Windows Analysis Report
acdseefree.exe

Overview

General Information

Sample name: acdseefree.exe
Analysis ID: 1428810
MD5: a65f33137f6f9188b0a6598644ea79de
SHA1: 106db77e30d094678b290d364d45ad49bdbe10df
SHA256: 26fed7c6c3d449c063c23dd3e45ee1a324e545ebbcfcc13913ca7f6242ce62a1
Infos:

Detection

Score: 24
Range: 0 - 100
Whitelisted: false
Confidence: 0%

Compliance

Score: 49
Range: 0 - 100

Signatures

Drops PE files with a suspicious file extension
Tries to delay execution (extensive OutputDebugStringW loop)
Allocates memory with a write watch (potentially for evading sandboxes)
Checks for available system drives (often done to infect USB drives)
Checks if the current process is being debugged
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Deletes files inside the Windows folder
Downloads executable code via HTTP
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Drops files with a non-matching file extension (content does not match file extension)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
May sleep (evasive loops) to hinder dynamic analysis
Modifies existing windows services
One or more processes crash
Queries the volume information (name, serial number etc) of a device
Sigma detected: SCR File Write Event
Sigma detected: Suspicious Screensaver Binary File Creation
Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification
Stores files to the Windows start menu directory
Stores large binary data to the registry
Uses 32bit PE files
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION ACDSeeGFMF.exe

Compliance
barindex
Uses 32bit PE files
Source: acdseefree.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\LicenseAgreement.rtf
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\LicenseAgreement.rtf
Source: acdseefree.exe Static PE information: certificate valid
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe File opened: C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.9625_none_508ef7e4bcbbe589\MSVCR90.dll
Source: unknown HTTPS traffic detected: 40.126.28.19:443 -> 192.168.2.17:49721 version: TLS 1.2
Source: unknown HTTPS traffic detected: 8.45.52.248:443 -> 192.168.2.17:49723 version: TLS 1.2
Source: unknown HTTPS traffic detected: 47.105.134.52:443 -> 192.168.2.17:49726 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.126.28.19:443 -> 192.168.2.17:49783 version: TLS 1.2
Source: acdseefree.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Checks for available system drives (often done to infect USB drives)
Source: C:\Windows\System32\msiexec.exe File opened: z:
Source: C:\Windows\System32\msiexec.exe File opened: x:
Source: C:\Windows\System32\msiexec.exe File opened: v:
Source: C:\Windows\System32\msiexec.exe File opened: t:
Source: C:\Windows\System32\msiexec.exe File opened: r:
Source: C:\Windows\System32\msiexec.exe File opened: p:
Source: C:\Windows\System32\msiexec.exe File opened: n:
Source: C:\Windows\System32\msiexec.exe File opened: l:
Source: C:\Windows\System32\msiexec.exe File opened: j:
Source: C:\Windows\System32\msiexec.exe File opened: h:
Source: C:\Windows\System32\msiexec.exe File opened: f:
Source: C:\Windows\System32\msiexec.exe File opened: b:
Source: C:\Windows\System32\msiexec.exe File opened: y:
Source: C:\Windows\System32\msiexec.exe File opened: w:
Source: C:\Windows\System32\msiexec.exe File opened: u:
Source: C:\Windows\System32\msiexec.exe File opened: s:
Source: C:\Windows\System32\msiexec.exe File opened: q:
Source: C:\Windows\System32\msiexec.exe File opened: o:
Source: C:\Windows\System32\msiexec.exe File opened: m:
Source: C:\Windows\System32\msiexec.exe File opened: k:
Source: C:\Windows\System32\msiexec.exe File opened: i:
Source: C:\Windows\System32\msiexec.exe File opened: g:
Source: C:\Windows\System32\msiexec.exe File opened: e:
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File opened: c:
Source: C:\Windows\System32\msiexec.exe File opened: a:
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File opened: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\AlbumGenerator\Styles\Style1\pages
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File opened: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\AlbumGenerator\Styles
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File opened: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\AlbumGenerator
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File opened: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\AlbumGenerator\Styles\Style1
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File opened: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\AlbumGenerator\Styles\Style1\css
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File opened: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\AlbumGenerator\Styles\Style1\pages\image
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: TengineContent-Type: application/octet-streamContent-Length: 42793272Connection: keep-aliveDate: Fri, 19 Apr 2024 14:43:40 GMTx-oss-request-id: 6622831C8F796832325FA5C9x-oss-cdn-auth: successAccept-Ranges: bytesx-oss-object-type: Normalx-oss-storage-class: StandardContent-MD5: JY7xR1D627GdooaJpOcm9A==x-oss-server-time: 30Ali-Swift-Global-Savetime: 1713537820Via: cache11.l2us1[932,941,304-0,M], cache11.l2us1[944,0], ens-cache14.us18[1140,1155,200-0,H], ens-cache16.us18[1159,0]ETag: "258EF14750FADBB19DA28689A4E726F4"Last-Modified: Wed, 22 Nov 2023 22:36:22 GMTx-oss-hash-crc64ecma: 1934414797581461564Age: 0X-Cache: HIT TCP_REFRESH_HIT dirn:0:1317184864X-Swift-SaveTime: Fri, 19 Apr 2024 14:43:40 GMTX-Swift-CacheTime: 3600Timing-Allow-Origin: *EagleId: 2ff618a417135378192792483eData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 31 48 b3 82 75 29 dd d1 75 29 dd d1 75 29 dd d1 b6 26 82 d1 77 29 dd d1 75 29 dc d1 ee 29 dd d1 b6 26 80 d1 64 29 dd d1 9d 36 d7 d1 7f 29 dd d1 b2 2f db d1 74 29 dd d1 52 69 63 68 75 29 dd d1 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 a7 b2 3a 4a 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 5c 00 00 00 d4 01 00 00 04 00 00 91 32 00 00 00 10 00 00 00 70 00 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 80 0b 00 00 04 00 00 c2 87 8d 02 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 a4 73 00 00 b4 00 00 00 00 10 04 00 a8 6d 07 00 00 00 00 00 00 00 00 00 f0 d0 8c 02 48 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 00 00 8c 02 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1Hu)u)u)&w)u))&d)6)/t)Richu)PEL:J\2p@smH(p
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.28.19
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.28.19
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.28.19
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.28.19
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.28.19
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.28.19
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.28.19
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.28.19
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.28.19
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.28.19
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.28.19
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.28.19
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.28.19
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.28.19
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.28.19
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.28.19
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.28.19
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.28.19
Source: global traffic HTTP traffic detected: GET /acdsee/za/acdsee-official-free.exe HTTP/1.1Accept: application/xml, */*Referer: http://www.acdsee.cnUser-Agent: ACDSee_WebInstallerHost: dl2.acdsee.cnCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /acdsee/za/acdsee-official-free.exe HTTP/1.1Accept: */*Range: bytes=0-42793271Referer: http://www.acdsee.cnUser-Agent: ACDSee_WebInstallerHost: dl2.acdsee.cnConnection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /banner_config.html HTTP/1.1Accept: */*User-Agent: ACDSee CNHost: www.acdsee.cnCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /za/onlinepages/signin.html HTTP/1.1Accept: */*Accept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: content.acdsee.cnConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /za/onlinepages/common/ga.js HTTP/1.1Accept: */*Referer: http://content.acdsee.cn/za/onlinepages/signin.htmlAccept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: content.acdsee.cnConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /za/onlinepages/common/bootstrap.min.css HTTP/1.1Accept: */*Referer: http://content.acdsee.cn/za/onlinepages/signin.htmlAccept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: content.acdsee.cnConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /za/onlinepages/common/jquery.min.js HTTP/1.1Accept: */*Referer: http://content.acdsee.cn/za/onlinepages/signin.htmlAccept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: content.acdsee.cnConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /za/onlinepages/common/bootstrap.min.js HTTP/1.1Accept: */*Referer: http://content.acdsee.cn/za/onlinepages/signin.htmlAccept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: content.acdsee.cnConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /za/onlinepages/common/common.css HTTP/1.1Accept: */*Referer: http://content.acdsee.cn/za/onlinepages/signin.htmlAccept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: content.acdsee.cnConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /za/onlinepages/resource/images/acdID-Experience-logo.png HTTP/1.1Accept: */*Referer: http://content.acdsee.cn/za/onlinepages/signin.htmlAccept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: content.acdsee.cnConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /za/onlinepages/resource/images/loading.gif HTTP/1.1Accept: */*Referer: http://content.acdsee.cn/za/onlinepages/signin.htmlAccept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: content.acdsee.cnConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /cgi-bin/readtemplate?t=market_redirect HTTP/1.1Host: wechat.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /za/onlinepages/resource/fonts/Raleway/Raleway-Medium.ttf HTTP/1.1Accept: */*Referer: http://content.acdsee.cn/za/onlinepages/signin.htmlAccept-Language: en-CHOrigin: http://content.acdsee.cnAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: content.acdsee.cnConnection: Keep-AliveCookie: _ga=GA1.2.351079198.1713537916; _gid=GA1.2.433388442.1713537916
Source: global traffic HTTP traffic detected: GET /za/onlinepages/resource/images/shield-icon.png HTTP/1.1Accept: */*Referer: http://content.acdsee.cn/za/onlinepages/signin.htmlAccept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: content.acdsee.cnConnection: Keep-AliveCookie: _ga=GA1.1.351079198.1713537916; _gid=GA1.2.433388442.1713537916; _gat=1; _ga_Q3Z42RLF61=GS1.1.1713537916.1.0.1713537916.0.0.0
