Edit tour

Windows Analysis Report
SetupGLG-CE-4-4-x64-vs2015.exe

Overview

General Information

Sample name:	SetupGLG-CE-4-4-x64-vs2015.exe
Analysis ID:	1431668
MD5:	fb96e42527566991cb7f45c08b7b411b
SHA1:	e5658793c41761981c0ad4cb3e421e12839869d0
SHA256:	3363b944fbd66e33ee0d3deb12d249e22e1ee17696783db3814c108f2cd5335d
Infos:

Detection

Score:	12
Range:	0 - 100
Whitelisted:	false
Confidence:	40%

Compliance

Score:	50
Range:	0 - 100

Signatures

Writes many files with high entropy

Contains functionality to dynamically determine API calls

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates files inside the system directory

Drops PE files

Found dropped PE file which has not been started or loaded

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Analysis Advice

Sample drops PE files which have not been started, submit dropped PE samples for a secondary analysis to Joe Sandbox

Sample has a GUI, but Joe Sandbox has not found any clickable buttons, likely more UI automation may extend behavior

Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior

Process Tree

System is w10x64_ra

SetupGLG-CE-4-4-x64-vs2015.exe (PID: 2120 cmdline: "C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe" MD5: FB96E42527566991CB7F45C08B7B411B)

rundll32.exe (PID: 1700 cmdline: C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding MD5: EF3179D498793BF4234F708D3BE28633)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Compliance

Uses 32bit PE files

Source: SetupGLG-CE-4-4-x64-vs2015.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Found installer window with terms and condition text

Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe

Window detected: < &Back&Next >CancelGeneric Logic Inc. www.genlogic.com Generic Logic Inc. www.genlogic.comGLG Toolkit Community Edition License AgreementPlease review the license terms before installing GLG Toolkit Community Edition 4.4 x64.Press Page Down to see the rest of the agreement.NON-COMMERCIAL LICENSE GLG Toolkit Community Edition This license applies to the Community Edition of the Generic Logic Inc.'s Software and any of its derivatives. Any use of the Software and/or its parts or of the software items that link with the Software signifies acceptance of this license.COMPATIBILITY NOTE: Drawings created with the Community Edition should not be used in the Production version of the Toolkit. To evaluate the Production version contact Generic Logic at sales@genlogic.com.GRANTED RIGHTS:1. Permission is hereby granted free of charge to any personobtaining a copy of this software and associated documentation files(the "Software") to use the software for non-commercial projects asdefined below free of charge and without modifications that wouldremove or hide the copyright notices.2. You can distribute any derivatives developed using the Software orin any way linked with it as long as these items are distributed forfree and contain this license file.3. Any web-based services that use the Software in any form must beavailable to all users free of charge.A NON-COMMERCIAL PROJECT is an application or web service thatdeveloped for a non-commercial entity and is available to all usersfree of charge.A COMMERCIAL PROJECT is an application or web service that isdeveloped or used by a commercial entity as part of its businessactivity either for profit or for advertising promotion and researchpurposes.WARRANTY DISCLAIMER: The Software is provided "AS-IS" and withoutwarranty of any kind express implied or otherwise including withoutlimitation any warranty of merchantability or fitness for aparticular purpose. Except as specifically provided herein GenericLogic Inc. makes no warranty or representation express or impliedwith respect to software including its quality performancemerchantability or fitness for a particular purpose title and againstinfringement.LIMITATIONS OF LIABILITY: In no event shall Generic Logic Inc. beliable for any special incidental indirect or consequential damagesof any kind or any damages whatsoever resulting from loss of usedata or profits whether or not advised of the possibility of damageand on any theory of liability arising out of or in connection withthe use or performance of this software.GOVERNING LAW: This Agreement shall be governed by and construed inaccordance with the laws of the Commonwealth of Massachusetts.Copyright (C) 1994-2024 Generic Logic Inc.If you accept the terms of the agreement click the check box below. You must accept the agreement to install GLG Toolkit Community Edition 4.4 x64. Click Next to continue.I &accept the terms of the License Agreement

