Skip to main content

Worm.Win32.AutoItGen_6ceaf1969b


Worm.Win32.AutoIt.FD, WormAutoItGen.YR (Lavasoft MAS)Behaviour: Worm

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: 6ceaf1969bacce2e154236e05feac591

SHA1: 3f7ae7845ad21942300fc00eb2b0acec0d5155a3

SHA256: 5316da40ce22a3b99d4e700a03309d6464ce7797f17184afbfc4ea76c116b192

SSDeep: 196608:qNntJfiv9hdKEz uLOGslsYtPURslS9XtLeIUujurJm3ULJTLGa:qhtu9hdPm RRXheILam6JT

Size: 12485632 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: UPolyXv05_v6

Company: Popeler.-.Installer

Created at: 2014-01-15 16:54:40

Analyzed on: WindowsXP SP3 32-bit

Summary: Worm. A program that is primarily replicating on networks or removable drives.

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Worm creates the following process(es):

Integrator.exe:3452
taskkill.exe:2244
DiskDefrag.exe:2340
gu4setup.exe:2184
regedit.exe:2716
regedit.exe:3660
Initialize.exe:2656

The Worm injects its code into the following process(es):

%original file name%.exe:1896

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process Integrator.exe:3452 makes changes in the file system.


The Worm creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\update[1].html (568 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\jquery.min[1].js (45771 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~gu3-ver.dat (107 bytes)
%Program Files%\Glary Utilities 4\data\AppSetting.ini (44667 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\news[1].ini (194 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\desktop.ini (67 bytes)
%Program Files%\Glary Utilities 4\data\backup.ini (9 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012014081520140816\index.dat (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\index[1].js (1177 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\redirect[1].php (107 bytes)
%Documents and Settings%\%current user%\Templates\GUTracksIni.tmp (42 bytes)
%Program Files%\Glary Utilities 4\news.ini (194 bytes)

The Worm deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013041520130416\index.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013040820130415 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013040820130415\index.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013041520130416 (0 bytes)
%Program Files%\Glary Utilities 4\data\backup.ini (0 bytes)
%Documents and Settings%\%current user%\Templates\GUTracksIni.tmp (0 bytes)

The process DiskDefrag.exe:2340 makes changes in the file system.


The Worm creates and/or writes to the following file(s):

%System%\BootDefrag.exe (601 bytes)
%System%\drivers\BootDefragDriver.sys (13 bytes)

The process %original file name%.exe:1896 makes changes in the file system.


The Worm creates and/or writes to the following file(s):

%WinDir%\MrSoftware\gu4setup.exe (90809 bytes)
%WinDir%\MrSoftware\reg.reg (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\autB3.tmp (482 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\autB2.tmp (96206 bytes)

The Worm deletes the following file(s):

%WinDir%\MrSoftware\gu4setup.exe (0 bytes)
%WinDir%\MrSoftware (0 bytes)
%WinDir%\MrSoftware\reg.reg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\autB3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\autB2.tmp (0 bytes)

The process gu4setup.exe:2184 makes changes in the file system.


The Worm creates and/or writes to the following file(s):

%Program Files%\Glary Utilities 4\skins\system information\others.png (544 bytes)
%Program Files%\Glary Utilities 4\languages.dll (1350 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\oc_btn_click.png (2 bytes)
%Program Files%\Glary Utilities 4\skins\icons\CheckUpdatehover.png (2 bytes)
%Program Files%\Glary Utilities 4\Native\wnet_x86\BootDefrag.exe (1615 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\systemcontrol.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsmB5.tmp\nsExec.dll (6 bytes)
%Program Files%\Glary Utilities 4\skins\system information\top.png (3 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\dockpopcurpage.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\systemtweaks.png (1 bytes)
%Program Files%\Glary Utilities 4\FileUndelete.exe (31651 bytes)
%Program Files%\Glary Utilities 4\Backup.dll (2695 bytes)
%Program Files%\Glary Utilities 4\Resources\Uninstaller\Large.png (3 bytes)
%Program Files%\Glary Utilities 4\Config.dll (26 bytes)
%Program Files%\Glary Utilities 4\DriverBackup.exe (6127 bytes)
%Program Files%\Glary Utilities 4\SpyRemover.dll (8263 bytes)
%Program Files%\Glary Utilities 4\skins\icons\emptyfolderfinder.png (1 bytes)
%Program Files%\Glary Utilities 4\Resources\DiskAnalysis\toolbar.png (7 bytes)
%Program Files%\Glary Utilities 4\data\BootTime.ini (3 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\filemanagement.png (1 bytes)
%Program Files%\Glary Utilities 4\Microsoft.VC90.CRT.manifest (524 bytes)
%Program Files%\Glary Utilities 4\skins\icons\regdefrag.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\skin_pic_normal.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\icons\fileencrypthover.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\icons\diskanalysishover.png (1 bytes)
%Program Files%\Glary Utilities 4\filesplitter.exe (2625 bytes)
%Program Files%\Glary Utilities 4\Resources\ProcessManager\ToolBar.png (6 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\oc_cancel_click.png (1 bytes)
%Program Files%\Glary Utilities 4\Resources\Uninstaller\Recently.png (3 bytes)
%Program Files%\Glary Utilities 4\languages\Slovak.lng (2711 bytes)
%Program Files%\Glary Utilities 4\Uninstaller.exe (7832 bytes)
%Program Files%\Glary Utilities 4\languages\hebrew.lng (1568 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\main_close.png (1 bytes)
%Program Files%\Glary Utilities 4\fileencrypt.exe (3595 bytes)
%Program Files%\Glary Utilities 4\languages\Romana.lng (2500 bytes)
%Documents and Settings%\All Users\Desktop\Glary Utilities 4.lnk (755 bytes)
%Program Files%\Glary Utilities 4\skins\icons\diskdefraghover.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\icons\registrycleaner.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\system information\drives.png (346 bytes)
%Program Files%\Glary Utilities 4\skins\system information\display.png (636 bytes)
%Program Files%\Glary Utilities 4\skins\icons\BrowserAssistanthover.png (1 bytes)
%Program Files%\Glary Utilities 4\Resources\DiskAnalysis\file_result.png (7 bytes)
%Program Files%\Glary Utilities 4\skins\icons\restorecenter.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\system information\cpu.png (372 bytes)
%Program Files%\Glary Utilities 4\skins\system information\network.png (618 bytes)
%Program Files%\Glary Utilities 4\skins\icons\fileundeletehover.png (1 bytes)
%Program Files%\Glary Utilities 4\Resources\Uninstaller\RarelyUsed.png (3 bytes)
%Program Files%\Glary Utilities 4\Resources\RegistryDefrag\regdefrag.png (25 bytes)
%Program Files%\Glary Utilities 4\Native\wxp_x86\RegBootDefrag.exe (22 bytes)
%Program Files%\Glary Utilities 4\skins\system information\topdown.png (3 bytes)
%Program Files%\Glary Utilities 4\skins\icons\fileundelete.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\checkbox_checked.png (1 bytes)
%Program Files%\Glary Utilities 4\LockDll.dll (20809 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\dockpopturnleft.png (2 bytes)
%Program Files%\Glary Utilities 4\languages\spain.lng (3093 bytes)
%Program Files%\Glary Utilities 4\languages\french.lng (3711 bytes)
%Program Files%\Glary Utilities 4\skins\icons\checkdiskhover.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\icons\BrowserAssistant.png (1 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Glary Utilities 4\Website.lnk (802 bytes)
%Program Files%\Glary Utilities 4\skins\icons\procmgrhover.png (1 bytes)
%Program Files%\Glary Utilities 4\Resources\Uninstaller\AllPrograms.png (3 bytes)
%Program Files%\Glary Utilities 4\Resources\CheckDisk\button_expand.png (3 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\oc_cancel_hover.png (1 bytes)
%Program Files%\Glary Utilities 4\BootTime.dll (20 bytes)
%Program Files%\Glary Utilities 4\languages\dutch.lng (1976 bytes)
%Program Files%\Glary Utilities 4\languages\english.lng (1897 bytes)
%Program Files%\Glary Utilities 4\languages\Finnish_(KBoost).lng (1678 bytes)
%Program Files%\Glary Utilities 4\joinExe.exe (1827 bytes)
%Program Files%\Glary Utilities 4\languages\italian.lng (2701 bytes)
%Program Files%\Glary Utilities 4\Native\wlh_x86\BootDefrag.exe (1578 bytes)
%Program Files%\Glary Utilities 4\DiskCleaner.dll (15221 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\diskspace.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\icons\driverbackup.png (1 bytes)
%Program Files%\Glary Utilities 4\msvcm90.dll (4349 bytes)
%Program Files%\Glary Utilities 4\skins\icons\restorecenterhover.png (1 bytes)
%Program Files%\Glary Utilities 4\RemoveDriver.dll (5165 bytes)
%Program Files%\Glary Utilities 4\CheckUpdate.dll (19685 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\main_right_top_mark_click_bg.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\pop_btn_normal.png (3 bytes)
%Program Files%\Glary Utilities 4\MemfilesService.exe (4526 bytes)
%Program Files%\Glary Utilities 4\Resources\Uninstaller\View.png (3 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\clear_tips.png (3 bytes)
%Program Files%\Glary Utilities 4\memdefrag.exe (3673 bytes)
%Program Files%\Glary Utilities 4\Native\wnet_x64\BootDefragDriver.sys (17 bytes)
%Program Files%\Glary Utilities 4\DiskDefrag.exe (12394 bytes)
%Program Files%\Glary Utilities 4\Resources\ProcessManager\RClickMenu.png (4 bytes)
%Program Files%\Glary Utilities 4\skins\default\backimages\bg1.jpg (4853 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\tab_ov_blue.png (3 bytes)
%Program Files%\Glary Utilities 4\Native\win7_x64\BootDefrag.exe (4197 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\tab_btn_hover.png (2 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\dockpopbg.png (3 bytes)
%Program Files%\Glary Utilities 4\skins\icons\checkdisk.png (1 bytes)
%Program Files%\Glary Utilities 4\languages\Greek.lng (3583 bytes)
%Program Files%\Glary Utilities 4\data\xb.dat (14600 bytes)
%Program Files%\Glary Utilities 4\skins\icons\shortcutfixerhover.png (2 bytes)
%Program Files%\Glary Utilities 4\skins\icons\startupmanager.png (2 bytes)
%Program Files%\Glary Utilities 4\languages\French(FR).lng (3564 bytes)
%Program Files%\Glary Utilities 4\languages\Francais.lng (3411 bytes)
%Program Files%\Glary Utilities 4\upgrade.exe (1964 bytes)
%Program Files%\Glary Utilities 4\DPInst32.exe (18153 bytes)
%Program Files%\Glary Utilities 4\data\xt.dat (26 bytes)
%Program Files%\Glary Utilities 4\data\backup.dat (864 bytes)
%Program Files%\Glary Utilities 4\Resources\EmptyFolderFinder\toolbar.png (6 bytes)
%Program Files%\Glary Utilities 4\languages\ukrainian.lng (2421 bytes)
%Program Files%\Glary Utilities 4\languages\French(CA).lng (1802 bytes)
%Program Files%\Glary Utilities 4\skins\icons\filesplitterhover.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\icons\diskcleaner.png (1 bytes)
%Program Files%\Glary Utilities 4\Native\win7_x86\BootDefrag.exe (1630 bytes)
%Program Files%\Glary Utilities 4\skins\icons\Uninstaller.png (2 bytes)
%Program Files%\Glary Utilities 4\skins\system information\memory.png (503 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\dockpopturnright.png (2 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\tab_ad_blue.png (3 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\pop_btn_click.png (3 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\main_feedback.png (1 bytes)
%Program Files%\Glary Utilities 4\languages\Czech.lng (2518 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsmB5.tmp\nsB6.tmp (6 bytes)
%Program Files%\Glary Utilities 4\Resources\SysInfo\NetworkNode.png (535 bytes)
%Program Files%\Glary Utilities 4\RestoreCenter.exe (1568 bytes)
%Program Files%\Glary Utilities 4\languages\Romania.lng (2446 bytes)
%Program Files%\Glary Utilities 4\StartupManager.exe (1568 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\systemstatus.png (1 bytes)
%Program Files%\Glary Utilities 4\CheckDisk.dll (4538 bytes)
%Program Files%\Glary Utilities 4\Native\wnet_x86\BootDefragDriver.sys (14 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\pop_btn_hover.png (3 bytes)
%Program Files%\Glary Utilities 4\Resources\settings\DiskCleanerImageList.bmp (25 bytes)
%Program Files%\Glary Utilities 4\data\duplicates.dat (288 bytes)
%Program Files%\Glary Utilities 4\Native\wlh_x86\BootDefragDriver.sys (14 bytes)
%Program Files%\Glary Utilities 4\QuickSearch.exe (9589 bytes)
%Program Files%\Glary Utilities 4\TracksEraser.dll (21815 bytes)
%Program Files%\Glary Utilities 4\Native\win7_x86\BootDefragDriver.sys (14 bytes)
%Program Files%\Glary Utilities 4\skins\icons\cmmhover.png (1 bytes)
%Program Files%\Glary Utilities 4\Log.dll (3673 bytes)
%Program Files%\Glary Utilities 4\cmm.exe (3849 bytes)
%Program Files%\Glary Utilities 4\skins\icons\shredder.png (1 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch\Glary Utilities 4.lnk (773 bytes)
%Program Files%\Glary Utilities 4\languages\French (Ad Lib).lng (2535 bytes)
%Program Files%\Glary Utilities 4\skins\icons\procmgr.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\tab_btn_normal.png (2 bytes)
%Program Files%\Glary Utilities 4\skins\default\backimages\bg6.jpg (1406 bytes)
%Program Files%\Glary Utilities 4\data\junkInfo.ini (1 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Glary Utilities 4\Uninstall.lnk (569 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\main_right_top_mark_sep.png (941 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\privacy.png (1 bytes)
%Program Files%\Glary Utilities 4\languages\chinese.lng (2317 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\search_mark.png (3 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\progress_bg.png (469 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\registry.png (1 bytes)
%Program Files%\Glary Utilities 4\languages\russian.lng (1862 bytes)
%Program Files%\Glary Utilities 4\skins\icons\driverbackuphover.png (1 bytes)
%Program Files%\Glary Utilities 4\Resources\DiskCleaner\toolbar.png (7 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\skinsbg.png (439 bytes)
%Program Files%\Glary Utilities 4\languages\turkish.lng (3258 bytes)
%Program Files%\Glary Utilities 4\skins\icons\Uninstallerhover.png (2 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\oc_cancel_normal.png (680 bytes)
%Program Files%\Glary Utilities 4\sysinfo.exe (10633 bytes)
%Program Files%\Glary Utilities 4\autodll.dll (2332 bytes)
%Program Files%\Glary Utilities 4\Resources\RegistryCleaner\Toolbar Default.png (6 bytes)
%Program Files%\Glary Utilities 4\dupefinder.exe (9324 bytes)
%Program Files%\Glary Utilities 4\skins\system information\normalhot.png (3 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\skin_custom.png (989 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\skin_col_normal.png (1 bytes)
%Program Files%\Glary Utilities 4\Resources\SysInfo\OtherDevicesNode.png (5 bytes)
%Program Files%\Glary Utilities 4\zlib1.dll (4242 bytes)
%Program Files%\Glary Utilities 4\skins\icons\registrycleanerhover.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\antimalware.png (1 bytes)
%Program Files%\Glary Utilities 4\CheckDiskProgress.exe (2104 bytes)
%Program Files%\Glary Utilities 4\Resources\InternetBooster\IBackGround.jpg (13 bytes)
%Program Files%\Glary Utilities 4\Native\wnet_x64\BootDefrag.exe (4149 bytes)
%Program Files%\Glary Utilities 4\skins\icons\trackseraserhover.png (1 bytes)
%Program Files%\Glary Utilities 4\DPInst64.exe (21501 bytes)
%Program Files%\Glary Utilities 4\data\startup.dat (2712 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\main_right_top_mark_hover_bg.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\main_close_click.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\icons\filesplitter.png (1 bytes)
%Program Files%\Glary Utilities 4\Integrator.exe (20633 bytes)
%Program Files%\Glary Utilities 4\EncryptExe.exe (10975 bytes)
%Program Files%\Glary Utilities 4\Undelete.dll (4085 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\progress.png (4 bytes)
%Program Files%\Glary Utilities 4\skins\default\backimages\bg7.jpg (1568 bytes)
%Program Files%\Glary Utilities 4\SoftwareUpdate.exe (7455 bytes)
%Program Files%\Glary Utilities 4\BottDefrag.dll (1946 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\menu_click.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\oc_detailbg.png (1 bytes)
%Program Files%\Glary Utilities 4\TracksEraser.exe (1568 bytes)
%Program Files%\Glary Utilities 4\languages\German.lng (2582 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\skintransparentmark.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\dockpopturnleftgray.png (1 bytes)
%Program Files%\Glary Utilities 4\Native\wxp_x86\BootDefragDriver.sys (13 bytes)
%Program Files%\Glary Utilities 4\settings.dll (9533 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\harddisk.png (1 bytes)
%Program Files%\Glary Utilities 4\languages\ukrainian2.lng (2222 bytes)
%Program Files%\Glary Utilities 4\skins\icons\emptyfolderfinderhover.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\oc_btn_hover.png (2 bytes)
%Program Files%\Glary Utilities 4\skins\icons\CheckUpdate.png (2 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\menu_normal.png (1 bytes)
%Program Files%\Glary Utilities 4\data\duplicatesfolder.dat (194 bytes)
%Program Files%\Glary Utilities 4\uninst.exe (2229 bytes)
%Program Files%\Glary Utilities 4\skins\icons\shortcutfixer.png (1 bytes)
%Program Files%\Glary Utilities 4\ObjectAdmin.dll (1765 bytes)
%Program Files%\Glary Utilities 4\Resources\TracksEraser\toolbar.png (6 bytes)
%Program Files%\Glary Utilities 4\Resources\SpyRemover\BKPic.png (1568 bytes)
%Program Files%\Glary Utilities 4\skins\icons\sysinfohover.png (1 bytes)
%Program Files%\Glary Utilities 4\procmgr.exe (7880 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\btn_click.png (2 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\body_transbg.png (8 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\main_close_hover.png (1 bytes)
%Program Files%\Glary Utilities 4\Resources\SysInfo\System Information.png (7 bytes)
%Program Files%\Glary Utilities 4\Native\wxp_x86\BootDefrag.exe (1613 bytes)
%Program Files%\Glary Utilities 4\Resources\settings\TracksEraseImageList.bmp (7 bytes)
%Program Files%\Glary Utilities 4\data\htmldata.dat (1 bytes)
%Program Files%\Glary Utilities 4\ScanFile.dll (1150 bytes)
%Program Files%\Glary Utilities 4\Resources\Uninstaller\WindowsUpdates.png (3 bytes)
%Program Files%\Glary Utilities 4\settings.ini (24 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\tab_ov.png (3 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\oc_btn_normal.png (2 bytes)
%Program Files%\Glary Utilities 4\languages\finnish.lng (1659 bytes)
%Program Files%\Glary Utilities 4\FileScanFilter.dll (9287 bytes)
%Program Files%\Glary Utilities 4\Native\wxp_x64\RegBootDefrag.exe (24 bytes)
%Program Files%\Glary Utilities 4\regdefrag.exe (3265 bytes)
%Program Files%\Glary Utilities 4\skins\icons\spyremover.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\oneclickmaintenance_front.png (2 bytes)
%Program Files%\Glary Utilities 4\skins\default\backimages\bg5.jpg (134 bytes)
%Program Files%\Glary Utilities 4\skins\icons\spyremoverhover.png (1 bytes)
%Program Files%\Glary Utilities 4\Glary Utilities 4.url (62 bytes)
%Program Files%\Glary Utilities 4\Resources\Dupefinder\tool.png (5 bytes)
%Program Files%\Glary Utilities 4\Resources\SysInfo\OperSysNode.png (9 bytes)
%Program Files%\Glary Utilities 4\msvcr90.dll (14706 bytes)
%Program Files%\Glary Utilities 4\languages\dutch2.lng (2980 bytes)
%Program Files%\Glary Utilities 4\languages\Magyar2.lng (4112 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\btn_normal.png (2 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\oneclick_progress.png (4 bytes)
%Program Files%\Glary Utilities 4\skins\icons\diskcleanerhover.png (1 bytes)
%Program Files%\Glary Utilities 4\shredder.exe (4681 bytes)
%Program Files%\Glary Utilities 4\skins\system information\windows.png (882 bytes)
%Program Files%\Glary Utilities 4\languages\Dutch3.lng (3098 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\dockpopturnrightgray.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\ov_boottimebg.png (3 bytes)
%Program Files%\Glary Utilities 4\data\junk.dat (1 bytes)
%Program Files%\Glary Utilities 4\Resources\ShortuctFixer\toolbar.png (9 bytes)
%Program Files%\Glary Utilities 4\ShortcutFixer.dll (7408 bytes)
%Program Files%\Glary Utilities 4\Resources\SysInfo\Picture.png (8 bytes)
%Program Files%\Glary Utilities 4\ShortcutFixer.exe (1568 bytes)
%Program Files%\Glary Utilities 4\OneClickMaintenance.exe (7818 bytes)
%Program Files%\Glary Utilities 4\languages\French(#DG#).lng (2590 bytes)
%Program Files%\Glary Utilities 4\DiskAnalysis.exe (10839 bytes)
%Program Files%\Glary Utilities 4\languages\arabic.lng (2806 bytes)
%Program Files%\Glary Utilities 4\Native\wlh_x64\BootDefrag.exe (4153 bytes)
%Program Files%\Glary Utilities 4\Native\wxp_x64\BootDefrag.exe (4099 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\main_min.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\menu_hover.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\default\backimages\bg3.jpg (1032 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Glary Utilities 4\Glary Utilities 4.lnk (767 bytes)
%Program Files%\Glary Utilities 4\skins\icons\sysinfo.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\icons\memdefrag.png (2 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\tab_oc.png (3 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\oneclick_bg.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\main_restore.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\main_like.png (1 bytes)
%Program Files%\Glary Utilities 4\languages\slovenian.lng (2096 bytes)
%Program Files%\Glary Utilities 4\Microsoft.VC90.MFC.manifest (548 bytes)
%Program Files%\Glary Utilities 4\languages\vietnamese.lng (3050 bytes)
%Program Files%\Glary Utilities 4\skins\icons\memdefraghover.png (2 bytes)
%Program Files%\Glary Utilities 4\data\empty.dat (478 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\oc_needclearbg.png (288 bytes)
%Program Files%\Glary Utilities 4\Resources\SysInfo\OverViewNode.png (8 bytes)
%Program Files%\Glary Utilities 4\languages\japanese.lng (2017 bytes)
%Program Files%\Glary Utilities 4\data\registry.dat (8 bytes)
%Program Files%\Glary Utilities 4\SpyRemover.exe (1568 bytes)
%Program Files%\Glary Utilities 4\msvcp90.dll (12049 bytes)
%Program Files%\Glary Utilities 4\RestoreCenter.dll (6654 bytes)
%Program Files%\Glary Utilities 4\languages\Danish.lng (4516 bytes)
%Program Files%\Glary Utilities 4\Resources\DiskDefrag\toolbar.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\system information\normaldown.png (3 bytes)
%Program Files%\Glary Utilities 4\skins\icons\dupefinder.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\icons\trackseraser.png (1 bytes)
%Program Files%\Glary Utilities 4\data\procsubmit.dat (1 bytes)
%Program Files%\Glary Utilities 4\skins\default\backimages\bg9.jpg (2712 bytes)
%Program Files%\Glary Utilities 4\RegistryCleaner.dll (13135 bytes)
%Program Files%\Glary Utilities 4\languages\polish.lng (2292 bytes)
%Program Files%\Glary Utilities 4\languages\chineseT.lng (3002 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\drivers.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\icons\dupefinderhover.png (1 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Glary Utilities 4.lnk (761 bytes)
%Program Files%\Glary Utilities 4\skins\icons\startupmanagerhover.png (2 bytes)
%Program Files%\Glary Utilities 4\Resources\StartupManager\toolbar.png (8 bytes)
%Program Files%\Glary Utilities 4\EmptyFolderFinder.exe (5963 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\btn_hover.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsmB5.tmp\System.dll (11 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\oneclickmaintenance_needclear_bg.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\default\backimages\bg4.jpg (21 bytes)
%Program Files%\Glary Utilities 4\Memfiles.dll (1838 bytes)
%Program Files%\Glary Utilities 4\StartupManager.dll (10956 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\tab_ad.png (3 bytes)
%Program Files%\Glary Utilities 4\skins\default\backimages\bg2.jpg (12 bytes)
%Program Files%\Glary Utilities 4\skins\icons\fileencrypt.png (1 bytes)
%Program Files%\Glary Utilities 4\data\apps.dat (8 bytes)
%Program Files%\Glary Utilities 4\gsd.exe (1236 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\logo.png (9 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\usertype_btn.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\oneclickmaintenance_bg.png (7 bytes)
%Program Files%\Glary Utilities 4\data\settings.dat (3 bytes)
%Program Files%\Glary Utilities 4\languages\Swedish.lng (3102 bytes)
%Program Files%\Glary Utilities 4\languages\ptbr.lng (2204 bytes)
%Program Files%\Glary Utilities 4\Resources\TurboMode\BackGround.jpg (16 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\dockpopdarkbg.png (1 bytes)
%Program Files%\Glary Utilities 4\DiskCleaner.exe (1568 bytes)
%Program Files%\Glary Utilities 4\data\xdata.dat (1568 bytes)
%Program Files%\Glary Utilities 4\Native\wxp_x64\BootDefragDriver.sys (17 bytes)
%Program Files%\Glary Utilities 4\CheckUpdate.exe (1568 bytes)
%Program Files%\Glary Utilities 4\skins\icons\quicksearchhover.png (1 bytes)
%Program Files%\Glary Utilities 4\languages\Magyar.lng (1728 bytes)
%Program Files%\Glary Utilities 4\skins\icons\diskdefrag.png (1 bytes)
%Program Files%\Glary Utilities 4\Native\win7_x64\BootDefragDriver.sys (17 bytes)
%Program Files%\Glary Utilities 4\ContextHandler.dll (1758 bytes)
%Program Files%\Glary Utilities 4\Resources\SysInfo\DisplayNode.png (5 bytes)
%Program Files%\Glary Utilities 4\Resources\SysInfo\SystemDevicesNode.png (4 bytes)
%Program Files%\Glary Utilities 4\skins\system information\computer.png (3 bytes)
%Program Files%\Glary Utilities 4\Resources\SysInfo\DrivesNode.png (6 bytes)
%Program Files%\Glary Utilities 4\skins\icons\SoftwareUpdate.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\default\backimages\bg8.jpg (914 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\dockpopcurpagegray.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\icons\SoftwareUpdatehover.png (1 bytes)
%Program Files%\Glary Utilities 4\languages\French_(RT).lng (3489 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\oc_btn_scan.png (1 bytes)
%Program Files%\Glary Utilities 4\languages\spanish.lng (2319 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\DockButton_Tip.png (2 bytes)
%Program Files%\Glary Utilities 4\iehelper.exe (17138 bytes)
%Program Files%\Glary Utilities 4\Native\wlh_x64\BootDefragDriver.sys (17 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\checkbox_uncheck.png (1 bytes)
%Program Files%\Glary Utilities 4\Resources\QuickSearch\images\quick_search_logo.png (3 bytes)
%Program Files%\Glary Utilities 4\CheckDisk.exe (1568 bytes)
%Program Files%\Glary Utilities 4\skins\icons\regdefraghover.png (1 bytes)
%Program Files%\Glary Utilities 4\Resources\settings\CleanRegistryImageList.bmp (18 bytes)
%Program Files%\Glary Utilities 4\data\process.dat (1568 bytes)
%Program Files%\Glary Utilities 4\skins\icons\diskanalysis.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\main_skin.png (1 bytes)
%Program Files%\Glary Utilities 4\languages\spanish (McM).lng (3122 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\programs.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\tab_oc_blue.png (3 bytes)
%Program Files%\Glary Utilities 4\RegistryCleaner.exe (2009 bytes)
%Program Files%\Glary Utilities 4\skins\icons\shredderhover.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\default\skin.ini (653 bytes)
%Program Files%\Glary Utilities 4\mfc90u.dll (27634 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\tab_btn_click.png (2 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\toolbar.png (3 bytes)
%Program Files%\Glary Utilities 4\skins\icons\quicksearch.png (1 bytes)
%Program Files%\Glary Utilities 4\skins\default\images\foot_transbg.png (7 bytes)
%Program Files%\Glary Utilities 4\GridMap.ocx (9906 bytes)
%Program Files%\Glary Utilities 4\Initialize.exe (3586 bytes)
%Program Files%\Glary Utilities 4\skins\icons\cmm.png (1 bytes)

