali novej

vs Windows Vista eller Windows XP med SP2 eller senare.CCitrio inahitaji Windows Vista au Windows XP iliyo na SP2 au zaidi.UWindows Vista

.DCitrio

.CCitrio

QCitrio; Windows Vista veya Windows XP SP2 ya da daha ileri bir s

gerektirir.HCitrio

u Windows Vista ho

c Windows XP c

Windows Vista

.yThe installer couldn't create a temporary directory. Please check for free disk space and permission to install software.yThe installer couldn't create a temporary directory. Please check for free disk space and permission to install software.

El instalador no pudo crear un directorio temporal. Verifique si hay espacio disponible en el disco y cuenta con permiso para instalar software.wInstallija ei suutnud luua ajutist kataloogi. Palun kontrollige vaba kettaruumi ja tarkvara installimise loa olemasolu.e

.xPemasang tidak dapat mencipta direktori sementara. Sila semak ruang cakera kosong dan kebenaran untuk memasang perisian.

lador no ha pogut descomprimir l'arxiu. Torneu a baixar Citrio.RInstala

m Citrio znovu.JInstallationsprogrammet kunne ikke pakke arkivet ud. Download Citrio igen.iDas Installationsprogramm konnte das Archiv nicht dekomprimieren. Bitte laden Sie Citrio erneut herunter.Z

.IThe installer failed to uncompress archive. Please download Citrio again.IThe installer failed to uncompress archive. Please download Citrio again.[El programa de instalaci

n no ha podido descomprimir el archivo. Vuelve a descargar Citrio.JEl instalador no pudo descomprimir el archivo. Descarga Citrio nuevamente.LInstalleril ei

.NAsennusohjelma ei pystynyt purkamaan arkistotiedostoa. Lataa Citrio uudelleen.VNabigong i-uncompress ng installer ang archive. Mangyaring i-download muli ang Citrio.n

.JProgram za instalaciju nije dekomprimirao arhivu. Ponovo preuzmite Citrio.gNem siker

.NDiegimo programai nepavyko i

.SInstal

.LPemasang gagal untuk menyahmampat arkib. Sila muat turun Citrio sekali lagi.QHet installatieprogramma kan het archief niet uitpakken. Download Citrio opnieuw.QInstallasjonsprogrammet kunne ikke dekomprimere arkivet. Last ned Citrio p

nytt.LInstalator nie mo

a o download do Citrio novamente.bHouve uma falha no programa de instala

Citrio znova.KNamestitvenemu programu ni uspelo raz

.RDet gick inte att packa upp arkivet med installationsfilen. Ladda ned Citrio igen.JKisakinishi kilishindwa kufinyuza kumbukumbu. Tafadhali pakua Citrio tena.P

Navegador web

Webov

Webbrowser

Web Browser

Navigateur Web

Web-preglednik

Browser Web

Browser web

Penyemak imbas web

Navegador da Web

Webbl

Web Taray

t web

s un navegador web que executa les p

gines web i les aplicacions a gran velocitat.

Citrio je webov

webov

ejte web bezpe

Citrio er en webbrowser, der k

rer websider og applikationer med lynets hast. Den er hurtig, stabil og brugervenlig. Beskyttelse mod malware og phishing er indbygget i Citrio, s

Citrio ist ein Webbrowser, der Webseiten und Apps in Sekundenschnelle l

Citrio is a web browser that runs webpages and applications with lightning speed. It's fast, stable, and easy to use. Browse the web more safely with malware and phishing protection built into Citrio.

Citrio es un navegador web que ejecuta p

ginas web y aplicaciones a gran velocidad. Es r

cil de utilizar. Citrio te permite navegar en la Web de forma m

ginas web y aplicaciones con la velocidad de la luz. Es r

cil de usar. Navega por la Web con seguridad y protecci

Ang Citrio ay isang web browser na nagpapatakbo ng mga webpage at application sa bilis ng kidlat. Ito ay mabilis, maaasahan, at madaling gamitin. Mas maingat na mag-browse sa web gamit ang proteksyon ng Citrio laban sa malware at phishing.

Citrio est un navigateur Web qui ex

cute les pages Web et les applications

une vitesse fulgurante. Il est rapide, stable et simple d'utilisation. Naviguez sur le Web en toute s

Citrio je web-preglednik koji munjevitom brzinom prikazuje web-stranice i aplikacije. Brz je, stabilan i jednostavan za upotrebu. Pregledavajte web sigurnije jer je za

mgyorsan futtatja a weboldalakat

Citrio adalah browser web yang menjalankan laman web dan aplikasi dengan kecepatan kilat. Browser ini cepat, stabil, dan mudah digunakan. Jelajahi web lebih aman dengan perlindungan dari perangkat lunak perusak dan phishing yang tertanam di dalam Citrio.

un browser web che esegue le pagine web e le applicazioni alla velocit

-Citrio.xCitrio

.yCitrio

Citrio merupakan penyemak imbas yang mengendalikan laman web dan aplikasi dengan kelajuan sepantas kilat. Citrio cepat, stabil dan mudah digunakan. Semak imbas web lebih selamat dengan perlindungan perisian hasad dan pancingan data terbina dalam Citrio.

Citrio is een webbrowser die webpagina's en applicaties bliksemsnel uitvoert. Citrio is snel, stabiel en eenvoudig in gebruik. Surf veiliger op internet met de in Citrio ingebouwde beveiliging tegen malware en phishing.

um navegador que executa p

ginas e aplicativos da web com alta velocidade.

cil de usar. Navegue na web com mais seguran

um navegador de internet que executa p

ginas Web e aplica

cil de utilizar. Navegue na Web com mais seguran

Citrio este un browser web care ruleaz

pagini web

i pe web

a webov

web bezpe

r en webbl

r webbsidor och appar blixtsnabbt. Den

Citrio, Web sayfalar

ran bir Web taray

sayesinde Web'de daha g

t web ch

c trang web v

t web nhanh,

t web tr

o Citrio.KCitrio

executant actualment. Tanqueu Citrio i torneu-ho a provar.qNelze nainstalovat verzi prohl

Citrio a zkuste to znovu.jKan ikke installere den samme version af Citrio som den, der k

.eCan not install the same Citrio version that is currently running. Please close Citrio and try again.eCan not install the same Citrio version that is currently running. Please close Citrio and try again.xNo se puede instalar la misma versi

ejecutando actualmente. Cierra Citrio y vuelve a intentarlo.nNo es posible instalar la misma versi

.fCitrioista ei voi asentaa versiota, joka on t

uudelleen.pHindi ma-install ang parehong Bersyon ng Citrio na kasalukuyang tumatakbo. Pakisara ang Citrio at subukang muli.

.lNe mo

ajte ponovo.mNem lehet ugyanazt a Citrio-verzi

jra.iTidak dapat memasang Citrio versi yang sama dengan yang sedang Anda jalankan. Tutup Citrio dan coba lagi.eImpossibile installare una versione di Citrio uguale a quella in esecuzione. Chiudi Citrio e riprova.

.sNegalima

.eNevar instal

.kTidak boleh memasang versi Citrio yang sama dengan yang sedang dijalankan. Sila tutup Citrio dan cuba lagi.qKan niet dezelfde Citrio-versie installeren, omdat deze versie nu actief is. Sluit Citrio en probeer het opnieuw.WKan ikke installere den samme Citrio-versjonen som kj

nytt.iNie mo

buj ponownie.lN

sendo executada. Feche o Citrio e tente novamente.sN

atualmente em execu

o. Feche o Citrio e tente novamente.nNu se poate instala aceea

ste to znova.eNi mogo

.iDet g

k igen.pHaiwezi kusakinisha toleo sawia la Citrio ambalo linaendeshwa hivi sasa. Tafadhali funga Citrio na ujaribu tena.a

ha fallat a causa d'un error no especificat. Torneu a baixar Citrio.HInstalace se z nezn

m Citrio znovu.SInstallationen mislykkedes p

.KInstallation failed due to unspecified error. Please download Citrio again.KInstallation failed due to unspecified error. Please download Citrio again.WLa instalaci

n ha fallado debido a un error no especificado. Vuelve a descargar Citrio.QLa instalaci

debido a un error no especificado. Descarga Citrio otra vez.HInstallimine eba

.NAsennus ep

.JInstalacija nije uspjela zbog nepoznate pogre

jra a Citrioot.KPemasangan gagal karena kesalahan yang tidak ditentukan. Unduh Citrio lagi.UInstallazione non riuscita a causa di un errore imprecisato. Scarica di nuovo Citrio.5

.JNepavyko

.UInstal

.WPemasangan gagal disebabkan ralat yang tidak dinyatakan. Sila muat turun semula Citrio.MDe installatie is mislukt wegens een onbekende fout. Download Citrio opnieuw.SInstalleringen mislyktes p

a o download do Citrio novamente.UA instala

o especificado. Transfira novamente o Citrio .SInstalarea nu a reu

znova.FNamestitev ni uspela zaradi nenavedene napake. Znova prenesite Citrio.H

.MInstallationen misslyckades p

nt fel. Ladda ned Citrio igen.YUsakinishaji ulishindwa kwa sababu ya hitilafu isiyobainika. Tafadhali pakua Citrio tena.Y

citrio_48.0.2564.270_1.exe_1144:

.text

`.data

.idata

@.rsrc

@.reloc

c:\jenkins\workspace\Citrio-Dev-Clone\browser\src\out\Release\mini_installer.exe.pdb

RegCloseKey

RegOpenKeyExW

ADVAPI32.dll

GetProcessHeap

KERNEL32.dll

SHELL32.dll

setup.exe

S*.lK

XP.hS

.FKY2

S%d?K

X'"ÌJg`

;.BHl

ns .Zs

.DikV

.JzPlq

-V})&

TJ%8u

y.RSt

ÁUPl

.nYq95cg

%S4-!S

.bBL'

8NA%x

I:.TW

@.cDX

5eXE.

?.mgH

.HsS844

z%u9&,

%s1'a

%s.H*2

Gf.sA!J|

x'P-5}

.ks=R

1.hx<

{ZNe%C

{O1%3xC

[.qgB

Q0I.ul

Z0&.iI

#-!pH.BBMk

mH4w$.eZ

89%u\

*rt-hf}

O|.Nt

H[?~;O%C

.HKMkL

%sD,h

#%>%x

QD.rj

]MP.wdnN

@-1Z

.JozUY

l.oit

X.Ko9

l:.VPf

bc%F:I

 [.Pf

tG5c.qT

$ESQL?*

?f.Ar<

.aF[m

C.hY`2

I.mLvM

.rfcV

2.vz$

;-O%x

'^Z%C

-rV1}

RV]&.cU

%svA{

ID%d$

.nF]1I

.nUsLB9

c%SOq[U

J..wM

P#.lJ

0.SBL

.t.X.Wj

:s>d%d`

.nq0=

%uR,:,

-|?

].TYo?o6]

m.Ugs

M"].gW

Z%dk^

j.tbH&

O^.mbT

%7 Q,N%C

p>.Vp

 c.HM

/%XBw^

.gS.v

.DYCqO

t;

.kQ#&TE'r

'%uq|

.dUA7,"

%fuB0

.SE~7)=

_K }%D

w1.QRq

n|:%c\C

ij<%u.

tu%xl

d:E`%x

\d%sX

l.fWfK

z3.yN

%x[@<M

)r.CS

.utP%

(.OPD

8Y|s%D

RU&%c

-*%D/H

cG.Ld

.dj#3q7

T.roF

T!(%fM)

.rRM,

%d.| 

#0.ii

@%Uy}Y

7.vC`

E|%7S

.izCZ

.YzgMa

F:\ZO

.ol_$

c.XY!T

Lt|

%SZW>

7.ZUT

Q:\dnF

mT.MRF%L

.Xkt>

Q%f^3

".Rz*%4

.SsNE

.cM}6H

.jD%3L

.YL<H

%s08c9

9g.An

X.kwbQ

cl 0%c

n.leu

 %fv~"

YXXT %d=,F

G9$.nL

)<hw%U

8SM.kgC

T%Xp8

sqLX

%-8.MJy)N

X.WFwzA

 !5.rxvm

xBi.HW

Gc.AA*.E4N

m{.lu

u%0UW4

ECX%UV

!DB.sySf

--y}),

.sXGFn

cRtA

H.XP$

.oRyP

J.OMbJ

.Vn:>

nR%4X

X~#.Ry

.Kiv*

*%c@W

%c/#K

v.GrG

R.Ws}

`tA@%f

%S]Q 

%stL\

%UzoS

\/.es

%9x:I

g%claI

AK.Lo

_/.eu

MJFX{.Aj`

d%C#q

v.iqx

.nBrS

.chm(

b%D&R

Ku.eS

y%d''Y

.aI@)

J.wSN

;.sSs

_E%SC

.rXZ-

oÞ-xL5

.EB]P

%cm--

%SX2Y

W%C%c

.Fh9]n!s

.KN|F

x`N%s5

Gq9VQEL<!%f

zcp.jU?

z.gbsti

t.jO'

g!.qQ

C`i%8xF

\`%f^y41y

n.lnF

?~.vGG

.Hh'u5

{%;

3%.ZI

>*Jh%s&

NW.Fn

2W.OV

%.Gp~

B(.dQ

'@n

.VWvf

O;%1S,S

%Sd#.

wa.US

.so$v`2

%Xwh.

