Worm.Win32.AutoIt.FD, WormAutoItGen.YR (Lavasoft MAS)Behaviour: Worm
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 6ceaf1969bacce2e154236e05feac591
SHA1: 3f7ae7845ad21942300fc00eb2b0acec0d5155a3
SHA256: 5316da40ce22a3b99d4e700a03309d6464ce7797f17184afbfc4ea76c116b192
SSDeep: 196608:qNntJfiv9hdKEz uLOGslsYtPURslS9XtLeIUujurJm3ULJTLGa:qhtu9hdPm RRXheILam6JT
Size: 12485632 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: Popeler.-.Installer
Created at: 2014-01-15 16:54:40
Analyzed on: WindowsXP SP3 32-bit
Summary: Worm. A program that is primarily replicating on networks or removable drives.
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The Worm creates the following process(es):
Integrator.exe:3452
taskkill.exe:2244
DiskDefrag.exe:2340
gu4setup.exe:2184
regedit.exe:2716
regedit.exe:3660
Initialize.exe:2656
The Worm injects its code into the following process(es):
%original file name%.exe:1896
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process Integrator.exe:3452 makes changes in the file system.
The Worm creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\update[1].html (568 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\jquery.min[1].js (45771 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~gu3-ver.dat (107 bytes)
%Program Files%\Glary Utilities 4\data\AppSetting.ini (44667 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\news[1].ini (194 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\desktop.ini (67 bytes)
%Program Files%\Glary Utilities 4\data\backup.ini (9 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012014081520140816\index.dat (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\index[1].js (1177 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\redirect[1].php (107 bytes)
%Documents and Settings%\%current user%\Templates\GUTracksIni.tmp (42 bytes)
%Program Files%\Glary Utilities 4\news.ini (194 bytes)
The Worm deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013041520130416\index.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013040820130415 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013040820130415\index.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013041520130416 (0 bytes)
%Program Files%\Glary Utilities 4\data\backup.ini (0 bytes)
%Documents and Settings%\%current user%\Templates\GUTracksIni.tmp (0 bytes)
The process DiskDefrag.exe:2340 makes changes in the file system.
The Worm creates and/or writes to the following file(s):
%System%\BootDefrag.exe (601 bytes)
%System%\drivers\BootDefragDriver.sys (13 bytes)
The process %original file name%.exe:1896 makes changes in the file system.
The Worm creates and/or writes to the following file(s):
%WinDir%\MrSoftware\gu4setup.exe (90809 bytes)
%WinDir%\MrSoftware\reg.reg (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\autB3.tmp (482 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\autB2.tmp (96206 bytes)
The Worm deletes the following file(s):
%WinDir%\MrSoftware\gu4setup.exe (0 bytes)
%WinDir%\MrSoftware (0 bytes)
%WinDir%\MrSoftware\reg.reg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\autB3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\autB2.tmp (0 bytes)
The process gu4setup.exe:2184 makes changes in the file system.
The Worm creates and/or writes to the following file(s):
%Program Files%\Glary Utilities 4\skins\system information\others.png (544 bytes)
%Program Files%\Glary Utilities 4\languages.dll (1350 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\oc_btn_click.png (2 bytes)
%Program Files%\Glary Utilities 4\skins\icons\CheckUpdatehover.png (2 bytes)
%Program Files%\Glary Utilities 4\Native\wnet_x86\BootDefrag.exe (1615 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\systemcontrol.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsmB5.tmp\nsExec.dll (6 bytes)
%Program Files%\Glary Utilities 4\skins\system information\top.png (3 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\dockpopcurpage.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\systemtweaks.png (1 bytes)
%Program Files%\Glary Utilities 4\FileUndelete.exe (31651 bytes)
%Program Files%\Glary Utilities 4\Backup.dll (2695 bytes)
%Program Files%\Glary Utilities 4\Resources\Uninstaller\Large.png (3 bytes)
%Program Files%\Glary Utilities 4\Config.dll (26 bytes)
%Program Files%\Glary Utilities 4\DriverBackup.exe (6127 bytes)
%Program Files%\Glary Utilities 4\SpyRemover.dll (8263 bytes)
%Program Files%\Glary Utilities 4\skins\icons\emptyfolderfinder.png (1 bytes)
%Program Files%\Glary Utilities 4\Resources\DiskAnalysis\toolbar.png (7 bytes)
%Program Files%\Glary Utilities 4\data\BootTime.ini (3 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\filemanagement.png (1 bytes)
%Program Files%\Glary Utilities 4\Microsoft.VC90.CRT.manifest (524 bytes)
%Program Files%\Glary Utilities 4\skins\icons\regdefrag.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\skin_pic_normal.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\icons\fileencrypthover.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\icons\diskanalysishover.png (1 bytes)
%Program Files%\Glary Utilities 4\filesplitter.exe (2625 bytes)
%Program Files%\Glary Utilities 4\Resources\ProcessManager\ToolBar.png (6 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\oc_cancel_click.png (1 bytes)
%Program Files%\Glary Utilities 4\Resources\Uninstaller\Recently.png (3 bytes)
%Program Files%\Glary Utilities 4\languages\Slovak.lng (2711 bytes)
%Program Files%\Glary Utilities 4\Uninstaller.exe (7832 bytes)
%Program Files%\Glary Utilities 4\languages\hebrew.lng (1568 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\main_close.png (1 bytes)
%Program Files%\Glary Utilities 4\fileencrypt.exe (3595 bytes)
%Program Files%\Glary Utilities 4\languages\Romana.lng (2500 bytes)
%Documents and Settings%\All Users\Desktop\Glary Utilities 4.lnk (755 bytes)
%Program Files%\Glary Utilities 4\skins\icons\diskdefraghover.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\icons\registrycleaner.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\system information\drives.png (346 bytes)
%Program Files%\Glary Utilities 4\skins\system information\display.png (636 bytes)
%Program Files%\Glary Utilities 4\skins\icons\BrowserAssistanthover.png (1 bytes)
%Program Files%\Glary Utilities 4\Resources\DiskAnalysis\file_result.png (7 bytes)
%Program Files%\Glary Utilities 4\skins\icons\restorecenter.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\system information\cpu.png (372 bytes)
%Program Files%\Glary Utilities 4\skins\system information\network.png (618 bytes)
%Program Files%\Glary Utilities 4\skins\icons\fileundeletehover.png (1 bytes)
%Program Files%\Glary Utilities 4\Resources\Uninstaller\RarelyUsed.png (3 bytes)
%Program Files%\Glary Utilities 4\Resources\RegistryDefrag\regdefrag.png (25 bytes)
%Program Files%\Glary Utilities 4\Native\wxp_x86\RegBootDefrag.exe (22 bytes)
%Program Files%\Glary Utilities 4\skins\system information\topdown.png (3 bytes)
%Program Files%\Glary Utilities 4\skins\icons\fileundelete.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\checkbox_checked.png (1 bytes)
%Program Files%\Glary Utilities 4\LockDll.dll (20809 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\dockpopturnleft.png (2 bytes)
%Program Files%\Glary Utilities 4\languages\spain.lng (3093 bytes)
%Program Files%\Glary Utilities 4\languages\french.lng (3711 bytes)
%Program Files%\Glary Utilities 4\skins\icons\checkdiskhover.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\icons\BrowserAssistant.png (1 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Glary Utilities 4\Website.lnk (802 bytes)
%Program Files%\Glary Utilities 4\skins\icons\procmgrhover.png (1 bytes)
%Program Files%\Glary Utilities 4\Resources\Uninstaller\AllPrograms.png (3 bytes)
%Program Files%\Glary Utilities 4\Resources\CheckDisk\button_expand.png (3 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\oc_cancel_hover.png (1 bytes)
%Program Files%\Glary Utilities 4\BootTime.dll (20 bytes)
%Program Files%\Glary Utilities 4\languages\dutch.lng (1976 bytes)
%Program Files%\Glary Utilities 4\languages\english.lng (1897 bytes)
%Program Files%\Glary Utilities 4\languages\Finnish_(KBoost).lng (1678 bytes)
%Program Files%\Glary Utilities 4\joinExe.exe (1827 bytes)
%Program Files%\Glary Utilities 4\languages\italian.lng (2701 bytes)
%Program Files%\Glary Utilities 4\Native\wlh_x86\BootDefrag.exe (1578 bytes)
%Program Files%\Glary Utilities 4\DiskCleaner.dll (15221 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\diskspace.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\icons\driverbackup.png (1 bytes)
%Program Files%\Glary Utilities 4\msvcm90.dll (4349 bytes)
%Program Files%\Glary Utilities 4\skins\icons\restorecenterhover.png (1 bytes)
%Program Files%\Glary Utilities 4\RemoveDriver.dll (5165 bytes)
%Program Files%\Glary Utilities 4\CheckUpdate.dll (19685 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\main_right_top_mark_click_bg.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\pop_btn_normal.png (3 bytes)
%Program Files%\Glary Utilities 4\MemfilesService.exe (4526 bytes)
%Program Files%\Glary Utilities 4\Resources\Uninstaller\View.png (3 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\clear_tips.png (3 bytes)
%Program Files%\Glary Utilities 4\memdefrag.exe (3673 bytes)
%Program Files%\Glary Utilities 4\Native\wnet_x64\BootDefragDriver.sys (17 bytes)
%Program Files%\Glary Utilities 4\DiskDefrag.exe (12394 bytes)
%Program Files%\Glary Utilities 4\Resources\ProcessManager\RClickMenu.png (4 bytes)
%Program Files%\Glary Utilities 4\skins\default\backimages\bg1.jpg (4853 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\tab_ov_blue.png (3 bytes)
%Program Files%\Glary Utilities 4\Native\win7_x64\BootDefrag.exe (4197 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\tab_btn_hover.png (2 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\dockpopbg.png (3 bytes)
%Program Files%\Glary Utilities 4\skins\icons\checkdisk.png (1 bytes)
%Program Files%\Glary Utilities 4\languages\Greek.lng (3583 bytes)
%Program Files%\Glary Utilities 4\data\xb.dat (14600 bytes)
%Program Files%\Glary Utilities 4\skins\icons\shortcutfixerhover.png (2 bytes)
%Program Files%\Glary Utilities 4\skins\icons\startupmanager.png (2 bytes)
%Program Files%\Glary Utilities 4\languages\French(FR).lng (3564 bytes)
%Program Files%\Glary Utilities 4\languages\Francais.lng (3411 bytes)
%Program Files%\Glary Utilities 4\upgrade.exe (1964 bytes)
%Program Files%\Glary Utilities 4\DPInst32.exe (18153 bytes)
%Program Files%\Glary Utilities 4\data\xt.dat (26 bytes)
%Program Files%\Glary Utilities 4\data\backup.dat (864 bytes)
%Program Files%\Glary Utilities 4\Resources\EmptyFolderFinder\toolbar.png (6 bytes)
%Program Files%\Glary Utilities 4\languages\ukrainian.lng (2421 bytes)
%Program Files%\Glary Utilities 4\languages\French(CA).lng (1802 bytes)
%Program Files%\Glary Utilities 4\skins\icons\filesplitterhover.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\icons\diskcleaner.png (1 bytes)
%Program Files%\Glary Utilities 4\Native\win7_x86\BootDefrag.exe (1630 bytes)
%Program Files%\Glary Utilities 4\skins\icons\Uninstaller.png (2 bytes)
%Program Files%\Glary Utilities 4\skins\system information\memory.png (503 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\dockpopturnright.png (2 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\tab_ad_blue.png (3 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\pop_btn_click.png (3 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\main_feedback.png (1 bytes)
%Program Files%\Glary Utilities 4\languages\Czech.lng (2518 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsmB5.tmp\nsB6.tmp (6 bytes)
%Program Files%\Glary Utilities 4\Resources\SysInfo\NetworkNode.png (535 bytes)
%Program Files%\Glary Utilities 4\RestoreCenter.exe (1568 bytes)
%Program Files%\Glary Utilities 4\languages\Romania.lng (2446 bytes)
%Program Files%\Glary Utilities 4\StartupManager.exe (1568 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\systemstatus.png (1 bytes)
%Program Files%\Glary Utilities 4\CheckDisk.dll (4538 bytes)
%Program Files%\Glary Utilities 4\Native\wnet_x86\BootDefragDriver.sys (14 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\pop_btn_hover.png (3 bytes)
%Program Files%\Glary Utilities 4\Resources\settings\DiskCleanerImageList.bmp (25 bytes)
%Program Files%\Glary Utilities 4\data\duplicates.dat (288 bytes)
%Program Files%\Glary Utilities 4\Native\wlh_x86\BootDefragDriver.sys (14 bytes)
%Program Files%\Glary Utilities 4\QuickSearch.exe (9589 bytes)
%Program Files%\Glary Utilities 4\TracksEraser.dll (21815 bytes)
%Program Files%\Glary Utilities 4\Native\win7_x86\BootDefragDriver.sys (14 bytes)
%Program Files%\Glary Utilities 4\skins\icons\cmmhover.png (1 bytes)
%Program Files%\Glary Utilities 4\Log.dll (3673 bytes)
%Program Files%\Glary Utilities 4\cmm.exe (3849 bytes)
%Program Files%\Glary Utilities 4\skins\icons\shredder.png (1 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch\Glary Utilities 4.lnk (773 bytes)
%Program Files%\Glary Utilities 4\languages\French (Ad Lib).lng (2535 bytes)
%Program Files%\Glary Utilities 4\skins\icons\procmgr.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\tab_btn_normal.png (2 bytes)
%Program Files%\Glary Utilities 4\skins\default\backimages\bg6.jpg (1406 bytes)
%Program Files%\Glary Utilities 4\data\junkInfo.ini (1 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Glary Utilities 4\Uninstall.lnk (569 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\main_right_top_mark_sep.png (941 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\privacy.png (1 bytes)
%Program Files%\Glary Utilities 4\languages\chinese.lng (2317 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\search_mark.png (3 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\progress_bg.png (469 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\registry.png (1 bytes)
%Program Files%\Glary Utilities 4\languages\russian.lng (1862 bytes)
%Program Files%\Glary Utilities 4\skins\icons\driverbackuphover.png (1 bytes)
%Program Files%\Glary Utilities 4\Resources\DiskCleaner\toolbar.png (7 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\skinsbg.png (439 bytes)
%Program Files%\Glary Utilities 4\languages\turkish.lng (3258 bytes)
%Program Files%\Glary Utilities 4\skins\icons\Uninstallerhover.png (2 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\oc_cancel_normal.png (680 bytes)
%Program Files%\Glary Utilities 4\sysinfo.exe (10633 bytes)
%Program Files%\Glary Utilities 4\autodll.dll (2332 bytes)
%Program Files%\Glary Utilities 4\Resources\RegistryCleaner\Toolbar Default.png (6 bytes)
%Program Files%\Glary Utilities 4\dupefinder.exe (9324 bytes)
%Program Files%\Glary Utilities 4\skins\system information\normalhot.png (3 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\skin_custom.png (989 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\skin_col_normal.png (1 bytes)
%Program Files%\Glary Utilities 4\Resources\SysInfo\OtherDevicesNode.png (5 bytes)
%Program Files%\Glary Utilities 4\zlib1.dll (4242 bytes)
%Program Files%\Glary Utilities 4\skins\icons\registrycleanerhover.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\antimalware.png (1 bytes)
%Program Files%\Glary Utilities 4\CheckDiskProgress.exe (2104 bytes)
%Program Files%\Glary Utilities 4\Resources\InternetBooster\IBackGround.jpg (13 bytes)
%Program Files%\Glary Utilities 4\Native\wnet_x64\BootDefrag.exe (4149 bytes)
%Program Files%\Glary Utilities 4\skins\icons\trackseraserhover.png (1 bytes)
%Program Files%\Glary Utilities 4\DPInst64.exe (21501 bytes)
%Program Files%\Glary Utilities 4\data\startup.dat (2712 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\main_right_top_mark_hover_bg.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\main_close_click.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\icons\filesplitter.png (1 bytes)
%Program Files%\Glary Utilities 4\Integrator.exe (20633 bytes)
%Program Files%\Glary Utilities 4\EncryptExe.exe (10975 bytes)
%Program Files%\Glary Utilities 4\Undelete.dll (4085 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\progress.png (4 bytes)
%Program Files%\Glary Utilities 4\skins\default\backimages\bg7.jpg (1568 bytes)
%Program Files%\Glary Utilities 4\SoftwareUpdate.exe (7455 bytes)
%Program Files%\Glary Utilities 4\BottDefrag.dll (1946 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\menu_click.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\oc_detailbg.png (1 bytes)
%Program Files%\Glary Utilities 4\TracksEraser.exe (1568 bytes)
%Program Files%\Glary Utilities 4\languages\German.lng (2582 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\skintransparentmark.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\dockpopturnleftgray.png (1 bytes)
%Program Files%\Glary Utilities 4\Native\wxp_x86\BootDefragDriver.sys (13 bytes)
%Program Files%\Glary Utilities 4\settings.dll (9533 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\harddisk.png (1 bytes)
%Program Files%\Glary Utilities 4\languages\ukrainian2.lng (2222 bytes)
%Program Files%\Glary Utilities 4\skins\icons\emptyfolderfinderhover.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\oc_btn_hover.png (2 bytes)
%Program Files%\Glary Utilities 4\skins\icons\CheckUpdate.png (2 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\menu_normal.png (1 bytes)
%Program Files%\Glary Utilities 4\data\duplicatesfolder.dat (194 bytes)
%Program Files%\Glary Utilities 4\uninst.exe (2229 bytes)
%Program Files%\Glary Utilities 4\skins\icons\shortcutfixer.png (1 bytes)
%Program Files%\Glary Utilities 4\ObjectAdmin.dll (1765 bytes)
%Program Files%\Glary Utilities 4\Resources\TracksEraser\toolbar.png (6 bytes)
%Program Files%\Glary Utilities 4\Resources\SpyRemover\BKPic.png (1568 bytes)
%Program Files%\Glary Utilities 4\skins\icons\sysinfohover.png (1 bytes)
%Program Files%\Glary Utilities 4\procmgr.exe (7880 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\btn_click.png (2 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\body_transbg.png (8 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\main_close_hover.png (1 bytes)
%Program Files%\Glary Utilities 4\Resources\SysInfo\System Information.png (7 bytes)
%Program Files%\Glary Utilities 4\Native\wxp_x86\BootDefrag.exe (1613 bytes)
%Program Files%\Glary Utilities 4\Resources\settings\TracksEraseImageList.bmp (7 bytes)
%Program Files%\Glary Utilities 4\data\htmldata.dat (1 bytes)
%Program Files%\Glary Utilities 4\ScanFile.dll (1150 bytes)
%Program Files%\Glary Utilities 4\Resources\Uninstaller\WindowsUpdates.png (3 bytes)
%Program Files%\Glary Utilities 4\settings.ini (24 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\tab_ov.png (3 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\oc_btn_normal.png (2 bytes)
%Program Files%\Glary Utilities 4\languages\finnish.lng (1659 bytes)
%Program Files%\Glary Utilities 4\FileScanFilter.dll (9287 bytes)
%Program Files%\Glary Utilities 4\Native\wxp_x64\RegBootDefrag.exe (24 bytes)
%Program Files%\Glary Utilities 4\regdefrag.exe (3265 bytes)
%Program Files%\Glary Utilities 4\skins\icons\spyremover.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\oneclickmaintenance_front.png (2 bytes)
%Program Files%\Glary Utilities 4\skins\default\backimages\bg5.jpg (134 bytes)
%Program Files%\Glary Utilities 4\skins\icons\spyremoverhover.png (1 bytes)
%Program Files%\Glary Utilities 4\Glary Utilities 4.url (62 bytes)
%Program Files%\Glary Utilities 4\Resources\Dupefinder\tool.png (5 bytes)
%Program Files%\Glary Utilities 4\Resources\SysInfo\OperSysNode.png (9 bytes)
%Program Files%\Glary Utilities 4\msvcr90.dll (14706 bytes)
%Program Files%\Glary Utilities 4\languages\dutch2.lng (2980 bytes)
%Program Files%\Glary Utilities 4\languages\Magyar2.lng (4112 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\btn_normal.png (2 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\oneclick_progress.png (4 bytes)
%Program Files%\Glary Utilities 4\skins\icons\diskcleanerhover.png (1 bytes)
%Program Files%\Glary Utilities 4\shredder.exe (4681 bytes)
%Program Files%\Glary Utilities 4\skins\system information\windows.png (882 bytes)
%Program Files%\Glary Utilities 4\languages\Dutch3.lng (3098 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\dockpopturnrightgray.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\ov_boottimebg.png (3 bytes)
%Program Files%\Glary Utilities 4\data\junk.dat (1 bytes)
%Program Files%\Glary Utilities 4\Resources\ShortuctFixer\toolbar.png (9 bytes)
%Program Files%\Glary Utilities 4\ShortcutFixer.dll (7408 bytes)
%Program Files%\Glary Utilities 4\Resources\SysInfo\Picture.png (8 bytes)
%Program Files%\Glary Utilities 4\ShortcutFixer.exe (1568 bytes)
%Program Files%\Glary Utilities 4\OneClickMaintenance.exe (7818 bytes)
%Program Files%\Glary Utilities 4\languages\French(#DG#).lng (2590 bytes)
%Program Files%\Glary Utilities 4\DiskAnalysis.exe (10839 bytes)
%Program Files%\Glary Utilities 4\languages\arabic.lng (2806 bytes)
%Program Files%\Glary Utilities 4\Native\wlh_x64\BootDefrag.exe (4153 bytes)
%Program Files%\Glary Utilities 4\Native\wxp_x64\BootDefrag.exe (4099 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\main_min.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\menu_hover.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\default\backimages\bg3.jpg (1032 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Glary Utilities 4\Glary Utilities 4.lnk (767 bytes)
%Program Files%\Glary Utilities 4\skins\icons\sysinfo.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\icons\memdefrag.png (2 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\tab_oc.png (3 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\oneclick_bg.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\main_restore.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\main_like.png (1 bytes)
%Program Files%\Glary Utilities 4\languages\slovenian.lng (2096 bytes)
%Program Files%\Glary Utilities 4\Microsoft.VC90.MFC.manifest (548 bytes)
%Program Files%\Glary Utilities 4\languages\vietnamese.lng (3050 bytes)
%Program Files%\Glary Utilities 4\skins\icons\memdefraghover.png (2 bytes)
%Program Files%\Glary Utilities 4\data\empty.dat (478 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\oc_needclearbg.png (288 bytes)
%Program Files%\Glary Utilities 4\Resources\SysInfo\OverViewNode.png (8 bytes)
%Program Files%\Glary Utilities 4\languages\japanese.lng (2017 bytes)
%Program Files%\Glary Utilities 4\data\registry.dat (8 bytes)
%Program Files%\Glary Utilities 4\SpyRemover.exe (1568 bytes)
%Program Files%\Glary Utilities 4\msvcp90.dll (12049 bytes)
%Program Files%\Glary Utilities 4\RestoreCenter.dll (6654 bytes)
%Program Files%\Glary Utilities 4\languages\Danish.lng (4516 bytes)
%Program Files%\Glary Utilities 4\Resources\DiskDefrag\toolbar.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\system information\normaldown.png (3 bytes)
%Program Files%\Glary Utilities 4\skins\icons\dupefinder.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\icons\trackseraser.png (1 bytes)
%Program Files%\Glary Utilities 4\data\procsubmit.dat (1 bytes)
%Program Files%\Glary Utilities 4\skins\default\backimages\bg9.jpg (2712 bytes)
%Program Files%\Glary Utilities 4\RegistryCleaner.dll (13135 bytes)
%Program Files%\Glary Utilities 4\languages\polish.lng (2292 bytes)
%Program Files%\Glary Utilities 4\languages\chineseT.lng (3002 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\drivers.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\icons\dupefinderhover.png (1 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Glary Utilities 4.lnk (761 bytes)
%Program Files%\Glary Utilities 4\skins\icons\startupmanagerhover.png (2 bytes)
%Program Files%\Glary Utilities 4\Resources\StartupManager\toolbar.png (8 bytes)
%Program Files%\Glary Utilities 4\EmptyFolderFinder.exe (5963 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\btn_hover.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsmB5.tmp\System.dll (11 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\oneclickmaintenance_needclear_bg.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\default\backimages\bg4.jpg (21 bytes)
%Program Files%\Glary Utilities 4\Memfiles.dll (1838 bytes)
%Program Files%\Glary Utilities 4\StartupManager.dll (10956 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\tab_ad.png (3 bytes)
%Program Files%\Glary Utilities 4\skins\default\backimages\bg2.jpg (12 bytes)
%Program Files%\Glary Utilities 4\skins\icons\fileencrypt.png (1 bytes)
%Program Files%\Glary Utilities 4\data\apps.dat (8 bytes)
%Program Files%\Glary Utilities 4\gsd.exe (1236 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\logo.png (9 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\usertype_btn.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\oneclickmaintenance_bg.png (7 bytes)
%Program Files%\Glary Utilities 4\data\settings.dat (3 bytes)
%Program Files%\Glary Utilities 4\languages\Swedish.lng (3102 bytes)
%Program Files%\Glary Utilities 4\languages\ptbr.lng (2204 bytes)
%Program Files%\Glary Utilities 4\Resources\TurboMode\BackGround.jpg (16 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\dockpopdarkbg.png (1 bytes)
%Program Files%\Glary Utilities 4\DiskCleaner.exe (1568 bytes)
%Program Files%\Glary Utilities 4\data\xdata.dat (1568 bytes)
%Program Files%\Glary Utilities 4\Native\wxp_x64\BootDefragDriver.sys (17 bytes)
%Program Files%\Glary Utilities 4\CheckUpdate.exe (1568 bytes)
%Program Files%\Glary Utilities 4\skins\icons\quicksearchhover.png (1 bytes)
%Program Files%\Glary Utilities 4\languages\Magyar.lng (1728 bytes)
%Program Files%\Glary Utilities 4\skins\icons\diskdefrag.png (1 bytes)
%Program Files%\Glary Utilities 4\Native\win7_x64\BootDefragDriver.sys (17 bytes)
%Program Files%\Glary Utilities 4\ContextHandler.dll (1758 bytes)
%Program Files%\Glary Utilities 4\Resources\SysInfo\DisplayNode.png (5 bytes)
%Program Files%\Glary Utilities 4\Resources\SysInfo\SystemDevicesNode.png (4 bytes)
%Program Files%\Glary Utilities 4\skins\system information\computer.png (3 bytes)
%Program Files%\Glary Utilities 4\Resources\SysInfo\DrivesNode.png (6 bytes)
%Program Files%\Glary Utilities 4\skins\icons\SoftwareUpdate.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\default\backimages\bg8.jpg (914 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\dockpopcurpagegray.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\icons\SoftwareUpdatehover.png (1 bytes)
%Program Files%\Glary Utilities 4\languages\French_(RT).lng (3489 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\oc_btn_scan.png (1 bytes)
%Program Files%\Glary Utilities 4\languages\spanish.lng (2319 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\DockButton_Tip.png (2 bytes)
%Program Files%\Glary Utilities 4\iehelper.exe (17138 bytes)
%Program Files%\Glary Utilities 4\Native\wlh_x64\BootDefragDriver.sys (17 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\checkbox_uncheck.png (1 bytes)
%Program Files%\Glary Utilities 4\Resources\QuickSearch\images\quick_search_logo.png (3 bytes)
%Program Files%\Glary Utilities 4\CheckDisk.exe (1568 bytes)
%Program Files%\Glary Utilities 4\skins\icons\regdefraghover.png (1 bytes)
%Program Files%\Glary Utilities 4\Resources\settings\CleanRegistryImageList.bmp (18 bytes)
%Program Files%\Glary Utilities 4\data\process.dat (1568 bytes)
%Program Files%\Glary Utilities 4\skins\icons\diskanalysis.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\main_skin.png (1 bytes)
%Program Files%\Glary Utilities 4\languages\spanish (McM).lng (3122 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\programs.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\tab_oc_blue.png (3 bytes)
%Program Files%\Glary Utilities 4\RegistryCleaner.exe (2009 bytes)
%Program Files%\Glary Utilities 4\skins\icons\shredderhover.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\default\skin.ini (653 bytes)
%Program Files%\Glary Utilities 4\mfc90u.dll (27634 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\tab_btn_click.png (2 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\toolbar.png (3 bytes)
%Program Files%\Glary Utilities 4\skins\icons\quicksearch.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\foot_transbg.png (7 bytes)
%Program Files%\Glary Utilities 4\GridMap.ocx (9906 bytes)
%Program Files%\Glary Utilities 4\Initialize.exe (3586 bytes)
%Program Files%\Glary Utilities 4\skins\icons\cmm.png (1 bytes)
The Worm deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nshB4.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsmB5.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsmB5.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsmB5.tmp\nsExec.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsmB5.tmp\nsB6.tmp (0 bytes)
The process Initialize.exe:2656 makes changes in the file system.