Creates a directory in C:\Program Files

Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\RealTime_StripChart	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\RealTime_StripChart\Script1.rc	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\RealTime_StripChart\StripChart.exe	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\RealTime_StripChart\StripChart.ico	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\RealTime_StripChart\StripChart.sln	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\RealTime_StripChart\StripChart.vcxproj	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\RealTime_StripChart\StripChart.vcxproj.filters	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\RealTime_StripChart\StripChart.vcxproj.user	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\RealTime_StripChart\resource.h	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\RealTime_StripChart\stripchart.c	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\RealTime_StripChart\stripchart.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\RealTime_StripChart\stripchart.h	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\AerationPage.c	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\AerationPage.h	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\AlarmPage.c	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\AlarmPage.h	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\AlarmTableWidget.c	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\AlarmTableWidget.h	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\ChartWidget.c	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\ChartWidget.h	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\CircuitPage.c	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\CircuitPage.h	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\DataFeed.c	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\DataFeed.h	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\DataTypes.h	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\DemoDataFeed.c	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\DemoDataFeed.h	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\EmptyPage.c	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\EmptyPage.h	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\GlgViewer.c	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\GlgViewer.h	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\GlgWidget.c	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\GlgWidget.h	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\HMIPage.c	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\HMIPage.h	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\LiveDataFeed.c	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\LiveDataFeed.h	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\MainLayoutPage.c	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\MainLayoutPage.h	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\ProcessDemoPage.c	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\ProcessDemoPage.h	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\README_MODULE_DESCRIPTIONS.txt	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\README_SCADA_VIEWER.txt	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\README_SCADA_VIEWER_BUILD.txt	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\RTChartPage.c	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\RTChartPage.h	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\SCADAViewer.exe	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\SCADAViewer.sln	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\SCADAViewer.vcxproj	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\SCADAViewer.vcxproj.filters	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\SCADAViewer.vcxproj.user	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\Script1.rc	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\UserRoleWidget.c	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\UserRoleWidget.h	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\config.c	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\main.c	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\resource.h	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\scada.h	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\scada.ico	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\util.c	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\HELP_AERATION_PAGE.txt	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\HELP_COMMAND_SAMPLES.txt	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\HELP_MAIN_LAYOUT.txt	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\HELP_RTCHART_PAGE.txt	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\HELP_RTCHART_PAGE_EXT.txt	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\HELP_SCADA_CONFIG.txt	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\alarm_button_obj.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\alarms.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\config_alarms.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\edit_alarm_sp.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\edit_analog_value.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\empty_drawing.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\engine.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\engine_measurements.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\fonttable_file.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\glg_scrollbar_h.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\glg_scrollbar_v.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\help.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\main_layout_buttons.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\main_layout_tabs.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\message_dialog.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\popup_menu_3state.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\popup_on_off.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\popup_open_close.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\popup_start_stop.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\popup_viewport.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\rtchart.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\rtchart_page.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\rtchart_page_ext.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\rtchart_scroll.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\rtchart_scroll_1axis.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\scada_aeration.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\scada_config_main_drawing.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\scada_config_menu.txt	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\scada_drill_down.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\scada_electric.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\scada_motor_info.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\scada_process.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\scada_test_commands.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\scada_test_commands.g.1095x780	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\template_drawing.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\template_drawing.g.1200x900	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\template_drawing.g.900x750	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\user_role.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\waste_heat_boiler.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\zoom_panel_h.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\zoom_panel_v.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\subdrawings	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\subdrawings\analog_value.sd	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\subdrawings\analog_value_adjustment.sd	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\subdrawings\digital_input.sd	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\aircombat	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\aircombat\Script1.rc	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\aircombat\aircombat.c	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\aircombat\aircombat.exe	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\aircombat\aircombat.ico	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\aircombat\aircombat.sln	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\aircombat\aircombat.vcxproj	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\aircombat\aircombat.vcxproj.filters	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\aircombat\aircombat.vcxproj.user	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\aircombat\demo.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\aircombat\demo_data.c	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\aircombat\resource.h	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\airtraffic	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\airtraffic\Script1.rc	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\airtraffic\airtraffic.c	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\airtraffic\airtraffic.exe	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\airtraffic\airtraffic.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\airtraffic\airtraffic.h	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\airtraffic\airtraffic.ico	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\airtraffic\airtraffic.sln	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\airtraffic\airtraffic.vcxproj	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\airtraffic\airtraffic.vcxproj.filters	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\airtraffic\airtraffic.vcxproj.user	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\airtraffic\resource.h	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\diagram	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\diagram\README.txt	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\diagram\Script1.rc	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\diagram\diagram.exe	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\diagram\diagram.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\diagram\diagram.ico	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\diagram\diagramG.c	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\diagram\diagramG.sln	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\diagram\diagramG.vcxproj	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\diagram\diagramG.vcxproj.user	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\diagram\diagramG2.c	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\diagram\diagram_proto.h	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\diagram\diagram_proto2.h	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\diagram\diagram_template.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\diagram\p_diagram.ico	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\diagram\process_diagram.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\diagram\process_template.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\diagram\resource.h	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\gis_demo	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\gis_demo\README.txt	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\gis_demo\Script1.rc	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\gis_demo\gis_demo.c	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\gis_demo\gis_demo.exe	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\gis_demo\gis_demo.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\gis_demo\gis_demo.h	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\gis_demo\gis_demo.ico	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\gis_demo\gis_demo.sln	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\gis_demo\gis_demo.vcxproj	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\gis_demo\gis_demo.vcxproj.filters	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\gis_demo\gis_demo.vcxproj.user	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\gis_demo\resource.h	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\gis_demo\example	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\gis_demo\example\gis_demo_simple.c	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\gis_demo\example\gis_demo_simple.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\graph_layout	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\graph_layout\GlgGraphLayoutDemoG.c	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\graph_layout\graph.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\graph_layout\graph_layout.exe	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\graph_layout\graph_layout.ico	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\graph_layout\graph_layout.rc	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\graph_layout\graph_layout.sln	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\graph_layout\graph_layout.vcxproj	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\graph_layout\graph_layout.vcxproj.user	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\graph_layout\palette.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\graph_layout\resource.h	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\main_demo	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\main_demo\GlgDemo.exe	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\map_demo	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\map_demo\Script1.rc	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\map_demo\critical.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\map_demo\default.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\map_demo\diagram.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\map_demo\facilities_s	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\map_demo\facilities_w	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\map_demo\indeterm.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\map_demo\links_s	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\map_demo\links_w	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\map_demo\major.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\map_demo\map.exe	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\map_demo\map.ico	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\map_demo\mapG.c	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\map_demo\mapG.sln	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\map_demo\mapG.vcxproj	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\map_demo\mapG.vcxproj.filters	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\map_demo\mapG.vcxproj.user	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\map_demo\map_demo.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\map_demo\map_proto.h	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\map_demo\no_alarms.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\map_demo\no_alarms.gif	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\map_demo\palette.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\map_demo\resource.h	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\map_demo\us_map.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\map_demo\warning.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\map_demo\world_map.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\process_demo	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\process_demo\README.txt	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\process_demo\Script1.rc	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\process_demo\process.exe	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\process_demo\process.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\process_demo\process.ico	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\process_demo\process.sln	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\process_demo\process.vcxproj	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\process_demo\process.vcxproj.filters	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\process_demo\process.vcxproj.user	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\process_demo\processG.c	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\process_demo\resource.h	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\satellite	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\satellite\README.txt	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\satellite\Script1.rc	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\satellite\main.c	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\satellite\resource1.h	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\satellite\satellite.c	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\satellite\satellite.exe	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\satellite\satellite.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\satellite\satellite.ico	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\satellite\satellite.sln	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\satellite\satellite.vcxproj	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\satellite\satellite.vcxproj.user	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\satellite\trajectory.c	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\satellite\trajectory.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\satellite\trajectory.ico	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\satellite\util.c	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\satellite\util.h	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\custom_objects.pal	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\palettes.pls	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\avionics	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\avionics\avio1.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\avionics\avio10.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\avionics\avio11.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\avionics\avio12.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\avionics\avio13.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\avionics\avio14.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\avionics\avio15.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\avionics\avio16.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\avionics\avio2.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\avionics\avio3.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\avionics\avio4.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\avionics\avio5.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\avionics\avio6.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\avionics\avio7.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\avionics\avio8.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\avionics\avio9.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\avionics\avionics.pal	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\alarm1.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button1.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button10.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button11.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button12.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button13.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button14.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button15.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button16.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button17.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button18.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button20.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button21.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button22.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button23.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button24.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button25.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button26.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button28.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button29.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button3.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button30.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button31.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button32.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button33.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button34.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button35.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button36.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button37.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button38.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button39.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button4.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button40.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button41.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button42.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button43.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button44.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button45.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button46.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button47.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button48.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button49.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button5.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button50.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button51.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button52.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button53.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button54.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button55.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button56.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button6.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button7.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button8.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button9.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\buttons.pal	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\date_time.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\dials.pal	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\gauge1.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\gauge3.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\gauge4.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\gauges.pal	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\indicator1.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\indicator10.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\indicator12.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\indicator13.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\indicator14.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\indicator15.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\indicator16.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\indicator17.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\indicator18.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\indicator19.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\indicator2.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\indicator20.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\indicator21.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\indicator22.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\indicator23.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\indicator24.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\indicator25.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\indicator26.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\indicator27.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\indicator28.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\indicator29.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\indicator3.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\indicator30.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\indicator31.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\indicator32.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\indicator33.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\indicator34.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\indicator35.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\indicator4.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\indicator5.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\indicator6.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\indicator7.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\indicator8.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\indicator9.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\indicators.pal	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\joystick1.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\joystick2.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\joystick3.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\joystick4.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\knob1.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\knob10.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\knob11.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\knob12.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\knob13.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\knob14.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\knob15.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\knob16.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\knob17.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\knob18.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\knob19.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\knob2.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\knob20.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\knob21.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\knob3.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\knob4.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\knob5.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\knob6.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\knob8.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\knob9.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\knobs.pal	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\label1.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\lat1.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\latlon1.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\latlon2.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\led1.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\led2.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\led3.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\led4.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\led5.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\led6.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\linear_gauges.pal	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\lon1.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter1.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter10.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter11.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter12.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter13.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter14.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter15.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter16.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter17.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter2.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter26.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter27.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter3.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter32.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter33.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter34.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter35.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter36.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter37.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter38.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter39.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter4.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter40.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter41.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter42.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter43.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter44.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter45.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter46.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter47.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter48.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter49.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter5.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter50.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter51.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter52.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter53.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter54.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter55.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter56.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter57.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter58.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter59.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter6.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter60.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter61.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter62.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter63.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter64.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter65.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter66.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter7.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter8.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter9.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider1.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider10.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider11.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider12.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider13.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider14.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider15.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider16.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider18.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider19.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider2.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider20.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider21.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider22.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider23.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider24.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider25.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider26.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider27.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider28.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider29.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider3.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider30.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider31.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider32.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider33.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider34.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider35.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider36.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider37.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider38.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider39.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider4.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider40.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider41.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider42.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider43.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider44.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider45.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider46.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider47.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider48.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider49.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider50.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider51.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider6.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider7.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\sliders.pal	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\switch1.g	Jump to behavior

Creates a software uninstall entry

Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GlgToolkitCE(x64)4.4

Jump to behavior

Creates license or readme file

Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\README_MODULE_DESCRIPTIONS.txt	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\README_SCADA_VIEWER.txt	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\README_SCADA_VIEWER_BUILD.txt	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\Program Files\GlgCE.4.4_x64\DEMOS\diagram\README.txt	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\Program Files\GlgCE.4.4_x64\DEMOS\gis_demo\README.txt	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\Program Files\GlgCE.4.4_x64\DEMOS\process_demo\README.txt	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\Program Files\GlgCE.4.4_x64\DEMOS\satellite\README.txt	Jump to behavior

PE / OLE file has a valid certificate

Source: SetupGLG-CE-4-4-x64-vs2015.exe

Static PE information: certificate valid

Binary contains paths to debug symbols

Source:	Binary string: X:\devel.4.4.vs2015\demo_process\x64\Release_Static\processS.pdb source: process.exe.0.dr
Source:	Binary string: X:\devel.4.4.vs2015\x64\Release\libdyn.pdb source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000003.1829526171.0000000003736000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: X:\devel.4.4.vs2015\cs\examples_ASP.NET\DialHandlerSource\obj\Release\DialHandler.pdb source: DialHandler.dll.0.dr
Source:	Binary string: X:\devel.4.4.vs2015\cs\glg.net\obj\Release_ce\Glg.NetCE.pdb source: Glg.NetCE.dll14.0.dr, Glg.NetCE.dll18.0.dr, Glg.NetCE.dll19.0.dr, Glg.NetCE.dll3.0.dr, Glg.NetCE.dll8.0.dr, Glg.NetCE.dll11.0.dr, Glg.NetCE.dll2.0.dr, Glg.NetCE.dll12.0.dr, Glg.NetCE.dll6.0.dr
Source:	Binary string: X:\jurassic_lib.4.6.2\Jurassic\obj\Release\JurassicGLG.pdb source: JurassicGLG.dll.0.dr, JurassicGLG.dll20.0.dr, JurassicGLG.dll11.0.dr, JurassicGLG.dll9.0.dr, JurassicGLG.dll7.0.dr, JurassicGLG.dll17.0.dr, JurassicGLG.dll14.0.dr, JurassicGLG.dll4.0.dr, JurassicGLG.dll16.0.dr