`%X9kr

\"%s$

Cp%XsT

$.Ko_

G7a.TbT

bc%U0

.eZ[H

pF%XH

;5.YR

p.rWSg

Ju.if

]x~8%U

D.Ii^3

Zf.mM[#2

Q k.MN!

.kS;!

.ODL%6

.McJb

%SV^?2[

-c}Z[

uÞ6}

A-n}c

c.fOV

1 9z%X

W.hoZ

^.HvK;

Q.ZLT

%CYmC

%F>^M

*h.do

.qc}L

X$.tZo

EpHe.qJ

ayA.AkG

Ø:y

OwW%f

8/Zy

S.meb

W%8x@Gs

%DHQ=

%CY8W

Y.XlC

8n%xLIV

-^%xMEY

(vA.Il

.bI*,!

-I<8%F

%CQ>~

[email protected]

lc.gu:

L%xRZ

sd'dÀ

4Nx.DQ

Y.nti}\

<%XBb

.Ls"p

oK^;.Rf

%v%Du

.xm/[

v.Sj 

dD%F;%U

xpKFTp

l.coV

%SB[x

~t.Se

7.mop

].yITV

.Ni2K

%CW`1

e.bi R

|z.plbw"

.ofxt*E

.nXYM

>%X E

.IVQX%

v.jiFX

:?.Mx

Dt.mU

%f>Gq

C.hwr&

q.XX7

TCPT

Q.vzc

.aJM)

.jreF}

.HeN0

%x2'x

t_kEy3~

I%D~Q

hC.Vc`

G8u.bU

@X(.qxl3

o:\WiN

.Of.Q

*$%dg

N.omh

.rXwx

%dW"Y?

<Q%S 9

.wjCh

nxL/'G.kW

?.mdj

.uEm#l

7bN%C

.Yk e

#_-W}

.qX\|

|4".DP

".Zhz

0.bci

K$d.DD

8*\%FS>I

Sd%XF

.JQTlC

]%F?rG

CÐr

%u?R/

E.Zhjf

1 ]ru

eT.bU

uUf~.XU

.qVM>U

%7S=a

86.gG

xv.j.eq

noj-k}W2

.SBm9!

=M$3.aw

dTA%sV

T%cGsC

%x}6b

-g};?

]Hr%c

.zqTEC

.U.GH

SUI%X

.icp3

.HK$A*

%u*!}

@%UtO%\

B%S=]

.JC2a

tSÓ

UdPt,9

<e.NN

@-?.dk2

O.gMtE

.Fv02c

%#$%d$

}"g>%F

U`'g%S

:4.nX=

,M!%f

04.Vd]

.fc0iYS- 

g.kR<K

%C$x(

V5.Vx

4.cha

.aWQu

7Z',Y.hg

-<rjs%x

sc.sh

l%dj J/Gx

G@".hi

vK.vS=

-dEY}

_.dP}g

.bgRP

%Sg_u$

.IZ!~K,

L#Y%f

(-.qA

v^.zyQ@

%u9]Q[x_F

|t.KK

T0.Tu

C%U0Xr

I8fN.GP

n.xdi@

i1%uL

*.Oj8

Nt5%X^

Ðz>

.VuR4

}iCÛS

)<"-O}%

)/.mXY

vWOx6w1D%CN

.XcA"

!]!??#$-

7crtP9

1ÙJ

u)%XK

.qtY`

1r.Bxg'

.Jqœ

DXn.CS

.Nl'F

Wz.cmF{oW

hM%x}/s

HN.RU;Y

&<%x<,

H .QV

;,U

CmD[@

.Tf15

.XsD]

5wEUv%u|

owebUb

.weSj#Vn

bo"%xeT

}g$.ze

D-qfu})

.lW&$Z

oF.Qq

.-Rh}

.MTBQ3

,.iO$

PYp%D&

x.WYE

A{}Rn%XW

b.mV{

`j~1.RY

L.Rop

.ANl[

.co`;

M{%x\I

.Jw&IJ#

;.CB!

F{#F.qNG

6.hpz

M%cq(

48L.dM

>i3%d@

.jG@7'

1O%c"`

4:.mw

P,.UZt/Z

*%S@Rv~

6mX.MQ

_ds.yT

XWC%c

oc,-4}

.ZV*,

H.JjT

Uv.Owt

%1.fjcoI

/%f/gs

_j%c_g

j.hrJ

lp%sX

qkf%sAU

%u?B=R%

O.JpA

T%C<y

d.qd '

cs.mFiQ

6.Dz,F3"

Dl%X(Nm

W0.Zzn

.In3N[

,`Þ

rH.noY

PX.HP

a.WWm@i

$&%.U

%c$?A

L)/%sZk-

i`.qK 

J.vF9p

.He5?X

/H.XAj

`T..Ji

%xU?"qY

%UWt#

]=.cD{

p~%fP~

.BfMv

3 .XJw*-

.YV|)

Ff<.tBm8

rA.se

;%S,<

=/sS^

)%F Ja

7)K%x:

'C.Bk

-q.vN

xkZ%C

.Lr\)

p, SSh

Z:ZZ%F

e*.dT

%s]0>

q"xq%S

".aC/

..sA{

.ZTC[:K

u2f3f%F

VKK;%U

a%U(Dv

4.aTy

N.RTY|

{A;%S

Z.DCsc

D r.kyU

-a%0S

uDPA

.BL45z

\.G.qB

W.qc,I

.yY{Y}

0;.BT

-u.Br

f.SNz

P!K%Dh

X|.PI`k

.jnqN7

.QX)KTJ}t8

ù$;

B%uK'B

.nZk"

ta.vk

W.oaL

Mm.Gq

!;%D#

.sY= /@

j6.REQ

%Dsr#|4

.Ga`z

2@%Xqj

j.JmX

v-G.OO{J

L5.ZM

]'Er%D\QA

;.RsmIKM

3:f.DG

<p/.EI

]@*%d

A>.Bk

Ra\G8&%cr

}.wLe

Ytdyn%d

'z%s<

.QV{Q

{}Pf%F

%D~L%

L.ba"~

dP.He

7cV%SI

)8.WC

A.zk'

.up<Q

.Hl3GA

.Bbn](jLvZ

>>.aJ

VÖl

b5O8

V.Vj!

.wy<W

u.zoF

%S}Z2

)=.yey

%CVSul

t.JY'

ßZr

.sxtY

P?%sI =

H.Ho;

2>[email protected]

.oA9Z

oLL\%X

 %4s{

0 Ö

N(NG%D

y.VG;$6'

:s{(.MmZg

-bY9}

{%suG

1Zb.ai 

,,.tz

.eigO

$B%sH

.JdHw

x%F_O

;QX.DKf

EO~D.phAR

.Mx-c3

h.eSU

H{.ox

5F.AU

Z=5%XM

x.fy/f

%PP.Wh8

k%;.eX

g.SIV

H.UtZ

}h*%X

.YqPj

.Drc!

IO.Ud

W%S:G

c*.cX

dhUDPxz

l}n.ku1wZ

?=.DF>Ev

#.Ds2*~

dq>%x

.Uz65

g.XVu}

FW d,%.f

 53r%d

Q?c.xCF

 i%S7

-QT}\U

Hrp.JO

d.nIz

TCp&f

j%1uj7/

U.MLL

%d&]#

TQb%S[

.AMtf

I.Di_D

>e.Ub

>3.iN

%6U|^

y[v%C

$.jIRp5p

aeJ7"74.DZLh

.yrh[z

>.xt]]

E%x=u

h.pK%

 .ro 

S/.vr

Xt.ai

%F&z(

.gZZLd

q.QY{e

(.WS}

E(RG.vt

cRtgj

9_^keY

m8.dH

.ha3w

KE.kp

.CYX%

Fo(ø

{:.Yf^

l9.gc{

X=)l%x

/x.Ls

<(%F@g

/.

L?%C,[5

$.Zr}*w

qp.BNO

%Uvzj

r.bdH=

RH.jz$n

:?.KF

w^.qT

o.MN0*

.okGC

iM.YJ|

`.MJV

.VK"^

K,,

.KTYj

ni%2U=

N~?%u

0R.mD

.uszq

%D=7V

.CCFv

.fCgA

%FT_f#

.kB.P

.BZ$8

 =.Dh%

"gx%S

g.KNN

E.fF`

d.dTX9

;.be_i

Ox.nG

-9.XG

QZV.uA

.eHU!

.Xr?BkZ

zwa.Ak

.TT2*I

kE^3^a%C

.SF:Q

.|%Cnnv

9@B%S

O=V.YpK

W@%Xh

%s/y_\_

I.lncJZ

L.dN0L

}..pI

8v%dj

!.bj;}4460

~%%xf

b1y.lE}LE

.Mg*xQm{4

MT.CA(v?

~.AD#

%s~0f

 O.ZX

.Me?JRL

h`.ED

Ohm.UY

.MDa_

VOI%s

DQ.cx;

.un=V

18.ou

..gR8

sU.yK

Q]V-9}

V.dw\;x

yPz%Xd

M .XL

U4CKE]R%S

%.Ê

úR*

;.oV:

Cet%X

.XX;1

(G.qBsD

.SF/%u

V`.XY

`.BHKF

i%u i2

ZSQl

.NC]C

%fI5k)

U :B7%F#

"%xEz]

c%F[3(J

wR.rH7y

nY%UL

V_%UUd

.QBx4

R.VV ;

h.Tp$

E%xW41

|\"%u

 .zJ4

4A

2.rbl

E;;.oW

jtC9i%U

F&Dt%c

b2j?.bF

N%X(H

.PMe3

.AsVd

Lf.QV

F*.RU

%DMSt

m.OR"

Urli

euVF

a.jdZ

.Eh7wfs-

> nZ.mp#=

$y=;%D

l%sv,

Y:\CI

{.LM)&

U;d?%u

k.IO"

b[j.Wo(

v .lJ

..bx*

xw.FAk

 ^%d%I

C!.Sa

B.CaL

.XR1M

7w.sSXr)

z%DyR*[C

!%s?B

 9.sV]

%uTP7w

{.yFcx

.vFl3

.CP;/

%dw.J!

R%u",

q.IB:

(.Qm0

78.eS,

#.%fY

.wVu^

j].bE

L3Ï

.ZA~Fb

C%FSE

.etJ{UT

.Eox!yW

%d!w^

Rn.Zw

%sP~z

ÞG/s$

t%FL<

-.anx'

Ï#O

j%u=Z

xU%0S

%Xtu-

sln%CX

L-q}N

.CqQVi

E%c#&A

K.GM)

UtD%s

EA.aJ

T.qt;

5;.hLD

p!KEY

Tfa.pn

S%uzj

b.cb`

@' 3$p

-o}T-v

yE.IR

qt.QE

Zl`#|%U

_Q.pz

-b}F.T

%UgXx

.xKfE

=.UGp^

I{.gF

tFg%d

*C%ChULQ

8 .Tq

.Cw%w

Oø4

`El%x

f.QnHk

i %X_

Z.bs.I

9.Zha

.cK<-

@*.pG

.apln

.bE?C

>.fOt/

84B%X-

U.tk(Pc

a..VLp

go`%x

bC.aK

vMA%d

&OŒ}

C0.nO

.ACvt

BWEbF

.Lcsi

%SQ!~c

>.Fm-

.Bhuu

2c\e.Xg{rx

&0^$%DrkA

Îf-@

.Ak~!