The Worm creates and/or writes to the following file(s):
%WinDir%\Tasks\GlaryInitialize 4.job (316 bytes)
%Program Files%\Glary Utilities 4\data\backup.ini (9 bytes)
%Documents and Settings%\%current user%\Templates\GUTracksIni.tmp (42 bytes)
The Worm deletes the following file(s):
%Program Files%\Glary Utilities 4\data\backup.ini (0 bytes)
%Documents and Settings%\%current user%\Templates\GUTracksIni.tmp (0 bytes)
Registry activity
The process Integrator.exe:3452 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:
[HKCU\Software\Glarysoft\Glary Utilities 4\Settings]
"AutoSoftupdate" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fdd9f6f3-7454-11e2-b4cd-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014081520140816]
"CacheLimit" = "8192"
[HKCU\Software\Glarysoft\Glary Utilities 4\OneClick\Selected]
"OC_REMOVETF" = "1"
[HKCU\Software\Glarysoft\Glary Utilities 4\Settings]
"Checkupdates" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{773a730e-74fb-11e2-b597-000c293bdf2f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\GlarySoft\Glary Utilities 4]
"date" = "41866.7095370370"
[HKCU\Software\Glarysoft\Glary Utilities 4\Settings\PrivacyTracks]
"EraseTracks" = "0"
[HKCU\Software\Glarysoft\Glary Utilities 4]
"Transparen" = "0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKCU\Software\Glarysoft\Glary Utilities 4\OneClick]
"DeepClean" = "0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
[HKCU\Software\Glarysoft\Glary Utilities 4]
"Current View" = "0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014081520140816]
"CachePath" = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012014081520140816"
[HKCU\Software\Glarysoft\Glary Utilities 4\OneClick\Selected]
"OC_OPTIMIZESA" = "1"
[HKLM\SOFTWARE\GlarySoft\Glary Utilities 4]
"SkipVersion" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Glarysoft\Glary Utilities 4\Advanced Tools]
"ADT_WR_REPAIR" = "1"
[HKCU\Software\Glarysoft\Glary Utilities 4\OneClick\Selected]
"OC_DISKR" = "0"
[HKLM\SOFTWARE\GlarySoft\Glary Utilities 4]
"UpdateURL" = "http://www.glarysoft.com/glary-utilities-pro/download/?ref=pro&v=4.4.0.86"
[HKCU\Software\Glarysoft\Glary Utilities 4\Advanced Tools]
"ADT_PRIVACY_ERASEH" = "9"
"ADT_PROGRAMS_CHECKFU" = "7"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Templates" = "%Documents and Settings%\%current user%\Templates"
[HKCU\Software\Glarysoft\Glary Utilities 4]
"BootTime" = "5929"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\GlarySoft\Glary Utilities 4]
"NewVersion" = "5.5.0.12"
"Version" = "4.4.0.86"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Favorites" = "%Documents and Settings%\%current user%\Favorites"
[HKCU\Software\Glarysoft\Glary Utilities 4\Advanced Tools]
"ADT_DS_CLEANUP" = "2"
"ADT_DS_EXPLORERD" = "4"
[HKCU\Software\Glarysoft\Glary Utilities 4\OneClick\Selected]
"OC_MALWARER" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fdd9f6f2-7454-11e2-b4cd-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Glarysoft\Glary Utilities 4\Settings]
"BackupsMax" = "60"
[HKCU\Software\Glarysoft\Glary Utilities 4\Advanced Tools]
"ADT_PROGRAMS_UNINSTALL" = "6"
[HKCU\Software\Microsoft\Internet Explorer\Main\WindowsSearch]
"Version" = "WS not installed"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014081520140816]
"CacheOptions" = "11"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 41 00 00 00 01 00 00 00 00 00 00 00"
[HKLM\SOFTWARE\GlarySoft\Glary Utilities 4]
"NewVersionDate" = "41866.709606"
"ProAutodownload" = "0"
[HKCU\Software\Glarysoft\Glary Utilities 4\Advanced Tools]
"ADT_ST_BROWSERS" = "8"
[HKCU\Software\Glarysoft\Glary Utilities 4]
"Update" = "1408111308"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "66 3E 9D 18 C4 62 F8 D4 72 B0 C1 DC 67 BA 21 5F"
[HKCU\Software\Glarysoft\Glary Utilities 4\Advanced Tools]
"ADT_SC_PROCESSES" = "5"
[HKCU\Software\Glarysoft\Glary Utilities 4\OneClick\Selected]
"OC_REMOVEBS" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKCU\Software\Glarysoft\Glary Utilities 4\OneClick\Selected]
"OC_CLEANREG" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014081520140816]
"CacheRepair" = "0"
[HKCU\Software\Glarysoft\Glary Utilities 4\Advanced Tools]
"ADT_SC_CONTEXTM" = "3"
[HKCU\Software\Glarysoft\Glary Utilities 4\Settings]
"Auto1ClickCare" = "0"
[HKCU\Software\Glarysoft\Glary Utilities 4\Advanced Tools]
"ADT_SC_STARTUPI" = "0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKLM\SOFTWARE\GlarySoft\Glary Utilities 4]
"rootDir" = "%Program Files%\Glary Utilities 4\"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fdd9f6f5-7454-11e2-b4cd-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014081520140816]
"CachePrefix" = ":2014081520140816:"
[HKCU\Software\Glarysoft\Glary Utilities 4]
"CurSkin" = "%Program Files%\Glary Utilities 4\skins\default\skin.ini"
[HKCU\Software\Glarysoft\Glary Utilities 4\OneClick\Selected]
"OC_ERASEPT" = "0"
[HKCU\Software\Glarysoft\Glary Utilities 4\Settings]
"ShowQuicklaunchTips" = "1"
The Worm modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Worm modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Worm modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Worm deletes the following registry key(s):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013041520130416]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013040820130415]
The Worm deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process taskkill.exe:2244 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "23 03 F3 64 58 E3 9A 85 75 EB 64 19 B9 A7 B5 FF"
The process DiskDefrag.exe:2340 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8B 51 D9 24 A9 38 13 32 1D E0 97 27 ED E3 BF 8B"
[HKLM\System\CurrentControlSet\Services\BootDefrag]
"RunCHK" = "0"
[HKLM\System\CurrentControlSet\Control\Session Manager]
"BootExecute" = "autocheck autochk *"
The process %original file name%.exe:1896 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A4 C8 12 E6 87 48 EE 71 93 83 75 58 4E E8 63 53"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fdd9f6f3-7454-11e2-b4cd-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{773a730e-74fb-11e2-b597-000c293bdf2f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\Windows\MrSoftware]
"gu4setup.exe" = "gu4setup"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fdd9f6f2-7454-11e2-b4cd-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fdd9f6f5-7454-11e2-b4cd-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
The Worm modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"
The Worm modifies IE settings for security zones to map all urls to the Intranet Zone:
"IntranetName" = "1"
The Worm modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
"UNCAsIntranet" = "1"
The process gu4setup.exe:2184 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fdd9f6f3-7454-11e2-b4cd-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\GlarySoft\Glary Utilities 4]
"LngVersion" = "2014-1-6"
[HKCR\ContextHandler.CContextMenu.1]
"(Default)" = "CContextMenu Class"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"
[HKLM\SOFTWARE\GlarySoft\Glary Utilities 4]
"date" = ""
[HKCR\GRIDMAP_CTRL.GridMapCtrl.1]
"(Default)" = "GridMap 控件"
[HKCR\TypeLib\{35AE4004-4194-4243-92AA-351BB7239539}\1.0\0\win32]
"(Default)" = "%Program Files%\Glary Utilities 4\GridMap.ocx"
[HKLM\SOFTWARE\GlarySoft\Glary Utilities 4]
"UpgradeTags" = ""
[HKCR\Interface\{FD50332F-185B-4D3C-B921-E0B65E547F28}\TypeLib]
"Version" = "1.0"
[HKCR\Interface\{31FB3410-EA8B-4931-91C5-ADA7B91D953B}\TypeLib]
"(Default)" = "{35AE4004-4194-4243-92AA-351BB7239539}"
[HKCR\CLSID\{B3C418F8-922B-4faf-915E-59BC14448CF7}\InprocServer32]
"(Default)" = "%Program Files%\Glary Utilities 4\ContextHandler.dll"
[HKCR\Interface\{FD50332F-185B-4D3C-B921-E0B65E547F28}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Glary Utilities 4]
"UninstallString" = "%Program Files%\Glary Utilities 4\uninst.exe"
[HKCR\GU.Encrypted]
"(Default)" = "Glary Utilities Encrypted File"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Glary Utilities 4]
"Publisher" = "Glarysoft Ltd"
[HKLM\SOFTWARE\GlarySoft\Glary Utilities 4]
"RefVersion" = "2014-1-6"
[HKCR\CLSID\{58B505BE-F589-4E8E-8BF2-B78E078CA8F7}\Version]
"(Default)" = "1.0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"
[HKLM\SOFTWARE\GlarySoft\Glary Utilities 4]
"UpdateDate" = "2014-1-6"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Glary Utilities 4]
"QuickLaunch" = "true"
[HKCR\Interface\{28C97FA4-8378-42BF-A6F9-D615EB1272D7}\ProxyStubClsid32]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fdd9f6f5-7454-11e2-b4cd-806d6172696f}]
"BaseClass" = "Drive"
[HKCR\CLSID\{58B505BE-F589-4E8E-8BF2-B78E078CA8F7}\MiscStatus]
"(Default)" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Glary Utilities 4]
"DisplayName" = "Glary Utilities 4.4"
[HKCR\Drive\shellex\ContextMenuHandlers]
"(Default)" = ""
[HKCR\CLSID\{7A1C7081-0275-49FB-B76F-B9A66767BB56}\InprocServer32]
"(Default)" = "C:\PROGRA~1\GLARYU~1\GridMap.ocx"
[HKCR\Interface\{31FB3410-EA8B-4931-91C5-ADA7B91D953B}\ProxyStubClsid32]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"
[HKCU\Software\Glarysoft\Glary Utilities 4\Settings\ContextMenu]
"EmptyFolder" = "1"
[HKCR\Folder\shellex\ContextMenuHandlers\Glary Utilities]
"(Default)" = "{B3C418F8-922B-4faf-915E-59BC14448CF7}"
[HKCR\TypeLib\{B52C0F28-8D4C-4886-965C-0A772490064E}\1.0\FLAGS]
"(Default)" = "0"
[HKCR\Interface\{FD50332F-185B-4D3C-B921-E0B65E547F28}\TypeLib]
"(Default)" = "{B52C0F28-8D4C-4886-965C-0A772490064E}"
[HKCR\*\shellex]
"(Default)" = ""
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
[HKCR\ContextHandler.CContextMenu\CurVer]
"(Default)" = "ContextHandler.CContextMenu.1"
[HKCR\Interface\{28C97FA4-8378-42BF-A6F9-D615EB1272D7}\ProxyStubClsid]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"
[HKCR\Interface\{28C97FA4-8378-42BF-A6F9-D615EB1272D7}]
"(Default)" = "_DGridMap_Ctrl"
[HKCR\CLSID\{58B505BE-F589-4E8E-8BF2-B78E078CA8F7}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCR\Interface\{31FB3410-EA8B-4931-91C5-ADA7B91D953B}\TypeLib]
"Version" = "1.0"
[HKCU\Software\Glarysoft\Glary Utilities 4]
"Language" = "english.lng"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Glary Utilities 4]
"DisplayIcon" = "%Program Files%\Glary Utilities 4\Integrator.exe"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCR\CLSID\{B3C418F8-922B-4faf-915E-59BC14448CF7}\ProgID]
"(Default)" = "ContextHandler.CContextMenu.1"
[HKCR\Folder\shellex]
"(Default)" = ""
[HKCU\Software\Glarysoft\Glary Utilities 4\Settings\ContextMenu]
"Wipe" = "1"
[HKCR\CLSID\{58B505BE-F589-4E8E-8BF2-B78E078CA8F7}\ProgID]
"(Default)" = "GRIDMAP_CTRL.GridMapCtrl.1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Integrator4.exe]
"(Default)" = "%Program Files%\Glary Utilities 4\Integrator.exe"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "25 38 CC 44 EA EF 99 DA 31 1C 69 0F 64 3C C5 8D"
[HKCR\TypeLib\{B52C0F28-8D4C-4886-965C-0A772490064E}\1.0\0\win32]
"(Default)" = "%Program Files%\Glary Utilities 4\ContextHandler.dll"
[HKCR\CLSID\{B3C418F8-922B-4faf-915E-59BC14448CF7}\TypeLib]
"(Default)" = "{B52C0F28-8D4C-4886-965C-0A772490064E}"
[HKCR\AppID\{A805009D-B902-439A-8E64-26EE3507A12E}]
"(Default)" = "ContextHandler"
[HKLM\SOFTWARE\GlarySoft\Glary Utilities 4]
"rootDir" = "%Program Files%\Glary Utilities 4"
[HKCU\Software\Glarysoft\Glary Utilities 4\Settings\ContextMenu]
"Decrypt" = "1"
[HKCR\TypeLib\{B52C0F28-8D4C-4886-965C-0A772490064E}\1.0]
"(Default)" = "ContextHandler 1.0 ÀàÃÂÂÿâ"
[HKCR\CLSID\{58B505BE-F589-4E8E-8BF2-B78E078CA8F7}\Control]
"(Default)" = ""
[HKCU\Software\Glarysoft\Glary Utilities 4\Settings\ContextMenu]
"Analyze Diskspace" = "1"
[HKCR\GU.Encrypted\DefaultIcon]
"(Default)" = "%Program Files%\Glary Utilities 4\fileencrypt.exe,0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCR\CLSID\{B3C418F8-922B-4faf-915E-59BC14448CF7}]
"(Default)" = "CContextMenu Class"
[HKCU\Software\Glarysoft\Glary Utilities 4\Settings\ContextMenu]
"Split" = "1"
[HKCR\CLSID\{58B505BE-F589-4E8E-8BF2-B78E078CA8F7}\InprocServer32]
"(Default)" = "C:\PROGRA~1\GLARYU~1\GridMap.ocx"
[HKCR\TypeLib\{35AE4004-4194-4243-92AA-351BB7239539}\1.0\HELPDIR]
"(Default)" = ""
[HKCR\GU.Encrypted\Shell\Open\Command]
"(Default)" = "%Program Files%\Glary Utilities 4\fileencrypt.exe -d %1"
[HKCR\GU.Splitted]
"(Default)" = "Glary Utilities Splitted File"
[HKCR\ContextHandler.CContextMenu.1\CLSID]
"(Default)" = "{B3C418F8-922B-4faf-915E-59BC14448CF7}"
[HKLM\SOFTWARE\GlarySoft\Glary Utilities 4]
"UpdateFile" = ""
[HKCU\Software\Glarysoft\Glary Utilities 4\Settings\ContextMenu]
"Encrypt" = "1"
[HKCR\ContextHandler.CContextMenu\CLSID]
"(Default)" = "{B3C418F8-922B-4faf-915E-59BC14448CF7}"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Glary Utilities 4]
"URLInfoAbout" = "http://www.glarysoft.com/?scr=client"
[HKCR\TypeLib\{35AE4004-4194-4243-92AA-351BB7239539}\1.0\FLAGS]
"(Default)" = "2"
[HKCR\Interface\{28C97FA4-8378-42BF-A6F9-D615EB1272D7}\TypeLib]
"(Default)" = "{35AE4004-4194-4243-92AA-351BB7239539}"
[HKCR\Interface\{31FB3410-EA8B-4931-91C5-ADA7B91D953B}\ProxyStubClsid]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"
[HKCR\TypeLib\{B52C0F28-8D4C-4886-965C-0A772490064E}\1.0\HELPDIR]
"(Default)" = "%Program Files%\Glary Utilities 4"
[HKCR\Drive\shellex\ContextMenuHandlers\Glary Utilities]
"(Default)" = "{B3C418F8-922B-4faf-915E-59BC14448CF7}"
[HKCU\Software\Glarysoft\Glary Utilities 4\Settings\ContextMenu]
"Join" = "1"
[HKCR\GRIDMAP_CTRL.GridMapCtrl.1\CLSID]
"(Default)" = "{58B505BE-F589-4E8E-8BF2-B78E078CA8F7}"
[HKCR\ContextHandler.CContextMenu]
"(Default)" = "CContextMenu Class"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKCR\.gfs]
"(Default)" = "GU.Splitted"
[HKCR\CLSID\{7A1C7081-0275-49FB-B76F-B9A66767BB56}]
"(Default)" = "GridMap 属性页"
[HKCR\Interface\{31FB3410-EA8B-4931-91C5-ADA7B91D953B}]
"(Default)" = "_DGridMap_CtrlEvents"
[HKCR\GU.Splitted\Shell\Open\Command]
"(Default)" = "%Program Files%\Glary Utilities 4\filesplitter.exe -j %1"
[HKCR\CLSID\{B3C418F8-922B-4faf-915E-59BC14448CF7}\VersionIndependentProgID]
"(Default)" = "ContextHandler.CContextMenu"
[HKCU\Software\Glarysoft\Glary Utilities 4\Settings]
"autoload" = "1"
[HKCR\GU.Splitted\DefaultIcon]
"(Default)" = "%Program Files%\Glary Utilities 4\filesplitter.exe,0"
[HKCR\Drive\shellex]
"(Default)" = ""
[HKCR\Folder\shellex\ContextMenuHandlers]
"(Default)" = ""
[HKCR\CLSID\{58B505BE-F589-4E8E-8BF2-B78E078CA8F7}\ToolboxBitmap32]
"(Default)" = "C:\PROGRA~1\GLARYU~1\GridMap.ocx, 1"
[HKCU\Software\Glarysoft\Glary Utilities 4\Settings\ContextMenu]
"Disk Defrag" = "1"
[HKCR\*\shellex\ContextMenuHandlers\Glary Utilities]
"(Default)" = "{B3C418F8-922B-4faf-915E-59BC14448CF7}"
[HKCR\Interface\{28C97FA4-8378-42BF-A6F9-D615EB1272D7}\TypeLib]
"Version" = "1.0"
[HKCR\AppID\ContextHandler.DLL]
"AppID" = "{A805009D-B902-439A-8E64-26EE3507A12E}"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCR\Interface\{FD50332F-185B-4D3C-B921-E0B65E547F28}]
"(Default)" = "ICContextMenu"
[HKCR\TypeLib\{35AE4004-4194-4243-92AA-351BB7239539}\1.0]
"(Default)" = "GridMap ActiveX ¿Ø¼þÄ£¿é"
[HKCR\CLSID\{58B505BE-F589-4E8E-8BF2-B78E078CA8F7}\MiscStatus\1]
"(Default)" = "131473"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Glary Utilities 4]
"DisplayVersion" = "4.4.0.86"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fdd9f6f2-7454-11e2-b4cd-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"
[HKCR\CLSID\{B3C418F8-922B-4faf-915E-59BC14448CF7}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCR\CLSID\{58B505BE-F589-4E8E-8BF2-B78E078CA8F7}\TypeLib]
"(Default)" = "{35AE4004-4194-4243-92AA-351BB7239539}"
[HKCR\*\shellex\ContextMenuHandlers]
"(Default)" = ""
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"
[HKCR\CLSID\{58B505BE-F589-4E8E-8BF2-B78E078CA8F7}]
"(Default)" = "GridMap 控件"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{773a730e-74fb-11e2-b597-000c293bdf2f}]
"BaseClass" = "Drive"
[HKCR\Interface\{FD50332F-185B-4D3C-B921-E0B65E547F28}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\.gfe]
"(Default)" = "GU.Encrypted"
The Worm deletes the following value(s) in system registry:
[HKLM\SOFTWARE\GlarySoft\Glary Utilities 4]
"UpdateUrl"
"NewVersion"
"SkipVersion"
The Worm disables automatic startup of the application by deleting the following autorun value:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Glary Utilities 4 Initialization"
The process regedit.exe:2716 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "65 ED 8B B8 CC 7C 53 0F 22 DE 5E D5 7B D2 A0 DF"
[HKLM\SOFTWARE\GlarySoft\Glary Utilities 4]
"UpdateDate" = "2014-1-6"
"RefVersion" = "2014-1-6"
[HKLM\SOFTWARE\Wow6432Node\GlarySoft\Glary Utilities 4]
"date" = "41654.6560416667"
[HKLM\SOFTWARE\GlarySoft\Glary Utilities 4]
"LngVersion" = "2014-1-6"
"UpgradeTags" = "gu70,"
[HKLM\SOFTWARE\Wow6432Node\GlarySoft\Glary Utilities 4]
"UpdateDate" = "2014-1-6"
"rootDir" = "%Program Files% (x86)\Glary Utilities 4\"
"UpgradeTags" = "gu70,"
"RegCode" = "2788-6167-9587-68"
"RefVersion" = "2014-1-6"
"UpdateFile" = ""
"Regname" = "MrSoftware"
[HKLM\SOFTWARE\GlarySoft\Glary Utilities 4]
"rootDir" = "%Program Files%\Glary Utilities 4\"
[HKLM\SOFTWARE\Wow6432Node\GlarySoft\Glary Utilities 4]
"LngVersion" = "2014-1-6"
[HKLM\SOFTWARE\GlarySoft\Glary Utilities 4]
"RegCode" = "2788-6167-9587-68"
"date" = "41651.8591319444"
[HKLM\SOFTWARE\Wow6432Node\GlarySoft\Glary Utilities 4]
"Version" = "4.4.0.86"
[HKLM\SOFTWARE\GlarySoft\Glary Utilities 4]
"Version" = "4.4.0.86"
"UpdateFile" = ""
"Regname" = "MrSoftware"
The process regedit.exe:3660 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "92 6C 5E 87 CD D7 E0 A3 5F 17 45 27 7D A6 42 CB"
[HKLM\SOFTWARE\GlarySoft\Glary Utilities 4]
"UpdateDate" = "2014-1-6"
"RefVersion" = "2014-1-6"
[HKLM\SOFTWARE\Wow6432Node\GlarySoft\Glary Utilities 4]
"date" = "41654.6560416667"
[HKLM\SOFTWARE\GlarySoft\Glary Utilities 4]
"LngVersion" = "2014-1-6"
"UpgradeTags" = "gu70,"
[HKLM\SOFTWARE\Wow6432Node\GlarySoft\Glary Utilities 4]
"UpdateDate" = "2014-1-6"
"rootDir" = "%Program Files% (x86)\Glary Utilities 4\"
"UpgradeTags" = "gu70,"
"RegCode" = "2788-6167-9587-68"
"RefVersion" = "2014-1-6"
"UpdateFile" = ""
"Regname" = "MrSoftware"
[HKLM\SOFTWARE\GlarySoft\Glary Utilities 4]
"rootDir" = "%Program Files%\Glary Utilities 4\"
[HKLM\SOFTWARE\Wow6432Node\GlarySoft\Glary Utilities 4]
"LngVersion" = "2014-1-6"
[HKLM\SOFTWARE\GlarySoft\Glary Utilities 4]
"RegCode" = "2788-6167-9587-68"
"date" = "41651.8591319444"
[HKLM\SOFTWARE\Wow6432Node\GlarySoft\Glary Utilities 4]
"Version" = "4.4.0.86"
[HKLM\SOFTWARE\GlarySoft\Glary Utilities 4]
"Version" = "4.4.0.86"
"UpdateFile" = ""
"Regname" = "MrSoftware"
The process Initialize.exe:2656 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "26 EC AF E5 13 6A F3 E9 6C 76 41 56 BB 10 83 63"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
"Startup" = "%Documents and Settings%\%current user%\Start Menu\Programs\Startup"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Startup" = "%Documents and Settings%\All Users\Start Menu\Programs\Startup"
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Glarysoft\Glary Utilities 4\Settings]
"BackupsMax" = "60"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Templates" = "%Documents and Settings%\%current user%\Templates"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
The Worm deletes the following value(s) in system registry:
[HKCU\Software\Glarysoft\Glary Utilities 4]
"Lastbackground"
"Curbackground"
[HKLM\SOFTWARE\GlarySoft\Glary Utilities 4]
"SkipVersion"
"UpdateUrl"
[HKCU\Software\Glarysoft\Glary Utilities 4]
"CurSkin"
[HKLM\SOFTWARE\GlarySoft\Glary Utilities 4]
"NewVersionDate"
"NewVersion"
"UpdateFile"
The Worm disables automatic startup of the application by deleting the following autorun value:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Glary Utilities 4"
"GUDelayStartup"
Dropped PE files
MD5 | File path |
---|---|
f7d94783ab9eda4e61cb93a21b0c49d8 | c:\Program Files\Glary Utilities 4\Backup.dll |
ab7e8b968767a7388c7604660ca78794 | c:\Program Files\Glary Utilities 4\BootTime.dll |
bfd6c5406b55f7285f5145f0288361fe | c:\Program Files\Glary Utilities 4\BottDefrag.dll |
c2ed7d47d1ee60be9f3b8aebcf5b052c | c:\Program Files\Glary Utilities 4\CheckDisk.dll |
4fc44e7292238e9caa78a149cdfbdc48 | c:\Program Files\Glary Utilities 4\CheckDisk.exe |
b280d797eeb7b9af98d25ced1246e38a | c:\Program Files\Glary Utilities 4\CheckDiskProgress.exe |
68428e257266b7c0f85d8816ada20b14 | c:\Program Files\Glary Utilities 4\CheckUpdate.dll |
b8e58e7251d77237e181dafb62bbfe5c | c:\Program Files\Glary Utilities 4\CheckUpdate.exe |
f0ef77a1cae6dff878aa7ed800fcec51 | c:\Program Files\Glary Utilities 4\Config.dll |
8c696d1e56593f6dddf66398cb22a301 | c:\Program Files\Glary Utilities 4\ContextHandler.dll |
3f442906b29b552f1c9fec1e221d90b7 | c:\Program Files\Glary Utilities 4\DPInst32.exe |
c3ac43b2018114a617e946aa8fdf3cac | c:\Program Files\Glary Utilities 4\DPInst64.exe |