Source: unknown DNS traffic detected: queries for: dl2.acdsee.cn
Source: unknown Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown HTTPS traffic detected: 40.126.28.19:443 -> 192.168.2.17:49721 version: TLS 1.2
Source: unknown HTTPS traffic detected: 8.45.52.248:443 -> 192.168.2.17:49723 version: TLS 1.2
Source: unknown HTTPS traffic detected: 47.105.134.52:443 -> 192.168.2.17:49726 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.126.28.19:443 -> 192.168.2.17:49783 version: TLS 1.2
Creates files inside the system directory
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\4cf839.msi
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\inprogressinstallinfo.ipi
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\SourceHash{42365A3A-622A-4EED-A727-FE192A794AFD}
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIFA1D.tmp
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\SysWOW64\vcamp140.dll
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\SysWOW64\vcomp140.dll
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\$PatchCache$\Managed\A3A56324A226DEE47A72EF91A297A4DF
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\$PatchCache$\Managed\A3A56324A226DEE47A72EF91A297A4DF\14.28.29914
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\$PatchCache$\Managed\A3A56324A226DEE47A72EF91A297A4DF\14.28.29914\concrt140.dll
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\$PatchCache$\Managed\A3A56324A226DEE47A72EF91A297A4DF\14.28.29914\msvcp140.dll
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\$PatchCache$\Managed\A3A56324A226DEE47A72EF91A297A4DF\14.28.29914\msvcp140_1.dll
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\$PatchCache$\Managed\A3A56324A226DEE47A72EF91A297A4DF\14.28.29914\msvcp140_2.dll
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\$PatchCache$\Managed\A3A56324A226DEE47A72EF91A297A4DF\14.28.29914\msvcp140_atomic_wait.dll
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\$PatchCache$\Managed\A3A56324A226DEE47A72EF91A297A4DF\14.28.29914\msvcp140_codecvt_ids.dll
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\$PatchCache$\Managed\A3A56324A226DEE47A72EF91A297A4DF\14.28.29914\vccorlib140.dll
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\$PatchCache$\Managed\A3A56324A226DEE47A72EF91A297A4DF\14.28.29914\vcruntime140.dll
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\4cf83d.msi
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\4cf83d.msi
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\4cf83e.msi
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\inprogressinstallinfo.ipi
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\SourceHash{BD8C6100-7C7D-48DD-93BA-69F6828213FE}
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIFE93.tmp
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\SysWOW64\mfc140.dll
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\SysWOW64\mfc140chs.dll
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\SysWOW64\mfc140cht.dll
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\SysWOW64\mfc140deu.dll
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\SysWOW64\mfc140enu.dll
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\SysWOW64\mfc140esn.dll
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\SysWOW64\mfc140fra.dll
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\SysWOW64\mfc140ita.dll
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\SysWOW64\mfc140jpn.dll
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\SysWOW64\mfc140kor.dll
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\SysWOW64\mfc140rus.dll
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\SysWOW64\mfc140u.dll
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\SysWOW64\mfcm140.dll
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\SysWOW64\mfcm140u.dll
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\4cf845.msi
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\4cf845.msi
Deletes files inside the Windows folder
Source: C:\Windows\System32\msiexec.exe File deleted: C:\Windows\Installer\4cf83d.msi
One or more processes crash
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6408 -s 1364
Uses 32bit PE files
Source: acdseefree.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: classification engine Classification label: sus24.evad.winEXE@38/668@30/36
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Program Files (x86)\ACD Systems
Source: C:\Users\user\AppData\Local\Temp\ACDWIClient.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GO30WR0E\acdsee-official-free[1].exe
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Mutant created: \Sessions\1\BaseNamedObjects\acdIDPersistentDataAccess
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4580:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Mutant created: \Sessions\1\BaseNamedObjects\ACDSeeGFMF_Setup
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6788:120:WilError_03
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Mutant created: \Sessions\1\BaseNamedObjects\ACDSeeGFMF-Instance
Source: C:\Users\user\Desktop\acdseefree.exe File created: C:\Users\user\AppData\Local\Temp\nsx18E5.tmp
Source: acdseefree.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\Desktop\acdseefree.exe File read: C:\Users\desktop.ini
Source: C:\Users\user\Desktop\acdseefree.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
Source: C:\Users\user\Desktop\acdseefree.exe File read: C:\Users\user\Desktop\acdseefree.exe
Source: unknown Process created: C:\Users\user\Desktop\acdseefree.exe "C:\Users\user\Desktop\acdseefree.exe"
Source: C:\Users\user\Desktop\acdseefree.exe Process created: C:\Users\user\AppData\Local\Temp\ACDWIClient.exe C:\Users\user\AppData\Local\Temp\ACDWIClient.exe
Source: C:\Users\user\Desktop\acdseefree.exe Process created: C:\Users\user\AppData\Local\Temp\ACDWIClient.exe C:\Users\user\AppData\Local\Temp\ACDWIClient.exe
Source: C:\Users\user\AppData\Local\Temp\ACDWIClient.exe Process created: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe "C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe"
Source: C:\Users\user\AppData\Local\Temp\ACDWIClient.exe Process created: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe "C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe"
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Process created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Inst\acdIDInstaller.exe "C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Inst\acdIDInstaller.exe" /i /app "ACDSee GFMF" /reg "Software\ACD Systems\ACDSee\GFMF" /pid ACSWF1ZA /lng ZA /bld 2771 /it2 "C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\acdIDInTouch2.exe" /alturl "acdidserver.acdsee.cn" /altcontenturl "content.acdsee.cn" /fr /mupd
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Inst\acdIDInstaller.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Process created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Inst\VC_redist.x86.exe "C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Inst\VC_redist.x86.exe" /q /norestart
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Inst\VC_redist.x86.exe Process created: C:\Windows\Temp\{6E93B698-1971-4E54-B8B3-1C54D946187D}\.cr\VC_redist.x86.exe "C:\Windows\Temp\{6E93B698-1971-4E54-B8B3-1C54D946187D}\.cr\VC_redist.x86.exe" -burn.clean.room="C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Inst\VC_redist.x86.exe" -burn.filehandle.attached=524 -burn.filehandle.self=532 /q /norestart
Source: C:\Windows\Temp\{6E93B698-1971-4E54-B8B3-1C54D946187D}\.cr\VC_redist.x86.exe Process created: C:\Windows\Temp\{85D91174-5AA2-4BD7-8CA8-1AF9FF68ED60}\.be\VC_redist.x86.exe "C:\Windows\Temp\{85D91174-5AA2-4BD7-8CA8-1AF9FF68ED60}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{2931EEB8-06D9-46C5-AA8E-63F09AAE39BC} {1A829FB4-BFBC-460A-A4EF-9CA8D2939709} 6868
Source: unknown Process created: C:\Windows\System32\SrTasks.exe C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:1
Source: C:\Windows\System32\SrTasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Process created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe "C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe"
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Process created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\CheckWinVer.exe "C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\CheckWinVer.exe"
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\CheckWinVer.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Process created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Inst\acdIDInstaller.exe "C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Inst\acdIDInstaller.exe" /i /app "ACDSee GFMF" /reg "Software\ACD Systems\ACDSee\GFMF" /pid ACSWF1ZA /lng ZA /bld 2771 /it2 "C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\acdIDInTouch2.exe" /alturl "acdidserver.acdsee.cn" /altcontenturl "content.acdsee.cn" /fr /mupd
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Process created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Inst\VC_redist.x86.exe "C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Inst\VC_redist.x86.exe" /q /norestart
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6408 -s 1364
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6408 -s 1364
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://weixin.qq.com/r/ikMpMWnEcDQPrS1S9xaY
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 --field-trial-handle=1960,i,17581221519274404497,16376727416887097049,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Process created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe "C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe"
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Process created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\CheckWinVer.exe "C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\CheckWinVer.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 --field-trial-handle=1960,i,17581221519274404497,16376727416887097049,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Users\user\Desktop\acdseefree.exe Section loaded: uxtheme.dll
Source: C:\Users\user\Desktop\acdseefree.exe Section loaded: userenv.dll
Source: C:\Users\user\Desktop\acdseefree.exe Section loaded: apphelp.dll
Source: C:\Users\user\Desktop\acdseefree.exe Section loaded: propsys.dll
Source: C:\Users\user\Desktop\acdseefree.exe Section loaded: dwmapi.dll
Source: C:\Users\user\Desktop\acdseefree.exe Section loaded: cryptbase.dll
Source: C:\Users\user\Desktop\acdseefree.exe Section loaded: oleacc.dll