Networking

Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2283509937.0000000002D48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gdavidcarter.blogspot.com/2016/04/installing-perl-on-windows-2012r2-iis-85.html
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2283509937.0000000002D48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://my_web_server.com/Scripts/GlmScript.pl?VERSION=1.3.0&REQUEST=GetMap&SRS=AUTO2:42003
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2283509937.0000000002D48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://my_web_server.com/Scripts/GlmScript.pl?VERSION=1.3.0&REQUEST=GetMap&SRS=EPSG:4326&WIDTH=800&H
Source: SetupGLG-CE-4-4-x64-vs2015.exe	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: SetupGLG-CE-4-4-x64-vs2015.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2283509937.0000000002D48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.betterhostreview.com/turn-on-iis-windows-10.html
Source: gis_demo.htm.0.dr	String found in binary or memory: http://www.genlogic.com
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp, dial_demo.htm.0.dr, electric_circuit.htm.0.dr, gis_demo.htm.0.dr	String found in binary or memory: http://www.genlogic.com/ajax_demos.html
Source: electric_circuit.htm.0.dr, gis_demo.htm.0.dr	String found in binary or memory: http://www.genlogic.com/architecture.html#Resource_Based_Data_Access
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp, dial_demo.htm.0.dr, electric_circuit.htm.0.dr, gis_demo.htm.0.dr	String found in binary or memory: http://www.genlogic.com/demos.html
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp, SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000003.1955964812.0000000007760000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.genlogic.com/doc_html/csharp_doc/index.html
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.genlogic.com/doc_html/index.html
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp, SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000003.1955742589.0000000007760000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.genlogic.com/doc_html/java_doc/index.html
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp, SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000003.1956225300.0000000007760000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.genlogic.com/doc_html/javascript_doc/index.html
Source: gis_demo.htm.0.dr	String found in binary or memory: http://www.genlogic.com/favicon.ico
Source: gis_demo.htm.0.dr	String found in binary or memory: http://www.genlogic.com/graphics_server.html
Source: dial_demo.htm.0.dr, electric_circuit.htm.0.dr, gis_demo.htm.0.dr	String found in binary or memory: http://www.genlogic.com/index.html#Products
Source: gis_demo.htm.0.dr	String found in binary or memory: http://www.genlogic.com/integration.html#Data_Supply
Source: dial_demo.htm.0.dr, gis_demo.htm.0.dr	String found in binary or memory: http://www.genlogic.com/toolkit.html#Graphics_Builder
Source: gis_demo.htm.0.dr	String found in binary or memory: http://www.genlogic.com/toolkit.html#Inherent_Dynamics
Source: electric_circuit.htm.0.dr, gis_demo.htm.0.dr	String found in binary or memory: http://www.genlogic.com/toolkit.html#Scalable_Vector_Graphics
Source: electric_circuit.htm.0.dr, gis_demo.htm.0.dr	String found in binary or memory: http://www.genlogic.com/toolkit.html#Unlimited_Geometrical_Dynamics
Source: gis_demo.htm.0.dr	String found in binary or memory: http://www.genlogic.com/widgets.html#2D_Graphs
Source: gis_demo.htm.0.dr	String found in binary or memory: http://www.genlogic.com/widgets.html#Avionics
Source: dial_demo.htm.0.dr, gis_demo.htm.0.dr	String found in binary or memory: http://www.genlogic.com/widgets.html#Controls
Source: gis_demo.htm.0.dr	String found in binary or memory: http://www.genlogic.com/widgets.html#Process_Control
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.genlogic.comPublisherGeneric
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2283509937.0000000002D48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.myserver.com

Spam, unwanted Advertisements and Ransom Demands

Writes many files with high entropy

Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\Program Files\GlgCE.4.4_x64\SCADAViewer\C#\drawings\config_alarms.g entropy: 7.99067641755	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\Program Files\GlgCE.4.4_x64\SCADAViewer\C#\drawings\engine.g entropy: 7.99114096945	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\Program Files\GlgCE.4.4_x64\SCADAViewer\C#\drawings\rtchart_page.g entropy: 7.99218557739	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\Program Files\GlgCE.4.4_x64\SCADAViewer\C#\drawings\main_layout_tabs.g entropy: 7.99071014646	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\Program Files\GlgCE.4.4_x64\SCADAViewer\C#\drawings\scada_process.g entropy: 7.99127184994	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\Program Files\GlgCE.4.4_x64\SCADAViewer\C#\drawings\scada_test_commands.g entropy: 7.99319516448	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\Program Files\GlgCE.4.4_x64\SCADAViewer\C#\drawings\scada_config_main_drawing.g entropy: 7.99027254918	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\Program Files\GlgCE.4.4_x64\SCADAViewer\C#\drawings\scada_test_commands.g.1095x780 entropy: 7.99185118875	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\Program Files\GlgCE.4.4_x64\SCADAViewer\HTML5\SCADAViewerFiles\drawings\config_alarms.g entropy: 7.99067641755	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\Program Files\GlgCE.4.4_x64\SCADAViewer\HTML5\SCADAViewerFiles\drawings\main_layout_tabs.g entropy: 7.99071014646	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\Program Files\GlgCE.4.4_x64\SCADAViewer\HTML5\SCADAViewerFiles\drawings\engine.g entropy: 7.99114096945	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\Program Files\GlgCE.4.4_x64\DEMOS\map_demo\world_map.g entropy: 7.99065923483	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\Program Files\GlgCE.4.4_x64\DEMOS\process_demo\process.g entropy: 7.991672879	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\Program Files\GlgCE.4.4_x64\examples_vbnet_ocx\process\process.g entropy: 7.99269954047	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\Program Files\GlgCE.4.4_x64\SCADAViewer\HTML5\SCADAViewerFiles\drawings\scada_config_main_drawing.g entropy: 7.99027254918	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\Program Files\GlgCE.4.4_x64\SCADAViewer\HTML5\SCADAViewerFiles\drawings\rtchart_page.g entropy: 7.99218557739	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\Program Files\GlgCE.4.4_x64\SCADAViewer\HTML5\SCADAViewerFiles\drawings\scada_process.g entropy: 7.99127184994	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\Program Files\GlgCE.4.4_x64\SCADAViewer\HTML5\SCADAViewerFiles\drawings\scada_test_commands.g entropy: 7.99319516448	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\Program Files\GlgCE.4.4_x64\SCADAViewer\HTML5\SCADAViewerFiles\drawings\scada_test_commands.g.1095x780 entropy: 7.99185118875	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\Program Files\GlgCE.4.4_x64\examples_ASP.NET\ProcessHandlerSource\ProcessHandler\process2.g entropy: 7.99308037856	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\Program Files\GlgCE.4.4_x64\examples_ASP.NET\ProcessHandlerSource\process2.g entropy: 7.99147698235	Jump to dropped file

System Summary

Creates files inside the system directory

Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\Windows\System32\Glg.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\Windows\System32\GlgEx.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\Windows\System32\GlgIn.dll	Jump to behavior

Sample file is different than original file name gathered from version info

Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2283509937.0000000002CDC000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameGLGOLE.DLL. vs SetupGLG-CE-4-4-x64-vs2015.exe