613ae803e9ad32ff302dbe8de0a5f370 | c:\Program Files\Glary Utilities 4\DiskAnalysis.exe |
777c4f84463d65a94744b06777ea4be8 | c:\Program Files\Glary Utilities 4\DiskCleaner.dll |
1c9e97d56f1696374c927a19b95dfbe0 | c:\Program Files\Glary Utilities 4\DiskCleaner.exe |
2f18747c25af2f6b4763f926e893b11e | c:\Program Files\Glary Utilities 4\DiskDefrag.exe |
462ca7c7edb4d96260205d0f0947a204 | c:\Program Files\Glary Utilities 4\DriverBackup.exe |
c369fb32409c5118c5ed42ad47a575d7 | c:\Program Files\Glary Utilities 4\EmptyFolderFinder.exe |
c3fd242f7de3c9dbb08a93c8025fa07e | c:\Program Files\Glary Utilities 4\EncryptExe.exe |
0991cb44c081f29c3cbdb4b7591ac7fe | c:\Program Files\Glary Utilities 4\FileScanFilter.dll |
f140610a0a6310368abadb1b4156b6e7 | c:\Program Files\Glary Utilities 4\FileUndelete.exe |
ad84b67c8b66639a0a6bd8d1f6c9a5a0 | c:\Program Files\Glary Utilities 4\GridMap.ocx |
9e703a25d6dcf43154162c7b830825da | c:\Program Files\Glary Utilities 4\Initialize.exe |
908b9e4ee22a281e2c5cd75ce22a217d | c:\Program Files\Glary Utilities 4\Integrator.exe |
92f7321b9601e91aec58611e3e5d5c0f | c:\Program Files\Glary Utilities 4\LockDll.dll |
edd035df3b9418eabe6c7d7e223da8f8 | c:\Program Files\Glary Utilities 4\Log.dll |
d73d2af9e7a6c3c915fbea018e47d27f | c:\Program Files\Glary Utilities 4\Memfiles.dll |
439edae3d67e44c7cfb155bb739a6b77 | c:\Program Files\Glary Utilities 4\MemfilesService.exe |
bd8e85717de96aafae9cfc47256b792f | c:\Program Files\Glary Utilities 4\Native\win7_x64\BootDefrag.exe |
85e239de26774afd66a6305bc7c39662 | c:\Program Files\Glary Utilities 4\Native\win7_x64\BootDefragDriver.sys |
44cead2b676953ec235b7b35bca32ee8 | c:\Program Files\Glary Utilities 4\Native\win7_x86\BootDefrag.exe |
9d3719bcb5e78ccaff5a2b192c0f5b81 | c:\Program Files\Glary Utilities 4\Native\win7_x86\BootDefragDriver.sys |
d8dc447031c1085ee6360f80828806d7 | c:\Program Files\Glary Utilities 4\Native\wlh_x64\BootDefrag.exe |
c0ba352412c002730831e83e69285bb6 | c:\Program Files\Glary Utilities 4\Native\wlh_x64\BootDefragDriver.sys |
c4d899de786d130ae17ee0b89ede66d5 | c:\Program Files\Glary Utilities 4\Native\wlh_x86\BootDefrag.exe |
02303a73cec912bc2a8aab12d042c0e5 | c:\Program Files\Glary Utilities 4\Native\wlh_x86\BootDefragDriver.sys |
b59b6cb0c2a45336594d688cdfae5ff5 | c:\Program Files\Glary Utilities 4\Native\wnet_x64\BootDefrag.exe |
67c3c69243964fdf5b2a2f18c0ceb66f | c:\Program Files\Glary Utilities 4\Native\wnet_x64\BootDefragDriver.sys |
c7f02b88a0cf9f7b76d2a374e4752a06 | c:\Program Files\Glary Utilities 4\Native\wnet_x86\BootDefrag.exe |
7d45d7e2ffc326d9e73ee3ddba46487c | c:\Program Files\Glary Utilities 4\Native\wnet_x86\BootDefragDriver.sys |
4131457a4f3aeaeb5d7c4aa9b7fdede6 | c:\Program Files\Glary Utilities 4\Native\wxp_x64\BootDefrag.exe |
7e46359e717e3ad28557f296d177419c | c:\Program Files\Glary Utilities 4\Native\wxp_x64\BootDefragDriver.sys |
dd9afab9a99e5772b76d3b34f3216cbf | c:\Program Files\Glary Utilities 4\Native\wxp_x64\RegBootDefrag.exe |
eef4e19b6392d74290805f0349b5d6f1 | c:\Program Files\Glary Utilities 4\Native\wxp_x86\BootDefrag.exe |
3722f97e33cacab1d08b76abfccc2966 | c:\Program Files\Glary Utilities 4\Native\wxp_x86\BootDefragDriver.sys |
23121acc4e1e1de73d63e47ed7dbb330 | c:\Program Files\Glary Utilities 4\Native\wxp_x86\RegBootDefrag.exe |
ce45b15d5c31e11118011709ab21747d | c:\Program Files\Glary Utilities 4\ObjectAdmin.dll |
ffa7dbd107fe4546cf02fcafa13eae76 | c:\Program Files\Glary Utilities 4\OneClickMaintenance.exe |
74755dbe494225af0bd39409b580897e | c:\Program Files\Glary Utilities 4\QuickSearch.exe |
43c2ae58a9935035af4e527b99942abd | c:\Program Files\Glary Utilities 4\RegistryCleaner.dll |
80aeb650b31f52c2085e014fe5af1d6b | c:\Program Files\Glary Utilities 4\RegistryCleaner.exe |
1a020bc5610262f457e74acb79994b1e | c:\Program Files\Glary Utilities 4\RemoveDriver.dll |
7978c2d257dff09b43580e020d68e8ed | c:\Program Files\Glary Utilities 4\RestoreCenter.dll |
13d2aaeaa6bd7530397e2f119a4ec515 | c:\Program Files\Glary Utilities 4\RestoreCenter.exe |
c1511f2bd10811580b703eb90c369c4d | c:\Program Files\Glary Utilities 4\ScanFile.dll |
c128d7602400bcb658b17a3a04f46bfa | c:\Program Files\Glary Utilities 4\ShortcutFixer.dll |
035d8f2b1ddc9154bc84d7e5ac0d8d8b | c:\Program Files\Glary Utilities 4\ShortcutFixer.exe |
4e5eaa602fa6d85f695f215e0b63394c | c:\Program Files\Glary Utilities 4\SoftwareUpdate.exe |
9f17bc00a597a7bb517121008cde5dc3 | c:\Program Files\Glary Utilities 4\SpyRemover.dll |
6bd5c51f64215e6d5c01f83e70f7afb7 | c:\Program Files\Glary Utilities 4\SpyRemover.exe |
1a80589f453b4556e11f74a24983c37e | c:\Program Files\Glary Utilities 4\StartupManager.dll |
8f1322a03517fa6a34dee89791367c2d | c:\Program Files\Glary Utilities 4\StartupManager.exe |
8050fdac98d15868d2428b14d2278402 | c:\Program Files\Glary Utilities 4\TracksEraser.dll |
fe3ebc13a5c2ab9e9dc8d0126f4aba8c | c:\Program Files\Glary Utilities 4\TracksEraser.exe |
55e4c5f7022092bc7f812e291e864148 | c:\Program Files\Glary Utilities 4\Undelete.dll |
3b3d7ffb5b5013d9547af28ec066f9e9 | c:\Program Files\Glary Utilities 4\Uninstaller.exe |
301c1f81b6c6893f18d9484415ab1f77 | c:\Program Files\Glary Utilities 4\autodll.dll |
cdfc08cfcb16044a7563bba7d0df8803 | c:\Program Files\Glary Utilities 4\cmm.exe |
15d14a91121dc16fc7ffa6cce4298b9c | c:\Program Files\Glary Utilities 4\dupefinder.exe |
da0c707acca1265384e9a9cd6ffe02fb | c:\Program Files\Glary Utilities 4\fileencrypt.exe |
5f9167a3f538ddc67e8234f07af87a97 | c:\Program Files\Glary Utilities 4\filesplitter.exe |
bdaedc64a57cb858ac95c4bc95ac3e9f | c:\Program Files\Glary Utilities 4\gsd.exe |
665d746175bd25f449d26eab36f49ab2 | c:\Program Files\Glary Utilities 4\iehelper.exe |
f7675efb8d127433f58aad6a85029ed8 | c:\Program Files\Glary Utilities 4\joinExe.exe |
8cfe71ce130cb8a7e877b17188e046f9 | c:\Program Files\Glary Utilities 4\languages.dll |
e6f4907e2f9f01ff3ea683ff16cb022f | c:\Program Files\Glary Utilities 4\memdefrag.exe |
b9030d821e099c79de1c9125b790e2da | c:\Program Files\Glary Utilities 4\mfc90u.dll |
4a8bc195abdc93f0db5dab7f5093c52f | c:\Program Files\Glary Utilities 4\msvcm90.dll |
6de5c66e434a9c1729575763d891c6c2 | c:\Program Files\Glary Utilities 4\msvcp90.dll |
e7d91d008fe76423962b91c43c88e4eb | c:\Program Files\Glary Utilities 4\msvcr90.dll |
899a68531f942cba34e58c5d06a23402 | c:\Program Files\Glary Utilities 4\procmgr.exe |
ef7b94eb4a818ab0254a98ebcdb922f2 | c:\Program Files\Glary Utilities 4\regdefrag.exe |
852847f0c6a37bbf3c715e3274c8a706 | c:\Program Files\Glary Utilities 4\settings.dll |
df32b8a025627f4be787bdd7961ee020 | c:\Program Files\Glary Utilities 4\shredder.exe |
ac988bf6b9d9b5f9a5753a91a950e73f | c:\Program Files\Glary Utilities 4\sysinfo.exe |
e01e55e5845718c691778178e01bad4d | c:\Program Files\Glary Utilities 4\uninst.exe |
9b179ffb7b8eb686d3949f734bc59e68 | c:\Program Files\Glary Utilities 4\upgrade.exe |
e4842b1d2fe2c157070d41606a44f7dd | c:\Program Files\Glary Utilities 4\zlib1.dll |
eef4e19b6392d74290805f0349b5d6f1 | c:\WINDOWS\system32\BootDefrag.exe |
3722f97e33cacab1d08b76abfccc2966 | c:\WINDOWS\system32\drivers\BootDefragDriver.sys |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
Integrator.exe:3452
taskkill.exe:2244
DiskDefrag.exe:2340
gu4setup.exe:2184
regedit.exe:2716
regedit.exe:3660
Initialize.exe:2656 - Delete the original Worm file.
- Delete or disinfect the following files created/modified by the Worm:
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\update[1].html (568 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\jquery.min[1].js (45771 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~gu3-ver.dat (107 bytes)
%Program Files%\Glary Utilities 4\data\AppSetting.ini (44667 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\news[1].ini (194 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\desktop.ini (67 bytes)
%Program Files%\Glary Utilities 4\data\backup.ini (9 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012014081520140816\index.dat (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\index[1].js (1177 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\redirect[1].php (107 bytes)
%Documents and Settings%\%current user%\Templates\GUTracksIni.tmp (42 bytes)
%Program Files%\Glary Utilities 4\news.ini (194 bytes)
%System%\BootDefrag.exe (601 bytes)
%System%\drivers\BootDefragDriver.sys (13 bytes)
%WinDir%\MrSoftware\gu4setup.exe (90809 bytes)
%WinDir%\MrSoftware\reg.reg (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\autB3.tmp (482 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\autB2.tmp (96206 bytes)
%Program Files%\Glary Utilities 4\skins\system information\others.png (544 bytes)
%Program Files%\Glary Utilities 4\languages.dll (1350 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\oc_btn_click.png (2 bytes)
%Program Files%\Glary Utilities 4\skins\icons\CheckUpdatehover.png (2 bytes)
%Program Files%\Glary Utilities 4\Native\wnet_x86\BootDefrag.exe (1615 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\systemcontrol.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsmB5.tmp\nsExec.dll (6 bytes)
%Program Files%\Glary Utilities 4\skins\system information\top.png (3 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\dockpopcurpage.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\systemtweaks.png (1 bytes)
%Program Files%\Glary Utilities 4\FileUndelete.exe (31651 bytes)
%Program Files%\Glary Utilities 4\Backup.dll (2695 bytes)
%Program Files%\Glary Utilities 4\Resources\Uninstaller\Large.png (3 bytes)
%Program Files%\Glary Utilities 4\Config.dll (26 bytes)
%Program Files%\Glary Utilities 4\DriverBackup.exe (6127 bytes)
%Program Files%\Glary Utilities 4\SpyRemover.dll (8263 bytes)
%Program Files%\Glary Utilities 4\skins\icons\emptyfolderfinder.png (1 bytes)
%Program Files%\Glary Utilities 4\Resources\DiskAnalysis\toolbar.png (7 bytes)
%Program Files%\Glary Utilities 4\data\BootTime.ini (3 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\filemanagement.png (1 bytes)
%Program Files%\Glary Utilities 4\Microsoft.VC90.CRT.manifest (524 bytes)
%Program Files%\Glary Utilities 4\skins\icons\regdefrag.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\skin_pic_normal.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\icons\fileencrypthover.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\icons\diskanalysishover.png (1 bytes)
%Program Files%\Glary Utilities 4\filesplitter.exe (2625 bytes)
%Program Files%\Glary Utilities 4\Resources\ProcessManager\ToolBar.png (6 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\oc_cancel_click.png (1 bytes)
%Program Files%\Glary Utilities 4\Resources\Uninstaller\Recently.png (3 bytes)
%Program Files%\Glary Utilities 4\languages\Slovak.lng (2711 bytes)
%Program Files%\Glary Utilities 4\Uninstaller.exe (7832 bytes)
%Program Files%\Glary Utilities 4\languages\hebrew.lng (1568 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\main_close.png (1 bytes)
%Program Files%\Glary Utilities 4\fileencrypt.exe (3595 bytes)
%Program Files%\Glary Utilities 4\languages\Romana.lng (2500 bytes)
%Documents and Settings%\All Users\Desktop\Glary Utilities 4.lnk (755 bytes)
%Program Files%\Glary Utilities 4\skins\icons\diskdefraghover.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\icons\registrycleaner.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\system information\drives.png (346 bytes)
%Program Files%\Glary Utilities 4\skins\system information\display.png (636 bytes)
%Program Files%\Glary Utilities 4\skins\icons\BrowserAssistanthover.png (1 bytes)
%Program Files%\Glary Utilities 4\Resources\DiskAnalysis\file_result.png (7 bytes)
%Program Files%\Glary Utilities 4\skins\icons\restorecenter.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\system information\cpu.png (372 bytes)
%Program Files%\Glary Utilities 4\skins\system information\network.png (618 bytes)
%Program Files%\Glary Utilities 4\skins\icons\fileundeletehover.png (1 bytes)
%Program Files%\Glary Utilities 4\Resources\Uninstaller\RarelyUsed.png (3 bytes)
%Program Files%\Glary Utilities 4\Resources\RegistryDefrag\regdefrag.png (25 bytes)
%Program Files%\Glary Utilities 4\Native\wxp_x86\RegBootDefrag.exe (22 bytes)
%Program Files%\Glary Utilities 4\skins\system information\topdown.png (3 bytes)
%Program Files%\Glary Utilities 4\skins\icons\fileundelete.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\checkbox_checked.png (1 bytes)
%Program Files%\Glary Utilities 4\LockDll.dll (20809 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\dockpopturnleft.png (2 bytes)
%Program Files%\Glary Utilities 4\languages\spain.lng (3093 bytes)
%Program Files%\Glary Utilities 4\languages\french.lng (3711 bytes)
%Program Files%\Glary Utilities 4\skins\icons\checkdiskhover.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\icons\BrowserAssistant.png (1 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Glary Utilities 4\Website.lnk (802 bytes)
%Program Files%\Glary Utilities 4\skins\icons\procmgrhover.png (1 bytes)
%Program Files%\Glary Utilities 4\Resources\Uninstaller\AllPrograms.png (3 bytes)
%Program Files%\Glary Utilities 4\Resources\CheckDisk\button_expand.png (3 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\oc_cancel_hover.png (1 bytes)
%Program Files%\Glary Utilities 4\BootTime.dll (20 bytes)
%Program Files%\Glary Utilities 4\languages\dutch.lng (1976 bytes)
%Program Files%\Glary Utilities 4\languages\english.lng (1897 bytes)
%Program Files%\Glary Utilities 4\languages\Finnish_(KBoost).lng (1678 bytes)
%Program Files%\Glary Utilities 4\joinExe.exe (1827 bytes)
%Program Files%\Glary Utilities 4\languages\italian.lng (2701 bytes)
%Program Files%\Glary Utilities 4\Native\wlh_x86\BootDefrag.exe (1578 bytes)
%Program Files%\Glary Utilities 4\DiskCleaner.dll (15221 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\diskspace.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\icons\driverbackup.png (1 bytes)
%Program Files%\Glary Utilities 4\msvcm90.dll (4349 bytes)
%Program Files%\Glary Utilities 4\skins\icons\restorecenterhover.png (1 bytes)
%Program Files%\Glary Utilities 4\RemoveDriver.dll (5165 bytes)
%Program Files%\Glary Utilities 4\CheckUpdate.dll (19685 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\main_right_top_mark_click_bg.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\pop_btn_normal.png (3 bytes)
%Program Files%\Glary Utilities 4\MemfilesService.exe (4526 bytes)
%Program Files%\Glary Utilities 4\Resources\Uninstaller\View.png (3 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\clear_tips.png (3 bytes)
%Program Files%\Glary Utilities 4\memdefrag.exe (3673 bytes)
%Program Files%\Glary Utilities 4\Native\wnet_x64\BootDefragDriver.sys (17 bytes)
%Program Files%\Glary Utilities 4\DiskDefrag.exe (12394 bytes)
%Program Files%\Glary Utilities 4\Resources\ProcessManager\RClickMenu.png (4 bytes)
%Program Files%\Glary Utilities 4\skins\default\backimages\bg1.jpg (4853 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\tab_ov_blue.png (3 bytes)
%Program Files%\Glary Utilities 4\Native\win7_x64\BootDefrag.exe (4197 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\tab_btn_hover.png (2 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\dockpopbg.png (3 bytes)
%Program Files%\Glary Utilities 4\skins\icons\checkdisk.png (1 bytes)
%Program Files%\Glary Utilities 4\languages\Greek.lng (3583 bytes)
%Program Files%\Glary Utilities 4\data\xb.dat (14600 bytes)
%Program Files%\Glary Utilities 4\skins\icons\shortcutfixerhover.png (2 bytes)
%Program Files%\Glary Utilities 4\skins\icons\startupmanager.png (2 bytes)
%Program Files%\Glary Utilities 4\languages\French(FR).lng (3564 bytes)
%Program Files%\Glary Utilities 4\languages\Francais.lng (3411 bytes)
%Program Files%\Glary Utilities 4\upgrade.exe (1964 bytes)
%Program Files%\Glary Utilities 4\DPInst32.exe (18153 bytes)
%Program Files%\Glary Utilities 4\data\xt.dat (26 bytes)
%Program Files%\Glary Utilities 4\data\backup.dat (864 bytes)
%Program Files%\Glary Utilities 4\Resources\EmptyFolderFinder\toolbar.png (6 bytes)
%Program Files%\Glary Utilities 4\languages\ukrainian.lng (2421 bytes)
%Program Files%\Glary Utilities 4\languages\French(CA).lng (1802 bytes)
%Program Files%\Glary Utilities 4\skins\icons\filesplitterhover.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\icons\diskcleaner.png (1 bytes)
%Program Files%\Glary Utilities 4\Native\win7_x86\BootDefrag.exe (1630 bytes)
%Program Files%\Glary Utilities 4\skins\icons\Uninstaller.png (2 bytes)
%Program Files%\Glary Utilities 4\skins\system information\memory.png (503 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\dockpopturnright.png (2 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\tab_ad_blue.png (3 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\pop_btn_click.png (3 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\main_feedback.png (1 bytes)
%Program Files%\Glary Utilities 4\languages\Czech.lng (2518 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsmB5.tmp\nsB6.tmp (6 bytes)
%Program Files%\Glary Utilities 4\Resources\SysInfo\NetworkNode.png (535 bytes)
%Program Files%\Glary Utilities 4\RestoreCenter.exe (1568 bytes)
%Program Files%\Glary Utilities 4\languages\Romania.lng (2446 bytes)
%Program Files%\Glary Utilities 4\StartupManager.exe (1568 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\systemstatus.png (1 bytes)
%Program Files%\Glary Utilities 4\CheckDisk.dll (4538 bytes)
%Program Files%\Glary Utilities 4\Native\wnet_x86\BootDefragDriver.sys (14 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\pop_btn_hover.png (3 bytes)
%Program Files%\Glary Utilities 4\Resources\settings\DiskCleanerImageList.bmp (25 bytes)
%Program Files%\Glary Utilities 4\data\duplicates.dat (288 bytes)
%Program Files%\Glary Utilities 4\Native\wlh_x86\BootDefragDriver.sys (14 bytes)
%Program Files%\Glary Utilities 4\QuickSearch.exe (9589 bytes)
%Program Files%\Glary Utilities 4\TracksEraser.dll (21815 bytes)
%Program Files%\Glary Utilities 4\Native\win7_x86\BootDefragDriver.sys (14 bytes)
%Program Files%\Glary Utilities 4\skins\icons\cmmhover.png (1 bytes)
%Program Files%\Glary Utilities 4\Log.dll (3673 bytes)
%Program Files%\Glary Utilities 4\cmm.exe (3849 bytes)
%Program Files%\Glary Utilities 4\skins\icons\shredder.png (1 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch\Glary Utilities 4.lnk (773 bytes)
%Program Files%\Glary Utilities 4\languages\French (Ad Lib).lng (2535 bytes)
%Program Files%\Glary Utilities 4\skins\icons\procmgr.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\tab_btn_normal.png (2 bytes)
%Program Files%\Glary Utilities 4\skins\default\backimages\bg6.jpg (1406 bytes)
%Program Files%\Glary Utilities 4\data\junkInfo.ini (1 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Glary Utilities 4\Uninstall.lnk (569 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\main_right_top_mark_sep.png (941 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\privacy.png (1 bytes)
%Program Files%\Glary Utilities 4\languages\chinese.lng (2317 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\search_mark.png (3 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\progress_bg.png (469 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\registry.png (1 bytes)
%Program Files%\Glary Utilities 4\languages\russian.lng (1862 bytes)
%Program Files%\Glary Utilities 4\skins\icons\driverbackuphover.png (1 bytes)
%Program Files%\Glary Utilities 4\Resources\DiskCleaner\toolbar.png (7 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\skinsbg.png (439 bytes)
%Program Files%\Glary Utilities 4\languages\turkish.lng (3258 bytes)
%Program Files%\Glary Utilities 4\skins\icons\Uninstallerhover.png (2 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\oc_cancel_normal.png (680 bytes)
%Program Files%\Glary Utilities 4\sysinfo.exe (10633 bytes)
%Program Files%\Glary Utilities 4\autodll.dll (2332 bytes)
%Program Files%\Glary Utilities 4\Resources\RegistryCleaner\Toolbar Default.png (6 bytes)
%Program Files%\Glary Utilities 4\dupefinder.exe (9324 bytes)
%Program Files%\Glary Utilities 4\skins\system information\normalhot.png (3 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\skin_custom.png (989 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\skin_col_normal.png (1 bytes)
%Program Files%\Glary Utilities 4\Resources\SysInfo\OtherDevicesNode.png (5 bytes)
%Program Files%\Glary Utilities 4\zlib1.dll (4242 bytes)
%Program Files%\Glary Utilities 4\skins\icons\registrycleanerhover.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\antimalware.png (1 bytes)
%Program Files%\Glary Utilities 4\CheckDiskProgress.exe (2104 bytes)
%Program Files%\Glary Utilities 4\Resources\InternetBooster\IBackGround.jpg (13 bytes)
%Program Files%\Glary Utilities 4\Native\wnet_x64\BootDefrag.exe (4149 bytes)
%Program Files%\Glary Utilities 4\skins\icons\trackseraserhover.png (1 bytes)
%Program Files%\Glary Utilities 4\DPInst64.exe (21501 bytes)