Source: C:\Users\user\Desktop\acdseefree.exe Section loaded: version.dll
Source: C:\Users\user\Desktop\acdseefree.exe Section loaded: shfolder.dll
Source: C:\Users\user\Desktop\acdseefree.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\acdseefree.exe Section loaded: windows.storage.dll
Source: C:\Users\user\Desktop\acdseefree.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\ACDWIClient.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\ACDWIClient.exe Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Temp\ACDWIClient.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\ACDWIClient.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\ACDWIClient.exe Section loaded: oleacc.dll
Source: C:\Users\user\AppData\Local\Temp\ACDWIClient.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\ACDWIClient.exe Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\Temp\ACDWIClient.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\ACDWIClient.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\ACDWIClient.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\ACDWIClient.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\ACDWIClient.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\ACDWIClient.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\ACDWIClient.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\ACDWIClient.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\ACDWIClient.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\ACDWIClient.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\ACDWIClient.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\ACDWIClient.exe Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\ACDWIClient.exe Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\ACDWIClient.exe Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\ACDWIClient.exe Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\ACDWIClient.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\ACDWIClient.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\ACDWIClient.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\ACDWIClient.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\ACDWIClient.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\ACDWIClient.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\ACDWIClient.exe Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\ACDWIClient.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\ACDWIClient.exe Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\ACDWIClient.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: riched20.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: usp10.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: msls31.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: linkinfo.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: ntshrui.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: cscapi.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: shellintmgr51u.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: sti.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: msvcp140.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: cabinet.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: mscms.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: vcomp140.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: mfc140.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: coloradapterclient.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: mscms.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: vcomp140.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: mfc140.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: coloradapterclient.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: mfc140u.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: vcomp140.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: mscms.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: coloradapterclient.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: mfc140u.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: vcomp140.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: mscms.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: coloradapterclient.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: ipworksssl8.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: mfc140u.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: vcomp140.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: mscms.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: coloradapterclient.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: logoncli.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: qwave.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: traffic.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: wmiclnt.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: ipworksssl8.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: mfc140u.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: vcomp140.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: mscms.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: coloradapterclient.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: qwave.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: traffic.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: wmiclnt.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: mfc140u.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: vcomp140.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: mscms.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: coloradapterclient.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: mfc140u.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: vcomp140.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: mscms.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: coloradapterclient.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: mfc140u.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: vcomp140.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: mscms.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: coloradapterclient.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: mfc140u.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: vcomp140.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: mscms.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: coloradapterclient.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: oleacc.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: vcomp140.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: oleacc.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: vcomp140.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: vcomp140.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: mscms.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: mfc140u.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: coloradapterclient.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: vcomp140.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: mscms.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: mfc140u.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: coloradapterclient.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: mf.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: mfreadwrite.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: mfplat.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: vcomp140.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: oleacc.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: mfcore.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: powrprof.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: ksuser.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: mfperfhelper.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: rtworkq.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: umpdc.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: mfreadwrite.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: vcomp140.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: oleacc.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: oleacc.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: oledlg.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: vcomp140.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: mscms.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: coloradapterclient.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: oleacc.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: oledlg.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: vcomp140.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: mscms.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: coloradapterclient.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: d3d11.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: d2d1.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: dxgi.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: oleacc.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: vcomp140.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: dxcore.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: d3d11.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: d2d1.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: dxgi.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: oleacc.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: vcomp140.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Inst\acdIDInstaller.exe Section loaded: apphelp.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Inst\acdIDInstaller.exe Section loaded: msimg32.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Inst\acdIDInstaller.exe Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Inst\acdIDInstaller.exe Section loaded: oleacc.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Inst\acdIDInstaller.exe Section loaded: winmm.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Inst\acdIDInstaller.exe Section loaded: sspicli.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Inst\acdIDInstaller.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: windows.shell.servicehostbuilder.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: ieframe.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\SrTasks.exe Section loaded: spp.dll
Source: C:\Windows\System32\SrTasks.exe Section loaded: srclient.dll
Source: C:\Windows\System32\SrTasks.exe Section loaded: srcore.dll
Source: C:\Windows\System32\SrTasks.exe Section loaded: vssapi.dll
Source: C:\Windows\System32\SrTasks.exe Section loaded: ktmw32.dll
Source: C:\Windows\System32\SrTasks.exe Section loaded: vssapi.dll
Source: C:\Windows\System32\SrTasks.exe Section loaded: vssapi.dll
Source: C:\Windows\System32\SrTasks.exe Section loaded: wer.dll
Source: C:\Windows\System32\SrTasks.exe Section loaded: bcd.dll
Source: C:\Windows\System32\SrTasks.exe Section loaded: vsstrace.dll