Uses 32bit PE files

Source: SetupGLG-CE-4-4-x64-vs2015.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ComboChart.csproj
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \DEMOS_C#\RealTimeChartGlgRealTimeChart.csGlgRealTimeChart.resxRealTimeChart.csprojRealTimeChart.exeRealTimeChart.exe.configRealTimeChart.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ObjectPosition.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: mapG.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \examples_csharp.NET\AnimationAnimation.csproj.user
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: diagramG.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: ElectricCircuit.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: simpleW.slnE
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: GlgExample.csproj
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: realtime_chart.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \DEMOS\graph_layoutGlgGraphLayoutDemoG.cgraph.ggraph_layout.exegraph_layout.icograph_layout.rcgraph_layout.slngraph_layout.vcxprojgraph_layout.vcxproj.userpalette.g
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: RobotArm.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \DEMOS_C#\AirTrafficAirTraffic.csprojAirTraffic.exeAirTraffic.exe.configAirTraffic.slnGlgAirTrafficDemo.csGlgAirTrafficDemo.resxREADME_AIR_TRAFFIC_DEMO.txtapp.config
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: Animation.csproj.userd
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: GraphHandler.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: GIS.csproj
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Controls.csproj
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Controls.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: gis.csproj
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: GraphLayout.sln"
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Avionics.csproj
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \examples_ASP.NET\GISHandlerSourceGISHandler.csprojGISHandler.slnGlgGISHandler.cs
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: exampleGcpp.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ProcessHandler.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: controlsG.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: Dashboard.csproj
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \examples_vbnet_ocx\processprocess.vbprojprocess.vbproj.userprocess.xml
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: glg_custom_proto.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: DialHandler.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCADAViewer.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCADAViewer.csproj
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: SimpleViewer.sln$at
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: SimpleViewer.csproj.userjH
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: RealTimeChart.csproj.user
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ProcessHandler.csproj
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: GIS.csproji
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \DEMOS_C#\AircombatAircombat.csprojAircombat.exeAircombat.exe.configAircombat.slnGlgAircombatDemo.csGlgAircombatDemo.resx
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: animationG.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AirTraffic.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: RealTimeChart.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Diagram.csproj
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: GraphLayout.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \DEMOS_C#\ProcessGlgProcessDemo.csGlgProcessDemo.resxProcess.csprojProcess.exeProcess.exe.configProcess.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: Diagram.csproj
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Dashboard.vbproj
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: SimpleViewer.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: animationG.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \DEMOS\SCADAViewerAerationPage.cAerationPage.hAlarmPage.cAlarmPage.hAlarmTableWidget.cAlarmTableWidget.hChartWidget.cChartWidget.hCircuitPage.cCircuitPage.hDataFeed.cDataFeed.hDataTypes.hDemoDataFeed.cDemoDataFeed.hEmptyPage.cEmptyPage.hGlgViewer.cGlgViewer.hGlgWidget.cGlgWidget.hHMIPage.cHMIPage.hLiveDataFeed.cLiveDataFeed.hMainLayoutPage.cMainLayoutPage.hProcessDemoPage.cProcessDemoPage.hREADME_MODULE_DESCRIPTIONS.txtREADME_SCADA_VIEWER.txtREADME_SCADA_VIEWER_BUILD.txtRTChartPage.cRTChartPage.hSCADAViewer.exeSCADAViewer.slnSCADAViewer.vcxprojSCADAViewer.vcxproj.filtersSCADAViewer.vcxproj.userUserRoleWidget.cUserRoleWidget.hconfig.cmain.cscada.hscada.icoutil.c
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \DEMOS_C#\AvionicsAvionics.csprojAvionics.exeAvionics.exe.configAvionics.slnGlgAvionicsDemo.csGlgAvionicsDemo.resxavionics.ico
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \SimpleViewer\MultiThreaded\C#BaseData.csDataFeedBase.csGPSData.csGlgViewerForm.Designer.csGlgViewerForm.csGlgViewerForm.resxSimpleViewer.csprojSimpleViewer.csproj.userTelemetryData.cs
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: simpleG.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \examples_ASP.NET\ProcessHandlerSourceGlgProcessDemoData.csGlgProcessHandler.csProcessHandler.csprojProcessHandler.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: exampleW.slnt
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: graphs.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \examples_ASP.NET\CircuitHandlerSourceCircuitHandler.csprojCircuitHandler.slnGlgCircuitDemoData.csGlgCircuitHandler.csGlgSimulationResource.cs
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AvionicsHandler.csproj
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: process.vbproj
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \DEMOS\diagramREADME.txtdiagram.exediagram.gdiagram.icodiagramG.cdiagramG.slndiagramG.vcxprojdiagramG.vcxproj.userdiagramG2.cdiagram_proto.hdiagram_proto2.hdiagram_template.gp_diagram.icoprocess_diagram.gprocess_template.g
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: airtraffic.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: aircombat.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: GIS.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \DEMOS_C#\MapGlgMapDemo.csGlgMapDemo.resxMap.csprojMap.exeMap.exe.configMap.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: AirTraffic.sln!!
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: SimpleViewerHandler.slnj
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: SimpleViewer.csprojU
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: gis.vbproj.user
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: SCADAViewer.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: simpleW.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \examples_c_cpp\RealTimeChartSimple_cppGlgChart.cppGlgChart.hGlgRTChartSimpleG.cpprealtime_chart_cpp.slnrealtime_chart_cpp.vcxprojrealtime_chart_cpp.vcxproj.filtersrealtime_chart_cpp.vcxproj.user
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: gis.slnC
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \DEMOS_C#\ElectricCircuitElectricCircuit.csprojElectricCircuit.exeElectricCircuit.exe.configElectricCircuit.slnGlgElectricCircuit.csGlgElectricCircuit.resxelectric.ico
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \DEMOS_C#\TrajectoryGlgTrajectoryDemo.csGlgTrajectoryDemo.resxTrajectory.csprojTrajectory.exeTrajectory.exe.configTrajectory.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \DEMOS_C#\FighterJetFighterJet.csprojFighterJet.exeFighterJet.exe.configFighterJet.slnGlgFighterJetDemo.csf35.ico
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Process.sln
Source: Dashboard.sln.0.dr	Binary or memory string: Project("{F184B08F-C81C-45F6-A57F-5ABD9991F28F}") = "Dashboard", "Dashboard.vbproj", "{6ACB611A-28EC-48F9-86B5-444408FE8284}"
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.00000000006BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c.slnigs
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: Aircombat.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: GlgExample.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \DEMOS\gis_demogis_demo.cgis_demo.exegis_demo.ggis_demo.hgis_demo.icogis_demo.slngis_demo.vcxprojgis_demo.vcxproj.filtersgis_demo.vcxproj.user
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Map.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: FighterJet.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \DEMOS_C#\ComboChartChartConfigRecord.csChartDataFeedInterface.csChartDemoDataFeed.csChartInfo.csChartLiveDataFeed.csComboChart.csprojComboChart.exeComboChart.exe.configComboChart.icoComboChart.slnGlgComboChart.csGlgRTChartForm.Designer.csGlgRTChartForm.csGlgRTChartForm.resxPlotDataPoint.csPlotInfo.csProgram.cs
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \examples_ASP.NET\AvionicsHandlerSourceAvionicsHandler.csprojAvionicsHandler.slnGlgAvionicsHandler.csGlgDemoDataSource.csWeb.configWeb.config.classicWeb.config.integrated
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: ElectricCircuit.csproj!
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2292969316.0000000007260000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: glg_custom_option.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: GraphSelectionHandler.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: example.sln
Source: GlgExample.sln.0.dr	Binary or memory string: Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "GlgExample", "GlgExample.csproj", "{77EE121F-BA45-4E8F-91E5-0168A530DA1E}"
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Animation.csproj.user
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: RealTimeChartSimple.vbprojP
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: Avionics.csproj
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \DEMOS\aircombataircombat.caircombat.exeaircombat.icoaircombat.slnaircombat.vcxprojaircombat.vcxproj.filtersaircombat.vcxproj.userdemo.gdemo_data.c
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Process.csproj
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: SCADAViewer.csproj4
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ObjectSelection.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \DEMOS_C#\AnimationAnimation.csprojAnimation.exeAnimation.exe.configAnimation.slnGlgAnimationDemo.csGlgAnimationDemo.resxanimation.ico
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: controlsGcpp.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: RealTimeChartSimple.vbproj\
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \DEMOS\process_demoprocess.exeprocess.icoprocess.slnprocess.vcxprojprocess.vcxproj.filtersprocess.vcxproj.userprocessG.c
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \DEMOS\airtrafficairtraffic.cairtraffic.exeairtraffic.gairtraffic.hairtraffic.icoairtraffic.slnairtraffic.vcxprojairtraffic.vcxproj.filtersairtraffic.vcxproj.user
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: GraphSelectionHandler.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: Diagram.sln\|
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: RealTimeChartSimple.csproj
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Satellite.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: animation.vbproj
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DialHandler.csproj
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: controlsG.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: GlgExample.slnz
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FighterJet.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: GlgExample.sln}
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: ProcessHandler.csproj
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Avionics.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: graph_layout.sln$W6
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: SimpleViewer.vbproj
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \examples_vbnet_ocx\RealTimeChartSimpleRealTimeChartSimple.slnRealTimeChartSimple.vbprojRealTimeChartSimple.xml
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: mapG.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: gis.vbproj.user
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: animation.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: GraphSelectionHandler.csproj
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AirTraffic.csproj
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: Controls.csproj2
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \examples_csharp_ocx\BarGraph2DApp.icoForm1.csGlgExample.csprojGlgExample.csproj.userGlgExample.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ComboChart.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DialHandler.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \DEMOS_C#\GraphLayoutGlgGraphLayoutDemo.csGlgGraphLayoutDemo.resxGraphLayout.csprojGraphLayout.exeGraphLayout.exe.configGraphLayout.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: exampleG.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \examples_mfc\ObjectPositionObjectPosition.apsObjectPosition.clwObjectPosition.cppObjectPosition.hObjectPosition.rcObjectPosition.slnObjectPosition.vcxprojObjectPosition.vcxproj.filtersObjectPosition.vcxproj.userObjectPositionDoc.cppObjectPositionDoc.hObjectPositionView.cppObjectPositionView.hnew_diagram.g
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Trajectory.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: Avionics.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \examples_csharp.NET\RealTimeChartGlgChart.csRealTimeChart.csproj.user
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: gis_demo.slnxN
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \examples_c_cpp\controlsGlgControlWidgetG.cGlgControlWidgetG.cppGlgControlWidgetX.cGlgControlWidgetX.cppcontrolsG.slncontrolsG.vcxprojcontrolsG.vcxproj.filterscontrolsG.vcxproj.usercontrolsGcpp.slncontrolsGcpp.vcxprojcontrolsGcpp.vcxproj.filterscontrolsGcpp.vcxproj.user
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: gis.vbproj
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: Process.csproj
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: Map.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: RealTimeChartSimple.vbproj
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: Animation.csproj
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: SimpleViewer.csproj
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: RealTimeChartSimple.csproj
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: controlsGcpp.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: GraphHandler.csproj
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \examples_ASP.NET\DialHandlerSourceDialHandler.csprojDialHandler.slnGlgDialHandler.cs
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: RealTimeChart.slnj
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Animation.csproj
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Skipped: SCADAViewer.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: GlgExample.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: gis.csproj9
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AvionicsHandler.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \SimpleViewer\SingleThreaded\VB.NETSimpleViewer.vbprojSimpleViewer.vbproj.userSimpleViewer.xml
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: exampleG.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: Trajectory.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \examples_csharp_ocx\RealTimeChartSimpleRealTimeChartSimple.csproj
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: gis_demo.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: Map.csproj
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: gis.csproj.user
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \examples_vbnet_ocx\animationClassDiagram1.cdanimation.slnanimation.vbprojanimation.vbproj.useranimation.xml
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \examples_csharp.NET\DashboardDashboard.csproj
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: DialHandler.csproj