%Program Files%\Glary Utilities 4\data\startup.dat (2712 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\main_right_top_mark_hover_bg.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\main_close_click.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\icons\filesplitter.png (1 bytes)
%Program Files%\Glary Utilities 4\Integrator.exe (20633 bytes)
%Program Files%\Glary Utilities 4\EncryptExe.exe (10975 bytes)
%Program Files%\Glary Utilities 4\Undelete.dll (4085 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\progress.png (4 bytes)
%Program Files%\Glary Utilities 4\skins\default\backimages\bg7.jpg (1568 bytes)
%Program Files%\Glary Utilities 4\SoftwareUpdate.exe (7455 bytes)
%Program Files%\Glary Utilities 4\BottDefrag.dll (1946 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\menu_click.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\oc_detailbg.png (1 bytes)
%Program Files%\Glary Utilities 4\TracksEraser.exe (1568 bytes)
%Program Files%\Glary Utilities 4\languages\German.lng (2582 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\skintransparentmark.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\dockpopturnleftgray.png (1 bytes)
%Program Files%\Glary Utilities 4\Native\wxp_x86\BootDefragDriver.sys (13 bytes)
%Program Files%\Glary Utilities 4\settings.dll (9533 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\harddisk.png (1 bytes)
%Program Files%\Glary Utilities 4\languages\ukrainian2.lng (2222 bytes)
%Program Files%\Glary Utilities 4\skins\icons\emptyfolderfinderhover.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\oc_btn_hover.png (2 bytes)
%Program Files%\Glary Utilities 4\skins\icons\CheckUpdate.png (2 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\menu_normal.png (1 bytes)
%Program Files%\Glary Utilities 4\data\duplicatesfolder.dat (194 bytes)
%Program Files%\Glary Utilities 4\uninst.exe (2229 bytes)
%Program Files%\Glary Utilities 4\skins\icons\shortcutfixer.png (1 bytes)
%Program Files%\Glary Utilities 4\ObjectAdmin.dll (1765 bytes)
%Program Files%\Glary Utilities 4\Resources\TracksEraser\toolbar.png (6 bytes)
%Program Files%\Glary Utilities 4\Resources\SpyRemover\BKPic.png (1568 bytes)
%Program Files%\Glary Utilities 4\skins\icons\sysinfohover.png (1 bytes)
%Program Files%\Glary Utilities 4\procmgr.exe (7880 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\btn_click.png (2 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\body_transbg.png (8 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\main_close_hover.png (1 bytes)
%Program Files%\Glary Utilities 4\Resources\SysInfo\System Information.png (7 bytes)
%Program Files%\Glary Utilities 4\Native\wxp_x86\BootDefrag.exe (1613 bytes)
%Program Files%\Glary Utilities 4\Resources\settings\TracksEraseImageList.bmp (7 bytes)
%Program Files%\Glary Utilities 4\data\htmldata.dat (1 bytes)
%Program Files%\Glary Utilities 4\ScanFile.dll (1150 bytes)
%Program Files%\Glary Utilities 4\Resources\Uninstaller\WindowsUpdates.png (3 bytes)
%Program Files%\Glary Utilities 4\settings.ini (24 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\tab_ov.png (3 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\oc_btn_normal.png (2 bytes)
%Program Files%\Glary Utilities 4\languages\finnish.lng (1659 bytes)
%Program Files%\Glary Utilities 4\FileScanFilter.dll (9287 bytes)
%Program Files%\Glary Utilities 4\Native\wxp_x64\RegBootDefrag.exe (24 bytes)
%Program Files%\Glary Utilities 4\regdefrag.exe (3265 bytes)
%Program Files%\Glary Utilities 4\skins\icons\spyremover.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\oneclickmaintenance_front.png (2 bytes)
%Program Files%\Glary Utilities 4\skins\default\backimages\bg5.jpg (134 bytes)
%Program Files%\Glary Utilities 4\skins\icons\spyremoverhover.png (1 bytes)
%Program Files%\Glary Utilities 4\Glary Utilities 4.url (62 bytes)
%Program Files%\Glary Utilities 4\Resources\Dupefinder\tool.png (5 bytes)
%Program Files%\Glary Utilities 4\Resources\SysInfo\OperSysNode.png (9 bytes)
%Program Files%\Glary Utilities 4\msvcr90.dll (14706 bytes)
%Program Files%\Glary Utilities 4\languages\dutch2.lng (2980 bytes)
%Program Files%\Glary Utilities 4\languages\Magyar2.lng (4112 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\btn_normal.png (2 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\oneclick_progress.png (4 bytes)
%Program Files%\Glary Utilities 4\skins\icons\diskcleanerhover.png (1 bytes)
%Program Files%\Glary Utilities 4\shredder.exe (4681 bytes)
%Program Files%\Glary Utilities 4\skins\system information\windows.png (882 bytes)
%Program Files%\Glary Utilities 4\languages\Dutch3.lng (3098 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\dockpopturnrightgray.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\ov_boottimebg.png (3 bytes)
%Program Files%\Glary Utilities 4\data\junk.dat (1 bytes)
%Program Files%\Glary Utilities 4\Resources\ShortuctFixer\toolbar.png (9 bytes)
%Program Files%\Glary Utilities 4\ShortcutFixer.dll (7408 bytes)
%Program Files%\Glary Utilities 4\Resources\SysInfo\Picture.png (8 bytes)
%Program Files%\Glary Utilities 4\ShortcutFixer.exe (1568 bytes)
%Program Files%\Glary Utilities 4\OneClickMaintenance.exe (7818 bytes)
%Program Files%\Glary Utilities 4\languages\French(#DG#).lng (2590 bytes)
%Program Files%\Glary Utilities 4\DiskAnalysis.exe (10839 bytes)
%Program Files%\Glary Utilities 4\languages\arabic.lng (2806 bytes)
%Program Files%\Glary Utilities 4\Native\wlh_x64\BootDefrag.exe (4153 bytes)
%Program Files%\Glary Utilities 4\Native\wxp_x64\BootDefrag.exe (4099 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\main_min.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\menu_hover.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\default\backimages\bg3.jpg (1032 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Glary Utilities 4\Glary Utilities 4.lnk (767 bytes)
%Program Files%\Glary Utilities 4\skins\icons\sysinfo.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\icons\memdefrag.png (2 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\tab_oc.png (3 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\oneclick_bg.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\main_restore.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\main_like.png (1 bytes)
%Program Files%\Glary Utilities 4\languages\slovenian.lng (2096 bytes)
%Program Files%\Glary Utilities 4\Microsoft.VC90.MFC.manifest (548 bytes)
%Program Files%\Glary Utilities 4\languages\vietnamese.lng (3050 bytes)
%Program Files%\Glary Utilities 4\skins\icons\memdefraghover.png (2 bytes)
%Program Files%\Glary Utilities 4\data\empty.dat (478 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\oc_needclearbg.png (288 bytes)
%Program Files%\Glary Utilities 4\Resources\SysInfo\OverViewNode.png (8 bytes)
%Program Files%\Glary Utilities 4\languages\japanese.lng (2017 bytes)
%Program Files%\Glary Utilities 4\data\registry.dat (8 bytes)
%Program Files%\Glary Utilities 4\SpyRemover.exe (1568 bytes)
%Program Files%\Glary Utilities 4\msvcp90.dll (12049 bytes)
%Program Files%\Glary Utilities 4\RestoreCenter.dll (6654 bytes)
%Program Files%\Glary Utilities 4\languages\Danish.lng (4516 bytes)
%Program Files%\Glary Utilities 4\Resources\DiskDefrag\toolbar.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\system information\normaldown.png (3 bytes)
%Program Files%\Glary Utilities 4\skins\icons\dupefinder.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\icons\trackseraser.png (1 bytes)
%Program Files%\Glary Utilities 4\data\procsubmit.dat (1 bytes)
%Program Files%\Glary Utilities 4\skins\default\backimages\bg9.jpg (2712 bytes)
%Program Files%\Glary Utilities 4\RegistryCleaner.dll (13135 bytes)
%Program Files%\Glary Utilities 4\languages\polish.lng (2292 bytes)
%Program Files%\Glary Utilities 4\languages\chineseT.lng (3002 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\drivers.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\icons\dupefinderhover.png (1 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Glary Utilities 4.lnk (761 bytes)
%Program Files%\Glary Utilities 4\skins\icons\startupmanagerhover.png (2 bytes)
%Program Files%\Glary Utilities 4\Resources\StartupManager\toolbar.png (8 bytes)
%Program Files%\Glary Utilities 4\EmptyFolderFinder.exe (5963 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\btn_hover.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsmB5.tmp\System.dll (11 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\oneclickmaintenance_needclear_bg.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\default\backimages\bg4.jpg (21 bytes)
%Program Files%\Glary Utilities 4\Memfiles.dll (1838 bytes)
%Program Files%\Glary Utilities 4\StartupManager.dll (10956 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\tab_ad.png (3 bytes)
%Program Files%\Glary Utilities 4\skins\default\backimages\bg2.jpg (12 bytes)
%Program Files%\Glary Utilities 4\skins\icons\fileencrypt.png (1 bytes)
%Program Files%\Glary Utilities 4\data\apps.dat (8 bytes)
%Program Files%\Glary Utilities 4\gsd.exe (1236 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\logo.png (9 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\usertype_btn.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\oneclickmaintenance_bg.png (7 bytes)
%Program Files%\Glary Utilities 4\data\settings.dat (3 bytes)
%Program Files%\Glary Utilities 4\languages\Swedish.lng (3102 bytes)
%Program Files%\Glary Utilities 4\languages\ptbr.lng (2204 bytes)
%Program Files%\Glary Utilities 4\Resources\TurboMode\BackGround.jpg (16 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\dockpopdarkbg.png (1 bytes)
%Program Files%\Glary Utilities 4\DiskCleaner.exe (1568 bytes)
%Program Files%\Glary Utilities 4\data\xdata.dat (1568 bytes)
%Program Files%\Glary Utilities 4\Native\wxp_x64\BootDefragDriver.sys (17 bytes)
%Program Files%\Glary Utilities 4\CheckUpdate.exe (1568 bytes)
%Program Files%\Glary Utilities 4\skins\icons\quicksearchhover.png (1 bytes)
%Program Files%\Glary Utilities 4\languages\Magyar.lng (1728 bytes)
%Program Files%\Glary Utilities 4\skins\icons\diskdefrag.png (1 bytes)
%Program Files%\Glary Utilities 4\Native\win7_x64\BootDefragDriver.sys (17 bytes)
%Program Files%\Glary Utilities 4\ContextHandler.dll (1758 bytes)
%Program Files%\Glary Utilities 4\Resources\SysInfo\DisplayNode.png (5 bytes)
%Program Files%\Glary Utilities 4\Resources\SysInfo\SystemDevicesNode.png (4 bytes)
%Program Files%\Glary Utilities 4\skins\system information\computer.png (3 bytes)
%Program Files%\Glary Utilities 4\Resources\SysInfo\DrivesNode.png (6 bytes)
%Program Files%\Glary Utilities 4\skins\icons\SoftwareUpdate.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\default\backimages\bg8.jpg (914 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\dockpopcurpagegray.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\icons\SoftwareUpdatehover.png (1 bytes)
%Program Files%\Glary Utilities 4\languages\French_(RT).lng (3489 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\oc_btn_scan.png (1 bytes)
%Program Files%\Glary Utilities 4\languages\spanish.lng (2319 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\DockButton_Tip.png (2 bytes)
%Program Files%\Glary Utilities 4\iehelper.exe (17138 bytes)
%Program Files%\Glary Utilities 4\Native\wlh_x64\BootDefragDriver.sys (17 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\checkbox_uncheck.png (1 bytes)
%Program Files%\Glary Utilities 4\Resources\QuickSearch\images\quick_search_logo.png (3 bytes)
%Program Files%\Glary Utilities 4\CheckDisk.exe (1568 bytes)
%Program Files%\Glary Utilities 4\skins\icons\regdefraghover.png (1 bytes)
%Program Files%\Glary Utilities 4\Resources\settings\CleanRegistryImageList.bmp (18 bytes)
%Program Files%\Glary Utilities 4\data\process.dat (1568 bytes)
%Program Files%\Glary Utilities 4\skins\icons\diskanalysis.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\main_skin.png (1 bytes)
%Program Files%\Glary Utilities 4\languages\spanish (McM).lng (3122 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\programs.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\tab_oc_blue.png (3 bytes)
%Program Files%\Glary Utilities 4\RegistryCleaner.exe (2009 bytes)
%Program Files%\Glary Utilities 4\skins\icons\shredderhover.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\default\skin.ini (653 bytes)
%Program Files%\Glary Utilities 4\mfc90u.dll (27634 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\tab_btn_click.png (2 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\toolbar.png (3 bytes)
%Program Files%\Glary Utilities 4\skins\icons\quicksearch.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\foot_transbg.png (7 bytes)
%Program Files%\Glary Utilities 4\GridMap.ocx (9906 bytes)
%Program Files%\Glary Utilities 4\Initialize.exe (3586 bytes)
%Program Files%\Glary Utilities 4\skins\icons\cmm.png (1 bytes)
%WinDir%\Tasks\GlaryInitialize 4.job (316 bytes) - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
Static Analysis
VersionInfo
Company Name:
Product Name:
Product Version:
Legal Copyright: MrSoftware
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 4.4.0.8
File Description: Glary Utilities Pro
Comments: http://www.autoitscript.com/autoit3/
Language: English (United States)
Company Name: Product Name: Product Version: Legal Copyright: MrSoftwareLegal Trademarks: Original Filename: Internal Name: File Version: 4.4.0.8File Description: Glary Utilities ProComments: http://www.autoitscript.com/autoit3/Language: English (United States)
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
UPX0 | 4096 | 12668928 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
UPX1 | 12673024 | 352256 | 349696 | 5.49795 | 063ef6d73afbf2ef1664a0bb494203e9 |
.rsrc | 13025280 | 12136448 | 12134912 | 5.53807 | 3dc52a0037d5695db9ed77057d0fa6e6 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
URL | IP |
---|---|
hxxp://gu.glarysoft.com/boottime/service.php | 23.23.198.31 |
hxxp://d3dti4k49whnx0.cloudfront.net/news/news.ini | |
hxxp://d3dti4k49whnx0.cloudfront.net/redirect.php?pid=2&a=update&v=4.4.0.86&uid=9CE3DA09E740E6E75C87B4D2B8140F2C | |
hxxp://d3dti4k49whnx0.cloudfront.net/update/glary-utilities/update.html | |
hxxp://d3dti4k49whnx0.cloudfront.net/js/jquery.min.js | |
hxxp://d3dti4k49whnx0.cloudfront.net/js/index.js | |
hxxp://www.glarysoft.com/js/jquery.min.js | 54.230.39.141 |
hxxp://www.glarysoft.com/news/news.ini | 54.230.39.141 |
hxxp://www.glarysoft.com/redirect.php?pid=2&a=update&v=4.4.0.86&uid=9CE3DA09E740E6E75C87B4D2B8140F2C | 54.230.39.141 |
hxxp://www.glarysoft.com/js/index.js | 54.230.39.141 |
hxxp://www.glarysoft.com/update/glary-utilities/update.html | 54.230.39.141 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
<font color="red">GET /js/index.js HTTP/1.1<br>
Accept: */*<br>
Referer: hXXp://VVV.glarysoft.com/update/glary-utilities/update.html<br>
Accept-Language: en-us<br>
Accept-Encoding: gzip, deflate<br>
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)<br>
Host: VVV.glarysoft.com<br>
Connection: Keep-Alive<br>
<br>
</font><br><font color="blue">HTTP/1.1 200 OK<br>
Content-Type: text/javascript<br>
Content-Length: 10128<br>
Connection: keep-alive<br>
Date: Fri, 15 Aug 2014 08:51:15 GMT<br>
Server: Apache/2.2.15 (Red Hat)<br>
Last-Modified: Fri, 04 Jul 2014 03:34:48 GMT<br>
ETag: "23c8f-2790-4fd55cea7e600"<br>
Accept-Ranges: bytes<br>
Age: 36234<br>
X-Cache: Hit from cloudfront<br>
Via: 1.1 648e00a047edab76310001e837503ac0.cloudfront.net (CloudFront)<br>
<<< skipped >>>
<font color="red">GET /news/news.ini HTTP/1.1<br>
Accept: */*<br>
Accept-Encoding: gzip, deflate<br>
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)<br>
Host: VVV.glarysoft.com<br>
Connection: Keep-Alive<br>
<br>
</font><br><font color="blue">HTTP/1.1 200 OK<br>
Content-Type: text/plain; charset=UTF-8<br>
Content-Length: 194<br>
Connection: keep-alive<br>
Date: Thu, 14 Aug 2014 02:15:25 GMT<br>
Server: Apache/2.2.15 (Red Hat)<br>
Last-Modified: Thu, 13 Feb 2014 03:17:09 GMT<br>
ETag: "43145-c2-4f2411fe8f740"<br>
Accept-Ranges: bytes<br>
Age: 59970<br>
X-Cache: Hit from cloudfront<br>
Via: 1.1 8b02a8bc49ce2525e4b610c7a96eeda4.cloudfront.net (CloudFront)<br>
X-Amz-Cf-Id: wuqJeVfmR85jAgWSAeEFXqm_bGLBgtaruB56xpkJIA6fk06va-CGAg==<br><pre>#[New1]..Title=Disk Speedup 2.0 just released..URL=hXXp://VVV.glarysof<br>t.com/products/utilities/disk-speedup..#[New2]..Title=Christmas Specia<br>l offer - 50% off..URL=hXXp://VVV.glarysoft.com/..</font>....</pre></font><br><br><font color="red">GET /redirect.php?pid=2&a=update&v=4.4.0.86&uid=9CE3DA09E740E6E75C87B4D2B8140F2C HTTP/1.1<br>
Accept: */*<br>
Accept-Encoding: gzip, deflate<br>
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)<br>
Host: VVV.glarysoft.com<br>
Connection: Keep-Alive<br>
<br>
</font><br><font color="blue">HTTP/1.1 200 OK<br>
Content-Type: text/html; charset=UTF-8<br>
Content-Length: 107<br>
Connection: keep-alive<br>
Date: Fri, 15 Aug 2014 18:55:02 GMT<br>
Server: Apache/2.2.15 (Red Hat)<br>
X-Powered-By: PHP/5.3.3<br>
X-Cache: Miss from cloudfront<br>
Via: 1.1 8b02a8bc49ce2525e4b610c7a96eeda4.cloudfront.net (CloudFront)<br>
X-Amz-Cf-Id: N4485ox3QnZdZV-zXX1KRi64WbM--TjvOm37ARTQFQcXQQD2PTwQMQ==<br><pre>[Version]..Version=5.5.0.12..UpdateUrl=hXXp://VVV.glarysoft.com/glary-<br>utilities-pro/download/..Forcepop=3</font>....</pre></font><br><br><font color="red">GET /update/glary-utilities/update.html HTTP/1.1<br>
Accept: image/gif, image/jpeg, image/pjpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*<br>
Accept-Language: en-us<br>
Accept-Encoding: gzip, deflate<br>
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)<br>
Host: VVV.glarysoft.com<br>
Connection: Keep-Alive<br>
<br>
</font><br><font color="blue">HTTP/1.1 200 OK<br>
Content-Type: text/html; charset=UTF-8<br>
Content-Length: 2954<br>
Connection: keep-alive<br>
Date: Fri, 15 Aug 2014 02:24:38 GMT<br>
Server: Apache/2.2.15 (Red Hat)<br>
Last-Modified: Fri, 08 Aug 2014 02:59:36 GMT<br>
ETag: "23d49-b8a-5001565377600"<br>
Accept-Ranges: bytes<br>
Age: 59427<br>
X-Cache: Hit from cloudfront<br>
Via: 1.1 8b02a8bc49ce2525e4b610c7a96eeda4.cloudfront.net (CloudFront)<br>
<<< skipped >>>
Accept: */*<br>
Referer: hXXp://VVV.glarysoft.com/update/glary-utilities/update.html<br>
Accept-Language: en-us<br>
Accept-Encoding: gzip, deflate<br>
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)<br>
Host: VVV.glarysoft.com<br>
Connection: Keep-Alive<br>
<br>
</font><br><font color="blue">HTTP/1.1 200 OK<br>
Content-Type: text/javascript<br>
Content-Length: 91572<br>
Connection: keep-alive<br>
Date: Fri, 15 Aug 2014 02:21:10 GMT<br>
Server: Apache/2.2.15 (Red Hat)<br>
Last-Modified: Thu, 13 Feb 2014 03:17:09 GMT<br>
ETag: "23c94-165b4-4f2411fe8f740"<br>
Accept-Ranges: bytes<br>
Age: 59639<br>
X-Cache: Hit from cloudfront<br>
Via: 1.1 8b02a8bc49ce2525e4b610c7a96eeda4.cloudfront.net (CloudFront)<br>
<<< skipped >>>
<font color="red">POST /boottime/service.php HTTP/1.1<br>
Content-Length: 482<br>
Content-Type: text/xml; charset=utf-8<br>
SOAPAction: "hXXp://VVV.example.org/Mutual/NewOperation"<br>
Accept: text/xml<br>
Host: gu.glarysoft.com<br>
User-Agent: Microsoft-ATL-Native/9.00<br>
<br>
<soap:Envelope xmlns:soap="hXXp://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="hXXp://VVV.w3.org/2001/XMLSchema-instance" xmlns:xsd="hXXp://VVV.w3.org/2001/XMLSchema" xmlns:soapenc="hXXp://schemas.xmlsoap.org/soap/encoding/"><soap:Body soap:encodingStyle="hXXp://schemas.xmlsoap.org/soap/encoding/"><snp:getComNum xmlns:snp="hXXp://VVV.example.org/Mutual/"><type>0</type><time soapenc:arrayType="xsd:string[1]"><string>5</string></time></snp:getComNum></soap:Body></soap:Envelope></font><br><font color="blue">HTTP/1.1 200 OK<br>
Date: Fri, 15 Aug 2014 19:01:00 GMT<br>
Server: Apache/2.2.15 (Red Hat)<br>
X-Powered-By: PHP/5.3.3<br>
Content-Length: 673<br>
Connection: close<br>
Content-Type: text/xml; charset=utf-8<br><pre><?xml version="1.0" encoding="UTF-8"?>.<SOAP-ENV:Envelope xml<br>ns:SOAP-ENV="hXXp://schemas.xmlsoap.org/soap/envelope/" xmlns:ns1="htt<br>p://VVV.example.org/Mutual/" xmlns:xsd="hXXp://VVV.w3.org/2001/XMLSche<br>ma" xmlns:SOAP-ENC="hXXp://schemas.xmlsoap.org/soap/encoding/" xmlns:x<br>si="hXXp://VVV.w3.org/2001/XMLSchema-instance" xmlns:ns2="hXXp://schem<br>a" SOAP-ENV:encodingStyle="hXXp://schemas.xmlsoap.org/soap/encoding/"&<br>gt;<SOAP-ENV:Body><ns1:getComNumResponse><rtime SOAP-EN<br>C:arrayType="xsd:string[2]" xsi:type="ns2:ArrayOfString"><item x<br>si:type="xsd:string">216399520</item><item xsi:type="xsd:s<br>tring">44568</item></rtime></ns1:getComNumResponse&g<br>t;</SOAP-ENV:Body></SOAP-ENV:Envelope>...</pre></font><br><br
Map
The Worm connects to the servers at the folowing location(s):
Strings from Dumps
%original file name%.exe_1896:
`.rsrc
`.rsrc
,044d8.ZQ
,044d8.ZQ
PSSSSSSh
PSSSSSSh
Gt.Ht$
Gt.Ht$
t.jGZf;
t.jGZf;
PSSSh@
PSSSh@
PVSSh@
PVSSh@
f;Crt
f;Crt
?#%X.y
?#%X.y
GetProcessWindowStation
GetProcessWindowStation
operator
operator
This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.