JPY.Tp

%0.lDy*w

rMsG`

_{%4x

m{8t1.nKW

0,Y%F

GP-A}d

.LN08

g]~d%S

4e%uR

K%cs3

/4).Tt

j.aKx

?vp.Io|

ti.pZ

.jK6JV

yÍf

.jx*Vl

?L%se

`.Ljz

.PqHe

%x.BF

H.SEZc

\.stU(

-7}Sj

@wM;%f>

2t.uj

6\%St

T_8.nO:

h%fRd

0-.Nva{

K<.kV}

r.cl|6

%8Z%DU

x.pF_<

*\j.bn

3H%ul

.WS"0-

#Sj%S

(tu%c

~}.%dy

.QbV-

Ì\&a

4s üH

iv%%s&;Aw

].sDi

u%xFo

Y`y]Ål

*=.ZO

%C=`w4

.My?}

!%s0Y_

2u.xHcU

.CowG

..gPu

R>A%dH

&X.yW

.GLVK

%DkrB

k.mK}f

<u.az

.LK?t>

%duBK

.vQmK

>.SxF

-x6}!D

3LCA7Na<by%C

.nagn

ek.LQ

]{.zn

.Dbf%

%XqYlP<e-

y)a%!]%u

Z%$'.ZF

3j_&a@A}.Cm

.PH(a

b.wRa

3-;).tO

k|pAT%c

!m.yv

5%R%U

z.MwR)A

78G%s

_U

MZurl

NP%uZ

$fT.sr

~^.BoJ,

6f.kZ

-cq}l}

.N%F`,N

%dnJq

%Xf"GS

?7.zH

-x@%d

$Y%9XT

\K`%x

.po=$

.dbho2H"

oCd%s

l:7t.Afq

gW.WC$$5

.aM8-

 9uRl

\.LojD

%.Hsi

.hm~~I

.aKkC

"?%sAP

h*.UV

9sW%X_

IEKV.bl

$.XSgC

"(_.rZ

V.Obm-

.uYm_

Y_.cn

}M.tj

Yag%SA]N

cy.Zl u

.mf"D

.RyfW

7#[;$ 5$

.SyaNTm

@%.Mt

&w.XY&

?o44.Gu

N.dux

.qH&c

9c9%s

aFL%s

>%1xK

=%9X6

)NV.vio

v0f<.gi

t-?|;CC .cH3m

.Ce?A

^T%C=

QK<P.He

YY%xPw[S

Alw.BV$k

k?AR.Jy

.IQEC}

%fh`qa

.gBig

HLÿo$

7Y%dIA;|

?9.GKg4

`p%fH

.:.Ly

5%9sV

.Bg-3

.gil/Q

%U""2

'\.jP

g!h.Lu}

| |.hT

"A%DQ6

CrTf3

D.aZz

9N.FY

SSn.VNDP

ÜWi

;I9%xe

e~G.DE:t

^T0%c

(r.VN

`"Z.cx

.XJ-dv>

%U :?

0J%S8J

V%U,lu

J.hKpc</5

Cf .xgR

%U9-w

'.3^'/=?_/

)$3;g%u

.iN7z

ov>.EI_

tv.NJ

^.Vt'

'/%u#

!.Spa

%f<8o

.efiJ!

[.Mx.

.RURK

/%W.pV

d%4uo

.YQ(q

.CBrD

~|{Msg

0./a5*.Yw(Z

/S.ZMU9

XF.MR

01.BA

%xa1$

 @.LX

S3,.ZO

T.LQh

%Sp#'

-hieQ}

DR%f$%D

iA9-zEg}

ÖqlrV3

GQ%Uf3C

uÏi

C4.aa

d.Au{

%XRR{

7rn%SA

p.QStP

-uM}{

.ojKe

p.tM7

7?F.Cg

Ï>,

3F%X%

%3\.BI$<

JurL)

9.VN-

q%S/d0H

D-.dJ

W.Ec>P

.zS\]

i>WCRt

Fg%Sj

Qu.KUXxm

hs.hcA

%sg<U

A%Fl|

k.RWT

,TÌ%

.NYyr

P\.gP

"d.XfyN

S.sgx`

Q&AB%s

.lgHK

X.nbo

TR %ue

9.GLj

6G%xF

.UsA_7

~.lL;:

x.BHZx

\L.cz

M4.cro.5

,&c.kW

S.rUa}

sQLFw| 

M.FY[

cR#.Ua

2:%U(

]m .HW4

(E.te

%udZ\

v.bQgN

.sVa1

.AhVK

:.RPbY

#&_%f

.wyi8

~bB3.Fd

R.LxP

.IR-U'

lY`%U

a.FA =

Ml.tNL t

.qOGP

ò9_1

{%x;O

 .MX/

jx/%x

[Wu.Iu

'u.mA

l.Hs':71

%S*Y'

<9i.oc

.dI^A

 .gBL

x.DMb

3x.RJ

.JrwS

%fZO)L

_.DXu

.bgv:

.xTv7

^O"%S

.JC7mL

l%DIQ

.Tu-'y

_X-9}EF-

.vE/x

9.Hl/x

V^LÓ

.sI-(<A

f$l%u

T1.ua

-u}MD[&

%xixX/Hp

{^%DH

J8%sE

4^Z!%X

%st9Xr[

%DT21

IW.OX

l<%S[

99L%X}

zL\.CZ.

,!Pn%S

IlÞ

.MG<@

5zK%D$n

%s>nhK

b&$t%xa

Sh%U7,]#

z.nr1}

.MW]N

.kG8kh

'Y.Uk

.MJ^w

d%dz>P

n4!%s

9.sV)H

.WUtF

%xQV,

s_\8%d_

Z.GU{d

%fuFi

iw.wOCg

b%2xS

<.hN]

N*uN%c

,%.qb8:

p.sN$O

t^.AD

RL%CK

.eh*^

.pHu5

.rfn'{

`#.Cib;

.idq?

%XoE?

rY.Cw

.Ty) <

.e%skh

.IzMA-

}.%X4

%xa:&

=Ul.uUA

ZF_/]

g'ch2%F"

yU'.Fi

.zGviY:

.OW_ DU

hmi%SC

j0{%s

%Xllo]

RVW%6x

m%z%S

xj;%U1

s.Bsc

tcpXXY

z3.QJ

;r.Mw

.JH<y

C%S(N

%uWz^

?.Qaf

e.CCd07G6

/p.BY

v{y%f

.VA 9W

b.hBe

w%XpS

$!Ë

Csu/

pwF\.ot

_%x|p2

%dMei

<BG1U"L'%c

6tZ9)%f

-5p}B

;7.Yh

*bT.XT

.XdRf

%u4?!

Qn.agA

-%c;(

%fG]U;

.iU.%

8II%x

S!^;.Juq

.FM,{IlZ

-SVAH}

0m%s|F

);.<.HK

>l8.Mp

<Y.mo

-XfqE}

Ho.VHn

E%4S{T

.CD.8r

479%Dt

.ER^'O

Vn.DJg

.ls4 

A.fNU

.dLJ@d

FHf2o%x

g?4%d

O.VIOa

þ' 

HR-P0G}7U

.DAun3K

(.le.

m;%s=

.LwTv

w%s|>

.AsOHanG

H5õ

 c8Qb.Vr

Nh%Xb

].JGx?

:a.jm

pg.zh

O0.Ab

r.js4

lh.sD

\%D>0

.eiB#$

0f.QwU

W(.HE

45%uj

m%F)p

cuRl

p-EF}N4(

..vB wn3

1-Y}]d

FJ.Iu

[%.s1!

^$M.RJ

xe6%c=

%DSrQf

1%0uw

.Wp%P

.Eh<J

"~.Ik!

Yx.bN

ax.Nx

C:.cl

W_f.XH

Q!^a9%s

V.AG(

].mwB

hN%s5

&Ii.qv

R.guHB

(?.Sta

S:\vGj

].npW@

!l.mk

}%SA&le

$yh-n}u

D#%FU

q.Db;

.IuBnu`

(-Jw},

5U%uP

.mu\.

C%CWB

L%c]7

.LLX('2

CB_;%c

m.ehK*=

V.liu

bE%x;

@.iPL

R.QE*_

:;.Eb

5.Dpthb

b6.jgoT

w%u7 g_

.ja<0

).utp

4##.kM

Ag%uu

2.NTC

s1.yv[i

)6.TmJ

%.cN(

4g%X3[*

dD.xG

.JDh}

.gqSZ

9"F.Of

U.Won

rR.bs

%k.EdO

b%6Y%cz

hi3.Qln

V.BZ&?c

/.osT

%s' aL

oa*%Dpi

-7}}mQO

E:\}q

% ($4?`{

.SWT0

.Qv&=

.IupP

g%f*h7

X.Xa;x

*Y%sC

(.ZN(3

J.VKR

G.bS1H

.]r6.Ssx66

x1.CK

ZY.bY@

y.aq*

B7%DH

'.ZfR

pmK

f^.Zn

xEr%D

sHe.Bc

 |9%c

Gf%U1

%u92`

G.vr!

.GYF5h0

z.zz!3v

.Jh'_

.Zsg,}&;0

?<.77@<8

V.fXF

6H.ygp

-.LDx

MEz%X`9a),0

'qU%x

t.Ib9

_.XFR

.zb43

wu/10@%F

E.qT|

k.oIG '

%dSV1'

.mH)zt

ScMdR

N#.CE

f0V.Vp

%Ckf7m

.miv^z

-.lWv

N.blw|

_y7L8B%u

3:5.GJ

.Iccaa

'.mT1

g.JD4

hm.GaQl`

=~.Ys

gm.pg\

.&oö

].DD'

@%cpdU38h

N&q%u

-(.%D

.B.GH

G.tZa

Lbf%U

.Qb>@

tmb%u

e},

.HLu~@g

Pi.sT9

cN%Ct<P^

C;%ss

yf.Er#g

-zDE}

.fFm7

q.Ox9

2%SUh

ea%f[*

.oc~Q

L=kP.OP

exl.nJ

)]C.fN

N.eg6

.ijF{

%Ds j

%X]'o

.wHV;

 {mv.xw

$~.iO

K.fSRD

{eV.GK)

r/.xh

w.pK29

..AoS,

3B.xv

lkt&.vB

b%fNzH

 /-M}

J\sR16SV:%U

.tkbI

B?.sK

d4%SR_

CWY.QV

D.GPX

.aUVu'

B^?.YlQOn(

X,).yN

Y61tCPI

_.cvbt

Wpf%dr

Kk-M}]g

h%4S$^

7J.RJf

Ir.Po

;.BbP

.Xmnw S!

t%CZC

5.POe(

tmÛ

.jF^d

$y.IE

Df.og

%D%{2

@~*[%D

.rH78

a1.Pc

Ät6h

>4.ac

u[.iPs 

Dq.ro

@/]%F$f&

vd:%D

se.TY

A.bb]

A_T-N8}{J

?\\~&?(8

o{sl

A.Zki

bX.Dd

.rHv>

.lL?%

>U0%SJ

.Sx@J

m<.KfQWF^

}@.tR

.QSq.lO

H.al_

q|-a}

t.Tij 

h.OA>Ka_

& y%d

;'.NM

.BB}82u

`=.ge

/Z.JK

t1.Rb

%x4\E

m.QqI

C&N%U

DhJHwYa.Pj

.oD&B"

[email protected]

-9}*K

vY.fjx

|þ5

Xds.frF

#`s.CvG

!BZg.nP

!<.hHYDj

cU.Mu

%S?x 8

.pMjl0F

%XF&u

.EE6 `

%UsSik

[email protected]

!.Yx F

2%d~X

9%%uZ

òl}

b~fI%u$

.thUn

5a.LcZ4

.Ls9m

WkFtp

fÀ2~

.BL]<v

10x%2U

0UrL)

=.Rx,6

-.WW4,

.ECs3wBou

8%DM)-

%cW&ZD{

.KGp-

R"P.aR

3.uPK

~O%U}

.zzK)L:GZ

 0o5JG

d.Js%]IW

3BK%f

%C;0oeG

v>%c<

PmC<

.qa%5

.dR3t>

S.IdS

/F%c$

?OU4M#.iO X

wjS%X

3b.RH

.FbEMf

Wwr]%F

#d.oQ

%DnJO

0O.ai

~.ICoZ

_o.px

K=-b}k

0%U%lfR15

v.qiC

Y.vy7

%2Uki

p.wVm

".cD9

 /.TJ

5Dj.by}

V.fK'