The Worm deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nshB4.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsmB5.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsmB5.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsmB5.tmp\nsExec.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsmB5.tmp\nsB6.tmp (0 bytes)

The process Initialize.exe:2656 makes changes in the file system.


The Worm creates and/or writes to the following file(s):

%WinDir%\Tasks\GlaryInitialize 4.job (316 bytes)
%Program Files%\Glary Utilities 4\data\backup.ini (9 bytes)
%Documents and Settings%\%current user%\Templates\GUTracksIni.tmp (42 bytes)

The Worm deletes the following file(s):

%Program Files%\Glary Utilities 4\data\backup.ini (0 bytes)
%Documents and Settings%\%current user%\Templates\GUTracksIni.tmp (0 bytes)

Registry activity

The process Integrator.exe:3452 makes changes in the system registry.


The Worm creates and/or sets the following values in system registry:

[HKCU\Software\Glarysoft\Glary Utilities 4\Settings]
"AutoSoftupdate" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fdd9f6f3-7454-11e2-b4cd-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014081520140816]
"CacheLimit" = "8192"

[HKCU\Software\Glarysoft\Glary Utilities 4\OneClick\Selected]
"OC_REMOVETF" = "1"

[HKCU\Software\Glarysoft\Glary Utilities 4\Settings]
"Checkupdates" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{773a730e-74fb-11e2-b597-000c293bdf2f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\GlarySoft\Glary Utilities 4]
"date" = "41866.7095370370"

[HKCU\Software\Glarysoft\Glary Utilities 4\Settings\PrivacyTracks]
"EraseTracks" = "0"

[HKCU\Software\Glarysoft\Glary Utilities 4]
"Transparen" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Glarysoft\Glary Utilities 4\OneClick]
"DeepClean" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKCU\Software\Glarysoft\Glary Utilities 4]
"Current View" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014081520140816]
"CachePath" = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012014081520140816"

[HKCU\Software\Glarysoft\Glary Utilities 4\OneClick\Selected]
"OC_OPTIMIZESA" = "1"

[HKLM\SOFTWARE\GlarySoft\Glary Utilities 4]
"SkipVersion" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Glarysoft\Glary Utilities 4\Advanced Tools]
"ADT_WR_REPAIR" = "1"

[HKCU\Software\Glarysoft\Glary Utilities 4\OneClick\Selected]
"OC_DISKR" = "0"

[HKLM\SOFTWARE\GlarySoft\Glary Utilities 4]
"UpdateURL" = "http://www.glarysoft.com/glary-utilities-pro/download/?ref=pro&v=4.4.0.86"

[HKCU\Software\Glarysoft\Glary Utilities 4\Advanced Tools]
"ADT_PRIVACY_ERASEH" = "9"
"ADT_PROGRAMS_CHECKFU" = "7"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Templates" = "%Documents and Settings%\%current user%\Templates"

[HKCU\Software\Glarysoft\Glary Utilities 4]
"BootTime" = "5929"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\GlarySoft\Glary Utilities 4]
"NewVersion" = "5.5.0.12"

"Version" = "4.4.0.86"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Favorites" = "%Documents and Settings%\%current user%\Favorites"

[HKCU\Software\Glarysoft\Glary Utilities 4\Advanced Tools]
"ADT_DS_CLEANUP" = "2"
"ADT_DS_EXPLORERD" = "4"

[HKCU\Software\Glarysoft\Glary Utilities 4\OneClick\Selected]
"OC_MALWARER" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fdd9f6f2-7454-11e2-b4cd-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Glarysoft\Glary Utilities 4\Settings]
"BackupsMax" = "60"

[HKCU\Software\Glarysoft\Glary Utilities 4\Advanced Tools]
"ADT_PROGRAMS_UNINSTALL" = "6"

[HKCU\Software\Microsoft\Internet Explorer\Main\WindowsSearch]
"Version" = "WS not installed"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014081520140816]
"CacheOptions" = "11"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 41 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\GlarySoft\Glary Utilities 4]
"NewVersionDate" = "41866.709606"
"ProAutodownload" = "0"

[HKCU\Software\Glarysoft\Glary Utilities 4\Advanced Tools]
"ADT_ST_BROWSERS" = "8"

[HKCU\Software\Glarysoft\Glary Utilities 4]
"Update" = "1408111308"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "66 3E 9D 18 C4 62 F8 D4 72 B0 C1 DC 67 BA 21 5F"

[HKCU\Software\Glarysoft\Glary Utilities 4\Advanced Tools]
"ADT_SC_PROCESSES" = "5"

[HKCU\Software\Glarysoft\Glary Utilities 4\OneClick\Selected]
"OC_REMOVEBS" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Glarysoft\Glary Utilities 4\OneClick\Selected]
"OC_CLEANREG" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014081520140816]
"CacheRepair" = "0"

[HKCU\Software\Glarysoft\Glary Utilities 4\Advanced Tools]
"ADT_SC_CONTEXTM" = "3"

[HKCU\Software\Glarysoft\Glary Utilities 4\Settings]
"Auto1ClickCare" = "0"

[HKCU\Software\Glarysoft\Glary Utilities 4\Advanced Tools]
"ADT_SC_STARTUPI" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\GlarySoft\Glary Utilities 4]
"rootDir" = "%Program Files%\Glary Utilities 4\"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fdd9f6f5-7454-11e2-b4cd-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014081520140816]
"CachePrefix" = ":2014081520140816:"

[HKCU\Software\Glarysoft\Glary Utilities 4]
"CurSkin" = "%Program Files%\Glary Utilities 4\skins\default\skin.ini"

[HKCU\Software\Glarysoft\Glary Utilities 4\OneClick\Selected]
"OC_ERASEPT" = "0"

[HKCU\Software\Glarysoft\Glary Utilities 4\Settings]
"ShowQuicklaunchTips" = "1"

The Worm modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Worm modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Worm modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Worm deletes the following registry key(s):

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013041520130416]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013040820130415]

The Worm deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process taskkill.exe:2244 makes changes in the system registry.


The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "23 03 F3 64 58 E3 9A 85 75 EB 64 19 B9 A7 B5 FF"

The process DiskDefrag.exe:2340 makes changes in the system registry.


The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8B 51 D9 24 A9 38 13 32 1D E0 97 27 ED E3 BF 8B"

[HKLM\System\CurrentControlSet\Services\BootDefrag]
"RunCHK" = "0"

[HKLM\System\CurrentControlSet\Control\Session Manager]
"BootExecute" = "autocheck autochk *"

The process %original file name%.exe:1896 makes changes in the system registry.


The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A4 C8 12 E6 87 48 EE 71 93 83 75 58 4E E8 63 53"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fdd9f6f3-7454-11e2-b4cd-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{773a730e-74fb-11e2-b597-000c293bdf2f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\Windows\MrSoftware]
"gu4setup.exe" = "gu4setup"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fdd9f6f2-7454-11e2-b4cd-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fdd9f6f5-7454-11e2-b4cd-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

The Worm modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

The Worm modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The Worm modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The process gu4setup.exe:2184 makes changes in the system registry.


The Worm creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fdd9f6f3-7454-11e2-b4cd-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\GlarySoft\Glary Utilities 4]
"LngVersion" = "2014-1-6"

[HKCR\ContextHandler.CContextMenu.1]
"(Default)" = "CContextMenu Class"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKLM\SOFTWARE\GlarySoft\Glary Utilities 4]
"date" = ""

[HKCR\GRIDMAP_CTRL.GridMapCtrl.1]
"(Default)" = "GridMap 控件"

[HKCR\TypeLib\{35AE4004-4194-4243-92AA-351BB7239539}\1.0\0\win32]
"(Default)" = "%Program Files%\Glary Utilities 4\GridMap.ocx"

[HKLM\SOFTWARE\GlarySoft\Glary Utilities 4]
"UpgradeTags" = ""

[HKCR\Interface\{FD50332F-185B-4D3C-B921-E0B65E547F28}\TypeLib]
"Version" = "1.0"

[HKCR\Interface\{31FB3410-EA8B-4931-91C5-ADA7B91D953B}\TypeLib]
"(Default)" = "{35AE4004-4194-4243-92AA-351BB7239539}"

[HKCR\CLSID\{B3C418F8-922B-4faf-915E-59BC14448CF7}\InprocServer32]
"(Default)" = "%Program Files%\Glary Utilities 4\ContextHandler.dll"

[HKCR\Interface\{FD50332F-185B-4D3C-B921-E0B65E547F28}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Glary Utilities 4]
"UninstallString" = "%Program Files%\Glary Utilities 4\uninst.exe"

[HKCR\GU.Encrypted]
"(Default)" = "Glary Utilities Encrypted File"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Glary Utilities 4]
"Publisher" = "Glarysoft Ltd"

[HKLM\SOFTWARE\GlarySoft\Glary Utilities 4]
"RefVersion" = "2014-1-6"

[HKCR\CLSID\{58B505BE-F589-4E8E-8BF2-B78E078CA8F7}\Version]
"(Default)" = "1.0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\GlarySoft\Glary Utilities 4]
"UpdateDate" = "2014-1-6"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Glary Utilities 4]
"QuickLaunch" = "true"

[HKCR\Interface\{28C97FA4-8378-42BF-A6F9-D615EB1272D7}\ProxyStubClsid32]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fdd9f6f5-7454-11e2-b4cd-806d6172696f}]
"BaseClass" = "Drive"

[HKCR\CLSID\{58B505BE-F589-4E8E-8BF2-B78E078CA8F7}\MiscStatus]
"(Default)" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Glary Utilities 4]
"DisplayName" = "Glary Utilities 4.4"

[HKCR\Drive\shellex\ContextMenuHandlers]
"(Default)" = ""

[HKCR\CLSID\{7A1C7081-0275-49FB-B76F-B9A66767BB56}\InprocServer32]
"(Default)" = "C:\PROGRA~1\GLARYU~1\GridMap.ocx"

[HKCR\Interface\{31FB3410-EA8B-4931-91C5-ADA7B91D953B}\ProxyStubClsid32]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"

[HKCU\Software\Glarysoft\Glary Utilities 4\Settings\ContextMenu]
"EmptyFolder" = "1"

[HKCR\Folder\shellex\ContextMenuHandlers\Glary Utilities]
"(Default)" = "{B3C418F8-922B-4faf-915E-59BC14448CF7}"

[HKCR\TypeLib\{B52C0F28-8D4C-4886-965C-0A772490064E}\1.0\FLAGS]
"(Default)" = "0"

[HKCR\Interface\{FD50332F-185B-4D3C-B921-E0B65E547F28}\TypeLib]
"(Default)" = "{B52C0F28-8D4C-4886-965C-0A772490064E}"

[HKCR\*\shellex]
"(Default)" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCR\ContextHandler.CContextMenu\CurVer]
"(Default)" = "ContextHandler.CContextMenu.1"

[HKCR\Interface\{28C97FA4-8378-42BF-A6F9-D615EB1272D7}\ProxyStubClsid]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"

[HKCR\Interface\{28C97FA4-8378-42BF-A6F9-D615EB1272D7}]
"(Default)" = "_DGridMap_Ctrl"

[HKCR\CLSID\{58B505BE-F589-4E8E-8BF2-B78E078CA8F7}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\Interface\{31FB3410-EA8B-4931-91C5-ADA7B91D953B}\TypeLib]
"Version" = "1.0"

[HKCU\Software\Glarysoft\Glary Utilities 4]
"Language" = "english.lng"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Glary Utilities 4]
"DisplayIcon" = "%Program Files%\Glary Utilities 4\Integrator.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCR\CLSID\{B3C418F8-922B-4faf-915E-59BC14448CF7}\ProgID]
"(Default)" = "ContextHandler.CContextMenu.1"

[HKCR\Folder\shellex]
"(Default)" = ""

[HKCU\Software\Glarysoft\Glary Utilities 4\Settings\ContextMenu]
"Wipe" = "1"

[HKCR\CLSID\{58B505BE-F589-4E8E-8BF2-B78E078CA8F7}\ProgID]
"(Default)" = "GRIDMAP_CTRL.GridMapCtrl.1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Integrator4.exe]
"(Default)" = "%Program Files%\Glary Utilities 4\Integrator.exe"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "25 38 CC 44 EA EF 99 DA 31 1C 69 0F 64 3C C5 8D"

[HKCR\TypeLib\{B52C0F28-8D4C-4886-965C-0A772490064E}\1.0\0\win32]
"(Default)" = "%Program Files%\Glary Utilities 4\ContextHandler.dll"

[HKCR\CLSID\{B3C418F8-922B-4faf-915E-59BC14448CF7}\TypeLib]
"(Default)" = "{B52C0F28-8D4C-4886-965C-0A772490064E}"

[HKCR\AppID\{A805009D-B902-439A-8E64-26EE3507A12E}]
"(Default)" = "ContextHandler"

[HKLM\SOFTWARE\GlarySoft\Glary Utilities 4]
"rootDir" = "%Program Files%\Glary Utilities 4"

[HKCU\Software\Glarysoft\Glary Utilities 4\Settings\ContextMenu]
"Decrypt" = "1"

[HKCR\TypeLib\{B52C0F28-8D4C-4886-965C-0A772490064E}\1.0]
"(Default)" = "ContextHandler 1.0 ÀàÐÍ¿â"

[HKCR\CLSID\{58B505BE-F589-4E8E-8BF2-B78E078CA8F7}\Control]
"(Default)" = ""

[HKCU\Software\Glarysoft\Glary Utilities 4\Settings\ContextMenu]
"Analyze Diskspace" = "1"

[HKCR\GU.Encrypted\DefaultIcon]
"(Default)" = "%Program Files%\Glary Utilities 4\fileencrypt.exe,0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCR\CLSID\{B3C418F8-922B-4faf-915E-59BC14448CF7}]
"(Default)" = "CContextMenu Class"

[HKCU\Software\Glarysoft\Glary Utilities 4\Settings\ContextMenu]
"Split" = "1"

[HKCR\CLSID\{58B505BE-F589-4E8E-8BF2-B78E078CA8F7}\InprocServer32]
"(Default)" = "C:\PROGRA~1\GLARYU~1\GridMap.ocx"

[HKCR\TypeLib\{35AE4004-4194-4243-92AA-351BB7239539}\1.0\HELPDIR]
"(Default)" = ""

[HKCR\GU.Encrypted\Shell\Open\Command]
"(Default)" = "%Program Files%\Glary Utilities 4\fileencrypt.exe -d %1"

[HKCR\GU.Splitted]
"(Default)" = "Glary Utilities Splitted File"

[HKCR\ContextHandler.CContextMenu.1\CLSID]
"(Default)" = "{B3C418F8-922B-4faf-915E-59BC14448CF7}"

[HKLM\SOFTWARE\GlarySoft\Glary Utilities 4]
"UpdateFile" = ""

[HKCU\Software\Glarysoft\Glary Utilities 4\Settings\ContextMenu]
"Encrypt" = "1"

[HKCR\ContextHandler.CContextMenu\CLSID]
"(Default)" = "{B3C418F8-922B-4faf-915E-59BC14448CF7}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Glary Utilities 4]
"URLInfoAbout" = "http://www.glarysoft.com/?scr=client"

[HKCR\TypeLib\{35AE4004-4194-4243-92AA-351BB7239539}\1.0\FLAGS]
"(Default)" = "2"

[HKCR\Interface\{28C97FA4-8378-42BF-A6F9-D615EB1272D7}\TypeLib]
"(Default)" = "{35AE4004-4194-4243-92AA-351BB7239539}"

[HKCR\Interface\{31FB3410-EA8B-4931-91C5-ADA7B91D953B}\ProxyStubClsid]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"

[HKCR\TypeLib\{B52C0F28-8D4C-4886-965C-0A772490064E}\1.0\HELPDIR]
"(Default)" = "%Program Files%\Glary Utilities 4"

[HKCR\Drive\shellex\ContextMenuHandlers\Glary Utilities]
"(Default)" = "{B3C418F8-922B-4faf-915E-59BC14448CF7}"

[HKCU\Software\Glarysoft\Glary Utilities 4\Settings\ContextMenu]
"Join" = "1"

[HKCR\GRIDMAP_CTRL.GridMapCtrl.1\CLSID]
"(Default)" = "{58B505BE-F589-4E8E-8BF2-B78E078CA8F7}"

[HKCR\ContextHandler.CContextMenu]
"(Default)" = "CContextMenu Class"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCR\.gfs]
"(Default)" = "GU.Splitted"

[HKCR\CLSID\{7A1C7081-0275-49FB-B76F-B9A66767BB56}]
"(Default)" = "GridMap 属性页"

[HKCR\Interface\{31FB3410-EA8B-4931-91C5-ADA7B91D953B}]
"(Default)" = "_DGridMap_CtrlEvents"

[HKCR\GU.Splitted\Shell\Open\Command]
"(Default)" = "%Program Files%\Glary Utilities 4\filesplitter.exe -j %1"

[HKCR\CLSID\{B3C418F8-922B-4faf-915E-59BC14448CF7}\VersionIndependentProgID]
"(Default)" = "ContextHandler.CContextMenu"

[HKCU\Software\Glarysoft\Glary Utilities 4\Settings]
"autoload" = "1"

[HKCR\GU.Splitted\DefaultIcon]
"(Default)" = "%Program Files%\Glary Utilities 4\filesplitter.exe,0"

[HKCR\Drive\shellex]
"(Default)" = ""

[HKCR\Folder\shellex\ContextMenuHandlers]
"(Default)" = ""

[HKCR\CLSID\{58B505BE-F589-4E8E-8BF2-B78E078CA8F7}\ToolboxBitmap32]
"(Default)" = "C:\PROGRA~1\GLARYU~1\GridMap.ocx, 1"

[HKCU\Software\Glarysoft\Glary Utilities 4\Settings\ContextMenu]
"Disk Defrag" = "1"

[HKCR\*\shellex\ContextMenuHandlers\Glary Utilities]
"(Default)" = "{B3C418F8-922B-4faf-915E-59BC14448CF7}"

[HKCR\Interface\{28C97FA4-8378-42BF-A6F9-D615EB1272D7}\TypeLib]
"Version" = "1.0"

[HKCR\AppID\ContextHandler.DLL]
"AppID" = "{A805009D-B902-439A-8E64-26EE3507A12E}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCR\Interface\{FD50332F-185B-4D3C-B921-E0B65E547F28}]
"(Default)" = "ICContextMenu"

[HKCR\TypeLib\{35AE4004-4194-4243-92AA-351BB7239539}\1.0]
"(Default)" = "GridMap ActiveX ¿Ø¼þÄ£¿é"

[HKCR\CLSID\{58B505BE-F589-4E8E-8BF2-B78E078CA8F7}\MiscStatus\1]
"(Default)" = "131473"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Glary Utilities 4]
"DisplayVersion" = "4.4.0.86"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fdd9f6f2-7454-11e2-b4cd-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKCR\CLSID\{B3C418F8-922B-4faf-915E-59BC14448CF7}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\CLSID\{58B505BE-F589-4E8E-8BF2-B78E078CA8F7}\TypeLib]
"(Default)" = "{35AE4004-4194-4243-92AA-351BB7239539}"

[HKCR\*\shellex\ContextMenuHandlers]
"(Default)" = ""

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKCR\CLSID\{58B505BE-F589-4E8E-8BF2-B78E078CA8F7}]
"(Default)" = "GridMap 控件"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{773a730e-74fb-11e2-b597-000c293bdf2f}]
"BaseClass" = "Drive"

[HKCR\Interface\{FD50332F-185B-4D3C-B921-E0B65E547F28}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\.gfe]
"(Default)" = "GU.Encrypted"

The Worm deletes the following value(s) in system registry:

[HKLM\SOFTWARE\GlarySoft\Glary Utilities 4]
"UpdateUrl"
"NewVersion"
"SkipVersion"

The Worm disables automatic startup of the application by deleting the following autorun value:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Glary Utilities 4 Initialization"

The process regedit.exe:2716 makes changes in the system registry.


The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "65 ED 8B B8 CC 7C 53 0F 22 DE 5E D5 7B D2 A0 DF"

[HKLM\SOFTWARE\GlarySoft\Glary Utilities 4]
"UpdateDate" = "2014-1-6"
"RefVersion" = "2014-1-6"

[HKLM\SOFTWARE\Wow6432Node\GlarySoft\Glary Utilities 4]
"date" = "41654.6560416667"

[HKLM\SOFTWARE\GlarySoft\Glary Utilities 4]
"LngVersion" = "2014-1-6"
"UpgradeTags" = "gu70,"

[HKLM\SOFTWARE\Wow6432Node\GlarySoft\Glary Utilities 4]
"UpdateDate" = "2014-1-6"
"rootDir" = "%Program Files% (x86)\Glary Utilities 4\"
"UpgradeTags" = "gu70,"
"RegCode" = "2788-6167-9587-68"
"RefVersion" = "2014-1-6"
"UpdateFile" = ""
"Regname" = "MrSoftware"

[HKLM\SOFTWARE\GlarySoft\Glary Utilities 4]
"rootDir" = "%Program Files%\Glary Utilities 4\"

[HKLM\SOFTWARE\Wow6432Node\GlarySoft\Glary Utilities 4]
"LngVersion" = "2014-1-6"

[HKLM\SOFTWARE\GlarySoft\Glary Utilities 4]
"RegCode" = "2788-6167-9587-68"
"date" = "41651.8591319444"

[HKLM\SOFTWARE\Wow6432Node\GlarySoft\Glary Utilities 4]
"Version" = "4.4.0.86"

[HKLM\SOFTWARE\GlarySoft\Glary Utilities 4]
"Version" = "4.4.0.86"
"UpdateFile" = ""
"Regname" = "MrSoftware"

The process regedit.exe:3660 makes changes in the system registry.