This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.
kernel32.dll
kernel32.dll
oleaut32.dll
oleaut32.dll
RegDeleteKeyExW
RegDeleteKeyExW
advapi32.dll
advapi32.dll
Error text not found (please report)
Error text not found (please report)
operand of unlimited repeat could match the empty string
operand of unlimited repeat could match the empty string
POSIX named classes are supported only within a class
POSIX named classes are supported only within a class
erroffset passed as NULL
erroffset passed as NULL
POSIX collating elements are not supported
POSIX collating elements are not supported
this version of PCRE is compiled without UTF support
this version of PCRE is compiled without UTF support
PCRE does not support \L, \l, \N{name}, \U, or \u
PCRE does not support \L, \l, \N{name}, \U, or \u
support for \P, \p, and \X has not been compiled
support for \P, \p, and \X has not been compiled
this version of PCRE is not compiled with Unicode property support
this version of PCRE is not compiled with Unicode property support
\N is not supported in a class
\N is not supported in a class
zcÃ
zcÃ
GetProcessHeap
GetProcessHeap
CreatePipe
CreatePipe
GetWindowsDirectoryW
GetWindowsDirectoryW
GetCPInfo
GetCPInfo
RegDeleteKeyW
RegDeleteKeyW
RegEnumKeyExW
RegEnumKeyExW
RegCreateKeyExW
RegCreateKeyExW
RegOpenKeyExW
RegOpenKeyExW
RegCloseKey
RegCloseKey
SetViewportOrgEx
SetViewportOrgEx
ShellExecuteExW
ShellExecuteExW
SHFileOperationW
SHFileOperationW
ShellExecuteW
ShellExecuteW
RegisterHotKey
RegisterHotKey
GetKeyboardLayoutNameW
GetKeyboardLayoutNameW
ExitWindowsEx
ExitWindowsEx
EnumThreadWindows
EnumThreadWindows
UnregisterHotKey
UnregisterHotKey
keybd_event
keybd_event
GetAsyncKeyState
GetAsyncKeyState
SetKeyboardState
SetKeyboardState
GetKeyboardState
GetKeyboardState
GetKeyState
GetKeyState
VkKeyScanW
VkKeyScanW
EnumWindows
EnumWindows
EnumChildWindows
EnumChildWindows
MapVirtualKeyW
MapVirtualKeyW
CloseWindowStation
CloseWindowStation
SetProcessWindowStation
SetProcessWindowStation
OpenWindowStationW
OpenWindowStationW
InternetCrackUrlW
InternetCrackUrlW
HttpQueryInfoW
HttpQueryInfoW
HttpOpenRequestW
HttpOpenRequestW
HttpSendRequestW
HttpSendRequestW
FtpOpenFileW
FtpOpenFileW
FtpGetFileSize
FtpGetFileSize
InternetOpenUrlW
InternetOpenUrlW
##@,&,//,))
##@,&,//,))
.jQE2
.jQE2
4`%ud*
4`%ud*
3(-,'')-*/%'
3(-,'')-*/%'
9(***3).**-)'
9(***3).**-)'
H%d=j@
H%d=j@
0!;....(
0!;....(
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
@.reloc
@.reloc
4`%ud
4`%ud
-%U)iQ
-%U)iQ
.rT%X
.rT%X
sQL"|
sQL"|
g.Te$o
g.Te$o
3X7.pk-
3X7.pk-
&.HXj
&.HXj
o.QYw
o.QYw
(.DfH7
(.DfH7
.JW!EU
.JW!EU
0o.id"
0o.id"
Hq,%S
Hq,%S
g.iD{
g.iD{
.bnh]
.bnh]
sS.os
sS.os
.MGpK
.MGpK
t@.St%
t@.St%
"n_ .ji
"n_ .ji
c--u%c
c--u%c
udPv
udPv
IÃ'!
IÃ'!
%cPHO
%cPHO
G~|N:1%C
G~|N:1%C
.jCnxf`uZ eE
.jCnxf`uZ eE
#Zy.qS
#Zy.qS
.rTX"
.rTX"
Sl.Ka
Sl.Ka
%X F.
%X F.
O]%dOg
O]%dOg
%x1^D
%x1^D
[J.fgu
[J.fgu
@Ñ7v
@Ñ7v
-BwV}
-BwV}
5.koDqCY
5.koDqCY
\m.NS
\m.NS
$l.Zkj}?
$l.Zkj}?
Qm.mwF
Qm.mwF
t~.aQVx*
t~.aQVx*
on%uV
on%uV
.wR}qO
.wR}qO
8J%fKG
8J%fKG
%f/`Ge
%f/`Ge
y_$
y_$
g|.trD
g|.trD
*,>.cj
*,>.cj
Y.Gvd
Y.Gvd
bI.M.Bz
bI.M.Bz
9$$%X?{
9$$%X?{
=.Gw4>
=.Gw4>
.QAu!Ue
.QAu!Ue
.GWp~
.GWp~
"0.KH*
"0.KH*
y.VG]
y.VG]
nudp
nudp
$Q.qj8
$Q.qj8
"-b}&%
"-b}&%
{56Û
{56Û
;.kx#0
;.kx#0
-9XV}
-9XV}
b .DH
b .DH
Fc%c|KM%
Fc%c|KM%
@Mln.exp
@Mln.exp
'mUj.Zo,
'mUj.Zo,
`T.kF~
`T.kF~
x)z-9jM}
x)z-9jM}
_!a%d
_!a%d
T.Qkt
T.Qkt
'T.LGDp1
'T.LGDp1
z .qH
z .qH
Yk:%S
Yk:%S
.xoKl
.xoKl
W.Zjc
W.Zjc
%XH t
%XH t
.gs* g
.gs* g
.DOFM
.DOFM
[.ri?[
[.ri?[
AC.MUq
AC.MUq
.aBwb#a
.aBwb#a
l.Au3
l.Au3
A/%x *
A/%x *
rd~\rCRt
rd~\rCRt
k1%uB
k1%uB
yi.yK
yi.yK
.yCpK
.yCpK
^d.QRQ
^d.QRQ
q.pL%s%t#
q.pL%s%t#
~7.Ps
~7.Ps
P'[%C
P'[%C
.&.HN
.&.HN
r.pZm,
r.pZm,
%ULm4J
%ULm4J
h.oYk
h.oYk
E.UHWQ0
E.UHWQ0
Tz.KoH
Tz.KoH
U.YTUQ
U.YTUQ
v1;-J}
v1;-J}
YN=%C;
YN=%C;
k|%x.I
k|%x.I
.cj[4
.cj[4
.WNWQ}
.WNWQ}
-v}Bf"
-v}Bf"
#%FJ^l
#%FJ^l
yb@%F
yb@%F
%d`N'
%d`N'
q'*.QE
q'*.QE
v.egZ
v.egZ
Y_,%Us jr
Y_,%Us jr
qY %s
qY %s
-7Ui}
-7Ui}
q&%Uk
q&%Uk
`<.eq>
`<.eq>
Q%Sbh
Q%Sbh
Vm'S{sÅ’G
Vm'S{sÅ’G
.rVFY
.rVFY
jr.lv
jr.lv
%cyeZ|
%cyeZ|
.nXh|
.nXh|
>u.ff
>u.ff
gr&[5%f
gr&[5%f
.gnJ\2=
.gnJ\2=
z.rH5u
z.rH5u
.WD6:
.WD6:
Wx..Le
Wx..Le
.U%SsF
.U%SsF
!%fjE
!%fjE
[,0%cuJ
[,0%cuJ
%Xm]5H@
%Xm]5H@
.Xsm9
.Xsm9
$.ET\
$.ET\
3g%Doo
3g%Doo
>l.UIL
>l.UIL
{.am;G
{.am;G
"~l%X
"~l%X
%US_2
%US_2
t.ewe::
t.ewe::
A]vp~I%f)r
A]vp~I%f)r
@7%U9
@7%U9
2S.itx
2S.itx
FI.lEO:
FI.lEO:
.lG2&
.lG2&
:%Sfni
:%Sfni
gBC.bm
gBC.bm
@LÃ
@LÃ
!3;.Aq
!3;.Aq
r"Xu.RD
r"Xu.RD
h%XGVt
h%XGVt
k97-k4o}
k97-k4o}
A%f(n
A%f(n
X.ecq
X.ecq
.EYPb1
.EYPb1
D#.Qn
D#.Qn
].vN*3Af
].vN*3Af
!\8.Ufz
!\8.Ufz
.VlU~
.VlU~
L.ff=
L.ff=
9.eBZ
9.eBZ
%xMNx
%xMNx
]a{.vZG_
]a{.vZG_
|UQ%f
|UQ%f
.yw5_}S
.yw5_}S
_6-{Q6
_6-{Q6
.qzx.
.qzx.
.pi4>
.pi4>
U0c%S3
U0c%S3
!T.lC
!T.lC
wo.ZZ
wo.ZZ
v!.BI
v!.BI
;ËE
;ËE
;.kmY
;.kmY
\.CGu
\.CGu
})%Cyu?
})%Cyu?
0ye%F
0ye%F
×>K
×>K
@.KXT
@.KXT
.RWe*
.RWe*
`98%s
`98%s
tw.gw
tw.gw
I|-%U0taK
I|-%U0taK
9[r~%c
9[r~%c
`2"Yj.af
`2"Yj.af
[Q.BV2,
[Q.BV2,
X%fp^
X%fp^
.PFxo
.PFxo
%W.Si
%W.Si
.KB(;f
.KB(;f
.hXV{
.hXV{
nf.zcX"
nf.zcX"
HSql
HSql
Lg%s*
Lg%s*
#.tO%,
#.tO%,
Q#2x%x
Q#2x%x
-mRQ}
-mRQ}
C=Fnf%S
C=Fnf%S
.LloD
.LloD
X]A.hd>
X]A.hd>
.nhoe
.nhoe
.yu)%
.yu)%
.aAiG
.aAiG
|!R.jn
|!R.jn
-R.HU
-R.HU
" .vnR
" .vnR
%u\6}xn
%u\6}xn
@E %F
@E %F
.bD8eTM3{B
.bD8eTM3{B
d.FcP,
d.FcP,
%sqzA
%sqzA
.RQ^z
.RQ^z
@PLy%u
@PLy%u
Ã’n#
Ã’n#
n.Ir~
n.Ir~
F!W%D
F!W%D
E1.Es
E1.Es
&.Aw#
&.Aw#
s.Yl;_
s.Yl;_
!.yE0P:
!.yE0P:
`HA%C
`HA%C
%dV4~
%dV4~
.Wvgi
.Wvgi
o.UWU
o.UWU
.eYU]^`
.eYU]^`
.tzct
.tzct
Tq.nd}7
Tq.nd}7
6j.E%S!
6j.E%S!
Zl/.Zm-dA>
Zl/.Zm-dA>
),.lf
),.lf
s.rFi
s.rFi
w.ZM?E
w.ZM?E
%siWct
%siWct
<.tht>
<.tht>
y.MSF
y.MSF
7]L@%c
7]L@%c
6S%uu
6S%uu
%CoHA4
%CoHA4
.rlXn
.rlXn
qh.KB~%i
qh.KB~%i
TU.YJ
TU.YJ
|}.Bv\G
|}.Bv\G
P,=-.mKM
P,=-.mKM
CS"%f
CS"%f
A6|P.WBC
A6|P.WBC
nEG.Oh
nEG.Oh
.JY"yGq
.JY"yGq
YC.gv
YC.gv
{.Ur3
{.Ur3
CRTF(=
CRTF(=
5F-zP.JAa^y
5F-zP.JAa^y
BF.Ab
BF.Ab
.PA(p
.PA(p
Ã32
Ã32
A.Jl8D
A.Jl8D
3%C@'
3%C@'
rd.grA
rd.grA
.rU8#E
.rU8#E
.JQ?h
.JQ?h
ü_m
ü_m
o.PuV
o.PuV
.WeW7GI
.WeW7GI
.uM&5/
.uM&5/
.vml(H=?H
.vml(H=?H
BMKCmD
BMKCmD
Qs.BI
Qs.BI
q[k!zm.rW`
q[k!zm.rW`
kU
kU
.Ib$u
.Ib$u
m.rze
m.rze
^{.Vz=?
^{.Vz=?
]D2%c)
]D2%c)
~C?.oM
~C?.oM
]kP@%Fx#
]kP@%Fx#
.bQVT
.bQVT
4$.Zh
4$.Zh
(H:%X
(H:%X
W"y0%F
W"y0%F
rN$%D
rN$%D
d.lq|
d.lq|
_YS
_YS
Xcrt
Xcrt
a.On6K
a.On6K
bo0.NU
bo0.NU
.GTLz(}
.GTLz(}
.VsIV
.VsIV
%x8<: r>
%x8<: r>
.tXKP
.tXKP
&H.tb
&H.tb
H.P.lQ
H.P.lQ
TY.Uc
TY.Uc
T7-J}
T7-J}
Z1*.oU
Z1*.oU
py.XWo
py.XWo
.YhOR
.YhOR
.Uo}01
.Uo}01
%d`1v6|X
%d`1v6|X
F=.c/%c
F=.c/%c
VZ?%F
VZ?%F
[/Z%X
[/Z%X
.nv0(
.nv0(
TQwEb
TQwEb
ht%fQT
ht%fQT
Gs%d-
Gs%d-
..Gtz
..Gtz
`}.pw
`}.pw
-yaYa}
-yaYa}
%?e%F
%?e%F
O;.vt
O;.vt
J~.eZN
J~.eZN
4/%Ck
4/%Ck
%Dt .
%Dt .
Y.YW~\pSgN
Y.YW~\pSgN
1-6}^.
1-6}^.
%U:jO
%U:jO
7K.AwY
7K.AwY
t .Is
t .Is
'.os1
'.os1
DO.oo
DO.oo
:urLA
:urLA
9Ne.Ce
9Ne.Ce
Nudp
Nudp
^-.YR
^-.YR
.xeRm
.xeRm
túNP
túNP
A3.Tv
A3.Tv
$ b%C
$ b%C
F.lR:}i
F.lR:}i
.cC091
.cC091
z.JO*\
z.JO*\
%Fwx~X
%Fwx~X
.FX^d
.FX^d
{2=CDn%sUA,
{2=CDn%sUA,
BZ.dP
BZ.dP
C.am=H
C.am=H
hxoE.cQ@
hxoE.cQ@
.gJdQ
.gJdQ
.dU/"
.dU/"
@T%D(-
@T%D(-
r*6.Jt
r*6.Jt
G.Zyos
G.Zyos
u>.Rw
u>.Rw
.dvFmB>
.dvFmB>
.NYV.
.NYV.
ahJ%c
ahJ%c
?%frX\
?%frX\
H_.kA(4
H_.kA(4
=udp(xl
=udp(xl
%FSVR!
%FSVR!
V%D
V%D
5.RHr
5.RHr
d%C*
d%C*
.xCh&
.xCh&
r.nvD
r.nvD
2.nA/J[e
2.nA/J[e
]O%%D&
]O%%D&
r#oÊ
r#oÊ
xf^Ÿ
xf^Ÿ
%sTtS
%sTtS
&qi%F
&qi%F
[,%fV
[,%fV
Q.Ic%g
Q.Ic%g
ZaL.SZ5
ZaL.SZ5
.bqjK\
.bqjK\
\web4\V
\web4\V
$%U%f
$%U%f
.gBgh
.gBgh
.ei0\z
.ei0\z
vS-hm}t
vS-hm}t
v.QPh
v.QPh
.ds:/
.ds:/
.pMxh2
.pMxh2
.aqG"
.aqG"
K.Df%
K.Df%
1H.Jt
1H.Jt
o.bQR_%
o.bQR_%
*.uMt
*.uMt
.vPKz
.vPKz
%dRW%
%dRW%
aH8.KaE
aH8.KaE
G%U`|
G%U`|
3.yV@
3.yV@
%F,eH)=
%F,eH)=
!X4%X
!X4%X
Gg0%fw
Gg0%fw
,.jso
,.jso
S2%u_>f
S2%u_>f
]w!.Yl'
]w!.Yl'
.PL%RvD8
.PL%RvD8
8`T%u
8`T%u
hq.AW
hq.AW
l=%C\,
l=%C\,
G]d4".SA
G]d4".SA
.yAV&
.yAV&
3g-D}
3g-D}
OI.uL
OI.uL
b)C1`.CZY
b)C1`.CZY
Zg%u5>ES
Zg%u5>ES
.fod"9
.fod"9
.WJ}sz
.WJ}sz
.qfZA
.qfZA
bAg$.Jz
bAg$.Jz
J8}.MJ
J8}.MJ
nH.gP~h >C
nH.gP~h >C
`.azj
`.azj
%f,r\
%f,r\
{p%S>
{p%S>
4$o.us
4$o.us
Q:C%F
Q:C%F
.sq-9
.sq-9
FGb.Cl?
FGb.Cl?
BY!%f
BY!%f
HL/K,%S
HL/K,%S
.ZY'd
.ZY'd
.Df92
.Df92
.Zl>ld
.Zl>ld
iQ-%c
iQ-%c
6L%X\
6L%X\
.HHgUju
.HHgUju
iÔ)
iÔ)
%xvxh
%xvxh
.wNza
.wNza
R.UNe
R.UNe
VK.dIZ
VK.dIZ
j%x=U$
j%x=U$
%sVLR#t^
%sVLR#t^
!3.diq
!3.diq
/L%f%
/L%f%
.Ri@K,
.Ri@K,
.pJ-;
.pJ-;
|.fKM^
|.fKM^
-Ux}m
-Ux}m
8.oXz
8.oXz
j%U}Fq
j%U}Fq
X|.az
X|.az
%xsE~
%xsE~
|F.HOK
|F.HOK
q4%S:
q4%S:
}E%F/
}E%F/
`.ca|
`.ca|
j%S5;2
j%S5;2
aSQl
aSQl
.YsOM
.YsOM
WXW.TIG
WXW.TIG
F.jv
F.jv
.dOmDs
.dOmDs
8.MkYV
8.MkYV
h .tYrlv
h .tYrlv
.UyZ^
.UyZ^
`x-
`x-
6x.Wi&T
6x.Wi&T
"D"%c
"D"%c
pP.IL
pP.IL
p`%D)\
p`%D)\
u.Chs
u.Chs
c%x*!9
c%x*!9
%s|L4>
%s|L4>
j-9%U
j-9%U
m.blM
m.blM
r[mu.zg
r[mu.zg
(p`%U
(p`%U
[f.dj
[f.dj
bk.rk
bk.rk
%drpb
%drpb
j\.Kp
j\.Kp
=.gI[D
=.gI[D
Dn.Yq
Dn.Yq
nU.Ng
nU.Ng
# %x,oLv
# %x,oLv
!.UFUI
!.UFUI
YG.VUb
YG.VUb
%f}g5
%f}g5
{%u&k
{%u&k
xI%S
xI%S
.xE -
.xE -
y&s`.wp
y&s`.wp
%s{Bi
%s{Bi
u75.#%U
u75.#%U
y.ls/QFJ
y.ls/QFJ
@5.Sj
@5.Sj
Urly
Urly
.Dj&B_.