Ò3z^

gS.Nb

~J!.wZ

hW{%xIl

[D.yH

~@Ý;y

Y.Ux#5d

r|.OT

"%1s[

%UJaH

d.Tvv9

.BkYJ

.Qp2N1qq

s.kv\

%Sz B~

.eD3I

.kt)0%6]

 s.vMy

Z:\! ~

ew.Vp

.Wd(g

%sa3>c

v%Uwc

.xP-A

s].jL

Y%sU`

7fòa 2r

_.Fw%

%X-Qdh

-3}q*

hY'%CmTb

[email protected]

_1*rmg%dRA

Fr@t;.nJA

@G.os

Y..Ps

#(%D|

(/.me`^pL

BtF%XJ

sIy.OO

.Cjm]

q%.PJrb

[email protected] 

.ZGei

,.vGDv

.ofaT

0w.Zr

(~4(%7uj

.ImNKD

XG.pZW*,

:#TcP

u.yZV

z.Gl/

%Slw&

x.ZwW

MhJx%d

.YW*XV

1z-A}N

7.tvUP

Nc%c@

T.GYV:

%9%.f*`

.Fa?h

GyH.Kxq

.iGB/

'pr%U

?.rO:VG

fRN.Ky

7.XiS

tx.xZ

kEYZk

@.NY|

-<x%S 

8.PfP6LLR

0.Lxm

.pD0K

ZS-9}

"6..zX

xY.qW

A.Fgkc7

m%Crk:

o3%s"

$%csl

Pl-.lZ

>c.WBx [

Pu%x~n

%uoo#

%D>} V

.US H]

.Xuv`u'}

Y.WauRCM08

ZN`.Ym

pR'%U

B.md.XnS

ku%X(

$[.Zvp

FN.gx`

\.wRF

9%d)h

p.lM<

r/|%f

9ns.HJ

K&.ARyE

.PK9:

 j gf%S

f7x.WH

FqWK%Xx

&\.cA

.jsJi

-5%xH 7

'P-N.jm'

ACrT4w

?%D> 

SshIB

I.hH@

|A.OF1

s6%uC<

~.rra0N

.tk@_

.Xw$f

(%S~;]

\4E%s

~K%Fq

4=%do

9S%Xva

.ZHC:

n(%Xun

[%cQ3

.dXx@"

9.sEW

.nY,*

^Fb.wI{

xb>fU0V.sf

y.BT<

d{M%c

;|%2u 

%sGh3

Y[F}u%sC

M.Zn 

xG.uu

WEbl

E%Udk

 Z,%d

@[email protected]

Y.hRB

]v.wu

.zc@I[

!.rj"*

.xR[]

\.xZ=

,]T%c

?EorMh.zx

s.sVk

_.qoy?

.sz@p>

.TD)Lf

.gL*o

DwN%Uk

w%S\e

&{%F}h

cRtY

yiN%u

.zB\S

oU.TR

,$%C;

[email protected]}R

Fe.yW

W6bW.nO

.Nd<T!

d.ZgK

kh.KD1 @

!H%Uw88

J.ORm`

5$.%u

YVKt.lJ]gn

J/.Ul

9Ym.wC

%D)RY

`P.nD

8H.ms

E%U.5

-%fs*

I.pz;

.b$.pl

.NYr03DT

N%sL}

1.rN,

.fIc1

8.iV~

.sZPQ

7n%dH

TFTP

!Cmd`

&%s<m

be%Xf

2.bG,

).XoY

8l|.qa

tPs.rl|N

I.Db%

`.yGW

.ypb`z

a%B.ko!

uRL[3=H

SM.Jf&

%uq(y

O<a.lNO

:=%a%X^SR

 c.xa

.MTq|e&

L?nA%c

jWZ%sV

V%XISO

OKEXeq

ŸBt

S.dvt

dQs6.NE

{.wk|x

%d|#Q

FB.zI

O^B%s

0`Fp[.Ap

.Gdu 

T.ZDgp

nudP

FM#.ySu7x

%xi3X

%DKoq

o^.ZYc

/=?q%S

s.CX3

'e.KC

cP.Lu

A7tcpK

03%c$

P.YME

'@P%U!Yq5m/

-V}yfJx

9(D%Fj

>u48%cV

).QS8

%U;#J

.Wb'[5

<P|%X

x.jx?

p.wZV

,a.kB

{piY#>,%5x

\2`%N.grF

ld.sf

QurL

Jg}.Tg

1(b`@%f

v*).hT^

i.mj.

e).Km

(H%CR

fURli

%c*<=

8%F\G

o.oS;

j>Í)

d4-q}

.JW4e9n

rr%U(9a

}.EO8

.qIMP

8=a-w}

{.GIB

%s}kn

}P1~>!Q8%d

Y_{.bM

o.zkBk<

%D\RG,T

.Ht`ma!

OS=%c}

$.yf4

.v.xHm(

.zLcjX

1U%uV@

/C

kEYjw

|q.aI=

B.BHR

TDn%F

%uomP46

*Bp{%9X;

^9%s5[Kw!

%u}j#

MSgr

o.bR?LL

.dkj $D

.fW<g

`.XX5\e

P].BAZ

*%sOo

Í-dQ

zx`l.rUEo)

mrj.gh

.kc 3

WSSHG@

/Xi%SI

x&.In

.bu"t

K.Iiab<

on%.Pg

;2%D-

0T.wk

2.mK%

.AM30JE! 

\{#%X

-<S%D

*.bV:

Up/%C

22`-*~|2

k!o%U

/}.cs

%C?~VT

l.-6}N

.Ag-;n:

\<$3%X

s,b.RC

.tF8W

.Mj<#&

.rQC 

MK2b%u

i3-

%CKn9

kb|.BS

(2%C[

P.hKx

v=E.CB

MT.tC

#>-F}(

I-$%U

%dKs~

|*.xx

X%uw9

3%x[6

].Us}J

%D_an

=.Nia

9%.os

{@^.XZ

xNFB.OO

%FomZ

;5.TA

c.yuY|

@%fv@5

%xZq:

.Fz]I{$}

.LVqI@

.DVWD

*TCP6

%f$bA:]

GœQF

.WJ;K

D.LC{:}

Y0.Ql

%ua(}4h

,.lo}

.wJYN

nvV%cYH

M.wKWGw

/.MbJ?y

.WUx1

K.hQa

Z.mm:

r:~.Pa

%d=I\I

'=0l.QdW

9l.DP(

 t%S\

\}.WJU

Wx%sg

N6.iB

.OzTs

WU

1oR.hF

`.edl{

8-9x}

? .vx

d[.kE@7

T%x8Y

EzHx4A%X

f&I%XI}6

c.Jqn

.hE</

P).oP

vu%U)

%s@d'

0sqlD

u4eXE '7f

{i[.jb

.XH{_

Gm.Dq

X%uj7

tD.%s

%DP}b

M,%S;

?.xJX

5\mm%S

#u.om

.gE2"

h%f -K

.bmkfNLw*

1%u&!/2Fr

{-C}Fy

wV%fRt

'J.SLv.L

g.DhgI-

.ChW /

x%Cg,< 

di.BX

%f,j9]

%X*XN

cp~%x

<.nBD~u

F3t%S

.Wv3P

.FX{/z

.MLIz

-B}o7

.aodMeCx

%FIHm{

,~.ui

 .INY

).CMc1

9NE.Ir

uH.AE

.vhVF

0E&Al3

%s)KW

@.gk`

8.SYa

.kddO

p%X0@

.fAgx

Q.JRS&

.vpKR

.Ly9*z

te,.yMA

.Xl(#

FWÞ

%X@F=

0Dm%f

Kz^.VO

)z2.Vj

D%c 0

\i.VJ

.Vqyl

e)&%uJ

.aYK]x

X.W%f<C

:6.VC

s.TnR

RE.NC|L

,%f-_9

.MD/J

=N.co

.YTcWD

5d%Sbp

BA1%D

 Ec.wS

phG%S

_7.ro

BmN.Yk

x}DQw%s

Te.XC

{&F-0}

YÈg

Tv.HC

TVqS

~.Cgbe

<;x{%S

e)UY.fl

sS.Ae2

w4.Xf 3

;`Fy%Dm

pI.MR

%c.Uiv

%%cj>

U3Q]%U

@e.EGQ

_x%Ck41a

.xeXt

2.Xa$L

.nAPj

.Pi~4

Vu.ba

Dqf.Eb

`tCpC

.IMv.v"

:.IgD

.re-0

Z}.Qp}

^M%XD

8)%D}

%cM0*X

e%F$r

Vd1.QQ

-3}jAOqJ$!N

pý9

v"8s%c& 

w,^c%c

.Sh0m

<N.iu

q2.jX 

F%x>xm

%m%C;/

.lE`1Z

Y].Ff

%sd"U%

?}SSH!

-6}]U

TJSq.YW

6J.cuv

#eXE/

KVi.WIB!

\%F(p

d_H

r.ccx

Yz.WX

%xTQp

S.yp.

E,vB8%C

WM3.liw<

r .Lx

B#Sqle

WeBRj

OUgR.DJ

"n.hN

-s?%X

ÉBx*

{.eYz

rLB$;x.AK

%u"DC_

%XjbK

h})%d

u.fV[

N.kFg

|A!%c

.OShc

.ycH'

.Fem=

F.mA7

.rcx-

H=J%S

%cid;

.aC,.~*

&P|.ip

11.po

<m%3u

)!Ú

^.Xe&

?=.tu

> -r}F

>,^.oMQ

Bz.IR0l

%D n|

.Xp%V

'M.Ku

q.tS^JZ

mC-Btg}

,9F,.SS

Gzg%X

t.QWo

.xbatm

.pET?

B.EP7P

dsSSH

a%8U*

Do%Sk

%s=~?

/úw

u9_Vd

%ŸY7

d.zpr

wB o.sp

C%swf

J.XXB

oYÚ

s3% %c

mH$d.MQ

FW.Mg

!.AE(

U.UUZ

%Xj[a{&x

R.RI!r

.veWsb

;.5$.JWK

PG%S0

-.XhA~

A%EXeqV

.IaU;

S=-5w}.

z.Vbe

.yT,bd

BF.gQ

t%CSr9]

7.dwB

[,%D/{

@;.at

}IVn.Rf

[email protected]

.Gr\(

c~%D.

V%4Xfe

.yBUe

Hßh

W.GYCE

)vw.NI

2a.tX

,F%S7:ttI

A.uD o

fMsg

s:\p5

.ONH|

%Sr&l

GLZ.no

n%9U 

HS%SW

.Kf.)*

$?.HH

'.DI(

#%sbZ

=DMSg

T.qE5

%x:_'k

a%fl;R

%Xh/?

.aBWq

sD%Sx

4wV%F\

g.cvil[

R.NVQ

.WBI%

4U%ci

&t.yz

f4Ic.ZW

P.Sou'

9Jc7<.PEz!b

p.NX>G

kQ.SId9

(.sF/ t

%u ,*?

.wa-,ns`

lzX.ff

%SMYG%

eV.KF%G

%dYr0c

.zYT4-

.FJmS0

JI.Yw

3WebM

.JC_~

Z%fG'-%

S0D.eT/

MnE%F

[W e%C

Tkv%CY

bm<0!%u

L8Jy%c

}.smk

.OuWqI

V%U-/1

"}=.ReC

%ChhD!