The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "92 6C 5E 87 CD D7 E0 A3 5F 17 45 27 7D A6 42 CB"

[HKLM\SOFTWARE\GlarySoft\Glary Utilities 4]
"UpdateDate" = "2014-1-6"
"RefVersion" = "2014-1-6"

[HKLM\SOFTWARE\Wow6432Node\GlarySoft\Glary Utilities 4]
"date" = "41654.6560416667"

[HKLM\SOFTWARE\GlarySoft\Glary Utilities 4]
"LngVersion" = "2014-1-6"
"UpgradeTags" = "gu70,"

[HKLM\SOFTWARE\Wow6432Node\GlarySoft\Glary Utilities 4]
"UpdateDate" = "2014-1-6"
"rootDir" = "%Program Files% (x86)\Glary Utilities 4\"
"UpgradeTags" = "gu70,"
"RegCode" = "2788-6167-9587-68"
"RefVersion" = "2014-1-6"
"UpdateFile" = ""
"Regname" = "MrSoftware"

[HKLM\SOFTWARE\GlarySoft\Glary Utilities 4]
"rootDir" = "%Program Files%\Glary Utilities 4\"

[HKLM\SOFTWARE\Wow6432Node\GlarySoft\Glary Utilities 4]
"LngVersion" = "2014-1-6"

[HKLM\SOFTWARE\GlarySoft\Glary Utilities 4]
"RegCode" = "2788-6167-9587-68"
"date" = "41651.8591319444"

[HKLM\SOFTWARE\Wow6432Node\GlarySoft\Glary Utilities 4]
"Version" = "4.4.0.86"

[HKLM\SOFTWARE\GlarySoft\Glary Utilities 4]
"Version" = "4.4.0.86"
"UpdateFile" = ""
"Regname" = "MrSoftware"

The process Initialize.exe:2656 makes changes in the system registry.


The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "26 EC AF E5 13 6A F3 E9 6C 76 41 56 BB 10 83 63"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
"Startup" = "%Documents and Settings%\%current user%\Start Menu\Programs\Startup"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Startup" = "%Documents and Settings%\All Users\Start Menu\Programs\Startup"
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Glarysoft\Glary Utilities 4\Settings]
"BackupsMax" = "60"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Templates" = "%Documents and Settings%\%current user%\Templates"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The Worm deletes the following value(s) in system registry:

[HKCU\Software\Glarysoft\Glary Utilities 4]
"Lastbackground"
"Curbackground"

[HKLM\SOFTWARE\GlarySoft\Glary Utilities 4]
"SkipVersion"
"UpdateUrl"

[HKCU\Software\Glarysoft\Glary Utilities 4]
"CurSkin"

[HKLM\SOFTWARE\GlarySoft\Glary Utilities 4]
"NewVersionDate"
"NewVersion"
"UpdateFile"

The Worm disables automatic startup of the application by deleting the following autorun value:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Glary Utilities 4"

"GUDelayStartup"

Dropped PE files

MD5 File path
f7d94783ab9eda4e61cb93a21b0c49d8c:\Program Files\Glary Utilities 4\Backup.dll
ab7e8b968767a7388c7604660ca78794c:\Program Files\Glary Utilities 4\BootTime.dll
bfd6c5406b55f7285f5145f0288361fec:\Program Files\Glary Utilities 4\BottDefrag.dll
c2ed7d47d1ee60be9f3b8aebcf5b052cc:\Program Files\Glary Utilities 4\CheckDisk.dll
4fc44e7292238e9caa78a149cdfbdc48c:\Program Files\Glary Utilities 4\CheckDisk.exe
b280d797eeb7b9af98d25ced1246e38ac:\Program Files\Glary Utilities 4\CheckDiskProgress.exe
68428e257266b7c0f85d8816ada20b14c:\Program Files\Glary Utilities 4\CheckUpdate.dll
b8e58e7251d77237e181dafb62bbfe5cc:\Program Files\Glary Utilities 4\CheckUpdate.exe
f0ef77a1cae6dff878aa7ed800fcec51c:\Program Files\Glary Utilities 4\Config.dll
8c696d1e56593f6dddf66398cb22a301c:\Program Files\Glary Utilities 4\ContextHandler.dll
3f442906b29b552f1c9fec1e221d90b7c:\Program Files\Glary Utilities 4\DPInst32.exe
c3ac43b2018114a617e946aa8fdf3cacc:\Program Files\Glary Utilities 4\DPInst64.exe
613ae803e9ad32ff302dbe8de0a5f370c:\Program Files\Glary Utilities 4\DiskAnalysis.exe
777c4f84463d65a94744b06777ea4be8c:\Program Files\Glary Utilities 4\DiskCleaner.dll
1c9e97d56f1696374c927a19b95dfbe0c:\Program Files\Glary Utilities 4\DiskCleaner.exe
2f18747c25af2f6b4763f926e893b11ec:\Program Files\Glary Utilities 4\DiskDefrag.exe
462ca7c7edb4d96260205d0f0947a204c:\Program Files\Glary Utilities 4\DriverBackup.exe
c369fb32409c5118c5ed42ad47a575d7c:\Program Files\Glary Utilities 4\EmptyFolderFinder.exe
c3fd242f7de3c9dbb08a93c8025fa07ec:\Program Files\Glary Utilities 4\EncryptExe.exe
0991cb44c081f29c3cbdb4b7591ac7fec:\Program Files\Glary Utilities 4\FileScanFilter.dll
f140610a0a6310368abadb1b4156b6e7c:\Program Files\Glary Utilities 4\FileUndelete.exe
ad84b67c8b66639a0a6bd8d1f6c9a5a0c:\Program Files\Glary Utilities 4\GridMap.ocx
9e703a25d6dcf43154162c7b830825dac:\Program Files\Glary Utilities 4\Initialize.exe
908b9e4ee22a281e2c5cd75ce22a217dc:\Program Files\Glary Utilities 4\Integrator.exe
92f7321b9601e91aec58611e3e5d5c0fc:\Program Files\Glary Utilities 4\LockDll.dll
edd035df3b9418eabe6c7d7e223da8f8c:\Program Files\Glary Utilities 4\Log.dll
d73d2af9e7a6c3c915fbea018e47d27fc:\Program Files\Glary Utilities 4\Memfiles.dll
439edae3d67e44c7cfb155bb739a6b77c:\Program Files\Glary Utilities 4\MemfilesService.exe
bd8e85717de96aafae9cfc47256b792fc:\Program Files\Glary Utilities 4\Native\win7_x64\BootDefrag.exe
85e239de26774afd66a6305bc7c39662c:\Program Files\Glary Utilities 4\Native\win7_x64\BootDefragDriver.sys
44cead2b676953ec235b7b35bca32ee8c:\Program Files\Glary Utilities 4\Native\win7_x86\BootDefrag.exe
9d3719bcb5e78ccaff5a2b192c0f5b81c:\Program Files\Glary Utilities 4\Native\win7_x86\BootDefragDriver.sys
d8dc447031c1085ee6360f80828806d7c:\Program Files\Glary Utilities 4\Native\wlh_x64\BootDefrag.exe
c0ba352412c002730831e83e69285bb6c:\Program Files\Glary Utilities 4\Native\wlh_x64\BootDefragDriver.sys
c4d899de786d130ae17ee0b89ede66d5c:\Program Files\Glary Utilities 4\Native\wlh_x86\BootDefrag.exe
02303a73cec912bc2a8aab12d042c0e5c:\Program Files\Glary Utilities 4\Native\wlh_x86\BootDefragDriver.sys
b59b6cb0c2a45336594d688cdfae5ff5c:\Program Files\Glary Utilities 4\Native\wnet_x64\BootDefrag.exe
67c3c69243964fdf5b2a2f18c0ceb66fc:\Program Files\Glary Utilities 4\Native\wnet_x64\BootDefragDriver.sys
c7f02b88a0cf9f7b76d2a374e4752a06c:\Program Files\Glary Utilities 4\Native\wnet_x86\BootDefrag.exe
7d45d7e2ffc326d9e73ee3ddba46487cc:\Program Files\Glary Utilities 4\Native\wnet_x86\BootDefragDriver.sys
4131457a4f3aeaeb5d7c4aa9b7fdede6c:\Program Files\Glary Utilities 4\Native\wxp_x64\BootDefrag.exe
7e46359e717e3ad28557f296d177419cc:\Program Files\Glary Utilities 4\Native\wxp_x64\BootDefragDriver.sys
dd9afab9a99e5772b76d3b34f3216cbfc:\Program Files\Glary Utilities 4\Native\wxp_x64\RegBootDefrag.exe
eef4e19b6392d74290805f0349b5d6f1c:\Program Files\Glary Utilities 4\Native\wxp_x86\BootDefrag.exe
3722f97e33cacab1d08b76abfccc2966c:\Program Files\Glary Utilities 4\Native\wxp_x86\BootDefragDriver.sys
23121acc4e1e1de73d63e47ed7dbb330c:\Program Files\Glary Utilities 4\Native\wxp_x86\RegBootDefrag.exe
ce45b15d5c31e11118011709ab21747dc:\Program Files\Glary Utilities 4\ObjectAdmin.dll
ffa7dbd107fe4546cf02fcafa13eae76c:\Program Files\Glary Utilities 4\OneClickMaintenance.exe
74755dbe494225af0bd39409b580897ec:\Program Files\Glary Utilities 4\QuickSearch.exe
43c2ae58a9935035af4e527b99942abdc:\Program Files\Glary Utilities 4\RegistryCleaner.dll
80aeb650b31f52c2085e014fe5af1d6bc:\Program Files\Glary Utilities 4\RegistryCleaner.exe
1a020bc5610262f457e74acb79994b1ec:\Program Files\Glary Utilities 4\RemoveDriver.dll
7978c2d257dff09b43580e020d68e8edc:\Program Files\Glary Utilities 4\RestoreCenter.dll
13d2aaeaa6bd7530397e2f119a4ec515c:\Program Files\Glary Utilities 4\RestoreCenter.exe
c1511f2bd10811580b703eb90c369c4dc:\Program Files\Glary Utilities 4\ScanFile.dll
c128d7602400bcb658b17a3a04f46bfac:\Program Files\Glary Utilities 4\ShortcutFixer.dll
035d8f2b1ddc9154bc84d7e5ac0d8d8bc:\Program Files\Glary Utilities 4\ShortcutFixer.exe
4e5eaa602fa6d85f695f215e0b63394cc:\Program Files\Glary Utilities 4\SoftwareUpdate.exe
9f17bc00a597a7bb517121008cde5dc3c:\Program Files\Glary Utilities 4\SpyRemover.dll
6bd5c51f64215e6d5c01f83e70f7afb7c:\Program Files\Glary Utilities 4\SpyRemover.exe
1a80589f453b4556e11f74a24983c37ec:\Program Files\Glary Utilities 4\StartupManager.dll
8f1322a03517fa6a34dee89791367c2dc:\Program Files\Glary Utilities 4\StartupManager.exe
8050fdac98d15868d2428b14d2278402c:\Program Files\Glary Utilities 4\TracksEraser.dll
fe3ebc13a5c2ab9e9dc8d0126f4aba8cc:\Program Files\Glary Utilities 4\TracksEraser.exe
55e4c5f7022092bc7f812e291e864148c:\Program Files\Glary Utilities 4\Undelete.dll
3b3d7ffb5b5013d9547af28ec066f9e9c:\Program Files\Glary Utilities 4\Uninstaller.exe
301c1f81b6c6893f18d9484415ab1f77c:\Program Files\Glary Utilities 4\autodll.dll
cdfc08cfcb16044a7563bba7d0df8803c:\Program Files\Glary Utilities 4\cmm.exe
15d14a91121dc16fc7ffa6cce4298b9cc:\Program Files\Glary Utilities 4\dupefinder.exe
da0c707acca1265384e9a9cd6ffe02fbc:\Program Files\Glary Utilities 4\fileencrypt.exe
5f9167a3f538ddc67e8234f07af87a97c:\Program Files\Glary Utilities 4\filesplitter.exe
bdaedc64a57cb858ac95c4bc95ac3e9fc:\Program Files\Glary Utilities 4\gsd.exe
665d746175bd25f449d26eab36f49ab2c:\Program Files\Glary Utilities 4\iehelper.exe
f7675efb8d127433f58aad6a85029ed8c:\Program Files\Glary Utilities 4\joinExe.exe
8cfe71ce130cb8a7e877b17188e046f9c:\Program Files\Glary Utilities 4\languages.dll
e6f4907e2f9f01ff3ea683ff16cb022fc:\Program Files\Glary Utilities 4\memdefrag.exe
b9030d821e099c79de1c9125b790e2dac:\Program Files\Glary Utilities 4\mfc90u.dll
4a8bc195abdc93f0db5dab7f5093c52fc:\Program Files\Glary Utilities 4\msvcm90.dll
6de5c66e434a9c1729575763d891c6c2c:\Program Files\Glary Utilities 4\msvcp90.dll
e7d91d008fe76423962b91c43c88e4ebc:\Program Files\Glary Utilities 4\msvcr90.dll
899a68531f942cba34e58c5d06a23402c:\Program Files\Glary Utilities 4\procmgr.exe
ef7b94eb4a818ab0254a98ebcdb922f2c:\Program Files\Glary Utilities 4\regdefrag.exe
852847f0c6a37bbf3c715e3274c8a706c:\Program Files\Glary Utilities 4\settings.dll
df32b8a025627f4be787bdd7961ee020c:\Program Files\Glary Utilities 4\shredder.exe
ac988bf6b9d9b5f9a5753a91a950e73fc:\Program Files\Glary Utilities 4\sysinfo.exe
e01e55e5845718c691778178e01bad4dc:\Program Files\Glary Utilities 4\uninst.exe
9b179ffb7b8eb686d3949f734bc59e68c:\Program Files\Glary Utilities 4\upgrade.exe
e4842b1d2fe2c157070d41606a44f7ddc:\Program Files\Glary Utilities 4\zlib1.dll
eef4e19b6392d74290805f0349b5d6f1c:\WINDOWS\system32\BootDefrag.exe
3722f97e33cacab1d08b76abfccc2966c:\WINDOWS\system32\drivers\BootDefragDriver.sys

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.

Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):

    Integrator.exe:3452
    taskkill.exe:2244
    DiskDefrag.exe:2340
    gu4setup.exe:2184
    regedit.exe:2716
    regedit.exe:3660
    Initialize.exe:2656