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: realtime_chart_cpp.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: animation.vbproj
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: graph_layout.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: SimpleViewer.slnlc
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: GlgExample.csproj.user3
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \SimpleViewer\MultiThreaded\CSimpleViewer.slnSimpleViewer.vcxprojSimpleViewer.vcxproj.filtersSimpleViewer.vcxproj.userdemo_datafeed.clibzmq-v100-mt-4_0_4.dlllibzmq-v100-mt-gd-4_0_4.dlllive_datafeed.craw_data.htags_example.gtelemetry_GPS.g
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: graphs.vbproj
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: simpleGcpp.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \examples_vbnet_ocx\gisgis.slngis.vbprojgis.vbproj.usergis.xml
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: GISHandler.slne
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: satellite.slndN
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.00000000006BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: SCADAViewer.slnX
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: graphs.sln!
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: RealTimeChart.csproj.userHC
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: GISHandler.csproj.xG
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2292969316.0000000007260000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: glg_custom_data.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: animationW.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \examples_mfc\BarGraph2DMainFrm.cppMainFrm.hReadMe.txtResource.hStdAfx.cppStdAfx.hUpgradeLog.htmexample.clwexample.cppexample.rcexample.slnexample.vcxprojexample.vcxproj.filtersexample.vcxproj.userexampleDoc.cppexampleDoc.hexampleView.cppexampleView.h
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: SCADAViewer.slnT
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: process.vbproj.user
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FighterJet.csproj
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: process.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: RealTimeChartSimple.slnN
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2292969316.0000000007260000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: glg_custom_proto.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: realtime_chart_cpp.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Animation.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: animationW.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \examples_ASP.NET\GraphSelectionHandlerSourceGlgGraphSelectionHandler.csGraphSelectionHandler.csprojGraphSelectionHandler.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: process.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: Dashboard.slnh
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: ObjectSelection.csprojP
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: SimpleViewer.slnL`
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \DEMOS\map_democritical.gdefault.gfacilities_sfacilities_windeterm.glinks_slinks_wmajor.gmap.exemap.icomapG.cmapG.slnmapG.vcxprojmapG.vcxproj.filtersmapG.vcxproj.usermap_demo.gmap_proto.hno_alarms.gno_alarms.gifus_map.gwarning.gworld_map.g
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: CircuitHandler.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: simpleGcpp.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: gis.vbproj
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: Satellite.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: animationGcpp.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SimpleViewer.vbproj.user
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: animation.vbproj.userR
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: Dashboard.vbproj
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CircuitHandler.csproj
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: SCADAViewer.sln<
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: Process.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: GraphLayout.csproj
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \examples_c_cpp\BarGraph2DGlgClass.cppGlgExampleG.cGlgExampleG.cppGlgExampleW.cGlgExampleX.cGlgExampleX.cppGlgSimpleG.cGlgSimpleG.cppGlgSimpleW.cGlgSimpleX.cGlgSimpleX.cppREADME_BUILD_CPP.txtUpgradeLog2.htmUpgradeLog3.htmexampleG.slnexampleG.vcxprojexampleG.vcxproj.filtersexampleG.vcxproj.userexampleGcpp.slnexampleGcpp.vcxprojexampleGcpp.vcxproj.filtersexampleGcpp.vcxproj.userexampleW.slnexampleW.vcxprojexampleW.vcxproj.filtersexampleW.vcxproj.usersimpleG.slnsimpleG.vcxprojsimpleG.vcxproj.filterssimpleG.vcxproj.usersimpleGcpp.slnsimpleGcpp.vcxprojsimpleGcpp.vcxproj.filterssimpleGcpp.vcxproj.usersimpleW.slnsimpleW.vcxprojsimpleW.vcxproj.filterssimpleW.vcxproj.user
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \DEMOS\satelliteresource1.hsatellite.csatellite.exesatellite.gsatellite.icosatellite.slnsatellite.vcxprojsatellite.vcxproj.usertrajectory.ctrajectory.gtrajectory.icoutil.h
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SimpleViewer.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: graphs.vbproj.user
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Dashboard.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \examples_c_cpp\RealTimeChartSimpleGlgRTChartSimpleG.crealtime_chart.iobjrealtime_chart.ipdbrealtime_chart.slnrealtime_chart.vcxprojrealtime_chart.vcxproj.filtersrealtime_chart.vcxproj.user
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: simpleG.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: glg_custom_data.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: ComboChart.csproj
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: process.vbproj.user2
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \examples_ASP.NET\SimpleViewerHandlerSourceGlgSimpleViewerHandler.csGlgTagRecord.csHandlerErrorInterface.csSimpleViewerHandler.csprojSimpleViewerHandler.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SimpleViewerHandler.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: Controls.sln]
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: SimpleViewerHandler.csproj
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: gis.csproj.user4
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \DEMOS_C#\DiagramDiagram.csprojDiagram.exeDiagram.exe.configDiagram.slnGlgDiagram.csGlgDiagram.resx
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: SimpleViewer.csproj.user:HS
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \examples_c_cpp\animationGlgAnimationG.cGlgAnimationG.cppGlgAnimationW.cGlgAnimationX.cGlgAnimationX.cppanimationG.slnanimationG.vcxprojanimationG.vcxproj.useranimationGcpp.slnanimationGcpp.vcxprojanimationGcpp.vcxproj.useranimationW.slnanimationW.vcxprojanimationW.vcxproj.useranimation_test.g
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: GlgExample.csprojz
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Dashboard.csproj
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: Dashboard.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: process.vbproj
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: ObjectPosition.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: gis.csproj.user
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: RealTimeChart.csproj
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: GraphHandler.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: RobotArm.csproj
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SimpleViewer.vbproj
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: process.sln%N
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: AirTraffic.csprojr
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CircuitHandler.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: animation.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \DEMOS_C#\SatelliteGlgSatelliteDemo.csGlgSatelliteDemo.resxSatellite.csprojSatellite.exeSatellite.exe.configSatellite.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: RealTimeChartSimple.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ElectricCircuit.csproj
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: exampleGcpp.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: gis.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: AirTraffic.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: GlgExample.csproj.user
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: GISHandler.csproj
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \DEMOS_C#\RobotArmGlgRobotArmDemo.csGlgRobotArmDemo.resxRobotArm.csprojRobotArm.exeRobotArm.exe.configRobotArm.slnrobot.ico
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: gis.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SimpleViewerHandler.csproj
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: GlgExample.csprojZ
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \examples_vbnet_ocx\DashboardApp.configDashboard.slnDashboard.vbprojDashboard.xmlForm1.Designer.vb
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: RealTimeChart.csproj
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: ProcessHandler.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: satellite.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: graphs.vbproj.user
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ObjectSelection.csproj
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \examples_csharp.NET\ObjectSelectionObjectSelection.csprojObjectSelection.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: animation.vbproj.user
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SimpleViewer.csproj.user
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: GlgExample.csproj.user
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: realtime_chart.slnL
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: SimpleViewer.vbprojUB"
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Trajectory.csproj
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: ComboChart.slnv!
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: ObjectSelection.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \DEMOS_C#\ControlsControls.csprojControls.exeControls.exe.configControls.slnGlgControlsDemo.csGlgControlsDemo.resxcontrols.ico
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: diagramG.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: FighterJet.csproj
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: SimpleViewer.vbproj.user
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: RobotArm.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: RealTimeChartSimple.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: airtraffic.slnjN
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \DEMOS\RealTime_StripChartScript1.rcStripChart.exeStripChart.icoStripChart.slnStripChart.vcxprojStripChart.vcxproj.filtersStripChart.vcxproj.userresource.hstripchart.cstripchart.gstripchart.h
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SimpleViewer.csproj
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: RealTimeChart.sln
Source: process.sln0.0.dr	Binary or memory string: Project("{F184B08F-C81C-45F6-A57F-5ABD9991F28F}") = "process", "process.vbproj", "{2CC0CD35-CC3F-48C8-A5D4-45D4F5C82441}"
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Aircombat.csproj
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: AvionicsHandler.csproj'
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: Animation.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: example.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: GlgExample.csproj.userv
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: graphs.vbproj
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Skipped: SCADAViewer.csproj
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Satellite.csproj
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Map.csproj
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ElectricCircuit.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \examples_csharp_ocx\GISgis.csprojgis.csproj.user
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: RealTimeChart.csprojL
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: glg_custom_option.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: RobotArm.csproj
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: GIS.slnM
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: Trajectory.csprojD
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: gis.csproj
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \DEMOS_C#\SCADAViewerActivePopupRecord.csAerationPage.csAlarmDialog.Designer.csAlarmDialog.csAlarmDialog.resxAlarmPage.csAlarmRecord.csAlarmSPInfo.csAlarmTableWidget.csChartWidget.csCircuitPage.csDataRecord.csDialogWidgetBase.csEmptyPage.csGlgViewer.csHMIPageC.csMainForm.Designer.csMainForm.csMainForm.resxMainLayoutPage.csMenuRecord.csMessageDialogC.csREADME_SCADA_BUILD_CSHARP.txtRTChartPage.csSCADAViewer.csprojSCADAViewer.exe.configScadaProcessDemoPage.csTagRecord.csUserRoleWidget.cs
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: Controls.csproj
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \DEMOS_C#\GISGIS.csprojGIS.exeGIS.exe.configGIS.slnGlgGISDemo.csGlgGISDemo.resx
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \examples_vbnet_ocx\BarGraph2DAssemblyInfo.vbAxInterop.GlgoleLib.dllForm1.resxForm1.vbgraphs.slngraphs.vbprojgraphs.vbproj.usergraphs.xml
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.0000000000717000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: StripChart.sln'J
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: exampleW.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Aircombat.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \examples_ASP.NET\GraphHandlerSourceGlgGraphHandler.csGraphHandler.csprojGraphHandler.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: GraphSelectionHandler.csproj
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: Satellite.csproj
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: CircuitHandler.csproj
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: RealTimeChart.csprojA
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \editor_extensions\custom_proto_exampleglg_custom_proto.dllglg_custom_proto.hglg_custom_proto.slnglg_custom_proto.vcxprojglg_custom_proto.vcxproj.filtersglg_custom_proto.vcxproj.userrun_proto_example.bat
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \editor_extensions\data_browser_exampleglg_custom_data.dllglg_custom_data.hglg_custom_data.slnglg_custom_data.vcxprojglg_custom_data.vcxproj.filtersglg_custom_data.vcxproj.userrun_data_example.batsample_simple.c
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: GraphLayout.csprojb
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Diagram.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: GISHandler.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: AirTraffic.csprojR
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: Aircombat.csproj
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: GlgExample.csproj$
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: AvionicsHandler.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: SCADAViewer.csproj
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: animationGcpp.sln$
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: Controls.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \editor_extensions\custom_option_examplecustom_editor_icons.gcustom_hmi_icons.gglg_custom_dll.hglg_custom_dll.objglg_custom_editor_dll.hglg_custom_editor_dll.objglg_custom_option.dllglg_custom_option.hglg_custom_option.slnglg_custom_option.vcxprojglg_custom_option.vcxproj.filtersglg_custom_option.vcxproj.usergoto_action_dialog.gprop_dialog.grun_option_example.batsample.csample_handler.gwrite_action_dialog.g
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: StripChart.sln
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2291796513.0000000003413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: GraphHandler.csproj
Source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000062E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Extract: aircombat.sln