Source: C:\Windows\System32\SrTasks.exe Section loaded: powrprof.dll
Source: C:\Windows\System32\SrTasks.exe Section loaded: umpdc.dll
Source: C:\Windows\System32\SrTasks.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\SrTasks.exe Section loaded: ntmarta.dll
Source: C:\Windows\System32\SrTasks.exe Section loaded: dsrole.dll
Source: C:\Windows\System32\SrTasks.exe Section loaded: msxml3.dll
Source: C:\Windows\System32\SrTasks.exe Section loaded: vss_ps.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: apphelp.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: aclayers.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc_os.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: msi.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: tsappcmp.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: userenv.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: profapi.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: netapi32.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: wkscli.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: netutils.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: wldp.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: msasn1.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: rsaenh.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: cryptbase.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: msisip.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: gpapi.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: mscoree.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: version.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: rstrtmgr.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: ncrypt.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: ntasn1.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: windows.storage.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: pcacli.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: mpr.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: cabinet.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: cabinet.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: mscoree.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: cabinet.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: apphelp.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: ddraw.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: acdclclient33u.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: shfolder.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: mscms.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: shellintmgr51u.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: wininet.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: xerces-c_2_7.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: xalan-c_1_10.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: ipworksssl8.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: d3d9.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: d3dx9_27.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: mfc140u.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: urlmon.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: msvcp140.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: vcomp140.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: version.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: oleacc.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: vcruntime140.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: mpr.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: userenv.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: coloradapterclient.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: msi.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: sti.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: msvcp140.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: version.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: vcruntime140.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: vcruntime140.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: dxgi.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: dciman32.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: xalanmessages_1_10.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: msvcp140.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: vcruntime140.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: wsock32.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: msvcp140.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: version.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: vcruntime140.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: iertutil.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: srvcli.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: netutils.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: vcruntime140.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: dwmapi.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: vcruntime140.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: wldp.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: netapi32.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: logoncli.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: qwave.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: traffic.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: wmiclnt.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: secur32.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: sspicli.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: msimg32.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: propsys.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: profapi.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: textshaping.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: winhttp.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: mswsock.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: winnsi.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: textinputframework.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: coreuicomponents.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: coremessaging.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: wintypes.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: wintypes.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: wintypes.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: riched20.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: usp10.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: msls31.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: win7api.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: samcli.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: samlib.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: windowscodecs.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: rasadhlp.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: cabinet.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: mfc140.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: mfc140.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: winmm.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: winmm.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: d3d11.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: d2d1.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: winmm.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: dxcore.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: winmm.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: winmm.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: winmm.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: winmm.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: winmm.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: winmm.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: d3d11.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: d2d1.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: winmm.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: mf.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: mfreadwrite.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: mfplat.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: winmm.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: mfcore.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: powrprof.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: ksuser.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: mfperfhelper.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: rtworkq.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: umpdc.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: mfreadwrite.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: winmm.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: mfreadwrite.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: winmm.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: mfreadwrite.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: winmm.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: oledlg.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: winmm.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: oledlg.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: winmm.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: oledlg.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: winmm.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: oledlg.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: winmm.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: oledlg.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: schannel.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: d3d11.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: d2d1.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: winmm.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: d3d11.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: d2d1.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: winmm.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: d3d11.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: d2d1.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: winmm.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: mskeyprotect.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: ntasn1.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: d3d11.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: d2d1.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: winmm.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: msasn1.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: dpapi.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: gpapi.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: d3d11.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: d2d1.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: winmm.