=Uþ*1X

,.OvY/

.EJM=

%XG6'M

;;[R.gD{

%DjAB

7.zdbR

.mdoY

%Xi[K

_Q%Sh

Xq.QHh

]}[%d

a^%xY

.aI"n:c

.VpXA

9.eU4G

S}.Jr"0

5].sz

ik>Ms.pYm

.U.gf%P

?.XGR

.rf)_

-w}5'

.Ey\k

n/%XM

.Et@*q

.VWD25

%X#Wt

6.oI1

.Zlj-

\e0%f| 

;G&%u

-WY}B

.Jgte/S

A..chhPm

"#%Uu

K9 %f

BA.%FW_B

`8%Dh

D#kLsSh

J.uL7

1%D%s2

%lW_.LeXw

D.DA{

SfL%d

.HsKq

L.iJr

z'.lj

.edSU

ev.KI

z%u*R

%.EL4

.iR4K

%7uWFn@

2t%SP

i.CcC

H4.xv

k.DQ,

#.yKa8

pB.CM

.PUYU

%cSUcGk

.dX'h

mh.Gr

e*&.ju

ÝAH

l7.ZHf

>$%DJ

%f |KiB

$.EmO

)T%Dg

i.aH`

%uX8R1

^x.Dk*L

k.Lf5U

-P}\z

S.MiU

.LS|1Ae

#<e.hIwG?/

y,%XB

Th%cN

f"7.jW

k".btt

e.mWe5

vIX[.Yi'

.Umv`

t8$.wu

';.xJ"E}

.yV#!

9.Ct\

a.dC])e

@ECe.vIC

gkL%1u

9.yVE

I-Q}?

ns`.na*I=Hj

[email protected]

J}e%X

.WoN/

.LqN\w

f;.Uhl:?;

>#[.RN

T`T%d

d&.BSk

eR{%x&

%Fy$s

.EGnZ

O`.No

>]j%U#G

A.YzB

.Aw\Hb

k[r{.pW

6E.eN

!Z%cy<C

3AN,S%.PN

oN.cm

x.cunB

"d.mD

S0%.f

.ghK3

bJ%Dr

%.Nea}d

IKEYj"

qS%d:!H

.DI9V

G4-%S

.sn/|7$

B%DOA

=^{(^.QZ

-.BQe

[(~%S

[.ta[

.Xs%H

;.tQk

\NU0.MH

UA.QK

%c;0|{

.dwOD

%uD*9

Ht%co

7%XeUa!

%XsY-

Czqq%xB

d|%uY

r.VOb]|

8c.TN

"tz.Tq.

M;-L}

,0.dW>pW

S6.Ws;

tH.Pn.Y

CxU%f

h.cyZ

s.VMAx

fm%S'

F|.YB

)v.TYv5

'`b5.YY

]A?.eg

.dbt`{

2r.vG

Kp.zZ'9

8E%Ss

|.zlEh

r4E%d:z

#%Cw9

.CEUY

b7.wY

D>.LR

Rx%Cr6~*

6%dnS?

&%St!

%7sr8

d.ae`?

M%S7J<

XG.gAg

>`[%X

.ep3j'

.Sr9t

p"v%S

>Z,%DRm{

'w.Is

E.JI4F

.tD:zl

g.bSZ

{e@%s

l.ULs

8VÎ!

au.gZ

 qr.YGs

-Xgz9}m:J

t2url

.DG3~P0

_K[Ih

t%ClnH

iX.CGF

Wh.QfrD

_fl

4.gdZ&

[email protected]

Yj*j%u

#s.qUK

C%9u=I 

[email protected]

.zgqUP

.Rhht

.ULW-

lcRT

.zH'bX

AX%U"

mvûk

Ei.KX

.CZZF

WE\N%do

p.hG~

%f}7RN

c?û

S%C^XM*^

0n%D:

{i.bx1

x]ipJ.PJ

y;.PW0(

P;CD.nEr2

p.eZR

%uIIHqH

!?.vE

.hm3B

.sGhW

.tCKS

`\%uW

.WhuhByI

aGl%D

ObA%s

TH.oa

aK=%f`"

:N.dMY

.BZ`w

N:%xY

W,.bz

^4.Ga&

f.YM4

.sR-b

.KFuC

K%dup

tLObc.Yk

.eQ6h

b5%c'

yK.UZ's

8>.Mg

;?.os

w.eH '3

.IEu}

3u.jZ

P.uY8

Z".TE

E%SELw

2v%C;

.ToOQo

8\%Cv

M0.nq

G.oP{x"

U.LyF

.gwUQ2

GH-3}

0I%c>

=*'.cx

l7_%s

kI.lg

j.sB}

.eYMP

ø_w

n.qj1

zI%us

[.JDl

<%C~@

yw%X#D

%SF)P3

%xYa6

isG%u

7.ktF

:.sD7,

J.ke_Q'

v.jDf

j.An8

c.eC}

%Dy:G~Na

=.AKNk

i%X#4Y

G}.RVOX

.QqW]

.pYJyz7

!.jOQ

%f[3<|

d.obY

9`%sq&

q;.Yl

.ljMs$/

3U%sz

PV).lX\u

4C.mM

g-i}Hh

-s.Yn

%U?Qo

zo].vR

.kQ5ie

[SSH?

dL.ef

ugò

?2.ySK

{fE.JD

2l.FN

}%5x!

%D&u;

cJ%s>

1o0%x'\

"~.uP

%du?{m4mibi

(R.UMpB

.wR9:

V.Ve3

JZ%c}

.eN-Bl2

scO%d

ÌBU

.jJ<X

 .LRe

`/%UxF

I.oM2

S.bNI"

*h8%C

J_N!%f

..lY:

.vV2!

.doSX

7N%C}

.ib/k

jZk.qbQim

g.AN/

Gv.OVT

v~.KS;O$V

1P4F%c

8.De9

M.Cq=

{}1%F

.tHo!

%uY)}

ok:%X.

Vd.juw5

:_.AT

.Ps$O

Y.fSxot

"i078%ug

0.hgQ5k

!PY9%S}S

[(I.DW

I`.yXx[

V9.XL

e.BFT'n

iwX~.IO|

w`H.uhw

~.Xu$

.aV3?

.Bd{S

]!.YD

b-.Xt

sQlh

fEXE

X%UBm

l"y.xN"

X
D

uR.qF

n.akg7

r%c?R/

6cSÍ

%.WIf

xp.qs

OL.Rd

*Ìa

-s}a;

k;.sv

L n%f

%D$Und

J.yTn

..HZ/

C2.pDUa

oe%D?

[zY"%F

&L.ot2d,

l;.zg

F0#%S

Sv=%x

Ï*%2"

"&o.bSI

SP.PJ

..EgZ

Nml.eY

PZ%D[

X8ov.bjp

4oHô8

SqlXL}8

.uL'2

*r.Up

iFu.Ly

].HUs

%D~T{

Ta.Ei

Ar.Sff

.wY9o

[x``%u

C%xl\^gW

nO{.vVHRVw

.yc~m

T3%UN

bw.cl

|).RJ

uf].sO

uG.zel

s*.Kl%

%X u>

!%XEn

H&%SRh

J18.ec

eùc

F%U,S

\l2

uM^Yi%ft

9.zM`

}UH%X

hC.WU

[Hz1s.Ni

.wyui

Qa!.mi"

?%.VHHP

Z.EJ8o

5p/.kF

.hOI]

 (Pn!.od

.qg&E

"DS%C

.HH;O

^x l6`^%s

G.Iw_

q%S<R

T:\x4

X2.wr

\%d^m

P.oc76/L

>K3-l}>

X.eH(

zd.aP

SJ.RC

Q:)xS.kI

.WH&k

w%sT42z

StÏR

-!.hE

x%sB>

.BnhD>

m%SL~d

.YvN%T

U~.lg

R.Mdp2

ÔYe

d.XQ$`&

.gW?p

zQ.QP

&vBN%U

ò Z

H*%F{

)=&Nf%F

D..bl

B.aYk

0H.Qe

n%Fj4

O.Mni

&-h}h

.GiUNx

h.jy:

.fQO;

=~.Cb

.Zlv$f

Es.RT

-I.jZb

'.Vh~

.wW7^s

' Z%D{

W8.rG

%fn5Xc

i.Ynld

.erJXW

XN.Ec

|.TZs

.Woz9$

o(

|.TFtJB

K4^%f=

O.nqz

<%FU-

vU.Bx

bk.wO

`.TV;}j1

.dtoBVV

T7.vKN

GW.xO

x%Fz,

`X %u

jY.bX

yv.FO

=7TD%f

ZZ%c[mJ

Ga<.Lc

x`A%S$a

$qS%s_F

^=q%D

.lqm^Br

=b.RI

9.vA&

b*o)%U}

.EG]R

zF%F>k

1\1%d

kv/

L%d\g\

[.LR"|

ýPh

o%-2}U@V

.jY~hQ

}.Shd

ml.IW

aS.Lz

UE.rk

Bexe

I'-l}"

@.Hn&

,.TU}

jE=.IzA

R~%X%

YzT%S&

%8%dr

.YMH^"

?&29%,=^

9m.VZl

y^%S1

|=.wh-

%xrtJs``

.RSuyrX

c'.Sl

.Tj9}

>.yUP

t}%CI1

3%fVm>:l5~

,.eGf

.Ss]b

q.hTl

k.dP_

|S%Um

{/[(/0[12

%u&* 

8%Uo!

.vG2^vXw

-Bv3}?

Ju

# .Vm

"G%%xy

`,.pB 

h1.mWU8X

h.kt}*`

Y7fld%x

%8Xnw

.lt&7

-4.dp}2

=W.qQR

.VN41I[7

.o%UO\ru8

.njG\

Z.DpE

\.vb)

d#.Ss

?{P.NA`a

_%dQ]

pjey%X3#%&

f5(.Vj

qKoj%2s

4^-Y}B

|`%Sx

R:\Nf

.iXn8

 .nNH

%uay=:\

/#-N}_%

!qcrT

Fv%xY {

.qyjq

-.AWz

J}%5X?

0.uc1

2>.YP;l

r.lkZ

.Cp3x4

pZ.qTF

.Ywp-

_W.ENoU

.BlV*

C:I\.SI

9N%x|

v%3S/\

48.eJ

v/.bUzT

-UHaA}

C.GC%M

%u~U[

%dP')E

.nS4c

.xC",

y1 %x=

.dK2$!

keyE*7

.nl_\

%S(w`

.ZH""/#

kL.(.uR9

!t/

;v%SEb(

E%xi9

-?k.gv

0.uvR

(DTi)m_.ia|

.84\ 4$^

%URCB

U!FF.dK

p.xW!

'W.uE

gk%9S=

1.Ll_

o4.IV

k.Wvh

\8.gN

Q%U|\}%-J

g%uW>

e.iws

Jk.XS

&%X`!

(%s@9

.fXZ:

I%xXj

w9T.Sl

wQ,.yz

%cO=0

#?.Sj*

p;.zHMV

qsM?%x~

^"7R%C

{%x.2Gk

0~.uio

}%D=T

.EPci

i%s=uq

pMl%d

0bQH__4%S

\.XDR

%c!IV@

d.ugk:

!1%8!%s

(%xi`

-zl4x5}

Rn}=j.lq

FH.iH

.zx$.

.TKpz

).OUw?

`Jng.oO4%

6 <.Jd*\

U.FA;Z

1%c@ t

s.sV u

I%Dls

lLa.Cw

%C=QH

.xZc#<

U~xW1!.CqH

.VLk%{

.Iv\p=mrrx

#b.zlKZ

)E.jqc

n%U_w

`RKÜ

WwJ.CCA

z$^3~%3u

A$(%s

@%cN5

ED.Xx

9".TI

.pKS|O

(a.ojX

kPB%Un

d[e.av<

W%CGFGQ[

%9X;$

o4.Ij

B=j%u

fE .ot

SsqLH

ÈiZ%

U%U|R

.kqp 

95.lb

-?e%U

).BCh)8

B8.hF

D.WmT1G

.kpZ^U

/rX-X}

Y%UU{

D.ZjJ,

-%SZl\J

_}l

%fqs0;

cS.WS

92".DN

J8.Lo

>wtGx%u*X

%xXI@

%XN=P

-5Q.Xh-

.vcQFR

Dm.wu

.sS*~

o('.ZK{G

<ja%D

]JA.Bf

re4%F@

.Rd_~d

%xW=j2t

@.fh[!

j<ohc%X

ohrB

3o.RL

.Cv^Ww

.Fa $

7%$=n%U

':"W%u

B.Dt#

6T.Ep

.oWL?d

ZF.lF

ac}.yR

.gHPx

qU.fI

c9%UM

@.tzW

*r<%Xl

J.XSx

.wk4Y

^I\.MT

W60R.zP)

.Tw1;

;%u5y{

.VNrZ

s%c=#y

W8(J.LS

':-B%CL

o.SbWT

P.qJ|

F|.EoY

W%S*[

ja.Ze

C;H.Ix.6sC

%u)[f

07Ð

.haX?

z(.Aw

C%u-u6

`P%S'

Udpy

V)!.wIf

.kS,'

{.W"i<%c

sz.qj$

.ns&`J(

.wk I

.xW.a1k#=

E.SK@

cMdv

.Els&

-.ZG|<z

.xc&}

K%F)e

.eI;z

CO.WN

3Crtdn

%Fw{>

\\Û*Bl

 o%Fq

CqXB%xRc

AF`%u

/AW.RW

%xqw"

.RS`V

z3.fJ

oU.rs/AWfug

.YX>c

4UZ8%u

er.yr

?.VMi

`By%u`6FW

^%U2<

j.yM:

m.HwR

Dd(.Yzd

Ay.XH

5%s^p

'u9LOzV%U

%u<a">

7bssH}\/

v50

]h.vF

^.MGQ

.hnuM

B].zC

J/sqLR

%c@;y

EK/%c

%SrNf

Jpo%XB

f&%DW

g.lwR2<

pN(e.qB

Nna.YhO

%X(I[c

}X.VJ

K7.CF

tm.Dx.