.Dj&B_.
s,N%F
s,N%F
^.Pxi 6F
^.Pxi 6F
;0Þ
;0Þ
.VUa
.VUa
"^
"^
>MO%UW
>MO%UW
B=ý
B=ý
Ç(1f
Ç(1f
z?.Ym
z?.Ym
( EhO.vx
( EhO.vx
K8%c@
K8%c@
z%(%C
z%(%C
.q%D?
.q%D?
.Mp/P
.Mp/P
(v%so
(v%so
t.swP
t.swP
1r.Cz
1r.Cz
.yJh(
.yJh(
g7 ø
g7 ø
D)pV%s2
D)pV%s2
.qZ3PQ
.qZ3PQ
N0>%f
N0>%f
)=.JpCi
)=.JpCi
%UpV-
%UpV-
lP.hg
lP.hg
B.wI|k
B.wI|k
.CeC%
.CeC%
M*.fB
M*.fB
%SU[V
%SU[V
=8.XV
=8.XV
9y.sUy&
9y.sUy&
NF.CL
NF.CL
.tEp:%Q
.tEp:%Q
r-.B.M.OeQ
r-.B.M.OeQ
.zt W
.zt W
q.Vba
q.Vba
#w.qh'N
#w.qh'N
`%xG"j
`%xG"j
)}.cy
)}.cy
8.TSHT
8.TSHT
4/.ixz]
4/.ixz]
|4ew.ae
|4ew.ae
D6.Cv
D6.Cv
gW9%C
gW9%C
$.iB}ltw
$.iB}ltw
P.len
P.len
9ZG
9ZG
H.nE]'J
H.nE]'J
.NkTw
.NkTw
XõY[
XõY[
NI.Gs
NI.Gs
.xN8A
.xN8A
f%XeJ
f%XeJ
)(%DuJ{eM
)(%DuJ{eM
'.cbH2
'.cbH2
Di.Tv
Di.Tv
Q.PQQ
Q.PQQ
e.xz1KO
e.xz1KO
P:\~1
P:\~1
s3%C:
s3%C:
Q:\ L
Q:\ L
}\/%X
}\/%X
xM.Dku%
xM.Dku%
~fB.vY
~fB.vY
d%C#JV
d%C#JV
qtg%D=
qtg%D=
ew*.Qh`]
ew*.Qh`]
.TjpT
.TjpT
:=.Fz
:=.Fz
>#.SW
>#.SW
@.rHu
@.rHu
JG.aS
JG.aS
C.fX[
C.fX[
.on)*
.on)*
4kEJ.vK
4kEJ.vK
=)Ü
=)Ü
.buew
.buew
I.Ss*
I.Ss*
.nkDD
.nkDD
`Us.In
`Us.In
.Sdpm
.Sdpm
L.eN2}4I
L.eN2}4I
jh.sX
jh.sX
v.rf:
v.rf:
.xg@?
.xg@?
)L-g}
)L-g}
J.BX55
J.BX55
.qu^8
.qu^8
"%FzL
"%FzL
Ks %d
Ks %d
.tWcg
.tWcg
k.Qq0
k.Qq0
"F.nM
"F.nM
-1Xf}Z
-1Xf}Z
GQ
GQ
R:%dI'SIT
R:%dI'SIT
45=%U
45=%U
vT.Rs|V
vT.Rs|V
0e.Akq
0e.Akq
%sv$m
%sv$m
FNm%S
FNm%S
fj.Em
fj.Em
;.gIGI
;.gIGI
.Mt|ko
.Mt|ko
-U[.fz
-U[.fz
!.sSq7S
!.sSq7S
E.LW\(
E.LW\(
k.cwQ
k.cwQ
F\%x n
F\%x n
Ye`h%X
Ye`h%X
.vxOk
.vxOk
~.Pg.
~.Pg.
.LX{CP
.LX{CP
-T}**i
-T}**i
C.jso
C.jso
?Z6[%Fs
?Z6[%Fs
V.Tt_
V.Tt_
%U1O$%P8
%U1O$%P8
.DD12:
.DD12:
.WqR&%
.WqR&%
KI.HZ
KI.HZ
.kt8Xx
.kt8Xx
.Uw!wd
.Uw!wd
U.uUy>
U.uUy>
!.wKf
!.wKf
#i.bq
#i.bq
tcPTj>N
tcPTj>N
<.vy>
<.vy>
%dOoE
%dOoE
w%CR,r
w%CR,r
Zv.Em
Zv.Em
%u[BY
%u[BY
*}y6%x
*}y6%x
V5G%u
V5G%u
.IxiM
.IxiM
[.yjqE
[.yjqE
h.cs"(A>
h.cs"(A>
%7uO/v*
%7uO/v*
Nu.rHD
Nu.rHD
IN%Ct&^a
IN%Ct&^a
A.cm/
A.cm/
$d=.IG
$d=.IG
aaÃ^_E
aaÃ^_E
Kd=.HY^
Kd=.HY^
.DcR.T
.DcR.T
{.sKs
{.sKs
n%DsZ:"
n%DsZ:"
.NF5l
.NF5l
,Tcp@
,Tcp@
np?(L%X
np?(L%X
%U9=y
%U9=y
Q.lob
Q.lob
ld.hn~
ld.hn~
.yI~2
.yI~2
*%U{*
*%U{*
%Dl?A
%Dl?A
.VjJ-
.VjJ-
0p%F~
0p%F~
$2k M%X
$2k M%X
St%xY1i
St%xY1i
.lZ9H
.lZ9H
`%x_m
`%x_m
q.aI~
q.aI~
E%%xI
E%%xI
5'y.Gc
5'y.Gc
f#.CMbm(>^
f#.CMbm(>^
/wc%x
/wc%x
.dpc4
.dpc4
aDU%u
aDU%u
.nb33
.nb33
Å’g]
Å’g]
3|3.ZmQ
3|3.ZmQ
g].Srt
g].Srt
CnÜ
CnÜ
J.mCjt
J.mCjt
RI[z.wg
RI[z.wg
Wo0
Wo0
N'L%x
N'L%x
.My12Dxc
.My12Dxc
yqr%Cv
yqr%Cv
MsGm
MsGm
/"7f1k2].Lw
/"7f1k2].Lw
.qp!Bve;
.qp!Bve;
NxU%f&
NxU%f&
\Q.gM
\Q.gM
%Xpc[
%Xpc[
B.Mt?
B.Mt?
>.tZN,9
>.tZN,9
HR%s.
HR%s.
f.pS?
f.pS?
I.aJ)
I.aJ)
uC%fKl0
uC%fKl0
a.hvE
a.hvE
.mi&y
.mi&y
WeBemj
WeBemj
'iy%Ss
'iy%Ss
.Xt C
.Xt C
|s%s\
|s%s\
X$l\%Fg
X$l\%Fg
~%f&q
~%f&q
j.gf(D
j.gf(D
.EGopl
.EGopl
_.Rrk
_.Rrk
U.Wv:
U.Wv:
%|po.G.Rc
%|po.G.Rc
J%xC`Q
J%xC`Q
^.EiY
^.EiY
.Gr$.
.Gr$.
Wq%xK 1
Wq%xK 1
2M}%U
2M}%U
%ClO?
%ClO?
_b7
_b7
.ZTG[
.ZTG[
#hs.hJp~
#hs.hJp~
VIRO.Om
VIRO.Om
x.zcK
x.zcK
37.WOT
37.WOT
|.eb>
|.eb>
h.Ejsdc
h.Ejsdc
zu%C,?
zu%C,?
S\O%uQf
S\O%uQf
o.WO`a
o.WO`a
$-m}M{1g
$-m}M{1g
8JA%fq
8JA%fq
-,M.PV
-,M.PV
/N%S L
/N%S L
~9.fO
~9.fO
%Sy})
%Sy})
i-c}O)
i-c}O)
-%%4U
-%%4U
MD.MK
MD.MK
<.ipe>
<.ipe>
d.gc.
d.gc.
HC.ait
HC.ait
.xl-2
.xl-2
9?q~%X!%I
9?q~%X!%I
Za.dEF
Za.dEF
h>dK%F
h>dK%F
Z.Ee)
Z.Ee)
.Qn$i
.Qn$i
xi3.rq
xi3.rq
.oum%
.oum%
#Z.ujp
#Z.ujp
[%xF"
[%xF"
G.Zer
G.Zer
l.Ur9
l.Ur9
CU.Yh
CU.Yh
.MeF}mYQ
.MeF}mYQ
.DZ){
.DZ){
r%5%f
r%5%f
urLyYog
urLyYog
.sakLm
.sakLm
y.UF(NJ
y.UF(NJ
`.uzL
`.uzL
e(O.SzY
e(O.SzY
:.eM
:.eM
]U%X,
]U%X,
8%x{
8%x{
l %D$
l %D$
.%uVd~UB
.%uVd~UB
.dreD
.dreD
Xo2
Xo2
>l.Ov5
>l.Ov5
mziV.LW
mziV.LW
ZBs%s
ZBs%s
ci.kx
ci.kx
ÃŒfM
ÃŒfM
x0.as
x0.as
j%FkX3l
j%FkX3l
{~.KT
{~.KT
.ngDL
.ngDL
D%D%wu
D%D%wu
s].fT
s].fT
9)J%C=
9)J%C=
`d.Ii
`d.Ii
9D%xD
9D%xD
J.GX#
J.GX#
J-G}>
J-G}>
H.mx&$
H.mx&$
P.lz|O
P.lz|O
oZ"5%F
oZ"5%F
&DFTP
&DFTP
t.xGC*
t.xGC*
.bGG;
.bGG;
Y84?%s
Y84?%s
eK%X!
eK%X!
z.Eh6=j
z.Eh6=j
%shpQ
%shpQ
}Fb(.BL
}Fb(.BL
%5x
%5x
!Z0:%u
!Z0:%u
\]P%U
\]P%U
$%0s:3
$%0s:3
.EnFD:
.EnFD:
Y%f/9Ss?
Y%f/9Ss?
h%uk/
h%uk/
.my"f
.my"f
E|%]%U
E|%]%U
DdL.LU
DdL.LU
wFH.Nx
wFH.Nx
A.aIcVE
A.aIcVE
e..kx
e..kx
%US
%US
.hc5h]
.hc5h]
H%x~jy*
H%x~jy*
.yMdC
.yMdC
eVo.WF
eVo.WF
".fD/bq
".fD/bq
iÓ?
iÓ?
.Re`@
.Re`@
xMsG
xMsG
%u7:2
%u7:2
r-t}W]
r-t}W]
6.bdy
6.bdy
t/`%s.
t/`%s.
K}8-Z}
K}8-Z}
W.he8
W.he8
s%Ufj
s%Ufj
Ãst
Ãst
6B5;%f
6B5;%f
)u%s;4{
)u%s;4{
.DYS:'
.DYS:'
6b.bn
6b.bn
z.CUr
z.CUr
.ROIHw
.ROIHw
wWU%s
wWU%s
.HLK_-
.HLK_-
<.mo>
<.mo>
2*%cG
2*%cG
iTb.ub
iTb.ub
%7s#@
%7s#@
gz.VnnBe
gz.VnnBe
~[k%f
~[k%f
|.KTXQD
|.KTXQD
y2.LT
y2.LT
zf.Kx
zf.Kx
%d(Vva
%d(Vva
=%2u1~
=%2u1~
T.CprA)
T.CprA)
P.qPG
P.qPG
Z.ILz
Z.ILz
.SmIo
.SmIo
[4.UE2
[4.UE2
.BdC7
.BdC7
m%CV|.
m%CV|.
%u Pi
%u Pi
|>%u^
|>%u^
.gji'
.gji'
h,T%.ji
h,T%.ji
n.wL4
n.wL4
gh.zs
gh.zs
%f/A6
%f/A6
o.llc
o.llc
W|39%%s
W|39%%s
oL.IP
oL.IP
i%U#N
i%U#N
rmI%XTn
rmI%XTn
Ta<.ci>
Ta<.ci>
i.yTT
i.yTT
.smQP
.smQP
.RT>N
.RT>N
J.ZS
J.ZS
QC.lY:
QC.lY:
Surl
Surl
W.Sg!
W.Sg!
X6%.F
X6%.F
9.KXa
9.KXa
.k.WZ
.k.WZ
[/]\/,[\
[/]\/,[\
]I.pGZ
]I.pGZ
%d{L%g
%d{L%g
!-AH}T'
!-AH}T'
jXÿ>
jXÿ>
[.NX>
[.NX>
"%ur,]!
"%ur,]!
%X.D6
%X.D6
VdyeXE$
VdyeXE$
0u}@%X
0u}@%X
VV/.VS
VV/.VS
W#".QO
W#".QO
.fof`
.fof`
iH(E
iH(E
.uzPr
.uzPr
.Kn4}
.Kn4}
_|.qW
_|.qW
K.ltV
K.ltV
8
8
%4udWf5q
%4udWf5q
Jb_.vz
Jb_.vz
gJ%x8,5m
gJ%x8,5m
R.StYJ
R.StYJ
lt.BZ
lt.BZ
s%S}.'
s%S}.'
P0%s:
P0%s:
KW48.OC
KW48.OC
"d@%S
"d@%S
0v.HLi
0v.HLi
sþ6[
sþ6[
fW%c*/
fW%c*/
.dn)
.dn)
80WftP
80WftP
.KLVa
.KLVa
NlA=
NlA=
>/8.Gl^
>/8.Gl^
Y%U9Z5
Y%U9Z5
!R.LW
!R.LW
Qr.bF
Qr.bF
Yw.MS
Yw.MS
RY%X|
RY%X|
Kp9%U
Kp9%U
.RUh7v
.RUh7v
UA<.sqf>
UA<.sqf>
:0.sUT
:0.sUT
.gVDE
.gVDE
Cq@.bg
Cq@.bg
/.Mdi
/.Mdi
K}.ox*
K}.ox*
wj.dL
wj.dL
.MW:3EV
.MW:3EV
%Q0D.zB7
%Q0D.zB7
kD0!o.eQ
kD0!o.eQ
AW.GUo
AW.GUo
f~.p.Iw
f~.p.Iw
.nS?8
.nS?8
K,.qL
K,.qL
k.tB8
k.tB8
:,M\.wlp?
:,M\.wlp?
Q[.LF
Q[.LF
.swQ[
.swQ[
tcRt
tcRt
ghP%U
ghP%U
;C.kQao
;C.kQao
6?-.aaZ
6?-.aaZ
.Iv>M
.Iv>M
.ak1Y
.ak1Y
.Rw|)
.Rw|)
d%S5X
d%S5X
[eK.px
[eK.px
]x%uE;
]x%uE;
.LLB>MH
.LLB>MH
(;%U6&
(;%U6&
YKeYH{
YKeYH{
\.yas
\.yas
.A.nz
.A.nz
.Qm@kk
.Qm@kk
.IJ@4
.IJ@4
6.ahFK
6.ahFK
,N%DL&:
,N%DL&:
Lv%8x
Lv%8x
4e`8.Cw
4e`8.Cw
[#}.RF|
[#}.RF|
nptCp
nptCp
.XcW^
.XcW^
n.rkp:;
n.rkp:;
K.hzN
K.hzN
xT%D$W
xT%D$W
\.fm
\.fm
-J=%c
-J=%c
%c*PS
%c*PS
9c.oQ
9c.oQ
N:,%x
N:,%x
w-.WEc)
w-.WEc)
%xC~X
%xC~X
Pw%x2fV
Pw%x2fV
nO3"e%D
nO3"e%D
~#V%U
~#V%U
D.ia{
D.ia{
.cxi1
.cxi1
\B.eG
\B.eG
Cn.Xe
Cn.Xe
SQ%U?
SQ%U?
~Ø
~Ø
nQ.uj{
nQ.uj{
*M.vk
*M.vk
.KxVZ
.KxVZ
Bg~%sB
Bg~%sB
P.QY'
P.QY'
*.gzh
*.gzh
z.kzZ
z.kzZ
94d%S
94d%S
.tZ.\f
.tZ.\f
%XPA_
%XPA_
c)[t%u
c)[t%u
l-Z.NU
l-Z.NU
ftpM
ftpM
l.Dwb»
l.Dwb»
.Ktu7
.Ktu7
.ix >
.ix >
.ZIEQN
.ZIEQN
A-7}=
A-7}=
bk.rq
bk.rq
).HBl
).HBl
ohB%X
ohB%X
rc]bzU.Bo#
rc]bzU.Bo#
!H%Dn
!H%Dn
.fk#m
.fk#m
"i%ua
"i%ua
%uVaV
%uVaV
.Ql@V%,
.Ql@V%,
CW4%U
CW4%U
^.expv
^.expv
q.Jt]
q.Jt]
?z!.fr
?z!.fr
p6.pd
p6.pd
K^s/E=%.C
K^s/E=%.C
c.ygk
c.ygk
.Vh0E1
.Vh0E1
h|.qX
h|.qX
H5#.yx
H5#.yx
!k%C}
!k%C}
P.ko(
P.ko(
X.HTn
X.HTn
ZA/%S
ZA/%S
i^..JA
i^..JA
.rmUoW
.rmUoW
.qGu
.qGu
e%xtV
e%xtV
.Pg9X
.Pg9X
!$4y.AL
!$4y.AL
.RrP&^>E
.RrP&^>E
.Ax}|
.Ax}|
X.ra-
X.ra-
.gP3N
.gP3N
W%s@M!?
W%s@M!?
sQ.KWP
sQ.KWP
o~.Do
o~.Do
B.Dr%
B.Dr%
:eÂa
:eÂa
.PlOx
.PlOx
.pz63
.pz63
%UK}3
%UK}3
V9.NM
V9.NM
Hx],s%C
Hx],s%C
6^.Lf
6^.Lf
.xC.:zH
.xC.:zH
J.nFa
J.nFa
û;{
û;{
vR%dr
vR%dr
r%sE3
r%sE3
.%fw?r
.%fw?r
k.LE>
k.LE>
%sjQbF&
%sjQbF&
>.PL D
>.PL D
\.xwe
\.xwe
}6.Og
}6.Og
/M%SNW
/M%SNW
j4GY\n.xGb`;
j4GY\n.xGb`;
.lKuR
.lKuR
.TFzlr
.TFzlr
.ES
.ES
.DhhW
.DhhW
.Rla\li
.Rla\li
nzuu.Zi
nzuu.Zi
|%CsX
|%CsX
.LMJk
.LMJk
ZXs.cT8N
ZXs.cT8N
oX.Ht
oX.Ht
C.CH,
C.CH,
{.pJS
{.pJS
1}D%D
1}D%D
.}.So
.}.So
.IwJ#
.IwJ#
.eo~;
.eo~;
KD(=%U
KD(=%U
z.MkGU
z.MkGU
.ZtlJ
.ZtlJ
.Dsc%
.Dsc%
:SQLQL'L
:SQLQL'L
{-f.bM
{-f.bM
%Xg`h
%Xg`h
J=%Fx
J=%Fx
.uWa=
.uWa=
De%Sq y
De%Sq y
.nUo*}P
.nUo*}P
Udpz
Udpz
'zAO.pf
'zAO.pf
.[.RM
.[.RM
6nIzP%SV
6nIzP%SV
Y%Dm2:
Y%Dm2:
.Uhp.
.Uhp.
.DvU2(
.DvU2(
>%RÃŽ
>%RÃŽ
.Jm-^t~
.Jm-^t~
h.yYv
h.yYv
XR%D$
XR%D$
|}.Oe
|}.Oe
%dwL.j
%dwL.j
.cA6Z
.cA6Z
%U9Ud\
%U9Ud\
j't%x
j't%x
%.TKDQt
%.TKDQt
J.Az!
J.Az!
'w.Oc
'w.Oc
F.qGo
F.qGo
$`s%u
$`s%u
.HvGg
.HvGg
l=.ob
l=.ob
aþn
aþn
}~%f/b
}~%f/b
Zn.QV=
Zn.QV=
%l%c$
%l%c$
6e
6e
XAb-GB}
XAb-GB}
TcPT
TcPT
s:\bn>
s:\bn>
.KsB9
.KsB9
7%x?"
7%x?"
RGS%8X
RGS%8X
}l.Sx
}l.Sx
-bF}I'9
-bF}I'9
].IoC
].IoC
f%.vn
f%.vn
'.vO@
'.vO@
<.ljg>
<.ljg>
-.RHLn
-.RHLn
x.zKsl
x.zKsl
R.nl["6
R.nl["6
(`%c(
(`%c(
.XFtJ
.XFtJ
#f.KM
#f.KM
b%Ut65N
b%Ut65N
Kb.Uz
Kb.Uz
.tLYu
.tLYu
.QR7r
.QR7r
.KiE4t!
.KiE4t!
-tYwJNHJ}O
-tYwJNHJ}O
.OC5
.OC5
&%dv^A
&%dv^A
O.uG7
O.uG7
.ntX;
.ntX;
.EnfO
.EnfO
.Ev"&
.Ev"&
$F%fxNvt
$F%fxNvt
3Hx.Ozt~C
3Hx.Ozt~C
f9.cib0
f9.cib0
KERNEL32.DLL
KERNEL32.DLL
ADVAPI32.dll
ADVAPI32.dll
COMCTL32.dll
COMCTL32.dll
COMDLG32.dll
COMDLG32.dll
GDI32.dll
GDI32.dll
IPHLPAPI.DLL
IPHLPAPI.DLL
MPR.dll
MPR.dll
ole32.dll
ole32.dll
OLEAUT32.dll
OLEAUT32.dll
PSAPI.DLL
PSAPI.DLL
SHELL32.dll
SHELL32.dll
USER32.dll
USER32.dll
USERENV.dll
USERENV.dll
UxTheme.dll
UxTheme.dll
VERSION.dll
VERSION.dll
WININET.dll
WININET.dll
WINMM.dll
WINMM.dll
WSOCK32.dll
WSOCK32.dll
mscoree.dll
mscoree.dll
combase.dll
combase.dll
- CRT not initialized
- CRT not initialized
- Attempt to initialize the CRT more than once.
- Attempt to initialize the CRT more than once.
- floating point support not loaded
- floating point support not loaded
USER32.DLL
USER32.DLL
>>>AUTOIT NO CMDEXECUTE
>>>AUTOIT NO CMDEXECUTE
CMDLINERAW
CMDLINERAW
CMDLINE
CMDLINE
/AutoIt3ExecuteLine
/AutoIt3ExecuteLine
/AutoIt3ExecuteScript
/AutoIt3ExecuteScript
APPSKEY
APPSKEY
789:;?
789:;?