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: ncrypt.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: ncryptsslp.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: netprofm.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: npmproxy.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: ieframe.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: wkscli.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: dataexchange.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: dcomp.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: twinapi.appcore.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: drprov.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: winsta.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: ntlanman.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: davclnt.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: davhlpr.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: cscapi.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: d3d10warp.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: dwrite.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: msiso.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: mshtml.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: srpapi.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: mlang.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: jscript9.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: thumbcache.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: msimtf.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: resourcepolicyclient.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: policymanager.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: msvcp110_win.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: napinsp.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: pnrpnsp.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: wshbth.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: nlaapi.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: winrnr.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: windowscodecsext.dll
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: msxml6.dll
Source: C:\Users\user\Desktop\acdseefree.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File written: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeSR Themes\Black\black.ini
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Window found: window name: SysTabControl32
Source: Window Recorder Window detected: More than 3 window changes detected
Source: acdseefree.exe Static PE information: certificate valid
Source: acdseefree.exe Static file information: File size 1484000 > 1048576
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe File opened: C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.9625_none_508ef7e4bcbbe589\MSVCR90.dll
Source: acdseefree.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Persistence and Installation Behavior
barindex
Drops PE files with a suspicious file extension
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\DSScreenSaver\ACDSeeScreensaver.scr Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\D3DScreenSaver\ACDSee.scr Jump to dropped file
Drops PE files
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Plugins\AX_RAR.apl Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\SysWOW64\mfc140esn.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\SysWOW64\mfc140ita.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDCLClient33U.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Plugins\CX_Ftpuploader.apl Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\SysWOW64\mfc140deu.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Users\user\AppData\Local\Temp\nse69C6.tmp\nsDialogs.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\2052\ACDSeeGFMF.exe.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\SysWOW64\vcamp140.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Plugins\AM_Encryption.apl Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\SysWOW64\mfc140jpn.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\SysWOW64\mfc140chs.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Users\user\AppData\Local\Temp\nse69C6.tmp\AdvSplash.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\SysWOW64\mfcm140u.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\$PatchCache$\Managed\A3A56324A226DEE47A72EF91A297A4DF\14.28.29914\msvcp140.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\$PatchCache$\Managed\A3A56324A226DEE47A72EF91A297A4DF\14.28.29914\vcruntime140.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Users\user\AppData\Local\Temp\nse69C6.tmp\System.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\SysWOW64\mfc140.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\OldBaseSlideShow.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\acdIDWriter.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\D3DScreenSaver\ACDSee.scr Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\2052\acdIDInTouch2.exe.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDWIClient.exe File created: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Jump to dropped file
Source: C:\Users\user\Desktop\acdseefree.exe File created: C:\Users\user\AppData\Local\Temp\ACDWIClient.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\d3dx9_27.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Xalan-C_1_10.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Inst\acdIDInstaller.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\AcdIDClient.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeSRGFMF.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\$PatchCache$\Managed\A3A56324A226DEE47A72EF91A297A4DF\14.28.29914\msvcp140_codecvt_ids.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\SysWOW64\mfc140fra.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ipworksssl8.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Plugins\IDE_PSD.apl Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Plugins\IE_DNG.apl Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\xerces-c_2_7.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Program Files (x86)\Common Files\ACD Systems\AdminTasks.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Users\user\AppData\Local\Temp\nse69C6.tmp\nsExec.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\SysWOW64\vcomp140.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Inst\VC_redist.x86.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\SysWOW64\mfc140rus.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Plugins\ID_Media2.apl Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\SysWOW64\mfc140cht.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Plugins\CX_Email.apl Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\2052\ACDSeeSRGFMF.exe.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\XalanMessages_1_10.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\SysWOW64\mfcm140.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Win7API.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ShellIntMgr51U.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\2052\ACDSeeQVGFMF.exe.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\D3DBaseSlideShow.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Program Files (x86)\Common Files\ACD Systems\ScreenCaptureU.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Plugins\ID_DCRaw.apl Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\$PatchCache$\Managed\A3A56324A226DEE47A72EF91A297A4DF\14.28.29914\msvcp140_1.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Plugins\ID_PSP.apl Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Plugins\CX_DFinder.apl Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Plugins\ID_Canvas.apl Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\CheckWinVer.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\$PatchCache$\Managed\A3A56324A226DEE47A72EF91A297A4DF\14.28.29914\msvcp140_2.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\SysWOW64\mfc140u.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\acdIDInTouch2.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Users\user\AppData\Local\Temp\nse69C6.tmp\Version.dll Jump to dropped file
Source: C:\Windows\Temp\{6E93B698-1971-4E54-B8B3-1C54D946187D}\.cr\VC_redist.x86.exe File created: C:\Windows\Temp\{85D91174-5AA2-4BD7-8CA8-1AF9FF68ED60}\.ba\wixstdba.dll Jump to dropped file
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Inst\VC_redist.x86.exe File created: C:\Windows\Temp\{6E93B698-1971-4E54-B8B3-1C54D946187D}\.cr\VC_redist.x86.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\SysWOW64\mfc140kor.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\DSScreenSaver\ACDSeeScreensaver.scr Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\$PatchCache$\Managed\A3A56324A226DEE47A72EF91A297A4DF\14.28.29914\concrt140.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\uninst.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Plugins\am_cab.apl Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Program Files (x86)\Common Files\ACD Systems\ZA\Sync.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeQVGFMF.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Plugins\ID_APD.apl Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Plugins\IDE_ACDStd.apl Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Plugins\ID_PS.apl Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\SysWOW64\mfc140enu.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Users\user\AppData\Local\Temp\nse69C6.tmp\nsRandom.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\$PatchCache$\Managed\A3A56324A226DEE47A72EF91A297A4DF\14.28.29914\vccorlib140.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Plugins\CX_Archive.apl Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Users\user\AppData\Local\Temp\nse69C6.tmp\FindProcDLL.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\$PatchCache$\Managed\A3A56324A226DEE47A72EF91A297A4DF\14.28.29914\msvcp140_atomic_wait.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Plugins\CX_SinaWeibo.apl Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Plugins\AM_ZIP.apl Jump to dropped file
Drops PE files to the windows directory (C:\Windows)