  2. Delete the original Worm file.
  3. Delete or disinfect the following files created/modified by the Worm:

    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\update[1].html (568 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\jquery.min[1].js (45771 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\~gu3-ver.dat (107 bytes)
    %Program Files%\Glary Utilities 4\data\AppSetting.ini (44667 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\news[1].ini (194 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\desktop.ini (67 bytes)
    %Program Files%\Glary Utilities 4\data\backup.ini (9 bytes)
    %Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012014081520140816\index.dat (16 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\index[1].js (1177 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\redirect[1].php (107 bytes)
    %Documents and Settings%\%current user%\Templates\GUTracksIni.tmp (42 bytes)
    %Program Files%\Glary Utilities 4\news.ini (194 bytes)
    %System%\BootDefrag.exe (601 bytes)
    %System%\drivers\BootDefragDriver.sys (13 bytes)
    %WinDir%\MrSoftware\gu4setup.exe (90809 bytes)
    %WinDir%\MrSoftware\reg.reg (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\autB3.tmp (482 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\autB2.tmp (96206 bytes)
    %Program Files%\Glary Utilities 4\skins\system information\others.png (544 bytes)
    %Program Files%\Glary Utilities 4\languages.dll (1350 bytes)
    %Program Files%\Glary Utilities 4\skins\default\images\oc_btn_click.png (2 bytes)
    %Program Files%\Glary Utilities 4\skins\icons\CheckUpdatehover.png (2 bytes)
    %Program Files%\Glary Utilities 4\Native\wnet_x86\BootDefrag.exe (1615 bytes)
    %Program Files%\Glary Utilities 4\skins\default\images\systemcontrol.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsmB5.tmp\nsExec.dll (6 bytes)
    %Program Files%\Glary Utilities 4\skins\system information\top.png (3 bytes)
    %Program Files%\Glary Utilities 4\skins\default\images\dockpopcurpage.png (1 bytes)
    %Program Files%\Glary Utilities 4\skins\default\images\systemtweaks.png (1 bytes)
    %Program Files%\Glary Utilities 4\FileUndelete.exe (31651 bytes)
    %Program Files%\Glary Utilities 4\Backup.dll (2695 bytes)
    %Program Files%\Glary Utilities 4\Resources\Uninstaller\Large.png (3 bytes)
    %Program Files%\Glary Utilities 4\Config.dll (26 bytes)
    %Program Files%\Glary Utilities 4\DriverBackup.exe (6127 bytes)
    %Program Files%\Glary Utilities 4\SpyRemover.dll (8263 bytes)
    %Program Files%\Glary Utilities 4\skins\icons\emptyfolderfinder.png (1 bytes)
    %Program Files%\Glary Utilities 4\Resources\DiskAnalysis\toolbar.png (7 bytes)
    %Program Files%\Glary Utilities 4\data\BootTime.ini (3 bytes)
    %Program Files%\Glary Utilities 4\skins\default\images\filemanagement.png (1 bytes)
    %Program Files%\Glary Utilities 4\Microsoft.VC90.CRT.manifest (524 bytes)
    %Program Files%\Glary Utilities 4\skins\icons\regdefrag.png (1 bytes)
    %Program Files%\Glary Utilities 4\skins\default\images\skin_pic_normal.png (1 bytes)
    %Program Files%\Glary Utilities 4\skins\icons\fileencrypthover.png (1 bytes)
    %Program Files%\Glary Utilities 4\skins\icons\diskanalysishover.png (1 bytes)
    %Program Files%\Glary Utilities 4\filesplitter.exe (2625 bytes)
    %Program Files%\Glary Utilities 4\Resources\ProcessManager\ToolBar.png (6 bytes)
    %Program Files%\Glary Utilities 4\skins\default\images\oc_cancel_click.png (1 bytes)
    %Program Files%\Glary Utilities 4\Resources\Uninstaller\Recently.png (3 bytes)
    %Program Files%\Glary Utilities 4\languages\Slovak.lng (2711 bytes)
    %Program Files%\Glary Utilities 4\Uninstaller.exe (7832 bytes)
    %Program Files%\Glary Utilities 4\languages\hebrew.lng (1568 bytes)
    %Program Files%\Glary Utilities 4\skins\default\images\main_close.png (1 bytes)
    %Program Files%\Glary Utilities 4\fileencrypt.exe (3595 bytes)
    %Program Files%\Glary Utilities 4\languages\Romana.lng (2500 bytes)
    %Documents and Settings%\All Users\Desktop\Glary Utilities 4.lnk (755 bytes)
    %Program Files%\Glary Utilities 4\skins\icons\diskdefraghover.png (1 bytes)
    %Program Files%\Glary Utilities 4\skins\icons\registrycleaner.png (1 bytes)
    %Program Files%\Glary Utilities 4\skins\system information\drives.png (346 bytes)
    %Program Files%\Glary Utilities 4\skins\system information\display.png (636 bytes)
    %Program Files%\Glary Utilities 4\skins\icons\BrowserAssistanthover.png (1 bytes)
    %Program Files%\Glary Utilities 4\Resources\DiskAnalysis\file_result.png (7 bytes)
    %Program Files%\Glary Utilities 4\skins\icons\restorecenter.png (1 bytes)
    %Program Files%\Glary Utilities 4\skins\system information\cpu.png (372 bytes)
    %Program Files%\Glary Utilities 4\skins\system information\network.png (618 bytes)
    %Program Files%\Glary Utilities 4\skins\icons\fileundeletehover.png (1 bytes)
    %Program Files%\Glary Utilities 4\Resources\Uninstaller\RarelyUsed.png (3 bytes)
    %Program Files%\Glary Utilities 4\Resources\RegistryDefrag\regdefrag.png (25 bytes)
    %Program Files%\Glary Utilities 4\Native\wxp_x86\RegBootDefrag.exe (22 bytes)
    %Program Files%\Glary Utilities 4\skins\system information\topdown.png (3 bytes)
    %Program Files%\Glary Utilities 4\skins\icons\fileundelete.png (1 bytes)
    %Program Files%\Glary Utilities 4\skins\default\images\checkbox_checked.png (1 bytes)
    %Program Files%\Glary Utilities 4\LockDll.dll (20809 bytes)
    %Program Files%\Glary Utilities 4\skins\default\images\dockpopturnleft.png (2 bytes)
    %Program Files%\Glary Utilities 4\languages\spain.lng (3093 bytes)
    %Program Files%\Glary Utilities 4\languages\french.lng (3711 bytes)
    %Program Files%\Glary Utilities 4\skins\icons\checkdiskhover.png (1 bytes)
    %Program Files%\Glary Utilities 4\skins\icons\BrowserAssistant.png (1 bytes)
    %Documents and Settings%\All Users\Start Menu\Programs\Glary Utilities 4\Website.lnk (802 bytes)
    %Program Files%\Glary Utilities 4\skins\icons\procmgrhover.png (1 bytes)
    %Program Files%\Glary Utilities 4\Resources\Uninstaller\AllPrograms.png (3 bytes)
    %Program Files%\Glary Utilities 4\Resources\CheckDisk\button_expand.png (3 bytes)
    %Program Files%\Glary Utilities 4\skins\default\images\oc_cancel_hover.png (1 bytes)
    %Program Files%\Glary Utilities 4\BootTime.dll (20 bytes)
    %Program Files%\Glary Utilities 4\languages\dutch.lng (1976 bytes)
    %Program Files%\Glary Utilities 4\languages\english.lng (1897 bytes)
    %Program Files%\Glary Utilities 4\languages\Finnish_(KBoost).lng (1678 bytes)
    %Program Files%\Glary Utilities 4\joinExe.exe (1827 bytes)
    %Program Files%\Glary Utilities 4\languages\italian.lng (2701 bytes)
    %Program Files%\Glary Utilities 4\Native\wlh_x86\BootDefrag.exe (1578 bytes)
    %Program Files%\Glary Utilities 4\DiskCleaner.dll (15221 bytes)
    %Program Files%\Glary Utilities 4\skins\default\images\diskspace.png (1 bytes)
    %Program Files%\Glary Utilities 4\skins\icons\driverbackup.png (1 bytes)
    %Program Files%\Glary Utilities 4\msvcm90.dll (4349 bytes)
    %Program Files%\Glary Utilities 4\skins\icons\restorecenterhover.png (1 bytes)
    %Program Files%\Glary Utilities 4\RemoveDriver.dll (5165 bytes)
    %Program Files%\Glary Utilities 4\CheckUpdate.dll (19685 bytes)
    %Program Files%\Glary Utilities 4\skins\default\images\main_right_top_mark_click_bg.png (1 bytes)
    %Program Files%\Glary Utilities 4\skins\default\images\pop_btn_normal.png (3 bytes)
    %Program Files%\Glary Utilities 4\MemfilesService.exe (4526 bytes)
    %Program Files%\Glary Utilities 4\Resources\Uninstaller\View.png (3 bytes)
    %Program Files%\Glary Utilities 4\skins\default\images\clear_tips.png (3 bytes)
    %Program Files%\Glary Utilities 4\memdefrag.exe (3673 bytes)
    %Program Files%\Glary Utilities 4\Native\wnet_x64\BootDefragDriver.sys (17 bytes)
    %Program Files%\Glary Utilities 4\DiskDefrag.exe (12394 bytes)
    %Program Files%\Glary Utilities 4\Resources\ProcessManager\RClickMenu.png (4 bytes)
    %Program Files%\Glary Utilities 4\skins\default\backimages\bg1.jpg (4853 bytes)
    %Program Files%\Glary Utilities 4\skins\default\images\tab_ov_blue.png (3 bytes)
    %Program Files%\Glary Utilities 4\Native\win7_x64\BootDefrag.exe (4197 bytes)
    %Program Files%\Glary Utilities 4\skins\default\images\tab_btn_hover.png (2 bytes)
    %Program Files%\Glary Utilities 4\skins\default\images\dockpopbg.png (3 bytes)
    %Program Files%\Glary Utilities 4\skins\icons\checkdisk.png (1 bytes)
    %Program Files%\Glary Utilities 4\languages\Greek.lng (3583 bytes)
    %Program Files%\Glary Utilities 4\data\xb.dat (14600 bytes)
    %Program Files%\Glary Utilities 4\skins\icons\shortcutfixerhover.png (2 bytes)
    %Program Files%\Glary Utilities 4\skins\icons\startupmanager.png (2 bytes)
    %Program Files%\Glary Utilities 4\languages\French(FR).lng (3564 bytes)
    %Program Files%\Glary Utilities 4\languages\Francais.lng (3411 bytes)
    %Program Files%\Glary Utilities 4\upgrade.exe (1964 bytes)
    %Program Files%\Glary Utilities 4\DPInst32.exe (18153 bytes)
    %Program Files%\Glary Utilities 4\data\xt.dat (26 bytes)
    %Program Files%\Glary Utilities 4\data\backup.dat (864 bytes)
    %Program Files%\Glary Utilities 4\Resources\EmptyFolderFinder\toolbar.png (6 bytes)
    %Program Files%\Glary Utilities 4\languages\ukrainian.lng (2421 bytes)
    %Program Files%\Glary Utilities 4\languages\French(CA).lng (1802 bytes)
    %Program Files%\Glary Utilities 4\skins\icons\filesplitterhover.png (1 bytes)
    %Program Files%\Glary Utilities 4\skins\icons\diskcleaner.png (1 bytes)
    %Program Files%\Glary Utilities 4\Native\win7_x86\BootDefrag.exe (1630 bytes)
    %Program Files%\Glary Utilities 4\skins\icons\Uninstaller.png (2 bytes)
    %Program Files%\Glary Utilities 4\skins\system information\memory.png (503 bytes)
    %Program Files%\Glary Utilities 4\skins\default\images\dockpopturnright.png (2 bytes)
    %Program Files%\Glary Utilities 4\skins\default\images\tab_ad_blue.png (3 bytes)
    %Program Files%\Glary Utilities 4\skins\default\images\pop_btn_click.png (3 bytes)
    %Program Files%\Glary Utilities 4\skins\default\images\main_feedback.png (1 bytes)
    %Program Files%\Glary Utilities 4\languages\Czech.lng (2518 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsmB5.tmp\nsB6.tmp (6 bytes)
    %Program Files%\Glary Utilities 4\Resources\SysInfo\NetworkNode.png (535 bytes)
    %Program Files%\Glary Utilities 4\RestoreCenter.exe (1568 bytes)
    %Program Files%\Glary Utilities 4\languages\Romania.lng (2446 bytes)
    %Program Files%\Glary Utilities 4\StartupManager.exe (1568 bytes)
    %Program Files%\Glary Utilities 4\skins\default\images\systemstatus.png (1 bytes)
    %Program Files%\Glary Utilities 4\CheckDisk.dll (4538 bytes)
    %Program Files%\Glary Utilities 4\Native\wnet_x86\BootDefragDriver.sys (14 bytes)
    %Program Files%\Glary Utilities 4\skins\default\images\pop_btn_hover.png (3 bytes)
    %Program Files%\Glary Utilities 4\Resources\settings\DiskCleanerImageList.bmp (25 bytes)
    %Program Files%\Glary Utilities 4\data\duplicates.dat (288 bytes)
    %Program Files%\Glary Utilities 4\Native\wlh_x86\BootDefragDriver.sys (14 bytes)
    %Program Files%\Glary Utilities 4\QuickSearch.exe (9589 bytes)
    %Program Files%\Glary Utilities 4\TracksEraser.dll (21815 bytes)
    %Program Files%\Glary Utilities 4\Native\win7_x86\BootDefragDriver.sys (14 bytes)
    %Program Files%\Glary Utilities 4\skins\icons\cmmhover.png (1 bytes)
    %Program Files%\Glary Utilities 4\Log.dll (3673 bytes)
    %Program Files%\Glary Utilities 4\cmm.exe (3849 bytes)
    %Program Files%\Glary Utilities 4\skins\icons\shredder.png (1 bytes)
    %Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch\Glary Utilities 4.lnk (773 bytes)
    %Program Files%\Glary Utilities 4\languages\French (Ad Lib).lng (2535 bytes)
    %Program Files%\Glary Utilities 4\skins\icons\procmgr.png (1 bytes)
    %Program Files%\Glary Utilities 4\skins\default\images\tab_btn_normal.png (2 bytes)
    %Program Files%\Glary Utilities 4\skins\default\backimages\bg6.jpg (1406 bytes)
    %Program Files%\Glary Utilities 4\data\junkInfo.ini (1 bytes)
    %Documents and Settings%\All Users\Start Menu\Programs\Glary Utilities 4\Uninstall.lnk (569 bytes)
    %Program Files%\Glary Utilities 4\skins\default\images\main_right_top_mark_sep.png (941 bytes)
    %Program Files%\Glary Utilities 4\skins\default\images\privacy.png (1 bytes)
    %Program Files%\Glary Utilities 4\languages\chinese.lng (2317 bytes)
    %Program Files%\Glary Utilities 4\skins\default\images\search_mark.png (3 bytes)
    %Program Files%\Glary Utilities 4\skins\default\images\progress_bg.png (469 bytes)
    %Program Files%\Glary Utilities 4\skins\default\images\registry.png (1 bytes)
    %Program Files%\Glary Utilities 4\languages\russian.lng (1862 bytes)
    %Program Files%\Glary Utilities 4\skins\icons\driverbackuphover.png (1 bytes)
    %Program Files%\Glary Utilities 4\Resources\DiskCleaner\toolbar.png (7 bytes)
    %Program Files%\Glary Utilities 4\skins\default\images\skinsbg.png (439 bytes)
    %Program Files%\Glary Utilities 4\languages\turkish.lng (3258 bytes)
    %Program Files%\Glary Utilities 4\skins\icons\Uninstallerhover.png (2 bytes)
    %Program Files%\Glary Utilities 4\skins\default\images\oc_cancel_normal.png (680 bytes)
    %Program Files%\Glary Utilities 4\sysinfo.exe (10633 bytes)
    %Program Files%\Glary Utilities 4\autodll.dll (2332 bytes)
    %Program Files%\Glary Utilities 4\Resources\RegistryCleaner\Toolbar Default.png (6 bytes)
    %Program Files%\Glary Utilities 4\dupefinder.exe (9324 bytes)
    %Program Files%\Glary Utilities 4\skins\system information\normalhot.png (3 bytes)
    %Program Files%\Glary Utilities 4\skins\default\images\skin_custom.png (989 bytes)
    %Program Files%\Glary Utilities 4\skins\default\images\skin_col_normal.png (1 bytes)
    %Program Files%\Glary Utilities 4\Resources\SysInfo\OtherDevicesNode.png (5 bytes)
    %Program Files%\Glary Utilities 4\zlib1.dll (4242 bytes)
    %Program Files%\Glary Utilities 4\skins\icons\registrycleanerhover.png (1 bytes)
    %Program Files%\Glary Utilities 4\skins\default\images\antimalware.png (1 bytes)
    %Program Files%\Glary Utilities 4\CheckDiskProgress.exe (2104 bytes)
    %Program Files%\Glary Utilities 4\Resources\InternetBooster\IBackGround.jpg (13 bytes)
    %Program Files%\Glary Utilities 4\Native\wnet_x64\BootDefrag.exe (4149 bytes)
    %Program Files%\Glary Utilities 4\skins\icons\trackseraserhover.png (1 bytes)
    %Program Files%\Glary Utilities 4\DPInst64.exe (21501 bytes)
    %Program Files%\Glary Utilities 4\data\startup.dat (2712 bytes)
    %Program Files%\Glary Utilities 4\skins\default\images\main_right_top_mark_hover_bg.png (1 bytes)
    %Program Files%\Glary Utilities 4\skins\default\images\main_close_click.png (1 bytes)
    %Program Files%\Glary Utilities 4\skins\icons\filesplitter.png (1 bytes)
    %Program Files%\Glary Utilities 4\Integrator.exe (20633 bytes)
    %Program Files%\Glary Utilities 4\EncryptExe.exe (10975 bytes)
    %Program Files%\Glary Utilities 4\Undelete.dll (4085 bytes)
    %Program Files%\Glary Utilities 4\skins\default\images\progress.png (4 bytes)
    %Program Files%\Glary Utilities 4\skins\default\backimages\bg7.jpg (1568 bytes)
    %Program Files%\Glary Utilities 4\SoftwareUpdate.exe (7455 bytes)
    %Program Files%\Glary Utilities 4\BottDefrag.dll (1946 bytes)
    %Program Files%\Glary Utilities 4\skins\default\images\menu_click.png (1 bytes)
    %Program Files%\Glary Utilities 4\skins\default\images\oc_detailbg.png (1 bytes)
    %Program Files%\Glary Utilities 4\TracksEraser.exe (1568 bytes)
    %Program Files%\Glary Utilities 4\languages\German.lng (2582 bytes)
    %Program Files%\Glary Utilities 4\skins\default\images\skintransparentmark.png (1 bytes)
    %Program Files%\Glary Utilities 4\skins\default\images\dockpopturnleftgray.png (1 bytes)
    %Program Files%\Glary Utilities 4\Native\wxp_x86\BootDefragDriver.sys (13 bytes)
    %Program Files%\Glary Utilities 4\settings.dll (9533 bytes)
    %Program Files%\Glary Utilities 4\skins\default\images\harddisk.png (1 bytes)
    %Program Files%\Glary Utilities 4\languages\ukrainian2.lng (2222 bytes)
    %Program Files%\Glary Utilities 4\skins\icons\emptyfolderfinderhover.png (1 bytes)
    %Program Files%\Glary Utilities 4\skins\default\images\oc_btn_hover.png (2 bytes)
    %Program Files%\Glary Utilities 4\skins\icons\CheckUpdate.png (2 bytes)
    %Program Files%\Glary Utilities 4\skins\default\images\menu_normal.png (1 bytes)
    %Program Files%\Glary Utilities 4\data\duplicatesfolder.dat (194 bytes)
    %Program Files%\Glary Utilities 4\uninst.exe (2229 bytes)
    %Program Files%\Glary Utilities 4\skins\icons\shortcutfixer.png (1 bytes)
    %Program Files%\Glary Utilities 4\ObjectAdmin.dll (1765 bytes)
    %Program Files%\Glary Utilities 4\Resources\TracksEraser\toolbar.png (6 bytes)
    %Program Files%\Glary Utilities 4\Resources\SpyRemover\BKPic.png (1568 bytes)
    %Program Files%\Glary Utilities 4\skins\icons\sysinfohover.png (1 bytes)
    %Program Files%\Glary Utilities 4\procmgr.exe (7880 bytes)
    %Program Files%\Glary Utilities 4\skins\default\images\btn_click.png (2 bytes)
    %Program Files%\Glary Utilities 4\skins\default\images\body_transbg.png (8 bytes)
    %Program Files%\Glary Utilities 4\skins\default\images\main_close_hover.png (1 bytes)
    %Program Files%\Glary Utilities 4\Resources\SysInfo\System Information.png (7 bytes)
    %Program Files%\Glary Utilities 4\Native\wxp_x86\BootDefrag.exe (1613 bytes)
    %Program Files%\Glary Utilities 4\Resources\settings\TracksEraseImageList.bmp (7 bytes)
    %Program Files%\Glary Utilities 4\data\htmldata.dat (1 bytes)
    %Program Files%\Glary Utilities 4\ScanFile.dll (1150 bytes)
    %Program Files%\Glary Utilities 4\Resources\Uninstaller\WindowsUpdates.png (3 bytes)
    %Program Files%\Glary Utilities 4\settings.ini (24 bytes)
    %Program Files%\Glary Utilities 4\skins\default\images\tab_ov.png (3 bytes)
    %Program Files%\Glary Utilities 4\skins\default\images\oc_btn_normal.png (2 bytes)
    %Program Files%\Glary Utilities 4\languages\finnish.lng (1659 bytes)
    %Program Files%\Glary Utilities 4\FileScanFilter.dll (9287 bytes)
    %Program Files%\Glary Utilities 4\Native\wxp_x64\RegBootDefrag.exe (24 bytes)
    %Program Files%\Glary Utilities 4\regdefrag.exe (3265 bytes)
    %Program Files%\Glary Utilities 4\skins\icons\spyremover.png (1 bytes)
    %Program Files%\Glary Utilities 4\skins\default\images\oneclickmaintenance_front.png (2 bytes)
    %Program Files%\Glary Utilities 4\skins\default\backimages\bg5.jpg (134 bytes)
    %Program Files%\Glary Utilities 4\skins\icons\spyremoverhover.png (1 bytes)
    %Program Files%\Glary Utilities 4\Glary Utilities 4.url (62 bytes)
    %Program Files%\Glary Utilities 4\Resources\Dupefinder\tool.png (5 bytes)
    %Program Files%\Glary Utilities 4\Resources\SysInfo\OperSysNode.png (9 bytes)
    %Program Files%\Glary Utilities 4\msvcr90.dll (14706 bytes)
    %Program Files%\Glary Utilities 4\languages\dutch2.lng (2980 bytes)
    %Program Files%\Glary Utilities 4\languages\Magyar2.lng (4112 bytes)
    %Program Files%\Glary Utilities 4\skins\default\images\btn_normal.png (2 bytes)
    %Program Files%\Glary Utilities 4\skins\default\images\oneclick_progress.png (4 bytes)
    %Program Files%\Glary Utilities 4\skins\icons\diskcleanerhover.png (1 bytes)
    %Program Files%\Glary Utilities 4\shredder.exe (4681 bytes)
    %Program Files%\Glary Utilities 4\skins\system information\windows.png (882 bytes)
    %Program Files%\Glary Utilities 4\languages\Dutch3.lng (3098 bytes)
    %Program Files%\Glary Utilities 4\skins\default\images\dockpopturnrightgray.png (1 bytes)
    %Program Files%\Glary Utilities 4\skins\default\images\ov_boottimebg.png (3 bytes)
    %Program Files%\Glary Utilities 4\data\junk.dat (1 bytes)
    %Program Files%\Glary Utilities 4\Resources\ShortuctFixer\toolbar.png (9 bytes)
    %Program Files%\Glary Utilities 4\ShortcutFixer.dll (7408 bytes)
    %Program Files%\Glary Utilities 4\Resources\SysInfo\Picture.png (8 bytes)
    %Program Files%\Glary Utilities 4\ShortcutFixer.exe (1568 bytes)
    %Program Files%\Glary Utilities 4\OneClickMaintenance.exe (7818 bytes)
    %Program Files%\Glary Utilities 4\languages\French(#DG#).lng (2590 bytes)
    %Program Files%\Glary Utilities 4\DiskAnalysis.exe (10839 bytes)
    %Program Files%\Glary Utilities 4\languages\arabic.lng (2806 bytes)
    %Program Files%\Glary Utilities 4\Native\wlh_x64\BootDefrag.exe (4153 bytes)
    %Program Files%\Glary Utilities 4\Native\wxp_x64\BootDefrag.exe (4099 bytes)
    %Program Files%\Glary Utilities 4\skins\default\images\main_min.png (1 bytes)
    %Program Files%\Glary Utilities 4\skins\default\images\menu_hover.png (1 bytes)
    %Program Files%\Glary Utilities 4\skins\default\backimages\bg3.jpg (1032 bytes)
    %Documents and Settings%\All Users\Start Menu\Programs\Glary Utilities 4\Glary Utilities 4.lnk (767 bytes)
    %Program Files%\Glary Utilities 4\skins\icons\sysinfo.png (1 bytes)
    %Program Files%\Glary Utilities 4\skins\icons\memdefrag.png (2 bytes)
    %Program Files%\Glary Utilities 4\skins\default\images\tab_oc.png (3 bytes)
    %Program Files%\Glary Utilities 4\skins\default\images\oneclick_bg.png (1 bytes)
    %Program Files%\Glary Utilities 4\skins\default\images\main_restore.png (1 bytes)
    %Program Files%\Glary Utilities 4\skins\default\images\main_like.png (1 bytes)
    %Program Files%\Glary Utilities 4\languages\slovenian.lng (2096 bytes)
    %Program Files%\Glary Utilities 4\Microsoft.VC90.MFC.manifest (548 bytes)
    %Program Files%\Glary Utilities 4\languages\vietnamese.lng (3050 bytes)
    %Program Files%\Glary Utilities 4\skins\icons\memdefraghover.png (2 bytes)
    %Program Files%\Glary Utilities 4\data\empty.dat (478 bytes)
    %Program Files%\Glary Utilities 4\skins\default\images\oc_needclearbg.png (288 bytes)
    %Program Files%\Glary Utilities 4\Resources\SysInfo\OverViewNode.png (8 bytes)
    %Program Files%\Glary Utilities 4\languages\japanese.lng (2017 bytes)
    %Program Files%\Glary Utilities 4\data\registry.dat (8 bytes)
    %Program Files%\Glary Utilities 4\SpyRemover.exe (1568 bytes)
    %Program Files%\Glary Utilities 4\msvcp90.dll (12049 bytes)
    %Program Files%\Glary Utilities 4\RestoreCenter.dll (6654 bytes)
    %Program Files%\Glary Utilities 4\languages\Danish.lng (4516 bytes)
    %Program Files%\Glary Utilities 4\Resources\DiskDefrag\toolbar.png (1 bytes)
    %Program Files%\Glary Utilities 4\skins\system information\normaldown.png (3 bytes)
    %Program Files%\Glary Utilities 4\skins\icons\dupefinder.png (1 bytes)
    %Program Files%\Glary Utilities 4\skins\icons\trackseraser.png (1 bytes)
    %Program Files%\Glary Utilities 4\data\procsubmit.dat (1 bytes)
    %Program Files%\Glary Utilities 4\skins\default\backimages\bg9.jpg (2712 bytes)
    %Program Files%\Glary Utilities 4\RegistryCleaner.dll (13135 bytes)
    %Program Files%\Glary Utilities 4\languages\polish.lng (2292 bytes)
    %Program Files%\Glary Utilities 4\languages\chineseT.lng (3002 bytes)
    %Program Files%\Glary Utilities 4\skins\default\images\drivers.png (1 bytes)
    %Program Files%\Glary Utilities 4\skins\icons\dupefinderhover.png (1 bytes)
    %Documents and Settings%\All Users\Start Menu\Programs\Glary Utilities 4.lnk (761 bytes)
    %Program Files%\Glary Utilities 4\skins\icons\startupmanagerhover.png (2 bytes)
    %Program Files%\Glary Utilities 4\Resources\StartupManager\toolbar.png (8 bytes)
    %Program Files%\Glary Utilities 4\EmptyFolderFinder.exe (5963 bytes)
    %Program Files%\Glary Utilities 4\skins\default\images\btn_hover.png (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsmB5.tmp\System.dll (11 bytes)
    %Program Files%\Glary Utilities 4\skins\default\images\oneclickmaintenance_needclear_bg.png (1 bytes)
    %Program Files%\Glary Utilities 4\skins\default\backimages\bg4.jpg (21 bytes)
    %Program Files%\Glary Utilities 4\Memfiles.dll (1838 bytes)
    %Program Files%\Glary Utilities 4\StartupManager.dll (10956 bytes)
    %Program Files%\Glary Utilities 4\skins\default\images\tab_ad.png (3 bytes)
    %Program Files%\Glary Utilities 4\skins\default\backimages\bg2.jpg (12 bytes)
    %Program Files%\Glary Utilities 4\skins\icons\fileencrypt.png (1 bytes)
    %Program Files%\Glary Utilities 4\data\apps.dat (8 bytes)
    %Program Files%\Glary Utilities 4\gsd.exe (1236 bytes)
    %Program Files%\Glary Utilities 4\skins\default\images\logo.png (9 bytes)
    %Program Files%\Glary Utilities 4\skins\default\images\usertype_btn.png (1 bytes)
    %Program Files%\Glary Utilities 4\skins\default\images\oneclickmaintenance_bg.png (7 bytes)
    %Program Files%\Glary Utilities 4\data\settings.dat (3 bytes)
    %Program Files%\Glary Utilities 4\languages\Swedish.lng (3102 bytes)
    %Program Files%\Glary Utilities 4\languages\ptbr.lng (2204 bytes)
    %Program Files%\Glary Utilities 4\Resources\TurboMode\BackGround.jpg (16 bytes)
    %Program Files%\Glary Utilities 4\skins\default\images\dockpopdarkbg.png (1 bytes)
    %Program Files%\Glary Utilities 4\DiskCleaner.exe (1568 bytes)
    %Program Files%\Glary Utilities 4\data\xdata.dat (1568 bytes)
    %Program Files%\Glary Utilities 4\Native\wxp_x64\BootDefragDriver.sys (17 bytes)
    %Program Files%\Glary Utilities 4\CheckUpdate.exe (1568 bytes)
    %Program Files%\Glary Utilities 4\skins\icons\quicksearchhover.png (1 bytes)
    %Program Files%\Glary Utilities 4\languages\Magyar.lng (1728 bytes)
    %Program Files%\Glary Utilities 4\skins\icons\diskdefrag.png (1 bytes)
    %Program Files%\Glary Utilities 4\Native\win7_x64\BootDefragDriver.sys (17 bytes)
    %Program Files%\Glary Utilities 4\ContextHandler.dll (1758 bytes)
    %Program Files%\Glary Utilities 4\Resources\SysInfo\DisplayNode.png (5 bytes)
    %Program Files%\Glary Utilities 4\Resources\SysInfo\SystemDevicesNode.png (4 bytes)
    %Program Files%\Glary Utilities 4\skins\system information\computer.png (3 bytes)
    %Program Files%\Glary Utilities 4\Resources\SysInfo\DrivesNode.png (6 bytes)
    %Program Files%\Glary Utilities 4\skins\icons\SoftwareUpdate.png (1 bytes)
    %Program Files%\Glary Utilities 4\skins\default\backimages\bg8.jpg (914 bytes)
    %Program Files%\Glary Utilities 4\skins\default\images\dockpopcurpagegray.png (1 bytes)
    %Program Files%\Glary Utilities 4\skins\icons\SoftwareUpdatehover.png (1 bytes)
    %Program Files%\Glary Utilities 4\languages\French_(RT).lng (3489 bytes)
    %Program Files%\Glary Utilities 4\skins\default\images\oc_btn_scan.png (1 bytes)
    %Program Files%\Glary Utilities 4\languages\spanish.lng (2319 bytes)
    %Program Files%\Glary Utilities 4\skins\default\images\DockButton_Tip.png (2 bytes)
    %Program Files%\Glary Utilities 4\iehelper.exe (17138 bytes)
    %Program Files%\Glary Utilities 4\Native\wlh_x64\BootDefragDriver.sys (17 bytes)
    %Program Files%\Glary Utilities 4\skins\default\images\checkbox_uncheck.png (1 bytes)
    %Program Files%\Glary Utilities 4\Resources\QuickSearch\images\quick_search_logo.png (3 bytes)
    %Program Files%\Glary Utilities 4\CheckDisk.exe (1568 bytes)
    %Program Files%\Glary Utilities 4\skins\icons\regdefraghover.png (1 bytes)
    %Program Files%\Glary Utilities 4\Resources\settings\CleanRegistryImageList.bmp (18 bytes)
    %Program Files%\Glary Utilities 4\data\process.dat (1568 bytes)
    %Program Files%\Glary Utilities 4\skins\icons\diskanalysis.png (1 bytes)
    %Program Files%\Glary Utilities 4\skins\default\images\main_skin.png (1 bytes)
    %Program Files%\Glary Utilities 4\languages\spanish (McM).lng (3122 bytes)
    %Program Files%\Glary Utilities 4\skins\default\images\programs.png (1 bytes)
    %Program Files%\Glary Utilities 4\skins\default\images\tab_oc_blue.png (3 bytes)
    %Program Files%\Glary Utilities 4\RegistryCleaner.exe (2009 bytes)
    %Program Files%\Glary Utilities 4\skins\icons\shredderhover.png (1 bytes)
    %Program Files%\Glary Utilities 4\skins\default\skin.ini (653 bytes)
    %Program Files%\Glary Utilities 4\mfc90u.dll (27634 bytes)
    %Program Files%\Glary Utilities 4\skins\default\images\tab_btn_click.png (2 bytes)
    %Program Files%\Glary Utilities 4\skins\default\images\toolbar.png (3 bytes)
    %Program Files%\Glary Utilities 4\skins\icons\quicksearch.png (1 bytes)
    %Program Files%\Glary Utilities 4\skins\default\images\foot_transbg.png (7 bytes)
    %Program Files%\Glary Utilities 4\GridMap.ocx (9906 bytes)
    %Program Files%\Glary Utilities 4\Initialize.exe (3586 bytes)
    %Program Files%\Glary Utilities 4\skins\icons\cmm.png (1 bytes)
    %WinDir%\Tasks\GlaryInitialize 4.job (316 bytes)

  4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
  5. Reboot the computer.
*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name:
Product Name:
Product Version:
Legal Copyright: MrSoftware
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 4.4.0.8
File Description: Glary Utilities Pro
Comments: http://www.autoitscript.com/autoit3/
Language: English (United States)

Company Name: Product Name: Product Version: Legal Copyright: MrSoftwareLegal Trademarks: Original Filename: Internal Name: File Version: 4.4.0.8File Description: Glary Utilities ProComments: http://www.autoitscript.com/autoit3/Language: English (United States)

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
UPX040961266892800d41d8cd98f00b204e9800998ecf8427e
UPX1126730243522563496965.49795063ef6d73afbf2ef1664a0bb494203e9
.rsrc1302528012136448121349125.538073dc52a0037d5695db9ed77057d0fa6e6

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL IP
hxxp://gu.glarysoft.com/boottime/service.php23.23.198.31
hxxp://d3dti4k49whnx0.cloudfront.net/news/news.ini
hxxp://d3dti4k49whnx0.cloudfront.net/redirect.php?pid=2&a=update&v=4.4.0.86&uid=9CE3DA09E740E6E75C87B4D2B8140F2C
hxxp://d3dti4k49whnx0.cloudfront.net/update/glary-utilities/update.html
hxxp://d3dti4k49whnx0.cloudfront.net/js/jquery.min.js
hxxp://d3dti4k49whnx0.cloudfront.net/js/index.js
hxxp://www.glarysoft.com/js/jquery.min.js54.230.39.141
hxxp://www.glarysoft.com/news/news.ini54.230.39.141
hxxp://www.glarysoft.com/redirect.php?pid=2&a=update&v=4.4.0.86&uid=9CE3DA09E740E6E75C87B4D2B8140F2C54.230.39.141
hxxp://www.glarysoft.com/js/index.js54.230.39.141
hxxp://www.glarysoft.com/update/glary-utilities/update.html54.230.39.141