Source: classification engine

Classification label: clean12.rans.winEXE@2/1025@0/0

Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe

File created: C:\Program Files\GlgCE.4.4_x64

Jump to behavior

Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe

Mutant created: \Sessions\1\BaseNamedObjects\GlgToolkitMutex

Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe

File created: C:\Users\user\AppData\Local\Temp\nsy1C0A.tmp

Jump to behavior

Source: SetupGLG-CE-4-4-x64-vs2015.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe

File read: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe "C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe"
Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Section loaded: ddraw.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Section loaded: dciman32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Section loaded: hid.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Section loaded: actxprxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Section loaded: explorerframe.dll	Jump to behavior

Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Found installer window with terms and condition text

Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe

Creates a directory in C:\Program Files

Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\RealTime_StripChart	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\RealTime_StripChart\Script1.rc	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\RealTime_StripChart\StripChart.exe	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\RealTime_StripChart\StripChart.ico	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\RealTime_StripChart\StripChart.sln	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\RealTime_StripChart\StripChart.vcxproj	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\RealTime_StripChart\StripChart.vcxproj.filters	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\RealTime_StripChart\StripChart.vcxproj.user	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\RealTime_StripChart\resource.h	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\RealTime_StripChart\stripchart.c	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\RealTime_StripChart\stripchart.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\RealTime_StripChart\stripchart.h	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\AerationPage.c	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\AerationPage.h	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\AlarmPage.c	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\AlarmPage.h	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\AlarmTableWidget.c	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\AlarmTableWidget.h	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\ChartWidget.c	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\ChartWidget.h	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\CircuitPage.c	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\CircuitPage.h	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\DataFeed.c	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\DataFeed.h	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\DataTypes.h	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\DemoDataFeed.c	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\DemoDataFeed.h	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\EmptyPage.c	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\EmptyPage.h	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\GlgViewer.c	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\GlgViewer.h	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\GlgWidget.c	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\GlgWidget.h	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\HMIPage.c	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\HMIPage.h	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\LiveDataFeed.c	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\LiveDataFeed.h	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\MainLayoutPage.c	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\MainLayoutPage.h	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\ProcessDemoPage.c	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\ProcessDemoPage.h	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\README_MODULE_DESCRIPTIONS.txt	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\README_SCADA_VIEWER.txt	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\README_SCADA_VIEWER_BUILD.txt	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\RTChartPage.c	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\RTChartPage.h	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\SCADAViewer.exe	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\SCADAViewer.sln	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\SCADAViewer.vcxproj	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\SCADAViewer.vcxproj.filters	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\SCADAViewer.vcxproj.user	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\Script1.rc	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\UserRoleWidget.c	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\UserRoleWidget.h	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\config.c	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\main.c	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\resource.h	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\scada.h	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\scada.ico	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\util.c	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\HELP_AERATION_PAGE.txt	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\HELP_COMMAND_SAMPLES.txt	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\HELP_MAIN_LAYOUT.txt	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\HELP_RTCHART_PAGE.txt	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\HELP_RTCHART_PAGE_EXT.txt	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\HELP_SCADA_CONFIG.txt	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\alarm_button_obj.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\alarms.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\config_alarms.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\edit_alarm_sp.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\edit_analog_value.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\empty_drawing.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\engine.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\engine_measurements.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\fonttable_file.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\glg_scrollbar_h.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\glg_scrollbar_v.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\help.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\main_layout_buttons.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\main_layout_tabs.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\message_dialog.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\popup_menu_3state.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\popup_on_off.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\popup_open_close.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\popup_start_stop.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\popup_viewport.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\rtchart.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\rtchart_page.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\rtchart_page_ext.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\rtchart_scroll.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\rtchart_scroll_1axis.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\scada_aeration.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\scada_config_main_drawing.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\scada_config_menu.txt	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\scada_drill_down.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\scada_electric.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\scada_motor_info.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\scada_process.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\scada_test_commands.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\scada_test_commands.g.1095x780	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\template_drawing.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\template_drawing.g.1200x900	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\template_drawing.g.900x750	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\user_role.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\waste_heat_boiler.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\zoom_panel_h.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\zoom_panel_v.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\subdrawings	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\subdrawings\analog_value.sd	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\subdrawings\analog_value_adjustment.sd	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\SCADAViewer\drawings\subdrawings\digital_input.sd	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\aircombat	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\aircombat\Script1.rc	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\aircombat\aircombat.c	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\aircombat\aircombat.exe	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\aircombat\aircombat.ico	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\aircombat\aircombat.sln	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\aircombat\aircombat.vcxproj	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\aircombat\aircombat.vcxproj.filters	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\aircombat\aircombat.vcxproj.user	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\aircombat\demo.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\aircombat\demo_data.c	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\aircombat\resource.h	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\airtraffic	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\airtraffic\Script1.rc	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\airtraffic\airtraffic.c	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\airtraffic\airtraffic.exe	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\airtraffic\airtraffic.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\airtraffic\airtraffic.h	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\airtraffic\airtraffic.ico	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\airtraffic\airtraffic.sln	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\airtraffic\airtraffic.vcxproj	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\airtraffic\airtraffic.vcxproj.filters	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\airtraffic\airtraffic.vcxproj.user	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\airtraffic\resource.h	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\diagram	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\diagram\README.txt	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\diagram\Script1.rc	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\diagram\diagram.exe	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\diagram\diagram.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\diagram\diagram.ico	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\diagram\diagramG.c	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\diagram\diagramG.sln	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\diagram\diagramG.vcxproj	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\diagram\diagramG.vcxproj.user	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\diagram\diagramG2.c	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\diagram\diagram_proto.h	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\diagram\diagram_proto2.h	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\diagram\diagram_template.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\diagram\p_diagram.ico	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\diagram\process_diagram.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\diagram\process_template.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\diagram\resource.h	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\gis_demo	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\gis_demo\README.txt	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\gis_demo\Script1.rc	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\gis_demo\gis_demo.c	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\gis_demo\gis_demo.exe	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\gis_demo\gis_demo.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\gis_demo\gis_demo.h	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\gis_demo\gis_demo.ico	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\gis_demo\gis_demo.sln	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\gis_demo\gis_demo.vcxproj	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\gis_demo\gis_demo.vcxproj.filters	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\gis_demo\gis_demo.vcxproj.user	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\gis_demo\resource.h	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\gis_demo\example	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\gis_demo\example\gis_demo_simple.c	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\gis_demo\example\gis_demo_simple.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\graph_layout	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\graph_layout\GlgGraphLayoutDemoG.c	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\graph_layout\graph.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\graph_layout\graph_layout.exe	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\graph_layout\graph_layout.ico	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\graph_layout\graph_layout.rc	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\graph_layout\graph_layout.sln	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\graph_layout\graph_layout.vcxproj	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\graph_layout\graph_layout.vcxproj.user	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\graph_layout\palette.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\graph_layout\resource.h	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\main_demo	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\main_demo\GlgDemo.exe	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\map_demo	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\map_demo\Script1.rc	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\map_demo\critical.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\map_demo\default.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\map_demo\diagram.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\map_demo\facilities_s	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\map_demo\facilities_w	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\map_demo\indeterm.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\map_demo\links_s	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\map_demo\links_w	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\map_demo\major.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\map_demo\map.exe	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\map_demo\map.ico	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\map_demo\mapG.c	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\map_demo\mapG.sln	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\map_demo\mapG.vcxproj	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\map_demo\mapG.vcxproj.filters	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\map_demo\mapG.vcxproj.user	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\map_demo\map_demo.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\map_demo\map_proto.h	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\map_demo\no_alarms.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\map_demo\no_alarms.gif	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\map_demo\palette.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\map_demo\resource.h	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\map_demo\us_map.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\map_demo\warning.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\map_demo\world_map.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\process_demo	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\process_demo\README.txt	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\process_demo\Script1.rc	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\process_demo\process.exe	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\process_demo\process.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\process_demo\process.ico	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\process_demo\process.sln	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\process_demo\process.vcxproj	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\process_demo\process.vcxproj.filters	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\process_demo\process.vcxproj.user	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\process_demo\processG.c	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\process_demo\resource.h	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\satellite	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\satellite\README.txt	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\satellite\Script1.rc	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\satellite\main.c	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\satellite\resource1.h	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\satellite\satellite.c	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\satellite\satellite.exe	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\satellite\satellite.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\satellite\satellite.ico	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\satellite\satellite.sln	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\satellite\satellite.vcxproj	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\satellite\satellite.vcxproj.user	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\satellite\trajectory.c	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\satellite\trajectory.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\satellite\trajectory.ico	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\satellite\util.c	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\satellite\util.h	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\custom_objects.pal	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\palettes.pls	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\avionics	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\avionics\avio1.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\avionics\avio10.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\avionics\avio11.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\avionics\avio12.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\avionics\avio13.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\avionics\avio14.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\avionics\avio15.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\avionics\avio16.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\avionics\avio2.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\avionics\avio3.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\avionics\avio4.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\avionics\avio5.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\avionics\avio6.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\avionics\avio7.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\avionics\avio8.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\avionics\avio9.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\avionics\avionics.pal	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\alarm1.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button1.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button10.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button11.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button12.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button13.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button14.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button15.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button16.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button17.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button18.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button20.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button21.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button22.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button23.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button24.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button25.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button26.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button28.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button29.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button3.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button30.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button31.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button32.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button33.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button34.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button35.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button36.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button37.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button38.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button39.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button4.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button40.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button41.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button42.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button43.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button44.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button45.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button46.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button47.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button48.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button49.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button5.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button50.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button51.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button52.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button53.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button54.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button55.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button56.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button6.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button7.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button8.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\button9.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\buttons.pal	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\date_time.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\dials.pal	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\gauge1.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\gauge3.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\gauge4.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\gauges.pal	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\indicator1.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\indicator10.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\indicator12.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\indicator13.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\indicator14.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\indicator15.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\indicator16.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\indicator17.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\indicator18.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\indicator19.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\indicator2.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\indicator20.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\indicator21.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\indicator22.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\indicator23.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\indicator24.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\indicator25.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\indicator26.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\indicator27.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\indicator28.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\indicator29.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\indicator3.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\indicator30.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\indicator31.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\indicator32.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\indicator33.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\indicator34.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\indicator35.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\indicator4.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\indicator5.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\indicator6.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\indicator7.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\indicator8.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\indicator9.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\indicators.pal	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\joystick1.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\joystick2.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\joystick3.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\joystick4.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\knob1.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\knob10.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\knob11.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\knob12.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\knob13.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\knob14.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\knob15.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\knob16.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\knob17.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\knob18.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\knob19.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\knob2.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\knob20.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\knob21.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\knob3.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\knob4.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\knob5.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\knob6.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\knob8.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\knob9.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\knobs.pal	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\label1.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\lat1.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\latlon1.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\latlon2.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\led1.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\led2.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\led3.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\led4.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\led5.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\led6.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\linear_gauges.pal	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\lon1.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter1.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter10.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter11.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter12.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter13.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter14.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter15.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter16.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter17.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter2.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter26.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter27.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter3.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter32.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter33.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter34.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter35.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter36.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter37.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter38.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter39.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter4.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter40.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter41.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter42.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter43.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter44.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter45.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter46.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter47.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter48.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter49.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter5.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter50.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter51.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter52.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter53.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter54.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter55.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter56.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter57.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter58.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter59.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter6.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter60.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter61.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter62.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter63.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter64.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter65.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter66.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter7.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter8.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\meter9.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider1.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider10.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider11.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider12.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider13.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider14.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider15.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider16.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider18.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider19.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider2.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider20.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider21.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider22.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider23.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider24.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider25.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider26.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider27.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider28.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider29.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider3.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider30.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider31.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider32.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider33.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider34.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider35.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider36.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider37.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider38.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider39.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider4.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider40.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider41.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider42.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider43.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider44.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider45.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider46.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider47.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider48.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider49.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider50.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider51.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider6.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\slider7.g	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\sliders.pal	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Directory created: C:\Program Files\GlgCE.4.4_x64\DEMOS\widgets\controls\switch1.g	Jump to behavior