O*2

%f^ffh~

n|.Gm

y.fRJ

(N.vv

%D/?:

.taN>f

ip.us

B:\i3F

iH.xP

!;H%xL

.jTl51

`~cmD

T#%x`

Y.WJ~V

o9k.yA

.SJ)zG

WY.eX

.XY{`3R

E.hEP

.Uvr&s

S.qx#

[XOc

CrTM,

{_.ji j5R

%U#~,vv|jRj

.vh\%R

V.WD[

'}@~D%c

g%fNm

&m%x|

lx&=

;k.Nys

.RY{ 

`/t%D

8H-l}

.jW.w

/B.tU

a.s%s

{.Ny?

Xj.ux

F5.li1

G>\%d

 jl^%cg

%F nN

qB<.fl

;.id6dF}

[.dQ0

%d`RW

V`%fy

vd.GH

8%U"b

eS.VD

b/6W%uf

jZ.rj

OQZ.jF

%xx_Dd

.AX'y

C6!Gf.QIx

.qxyJ]

'%6s'fz1

s.hR9

%S\-J

eU%u(V

Q".Zw

.qGI3

&;%FN

!Durl

G*

,3.FR

%Dn/p

q%X*V

.hL2O

xhYC%C;

\Z.nS

%1UIh

.kso>

>).tl

rÊ|d(

.Zv;qR8

%XwK@8

xOMkDLW.uT

q.Zt@

NÖk

;l7%D

x.CV;

lJ%S,

.Qs/A

&3U%c

SptCp/

W*>.NS

C.sB|

E%c=@

P%h.WJ

q.Aya3

M.GQ^

2%1XgKS

3y.qj

S.sL,/

\Ai*A.XK

*.bF5W

.LO]f>D

.fc}S

^" %sOI

k;.eq

$.fK8

LS.dc

k.JuE*

<.uU|

.nNz|

/d.Ks

.nbbG

-i&%u

7.Bik

Qh.sX

.KWeP

`1m/%SNk

r.im|

%cQO#

.vy-E&

~-RIy.oa

URLP

3URl,

_Vh%X

Q.DM:

]f.MHh

j%d&~g

g.y%f

[1.NuM

%8XC7_u!

<g<%D

[email protected]

Rp.dQ

cl.iMw

yx=%SQS

 .Zx`

.IBV9

86%cr

mi$g7.OX

@.DyR

|R?rs}m.bWr6

ÇUW

(.vexL

k}.PJY

Y=%uW

oÏ@H

.vjq\

m&h.uUn

^.acP

%U0M"

!.Mab

.lRp]

.SCwX-

hv|@7.ms

m$\.rR

f%soh

`]b.NQ

%U^zs"

fg.PNB

7H.kN>fn

.qpWq

2.Ca:

".XP~B

7.Ps5d!F

.nRV5L

!JV.HuWqG

FW%x%x)|3

~0m.MJ

.UO%#

.qK;'

F*.Qo

[Td:%C?

UDPF

nûIk

u.orW45

SsH=y

.XUK\

z.ofGUL

f%U[Ya

2.fwH

Z~%s-

|*U%f

L\l%X

<\.aO(

9hN6%x_a

O`<@y%F

'%sTS

[email protected]

zk.Zy

c.SHv

zo1%X]

u.pm*

m%F,,

l*.rmw

eG.Xb

%f..<

.UV_$

.eqLyKT0

ottù

..Fs|

.Qjn`\

(pi.zz

6h.ee

].Tfo

%fY$|{

M.QAt

.uMYf

36-cmD

}.MbXFl

PiVk.vj%

>O-<e%f

Fg.SZ

]rd%C

ju.nl

-LT}\

H?8%x

c3*.lGi9zw

o%s<8

\{R.wV

:.IyP)

.gOuOr

S3.Yna

NYT-x}M/

R]%s)

.VB)|

ÿ8l_

[email protected]

@";?%u'

iq.xy

V%mk@{%Xk

x-qF}

L?z\.peV

TQ8.UbNa

_vudP

.Qi)H

qg7!.MBk9

Z/.fs3

-.Fip

.Va3A\

Rj.xw

.wDE;Z

%f~@\w

-d9u}5T

V).IF

s.qL1hS

y%DRj)p

.hT>J

.ec`~

.Uh.0

7;.rk

;%s3u

RWUDp

8.YxQ4lq0

!-m1},

n.hD>

:.WpP

.lqlW

g%c I;LQ

.zQV>

o[K\.Edc

].cs>[ 

.Zj|\S

/#.UQ0

&C.rH

iW7.WKo

Q!.aZYTr/

PV,F%%D

4/"VË

-c}:c>

60F.GO

{j;qKY%D@]

.ERHq

\/s%dN3

.vpSa

HDf<%s

aSw.gh

c1-8}

]7$2%Su

*C#.py

cG.VL

*-#{~=!@

]GytS%S

%scuh

zCcrt

:&.HE

u.wWJk

O/K.II

.OmK%u

%s0Q|

%U}CU

Q%f-qiW

/%C>M

eIc.Ik^

ÿWZ9

P[%XJ

%S9LHL

&W.DY

8j%F*

:b.Fd

'N.Gm

%sK)/

S%UV`

bk.IE

n|i%f\

Yf%S,

.nL[M

%UGQ/

|fxf%x}f

<`T%x

%c|iZ

Nm~R'.el

.RJ`?%

Z.GK/

.MwQ!(

^<;v.NV

(P%s@

XY.NLAI

.zT"Mm

Url! 

.cpZR>De

.pVRq

B.eA}J

.Tz!,,

h8Oa.xn

e.YgX

.va|K

*U]s'.Am.

)%.Sb

.xg~9

%UWp#

 .SY=[)

.Qg1a%

RoI%D

bV-x8}

.JHV^

%cQDWddK

fw%Xxp

G%xO 

#?.ev

1g%fi

.rC:=

B1'%U

yw%.F*

gQ%SP

Y.rCp

Y$%SQ;1e

%Uyj0

I,a.ZB

?.Te,

.mL<w

keyK

]%uI$A

Ps%CU

UL$)%x

;.RtsP

d?.SI

T%S'we*G

[.gM'H

A.Nc%9

lb9%CZ

6.Wq[;q

.WFca

@%XAM

q^.Vl{

tCpZ]=

.GusJ

.fhfX

e@W%c

.gnL%

.DQ#f

.cXE V9

~.Oa7

>[email protected]%

Zj.QL

.ZI^?h

l.yLde(

QTg_%s

,.SKMX

.gc^)

.xXE m

.Am6xFV

MHv.hl

zL 

!i5.SY

8Q %d

UG.nui

iZ.vH

.YHY0

s|x.gy

-SSc}

.YufR

.HBE-"

.uX&5

<.iI%

Nk.FFh

9.Awq

Ze=%C

V.aA 

Oy?%U

aYY.dU

Cq

Wg.KPa

O4.OM

.OXv5

V>.Qv

w.bkQK

c.PjO)

fa7%Ux

.SUfO4C

.kdbv

&;k%U

5"%Fi)Q

3Lh.gf

:.kqzka

AûPlx

4q.Yd

.sHog

n2%c_

L.ci7>~

#}Z.BH

bJ%S>

%C[( 

j.nO\/

.nqNNn

Z.XOTA

%xxkZ

).pM]

f!.Ya

.wCMY;P

C.hdd

%4U8`

x^:.bv5

E#cMd#

.vcX(k

nA-yr}

`.LI0k

!l.Ev

DFC%x

~[%4U

.mSF"

a:\}*3

.nbir0

(r%XE

Wl.qE

JqzE.dX&

%X&kP

[FplS.jC;

tCPA

R6 X%x

b.MY~

X8.BHZ

.Zch5?

.gr3g

kX.qX

t2/%u

.VIY#8

.ag=i

x..lM

.Vv``KM

*V.Qof:U

)%F#1

P3%c)

..eQ!

A8_7^.YI

*.swh

Ga.Ji

;.eZoN

Ýy`

hI^.Zi]C/

3J].RF.

uW%F'

AF%6sZTx

"BkoQ%fO

'.sP:_

Ëy/

cD)"%s

X.edl

G4%x^

%X3F/

.NoPL

BB`%x

udpJwf

%cJ}RJ

*.TNn

3p%XS*

i.RN/Fh'

?2.qN

lx.VT

h%XF&

^{U.mO

.Zs@fv

KpasS9g

d-M}:

.zz$i

'%UO]

^P.og@

.QDof

 jv4.CQ

*D#-%x

J*crt

Hm/4%F%

.qyZN

.RhP#

A^k%C~

(LD%X

{-R.kX

%cs>vlY

*%cOK

1C%D,

J.pXA

d~.fq

.DOJ 

%s,pz

Q:\NA

u[B%d

$)%6x

qR.Cd*

d,5%c

N^'-9g}0

Y.uT9

I'.Cg

{>.Sl

'OV^.TU

%7u_<

%F=W_5u

J%dXw

QURl

B6.KG

X.LS[

{>A.fHj

-h4b.cbp

M<\S.Efw

&.pCH

.OYTU

D.hS@

fi%UUo>

)&.%CZ

%DRLx

/.PojsF

u,<9.Bdy

k/6.cT

.mXDt&4

u'e%S

P)%SMi

}%cTC

 .Krq

KG.OH:'|/~

.wN2ML

#x.Ou

4zj1.FC_

.zlXwhE

.de!U

aW3%d

.JOB8

QD.mY

h[.ao

?WT2%.cY

.goQ 

s9L.tr4{U

Z!x.Hq

LGk4%X

/K.mH

%.PAYp{

=%S_2

N]ôP

_%sAj

`.xC3

q9_FE%d

}Q.aS

.nadyx

lS&.nQ

]R;.VI

c.CR#

.Aq[(Ss'=

_U%s9

.EW4X

5.bc4

`#.uV

iN.BdA

h.LQ<

g%.C6

PrÞ

>.RM{

`1%Xh?

.TImS{T8

fF.Qr3

E{>LQ.Gt

Cmdn

&(?6'#-:

7.FVS

.wUa6

.sF{Ni

[b%um

.cW6?

p..RA

>%oT4:%CI

.Ju9d

E[S%x

f%xOlc3

MsGK

.ky.F

%c(6v

R<.YE

.lMk?

gI<%x

/-A.nXda

8,%U$4l.oU

lt.xZ>

$ØT`

%cJWj

]'[7%s

).ue"]

rd.HH

p,.hN

.vQ7/

.FX[wr

n.mO,

o.AN;

^.Bl}

F,.mK

.LKz~

Z.JTA^/

Y$O%d

Sf.Cu

IN%UNDg

CO.ofC

O%Dht

oFA%u7

?k!IH%s:

<3\^$:4#

/.oh{m

O.eKpD

2yG.qj6|

%d#<EKU

M.yWu

B.Nb~

'Œ#OG

,S%cv

.ar/0

%fWgwB

%fz|j

_cF%x

ux.gBG

x.aK&3

*X.dT

R.Ax~Bkl

6tm%c

#e.jkg

%s'Bb

%ci$.