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

<font color="red">GET /js/index.js HTTP/1.1<br>

Accept: */*<br>

Referer: hXXp://VVV.glarysoft.com/update/glary-utilities/update.html<br>

Accept-Language: en-us<br>

Accept-Encoding: gzip, deflate<br>

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)<br>

Host: VVV.glarysoft.com<br>

Connection: Keep-Alive<br>

<br>

</font><br><font color="blue">HTTP/1.1 200 OK<br>

Content-Type: text/javascript<br>

Content-Length: 10128<br>

Connection: keep-alive<br>

Date: Fri, 15 Aug 2014 08:51:15 GMT<br>

Server: Apache/2.2.15 (Red Hat)<br>

Last-Modified: Fri, 04 Jul 2014 03:34:48 GMT<br>

ETag: "23c8f-2790-4fd55cea7e600"<br>

Accept-Ranges: bytes<br>

Age: 36234<br>

X-Cache: Hit from cloudfront<br>

Via: 1.1 648e00a047edab76310001e837503ac0.cloudfront.net (CloudFront)<br>

<<< skipped >>>

<font color="red">GET /news/news.ini HTTP/1.1<br>

Accept: */*<br>

Accept-Encoding: gzip, deflate<br>

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)<br>

Host: VVV.glarysoft.com<br>

Connection: Keep-Alive<br>

<br>

</font><br><font color="blue">HTTP/1.1 200 OK<br>

Content-Type: text/plain; charset=UTF-8<br>

Content-Length: 194<br>

Connection: keep-alive<br>

Date: Thu, 14 Aug 2014 02:15:25 GMT<br>

Server: Apache/2.2.15 (Red Hat)<br>

Last-Modified: Thu, 13 Feb 2014 03:17:09 GMT<br>

ETag: "43145-c2-4f2411fe8f740"<br>

Accept-Ranges: bytes<br>

Age: 59970<br>

X-Cache: Hit from cloudfront<br>

Via: 1.1 8b02a8bc49ce2525e4b610c7a96eeda4.cloudfront.net (CloudFront)<br>

X-Amz-Cf-Id: wuqJeVfmR85jAgWSAeEFXqm_bGLBgtaruB56xpkJIA6fk06va-CGAg==<br><pre>#[New1]..Title=Disk Speedup 2.0 just released..URL=hXXp://VVV.glarysof<br>t.com/products/utilities/disk-speedup..#[New2]..Title=Christmas Specia<br>l offer - 50% off..URL=hXXp://VVV.glarysoft.com/..</font>....</pre></font><br><br><font color="red">GET /redirect.php?pid=2&a=update&v=4.4.0.86&uid=9CE3DA09E740E6E75C87B4D2B8140F2C HTTP/1.1<br>

Accept: */*<br>

Accept-Encoding: gzip, deflate<br>

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)<br>

Host: VVV.glarysoft.com<br>

Connection: Keep-Alive<br>

<br>

</font><br><font color="blue">HTTP/1.1 200 OK<br>

Content-Type: text/html; charset=UTF-8<br>

Content-Length: 107<br>

Connection: keep-alive<br>

Date: Fri, 15 Aug 2014 18:55:02 GMT<br>

Server: Apache/2.2.15 (Red Hat)<br>

X-Powered-By: PHP/5.3.3<br>

X-Cache: Miss from cloudfront<br>

Via: 1.1 8b02a8bc49ce2525e4b610c7a96eeda4.cloudfront.net (CloudFront)<br>

X-Amz-Cf-Id: N4485ox3QnZdZV-zXX1KRi64WbM--TjvOm37ARTQFQcXQQD2PTwQMQ==<br><pre>[Version]..Version=5.5.0.12..UpdateUrl=hXXp://VVV.glarysoft.com/glary-<br>utilities-pro/download/..Forcepop=3</font>....</pre></font><br><br><font color="red">GET /update/glary-utilities/update.html HTTP/1.1<br>

Accept: image/gif, image/jpeg, image/pjpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*<br>

Accept-Language: en-us<br>

Accept-Encoding: gzip, deflate<br>

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)<br>

Host: VVV.glarysoft.com<br>

Connection: Keep-Alive<br>

<br>

</font><br><font color="blue">HTTP/1.1 200 OK<br>

Content-Type: text/html; charset=UTF-8<br>

Content-Length: 2954<br>

Connection: keep-alive<br>

Date: Fri, 15 Aug 2014 02:24:38 GMT<br>

Server: Apache/2.2.15 (Red Hat)<br>

Last-Modified: Fri, 08 Aug 2014 02:59:36 GMT<br>

ETag: "23d49-b8a-5001565377600"<br>

Accept-Ranges: bytes<br>

Age: 59427<br>

X-Cache: Hit from cloudfront<br>

Via: 1.1 8b02a8bc49ce2525e4b610c7a96eeda4.cloudfront.net (CloudFront)<br>

<<< skipped >>>

Accept: */*<br>

Referer: hXXp://VVV.glarysoft.com/update/glary-utilities/update.html<br>

Accept-Language: en-us<br>

Accept-Encoding: gzip, deflate<br>

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)<br>

Host: VVV.glarysoft.com<br>

Connection: Keep-Alive<br>

<br>

</font><br><font color="blue">HTTP/1.1 200 OK<br>

Content-Type: text/javascript<br>

Content-Length: 91572<br>

Connection: keep-alive<br>

Date: Fri, 15 Aug 2014 02:21:10 GMT<br>

Server: Apache/2.2.15 (Red Hat)<br>

Last-Modified: Thu, 13 Feb 2014 03:17:09 GMT<br>

ETag: "23c94-165b4-4f2411fe8f740"<br>

Accept-Ranges: bytes<br>

Age: 59639<br>

X-Cache: Hit from cloudfront<br>

Via: 1.1 8b02a8bc49ce2525e4b610c7a96eeda4.cloudfront.net (CloudFront)<br>

<<< skipped >>>

<font color="red">POST /boottime/service.php HTTP/1.1<br>

Content-Length: 482<br>

Content-Type: text/xml; charset=utf-8<br>

SOAPAction: "hXXp://VVV.example.org/Mutual/NewOperation"<br>

Accept: text/xml<br>

Host: gu.glarysoft.com<br>

User-Agent: Microsoft-ATL-Native/9.00<br>

<br>

<soap:Envelope xmlns:soap="hXXp://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="hXXp://VVV.w3.org/2001/XMLSchema-instance" xmlns:xsd="hXXp://VVV.w3.org/2001/XMLSchema" xmlns:soapenc="hXXp://schemas.xmlsoap.org/soap/encoding/"><soap:Body soap:encodingStyle="hXXp://schemas.xmlsoap.org/soap/encoding/"><snp:getComNum xmlns:snp="hXXp://VVV.example.org/Mutual/"><type>0</type><time soapenc:arrayType="xsd:string[1]"><string>5</string></time></snp:getComNum></soap:Body></soap:Envelope></font><br><font color="blue">HTTP/1.1 200 OK<br>

Date: Fri, 15 Aug 2014 19:01:00 GMT<br>

Server: Apache/2.2.15 (Red Hat)<br>

X-Powered-By: PHP/5.3.3<br>

Content-Length: 673<br>

Connection: close<br>

Content-Type: text/xml; charset=utf-8<br><pre><?xml version="1.0" encoding="UTF-8"?>.<SOAP-ENV:Envelope xml<br>ns:SOAP-ENV="hXXp://schemas.xmlsoap.org/soap/envelope/" xmlns:ns1="htt<br>p://VVV.example.org/Mutual/" xmlns:xsd="hXXp://VVV.w3.org/2001/XMLSche<br>ma" xmlns:SOAP-ENC="hXXp://schemas.xmlsoap.org/soap/encoding/" xmlns:x<br>si="hXXp://VVV.w3.org/2001/XMLSchema-instance" xmlns:ns2="hXXp://schem<br>a" SOAP-ENV:encodingStyle="hXXp://schemas.xmlsoap.org/soap/encoding/"&<br>gt;<SOAP-ENV:Body><ns1:getComNumResponse><rtime SOAP-EN<br>C:arrayType="xsd:string[2]" xsi:type="ns2:ArrayOfString"><item x<br>si:type="xsd:string">216399520</item><item xsi:type="xsd:s<br>tring">44568</item></rtime></ns1:getComNumResponse&g<br>t;</SOAP-ENV:Body></SOAP-ENV:Envelope>...</pre></font><br><br

Map

The Worm connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_1896:

`.rsrc

`.rsrc

,044d8.ZQ

,044d8.ZQ

PSSSSSSh

PSSSSSSh

Gt.Ht$

Gt.Ht$

t.jGZf;

t.jGZf;

PSSSh@

PSSSh@

PVSSh@

PVSSh@

f;Crt

f;Crt

?#%X.y

?#%X.y

GetProcessWindowStation

GetProcessWindowStation

operator

operator

This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.

This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.

kernel32.dll

kernel32.dll

oleaut32.dll

oleaut32.dll

RegDeleteKeyExW

RegDeleteKeyExW

advapi32.dll

advapi32.dll

Error text not found (please report)

Error text not found (please report)

operand of unlimited repeat could match the empty string

operand of unlimited repeat could match the empty string

POSIX named classes are supported only within a class

POSIX named classes are supported only within a class

erroffset passed as NULL

erroffset passed as NULL

POSIX collating elements are not supported

POSIX collating elements are not supported

this version of PCRE is compiled without UTF support

this version of PCRE is compiled without UTF support

PCRE does not support \L, \l, \N{name}, \U, or \u

PCRE does not support \L, \l, \N{name}, \U, or \u

support for \P, \p, and \X has not been compiled

support for \P, \p, and \X has not been compiled

this version of PCRE is not compiled with Unicode property support

this version of PCRE is not compiled with Unicode property support

\N is not supported in a class

\N is not supported in a class

zcÁ

zcÁ

GetProcessHeap

GetProcessHeap

CreatePipe

CreatePipe

GetWindowsDirectoryW

GetWindowsDirectoryW

GetCPInfo

GetCPInfo

RegDeleteKeyW

RegDeleteKeyW

RegEnumKeyExW

RegEnumKeyExW

RegCreateKeyExW

RegCreateKeyExW

RegOpenKeyExW

RegOpenKeyExW

RegCloseKey

RegCloseKey

SetViewportOrgEx

SetViewportOrgEx

ShellExecuteExW

ShellExecuteExW

SHFileOperationW

SHFileOperationW

ShellExecuteW

ShellExecuteW

RegisterHotKey

RegisterHotKey

GetKeyboardLayoutNameW

GetKeyboardLayoutNameW

ExitWindowsEx

ExitWindowsEx

EnumThreadWindows

EnumThreadWindows

UnregisterHotKey

UnregisterHotKey

keybd_event

keybd_event

GetAsyncKeyState

GetAsyncKeyState

SetKeyboardState

SetKeyboardState

GetKeyboardState

GetKeyboardState

GetKeyState

GetKeyState

VkKeyScanW

VkKeyScanW

EnumWindows

EnumWindows

EnumChildWindows

EnumChildWindows

MapVirtualKeyW

MapVirtualKeyW

CloseWindowStation

CloseWindowStation

SetProcessWindowStation

SetProcessWindowStation

OpenWindowStationW

OpenWindowStationW

InternetCrackUrlW

InternetCrackUrlW

HttpQueryInfoW

HttpQueryInfoW

HttpOpenRequestW

HttpOpenRequestW

HttpSendRequestW

HttpSendRequestW

FtpOpenFileW

FtpOpenFileW

FtpGetFileSize

FtpGetFileSize

InternetOpenUrlW

InternetOpenUrlW

##@,&,//,))

##@,&,//,))

.jQE2

.jQE2

4`%ud*

4`%ud*

3(-,'')-*/%'

3(-,'')-*/%'

9(***3).**-)'

9(***3).**-)'

H%d=j@

H%d=j@

0!;....(

0!;....(

.text

.text

`.rdata

`.rdata

@.data

@.data

.rsrc

.rsrc

@.reloc

@.reloc

4`%ud

4`%ud

-%U)iQ

-%U)iQ

.rT%X

.rT%X

sQL"|

sQL"|

g.Te$o

g.Te$o

3X7.pk-

3X7.pk-

&.HXj

&.HXj

o.QYw

o.QYw

(.DfH7

(.DfH7

.JW!EU

.JW!EU

0o.id"

0o.id"

Hq,%S

Hq,%S

g.iD{

g.iD{

.bnh]

.bnh]

sS.os

sS.os

.MGpK

.MGpK

t@.St%

t@.St%

"n_ .ji

"n_ .ji

c--u%c

c--u%c

udPv

udPv

IÝ'!

IÝ'!

%cPHO

%cPHO

G~|N:1%C

G~|N:1%C

.jCnxf`uZ eE

.jCnxf`uZ eE

#Zy.qS

#Zy.qS

.rTX"

.rTX"

Sl.Ka

Sl.Ka

%X F.

%X F.

O]%dOg

O]%dOg

%x1^D

%x1^D

[J.fgu

[J.fgu

@Ñ7v

@Ñ7v

-BwV}

-BwV}

5.koDqCY

5.koDqCY

\m.NS

\m.NS

$l.Zkj}?

$l.Zkj}?

Qm.mwF

Qm.mwF

t~.aQVx*

t~.aQVx*

on%uV

on%uV

.wR}qO

.wR}qO

8J%fKG

8J%fKG

%f/`Ge

%f/`Ge

y_$

y_$

g|.trD

g|.trD

*,>.cj

*,>.cj

Y.Gvd

Y.Gvd

bI.M.Bz

bI.M.Bz

9$$%X?{

9$$%X?{

=.Gw4>

=.Gw4>

.QAu!Ue

.QAu!Ue

.GWp~

.GWp~

"0.KH*

"0.KH*

y.VG]

y.VG]

nudp

nudp

$Q.qj8

$Q.qj8

"-b}&%

"-b}&%

{56Û

{56Û

;.kx#0

;.kx#0

-9XV}

-9XV}

b .DH

b .DH

Fc%c|KM%

Fc%c|KM%

@Mln.exp

@Mln.exp

'mUj.Zo,

'mUj.Zo,

`T.kF~

`T.kF~

x)z-9jM}

x)z-9jM}

_!a%d

_!a%d

T.Qkt

T.Qkt

'T.LGDp1

'T.LGDp1

z .qH

z .qH

Yk:%S

Yk:%S

.xoKl

.xoKl

W.Zjc

W.Zjc

%XH t

%XH t

.gs* g

.gs* g

.DOFM

.DOFM

[.ri?[

[.ri?[

AC.MUq

AC.MUq

.aBwb#a

.aBwb#a

l.Au3

l.Au3

A/%x *

A/%x *

rd~\rCRt

rd~\rCRt

k1%uB

k1%uB

yi.yK

yi.yK

.yCpK

.yCpK

^d.QRQ

^d.QRQ

q.pL%s%t#

q.pL%s%t#

~7.Ps

~7.Ps

P'[%C

P'[%C

.&.HN

.&.HN

r.pZm,

r.pZm,

%ULm4J

%ULm4J

h.oYk

h.oYk

E.UHWQ0

E.UHWQ0

Tz.KoH

Tz.KoH

U.YTUQ

U.YTUQ

v1;-J}

v1;-J}

YN=%C;

YN=%C;

k|%x.I

k|%x.I

.cj[4

.cj[4

.WNWQ}

.WNWQ}

-v}Bf"

-v}Bf"

#%FJ^l

#%FJ^l

yb@%F

yb@%F

%d`N'

%d`N'

q'*.QE

q'*.QE

v.egZ

v.egZ

Y_,%Us jr

Y_,%Us jr

qY %s

qY %s

-7Ui}

-7Ui}

q&%Uk

q&%Uk

`<.eq>

`<.eq>

Q%Sbh

Q%Sbh

Vm'S{sÅ’G

Vm'S{sÅ’G

.rVFY

.rVFY

jr.lv

jr.lv

%cyeZ|

%cyeZ|

.nXh|

.nXh|

>u.ff

>u.ff

gr&[5%f

gr&[5%f

.gnJ\2=

.gnJ\2=

z.rH5u

z.rH5u

.WD6:

.WD6:

Wx..Le

Wx..Le

.U%SsF

.U%SsF

!%fjE

!%fjE

[,0%cuJ

[,0%cuJ

%Xm]5H@

%Xm]5H@

.Xsm9

.Xsm9

$.ET\

$.ET\

3g%Doo

3g%Doo

>l.UIL

>l.UIL

{.am;G

{.am;G

"~l%X

"~l%X

%US_2

%US_2

t.ewe::

t.ewe::

A]vp~I%f)r

A]vp~I%f)r

@7%U9

@7%U9

2S.itx

2S.itx

FI.lEO:

FI.lEO:

.lG2&

.lG2&

:%Sfni

:%Sfni

gBC.bm

gBC.bm

@LÝ

@LÝ

!3;.Aq

!3;.Aq

r"Xu.RD

r"Xu.RD

h%XGVt

h%XGVt

k97-k4o}

k97-k4o}

A%f(n

A%f(n

X.ecq

X.ecq

.EYPb1

.EYPb1

D#.Qn

D#.Qn

].vN*3Af

].vN*3Af

!\8.Ufz

!\8.Ufz

.VlU~

.VlU~

L.ff=

L.ff=

9.eBZ

9.eBZ

%xMNx

%xMNx

]a{.vZG_

]a{.vZG_

|UQ%f

|UQ%f

.yw5_}S

.yw5_}S

_6-{Q6

_6-{Q6

.qzx.

.qzx.

.pi4>

.pi4>

U0c%S3

U0c%S3

!T.lC

!T.lC

wo.ZZ

wo.ZZ

v!.BI

v!.BI

;ËE

;ËE

;.kmY

;.kmY

\.CGu

\.CGu

})%Cyu?

})%Cyu?

0ye%F

0ye%F

×>K

×>K

@.KXT

@.KXT

.RWe*

.RWe*

`98%s

`98%s

tw.gw

tw.gw

I|-%U0taK

I|-%U0taK

9[r~%c

9[r~%c

`2"Yj.af

`2"Yj.af

[Q.BV2,

[Q.BV2,

X%fp^

X%fp^

.PFxo

.PFxo

%W.Si

%W.Si

.KB(;f

.KB(;f

.hXV{

.hXV{

nf.zcX"

nf.zcX"

HSql

HSql

Lg%s*

Lg%s*

#.tO%,

#.tO%,

Q#2x%x

Q#2x%x

-mRQ}

-mRQ}

C=Fnf%S

C=Fnf%S

.LloD

.LloD

X]A.hd>

X]A.hd>

.nhoe

.nhoe

.yu)%

.yu)%

.aAiG

.aAiG

|!R.jn

|!R.jn

-R.HU

-R.HU

" .vnR

" .vnR

%u\6}xn

%u\6}xn

@E %F

@E %F

.bD8eTM3{B

.bD8eTM3{B

d.FcP,

d.FcP,

%sqzA

%sqzA

.RQ^z

.RQ^z

@PLy%u

@PLy%u

Ã’n#

Ã’n#

n.Ir~

n.Ir~

F!W%D

F!W%D

E1.Es

E1.Es

&.Aw#

&.Aw#

s.Yl;_

s.Yl;_

!.yE0P:

!.yE0P:

`HA%C

`HA%C

%dV4~

%dV4~

.Wvgi

.Wvgi

o.UWU

o.UWU

.eYU]^`

.eYU]^`

.tzct

.tzct

Tq.nd}7

Tq.nd}7

6j.E%S!

6j.E%S!

Zl/.Zm-dA>

Zl/.Zm-dA>

),.lf

),.lf

s.rFi

s.rFi

w.ZM?E

w.ZM?E

%siWct

%siWct

<.tht>

<.tht>

y.MSF

y.MSF

7]L@%c

7]L@%c

6S%uu

6S%uu

%CoHA4

%CoHA4

.rlXn

.rlXn

qh.KB~%i

qh.KB~%i

TU.YJ

TU.YJ

|}.Bv\G

|}.Bv\G

P,=-.mKM

P,=-.mKM

CS"%f

CS"%f

A6|P.WBC

A6|P.WBC

nEG.Oh

nEG.Oh

.JY"yGq

.JY"yGq

YC.gv

YC.gv

{.Ur3

{.Ur3

CRTF(=

CRTF(=

5F-zP.JAa^y

5F-zP.JAa^y

BF.Ab

BF.Ab

.PA(p

.PA(p

Ý32

Ý32

A.Jl8D

A.Jl8D

3%C@'

3%C@'

rd.grA

rd.grA

.rU8#E

.rU8#E

.JQ?h

.JQ?h

ü_m

ü_m

o.PuV

o.PuV

.WeW7GI

.WeW7GI

.uM&5/

.uM&5/

.vml(H=?H

.vml(H=?H

BMKCmD

BMKCmD

Qs.BI

Qs.BI

q[k!zm.rW`

q[k!zm.rW`

kU

kU

.Ib$u

.Ib$u

m.rze

m.rze

^{.Vz=?

^{.Vz=?

]D2%c)

]D2%c)

~C?.oM

~C?.oM

]kP@%Fx#

]kP@%Fx#

.bQVT

.bQVT

4$.Zh

4$.Zh

(H:%X

(H:%X

W"y0%F

W"y0%F

rN$%D

rN$%D

d.lq|

d.lq|

_YS

_YS

Xcrt

Xcrt

a.On6K

a.On6K

bo0.NU

bo0.NU

.GTLz(}

.GTLz(}

.VsIV

.VsIV

%x8<: r>

%x8<: r>

.tXKP

.tXKP

&H.tb

&H.tb

H.P.lQ

H.P.lQ

TY.Uc

TY.Uc

T7-J}

T7-J}

Z1*.oU

Z1*.oU

py.XWo

py.XWo

.YhOR

.YhOR

.Uo}01

.Uo}01

%d`1v6|X

%d`1v6|X

F=.c/%c

F=.c/%c

VZ?%F

VZ?%F

[/Z%X

[/Z%X

.nv0(

.nv0(

TQwEb

TQwEb

ht%fQT

ht%fQT

Gs%d-

Gs%d-

..Gtz

..Gtz

`}.pw

`}.pw

-yaYa}

-yaYa}

%?e%F

%?e%F

O;.vt

O;.vt

J~.eZN

J~.eZN

4/%Ck

4/%Ck

%Dt .

%Dt .

Y.YW~\pSgN

Y.YW~\pSgN

1-6}^.

1-6}^.

%U:jO

%U:jO

7K.AwY

7K.AwY

t .Is

t .Is

'.os1

'.os1

DO.oo

DO.oo

:urLA

:urLA

9Ne.Ce

9Ne.Ce

Nudp

Nudp

^-.YR

^-.YR

.xeRm

.xeRm

túNP

túNP

A3.Tv

A3.Tv

$ b%C

$ b%C

F.lR:}i

F.lR:}i

.cC091

.cC091

z.JO*\

z.JO*\

%Fwx~X

%Fwx~X

.FX^d

.FX^d

{2=CDn%sUA,

{2=CDn%sUA,

BZ.dP

BZ.dP

C.am=H

C.am=H

hxoE.cQ@

hxoE.cQ@

.gJdQ

.gJdQ

.dU/"

.dU/"

@T%D(-

@T%D(-

r*6.Jt

r*6.Jt

G.Zyos

G.Zyos

u>.Rw

u>.Rw

.dvFmB>

.dvFmB>

.NYV.

.NYV.

ahJ%c

ahJ%c

?%frX\

?%frX\

H_.kA(4

H_.kA(4

=udp(xl

=udp(xl

%FSVR!

%FSVR!

V%D

V%D

5.RHr

5.RHr

d%C*

d%C*

.xCh&

.xCh&

r.nvD

r.nvD

2.nA/J[e

2.nA/J[e

]O%%D&

]O%%D&

r#oÊ

r#oÊ

xf^Ÿ

xf^Ÿ

%sTtS

%sTtS

&qi%F

&qi%F

[,%fV

[,%fV

Q.Ic%g

Q.Ic%g

ZaL.SZ5

ZaL.SZ5

.bqjK\

.bqjK\

\web4\V

\web4\V

$%U%f

$%U%f

.gBgh

.gBgh

.ei0\z

.ei0\z

vS-hm}t

vS-hm}t

v.QPh

v.QPh

.ds:/

.ds:/

.pMxh2

.pMxh2

.aqG"

.aqG"

K.Df%

K.Df%

1H.Jt

1H.Jt

o.bQR_%

o.bQR_%

*.uMt

*.uMt

.vPKz

.vPKz

%dRW%

%dRW%

aH8.KaE

aH8.KaE

G%U`|

G%U`|

3.yV@

3.yV@

%F,eH)=

%F,eH)=

!X4%X

!X4%X

Gg0%fw

Gg0%fw

,.jso

,.jso

S2%u_>f

S2%u_>f

]w!.Yl'

]w!.Yl'

.PL%RvD8

.PL%RvD8

8`T%u

8`T%u

hq.AW

hq.AW

l=%C\,

l=%C\,

G]d4".SA

G]d4".SA

.yAV&

.yAV&

3g-D}

3g-D}

OI.uL

OI.uL

b)C1`.CZY

b)C1`.CZY

Zg%u5>ES

Zg%u5>ES

.fod"9

.fod"9

.WJ}sz

.WJ}sz

.qfZA

.qfZA

bAg$.Jz

bAg$.Jz

J8}.MJ

J8}.MJ

nH.gP~h >C

nH.gP~h >C

`.azj

`.azj

%f,r\

%f,r\

{p%S>

{p%S>

4$o.us

4$o.us

Q:C%F

Q:C%F

.sq-9

.sq-9

FGb.Cl?