FTPSETPROXY
FTPSETPROXY
GUICTRLRECVMSG
GUICTRLRECVMSG
GUICTRLSENDMSG
GUICTRLSENDMSG
GUIGETMSG
GUIGETMSG
GUIREGISTERMSG
GUIREGISTERMSG
HOTKEYSET
HOTKEYSET
HTTPSETPROXY
HTTPSETPROXY
HTTPSETUSERAGENT
HTTPSETUSERAGENT
ISKEYWORD
ISKEYWORD
MSGBOX
MSGBOX
REGENUMKEY
REGENUMKEY
SHELLEXECUTE
SHELLEXECUTE
SHELLEXECUTEWAIT
SHELLEXECUTEWAIT
TCPACCEPT
TCPACCEPT
TCPCLOSESOCKET
TCPCLOSESOCKET
TCPCONNECT
TCPCONNECT
TCPLISTEN
TCPLISTEN
TCPNAMETOIP
TCPNAMETOIP
TCPRECV
TCPRECV
TCPSEND
TCPSEND
TCPSHUTDOWN
TCPSHUTDOWN
TCPSTARTUP
TCPSTARTUP
TRAYGETMSG
TRAYGETMSG
UDPBIND
UDPBIND
UDPCLOSESOCKET
UDPCLOSESOCKET
UDPOPEN
UDPOPEN
UDPRECV
UDPRECV
UDPSEND
UDPSEND
UDPSHUTDOWN
UDPSHUTDOWN
UDPSTARTUP
UDPSTARTUP
SendKeyDelay
SendKeyDelay
SendKeyDownDelay
SendKeyDownDelay
TCPTimeout
TCPTimeout
WINDOWSDIR
WINDOWSDIR
AUTOITEXE
AUTOITEXE
HOTKEYPRESSED
HOTKEYPRESSED
D%s (%d) : ==> %s.:
D%s (%d) : ==> %s.:
Line %d:
Line %d:
Line %d (File "%s"):
Line %d (File "%s"):
%s (%d) : ==> %s:
%s (%d) : ==> %s:
AutoIt script files (*.au3, *.a3x)
AutoIt script files (*.au3, *.a3x)
*.au3;*.a3x
*.au3;*.a3x
All files (*.*)
All files (*.*)
04090000
04090000
%u.%u.%u.%u
%u.%u.%u.%u
0.0.0.0
0.0.0.0
Mddddd
Mddddd
"%s" (%d) : ==> %s:
"%s" (%d) : ==> %s:
\??\%s
\??\%s
GUI_RUNDEFMSG
GUI_RUNDEFMSG
AUTOITCALLVARIABLE%d
AUTOITCALLVARIABLE%d
255.255.255.255
255.255.255.255
Keyword
Keyword
AUTOIT.ERROR
AUTOIT.ERROR
Null Object assignment in FOR..IN loop
Null Object assignment in FOR..IN loop
Incorrect Object type in FOR..IN loop
Incorrect Object type in FOR..IN loop
3, 3, 10, 0
3, 3, 10, 0
HKEY_LOCAL_MACHINE
HKEY_LOCAL_MACHINE
HKEY_CLASSES_ROOT
HKEY_CLASSES_ROOT
HKEY_CURRENT_CONFIG
HKEY_CURRENT_CONFIG
HKEY_CURRENT_USER
HKEY_CURRENT_USER
HKEY_USERS
HKEY_USERS
%d/d/d
%d/d/d
c:\%original file name%.exe
c:\%original file name%.exe
C:\%original file name%.exe
C:\%original file name%.exe
AutoIt supports the __stdcall (WINAPI) and __cdecl calling conventions. The __stdcall (WINAPI) convention is used by default but __cdecl can be used instead. See the DllCall() documentation for details on changing the calling convention.
AutoIt supports the __stdcall (WINAPI) and __cdecl calling conventions. The __stdcall (WINAPI) convention is used by default but __cdecl can be used instead. See the DllCall() documentation for details on changing the calling convention.
Missing operator in expression."Unbalanced brackets in expression.
Missing operator in expression."Unbalanced brackets in expression.
Error parsing function call.0Incorrect number of parameters in function call.'"ReDim" used without an array variable.>Illegal text at the end of statement (one statement per line).1"If" statement has no matching "EndIf" statement.1"Else" statement with no matching "If" statement.2"EndIf" statement with no matching "If" statement.7Too many "Else" statements for matching "If" statement.3"While" statement has no matching "Wend" statement.4"Wend" statement with no matching "While" statement.%Variable used without being declared.XArray variable has incorrect number of subscripts or subscript dimension range exceeded.#Variable subscript badly formatted.*Subscript used on non-accessible variable.&Too many subscripts used for an array.0Missing subscript dimensions in "Dim" statement.NNo variable given for "Dim", "Local", "Global", "Struct" or "Const" statement.
Error parsing function call.0Incorrect number of parameters in function call.'"ReDim" used without an array variable.>Illegal text at the end of statement (one statement per line).1"If" statement has no matching "EndIf" statement.1"Else" statement with no matching "If" statement.2"EndIf" statement with no matching "If" statement.7Too many "Else" statements for matching "If" statement.3"While" statement has no matching "Wend" statement.4"Wend" statement with no matching "While" statement.%Variable used without being declared.XArray variable has incorrect number of subscripts or subscript dimension range exceeded.#Variable subscript badly formatted.*Subscript used on non-accessible variable.&Too many subscripts used for an array.0Missing subscript dimensions in "Dim" statement.NNo variable given for "Dim", "Local", "Global", "Struct" or "Const" statement.
0Expected a "=" operator in assignment statement.*Invalid keyword at the start of this line.
0Expected a "=" operator in assignment statement.*Invalid keyword at the start of this line.
Invalid element in a DllStruct.*Unknown option or bad parameter specified.&Unable to load the internet libraries./"Struct" statement has no matching "EndStruct".HUnable to open file, the maximum number of open files has been exceeded.K"ContinueLoop" statement with no matching "While", "Do" or "For" statement.
Invalid element in a DllStruct.*Unknown option or bad parameter specified.&Unable to load the internet libraries./"Struct" statement has no matching "EndStruct".HUnable to open file, the maximum number of open files has been exceeded.K"ContinueLoop" statement with no matching "While", "Do" or "For" statement.
Invalid file filter given.*Expected a variable in user function call.1"Do" statement has no matching "Until" statement.2"Until" statement with no matching "Do" statement.#"For" statement is badly formatted.2"Next" statement with no matching "For" statement.N"ExitLoop/ContinueLoop" statements only valid from inside a For/Do/While loop.1"For" statement has no matching "Next" statement.@"Case" statement with no matching "Select"or "Switch" statement.:"EndSelect" statement with no matching "Select" statement.ORecursion level has been exceeded - AutoIt will quit to prevent stack overflow.&Cannot make existing variables static.4Cannot make static variables into regular variables.
Invalid file filter given.*Expected a variable in user function call.1"Do" statement has no matching "Until" statement.2"Until" statement with no matching "Do" statement.#"For" statement is badly formatted.2"Next" statement with no matching "For" statement.N"ExitLoop/ContinueLoop" statements only valid from inside a For/Do/While loop.1"For" statement has no matching "Next" statement.@"Case" statement with no matching "Select"or "Switch" statement.:"EndSelect" statement with no matching "Select" statement.ORecursion level has been exceeded - AutoIt will quit to prevent stack overflow.&Cannot make existing variables static.4Cannot make static variables into regular variables.
3This keyword cannot be used after a "Then" keyword.>"Select" statement is missing "EndSelect" or "Case" statement. "If" statements must have a "Then" keyword. Badly formated Struct statement."Cannot assign values to constants..Cannot make existing variables into constants.9Only Object-type variables allowed in a "With" statement.v"long_ptr", "int_ptr" and "short_ptr" DllCall() types have been deprecated. Use "long*", "int*" and "short*" instead.-Object referenced outside a "With" statement.)Nested "With" statements are not allowed."Variable must be of type "Object".1The requested action with this object has failed.8Variable appears more than once in function declaration.2ReDim array can not be initialized in this manner.1An array variable can not be used in this manner.
3This keyword cannot be used after a "Then" keyword.>"Select" statement is missing "EndSelect" or "Case" statement. "If" statements must have a "Then" keyword. Badly formated Struct statement."Cannot assign values to constants..Cannot make existing variables into constants.9Only Object-type variables allowed in a "With" statement.v"long_ptr", "int_ptr" and "short_ptr" DllCall() types have been deprecated. Use "long*", "int*" and "short*" instead.-Object referenced outside a "With" statement.)Nested "With" statements are not allowed."Variable must be of type "Object".1The requested action with this object has failed.8Variable appears more than once in function declaration.2ReDim array can not be initialized in this manner.1An array variable can not be used in this manner.
Can not redeclare a constant.5Can not redeclare a parameter inside a user function.HCan pass constants by reference only to parameters with "Const" keyword.*Can not initialize a variable with itself.$Incorrect way to use this parameter.:"EndSwitch" statement with no matching "Switch" statement.>"Switch" statement is missing "EndSwitch" or "Case" statement.H"ContinueCase" statement with no matching "Select"or "Switch" statement.
Can not redeclare a constant.5Can not redeclare a parameter inside a user function.HCan pass constants by reference only to parameters with "Const" keyword.*Can not initialize a variable with itself.$Incorrect way to use this parameter.:"EndSwitch" statement with no matching "Switch" statement.>"Switch" statement is missing "EndSwitch" or "Case" statement.H"ContinueCase" statement with no matching "Select"or "Switch" statement.
String missing closing quote.!Badly formated variable or macro.*Missing separator character after keyword.
String missing closing quote.!Badly formated variable or macro.*Missing separator character after keyword.
4.4.0.8
4.4.0.8
hXXp://VVV.autoitscript.com/autoit3/
hXXp://VVV.autoitscript.com/autoit3/
%original file name%.exe_1896_rwx_00401000_00C6A000:
PSSSSSSh
PSSSSSSh
Gt.Ht$
Gt.Ht$
t.jGZf;
t.jGZf;
PSSSh@
PSSSh@
PVSSh@
PVSSh@
f;Crt
f;Crt
?#%X.y
?#%X.y
GetProcessWindowStation
GetProcessWindowStation
operator
operator
This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.
This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.
kernel32.dll
kernel32.dll
oleaut32.dll
oleaut32.dll
RegDeleteKeyExW
RegDeleteKeyExW
advapi32.dll
advapi32.dll
Error text not found (please report)
Error text not found (please report)
operand of unlimited repeat could match the empty string
operand of unlimited repeat could match the empty string
POSIX named classes are supported only within a class
POSIX named classes are supported only within a class
erroffset passed as NULL
erroffset passed as NULL
POSIX collating elements are not supported
POSIX collating elements are not supported
this version of PCRE is compiled without UTF support
this version of PCRE is compiled without UTF support
PCRE does not support \L, \l, \N{name}, \U, or \u
PCRE does not support \L, \l, \N{name}, \U, or \u
support for \P, \p, and \X has not been compiled
support for \P, \p, and \X has not been compiled
this version of PCRE is not compiled with Unicode property support
this version of PCRE is not compiled with Unicode property support
\N is not supported in a class
\N is not supported in a class
zcÃ
zcÃ
GetProcessHeap
GetProcessHeap
CreatePipe
CreatePipe
GetWindowsDirectoryW
GetWindowsDirectoryW
GetCPInfo
GetCPInfo
RegDeleteKeyW
RegDeleteKeyW
RegEnumKeyExW
RegEnumKeyExW
RegCreateKeyExW
RegCreateKeyExW
RegOpenKeyExW
RegOpenKeyExW
RegCloseKey
RegCloseKey
SetViewportOrgEx
SetViewportOrgEx
ShellExecuteExW
ShellExecuteExW
SHFileOperationW
SHFileOperationW
ShellExecuteW
ShellExecuteW
RegisterHotKey
RegisterHotKey
GetKeyboardLayoutNameW
GetKeyboardLayoutNameW
ExitWindowsEx
ExitWindowsEx
EnumThreadWindows
EnumThreadWindows
UnregisterHotKey
UnregisterHotKey
keybd_event
keybd_event
GetAsyncKeyState
GetAsyncKeyState
SetKeyboardState
SetKeyboardState
GetKeyboardState
GetKeyboardState
GetKeyState
GetKeyState
VkKeyScanW
VkKeyScanW
EnumWindows
EnumWindows
EnumChildWindows
EnumChildWindows
MapVirtualKeyW
MapVirtualKeyW
CloseWindowStation
CloseWindowStation
SetProcessWindowStation
SetProcessWindowStation
OpenWindowStationW
OpenWindowStationW
InternetCrackUrlW
InternetCrackUrlW
HttpQueryInfoW
HttpQueryInfoW
HttpOpenRequestW
HttpOpenRequestW
HttpSendRequestW
HttpSendRequestW
FtpOpenFileW
FtpOpenFileW
FtpGetFileSize
FtpGetFileSize
InternetOpenUrlW
InternetOpenUrlW
##@,&,//,))
##@,&,//,))
.jQE2
.jQE2
4`%ud*
4`%ud*
3(-,'')-*/%'
3(-,'')-*/%'
9(***3).**-)'
9(***3).**-)'
H%d=j@
H%d=j@
0!;....(
0!;....(
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
@.reloc
@.reloc
4`%ud
4`%ud
mscoree.dll
mscoree.dll
combase.dll
combase.dll
- CRT not initialized
- CRT not initialized
- Attempt to initialize the CRT more than once.
- Attempt to initialize the CRT more than once.
- floating point support not loaded
- floating point support not loaded
USER32.DLL
USER32.DLL
>>>AUTOIT NO CMDEXECUTE
>>>AUTOIT NO CMDEXECUTE
CMDLINERAW
CMDLINERAW
CMDLINE
CMDLINE
/AutoIt3ExecuteLine
/AutoIt3ExecuteLine
/AutoIt3ExecuteScript
/AutoIt3ExecuteScript
APPSKEY
APPSKEY
789:;?
789:;?
FTPSETPROXY
FTPSETPROXY
GUICTRLRECVMSG
GUICTRLRECVMSG
GUICTRLSENDMSG
GUICTRLSENDMSG
GUIGETMSG
GUIGETMSG
GUIREGISTERMSG
GUIREGISTERMSG
HOTKEYSET
HOTKEYSET
HTTPSETPROXY
HTTPSETPROXY
HTTPSETUSERAGENT
HTTPSETUSERAGENT
ISKEYWORD
ISKEYWORD
MSGBOX
MSGBOX
REGENUMKEY
REGENUMKEY
SHELLEXECUTE
SHELLEXECUTE
SHELLEXECUTEWAIT
SHELLEXECUTEWAIT
TCPACCEPT
TCPACCEPT
TCPCLOSESOCKET
TCPCLOSESOCKET
TCPCONNECT
TCPCONNECT
TCPLISTEN
TCPLISTEN
TCPNAMETOIP
TCPNAMETOIP
TCPRECV
TCPRECV
TCPSEND
TCPSEND
TCPSHUTDOWN
TCPSHUTDOWN
TCPSTARTUP
TCPSTARTUP
TRAYGETMSG
TRAYGETMSG
UDPBIND
UDPBIND
UDPCLOSESOCKET
UDPCLOSESOCKET
UDPOPEN
UDPOPEN
UDPRECV
UDPRECV
UDPSEND
UDPSEND
UDPSHUTDOWN
UDPSHUTDOWN
UDPSTARTUP
UDPSTARTUP
SendKeyDelay
SendKeyDelay
SendKeyDownDelay
SendKeyDownDelay
TCPTimeout
TCPTimeout
WINDOWSDIR
WINDOWSDIR
AUTOITEXE
AUTOITEXE
HOTKEYPRESSED
HOTKEYPRESSED
D%s (%d) : ==> %s.:
D%s (%d) : ==> %s.:
Line %d:
Line %d:
Line %d (File "%s"):
Line %d (File "%s"):
%s (%d) : ==> %s:
%s (%d) : ==> %s:
AutoIt script files (*.au3, *.a3x)
AutoIt script files (*.au3, *.a3x)
*.au3;*.a3x
*.au3;*.a3x
All files (*.*)
All files (*.*)
04090000
04090000
%u.%u.%u.%u
%u.%u.%u.%u
0.0.0.0
0.0.0.0
Mddddd
Mddddd
"%s" (%d) : ==> %s:
"%s" (%d) : ==> %s:
\??\%s
\??\%s
GUI_RUNDEFMSG
GUI_RUNDEFMSG
AUTOITCALLVARIABLE%d
AUTOITCALLVARIABLE%d
255.255.255.255
255.255.255.255
Keyword
Keyword
AUTOIT.ERROR
AUTOIT.ERROR
Null Object assignment in FOR..IN loop
Null Object assignment in FOR..IN loop
Incorrect Object type in FOR..IN loop
Incorrect Object type in FOR..IN loop
3, 3, 10, 0
3, 3, 10, 0
HKEY_LOCAL_MACHINE
HKEY_LOCAL_MACHINE
HKEY_CLASSES_ROOT
HKEY_CLASSES_ROOT
HKEY_CURRENT_CONFIG
HKEY_CURRENT_CONFIG
HKEY_CURRENT_USER
HKEY_CURRENT_USER
HKEY_USERS
HKEY_USERS
%d/d/d
%d/d/d
c:\%original file name%.exe
c:\%original file name%.exe
C:\%original file name%.exe
C:\%original file name%.exe
AutoIt supports the __stdcall (WINAPI) and __cdecl calling conventions. The __stdcall (WINAPI) convention is used by default but __cdecl can be used instead. See the DllCall() documentation for details on changing the calling convention.
AutoIt supports the __stdcall (WINAPI) and __cdecl calling conventions. The __stdcall (WINAPI) convention is used by default but __cdecl can be used instead. See the DllCall() documentation for details on changing the calling convention.
Missing operator in expression."Unbalanced brackets in expression.
Missing operator in expression."Unbalanced brackets in expression.
Error parsing function call.0Incorrect number of parameters in function call.'"ReDim" used without an array variable.>Illegal text at the end of statement (one statement per line).1"If" statement has no matching "EndIf" statement.1"Else" statement with no matching "If" statement.2"EndIf" statement with no matching "If" statement.7Too many "Else" statements for matching "If" statement.3"While" statement has no matching "Wend" statement.4"Wend" statement with no matching "While" statement.%Variable used without being declared.XArray variable has incorrect number of subscripts or subscript dimension range exceeded.#Variable subscript badly formatted.*Subscript used on non-accessible variable.&Too many subscripts used for an array.0Missing subscript dimensions in "Dim" statement.NNo variable given for "Dim", "Local", "Global", "Struct" or "Const" statement.
Error parsing function call.0Incorrect number of parameters in function call.'"ReDim" used without an array variable.>Illegal text at the end of statement (one statement per line).1"If" statement has no matching "EndIf" statement.1"Else" statement with no matching "If" statement.2"EndIf" statement with no matching "If" statement.7Too many "Else" statements for matching "If" statement.3"While" statement has no matching "Wend" statement.4"Wend" statement with no matching "While" statement.%Variable used without being declared.XArray variable has incorrect number of subscripts or subscript dimension range exceeded.#Variable subscript badly formatted.*Subscript used on non-accessible variable.&Too many subscripts used for an array.0Missing subscript dimensions in "Dim" statement.NNo variable given for "Dim", "Local", "Global", "Struct" or "Const" statement.
0Expected a "=" operator in assignment statement.*Invalid keyword at the start of this line.
0Expected a "=" operator in assignment statement.*Invalid keyword at the start of this line.
Invalid element in a DllStruct.*Unknown option or bad parameter specified.&Unable to load the internet libraries./"Struct" statement has no matching "EndStruct".HUnable to open file, the maximum number of open files has been exceeded.K"ContinueLoop" statement with no matching "While", "Do" or "For" statement.
Invalid element in a DllStruct.*Unknown option or bad parameter specified.&Unable to load the internet libraries./"Struct" statement has no matching "EndStruct".HUnable to open file, the maximum number of open files has been exceeded.K"ContinueLoop" statement with no matching "While", "Do" or "For" statement.
Invalid file filter given.*Expected a variable in user function call.1"Do" statement has no matching "Until" statement.2"Until" statement with no matching "Do" statement.#"For" statement is badly formatted.2"Next" statement with no matching "For" statement.N"ExitLoop/ContinueLoop" statements only valid from inside a For/Do/While loop.1"For" statement has no matching "Next" statement.@"Case" statement with no matching "Select"or "Switch" statement.:"EndSelect" statement with no matching "Select" statement.ORecursion level has been exceeded - AutoIt will quit to prevent stack overflow.&Cannot make existing variables static.4Cannot make static variables into regular variables.
Invalid file filter given.*Expected a variable in user function call.1"Do" statement has no matching "Until" statement.2"Until" statement with no matching "Do" statement.#"For" statement is badly formatted.2"Next" statement with no matching "For" statement.N"ExitLoop/ContinueLoop" statements only valid from inside a For/Do/While loop.1"For" statement has no matching "Next" statement.@"Case" statement with no matching "Select"or "Switch" statement.:"EndSelect" statement with no matching "Select" statement.ORecursion level has been exceeded - AutoIt will quit to prevent stack overflow.&Cannot make existing variables static.4Cannot make static variables into regular variables.
3This keyword cannot be used after a "Then" keyword.>"Select" statement is missing "EndSelect" or "Case" statement. "If" statements must have a "Then" keyword. Badly formated Struct statement."Cannot assign values to constants..Cannot make existing variables into constants.9Only Object-type variables allowed in a "With" statement.v"long_ptr", "int_ptr" and "short_ptr" DllCall() types have been deprecated. Use "long*", "int*" and "short*" instead.-Object referenced outside a "With" statement.)Nested "With" statements are not allowed."Variable must be of type "Object".1The requested action with this object has failed.8Variable appears more than once in function declaration.2ReDim array can not be initialized in this manner.1An array variable can not be used in this manner.
3This keyword cannot be used after a "Then" keyword.>"Select" statement is missing "EndSelect" or "Case" statement. "If" statements must have a "Then" keyword. Badly formated Struct statement."Cannot assign values to constants..Cannot make existing variables into constants.9Only Object-type variables allowed in a "With" statement.v"long_ptr", "int_ptr" and "short_ptr" DllCall() types have been deprecated. Use "long*", "int*" and "short*" instead.-Object referenced outside a "With" statement.)Nested "With" statements are not allowed."Variable must be of type "Object".1The requested action with this object has failed.8Variable appears more than once in function declaration.2ReDim array can not be initialized in this manner.1An array variable can not be used in this manner.
Can not redeclare a constant.5Can not redeclare a parameter inside a user function.HCan pass constants by reference only to parameters with "Const" keyword.*Can not initialize a variable with itself.$Incorrect way to use this parameter.:"EndSwitch" statement with no matching "Switch" statement.>"Switch" statement is missing "EndSwitch" or "Case" statement.H"ContinueCase" statement with no matching "Select"or "Switch" statement.
Can not redeclare a constant.5Can not redeclare a parameter inside a user function.HCan pass constants by reference only to parameters with "Const" keyword.*Can not initialize a variable with itself.$Incorrect way to use this parameter.:"EndSwitch" statement with no matching "Switch" statement.>"Switch" statement is missing "EndSwitch" or "Case" statement.H"ContinueCase" statement with no matching "Select"or "Switch" statement.
String missing closing quote.!Badly formated variable or macro.*Missing separator character after keyword.
String missing closing quote.!Badly formated variable or macro.*Missing separator character after keyword.