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\SysWOW64\mfc140ita.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\SysWOW64\mfc140esn.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\$PatchCache$\Managed\A3A56324A226DEE47A72EF91A297A4DF\14.28.29914\msvcp140_1.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\SysWOW64\mfc140deu.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\SysWOW64\vcamp140.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\SysWOW64\mfc140jpn.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\SysWOW64\mfc140chs.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\SysWOW64\mfcm140u.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\$PatchCache$\Managed\A3A56324A226DEE47A72EF91A297A4DF\14.28.29914\msvcp140.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\$PatchCache$\Managed\A3A56324A226DEE47A72EF91A297A4DF\14.28.29914\vcruntime140.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\SysWOW64\mfc140.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\$PatchCache$\Managed\A3A56324A226DEE47A72EF91A297A4DF\14.28.29914\msvcp140_2.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\SysWOW64\mfc140u.dll Jump to dropped file
Source: C:\Windows\Temp\{6E93B698-1971-4E54-B8B3-1C54D946187D}\.cr\VC_redist.x86.exe File created: C:\Windows\Temp\{85D91174-5AA2-4BD7-8CA8-1AF9FF68ED60}\.ba\wixstdba.dll Jump to dropped file
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Inst\VC_redist.x86.exe File created: C:\Windows\Temp\{6E93B698-1971-4E54-B8B3-1C54D946187D}\.cr\VC_redist.x86.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\SysWOW64\mfc140kor.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\$PatchCache$\Managed\A3A56324A226DEE47A72EF91A297A4DF\14.28.29914\concrt140.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\$PatchCache$\Managed\A3A56324A226DEE47A72EF91A297A4DF\14.28.29914\msvcp140_codecvt_ids.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\SysWOW64\mfc140fra.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\SysWOW64\vcomp140.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\SysWOW64\mfc140enu.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\SysWOW64\mfc140rus.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\SysWOW64\mfc140cht.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\$PatchCache$\Managed\A3A56324A226DEE47A72EF91A297A4DF\14.28.29914\vccorlib140.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\SysWOW64\mfcm140.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\$PatchCache$\Managed\A3A56324A226DEE47A72EF91A297A4DF\14.28.29914\msvcp140_atomic_wait.dll Jump to dropped file
Drops files with a non-matching file extension (content does not match file extension)
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Plugins\AM_ZIP.apl Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Plugins\am_cab.apl Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Plugins\AM_Encryption.apl Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Plugins\AX_RAR.apl Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Plugins\CX_Archive.apl Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Plugins\CX_DFinder.apl Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Plugins\CX_Email.apl Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Plugins\CX_Ftpuploader.apl Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Plugins\CX_SinaWeibo.apl Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Plugins\ID_APD.apl Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Plugins\ID_Canvas.apl Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Plugins\IE_DNG.apl Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Plugins\ID_Media2.apl Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Plugins\ID_PS.apl Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Plugins\IDE_PSD.apl Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Plugins\ID_PSP.apl Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Plugins\ID_DCRaw.apl Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Plugins\IDE_ACDStd.apl Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\LicenseAgreement.rtf
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\LicenseAgreement.rtf
Modifies existing windows services
Source: C:\Windows\System32\SrTasks.exe Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Stores files to the Windows start menu directory
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ACD Systems
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ACD Systems\ACDSee .lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Inst\acdIDInstaller.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run ACSWF1ZA
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Inst\acdIDInstaller.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run ACSWF1ZA
Stores large binary data to the registry
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\ACD Systems\PlugIns\V2\InfoCache\IDP c:\program files (x86)\acd systems\acdsee\gfmf\plugins\ID_DCRaw.apl
Source: C:\Users\user\Desktop\acdseefree.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ACDWIClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ACDWIClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ACDWIClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ACDWIClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ACDWIClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Tries to delay execution (extensive OutputDebugStringW loop)
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Section loaded: OutputDebugStringW count: 141
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Memory allocated: 13900000 memory reserve | memory write watch
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Memory allocated: 13BF0000 memory commit | memory reserve | memory write watch
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Memory allocated: 13D70000 memory commit | memory reserve | memory write watch
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Memory allocated: 13D90000 memory commit | memory reserve | memory write watch
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Memory allocated: 13DB0000 memory commit | memory reserve | memory write watch
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Memory allocated: 13DD0000 memory commit | memory reserve | memory write watch
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Memory allocated: FB60000 memory commit | memory reserve | memory write watch
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Memory allocated: 14BC0000 memory commit | memory reserve | memory write watch
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Memory allocated: 148B0000 memory reserve | memory write watch
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Memory allocated: 14470000 memory commit | memory reserve | memory write watch
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Memory allocated: 16940000 memory commit | memory reserve | memory write watch
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Memory allocated: 16960000 memory commit | memory reserve | memory write watch
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Memory allocated: 16CA0000 memory reserve | memory write watch
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Memory allocated: 17350000 memory commit | memory reserve | memory write watch
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Memory allocated: 173D0000 memory commit | memory reserve | memory write watch
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Memory allocated: 17430000 memory commit | memory reserve | memory write watch
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Memory allocated: 174D0000 memory commit | memory reserve | memory write watch
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Memory allocated: 17590000 memory commit | memory reserve | memory write watch
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Memory allocated: 17600000 memory commit | memory reserve | memory write watch
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Memory allocated: 17640000 memory commit | memory reserve | memory write watch
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Memory allocated: 176E0000 memory commit | memory reserve | memory write watch
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Memory allocated: 177A0000 memory commit | memory reserve | memory write watch
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Memory allocated: 17840000 memory commit | memory reserve | memory write watch
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Memory allocated: 17A80000 memory reserve | memory write watch
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Memory allocated: 16E10000 memory commit | memory reserve | memory write watch
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Memory allocated: 16E50000 memory commit | memory reserve | memory write watch
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Memory allocated: 16E90000 memory commit | memory reserve | memory write watch
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Memory allocated: 17370000 memory commit | memory reserve | memory write watch
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Memory allocated: 17450000 memory commit | memory reserve | memory write watch
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Memory allocated: 174F0000 memory commit | memory reserve | memory write watch
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Memory allocated: 17820000 memory commit | memory reserve | memory write watch
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Memory allocated: 17B80000 memory commit | memory reserve | memory write watch
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Memory allocated: 17BA0000 memory commit | memory reserve | memory write watch
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Memory allocated: 17BC0000 memory commit | memory reserve | memory write watch
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Memory allocated: 17BE0000 memory commit | memory reserve | memory write watch
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Memory allocated: 17C00000 memory commit | memory reserve | memory write watch
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Memory allocated: 17C20000 memory commit | memory reserve | memory write watch
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Memory allocated: 17C40000 memory commit | memory reserve | memory write watch
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Memory allocated: 17C60000 memory commit | memory reserve | memory write watch
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Memory allocated: 17C80000 memory commit | memory reserve | memory write watch
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Memory allocated: 17CA0000 memory commit | memory reserve | memory write watch
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Memory allocated: 17CC0000 memory commit | memory reserve | memory write watch
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Memory allocated: 17CE0000 memory commit | memory reserve | memory write watch
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Memory allocated: 17D00000 memory commit | memory reserve | memory write watch