FGb.Cl?

BY!%f

BY!%f

HL/K,%S

HL/K,%S

.ZY'd

.ZY'd

.Df92

.Df92

.Zl>ld

.Zl>ld

iQ-%c

iQ-%c

6L%X\

6L%X\

.HHgUju

.HHgUju

iÔ)

iÔ)

%xvxh

%xvxh

.wNza

.wNza

R.UNe

R.UNe

VK.dIZ

VK.dIZ

j%x=U$

j%x=U$

%sVLR#t^

%sVLR#t^

!3.diq

!3.diq

/L%f%

/L%f%

.Ri@K,

.Ri@K,

.pJ-;

.pJ-;

|.fKM^

|.fKM^

-Ux}m

-Ux}m

8.oXz

8.oXz

j%U}Fq

j%U}Fq

X|.az

X|.az

%xsE~

%xsE~

|F.HOK

|F.HOK

q4%S:

q4%S:

}E%F/

}E%F/

`.ca|

`.ca|

j%S5;2

j%S5;2

aSQl

aSQl

.YsOM

.YsOM

WXW.TIG

WXW.TIG

F.jv

F.jv

.dOmDs

.dOmDs

8.MkYV

8.MkYV

h .tYrlv

h .tYrlv

.UyZ^

.UyZ^

`x-

`x-

6x.Wi&T

6x.Wi&T

"D"%c

"D"%c

pP.IL

pP.IL

p`%D)\

p`%D)\

u.Chs

u.Chs

c%x*!9

c%x*!9

%s|L4>

%s|L4>

j-9%U

j-9%U

m.blM

m.blM

r[mu.zg

r[mu.zg

(p`%U

(p`%U

[f.dj

[f.dj

bk.rk

bk.rk

%drpb

%drpb

j\.Kp

j\.Kp

=.gI[D

=.gI[D

Dn.Yq

Dn.Yq

nU.Ng

nU.Ng

# %x,oLv

# %x,oLv

!.UFUI

!.UFUI

YG.VUb

YG.VUb

%f}g5

%f}g5

{%u&k

{%u&k

xI%S

xI%S

.xE -

.xE -

y&s`.wp

y&s`.wp

%s{Bi

%s{Bi

u75.#%U

u75.#%U

y.ls/QFJ

y.ls/QFJ

@5.Sj

@5.Sj

Urly

Urly

.Dj&B_.

.Dj&B_.

s,N%F

s,N%F

^.Pxi 6F

^.Pxi 6F

;0Þ

;0Þ

.VUa

.VUa

"^

"^

>MO%UW

>MO%UW

B=ý

B=ý

Ç(1f

Ç(1f

z?.Ym

z?.Ym

( EhO.vx

( EhO.vx

K8%c@

K8%c@

z%(%C

z%(%C

.q%D?

.q%D?

.Mp/P

.Mp/P

(v%so

(v%so

t.swP

t.swP

1r.Cz

1r.Cz

.yJh(

.yJh(

g7 ø

g7 ø

D)pV%s2

D)pV%s2

.qZ3PQ

.qZ3PQ

N0>%f

N0>%f

)=.JpCi

)=.JpCi

%UpV-

%UpV-

lP.hg

lP.hg

B.wI|k

B.wI|k

.CeC%

.CeC%

M*.fB

M*.fB

%SU[V

%SU[V

=8.XV

=8.XV

9y.sUy&

9y.sUy&

NF.CL

NF.CL

.tEp:%Q

.tEp:%Q

r-.B.M.OeQ

r-.B.M.OeQ

.zt W

.zt W

q.Vba

q.Vba

#w.qh'N

#w.qh'N

`%xG"j

`%xG"j

)}.cy

)}.cy

8.TSHT

8.TSHT

4/.ixz]

4/.ixz]

|4ew.ae

|4ew.ae

D6.Cv

D6.Cv

gW9%C

gW9%C

$.iB}ltw

$.iB}ltw

P.len

P.len

9ZG

9ZG

H.nE]'J

H.nE]'J

.NkTw

.NkTw

XõY[

XõY[

NI.Gs

NI.Gs

.xN8A

.xN8A

f%XeJ

f%XeJ

)(%DuJ{eM

)(%DuJ{eM

'.cbH2

'.cbH2

Di.Tv

Di.Tv

Q.PQQ

Q.PQQ

e.xz1KO

e.xz1KO

P:\~1

P:\~1

s3%C:

s3%C:

Q:\ L

Q:\ L

}\/%X

}\/%X

xM.Dku%

xM.Dku%

~fB.vY

~fB.vY

d%C#JV

d%C#JV

qtg%D=

qtg%D=

ew*.Qh`]

ew*.Qh`]

.TjpT

.TjpT

:=.Fz

:=.Fz

>#.SW

>#.SW

@.rHu

@.rHu

JG.aS

JG.aS

C.fX[

C.fX[

.on)*

.on)*

4kEJ.vK

4kEJ.vK

=)Ü

=)Ü

.buew

.buew

I.Ss*

I.Ss*

.nkDD

.nkDD

`Us.In

`Us.In

.Sdpm

.Sdpm

L.eN2}4I

L.eN2}4I

jh.sX

jh.sX

v.rf:

v.rf:

.xg@?

.xg@?

)L-g}

)L-g}

J.BX55

J.BX55

.qu^8

.qu^8

"%FzL

"%FzL

Ks %d

Ks %d

.tWcg

.tWcg

k.Qq0

k.Qq0

"F.nM

"F.nM

-1Xf}Z

-1Xf}Z

GQ

GQ

R:%dI'SIT

R:%dI'SIT

45=%U

45=%U

vT.Rs|V

vT.Rs|V

0e.Akq

0e.Akq

%sv$m

%sv$m

FNm%S

FNm%S

fj.Em

fj.Em

;.gIGI

;.gIGI

.Mt|ko

.Mt|ko

-U[.fz

-U[.fz

!.sSq7S

!.sSq7S

E.LW\(

E.LW\(

k.cwQ

k.cwQ

F\%x n

F\%x n

Ye`h%X

Ye`h%X

.vxOk

.vxOk

~.Pg.

~.Pg.

.LX{CP

.LX{CP

-T}**i

-T}**i

C.jso

C.jso

?Z6[%Fs

?Z6[%Fs

V.Tt_

V.Tt_

%U1O$%P8

%U1O$%P8

.DD12:

.DD12:

.WqR&%

.WqR&%

KI.HZ

KI.HZ

.kt8Xx

.kt8Xx

.Uw!wd

.Uw!wd

U.uUy>

U.uUy>

!.wKf

!.wKf

#i.bq

#i.bq

tcPTj>N

tcPTj>N

<.vy>

<.vy>

%dOoE

%dOoE

w%CR,r

w%CR,r

Zv.Em

Zv.Em

%u[BY

%u[BY

*}y6%x

*}y6%x

V5G%u

V5G%u

.IxiM

.IxiM

[.yjqE

[.yjqE

h.cs"(A>

h.cs"(A>

%7uO/v*

%7uO/v*

Nu.rHD

Nu.rHD

IN%Ct&^a

IN%Ct&^a

A.cm/

A.cm/

$d=.IG

$d=.IG

aaÍ^_E

aaÍ^_E

Kd=.HY^

Kd=.HY^

.DcR.T

.DcR.T

{.sKs

{.sKs

n%DsZ:"

n%DsZ:"

.NF5l

.NF5l

,Tcp@

,Tcp@

np?(L%X

np?(L%X

%U9=y

%U9=y

Q.lob

Q.lob

ld.hn~

ld.hn~

.yI~2

.yI~2

*%U{*

*%U{*

%Dl?A

%Dl?A

.VjJ-

.VjJ-

0p%F~

0p%F~

$2k M%X

$2k M%X

St%xY1i

St%xY1i

.lZ9H

.lZ9H

`%x_m

`%x_m

q.aI~

q.aI~

E%%xI

E%%xI

5'y.Gc

5'y.Gc

f#.CMbm(>^

f#.CMbm(>^

/wc%x

/wc%x

.dpc4

.dpc4

aDU%u

aDU%u

.nb33

.nb33

Å’g]

Å’g]

3|3.ZmQ

3|3.ZmQ

g].Srt

g].Srt

CnÜ

CnÜ

J.mCjt

J.mCjt

RI[z.wg

RI[z.wg

Wo0

Wo0

N'L%x

N'L%x

.My12Dxc

.My12Dxc

yqr%Cv

yqr%Cv

MsGm

MsGm

/"7f1k2].Lw

/"7f1k2].Lw

.qp!Bve;

.qp!Bve;

NxU%f&

NxU%f&

\Q.gM

\Q.gM

%Xpc[

%Xpc[

B.Mt?

B.Mt?

>.tZN,9

>.tZN,9

HR%s.

HR%s.

f.pS?

f.pS?

I.aJ)

I.aJ)

uC%fKl0

uC%fKl0

a.hvE

a.hvE

.mi&y

.mi&y

WeBemj

WeBemj

'iy%Ss

'iy%Ss

.Xt C

.Xt C

|s%s\

|s%s\

X$l\%Fg

X$l\%Fg

~%f&q

~%f&q

j.gf(D

j.gf(D

.EGopl

.EGopl

_.Rrk

_.Rrk

U.Wv:

U.Wv:

%|po.G.Rc

%|po.G.Rc

J%xC`Q

J%xC`Q

^.EiY

^.EiY

.Gr$.

.Gr$.

Wq%xK 1

Wq%xK 1

2M}%U

2M}%U

%ClO?

%ClO?

_b7

_b7

.ZTG[

.ZTG[

#hs.hJp~

#hs.hJp~

VIRO.Om

VIRO.Om

x.zcK

x.zcK

37.WOT

37.WOT

|.eb>

|.eb>

h.Ejsdc

h.Ejsdc

zu%C,?

zu%C,?

S\O%uQf

S\O%uQf

o.WO`a

o.WO`a

$-m}M{1g

$-m}M{1g

8JA%fq

8JA%fq

-,M.PV

-,M.PV

/N%S L

/N%S L

~9.fO

~9.fO

%Sy})

%Sy})

i-c}O)

i-c}O)

-%%4U

-%%4U

MD.MK

MD.MK

<.ipe>

<.ipe>

d.gc.

d.gc.

HC.ait

HC.ait

.xl-2

.xl-2

9?q~%X!%I

9?q~%X!%I

Za.dEF

Za.dEF

h>dK%F

h>dK%F

Z.Ee)

Z.Ee)

.Qn$i

.Qn$i

xi3.rq

xi3.rq

.oum%

.oum%

#Z.ujp

#Z.ujp

[%xF"

[%xF"

G.Zer

G.Zer

l.Ur9

l.Ur9

CU.Yh

CU.Yh

.MeF}mYQ

.MeF}mYQ

.DZ){

.DZ){

r%5%f

r%5%f

urLyYog

urLyYog

.sakLm

.sakLm

y.UF(NJ

y.UF(NJ

`.uzL

`.uzL

e(O.SzY

e(O.SzY

:.eM

:.eM

]U%X,

]U%X,

8%x{

8%x{

l %D$

l %D$

.%uVd~UB

.%uVd~UB

.dreD

.dreD

Xo2

Xo2

>l.Ov5

>l.Ov5

mziV.LW

mziV.LW

ZBs%s

ZBs%s

ci.kx

ci.kx

ÃŒfM

ÃŒfM

x0.as

x0.as

j%FkX3l

j%FkX3l

{~.KT

{~.KT

.ngDL

.ngDL

D%D%wu

D%D%wu

s].fT

s].fT

9)J%C=

9)J%C=

`d.Ii

`d.Ii

9D%xD

9D%xD

J.GX#

J.GX#

J-G}>

J-G}>

H.mx&$

H.mx&$

P.lz|O

P.lz|O

oZ"5%F

oZ"5%F

&DFTP

&DFTP

t.xGC*

t.xGC*

.bGG;

.bGG;

Y84?%s

Y84?%s

eK%X!

eK%X!

z.Eh6=j

z.Eh6=j

%shpQ

%shpQ

}Fb(.BL

}Fb(.BL

%5x

%5x

!Z0:%u

!Z0:%u

\]P%U

\]P%U

$%0s:3

$%0s:3

.EnFD:

.EnFD:

Y%f/9Ss?

Y%f/9Ss?

h%uk/

h%uk/

.my"f

.my"f

E|%]%U

E|%]%U

DdL.LU

DdL.LU

wFH.Nx

wFH.Nx

A.aIcVE

A.aIcVE

e..kx

e..kx

%US

%US

.hc5h]

.hc5h]

H%x~jy*

H%x~jy*

.yMdC

.yMdC

eVo.WF

eVo.WF

".fD/bq

".fD/bq

iÓ?

iÓ?

.Re`@

.Re`@

xMsG

xMsG

%u7:2

%u7:2

r-t}W]

r-t}W]

6.bdy

6.bdy

t/`%s.

t/`%s.

K}8-Z}

K}8-Z}

W.he8

W.he8

s%Ufj

s%Ufj

Ýst

Ýst

6B5;%f

6B5;%f

)u%s;4{

)u%s;4{

.DYS:'

.DYS:'

6b.bn

6b.bn

z.CUr

z.CUr

.ROIHw

.ROIHw

wWU%s

wWU%s

.HLK_-

.HLK_-

<.mo>

<.mo>

2*%cG

2*%cG

iTb.ub

iTb.ub

%7s#@

%7s#@

gz.VnnBe

gz.VnnBe

~[k%f

~[k%f

|.KTXQD

|.KTXQD

y2.LT

y2.LT

zf.Kx

zf.Kx

%d(Vva

%d(Vva

=%2u1~

=%2u1~

T.CprA)

T.CprA)

P.qPG

P.qPG

Z.ILz

Z.ILz

.SmIo

.SmIo

[4.UE2

[4.UE2

.BdC7

.BdC7

m%CV|.

m%CV|.

%u Pi

%u Pi

|>%u^

|>%u^

.gji'

.gji'

h,T%.ji

h,T%.ji

n.wL4

n.wL4

gh.zs

gh.zs

%f/A6

%f/A6

o.llc

o.llc

W|39%%s

W|39%%s

oL.IP

oL.IP

i%U#N

i%U#N

rmI%XTn

rmI%XTn

Ta<.ci>

Ta<.ci>

i.yTT

i.yTT

.smQP

.smQP

.RT>N

.RT>N

J.ZS

J.ZS

QC.lY:

QC.lY:

Surl

Surl

W.Sg!

W.Sg!

X6%.F

X6%.F

9.KXa

9.KXa

.k.WZ

.k.WZ

[/]\/,[\

[/]\/,[\

]I.pGZ

]I.pGZ

%d{L%g

%d{L%g

!-AH}T'

!-AH}T'

jXÿ>

jXÿ>

[.NX>

[.NX>

"%ur,]!

"%ur,]!

%X.D6

%X.D6

VdyeXE$

VdyeXE$

0u}@%X

0u}@%X

VV/.VS

VV/.VS

W#".QO

W#".QO

.fof`

.fof`

iH(E

iH(E

.uzPr

.uzPr

.Kn4}

.Kn4}

_|.qW

_|.qW

K.ltV

K.ltV

8

8

%4udWf5q

%4udWf5q

Jb_.vz

Jb_.vz

gJ%x8,5m

gJ%x8,5m

R.StYJ

R.StYJ

lt.BZ

lt.BZ

s%S}.'

s%S}.'

P0%s:

P0%s:

KW48.OC

KW48.OC

"d@%S

"d@%S

0v.HLi

0v.HLi

sþ6[

sþ6[

fW%c*/

fW%c*/

.dn)

.dn)

80WftP

80WftP

.KLVa

.KLVa

NlA=

NlA=

>/8.Gl^

>/8.Gl^

Y%U9Z5

Y%U9Z5

!R.LW

!R.LW

Qr.bF

Qr.bF

Yw.MS

Yw.MS

RY%X|

RY%X|

Kp9%U

Kp9%U

.RUh7v

.RUh7v

UA<.sqf>

UA<.sqf>

:0.sUT

:0.sUT

.gVDE

.gVDE

Cq@.bg

Cq@.bg

/.Mdi

/.Mdi

K}.ox*

K}.ox*

wj.dL

wj.dL

.MW:3EV

.MW:3EV

%Q0D.zB7

%Q0D.zB7

kD0!o.eQ

kD0!o.eQ

AW.GUo

AW.GUo

f~.p.Iw

f~.p.Iw

.nS?8

.nS?8

K,.qL

K,.qL

k.tB8

k.tB8

:,M\.wlp?

:,M\.wlp?

Q[.LF

Q[.LF

.swQ[

.swQ[

tcRt

tcRt

ghP%U

ghP%U

;C.kQao

;C.kQao

6?-.aaZ

6?-.aaZ

.Iv>M

.Iv>M

.ak1Y

.ak1Y

.Rw|)

.Rw|)

d%S5X

d%S5X

[eK.px

[eK.px

]x%uE;

]x%uE;

.LLB>MH

.LLB>MH

(;%U6&

(;%U6&

YKeYH{

YKeYH{

\.yas

\.yas

.A.nz

.A.nz

.Qm@kk

.Qm@kk

.IJ@4

.IJ@4

6.ahFK

6.ahFK

,N%DL&:

,N%DL&:

Lv%8x

Lv%8x

4e`8.Cw

4e`8.Cw

[#}.RF|

[#}.RF|

nptCp

nptCp

.XcW^

.XcW^

n.rkp:;

n.rkp:;

K.hzN

K.hzN

xT%D$W

xT%D$W

\.fm

\.fm

-J=%c

-J=%c

%c*PS

%c*PS

9c.oQ

9c.oQ

N:,%x

N:,%x

w-.WEc)

w-.WEc)

%xC~X

%xC~X

Pw%x2fV

Pw%x2fV

nO3"e%D

nO3"e%D

~#V%U

~#V%U

D.ia{

D.ia{

.cxi1

.cxi1

\B.eG

\B.eG

Cn.Xe

Cn.Xe

SQ%U?

SQ%U?

~Ø

~Ø

nQ.uj{

nQ.uj{

*M.vk

*M.vk

.KxVZ

.KxVZ

Bg~%sB

Bg~%sB

P.QY'

P.QY'

*.gzh

*.gzh

z.kzZ

z.kzZ

94d%S

94d%S

.tZ.\f

.tZ.\f

%XPA_

%XPA_

c)[t%u

c)[t%u

l-Z.NU

l-Z.NU

ftpM

ftpM

l.Dwb»

l.Dwb»

.Ktu7

.Ktu7

.ix >

.ix >

.ZIEQN

.ZIEQN

A-7}=

A-7}=

bk.rq

bk.rq

).HBl

).HBl

ohB%X

ohB%X

rc]bzU.Bo#

rc]bzU.Bo#

!H%Dn

!H%Dn

.fk#m

.fk#m

"i%ua

"i%ua

%uVaV

%uVaV

.Ql@V%,

.Ql@V%,

CW4%U

CW4%U

^.expv

^.expv

q.Jt]

q.Jt]

?z!.fr

?z!.fr

p6.pd

p6.pd

K^s/E=%.C

K^s/E=%.C

c.ygk

c.ygk

.Vh0E1

.Vh0E1

h|.qX

h|.qX

H5#.yx

H5#.yx

!k%C}

!k%C}

P.ko(

P.ko(

X.HTn

X.HTn

ZA/%S

ZA/%S

i^..JA

i^..JA

.rmUoW

.rmUoW

.qGu

.qGu

e%xtV

e%xtV

.Pg9X

.Pg9X

!$4y.AL

!$4y.AL

.RrP&^>E

.RrP&^>E

.Ax}|

.Ax}|

X.ra-

X.ra-

.gP3N

.gP3N

W%s@M!?

W%s@M!?

sQ.KWP

sQ.KWP

o~.Do

o~.Do

B.Dr%

B.Dr%

:ea

:ea

.PlOx

.PlOx

.pz63

.pz63

%UK}3

%UK}3

V9.NM

V9.NM

Hx],s%C

Hx],s%C

6^.Lf

6^.Lf

.xC.:zH

.xC.:zH

J.nFa

J.nFa

û;{

û;{

vR%dr

vR%dr

r%sE3

r%sE3

.%fw?r

.%fw?r

k.LE>

k.LE>

%sjQbF&

%sjQbF&

>.PL D

>.PL D

\.xwe

\.xwe

}6.Og

}6.Og

/M%SNW

/M%SNW

j4GY\n.xGb`;

j4GY\n.xGb`;

.lKuR

.lKuR

.TFzlr

.TFzlr

.ES

.ES

.DhhW

.DhhW

.Rla\li

.Rla\li

nzuu.Zi

nzuu.Zi

|%CsX

|%CsX

.LMJk

.LMJk

ZXs.cT8N

ZXs.cT8N

oX.Ht

oX.Ht

C.CH,

C.CH,

{.pJS

{.pJS

1}D%D

1}D%D

.}.So

.}.So

.IwJ#

.IwJ#

.eo~;

.eo~;

KD(=%U

KD(=%U

z.MkGU

z.MkGU

.ZtlJ

.ZtlJ

.Dsc%

.Dsc%

:SQLQL'L

:SQLQL'L

{-f.bM

{-f.bM

%Xg`h

%Xg`h

J=%Fx

J=%Fx

.uWa=

.uWa=

De%Sq y

De%Sq y

.nUo*}P

.nUo*}P

Udpz

Udpz

'zAO.pf

'zAO.pf

.[.RM

.[.RM

6nIzP%SV

6nIzP%SV

Y%Dm2:

Y%Dm2:

.Uhp.

.Uhp.

.DvU2(

.DvU2(

>%RÃŽ

>%RÃŽ

.Jm-^t~

.Jm-^t~

h.yYv

h.yYv

XR%D$

XR%D$

|}.Oe

|}.Oe

%dwL.j

%dwL.j

.cA6Z

.cA6Z

%U9Ud\

%U9Ud\

j't%x

j't%x

%.TKDQt

%.TKDQt

J.Az!

J.Az!

'w.Oc

'w.Oc

F.qGo

F.qGo

$`s%u

$`s%u

.HvGg

.HvGg

l=.ob

l=.ob

aþn

aþn

}~%f/b

}~%f/b

Zn.QV=

Zn.QV=

%l%c$

%l%c$

6e

6e

XAb-GB}

XAb-GB}

TcPT

TcPT

s:\bn>

s:\bn>

.KsB9

.KsB9

7%x?"

7%x?"

RGS%8X

RGS%8X

}l.Sx

}l.Sx

-bF}I'9

-bF}I'9

].IoC

].IoC

f%.vn

f%.vn

'.vO@

'.vO@

<.ljg>

<.ljg>

-.RHLn

-.RHLn

x.zKsl

x.zKsl

R.nl["6

R.nl["6

(`%c(

(`%c(

.XFtJ

.XFtJ

#f.KM

#f.KM

b%Ut65N

b%Ut65N

Kb.Uz

Kb.Uz

.tLYu

.tLYu

.QR7r

.QR7r

.KiE4t!

.KiE4t!

-tYwJNHJ}O

-tYwJNHJ}O

.OC5

.OC5

&%dv^A

&%dv^A

O.uG7

O.uG7

.ntX;

.ntX;

.EnfO

.EnfO

.Ev"&

.Ev"&

$F%fxNvt

$F%fxNvt

3Hx.Ozt~C

3Hx.Ozt~C

f9.cib0

f9.cib0

KERNEL32.DLL

KERNEL32.DLL

ADVAPI32.dll

ADVAPI32.dll

COMCTL32.dll

COMCTL32.dll

COMDLG32.dll

COMDLG32.dll

GDI32.dll

GDI32.dll

IPHLPAPI.DLL

IPHLPAPI.DLL

MPR.dll

MPR.dll

ole32.dll

ole32.dll

OLEAUT32.dll

OLEAUT32.dll

PSAPI.DLL

PSAPI.DLL

SHELL32.dll

SHELL32.dll

USER32.dll

USER32.dll

USERENV.dll

USERENV.dll

UxTheme.dll

UxTheme.dll

VERSION.dll

VERSION.dll

WININET.dll

WININET.dll

WINMM.dll

WINMM.dll

WSOCK32.dll

WSOCK32.dll

mscoree.dll

mscoree.dll

combase.dll

combase.dll

- CRT not initialized

- CRT not initialized

- Attempt to initialize the CRT more than once.

- Attempt to initialize the CRT more than once.

- floating point support not loaded

- floating point support not loaded

USER32.DLL

USER32.DLL

>>>AUTOIT NO CMDEXECUTE

>>>AUTOIT NO CMDEXECUTE

CMDLINERAW

CMDLINERAW

CMDLINE

CMDLINE

/AutoIt3ExecuteLine

/AutoIt3ExecuteLine

/AutoIt3ExecuteScript

/AutoIt3ExecuteScript

APPSKEY

APPSKEY

789:;?

789:;?