Integrator.exe_3452:
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
@.reloc
@.reloc
Rpj%UQP
Rpj%UQP
Ppj%SQW
Ppj%SQW
SSSSSSh
SSSSSSh
L$.Qf
L$.Qf
PSSSSSSh
PSSSSSSh
hXXp://VVV.example.org/Mutual/
hXXp://VVV.example.org/Mutual/
CoInitializeEx failed: %x
CoInitializeEx failed: %x
Failed to create an instance of ITaskService: %x
Failed to create an instance of ITaskService: %x
ITaskService::Connect failed: %x
ITaskService::Connect failed: %x
ITaskService::GetFolder failed: %x
ITaskService::GetFolder failed: %x
D:\WorkFolder\gu\exe\vc\Integrator\sourcecode\Release\Integrator.pdb
D:\WorkFolder\gu\exe\vc\Integrator\sourcecode\Release\Integrator.pdb
mfc90u.dll
mfc90u.dll
_amsg_exit
_amsg_exit
_wcmdln
_wcmdln
MSVCR90.dll
MSVCR90.dll
_crt_debugger_hook
_crt_debugger_hook
GetProcessHeap
GetProcessHeap
GetWindowsDirectoryW
GetWindowsDirectoryW
WinExec
WinExec
GetCPInfo
GetCPInfo
KERNEL32.dll
KERNEL32.dll
GetKeyState
GetKeyState
MsgWaitForMultipleObjects
MsgWaitForMultipleObjects
SetWindowsHookExW
SetWindowsHookExW
UnhookWindowsHookEx
UnhookWindowsHookEx
USER32.dll
USER32.dll
GetViewportExtEx
GetViewportExtEx
GDI32.dll
GDI32.dll
MSIMG32.dll
MSIMG32.dll
RegOpenKeyExW
RegOpenKeyExW
RegCloseKey
RegCloseKey
ADVAPI32.dll
ADVAPI32.dll
ShellExecuteW
ShellExecuteW
ShellExecuteExW
ShellExecuteExW
SHELL32.dll
SHELL32.dll
COMCTL32.dll
COMCTL32.dll
PathIsURLW
PathIsURLW
SHLWAPI.dll
SHLWAPI.dll
ole32.dll
ole32.dll
OLEAUT32.dll
OLEAUT32.dll
GdiplusShutdown
GdiplusShutdown
gdiplus.dll
gdiplus.dll
MSVCP90.dll
MSVCP90.dll
Languages.dll
Languages.dll
WS2_32.dll
WS2_32.dll
BootTime.dll
BootTime.dll
LockDll.dll
LockDll.dll
CheckUpdate.dll
CheckUpdate.dll
RestoreCenter.dll
RestoreCenter.dll
VERSION.dll
VERSION.dll
IsShowQuicklaunchBarTips
IsShowQuicklaunchBarTips
IsShowTrayTips
IsShowTrayTips
settings.dll
settings.dll
TracksEraser.dll
TracksEraser.dll
Config.dll
Config.dll
.?AVCCmdTarget@@
.?AVCCmdTarget@@
.PAVCException@@
.PAVCException@@
.?AV?$CFixedStringT@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@$0BA@@ATL@@
.?AV?$CFixedStringT@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@$0BA@@ATL@@
.?AV?$CFixedStringT@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@$0EA@@ATL@@
.?AV?$CFixedStringT@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@$0EA@@ATL@@
.?AV?$CFixedStringT@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@$0BAA@@ATL@@
.?AV?$CFixedStringT@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@$0BAA@@ATL@@
.?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@
.?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@
.?AV?$CFixedStringT@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@$0EAA@@ATL@@
.?AV?$CFixedStringT@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@$0EAA@@ATL@@
.?AV?$CAtlHttpClientT@VZEvtSyncSocket@ATL@@@ATL@@
.?AV?$CAtlHttpClientT@VZEvtSyncSocket@ATL@@@ATL@@
.?AVCCRTHeap@ATL@@
.?AVCCRTHeap@ATL@@
" id="W5M0MpCehiHzreSzNTczkc9d"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?>
`f:.AW
`f:.AW
iTXtXML:com.adobe.xmp
iTXtXML:com.adobe.xmp
" id="W5M0MpCehiHzreSzNTczkc9d"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?>
Tk.vE 7
Tk.vE 7
4 4$4(4,4
4 4$4(4,4
2%6S6`6
2%6S6`6
='=3=9=_=
='=3=9=_=
9%9U9t9
9%9U9t9
55S5e5v5
55S5e5v5
8-8o8}8
8-8o8}8
1%2S2d2z2
1%2S2d2z2
4'40494\4
4'40494\4
;$
;$
7 7$7(7,70747
7 7$7(7,70747
1(1@1\1|1
1(1@1\1|1
HTRUE %s
HTRUE %s
FALSE %s
FALSE %s
@%Program Files%\Microsoft Visual Studio 9.0\VC\atlmfc\include\afxwin1.inl
@%Program Files%\Microsoft Visual Studio 9.0\VC\atlmfc\include\afxwin1.inl
%s (%s:%d)
%s (%s:%d)
@.\data\AppSetting.ini
@.\data\AppSetting.ini
data\AppSetting.ini
data\AppSetting.ini
%windir%\system32\sdclt.exe
%windir%\system32\sdclt.exe
%windir%\system32\ntbackup.exe
%windir%\system32\ntbackup.exe
%windir%\system32\rstrui.exe
%windir%\system32\rstrui.exe
%windir%\system32\restore\rstrui.exe
%windir%\system32\restore\rstrui.exe
iexplore.exe
iexplore.exe
CApplicationDispatch::ExecuteApplication
CApplicationDispatch::ExecuteApplication
%s(%d) : ErrorCode %d: ProcessName = %s
%s(%d) : ErrorCode %d: ProcessName = %s
1004001||
1004001||
1004002|||Windows Registry|.\skins\default\images\registry.png||0|1|1
1004002|||Windows Registry|.\skins\default\images\registry.png||0|1|1
1004003|11901|11001|RegistryCleaner.exe|.\skins\Icons\registrycleaner.png|.\skins\Icons\registrycleanerhover.png|1|0|1
1004003|11901|11001|RegistryCleaner.exe|.\skins\Icons\registrycleaner.png|.\skins\Icons\registrycleanerhover.png|1|0|1
1004004|32901|32001|regdefrag.exe|.\skins\Icons\regdefrag.png|.\skins\Icons\regdefraghover.png|1|1|1
1004004|32901|32001|regdefrag.exe|.\skins\Icons\regdefrag.png|.\skins\Icons\regdefraghover.png|1|1|1
1004005|||RegistryCleaner.exe /backups|||1|2|1
1004005|||RegistryCleaner.exe /backups|||1|2|1
1004006|||RegistryCleaner.exe /restore|||1|3|1
1004006|||RegistryCleaner.exe /restore|||1|3|1
1004007|||Disk Space|.\skins\default\images\diskspace.png||0|2|1
1004007|||Disk Space|.\skins\default\images\diskspace.png||0|2|1
1004008|13901|13001|DiskCleaner.exe|.\skins\Icons\diskcleaner.png|.\skins\Icons\diskcleanerhover.png|2|0|1
1004008|13901|13001|DiskCleaner.exe|.\skins\Icons\diskcleaner.png|.\skins\Icons\diskcleanerhover.png|2|0|1
1004009|15901|15001|dupefinder.exe|.\skins\Icons\dupefinder.png|.\skins\Icons\dupefinderhover.png|2|1|1
1004009|15901|15001|dupefinder.exe|.\skins\Icons\dupefinder.png|.\skins\Icons\dupefinderhover.png|2|1|1
1004010|16901|16001|EmptyFolderFinder.exe|.\skins\Icons\emptyfolderfinder.png|.\skins\Icons\emptyfolderfinderhover.png|2|2|1
1004010|16901|16001|EmptyFolderFinder.exe|.\skins\Icons\emptyfolderfinder.png|.\skins\Icons\emptyfolderfinderhover.png|2|2|1
1004011|17901|17001|ShortcutFixer.exe|.\skins\Icons\shortcutfixer.png|.\skins\Icons\shortcutfixerhover.png|2|3|1
1004011|17901|17001|ShortcutFixer.exe|.\skins\Icons\shortcutfixer.png|.\skins\Icons\shortcutfixerhover.png|2|3|1
1004012|19901|19001|DiskAnalysis.exe|.\skins\Icons\diskanalysis.png|.\skins\Icons\diskanalysishover.png|2|4|1
1004012|19901|19001|DiskAnalysis.exe|.\skins\Icons\diskanalysis.png|.\skins\Icons\diskanalysishover.png|2|4|1
1004013|||System Tweaks|.\skins\default\images\systemtweaks.png||0|3|1
1004013|||System Tweaks|.\skins\default\images\systemtweaks.png||0|3|1
1004016|21901|21001|memdefrag.exe|.\skins\Icons\memdefrag.png|.\skins\Icons\memdefraghover.png|3|0|1
1004016|21901|21001|memdefrag.exe|.\skins\Icons\memdefrag.png|.\skins\Icons\memdefraghover.png|3|0|1
1004043|23901|23001|iehelper.exe|.\skins\Icons\BrowserAssistant.png|.\skins\Icons\BrowserAssistanthover.png|3|1|1
1004043|23901|23001|iehelper.exe|.\skins\Icons\BrowserAssistant.png|.\skins\Icons\BrowserAssistanthover.png|3|1|1
1004049|||Anti-malware|.\skins\default\images\antimalware.png||0|4|1
1004049|||Anti-malware|.\skins\default\images\antimalware.png||0|4|1
1004050||2701001|SpyRemover.exe|.\skins\Icons\spyremover.png|.\skins\Icons\spyremoverhover.png|4|0|1
1004050||2701001|SpyRemover.exe|.\skins\Icons\spyremover.png|.\skins\Icons\spyremoverhover.png|4|0|1
1004019|||Privacy|.\skins\default\images\privacy.png||0|5|2
1004019|||Privacy|.\skins\default\images\privacy.png||0|5|2
1004020|18901|18001|TracksEraser.exe|.\skins\Icons\trackseraser.png|.\skins\Icons\trackseraserhover.png|5|0|2
1004020|18901|18001|TracksEraser.exe|.\skins\Icons\trackseraser.png|.\skins\Icons\trackseraserhover.png|5|0|2
1004021|22901|22001|shredder.exe|.\skins\Icons\shredder.png|.\skins\Icons\shredderhover.png|5|1|2
1004021|22901|22001|shredder.exe|.\skins\Icons\shredder.png|.\skins\Icons\shredderhover.png|5|1|2
1004022|22901|22001|shredder.exe /WipeFreeSpace|||5|2|2
1004022|22901|22001|shredder.exe /WipeFreeSpace|||5|2|2
1004023|27901|27001|fileencrypt.exe|.\skins\Icons\fileencrypt.png|.\skins\Icons\fileencrypthover.png|5|3|2
1004023|27901|27001|fileencrypt.exe|.\skins\Icons\fileencrypt.png|.\skins\Icons\fileencrypthover.png|5|3|2
1004037|||System Control|.\skins\default\images\systemcontrol.png||0|6|2
1004037|||System Control|.\skins\default\images\systemcontrol.png||0|6|2
1004038|14901|14001|StartupManager.exe|.\skins\Icons\startupmanager.png|.\skins\Icons\startupmanagerhover.png|6|0|2
1004038|14901|14001|StartupManager.exe|.\skins\Icons\startupmanager.png|.\skins\Icons\startupmanagerhover.png|6|0|2
1004039|14901|14001|StartupManager.exe /services|||6|1|2
1004039|14901|14001|StartupManager.exe /services|||6|1|2
1004040|14901|14001|StartupManager.exe /scheduledtasks|||6|2|2
1004040|14901|14001|StartupManager.exe /scheduledtasks|||6|2|2
1004041|25901|25001|cmm.exe|.\skins\Icons\cmm.png|.\skins\Icons\cmmhover.png|6|3|2
1004041|25901|25001|cmm.exe|.\skins\Icons\cmm.png|.\skins\Icons\cmmhover.png|6|3|2
1004042|24901|24001|procmgr.exe|.\skins\Icons\procmgr.png|.\skins\Icons\procmgrhover.png|6|4|2
1004042|24901|24001|procmgr.exe|.\skins\Icons\procmgr.png|.\skins\Icons\procmgrhover.png|6|4|2
1004044|||System Status|.\skins\default\images\systemstatus.png||0|7|2
1004044|||System Status|.\skins\default\images\systemstatus.png||0|7|2
1004045|33901|33001|sysinfo.exe|.\skins\Icons\sysinfo.png|.\skins\Icons\sysinfohover.png|7|0|2
1004045|33901|33001|sysinfo.exe|.\skins\Icons\sysinfo.png|.\skins\Icons\sysinfohover.png|7|0|2
1004056|||%windir%\system32\sfc.exe /SCANNOW|||7|1|2
1004056|||%windir%\system32\sfc.exe /SCANNOW|||7|1|2
1004046|||%windir%\system32\ntbackup.exe|||7|2|2
1004046|||%windir%\system32\ntbackup.exe|||7|2|2
1004047|||%windir%\system32\restore\rstrui.exe|||7|3|2
1004047|||%windir%\system32\restore\rstrui.exe|||7|3|2
1004046|||%windir%\system32\sdclt.exe|||7|2|2
1004046|||%windir%\system32\sdclt.exe|||7|2|2
1004047|||%windir%\system32\rstrui.exe|||7|3|2
1004047|||%windir%\system32\rstrui.exe|||7|3|2
1004048||10838|RestoreCenter.exe /undochanges|.\skins\Icons\restorecenter.png|.\skins\Icons\restorecenterhover.png|7|4|2
1004048||10838|RestoreCenter.exe /undochanges|.\skins\Icons\restorecenter.png|.\skins\Icons\restorecenterhover.png|7|4|2
1004033|||Hard disks|.\skins\default\images\harddisk.png||0|8|3
1004033|||Hard disks|.\skins\default\images\harddisk.png||0|8|3
1004034||3400001|DiskDefrag.exe|.\skins\Icons\diskdefrag.png|.\skins\Icons\diskdefraghover.png|8|0|3
1004034||3400001|DiskDefrag.exe|.\skins\Icons\diskdefrag.png|.\skins\Icons\diskdefraghover.png|8|0|3
1004035|||DiskDefrag.exe -BootTimeDefrag|||8|1|3
1004035|||DiskDefrag.exe -BootTimeDefrag|||8|1|3
1004036||2400001|CheckDisk.exe|.\skins\Icons\checkdisk.png|.\skins\Icons\checkdiskhover.png|8|2|3
1004036||2400001|CheckDisk.exe|.\skins\Icons\checkdisk.png|.\skins\Icons\checkdiskhover.png|8|2|3
1004024|||Drivers|.\skins\default\images\drivers.png||0|9|3
1004024|||Drivers|.\skins\default\images\drivers.png||0|9|3
1004025||2200001|DriverBackup.exe|.\skins\Icons\driverbackup.png|.\skins\Icons\driverbackuphover.png|9|0|3
1004025||2200001|DriverBackup.exe|.\skins\Icons\driverbackup.png|.\skins\Icons\driverbackuphover.png|9|0|3
1004026|||DriverBackup.exe /restore|||9|1|3
1004026|||DriverBackup.exe /restore|||9|1|3
1004027|||DriverBackup.exe /uninstall|||9|2|3
1004027|||DriverBackup.exe /uninstall|||9|2|3
1004029|||File management|.\skins\default\images\filemanagement.png||0|10|3
1004029|||File management|.\skins\default\images\filemanagement.png||0|10|3
1004030|28901|28001|filesplitter.exe|.\skins\Icons\filesplitter.png|.\skins\Icons\filesplitterhover.png|10|0|3
1004030|28901|28001|filesplitter.exe|.\skins\Icons\filesplitter.png|.\skins\Icons\filesplitterhover.png|10|0|3
1004031|31901|31001|FileUndelete.exe|.\skins\Icons\fileundelete.png|.\skins\Icons\fileundeletehover.png|10|1|3
1004031|31901|31001|FileUndelete.exe|.\skins\Icons\fileundelete.png|.\skins\Icons\fileundeletehover.png|10|1|3
1004032||3700001|QuickSearch.exe|.\skins\Icons\quicksearch.png|.\skins\Icons\quicksearchhover.png|10|2|3
1004032||3700001|QuickSearch.exe|.\skins\Icons\quicksearch.png|.\skins\Icons\quicksearchhover.png|10|2|3
1004052|||Programs|.\skins\default\images\programs.png||0|11|3
1004052|||Programs|.\skins\default\images\programs.png||0|11|3
1004053|12901|12001|Uninstaller.exe|.\skins\Icons\Uninstaller.png|.\skins\Icons\Uninstallerhover.png|11|0|3
1004053|12901|12001|Uninstaller.exe|.\skins\Icons\Uninstaller.png|.\skins\Icons\Uninstallerhover.png|11|0|3
1004054||4000001|SoftwareUpdate.exe|.\skins\Icons\SoftwareUpdate.png|.\skins\Icons\SoftwareUpdatehover.png|11|1|3
1004054||4000001|SoftwareUpdate.exe|.\skins\Icons\SoftwareUpdate.png|.\skins\Icons\SoftwareUpdatehover.png|11|1|3
1004055|||hXXp://VVV.filepuma.com/|||11|2|3
1004055|||hXXp://VVV.filepuma.com/|||11|2|3
1002008|||StartupManager.exe||
1002008|||StartupManager.exe||
.\skins\Icons\minus.png
.\skins\Icons\minus.png
.\skins\Icons\minusbg.png
.\skins\Icons\minusbg.png
1005001
1005001
@hXXp://VVV.example.org/Mutual/
@hXXp://VVV.example.org/Mutual/
https
https
X;
X;
X;
X;
hXXp://schemas.xmlsoap.org/soap/encoding/
hXXp://schemas.xmlsoap.org/soap/encoding/
hXXp://schemas.xmlsoap.org/soap/envelope/
hXXp://schemas.xmlsoap.org/soap/envelope/
hXXp://VVV.w3.org/2001/XMLSchema-instance
hXXp://VVV.w3.org/2001/XMLSchema-instance
hXXp://gu.glarysoft.com/boottime/service.php
hXXp://gu.glarysoft.com/boottime/service.php
SOAPAction: "hXXp://VVV.example.org/Mutual/NewOperation"
SOAPAction: "hXXp://VVV.example.org/Mutual/NewOperation"
HTTP/1.1
HTTP/1.1
Host: %s:%d
Host: %s:%d
Host: %s
Host: %s
Content-Length: %d
Content-Length: %d
Hdockpopdarkbg.png
Hdockpopdarkbg.png
DockButton_Tip.png
DockButton_Tip.png
dockpopturnleft.png
dockpopturnleft.png
dockpopturnleftgray.png
dockpopturnleftgray.png
dockpopturnright.png
dockpopturnright.png
dockpopcurpage.png
dockpopcurpage.png
dockpopcurpagegray.png
dockpopcurpagegray.png
H%d%%
H%d%%
Htoolbar.png
Htoolbar.png
logo.png
logo.png
body_transbg.png
body_transbg.png
foot_transbg.png
foot_transbg.png
hXXp://VVV.glarysoft.com/support/faq/
hXXp://VVV.glarysoft.com/support/faq/
hXXp://VVV.glarysoft.com
hXXp://VVV.glarysoft.com
main_close_click.png
main_close_click.png
main_close_hover.png
main_close_hover.png
main_close.png
main_close.png
main_right_top_mark_click_bg.png
main_right_top_mark_click_bg.png
main_right_top_mark_hover_bg.png
main_right_top_mark_hover_bg.png
main_right_top_mark_sep.png
main_right_top_mark_sep.png
main_min.png
main_min.png
main_feedback.png
main_feedback.png
main_restore.png
main_restore.png
main_skin.png
main_skin.png
main_like.png
main_like.png
tab_btn_click.png
tab_btn_click.png
tab_btn_hover.png
tab_btn_hover.png
tab_btn_normal.png
tab_btn_normal.png
tab_ov.png
tab_ov.png
tab_oc.png
tab_oc.png
tab_ad.png
tab_ad.png
menu_normal.png
menu_normal.png
menu_click.png
menu_click.png
menu_hover.png
menu_hover.png
pop_btn_normal.png
pop_btn_normal.png
pop_btn_click.png
pop_btn_click.png
pop_btn_hover.png
pop_btn_hover.png
usertype_btn.png
usertype_btn.png
1005002
1005002
1005004
1005004
bg2.jpg
bg2.jpg
tab_ad_blue.png
tab_ad_blue.png
tab_ov_blue.png
tab_ov_blue.png
tab_oc_blue.png
tab_oc_blue.png
%s &F1
%s &F1
%supgrade.exe
%supgrade.exe
1004001
1004001
1002001
1002001
1001005
1001005
1001001
1001001
1001002
1001002
1001003
1001003
1001004
1001004
%s %s
%s %s
news.ini
news.ini
hXXp://VVV.glarysoft.com/goto.php?a=buy&s=freelink
hXXp://VVV.glarysoft.com/goto.php?a=buy&s=freelink
hXXp://VVV.glarysoft.com/support/feedback/?subject=Glary Utilities %s
hXXp://VVV.glarysoft.com/support/feedback/?subject=Glary Utilities %s
hXXp://VVV.facebook.com/Glarysoft
hXXp://VVV.facebook.com/Glarysoft
%sSoftwareUpdate.exe
%sSoftwareUpdate.exe
SoftUpdateURL
SoftUpdateURL
4000001
4000001
4001030
4001030
4001023
4001023
4001025
4001025
4001029
4001029
4001019
4001019
%s(%d) : ErrorCode %d: LoadLibrary Faild! ModulePath = %s
%s(%d) : ErrorCode %d: LoadLibrary Faild! ModulePath = %s
%s(%d) : ErrorCode %d: GetProcAddress Faild! FunctionName = %s:PScanFun
%s(%d) : ErrorCode %d: GetProcAddress Faild! FunctionName = %s:PScanFun
%s(%d) : ErrorCode %d: GetProcAddress Faild! FunctionName = %s:PClearFun
%s(%d) : ErrorCode %d: GetProcAddress Faild! FunctionName = %s:PClearFun
%s(%d) : ErrorCode %d: GetProcAddress Faild! FunctionName = %s:PStopScan
%s(%d) : ErrorCode %d: GetProcAddress Faild! FunctionName = %s:PStopScan
%s(%d) : ErrorCode %d: GetProcAddress Faild! FunctionName = %s:PStopClear
%s(%d) : ErrorCode %d: GetProcAddress Faild! FunctionName = %s:PStopClear
%s(%d) : ErrorCode %d: GetProcAddress Faild! FunctionName = %s:PGetResultCount
%s(%d) : ErrorCode %d: GetProcAddress Faild! FunctionName = %s:PGetResultCount
%s(%d) : ErrorCode %d: GetProcAddress Faild! FunctionName = %s:PShowResultDialog
%s(%d) : ErrorCode %d: GetProcAddress Faild! FunctionName = %s:PShowResultDialog
29601|RegistryCleaner.dll|1|0
29601|RegistryCleaner.dll|1|0
29602|FileScanFilter.dll|1|1
29602|FileScanFilter.dll|1|1
29606|SpyRemover.dll|1|2
29606|SpyRemover.dll|1|2
1003001|CheckDisk.dll|0|3
1003001|CheckDisk.dll|0|3
29605|TracksEraser.dll|0|4
29605|TracksEraser.dll|0|4
29604|DiskCleaner.dll|1|5
29604|DiskCleaner.dll|1|5
29603|StartupManager.dll|1|6
29603|StartupManager.dll|1|6
%s(%d) : ErrorCode %d: TagId:%s ReturnCode:%d
%s(%d) : ErrorCode %d: TagId:%s ReturnCode:%d
Hprogress.png
Hprogress.png
progress_bg.png
progress_bg.png
checkbox_checked.png
checkbox_checked.png
checkbox_uncheck.png
checkbox_uncheck.png
oc_detailbg.png
oc_detailbg.png
oc_needclearbg.png
oc_needclearbg.png
oc_btn_normal.png
oc_btn_normal.png
oc_btn_click.png
oc_btn_click.png
oc_btn_hover.png
oc_btn_hover.png
oc_btn_scan.png
oc_btn_scan.png
oc_cancel_normal.png
oc_cancel_normal.png
oc_cancel_click.png
oc_cancel_click.png
oc_cancel_hover.png
oc_cancel_hover.png
clear_tips.png
clear_tips.png
%d.%d.%d.%d
%d.%d.%d.%d
2901008
2901008
Hbtn_normal.png
Hbtn_normal.png
btn_click.png
btn_click.png
btn_hover.png
btn_hover.png
ov_boottimebg.png
ov_boottimebg.png
1002015
1002015
1002006
1002006
1002008
1002008
1002010
1002010
1002012
1002012
1002013
1002013
1002014
1002014
1002017
1002017
%sdata\BootTime.ini
%sdata\BootTime.ini
2901005
2901005
2901002
2901002
2901003
2901003
2901004
2901004
2901006
2901006
2901001
2901001
%sStartupManager.exe
%sStartupManager.exe
\backimages\bg2.jpg
\backimages\bg2.jpg
7513803
7513803
\skin.ini
\skin.ini
skins\default\skin.ini
skins\default\skin.ini
%sskins\default\images\
%sskins\default\images\
%sskins\default\backimages\
%sskins\default\backimages\
Hskintransparentmark.png
Hskintransparentmark.png
*.png|*.jpg|*.gif|*.jpeg
*.png|*.jpg|*.gif|*.jpeg
skin_custom.png
skin_custom.png
skinsbg.png
skinsbg.png
skin_pic_normal.png
skin_pic_normal.png
skin_col_normal.png
skin_col_normal.png
%s\Sample Pictures
%s\Sample Pictures
1006005
1006005
%s(*.jpg *.png *.gif *.jpeg)|*.jpg;*.png;*.gif;*.jpeg||
%s(*.jpg *.png *.gif *.jpeg)|*.jpg;*.png;*.gif;*.jpeg||
1006006
1006006
SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\
SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\
H\winhlp32.exe
H\winhlp32.exe
burlywood
burlywood
.cpp-comment {color:green; font-style:italic}
.cpp-comment {color:green; font-style:italic}
-.,!:;)}]?
-.,!:;)}]?
H0xX
H0xX
(%d, %d)-(%d, %d)
(%d, %d)-(%d, %d)
%s%s %s%sHbg7.jpg
Hbg7.jpg
Windows Classic.theme
Windows Classic.theme
Erase privacy tracks on windows shutdown
Erase privacy tracks on windows shutdown
Disable unnecessary startup programs to make Windows boot faster
Disable unnecessary startup programs to make Windows boot faster
4.4.0.86
4.4.0.86
Integrator.exe
Integrator.exe
4.0.0.0
4.0.0.0