Q.KfM

J.bVO`

|<.nl

.Ldi&

%CS:p*

.vVrv

.CH<b

~h%SWO

z.yrc

{Y.xG

.Hev ~

.TAF{

ru.Rb1

6.dwI

T-V%x

.S^%C

.gFXX

8Bq%S

V5y}%S

U .tn

vQ-%S

{\%U< H

 hU%Fk

_%d{} 

.DIqy

.Gyho

.SWuFD

.EoL}

.WN2T1

S1w.Jzb

"gP\%s

?3.aZ#xy

@.Aqr

.LYEf_

1h.hT

CP.ap

-BE}n

.kC~,3i

.iEjRf

)-d} 

@6.JH

\=.bd

4.hJ=

E{.dDFa

mQ.hLEv

&RG%X &X

}_.Yq>E

E:\=I@

>%Xcr

){(W8%S

.chGO

S^%u-

7N.xD

WJh%d({

X%c$k

%dq;^

.eT!r

2B.Nj

am.hH

_%U;l

T.Yqk

yFTp=

/%SAp

.gV{2

.ED_t

J5%c]

4.dtlW

.Un}0

q.BoM

?.bE)

.poxx

.RR|{

i%D^U

9%X|!gU-A

5yzL.yaj

3%uFi

.AQ!r

}.NBo6

d*%dK

(b.WH

`p=xo?QO%f

3& T.je

!X.AL

{.sh9

-.KV[ e

%C)Gk%

.rie7\

x.ew"

}Gw@Ô7

6"V.gs}

X[/0.bo~u

.zBH&

7.CTt

~=J%f

.kG@o

.LM}S

j.vk_HqJA

hu.AI

D%fv-

PuRL%

nz.P%xz;

.Rp1H

/fTPhST$

E7u\Ky.abL

:Q%2x0

C.gMG

%.Aaz

%1sTjpO

_&.ml

m>W.KI

a%Sh`

Nu%s{

.GvS"

A%sM-

?.zl5

.XTpi

ke.mL

^%CsR

 budpY

09v.FFr

X}_T.IY

oFTp

.Om_j

x%s#v

pJ9g.sv

T%

tr%do

_,.dD

6(/~;_.?

QM-.pF

!a.Xu

)=.OY

.JdK?

W=.rJkhP

6 %UI

-bD}l

T.pN]

'.yr*0F

"K=>).lf

J.mCD:

[email protected]

>v.Vp

6.cLs7

%XsMI&

).FK:

<w[.iA

.pV@/

V0D"%U5:P

We%F,

udPn2

y.%sN

.iY J?

?V5.Ow

.Yi0yGsC

.IuQ($

S.fO|

H%S2}

r%fx?

E_.HY

ÍLN

&.Kvp]@

noþj

'B%f)

 .uGP

K%xh^;

[-.tM

J{3#.zK

g!.sTl

T_..spo

Ge%ft

k.rw=0s

:q-TB}U

%U\'!t

.eu-`vZIH

ÚBpy*

}1.-mF}

^.Jih

.ui)g

=.hM=

AA.gY

98>qR.xD

zA.pM}

.Jbyh/

%u#py

.IWyz

%UJQs

-%dWK

.Uz*VgKR

v.aJ2!

!=%X'%X

ZG.Gz9

.YE`E

R5'%s

.SL$/

FE'Y.wWh

B#-YKrS%s

u1DG.KS

%Dx$}

}N.kFWh

.Ag5K

g:\5NOu

Ut4cG

X%F> 

b6.ni&

|]%fjh

4rG%d

%FKjh

.Guv;

2&.El$

%d~:m

.fEdt

4{_\M.cQ

tW.Ix

.uZPk

.f9%S

).(.tX

NgK.Yy

.Pr<>-

l{.HB

nj(.Lv]

g.%Dm<#L^

jOw.ibI

g_L%U

-I}m3<

3].Cm

.DUWw

xW.tYA

'M%Do

q%f;-

6T{[S.iO

.tZ&-

-].VHV

%uQ Q

JA%x@

E.tj"

%C <{

%dP&`/$

V%DQe

M%P%d

.pk4=-

h@Pþ

^:P%D

8,%U=

vr.%S|

%XA<xb\k

).qLG

tV;'.Dv

m``

pmj%c

%UXHP

ftpYi?R

V-%xx

FE.Zc

G9j%f

>^@.SDf

.hz[Hd

Lo.Bi)

%>%S|

R„C

KN %u

|cP.hA$.,

N9.NS<F)y

P%CX}

=g.QD

"M%Fx

j*0.xv

[a^:.FK

tudPj

w12$%Ux,

%T=%sjA

0~.rn

J.fXkp

I4.ZxO

mS2.DG

I.bHe

H%C c

%.PTM

]\.qQ/

:-%D?

gU&%d

d"{.YB}

,1I.oq

A%FWp

.Tc;_

.APYi

^".hm

h8U%cH

.DH%"x

t~I.oI

.HG!(

fkV;%dH

.Rh4Ko

D.xtZ

.lxu_

P2%DX1

sexEr

Âf#

K8.nZH

7f.Kcu

VcMd

.IIti

C.UZ&G

'.wV8

N%f&,]

52.QZ4

4Hd,.tS

Il,.glS

L".iC]

Yts.QS

%xa/3Q

2.hE`u

9zP.Vi=

C1 \O.Rf

%SsMx

-7.xr

iSL%U/

x0.zA9

.GHMq

o.JRr^(

%f} o\q

m.eF[

'.XbM

G(.oZ~U

a2[.Bi

YAnn%u

%SZ%0

z).Nm

s6W.Cv

I.ocO

%Xw$F/PV

.hsUxM

7$G).VYj

[\.DkUz?C

B.ng@

y.AsR

1.gfF

.Ye_:

.ocF*

ha%Cx

%s_^}

&.nk=.

%D,!cos

;[email protected]

;j.AS#

C.Gbv8*w2

[VZ%J%D>

E6,)%d

-jtX3}

xe%s[

.OLR-*

;Rm%u

'&x.dh1.

b@w%f

P=8%d

.AwbI

$9T.<%F

`}T.Mk

z.xx WE

%.Hpu

7.nW@

Fy%D H

bf%XM

%Yyj.CKa1

iQ%%c

&# .GC

v*%Cx

)=~~Q"

M:%U4\

;8%cW

R.twXXH

.hCJGa

.Xx ]c

.%U oP

@:%.X

6/.Qu

Nk%X!

.QCgK

y\%d.x

t5.DL

%fke"Ia

mSGgW

"%SiX

an@%d

Web$s

D`.Ds

o%D&<P<

Ro.fur

oIo.PT

F!%ud@

%s gS

.jBN3

ÿf5

0.Cmr#2

f.DlD

.IoZ5

E.dqcv,

t1.Rq

n.Bj9Y4

)-(-z}g

%2xxX

Ckey

{5exe

\7Qj%ci=

%4xVT

%fTVx

.qOn*

m}@ar;%XCf

C7R#0

B.cT*S

.Yk.@

cV@%c

}\.FXi

@Z.ri

.TL:l@

/[?%X

M%5X_

K%FO@

`5.Aj

:%f`jb

<2$%s

.FJi@f

mSG<2

%S,<W

%FnuKp

$.LLK

FTpL

F2Xh%x

AV!.cdn

(.elY

p?.Xm

3xY*%F

|.YzL

%d.oX

6t.adD

[Webg

x.Zs[

%sj#d

m .QZ4Pu

.gp|W

*/.MR "IZ

-WI}k

1ty%S

9tCpp

%Chd<

oq.Tb

6%x%j

.xH&!

w.Ww}

6m.vr8

UwHs.dF

v)%cS8

>41A.duo

a.DdT

.oBC=

SSH:.

2'.zTUT5

c.eX,IH

.BXI>h

.0pgrX%s

*.mee

na.UP

vO.nt|

T.JZa%

.5

0.xDQ

N$`%s

Oa4%Cr

S).MP @

Q.).Tk

>-v}o0

@7c.uC

F.JfQ|

q.Hq;

.dY#)

kN%d)

alxÜ

M.xSPD

V.xE(

O.ojW(

 %UX-%

1X.md

.sJP'

VW#%S

.oz=n[2t8

Nn.wp

Kh.Pxj

7.eYs)

.txuZ1

QC.Nq

.YR0H

:H\.og

.ZsgtI64{A

.ud3i

@U;p5C{.Uj

[ :%D

N%C!1

%f{g4

JZ%u_

.MeBM

~.tH@>

N#k".sy

k.pI2

z%xq*

|S.jba

I/.rt%

l7:.Fm

%SVws>@

%X_ \

D%C%7

.kjc=3

{kp%cH

?R.Xf

/~.tFodu

y%s?V

UYW.re

Z.UpX

;C!.rI

i.ARQ

6.pSf

-.kQF~V

sl"%U$

To%d"M

^Z.Bun

w#%4X

.Ti[_

p{`..Pq

S.gmU*SN(

.AOC7

jH.zS

.Mn))

)Il%X

('.xNRu9

I.cV%

*.ZGP

_fk%c

ZM.VZ

}A.WI3

C^0%x

~=%U$|

%S:^)

X%x/K

×[=kB

ugh.tUA]

-.vs ?

x\%x]

%u0}7tl

?#.Up

%fT;T

Vo~.uJ

/M%s-

.cN#D

.OJ][F

NYzm-Z%C

|Lm%S

ZeÅ_W

Bpxw

.oJG.

Y4.kn

2%SWa

.Nls!CX

( .Vo6

.XNGcnH

A3^.pt:

.Gr n/j

-gs6}I

RZ-%Seh

urLxH&

v1.slD^

%SrR-]

_M.Ec

.nw2B

h[.fs

WeBR

B%xv)

}wP.JB

P .lEfl

Sx9%s|

%xO-K R

L.sl3sI

M.VN=m%k

sY.QC

od

.CJu4,4

O9.xc

.UI7\

uI8%Dmo

I.etD

)=.qv

A.QRqi

R.Zc8

;.rCe

.mzrkt

ac%s2

E.XuT1

h%fH7t

.NY >

/k.XM'"!

C.AR&

y.phH

.gF&pX$

[email protected]%

;U%s\P

C .xw

YRK%Xi

%.DmR\

%xumD

>/}%X

.vGKf

.zNeD'?T

W.uq&Hf;

X#.Ok

(%2sD2

AQ_}.BW

gZd.Mg

.yZfG

8yX%s

qL%.WtsH

&!3 5(!6

@.no"y

.cAhf

1OO.il

E\SS^1%u

ü M

/].UA

$.cEF

xjT2%f

=%F~S

m.Fqu

N%Cv{U!

&5.Ao;/

pN\l%C!

rlH&1k%fk

>v.Qz

S9%cH

O:\.85Nj}*

x%D##

%X}5SC/

%C*TM

.yl<l

8m%fT

{Q#ÖH

.CLj-

j%X&n

9*_S%u

v%XPw

c:c.KCO;n

kv#h.CV

.HAyg

_RP

)qÂ=

.CpP_}

FD%SR

%Dt\8

x(.Zs

.ge00

>ww%U

'C|.Ns

AxmsG(

KA.NJ>3

W.TagS0

.Cw>5;A

[email protected]

%XX$B

{.tD*[:

U"%F*v

"!.NBb

I%0sB

V8]6.FK

.Ad8dnr60Nt

1b4%x

 2%UU

.jF)q)

_..Iw

*Þ[

t8G.nO

h%FUv

S&.AO

'.Vs="

V.wt'

K.KUZ

%XzO`

.THba

="S %u

) m.Yc

.Pg]RI

.LBvVd

K %%f

.pFajE

8.kd0

/%F]~F

2.vr:[

~ÌZ

bN.ER

%CNTc

;A.ZpG

Wf^T.er

.gTAX/1

q.NC@gEf

W.rZA

}.aq#

HsXY%f

.jZmT

%XaJHG

T%U0FK

qM%ct

B%xp .