FTPSETPROXY

FTPSETPROXY

GUICTRLRECVMSG

GUICTRLRECVMSG

GUICTRLSENDMSG

GUICTRLSENDMSG

GUIGETMSG

GUIGETMSG

GUIREGISTERMSG

GUIREGISTERMSG

HOTKEYSET

HOTKEYSET

HTTPSETPROXY

HTTPSETPROXY

HTTPSETUSERAGENT

HTTPSETUSERAGENT

ISKEYWORD

ISKEYWORD

MSGBOX

MSGBOX

REGENUMKEY

REGENUMKEY

SHELLEXECUTE

SHELLEXECUTE

SHELLEXECUTEWAIT

SHELLEXECUTEWAIT

TCPACCEPT

TCPACCEPT

TCPCLOSESOCKET

TCPCLOSESOCKET

TCPCONNECT

TCPCONNECT

TCPLISTEN

TCPLISTEN

TCPNAMETOIP

TCPNAMETOIP

TCPRECV

TCPRECV

TCPSEND

TCPSEND

TCPSHUTDOWN

TCPSHUTDOWN

TCPSTARTUP

TCPSTARTUP

TRAYGETMSG

TRAYGETMSG

UDPBIND

UDPBIND

UDPCLOSESOCKET

UDPCLOSESOCKET

UDPOPEN

UDPOPEN

UDPRECV

UDPRECV

UDPSEND

UDPSEND

UDPSHUTDOWN

UDPSHUTDOWN

UDPSTARTUP

UDPSTARTUP

SendKeyDelay

SendKeyDelay

SendKeyDownDelay

SendKeyDownDelay

TCPTimeout

TCPTimeout

WINDOWSDIR

WINDOWSDIR

AUTOITEXE

AUTOITEXE

HOTKEYPRESSED

HOTKEYPRESSED

D%s (%d) : ==> %s.:

D%s (%d) : ==> %s.:

Line %d:

Line %d:

Line %d (File "%s"):

Line %d (File "%s"):

%s (%d) : ==> %s:

%s (%d) : ==> %s:

AutoIt script files (*.au3, *.a3x)

AutoIt script files (*.au3, *.a3x)

*.au3;*.a3x

*.au3;*.a3x

All files (*.*)

All files (*.*)

04090000

04090000

%u.%u.%u.%u

%u.%u.%u.%u

0.0.0.0

0.0.0.0

Mddddd

Mddddd

"%s" (%d) : ==> %s:

"%s" (%d) : ==> %s:

\??\%s

\??\%s

GUI_RUNDEFMSG

GUI_RUNDEFMSG

AUTOITCALLVARIABLE%d

AUTOITCALLVARIABLE%d

255.255.255.255

255.255.255.255

Keyword

Keyword

AUTOIT.ERROR

AUTOIT.ERROR

Null Object assignment in FOR..IN loop

Null Object assignment in FOR..IN loop

Incorrect Object type in FOR..IN loop

Incorrect Object type in FOR..IN loop

3, 3, 10, 0

3, 3, 10, 0

HKEY_LOCAL_MACHINE

HKEY_LOCAL_MACHINE

HKEY_CLASSES_ROOT

HKEY_CLASSES_ROOT

HKEY_CURRENT_CONFIG

HKEY_CURRENT_CONFIG

HKEY_CURRENT_USER

HKEY_CURRENT_USER

HKEY_USERS

HKEY_USERS

%d/d/d

%d/d/d

c:\%original file name%.exe

c:\%original file name%.exe

C:\%original file name%.exe

C:\%original file name%.exe

AutoIt supports the __stdcall (WINAPI) and __cdecl calling conventions. The __stdcall (WINAPI) convention is used by default but __cdecl can be used instead. See the DllCall() documentation for details on changing the calling convention.

AutoIt supports the __stdcall (WINAPI) and __cdecl calling conventions. The __stdcall (WINAPI) convention is used by default but __cdecl can be used instead. See the DllCall() documentation for details on changing the calling convention.

Missing operator in expression."Unbalanced brackets in expression.

Missing operator in expression."Unbalanced brackets in expression.

Error parsing function call.0Incorrect number of parameters in function call.'"ReDim" used without an array variable.>Illegal text at the end of statement (one statement per line).1"If" statement has no matching "EndIf" statement.1"Else" statement with no matching "If" statement.2"EndIf" statement with no matching "If" statement.7Too many "Else" statements for matching "If" statement.3"While" statement has no matching "Wend" statement.4"Wend" statement with no matching "While" statement.%Variable used without being declared.XArray variable has incorrect number of subscripts or subscript dimension range exceeded.#Variable subscript badly formatted.*Subscript used on non-accessible variable.&Too many subscripts used for an array.0Missing subscript dimensions in "Dim" statement.NNo variable given for "Dim", "Local", "Global", "Struct" or "Const" statement.

Error parsing function call.0Incorrect number of parameters in function call.'"ReDim" used without an array variable.>Illegal text at the end of statement (one statement per line).1"If" statement has no matching "EndIf" statement.1"Else" statement with no matching "If" statement.2"EndIf" statement with no matching "If" statement.7Too many "Else" statements for matching "If" statement.3"While" statement has no matching "Wend" statement.4"Wend" statement with no matching "While" statement.%Variable used without being declared.XArray variable has incorrect number of subscripts or subscript dimension range exceeded.#Variable subscript badly formatted.*Subscript used on non-accessible variable.&Too many subscripts used for an array.0Missing subscript dimensions in "Dim" statement.NNo variable given for "Dim", "Local", "Global", "Struct" or "Const" statement.

0Expected a "=" operator in assignment statement.*Invalid keyword at the start of this line.

0Expected a "=" operator in assignment statement.*Invalid keyword at the start of this line.

Invalid element in a DllStruct.*Unknown option or bad parameter specified.&Unable to load the internet libraries./"Struct" statement has no matching "EndStruct".HUnable to open file, the maximum number of open files has been exceeded.K"ContinueLoop" statement with no matching "While", "Do" or "For" statement.

Invalid element in a DllStruct.*Unknown option or bad parameter specified.&Unable to load the internet libraries./"Struct" statement has no matching "EndStruct".HUnable to open file, the maximum number of open files has been exceeded.K"ContinueLoop" statement with no matching "While", "Do" or "For" statement.

Invalid file filter given.*Expected a variable in user function call.1"Do" statement has no matching "Until" statement.2"Until" statement with no matching "Do" statement.#"For" statement is badly formatted.2"Next" statement with no matching "For" statement.N"ExitLoop/ContinueLoop" statements only valid from inside a For/Do/While loop.1"For" statement has no matching "Next" statement.@"Case" statement with no matching "Select"or "Switch" statement.:"EndSelect" statement with no matching "Select" statement.ORecursion level has been exceeded - AutoIt will quit to prevent stack overflow.&Cannot make existing variables static.4Cannot make static variables into regular variables.

Invalid file filter given.*Expected a variable in user function call.1"Do" statement has no matching "Until" statement.2"Until" statement with no matching "Do" statement.#"For" statement is badly formatted.2"Next" statement with no matching "For" statement.N"ExitLoop/ContinueLoop" statements only valid from inside a For/Do/While loop.1"For" statement has no matching "Next" statement.@"Case" statement with no matching "Select"or "Switch" statement.:"EndSelect" statement with no matching "Select" statement.ORecursion level has been exceeded - AutoIt will quit to prevent stack overflow.&Cannot make existing variables static.4Cannot make static variables into regular variables.

3This keyword cannot be used after a "Then" keyword.>"Select" statement is missing "EndSelect" or "Case" statement. "If" statements must have a "Then" keyword. Badly formated Struct statement."Cannot assign values to constants..Cannot make existing variables into constants.9Only Object-type variables allowed in a "With" statement.v"long_ptr", "int_ptr" and "short_ptr" DllCall() types have been deprecated. Use "long*", "int*" and "short*" instead.-Object referenced outside a "With" statement.)Nested "With" statements are not allowed."Variable must be of type "Object".1The requested action with this object has failed.8Variable appears more than once in function declaration.2ReDim array can not be initialized in this manner.1An array variable can not be used in this manner.

3This keyword cannot be used after a "Then" keyword.>"Select" statement is missing "EndSelect" or "Case" statement. "If" statements must have a "Then" keyword. Badly formated Struct statement."Cannot assign values to constants..Cannot make existing variables into constants.9Only Object-type variables allowed in a "With" statement.v"long_ptr", "int_ptr" and "short_ptr" DllCall() types have been deprecated. Use "long*", "int*" and "short*" instead.-Object referenced outside a "With" statement.)Nested "With" statements are not allowed."Variable must be of type "Object".1The requested action with this object has failed.8Variable appears more than once in function declaration.2ReDim array can not be initialized in this manner.1An array variable can not be used in this manner.

Can not redeclare a constant.5Can not redeclare a parameter inside a user function.HCan pass constants by reference only to parameters with "Const" keyword.*Can not initialize a variable with itself.$Incorrect way to use this parameter.:"EndSwitch" statement with no matching "Switch" statement.>"Switch" statement is missing "EndSwitch" or "Case" statement.H"ContinueCase" statement with no matching "Select"or "Switch" statement.

Can not redeclare a constant.5Can not redeclare a parameter inside a user function.HCan pass constants by reference only to parameters with "Const" keyword.*Can not initialize a variable with itself.$Incorrect way to use this parameter.:"EndSwitch" statement with no matching "Switch" statement.>"Switch" statement is missing "EndSwitch" or "Case" statement.H"ContinueCase" statement with no matching "Select"or "Switch" statement.

String missing closing quote.!Badly formated variable or macro.*Missing separator character after keyword.

String missing closing quote.!Badly formated variable or macro.*Missing separator character after keyword.

4.4.0.8

4.4.0.8

hXXp://VVV.autoitscript.com/autoit3/

hXXp://VVV.autoitscript.com/autoit3/

%original file name%.exe_1896_rwx_00401000_00C6A000:

PSSSSSSh

PSSSSSSh

Gt.Ht$

Gt.Ht$

t.jGZf;

t.jGZf;

PSSSh@

PSSSh@

PVSSh@

PVSSh@

f;Crt

f;Crt

?#%X.y

?#%X.y

GetProcessWindowStation

GetProcessWindowStation

operator

operator

This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.

This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.

kernel32.dll

kernel32.dll

oleaut32.dll

oleaut32.dll

RegDeleteKeyExW

RegDeleteKeyExW

advapi32.dll

advapi32.dll

Error text not found (please report)

Error text not found (please report)

operand of unlimited repeat could match the empty string

operand of unlimited repeat could match the empty string

POSIX named classes are supported only within a class

POSIX named classes are supported only within a class

erroffset passed as NULL

erroffset passed as NULL

POSIX collating elements are not supported

POSIX collating elements are not supported

this version of PCRE is compiled without UTF support

this version of PCRE is compiled without UTF support

PCRE does not support \L, \l, \N{name}, \U, or \u

PCRE does not support \L, \l, \N{name}, \U, or \u

support for \P, \p, and \X has not been compiled

support for \P, \p, and \X has not been compiled

this version of PCRE is not compiled with Unicode property support

this version of PCRE is not compiled with Unicode property support

\N is not supported in a class

\N is not supported in a class

zcÁ

zcÁ

GetProcessHeap

GetProcessHeap

CreatePipe

CreatePipe

GetWindowsDirectoryW

GetWindowsDirectoryW

GetCPInfo

GetCPInfo

RegDeleteKeyW

RegDeleteKeyW

RegEnumKeyExW

RegEnumKeyExW

RegCreateKeyExW

RegCreateKeyExW

RegOpenKeyExW

RegOpenKeyExW

RegCloseKey

RegCloseKey

SetViewportOrgEx

SetViewportOrgEx

ShellExecuteExW

ShellExecuteExW

SHFileOperationW

SHFileOperationW

ShellExecuteW

ShellExecuteW

RegisterHotKey

RegisterHotKey

GetKeyboardLayoutNameW

GetKeyboardLayoutNameW

ExitWindowsEx

ExitWindowsEx

EnumThreadWindows

EnumThreadWindows

UnregisterHotKey

UnregisterHotKey

keybd_event

keybd_event

GetAsyncKeyState

GetAsyncKeyState

SetKeyboardState

SetKeyboardState

GetKeyboardState

GetKeyboardState

GetKeyState

GetKeyState

VkKeyScanW

VkKeyScanW

EnumWindows

EnumWindows

EnumChildWindows

EnumChildWindows

MapVirtualKeyW

MapVirtualKeyW

CloseWindowStation

CloseWindowStation

SetProcessWindowStation

SetProcessWindowStation

OpenWindowStationW

OpenWindowStationW

InternetCrackUrlW

InternetCrackUrlW

HttpQueryInfoW

HttpQueryInfoW

HttpOpenRequestW

HttpOpenRequestW

HttpSendRequestW

HttpSendRequestW

FtpOpenFileW

FtpOpenFileW

FtpGetFileSize

FtpGetFileSize

InternetOpenUrlW

InternetOpenUrlW

##@,&,//,))

##@,&,//,))

.jQE2

.jQE2

4`%ud*

4`%ud*

3(-,'')-*/%'

3(-,'')-*/%'

9(***3).**-)'

9(***3).**-)'

H%d=j@

H%d=j@

0!;....(

0!;....(

.text

.text

`.rdata

`.rdata

@.data

@.data

.rsrc

.rsrc

@.reloc

@.reloc

4`%ud

4`%ud

mscoree.dll

mscoree.dll

combase.dll

combase.dll

- CRT not initialized

- CRT not initialized

- Attempt to initialize the CRT more than once.

- Attempt to initialize the CRT more than once.

- floating point support not loaded

- floating point support not loaded

USER32.DLL

USER32.DLL

>>>AUTOIT NO CMDEXECUTE

>>>AUTOIT NO CMDEXECUTE

CMDLINERAW

CMDLINERAW

CMDLINE

CMDLINE

/AutoIt3ExecuteLine

/AutoIt3ExecuteLine

/AutoIt3ExecuteScript

/AutoIt3ExecuteScript

APPSKEY

APPSKEY

789:;?

789:;?

FTPSETPROXY

FTPSETPROXY

GUICTRLRECVMSG

GUICTRLRECVMSG

GUICTRLSENDMSG

GUICTRLSENDMSG

GUIGETMSG

GUIGETMSG

GUIREGISTERMSG

GUIREGISTERMSG

HOTKEYSET

HOTKEYSET

HTTPSETPROXY

HTTPSETPROXY

HTTPSETUSERAGENT

HTTPSETUSERAGENT

ISKEYWORD

ISKEYWORD

MSGBOX

MSGBOX

REGENUMKEY

REGENUMKEY

SHELLEXECUTE

SHELLEXECUTE

SHELLEXECUTEWAIT

SHELLEXECUTEWAIT

TCPACCEPT

TCPACCEPT

TCPCLOSESOCKET

TCPCLOSESOCKET

TCPCONNECT

TCPCONNECT

TCPLISTEN

TCPLISTEN

TCPNAMETOIP

TCPNAMETOIP

TCPRECV

TCPRECV

TCPSEND

TCPSEND

TCPSHUTDOWN

TCPSHUTDOWN

TCPSTARTUP

TCPSTARTUP

TRAYGETMSG

TRAYGETMSG

UDPBIND

UDPBIND

UDPCLOSESOCKET

UDPCLOSESOCKET

UDPOPEN

UDPOPEN

UDPRECV

UDPRECV

UDPSEND

UDPSEND

UDPSHUTDOWN

UDPSHUTDOWN

UDPSTARTUP

UDPSTARTUP

SendKeyDelay

SendKeyDelay

SendKeyDownDelay

SendKeyDownDelay

TCPTimeout

TCPTimeout

WINDOWSDIR

WINDOWSDIR

AUTOITEXE

AUTOITEXE

HOTKEYPRESSED

HOTKEYPRESSED

D%s (%d) : ==> %s.:

D%s (%d) : ==> %s.:

Line %d:

Line %d:

Line %d (File "%s"):

Line %d (File "%s"):

%s (%d) : ==> %s:

%s (%d) : ==> %s:

AutoIt script files (*.au3, *.a3x)

AutoIt script files (*.au3, *.a3x)

*.au3;*.a3x

*.au3;*.a3x

All files (*.*)

All files (*.*)

04090000

04090000

%u.%u.%u.%u

%u.%u.%u.%u

0.0.0.0

0.0.0.0

Mddddd

Mddddd

"%s" (%d) : ==> %s:

"%s" (%d) : ==> %s:

\??\%s

\??\%s

GUI_RUNDEFMSG

GUI_RUNDEFMSG

AUTOITCALLVARIABLE%d

AUTOITCALLVARIABLE%d

255.255.255.255

255.255.255.255

Keyword

Keyword

AUTOIT.ERROR

AUTOIT.ERROR

Null Object assignment in FOR..IN loop

Null Object assignment in FOR..IN loop

Incorrect Object type in FOR..IN loop

Incorrect Object type in FOR..IN loop

3, 3, 10, 0

3, 3, 10, 0

HKEY_LOCAL_MACHINE

HKEY_LOCAL_MACHINE

HKEY_CLASSES_ROOT

HKEY_CLASSES_ROOT

HKEY_CURRENT_CONFIG

HKEY_CURRENT_CONFIG

HKEY_CURRENT_USER

HKEY_CURRENT_USER

HKEY_USERS

HKEY_USERS

%d/d/d

%d/d/d

c:\%original file name%.exe

c:\%original file name%.exe

C:\%original file name%.exe

C:\%original file name%.exe

AutoIt supports the __stdcall (WINAPI) and __cdecl calling conventions. The __stdcall (WINAPI) convention is used by default but __cdecl can be used instead. See the DllCall() documentation for details on changing the calling convention.

AutoIt supports the __stdcall (WINAPI) and __cdecl calling conventions. The __stdcall (WINAPI) convention is used by default but __cdecl can be used instead. See the DllCall() documentation for details on changing the calling convention.

Missing operator in expression."Unbalanced brackets in expression.

Missing operator in expression."Unbalanced brackets in expression.

Error parsing function call.0Incorrect number of parameters in function call.'"ReDim" used without an array variable.>Illegal text at the end of statement (one statement per line).1"If" statement has no matching "EndIf" statement.1"Else" statement with no matching "If" statement.2"EndIf" statement with no matching "If" statement.7Too many "Else" statements for matching "If" statement.3"While" statement has no matching "Wend" statement.4"Wend" statement with no matching "While" statement.%Variable used without being declared.XArray variable has incorrect number of subscripts or subscript dimension range exceeded.#Variable subscript badly formatted.*Subscript used on non-accessible variable.&Too many subscripts used for an array.0Missing subscript dimensions in "Dim" statement.NNo variable given for "Dim", "Local", "Global", "Struct" or "Const" statement.

Error parsing function call.0Incorrect number of parameters in function call.'"ReDim" used without an array variable.>Illegal text at the end of statement (one statement per line).1"If" statement has no matching "EndIf" statement.1"Else" statement with no matching "If" statement.2"EndIf" statement with no matching "If" statement.7Too many "Else" statements for matching "If" statement.3"While" statement has no matching "Wend" statement.4"Wend" statement with no matching "While" statement.%Variable used without being declared.XArray variable has incorrect number of subscripts or subscript dimension range exceeded.#Variable subscript badly formatted.*Subscript used on non-accessible variable.&Too many subscripts used for an array.0Missing subscript dimensions in "Dim" statement.NNo variable given for "Dim", "Local", "Global", "Struct" or "Const" statement.

0Expected a "=" operator in assignment statement.*Invalid keyword at the start of this line.

0Expected a "=" operator in assignment statement.*Invalid keyword at the start of this line.

Invalid element in a DllStruct.*Unknown option or bad parameter specified.&Unable to load the internet libraries./"Struct" statement has no matching "EndStruct".HUnable to open file, the maximum number of open files has been exceeded.K"ContinueLoop" statement with no matching "While", "Do" or "For" statement.

Invalid element in a DllStruct.*Unknown option or bad parameter specified.&Unable to load the internet libraries./"Struct" statement has no matching "EndStruct".HUnable to open file, the maximum number of open files has been exceeded.K"ContinueLoop" statement with no matching "While", "Do" or "For" statement.

Invalid file filter given.*Expected a variable in user function call.1"Do" statement has no matching "Until" statement.2"Until" statement with no matching "Do" statement.#"For" statement is badly formatted.2"Next" statement with no matching "For" statement.N"ExitLoop/ContinueLoop" statements only valid from inside a For/Do/While loop.1"For" statement has no matching "Next" statement.@"Case" statement with no matching "Select"or "Switch" statement.:"EndSelect" statement with no matching "Select" statement.ORecursion level has been exceeded - AutoIt will quit to prevent stack overflow.&Cannot make existing variables static.4Cannot make static variables into regular variables.

Invalid file filter given.*Expected a variable in user function call.1"Do" statement has no matching "Until" statement.2"Until" statement with no matching "Do" statement.#"For" statement is badly formatted.2"Next" statement with no matching "For" statement.N"ExitLoop/ContinueLoop" statements only valid from inside a For/Do/While loop.1"For" statement has no matching "Next" statement.@"Case" statement with no matching "Select"or "Switch" statement.:"EndSelect" statement with no matching "Select" statement.ORecursion level has been exceeded - AutoIt will quit to prevent stack overflow.&Cannot make existing variables static.4Cannot make static variables into regular variables.

3This keyword cannot be used after a "Then" keyword.>"Select" statement is missing "EndSelect" or "Case" statement. "If" statements must have a "Then" keyword. Badly formated Struct statement."Cannot assign values to constants..Cannot make existing variables into constants.9Only Object-type variables allowed in a "With" statement.v"long_ptr", "int_ptr" and "short_ptr" DllCall() types have been deprecated. Use "long*", "int*" and "short*" instead.-Object referenced outside a "With" statement.)Nested "With" statements are not allowed."Variable must be of type "Object".1The requested action with this object has failed.8Variable appears more than once in function declaration.2ReDim array can not be initialized in this manner.1An array variable can not be used in this manner.

3This keyword cannot be used after a "Then" keyword.>"Select" statement is missing "EndSelect" or "Case" statement. "If" statements must have a "Then" keyword. Badly formated Struct statement."Cannot assign values to constants..Cannot make existing variables into constants.9Only Object-type variables allowed in a "With" statement.v"long_ptr", "int_ptr" and "short_ptr" DllCall() types have been deprecated. Use "long*", "int*" and "short*" instead.-Object referenced outside a "With" statement.)Nested "With" statements are not allowed."Variable must be of type "Object".1The requested action with this object has failed.8Variable appears more than once in function declaration.2ReDim array can not be initialized in this manner.1An array variable can not be used in this manner.

Can not redeclare a constant.5Can not redeclare a parameter inside a user function.HCan pass constants by reference only to parameters with "Const" keyword.*Can not initialize a variable with itself.$Incorrect way to use this parameter.:"EndSwitch" statement with no matching "Switch" statement.>"Switch" statement is missing "EndSwitch" or "Case" statement.H"ContinueCase" statement with no matching "Select"or "Switch" statement.

Can not redeclare a constant.5Can not redeclare a parameter inside a user function.HCan pass constants by reference only to parameters with "Const" keyword.*Can not initialize a variable with itself.$Incorrect way to use this parameter.:"EndSwitch" statement with no matching "Switch" statement.>"Switch" statement is missing "EndSwitch" or "Case" statement.H"ContinueCase" statement with no matching "Select"or "Switch" statement.

String missing closing quote.!Badly formated variable or macro.*Missing separator character after keyword.

String missing closing quote.!Badly formated variable or macro.*Missing separator character after keyword.