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Memory allocated: 17D20000 memory commit | memory reserve | memory write watch
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Memory allocated: 17D40000 memory commit | memory reserve | memory write watch
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Memory allocated: 17D60000 memory commit | memory reserve | memory write watch
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Memory allocated: 17D80000 memory commit | memory reserve | memory write watch
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Memory allocated: 17DA0000 memory commit | memory reserve | memory write watch
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Memory allocated: 183F0000 memory commit | memory reserve | memory write watch
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Memory allocated: 18410000 memory commit | memory reserve | memory write watch
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Memory allocated: 18430000 memory commit | memory reserve | memory write watch
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Memory allocated: 184D0000 memory commit | memory reserve | memory write watch
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Memory allocated: 184F0000 memory commit | memory reserve | memory write watch
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Memory allocated: 18510000 memory commit | memory reserve | memory write watch
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Memory allocated: 18530000 memory commit | memory reserve | memory write watch
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Memory allocated: 18550000 memory commit | memory reserve | memory write watch
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Memory allocated: 18570000 memory commit | memory reserve | memory write watch
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Memory allocated: 18590000 memory commit | memory reserve | memory write watch
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Memory allocated: 185B0000 memory commit | memory reserve | memory write watch
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Memory allocated: 185D0000 memory commit | memory reserve | memory write watch
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Memory allocated: 185F0000 memory commit | memory reserve | memory write watch
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Memory allocated: 18630000 memory commit | memory reserve | memory write watch
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Memory allocated: 18650000 memory commit | memory reserve | memory write watch
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Memory allocated: 18670000 memory commit | memory reserve | memory write watch
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Window / User API: threadDelayed 557
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Window / User API: threadDelayed 653
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Dropped PE file which has not been started: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Plugins\AX_RAR.apl Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\SysWOW64\mfc140esn.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\SysWOW64\mfc140ita.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Dropped PE file which has not been started: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDCLClient33U.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Dropped PE file which has not been started: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Plugins\CX_Ftpuploader.apl Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\SysWOW64\mfc140deu.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\SysWOW64\vcamp140.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nse69C6.tmp\nsDialogs.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Dropped PE file which has not been started: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\2052\ACDSeeGFMF.exe.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Dropped PE file which has not been started: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Plugins\AM_Encryption.apl Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\SysWOW64\mfc140jpn.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\SysWOW64\mfc140chs.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\SysWOW64\mfcm140u.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nse69C6.tmp\AdvSplash.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nse69C6.tmp\System.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Dropped PE file which has not been started: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\OldBaseSlideShow.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Dropped PE file which has not been started: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\acdIDWriter.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Dropped PE file which has not been started: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\D3DScreenSaver\ACDSee.scr Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Dropped PE file which has not been started: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\2052\acdIDInTouch2.exe.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Dropped PE file which has not been started: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\d3dx9_27.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Dropped PE file which has not been started: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Xalan-C_1_10.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\Installer\$PatchCache$\Managed\A3A56324A226DEE47A72EF91A297A4DF\14.28.29914\msvcp140_codecvt_ids.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Dropped PE file which has not been started: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\AcdIDClient.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Dropped PE file which has not been started: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeSRGFMF.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\SysWOW64\mfc140fra.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Dropped PE file which has not been started: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Plugins\IDE_PSD.apl Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Dropped PE file which has not been started: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\xerces-c_2_7.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Dropped PE file which has not been started: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Plugins\IE_DNG.apl Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\ACD Systems\AdminTasks.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nse69C6.tmp\nsExec.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\SysWOW64\mfc140rus.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Dropped PE file which has not been started: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Plugins\ID_Media2.apl Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\SysWOW64\mfc140cht.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Dropped PE file which has not been started: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Plugins\CX_Email.apl Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Dropped PE file which has not been started: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\2052\ACDSeeSRGFMF.exe.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Dropped PE file which has not been started: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\XalanMessages_1_10.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\SysWOW64\mfcm140.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Dropped PE file which has not been started: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Win7API.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Dropped PE file which has not been started: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\D3DBaseSlideShow.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Dropped PE file which has not been started: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\2052\ACDSeeQVGFMF.exe.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\ACD Systems\ScreenCaptureU.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Dropped PE file which has not been started: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Plugins\ID_DCRaw.apl Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\Installer\$PatchCache$\Managed\A3A56324A226DEE47A72EF91A297A4DF\14.28.29914\msvcp140_1.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Dropped PE file which has not been started: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Plugins\ID_PSP.apl Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Dropped PE file which has not been started: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Plugins\CX_DFinder.apl Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Dropped PE file which has not been started: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Plugins\ID_Canvas.apl Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\Installer\$PatchCache$\Managed\A3A56324A226DEE47A72EF91A297A4DF\14.28.29914\msvcp140_2.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Dropped PE file which has not been started: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\acdIDInTouch2.exe Jump to dropped file
Source: C:\Windows\Temp\{6E93B698-1971-4E54-B8B3-1C54D946187D}\.cr\VC_redist.x86.exe Dropped PE file which has not been started: C:\Windows\Temp\{85D91174-5AA2-4BD7-8CA8-1AF9FF68ED60}\.ba\wixstdba.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\SysWOW64\mfc140kor.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\Installer\$PatchCache$\Managed\A3A56324A226DEE47A72EF91A297A4DF\14.28.29914\concrt140.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Dropped PE file which has not been started: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\DSScreenSaver\ACDSeeScreensaver.scr Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Dropped PE file which has not been started: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\uninst.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Dropped PE file which has not been started: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Plugins\am_cab.apl Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\ACD Systems\ZA\Sync.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Dropped PE file which has not been started: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeQVGFMF.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Dropped PE file which has not been started: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Plugins\ID_APD.apl Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Dropped PE file which has not been started: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Plugins\IDE_ACDStd.apl Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\SysWOW64\mfc140enu.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Dropped PE file which has not been started: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Plugins\ID_PS.apl Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nse69C6.tmp\nsRandom.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\Installer\$PatchCache$\Managed\A3A56324A226DEE47A72EF91A297A4DF\14.28.29914\vccorlib140.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Dropped PE file which has not been started: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Plugins\CX_Archive.apl Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nse69C6.tmp\FindProcDLL.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\Installer\$PatchCache$\Managed\A3A56324A226DEE47A72EF91A297A4DF\14.28.29914\msvcp140_atomic_wait.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Dropped PE file which has not been started: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Plugins\CX_SinaWeibo.apl Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Dropped PE file which has not been started: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Plugins\AM_ZIP.apl Jump to dropped file