Xn.Zx

vMC..Il

(.UWh

p%fV(

u.Jr4

H09%S

Yx%x%

!.Bn50

Vn%x6

C']%X

l:%XH1fS2]f

~b8%s

m.%U]

@3%D:

Z.hen

.kI[c

*%3uB

3x%F!

j.IQA

udpk

j.UQm

v%C/^[

_d.En

..BR0

%U! ;z

e1.YS

4L.Ka

iem%U$:

AM.Ta[0

%XY,(

.VflM

[.wz\H

6:*%D

 /"2,0 #

9%xi3

kXpFtpo;

\!%u:

|aI%F

o.kAS

?aN.qAyCf

'U%s-

N.HS; 

{*e.jq

I1%fnO

.qNt<

J.FfO

.cvGD

[%Di{T#

. .DKB

=%so<

Rt5C.lp

0tCP49

%DJRf

p>R%C[

.uTos

.Jk%\

i>X.iBK

r;/g%F

%XzBN

RSr(%fW

?Ú.g 

%x`y:

5%DU-r

.omyS,

m.qnn

7)%XN6

[.yLu

rCd%Dz>

.DIsP

V4!.lxDAC(

B.EDAO

Kk.Tk

.IJk Y/2

4pC.sMV

.tcuj

.Re'(

góUAk

y%C{y

X5%S"

J.EAy

W.tj/

.lxW1

?.bE$

;.bsb

] &%D

.Xc!^

#.RV<g

x%d>(N

UWEb

K'(r%s

q%0S}

vhHSsh

.Gw3:

z_,%S

pd}E.oIa

.LV#/

%s-J3

87.ZF

m%SWq

j$%Uu~

úq[

v.vM)

@j.ys]

v~$6%c]

%u<g{

c.AX)

Wl.qe

.UpU@

.FOfX

4Ý<

LMt25R(.Re

G<.KISz

%.yC?

]ej%u(K

.jJh>/

L%uy;d

(:Jw%S

).eqhv

y}@%X

h:S.azA.

.HjP${

.ka5B

.fPU$

fH.Pz

df.ay=q

.V%uS>

9.lNwj.

v.dc^

URLp

^t.pdG

XR.NCeh

asqL

Xp.hg

3.uEP

%h`\%X

.NQUm

9H.oja

*.sQix

X}G%xz

M.xT0i

)=o.Lz

.gM-4

I.zL"

.AqR}

E@}%c

.dU6g

A%.d&Nz 

1.hp/

,j2}%X

|Ci.TC

.bcL*

j`.wX!

<WG.Cz

w.Mpd]

qQ.cJs

%Fjfx

1..SG]

.Ye%\9c\

g6p^N.BC

UcRT

w.zCs

@.Izs

HFbBR.PV|

$.AX!

v%.xe

)ó/

EB%C/

w6*%%.OY

,%U4"Z

%u9=J

<.Wj{

.uEb9IkA9

.ye!|

Fko.wc

Q%s\$

.BJPV^

RÏe

%F"$W

}IN%S

%FgA%v

B`.bYy

i.LbWl

``.mq

PZ%S 

JM.rl[

;.zzt

t'.dW

.eH{/

%S'(8

oq&-.Ev

fW,F.sup8

%1s1y

\Y.XP

W.rSC

'6.uJa

3I.xQ

p.OMX

.Hpds

UF.Dg(i

jj%%x

XU.Xz

.aaZZ4

-sy}C}

8%1sT/

n.Rt&

}.BF,

>%s7h

M*j.Lc

O2.sd3A

=l.Nx

.nG)*

A.UW?/

.oLC-gC%

J D%S*

^ùm5

gkeY3

.dQRD

e.=.IY

^-o

.NTO`heR

.Dl>"

.zYdV

CzRh.qt>h

>) .XX

zcR.AF

-L}Br

ßa(

.Pi5h<

A>ÿ

%x<1<

\B %uZM

xB.rP

$o.SX|

 X.At

k0N%x

i.jF3

3#W.Nd

%SkE1\cS

8P.PU

Fr.Et 

*^"..Bb]

NùF

.FH$q

-Ev%x

c0<.lw

*D.sS_

m.yWq

.zbgS

`|%u[<6

a.Tyd7

|.MG5

f.OR$

.kW.}

oo%u5

)V.PXU

.XNQI

 c[`.lW

9M.Sg

cP_%CRMm

.Knx`

L%uaR

YN$w%S

2^%X$*

~M%d[

7*%x(

%u<MZ 

f%X-l`

c.SQZ

nF.ww

?-S}o

ur.PG

Z.JabbQ

>/u%xo

.RUD' 

-j}%5

o%sJ[

v.VP#

_| :.gOI~4

6.Swi8j&c"

.pl|M(<

`.qxi

%F_9K

.MfcC

.UDbH

>%f{$$

.ra5a

<L.ZA

MsgW

-.To&

?ac-6};m

g.DbXo

%x(!6d

p"#Cf

06-P}

1#%c'

%doRf

-P}0_]

.Bd8~

.QG|vnx

H.VPf

=mp%dP

R%cMV

.Vsj)z

$%SKp

Z%XNbb

.CBCDR

AEd.xt8N||

.FbDH

kf!%S

RLÙ

.OJ4[]

/^.Vy

Tgf%s

GQ.Zt

Q.nAM

)F(-)T2%%x

Sb.RF

.mrlfm

|-qx-t}

MsGJ

tk.gN

".bYz:

%dG_C8

%CtS"c

.OPD5

^L%d;

O.KTfgDI

r(.QE

%U'C\

.hpN1

~&.Cq

|.xe.

.ROMy

]D}%FO

ÂZz

a.EyS

.j(4%u

X$.mu

B.IsS

H*aY'.qL

%C!{y

(EcSsa.eK8

K.wtHc

.Q_%s !

2.TmM

H.QPq

.sjd%#

&.mz{

$J.z.nz

QF}.eN

e9a.JX

$.DdA2

.TQTv

TC.Tn,

DG.iY

.eWz}

_]

Zn:%u!

pw!.mj

`O4%X9

kef.yX`SS

K%dtv

.AR6q

7Pzm%u

.FiR@

T.UpI

.iA*X

ThLeXE

&T.MFX

C%c/)(X

.Sh,d

8%UItK

.%u@K

?%U`~

Cz.lv

%F)lQ

.YFrJ

D.ZEa

q!.gO

i%x<:=

MJ!A.rew

01x.AT

uO]^%D

.;@.Ld

%xOpstz

>{.Ag#

S^r:

|N .bM|<

O/-.un$/

}.fsd

0.CvU

#[,.BIy

w.YBjl

'XC%Qn%FIz

\~&.pr!

! .MU

H.awmqF

sa.tz

).mr~

.bf8B0w

C.Ci*]>/R

[|%XXZ

.RvUr

n.FZu

Ixa\0*%S}G

ln)r%d

K.Rie6

9i%x^

.Ftik

.XlC0

*Ay.lI

72.ESU

%8s jb

F.uv9

-MMT}5

l.%cj

u1.rFH#8

^z.eOJ

pb.bhA

KO.CI

kyazc%xv

k.lhx

pK.gJ

:sssh 

7:<<<6000

<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><ms_asmv2:trustInfo xmlns="urn:schemas-microsoft-com:asm.v3" xmlns:ms_asmv2="urn:schemas-microsoft-com:asm.v2"><ms_asmv2:security><ms_asmv2:requestedPrivileges><ms_asmv2:requestedExecutionLevel xmlns:ms_asmv3="urn:schemas-microsoft-com:asm.v3" level="asInvoker" ms_asmv3:uiAccess="false"></ms_asmv2:requestedExecutionLevel></ms_asmv2:requestedPrivileges></ms_asmv2:security></ms_asmv2:trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"><application><supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"></supportedOS><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"></supportedOS><supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"></supportedOS><supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"></supportedOS><supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"></supportedOS></application></compatibility></assembly>

{92F8A219-E740-49D5-B785-B962AD819724}

{E9F24A7C-13CA-42FB-A4D9-79C3C9D21B28}

{DE28A2EA-77FA-4F2B-8252-C3B5844F6455}

{F0B50D5A-4BBA-4514-AD2C-EBA50C29C460}

@--chrome-sxs

--chrome

--chrome-frame

@%WINDIR%\system32\cabinet.dll

%SYSTEMROOT%\system32\cabinet.dll

C:\Windows\system32\cabinet.dll

@chrome_

update-setup-exe

new-setup-exe

Software\Microsoft\Windows\CurrentVersion\Uninstall\Citrio

SETUP.EX_

CITRIO.PACKED.7Z

48.0.2564.270

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   CatalinaUpdate.exe:1256
   CatalinaUpdate.exe:956
   CatalinaUpdate.exe:1572
   citrio_48.0.2564.270_1.exe:1144
   %original file name%.exe:1964

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:
   

   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\Install\{091E7932-CF93-4194-B98B-4DF75362EFF0}\citrio_48.0.2564.270_1.exe (453901 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\Download\{92F8A219-E740-49D5-B785-B962AD819724}\48.0.2564.270\citrio_48.0.2564.270_1.exe (449813 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_te.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ca.dll (27 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ru.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_nl.dll (28 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_fi.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_pl.dll (28 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_fr.dll (28 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\psmachine.dll (673 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_uk.dll (26 bytes)
   %WinDir%\Tasks\CatalinaGroupUpdateTaskUserS-1-5-21-1844237615-1960408961-1801674531-1003Core.job (948 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_th.dll (25 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_zh-TW.dll (19 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_vi.dll (25 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_es-419.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdate.dll (5873 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_fil.dll (28 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ta.dll (28 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_tr.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ar.dll (24 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_sk.dll (27 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_is.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_mr.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_sw.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_es.dll (29 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_hr.dll (27 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ja.dll (22 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_kn.dll (27 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_en.dll (25 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_en-GB.dll (25 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\psuser.dll (673 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_no.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ml.dll (29 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\CatalinaUpdateHelper.msi (36 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ur.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_am.dll (22 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_pt-BR.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\CatalinaUpdate.exe (601 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_bn.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_sv.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_et.dll (25 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_gu.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_da.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\CatalinaUpdate.exe (601 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_fa.dll (25 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ms.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_sr.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_sl.dll (27 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_hu.dll (27 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_cs.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_iw.dll (23 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_lt.dll (25 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ko.dll (21 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_el.dll (28 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_hi.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_lv.dll (28 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_zh-CN.dll (19 bytes)
   %WinDir%\Tasks\CatalinaGroupUpdateTaskUserS-1-5-21-1844237615-1960408961-1801674531-1003UA.job (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_de.dll (29 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_id.dll (25 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\CatalinaUpdateOnDemand.exe (58 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_pt-PT.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_bg.dll (28 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\npCatalinaUpdate3.dll (1281 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\CatalinaUpdateBroker.exe (58 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\CatalinaCrashHandler.exe (601 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_ro.dll (27 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\1.3.25.223\goopdateres_it.dll (28 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\CR_DD852.tmp\CITRIO.PACKED.7Z (114356 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_sl.dll (27 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_gu.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUT2.tmp (22433 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_nl.dll (28 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_te.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_sk.dll (27 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_el.dll (28 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ru.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_es-419.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_iw.dll (23 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_no.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_tr.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_sr.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_en-GB.dll (25 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_da.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ro.dll (27 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_uk.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_zh-TW.dll (19 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_bn.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ms.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ta.dll (28 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\CatalinaUpdateBroker.exe (58 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_es.dll (29 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdate.dll (1990 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_sw.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_de.dll (29 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_is.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_sv.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_fr.dll (28 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_en.dll (25 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_cs.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_mr.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_pt-BR.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_fa.dll (25 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_kn.dll (27 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_bg.dll (28 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_pt-PT.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_id.dll (25 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_fi.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ja.dll (22 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\npCatalinaUpdate3.dll (236 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\psuser.dll (161 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ml.dll (29 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ko.dll (21 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_th.dll (25 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ca.dll (27 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_vi.dll (25 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_hi.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_zh-CN.dll (19 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_lv.dll (28 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_hu.dll (27 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\CatalinaUpdate.exe (130 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ar.dll (24 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_pl.dll (28 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_hr.dll (27 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\CatalinaUpdateHelper.msi (36 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_lt.dll (25 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_et.dll (25 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_am.dll (22 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\psmachine.dll (155 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\CatalinaCrashHandler.exe (130 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_it.dll (28 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_fil.dll (28 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\goopdateres_ur.dll (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\GUM1.tmp\CatalinaUpdateOnDemand.exe (58 bytes)

4. Delete the following value(s) in the autorun key (How to Work with System Registry):
   

   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   "CatalinaGroup Update" = "%Documents and Settings%\%current user%\Local Settings\Application Data\CatalinaGroup\Update\CatalinaUpdate.exe /c"

5. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.