Integrator.exe_3452:

.text

.text

`.rdata

`.rdata

@.data

@.data

.rsrc

.rsrc

@.reloc

@.reloc

Rpj%UQP

Rpj%UQP

Ppj%SQW

Ppj%SQW

SSSSSSh

SSSSSSh

L$.Qf

L$.Qf

PSSSSSSh

PSSSSSSh

hXXp://VVV.example.org/Mutual/

hXXp://VVV.example.org/Mutual/

CoInitializeEx failed: %x

CoInitializeEx failed: %x

Failed to create an instance of ITaskService: %x

Failed to create an instance of ITaskService: %x

ITaskService::Connect failed: %x

ITaskService::Connect failed: %x

ITaskService::GetFolder failed: %x

ITaskService::GetFolder failed: %x

D:\WorkFolder\gu\exe\vc\Integrator\sourcecode\Release\Integrator.pdb

D:\WorkFolder\gu\exe\vc\Integrator\sourcecode\Release\Integrator.pdb

mfc90u.dll

mfc90u.dll

_amsg_exit

_amsg_exit

_wcmdln

_wcmdln

MSVCR90.dll

MSVCR90.dll

_crt_debugger_hook

_crt_debugger_hook

GetProcessHeap

GetProcessHeap

GetWindowsDirectoryW

GetWindowsDirectoryW

WinExec

WinExec

GetCPInfo

GetCPInfo

KERNEL32.dll

KERNEL32.dll

GetKeyState

GetKeyState

MsgWaitForMultipleObjects

MsgWaitForMultipleObjects

SetWindowsHookExW

SetWindowsHookExW

UnhookWindowsHookEx

UnhookWindowsHookEx

USER32.dll

USER32.dll

GetViewportExtEx

GetViewportExtEx

GDI32.dll

GDI32.dll

MSIMG32.dll

MSIMG32.dll

RegOpenKeyExW

RegOpenKeyExW

RegCloseKey

RegCloseKey

ADVAPI32.dll

ADVAPI32.dll

ShellExecuteW

ShellExecuteW

ShellExecuteExW

ShellExecuteExW

SHELL32.dll

SHELL32.dll

COMCTL32.dll

COMCTL32.dll

PathIsURLW

PathIsURLW

SHLWAPI.dll

SHLWAPI.dll

ole32.dll

ole32.dll

OLEAUT32.dll

OLEAUT32.dll

GdiplusShutdown

GdiplusShutdown

gdiplus.dll

gdiplus.dll

MSVCP90.dll

MSVCP90.dll

Languages.dll

Languages.dll

WS2_32.dll

WS2_32.dll

BootTime.dll

BootTime.dll

LockDll.dll

LockDll.dll

CheckUpdate.dll

CheckUpdate.dll

RestoreCenter.dll

RestoreCenter.dll

VERSION.dll

VERSION.dll

IsShowQuicklaunchBarTips

IsShowQuicklaunchBarTips

IsShowTrayTips

IsShowTrayTips

settings.dll

settings.dll

TracksEraser.dll

TracksEraser.dll

Config.dll

Config.dll

.?AVCCmdTarget@@

.?AVCCmdTarget@@

.PAVCException@@

.PAVCException@@

.?AV?$CFixedStringT@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@$0BA@@ATL@@

.?AV?$CFixedStringT@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@$0BA@@ATL@@

.?AV?$CFixedStringT@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@$0EA@@ATL@@

.?AV?$CFixedStringT@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@$0EA@@ATL@@

.?AV?$CFixedStringT@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@$0BAA@@ATL@@

.?AV?$CFixedStringT@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@$0BAA@@ATL@@

.?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@

.?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@

.?AV?$CFixedStringT@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@$0EAA@@ATL@@

.?AV?$CFixedStringT@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@$0EAA@@ATL@@

.?AV?$CAtlHttpClientT@VZEvtSyncSocket@ATL@@@ATL@@

.?AV?$CAtlHttpClientT@VZEvtSyncSocket@ATL@@@ATL@@

.?AVCCRTHeap@ATL@@

.?AVCCRTHeap@ATL@@

" id="W5M0MpCehiHzreSzNTczkc9d"?>

" id="W5M0MpCehiHzreSzNTczkc9d"?>

`f:.AW

`f:.AW

iTXtXML:com.adobe.xmp

iTXtXML:com.adobe.xmp

" id="W5M0MpCehiHzreSzNTczkc9d"?>

" id="W5M0MpCehiHzreSzNTczkc9d"?>

Tk.vE 7

Tk.vE 7

4 4$4(4,4

4 4$4(4,4

2%6S6`6

2%6S6`6

='=3=9=_=

='=3=9=_=

9%9U9t9

9%9U9t9

55S5e5v5

55S5e5v5

8-8o8}8

8-8o8}8

1%2S2d2z2

1%2S2d2z2

4'40494\4

4'40494\4

;$

;$

7 7$7(7,70747

7 7$7(7,70747

1(1@1\1|1

1(1@1\1|1

HTRUE %s

HTRUE %s

FALSE %s

FALSE %s

@%Program Files%\Microsoft Visual Studio 9.0\VC\atlmfc\include\afxwin1.inl

@%Program Files%\Microsoft Visual Studio 9.0\VC\atlmfc\include\afxwin1.inl

%s (%s:%d)

%s (%s:%d)

@.\data\AppSetting.ini

@.\data\AppSetting.ini

data\AppSetting.ini

data\AppSetting.ini

%windir%\system32\sdclt.exe

%windir%\system32\sdclt.exe

%windir%\system32\ntbackup.exe

%windir%\system32\ntbackup.exe

%windir%\system32\rstrui.exe

%windir%\system32\rstrui.exe

%windir%\system32\restore\rstrui.exe

%windir%\system32\restore\rstrui.exe

iexplore.exe

iexplore.exe

CApplicationDispatch::ExecuteApplication

CApplicationDispatch::ExecuteApplication

%s(%d) : ErrorCode %d: ProcessName = %s

%s(%d) : ErrorCode %d: ProcessName = %s

1004001||

1004001||

1004002|||Windows Registry|.\skins\default\images\registry.png||0|1|1

1004002|||Windows Registry|.\skins\default\images\registry.png||0|1|1

1004003|11901|11001|RegistryCleaner.exe|.\skins\Icons\registrycleaner.png|.\skins\Icons\registrycleanerhover.png|1|0|1

1004003|11901|11001|RegistryCleaner.exe|.\skins\Icons\registrycleaner.png|.\skins\Icons\registrycleanerhover.png|1|0|1

1004004|32901|32001|regdefrag.exe|.\skins\Icons\regdefrag.png|.\skins\Icons\regdefraghover.png|1|1|1

1004004|32901|32001|regdefrag.exe|.\skins\Icons\regdefrag.png|.\skins\Icons\regdefraghover.png|1|1|1

1004005|||RegistryCleaner.exe /backups|||1|2|1

1004005|||RegistryCleaner.exe /backups|||1|2|1

1004006|||RegistryCleaner.exe /restore|||1|3|1

1004006|||RegistryCleaner.exe /restore|||1|3|1

1004007|||Disk Space|.\skins\default\images\diskspace.png||0|2|1

1004007|||Disk Space|.\skins\default\images\diskspace.png||0|2|1

1004008|13901|13001|DiskCleaner.exe|.\skins\Icons\diskcleaner.png|.\skins\Icons\diskcleanerhover.png|2|0|1

1004008|13901|13001|DiskCleaner.exe|.\skins\Icons\diskcleaner.png|.\skins\Icons\diskcleanerhover.png|2|0|1

1004009|15901|15001|dupefinder.exe|.\skins\Icons\dupefinder.png|.\skins\Icons\dupefinderhover.png|2|1|1

1004009|15901|15001|dupefinder.exe|.\skins\Icons\dupefinder.png|.\skins\Icons\dupefinderhover.png|2|1|1

1004010|16901|16001|EmptyFolderFinder.exe|.\skins\Icons\emptyfolderfinder.png|.\skins\Icons\emptyfolderfinderhover.png|2|2|1

1004010|16901|16001|EmptyFolderFinder.exe|.\skins\Icons\emptyfolderfinder.png|.\skins\Icons\emptyfolderfinderhover.png|2|2|1

1004011|17901|17001|ShortcutFixer.exe|.\skins\Icons\shortcutfixer.png|.\skins\Icons\shortcutfixerhover.png|2|3|1

1004011|17901|17001|ShortcutFixer.exe|.\skins\Icons\shortcutfixer.png|.\skins\Icons\shortcutfixerhover.png|2|3|1

1004012|19901|19001|DiskAnalysis.exe|.\skins\Icons\diskanalysis.png|.\skins\Icons\diskanalysishover.png|2|4|1

1004012|19901|19001|DiskAnalysis.exe|.\skins\Icons\diskanalysis.png|.\skins\Icons\diskanalysishover.png|2|4|1

1004013|||System Tweaks|.\skins\default\images\systemtweaks.png||0|3|1

1004013|||System Tweaks|.\skins\default\images\systemtweaks.png||0|3|1

1004016|21901|21001|memdefrag.exe|.\skins\Icons\memdefrag.png|.\skins\Icons\memdefraghover.png|3|0|1

1004016|21901|21001|memdefrag.exe|.\skins\Icons\memdefrag.png|.\skins\Icons\memdefraghover.png|3|0|1

1004043|23901|23001|iehelper.exe|.\skins\Icons\BrowserAssistant.png|.\skins\Icons\BrowserAssistanthover.png|3|1|1

1004043|23901|23001|iehelper.exe|.\skins\Icons\BrowserAssistant.png|.\skins\Icons\BrowserAssistanthover.png|3|1|1

1004049|||Anti-malware|.\skins\default\images\antimalware.png||0|4|1

1004049|||Anti-malware|.\skins\default\images\antimalware.png||0|4|1

1004050||2701001|SpyRemover.exe|.\skins\Icons\spyremover.png|.\skins\Icons\spyremoverhover.png|4|0|1

1004050||2701001|SpyRemover.exe|.\skins\Icons\spyremover.png|.\skins\Icons\spyremoverhover.png|4|0|1

1004019|||Privacy|.\skins\default\images\privacy.png||0|5|2

1004019|||Privacy|.\skins\default\images\privacy.png||0|5|2

1004020|18901|18001|TracksEraser.exe|.\skins\Icons\trackseraser.png|.\skins\Icons\trackseraserhover.png|5|0|2

1004020|18901|18001|TracksEraser.exe|.\skins\Icons\trackseraser.png|.\skins\Icons\trackseraserhover.png|5|0|2

1004021|22901|22001|shredder.exe|.\skins\Icons\shredder.png|.\skins\Icons\shredderhover.png|5|1|2

1004021|22901|22001|shredder.exe|.\skins\Icons\shredder.png|.\skins\Icons\shredderhover.png|5|1|2

1004022|22901|22001|shredder.exe /WipeFreeSpace|||5|2|2

1004022|22901|22001|shredder.exe /WipeFreeSpace|||5|2|2

1004023|27901|27001|fileencrypt.exe|.\skins\Icons\fileencrypt.png|.\skins\Icons\fileencrypthover.png|5|3|2

1004023|27901|27001|fileencrypt.exe|.\skins\Icons\fileencrypt.png|.\skins\Icons\fileencrypthover.png|5|3|2

1004037|||System Control|.\skins\default\images\systemcontrol.png||0|6|2

1004037|||System Control|.\skins\default\images\systemcontrol.png||0|6|2

1004038|14901|14001|StartupManager.exe|.\skins\Icons\startupmanager.png|.\skins\Icons\startupmanagerhover.png|6|0|2

1004038|14901|14001|StartupManager.exe|.\skins\Icons\startupmanager.png|.\skins\Icons\startupmanagerhover.png|6|0|2

1004039|14901|14001|StartupManager.exe /services|||6|1|2

1004039|14901|14001|StartupManager.exe /services|||6|1|2

1004040|14901|14001|StartupManager.exe /scheduledtasks|||6|2|2

1004040|14901|14001|StartupManager.exe /scheduledtasks|||6|2|2

1004041|25901|25001|cmm.exe|.\skins\Icons\cmm.png|.\skins\Icons\cmmhover.png|6|3|2

1004041|25901|25001|cmm.exe|.\skins\Icons\cmm.png|.\skins\Icons\cmmhover.png|6|3|2

1004042|24901|24001|procmgr.exe|.\skins\Icons\procmgr.png|.\skins\Icons\procmgrhover.png|6|4|2

1004042|24901|24001|procmgr.exe|.\skins\Icons\procmgr.png|.\skins\Icons\procmgrhover.png|6|4|2

1004044|||System Status|.\skins\default\images\systemstatus.png||0|7|2

1004044|||System Status|.\skins\default\images\systemstatus.png||0|7|2

1004045|33901|33001|sysinfo.exe|.\skins\Icons\sysinfo.png|.\skins\Icons\sysinfohover.png|7|0|2

1004045|33901|33001|sysinfo.exe|.\skins\Icons\sysinfo.png|.\skins\Icons\sysinfohover.png|7|0|2

1004056|||%windir%\system32\sfc.exe /SCANNOW|||7|1|2

1004056|||%windir%\system32\sfc.exe /SCANNOW|||7|1|2

1004046|||%windir%\system32\ntbackup.exe|||7|2|2

1004046|||%windir%\system32\ntbackup.exe|||7|2|2

1004047|||%windir%\system32\restore\rstrui.exe|||7|3|2

1004047|||%windir%\system32\restore\rstrui.exe|||7|3|2

1004046|||%windir%\system32\sdclt.exe|||7|2|2

1004046|||%windir%\system32\sdclt.exe|||7|2|2

1004047|||%windir%\system32\rstrui.exe|||7|3|2

1004047|||%windir%\system32\rstrui.exe|||7|3|2

1004048||10838|RestoreCenter.exe /undochanges|.\skins\Icons\restorecenter.png|.\skins\Icons\restorecenterhover.png|7|4|2

1004048||10838|RestoreCenter.exe /undochanges|.\skins\Icons\restorecenter.png|.\skins\Icons\restorecenterhover.png|7|4|2

1004033|||Hard disks|.\skins\default\images\harddisk.png||0|8|3

1004033|||Hard disks|.\skins\default\images\harddisk.png||0|8|3

1004034||3400001|DiskDefrag.exe|.\skins\Icons\diskdefrag.png|.\skins\Icons\diskdefraghover.png|8|0|3

1004034||3400001|DiskDefrag.exe|.\skins\Icons\diskdefrag.png|.\skins\Icons\diskdefraghover.png|8|0|3

1004035|||DiskDefrag.exe -BootTimeDefrag|||8|1|3

1004035|||DiskDefrag.exe -BootTimeDefrag|||8|1|3

1004036||2400001|CheckDisk.exe|.\skins\Icons\checkdisk.png|.\skins\Icons\checkdiskhover.png|8|2|3

1004036||2400001|CheckDisk.exe|.\skins\Icons\checkdisk.png|.\skins\Icons\checkdiskhover.png|8|2|3

1004024|||Drivers|.\skins\default\images\drivers.png||0|9|3

1004024|||Drivers|.\skins\default\images\drivers.png||0|9|3

1004025||2200001|DriverBackup.exe|.\skins\Icons\driverbackup.png|.\skins\Icons\driverbackuphover.png|9|0|3

1004025||2200001|DriverBackup.exe|.\skins\Icons\driverbackup.png|.\skins\Icons\driverbackuphover.png|9|0|3

1004026|||DriverBackup.exe /restore|||9|1|3

1004026|||DriverBackup.exe /restore|||9|1|3

1004027|||DriverBackup.exe /uninstall|||9|2|3

1004027|||DriverBackup.exe /uninstall|||9|2|3

1004029|||File management|.\skins\default\images\filemanagement.png||0|10|3

1004029|||File management|.\skins\default\images\filemanagement.png||0|10|3

1004030|28901|28001|filesplitter.exe|.\skins\Icons\filesplitter.png|.\skins\Icons\filesplitterhover.png|10|0|3

1004030|28901|28001|filesplitter.exe|.\skins\Icons\filesplitter.png|.\skins\Icons\filesplitterhover.png|10|0|3

1004031|31901|31001|FileUndelete.exe|.\skins\Icons\fileundelete.png|.\skins\Icons\fileundeletehover.png|10|1|3

1004031|31901|31001|FileUndelete.exe|.\skins\Icons\fileundelete.png|.\skins\Icons\fileundeletehover.png|10|1|3

1004032||3700001|QuickSearch.exe|.\skins\Icons\quicksearch.png|.\skins\Icons\quicksearchhover.png|10|2|3

1004032||3700001|QuickSearch.exe|.\skins\Icons\quicksearch.png|.\skins\Icons\quicksearchhover.png|10|2|3

1004052|||Programs|.\skins\default\images\programs.png||0|11|3

1004052|||Programs|.\skins\default\images\programs.png||0|11|3

1004053|12901|12001|Uninstaller.exe|.\skins\Icons\Uninstaller.png|.\skins\Icons\Uninstallerhover.png|11|0|3

1004053|12901|12001|Uninstaller.exe|.\skins\Icons\Uninstaller.png|.\skins\Icons\Uninstallerhover.png|11|0|3

1004054||4000001|SoftwareUpdate.exe|.\skins\Icons\SoftwareUpdate.png|.\skins\Icons\SoftwareUpdatehover.png|11|1|3

1004054||4000001|SoftwareUpdate.exe|.\skins\Icons\SoftwareUpdate.png|.\skins\Icons\SoftwareUpdatehover.png|11|1|3

1004055|||hXXp://VVV.filepuma.com/|||11|2|3

1004055|||hXXp://VVV.filepuma.com/|||11|2|3

1002008|||StartupManager.exe||

1002008|||StartupManager.exe||

.\skins\Icons\minus.png

.\skins\Icons\minus.png

.\skins\Icons\minusbg.png

.\skins\Icons\minusbg.png

1005001

1005001

@hXXp://VVV.example.org/Mutual/

@hXXp://VVV.example.org/Mutual/

https

https

X;

X;

X;

X;

hXXp://schemas.xmlsoap.org/soap/encoding/

hXXp://schemas.xmlsoap.org/soap/encoding/

hXXp://schemas.xmlsoap.org/soap/envelope/

hXXp://schemas.xmlsoap.org/soap/envelope/

hXXp://VVV.w3.org/2001/XMLSchema-instance

hXXp://VVV.w3.org/2001/XMLSchema-instance

hXXp://gu.glarysoft.com/boottime/service.php

hXXp://gu.glarysoft.com/boottime/service.php

SOAPAction: "hXXp://VVV.example.org/Mutual/NewOperation"

SOAPAction: "hXXp://VVV.example.org/Mutual/NewOperation"

HTTP/1.1

HTTP/1.1

Host: %s:%d

Host: %s:%d

Host: %s

Host: %s

Content-Length: %d

Content-Length: %d

Hdockpopdarkbg.png

Hdockpopdarkbg.png

DockButton_Tip.png

DockButton_Tip.png

dockpopturnleft.png

dockpopturnleft.png

dockpopturnleftgray.png

dockpopturnleftgray.png

dockpopturnright.png

dockpopturnright.png

dockpopcurpage.png

dockpopcurpage.png

dockpopcurpagegray.png

dockpopcurpagegray.png

H%d%%

H%d%%

Htoolbar.png

Htoolbar.png

logo.png

logo.png

body_transbg.png

body_transbg.png

foot_transbg.png

foot_transbg.png

hXXp://VVV.glarysoft.com/support/faq/

hXXp://VVV.glarysoft.com/support/faq/

hXXp://VVV.glarysoft.com

hXXp://VVV.glarysoft.com

main_close_click.png

main_close_click.png

main_close_hover.png

main_close_hover.png

main_close.png

main_close.png

main_right_top_mark_click_bg.png

main_right_top_mark_click_bg.png

main_right_top_mark_hover_bg.png

main_right_top_mark_hover_bg.png

main_right_top_mark_sep.png

main_right_top_mark_sep.png

main_min.png

main_min.png

main_feedback.png

main_feedback.png

main_restore.png

main_restore.png

main_skin.png

main_skin.png

main_like.png

main_like.png

tab_btn_click.png

tab_btn_click.png

tab_btn_hover.png

tab_btn_hover.png

tab_btn_normal.png

tab_btn_normal.png

tab_ov.png

tab_ov.png

tab_oc.png

tab_oc.png

tab_ad.png

tab_ad.png

menu_normal.png

menu_normal.png

menu_click.png

menu_click.png

menu_hover.png

menu_hover.png

pop_btn_normal.png

pop_btn_normal.png

pop_btn_click.png

pop_btn_click.png

pop_btn_hover.png

pop_btn_hover.png

usertype_btn.png

usertype_btn.png

1005002

1005002

1005004

1005004

bg2.jpg

bg2.jpg

tab_ad_blue.png

tab_ad_blue.png

tab_ov_blue.png

tab_ov_blue.png

tab_oc_blue.png

tab_oc_blue.png

%s &F1

%s &F1

%supgrade.exe

%supgrade.exe

1004001

1004001

1002001

1002001

1001005

1001005

1001001

1001001

1001002

1001002

1001003

1001003

1001004

1001004

%s %s

%s %s

news.ini

news.ini

hXXp://VVV.glarysoft.com/goto.php?a=buy&s=freelink

hXXp://VVV.glarysoft.com/goto.php?a=buy&s=freelink

hXXp://VVV.glarysoft.com/support/feedback/?subject=Glary Utilities %s

hXXp://VVV.glarysoft.com/support/feedback/?subject=Glary Utilities %s

hXXp://VVV.facebook.com/Glarysoft

hXXp://VVV.facebook.com/Glarysoft

%sSoftwareUpdate.exe

%sSoftwareUpdate.exe

SoftUpdateURL

SoftUpdateURL

4000001

4000001

4001030

4001030

4001023

4001023

4001025

4001025

4001029

4001029

4001019

4001019

%s(%d) : ErrorCode %d: LoadLibrary Faild! ModulePath = %s

%s(%d) : ErrorCode %d: LoadLibrary Faild! ModulePath = %s

%s(%d) : ErrorCode %d: GetProcAddress Faild! FunctionName = %s:PScanFun

%s(%d) : ErrorCode %d: GetProcAddress Faild! FunctionName = %s:PScanFun

%s(%d) : ErrorCode %d: GetProcAddress Faild! FunctionName = %s:PClearFun

%s(%d) : ErrorCode %d: GetProcAddress Faild! FunctionName = %s:PClearFun

%s(%d) : ErrorCode %d: GetProcAddress Faild! FunctionName = %s:PStopScan

%s(%d) : ErrorCode %d: GetProcAddress Faild! FunctionName = %s:PStopScan

%s(%d) : ErrorCode %d: GetProcAddress Faild! FunctionName = %s:PStopClear

%s(%d) : ErrorCode %d: GetProcAddress Faild! FunctionName = %s:PStopClear

%s(%d) : ErrorCode %d: GetProcAddress Faild! FunctionName = %s:PGetResultCount

%s(%d) : ErrorCode %d: GetProcAddress Faild! FunctionName = %s:PGetResultCount

%s(%d) : ErrorCode %d: GetProcAddress Faild! FunctionName = %s:PShowResultDialog

%s(%d) : ErrorCode %d: GetProcAddress Faild! FunctionName = %s:PShowResultDialog

29601|RegistryCleaner.dll|1|0

29601|RegistryCleaner.dll|1|0

29602|FileScanFilter.dll|1|1

29602|FileScanFilter.dll|1|1

29606|SpyRemover.dll|1|2

29606|SpyRemover.dll|1|2

1003001|CheckDisk.dll|0|3

1003001|CheckDisk.dll|0|3

29605|TracksEraser.dll|0|4

29605|TracksEraser.dll|0|4

29604|DiskCleaner.dll|1|5

29604|DiskCleaner.dll|1|5

29603|StartupManager.dll|1|6

29603|StartupManager.dll|1|6

%s(%d) : ErrorCode %d: TagId:%s ReturnCode:%d

%s(%d) : ErrorCode %d: TagId:%s ReturnCode:%d

Hprogress.png

Hprogress.png

progress_bg.png

progress_bg.png

checkbox_checked.png

checkbox_checked.png

checkbox_uncheck.png

checkbox_uncheck.png

oc_detailbg.png

oc_detailbg.png

oc_needclearbg.png

oc_needclearbg.png

oc_btn_normal.png

oc_btn_normal.png

oc_btn_click.png

oc_btn_click.png

oc_btn_hover.png

oc_btn_hover.png

oc_btn_scan.png

oc_btn_scan.png

oc_cancel_normal.png

oc_cancel_normal.png

oc_cancel_click.png

oc_cancel_click.png

oc_cancel_hover.png

oc_cancel_hover.png

clear_tips.png

clear_tips.png

%d.%d.%d.%d

%d.%d.%d.%d

2901008

2901008

Hbtn_normal.png

Hbtn_normal.png

btn_click.png

btn_click.png

btn_hover.png

btn_hover.png

ov_boottimebg.png

ov_boottimebg.png

1002015

1002015

1002006

1002006

1002008

1002008

1002010

1002010

1002012

1002012

1002013

1002013

1002014

1002014

1002017

1002017

%sdata\BootTime.ini

%sdata\BootTime.ini

2901005

2901005

2901002

2901002

2901003

2901003

2901004

2901004

2901006

2901006

2901001

2901001

%sStartupManager.exe

%sStartupManager.exe

\backimages\bg2.jpg

\backimages\bg2.jpg

7513803

7513803

\skin.ini

\skin.ini

skins\default\skin.ini

skins\default\skin.ini

%sskins\default\images\

%sskins\default\images\

%sskins\default\backimages\

%sskins\default\backimages\

Hskintransparentmark.png

Hskintransparentmark.png

*.png|*.jpg|*.gif|*.jpeg

*.png|*.jpg|*.gif|*.jpeg

skin_custom.png

skin_custom.png

skinsbg.png

skinsbg.png

skin_pic_normal.png

skin_pic_normal.png

skin_col_normal.png

skin_col_normal.png

%s\Sample Pictures

%s\Sample Pictures

1006005

1006005

%s(*.jpg *.png *.gif *.jpeg)|*.jpg;*.png;*.gif;*.jpeg||

%s(*.jpg *.png *.gif *.jpeg)|*.jpg;*.png;*.gif;*.jpeg||

1006006

1006006

SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\

SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\

H\winhlp32.exe

H\winhlp32.exe

burlywood

burlywood

.cpp-comment {color:green; font-style:italic}

.cpp-comment {color:green; font-style:italic}

-.,!:;)}]?

-.,!:;)}]?

H0xX

H0xX

(%d, %d)-(%d, %d)

(%d, %d)-(%d, %d)

%s%s

%s%s

Hbg7.jpg

Hbg7.jpg

Windows Classic.theme

Windows Classic.theme

Erase privacy tracks on windows shutdown

Erase privacy tracks on windows shutdown

Disable unnecessary startup programs to make Windows boot faster

Disable unnecessary startup programs to make Windows boot faster

4.4.0.86

4.4.0.86

Integrator.exe

Integrator.exe

4.0.0.0

4.0.0.0