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\System32\SrTasks.exe TID: 1704 Thread sleep time: -300000s >= -30000s
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe TID: 1392 Thread sleep count: 557 > 30
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe TID: 1392 Thread sleep count: 653 > 30
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File opened: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\AlbumGenerator\Styles\Style1\pages
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File opened: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\AlbumGenerator\Styles
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File opened: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\AlbumGenerator
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File opened: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\AlbumGenerator\Styles\Style1
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File opened: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\AlbumGenerator\Styles\Style1\css
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe File opened: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\AlbumGenerator\Styles\Style1\pages\image
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Process information queried: ProcessInformation
Checks if the current process is being debugged
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Process queried: DebugPort
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Memory allocated: page read and write | page guard
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Process created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Inst\acdIDInstaller.exe "C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Inst\acdIDInstaller.exe" /i /app "ACDSee GFMF" /reg "Software\ACD Systems\ACDSee\GFMF" /pid ACSWF1ZA /lng ZA /bld 2771 /it2 "C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\acdIDInTouch2.exe" /alturl "acdidserver.acdsee.cn" /altcontenturl "content.acdsee.cn" /fr /mupd
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Process created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Inst\VC_redist.x86.exe "C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Inst\VC_redist.x86.exe" /q /norestart
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Process created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\CheckWinVer.exe "C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\CheckWinVer.exe"
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Process created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Inst\acdIDInstaller.exe "c:\program files (x86)\acd systems\acdsee\gfmf\inst\acdidinstaller.exe" /i /app "acdsee gfmf" /reg "software\acd systems\acdsee\gfmf" /pid acswf1za /lng za /bld 2771 /it2 "c:\program files (x86)\acd systems\acdsee\gfmf\acdidintouch2.exe" /alturl "acdidserver.acdsee.cn" /altcontenturl "content.acdsee.cn" /fr /mupd
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Process created: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Inst\acdIDInstaller.exe "c:\program files (x86)\acd systems\acdsee\gfmf\inst\acdidinstaller.exe" /i /app "acdsee gfmf" /reg "software\acd systems\acdsee\gfmf" /pid acswf1za /lng za /bld 2771 /it2 "c:\program files (x86)\acd systems\acdsee\gfmf\acdidintouch2.exe" /alturl "acdidserver.acdsee.cn" /altcontenturl "content.acdsee.cn" /fr /mupd
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\AppData\Local\Temp\ACDWIClient.exe Queries volume information: C:\Users\user\AppData\Local\Temp\MainWndBkg.jpg VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\ACDWIClient.exe Queries volume information: C:\Users\user\AppData\Local\Temp\StatusBkg.jpg VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\ACDWIClient.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Close_N.jpg VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\ACDWIClient.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Close_H.jpg VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\ACDWIClient.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Min_N.jpg VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\ACDWIClient.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Min_H.jpg VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\ACDWIClient.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Cancel_N.jpg VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\ACDWIClient.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Cancel_H.jpg VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\ACDWIClient.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Cancel_D.jpg VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\ACDWIClient.exe Queries volume information: C:\Users\user\AppData\Local\Temp\CheckD.jpg VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\msiexec.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\msiexec.exe Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Users\user\AppData\Local\ACD Systems\acdIDInTouch2\20\banners\ACSWF1ZA_LOCAL\DEFAULT\default-popup-banner.png VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\DUBAI-MEDIUM.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\DUBAI-LIGHT.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\DUBAI-BOLD.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\flat_officeFontsPreview.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\OFFSYM.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\OFFSYMSL.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\OFFSYMSB.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\OFFSYMXL.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\OFFSYML.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\OFFSYMB.TTF VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\ACDSeeGFMF.exe Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation
Source: C:\Program Files (x86)\ACD Systems\ACDSee\GFMF\Inst\acdIDInstaller.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid
Source: C:\Users\user\AppData\Local\Temp\ACDSee_Official_Free.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
64.233.177.84
 unknown United States
15169 GOOGLEUS false
43.159.26.129
 unknown Japan 4249 LILLY-ASUS false
64.233.177.97
 unknown United States
15169 GOOGLEUS false
43.154.254.90
 minorshort.weixin.qq.com Japan 4249 LILLY-ASUS false
74.125.138.139
 unknown United States
15169 GOOGLEUS false
74.125.136.99
 www.google.com United States
15169 GOOGLEUS false
106.14.229.213
 content-acdsee-cn.oss-cn-shanghai.aliyuncs.com China
37963 CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd false
43.155.124.49
 wechat.com Japan 4249 LILLY-ASUS false
43.154.240.170
 unknown Japan 4249 LILLY-ASUS false
128.14.246.120
 41jhoui9.ovslegodl.sched.ovscdns.com United States
135377 UHGL-AS-APUCloudHKHoldingsGroupLimitedHK false
43.153.248.110
 newcomm.wechat.com Japan 4249 LILLY-ASUS false
173.194.219.94
 unknown United States
15169 GOOGLEUS false
47.246.24.236
 dl2.acdsee.cn.w.kunlunca.com United States
24429 TAOBAOZhejiangTaobaoNetworkCoLtdCN false
20.189.173.21
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
239.255.255.250
 unknown Reserved
unknown unknown false
101.32.133.53
 sgminorshort.wechat.com China
132203 TENCENT-NET-AP-CNTencentBuildingKejizhongyiAvenueCN false
8.45.52.248
 www.acdsee.cn.w.cdngslb.com United States
17639 CONVERGE-ASConvergeICTSolutionsIncPH false
47.105.134.52
 acdidserver.acdsee.cn China
37963 CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd false

Private

IP
192.168.2.17

Contacted Domains

Name IP Active
minorshort.weixin.qq.com 43.154.254.90 true
newcomm.wechat.com 43.153.248.110 true
dl2.acdsee.cn.w.kunlunca.com 47.246.24.236 true
wechat.com 43.155.124.49 true
www.google.com 74.125.136.99 true
sgminorshort.wechat.com 101.32.133.53 true
www.acdsee.cn.w.cdngslb.com 8.45.52.248 true
acdidserver.acdsee.cn 47.105.134.52 true
41jhoui9.ovslegodl.sched.ovscdns.com 128.14.246.120 true
content-acdsee-cn.oss-cn-shanghai.aliyuncs.com 106.14.229.213 true
weixin.qq.com unknown unknown
newres.wechat.com unknown unknown
www.acdsee.cn unknown unknown
www.wechat.com unknown unknown
support.wechat.com unknown unknown
dl2.acdsee.cn unknown unknown
content.acdsee.cn unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://content.acdsee.cn/za/onlinepages/common/ga.js false
    		high
    http://content.acdsee.cn/za/onlinepages/common/common.css false
      		high
      http://wechat.com/cgi-bin/readtemplate?t=market_redirect false
        		high
        http://dl2.acdsee.cn/acdsee/za/acdsee-official-free.exe false
          		high
          http://content.acdsee.cn/za/onlinepages/resource/images/loading.gif false
            		high
            http://content.acdsee.cn/za/onlinepages/resource/images/shield-icon.png false
              		high
              http://content.acdsee.cn/za/onlinepages/signin.html false
                		high
                http://content.acdsee.cn/za/onlinepages/common/bootstrap.min.js false
                  		high
                  http://content.acdsee.cn/za/onlinepages/common/bootstrap.min.css false
                    		high
                    https://www.wechat.com/mobile false
                      		high
                      http://www.acdsee.cn/banner_config.html false
                        		high
                        http://content.acdsee.cn/za/onlinepages/common/jquery.min.js false
                          		high
                          http://content.acdsee.cn/za/onlinepages/resource/fonts/Raleway/Raleway-Medium.ttf false
                            		high