Creates a software uninstall entry

Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GlgToolkitCE(x64)4.4

Jump to behavior

PE / OLE file has a valid certificate

Source: SetupGLG-CE-4-4-x64-vs2015.exe

Static PE information: certificate valid

Submission file is bigger than most known malware samples

Source: SetupGLG-CE-4-4-x64-vs2015.exe

Static file information: File size 46456984 > 1048576

Binary contains paths to debug symbols

Source:	Binary string: X:\devel.4.4.vs2015\demo_process\x64\Release_Static\processS.pdb source: process.exe.0.dr
Source:	Binary string: X:\devel.4.4.vs2015\x64\Release\libdyn.pdb source: SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000003.1829526171.0000000003736000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: X:\devel.4.4.vs2015\cs\examples_ASP.NET\DialHandlerSource\obj\Release\DialHandler.pdb source: DialHandler.dll.0.dr
Source:	Binary string: X:\devel.4.4.vs2015\cs\glg.net\obj\Release_ce\Glg.NetCE.pdb source: Glg.NetCE.dll14.0.dr, Glg.NetCE.dll18.0.dr, Glg.NetCE.dll19.0.dr, Glg.NetCE.dll3.0.dr, Glg.NetCE.dll8.0.dr, Glg.NetCE.dll11.0.dr, Glg.NetCE.dll2.0.dr, Glg.NetCE.dll12.0.dr, Glg.NetCE.dll6.0.dr
Source:	Binary string: X:\jurassic_lib.4.6.2\Jurassic\obj\Release\JurassicGLG.pdb source: JurassicGLG.dll.0.dr, JurassicGLG.dll20.0.dr, JurassicGLG.dll11.0.dr, JurassicGLG.dll9.0.dr, JurassicGLG.dll7.0.dr, JurassicGLG.dll17.0.dr, JurassicGLG.dll14.0.dr, JurassicGLG.dll4.0.dr, JurassicGLG.dll16.0.dr

Data Obfuscation

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe

Code function: 0_2_10001D3B GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyA,GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,lstrcatA,GetProcAddress,

Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GLG CE 4.4 x64, Demos Online\Demos, HTML5 & JavaScript (Web, Client Side).lnk	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GLG CE 4.4 x64, Demos Online\Demos, JSP & ASP (Web, Server-Side).lnk	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GLG CE 4.4 x64, Demos Java\Demos, Java (Running Instructions).lnk	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GLG CE 4.4 x64, Demos C,C++\Main Demo, OpenGL.lnk	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GLG CE 4.4 x64, Demos C,C++ GDI\Main Demo, GDI.lnk	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GLG CE 4.4 x64, Demos C,C++\Robot Arm Demo, OpenGL.lnk	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GLG CE 4.4 x64, Demos C,C++ GDI\Robot Arm Demo, GDI.lnk	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GLG CE 4.4 x64, Demos C,C++\Controls Demo, OpenGL.lnk	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GLG CE 4.4 x64, Demos C,C++ GDI\Controls Demo, GDI.lnk	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GLG CE 4.4 x64, Demos C,C++\F-35 Lightning II Demo, OpenGL.lnk	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GLG CE 4.4 x64, Demos C,C++ GDI\F-35 Lightning II Demo, GDI.lnk	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GLG CE 4.4 x64, Demos C,C++\Aircombat Demo, OpenGL.lnk	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GLG CE 4.4 x64, Demos C,C++ GDI\Aircombat Demo, GDI.lnk	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GLG CE 4.4 x64, Demos C,C++\Air Traffic Demo, OpenGL.lnk	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GLG CE 4.4 x64, Demos C,C++ GDI\Air Traffic Demo, GDI.lnk	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GLG CE 4.4 x64, Demos C,C++\Diagram Editor Demo, OpenGL.lnk	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GLG CE 4.4 x64, Demos C,C++ GDI\Diagram Editor Demo, GDI.lnk	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GLG CE 4.4 x64, Demos C,C++\Process Diagram Demo, OpenGL.lnk	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GLG CE 4.4 x64, Demos C,C++ GDI\Process Diagram Demo, GDI.lnk	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GLG CE 4.4 x64, Demos C,C++\SCADA Viewer Demo, OpenGL.lnk	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GLG CE 4.4 x64, Demos C,C++ GDI\SCADA Viewer Demo, GDI.lnk	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GLG CE 4.4 x64, Demos C,C++\Real-Time Strip-Chart, OpenGL.lnk	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GLG CE 4.4 x64, Demos C,C++ GDI\Real-Time Strip-Chart, GDI.lnk	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GLG CE 4.4 x64, Demos C,C++\Process Monitoring Demo, OpenGL.lnk	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GLG CE 4.4 x64, Demos C,C++ GDI\Process Monitoring Demo, GDI.lnk	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GLG CE 4.4 x64, Demos C,C++\Map Demo, OpenGL.lnk	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GLG CE 4.4 x64, Demos C,C++ GDI\Map Demo, GDI.lnk	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GLG CE 4.4 x64, Demos C,C++\GIS Demo, OpenGL.lnk	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GLG CE 4.4 x64, Demos C,C++ GDI\GIS Demo, GDI.lnk	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GLG CE 4.4 x64, Demos C,C++\Satellite Demo, OpenGL.lnk	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GLG CE 4.4 x64, Demos C,C++ GDI\Satellite Demo, GDI.lnk	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GLG CE 4.4 x64, Demos C,C++\Trajectory Demo, OpenGL.lnk	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GLG CE 4.4 x64, Demos C,C++ GDI\Trajectory Demo, GDI.lnk	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GLG CE 4.4 x64, Demos C,C++\Graph Layout Demo, OpenGL.lnk	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GLG CE 4.4 x64, Demos C,C++ GDI\Graph Layout Demo, GDI.lnk	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GLG CE 4.4 x64, Demos C# .NET\Aircombat Demo.lnk	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GLG CE 4.4 x64, Demos C# .NET\Air Traffic Demo.lnk	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GLG CE 4.4 x64, Demos C# .NET\Diagram Editor Demo.lnk	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GLG CE 4.4 x64, Demos C# .NET\Process Diagram Demo.lnk	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GLG CE 4.4 x64, Demos C# .NET\SCADA Viewer Demo.lnk	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GLG CE 4.4 x64, Demos C# .NET\Real-Time Strip-Chart.lnk	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GLG CE 4.4 x64, Demos C# .NET\Combo Chart.lnk	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GLG CE 4.4 x64, Demos C# .NET\Process Monitoring Demo.lnk	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GLG CE 4.4 x64, Demos C# .NET\Map Demo.lnk	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GLG CE 4.4 x64, Demos C# .NET\GIS Demo.lnk	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GLG CE 4.4 x64, Demos C# .NET\Satellite Demo.lnk	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GLG CE 4.4 x64, Demos C# .NET\Trajectory Demo.lnk	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GLG CE 4.4 x64, Demos C# .NET\Graph Layout Demo.lnk	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GLG CE 4.4 x64, Demos C# .NET\Robot Arm Demo.lnk	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GLG CE 4.4 x64, Demos C# .NET\Avionics Demo.lnk	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GLG CE 4.4 x64, Demos C# .NET\Controls Demo.lnk	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GLG CE 4.4 x64, Demos C# .NET\Electric Circuit Demo.lnk	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GLG CE 4.4 x64, Editors\Graphics Builder CE, OpenGL.lnk	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GLG CE 4.4 x64, Editors\Graphics Builder CE, GDI.lnk	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GLG CE 4.4 x64, Editors\OEM Graphics Builder CE, OpenGL.lnk	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GLG CE 4.4 x64, Editors\OEM Graphics Builder CE, GDI.lnk	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GLG CE 4.4 x64, Editors\HMI Configurator CE, OpenGL.lnk	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GLG CE 4.4 x64, Editors\HMI Configurator CE, GDI.lnk	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GLG CE 4.4 x64, Editors\OEM ReadMe.lnk	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GLG CE 4.4 x64, Documentation\GLG Reference Manuals and Tutorials.lnk	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GLG CE 4.4 x64, Documentation\GLG Java API Online Reference.lnk	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GLG CE 4.4 x64, Documentation\GLG C# API Online Reference.lnk	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GLG CE 4.4 x64, Documentation\GLG JavaScript API Online Reference.lnk	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GLG CE 4.4 x64, Documentation\Programming Examples.lnk	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GLG CE 4.4 x64, Editors\Uninstall.lnk	Jump to behavior

Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Dropped PE file which has not been started: C:\Program Files\GlgCE.4.4_x64\DEMOS_C#\GIS\Glg.NetCE.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Dropped PE file which has not been started: C:\Program Files\GlgCE.4.4_x64\examples_csharp_ocx\BarGraph2D\Interop.GlgoleLib.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Dropped PE file which has not been started: C:\Program Files\GlgCE.4.4_x64\DEMOS_C#\ComboChart\JurassicGLG.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nse1CC8.tmp\HwInfo.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Dropped PE file which has not been started: C:\Program Files\GlgCE.4.4_x64\DEMOS_C#\Trajectory\JurassicGLG.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Dropped PE file which has not been started: C:\Program Files\GlgCE.4.4_x64\examples_ASP.NET\AvionicsHandlerSource\AvionicsHandler\bin\AvionicsHandler.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Dropped PE file which has not been started: C:\Program Files\GlgCE.4.4_x64\DEMOS_C#\GIS\JurassicGLG.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Dropped PE file which has not been started: C:\Program Files\GlgCE.4.4_x64\examples_vbnet_ocx\RealTimeChartSimple\AxInterop.GlgoleLib.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Dropped PE file which has not been started: C:\Program Files\GlgCE.4.4_x64\examples_csharp_ocx\BarGraph2D\AxInterop.GlgoleLib.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Dropped PE file which has not been started: C:\Program Files\GlgCE.4.4_x64\examples_ASP.NET\DialHandlerSource\DialHandler\bin\DialHandler.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nse1CC8.tmp\UserInfo.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Dropped PE file which has not been started: C:\Program Files\GlgCE.4.4_x64\examples_ASP.NET\GraphHandlerSource\GraphHandler\bin\GraphHandler.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Dropped PE file which has not been started: C:\Program Files\GlgCE.4.4_x64\examples_vbnet_ocx\animation\AxInterop.GlgoleLib.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Dropped PE file which has not been started: C:\Program Files\GlgCE.4.4_x64\SCADAViewer\C#\JurassicGLG.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Dropped PE file which has not been started: C:\Program Files\GlgCE.4.4_x64\DEMOS\process_demo\process.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Dropped PE file which has not been started: C:\Program Files\GlgCE.4.4_x64\examples_ASP.NET\ProcessHandlerSource\ProcessHandler\bin\ProcessHandler.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Dropped PE file which has not been started: C:\Program Files\GlgCE.4.4_x64\DEMOS_C#\RobotArm\JurassicGLG.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Dropped PE file which has not been started: C:\Program Files\GlgCE.4.4_x64\DEMOS_C#\Controls\JurassicGLG.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Dropped PE file which has not been started: C:\Program Files\GlgCE.4.4_x64\DEMOS_C#\Network\JurassicGLG.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nse1CC8.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Dropped PE file which has not been started: C:\Program Files\GlgCE.4.4_x64\DEMOS_C#\SCADAViewer\JurassicGLG.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Dropped PE file which has not been started: C:\Program Files\GlgCE.4.4_x64\SCADAViewer\C#\Glg.NetCE.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Dropped PE file which has not been started: C:\Program Files\GlgCE.4.4_x64\examples_vbnet_ocx\process\AxInterop.GlgoleLib.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Dropped PE file which has not been started: C:\Program Files\GlgCE.4.4_x64\SimpleViewer\MultiThreaded\C#\Glg.NetCE.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Dropped PE file which has not been started: C:\Program Files\GlgCE.4.4_x64\DEMOS_C#\RealTimeChart\JurassicGLG.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Dropped PE file which has not been started: C:\Program Files\GlgCE.4.4_x64\DEMOS_C#\Satellite\Glg.NetCE.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Dropped PE file which has not been started: C:\Program Files\GlgCE.4.4_x64\DEMOS_C#\ElectricCircuit\Glg.NetCE.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Dropped PE file which has not been started: C:\Program Files\GlgCE.4.4_x64\SimpleViewer\MultiThreaded\C#\JurassicGLG.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Dropped PE file which has not been started: C:\Program Files\GlgCE.4.4_x64\DEMOS_C#\FighterJet\JurassicGLG.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Dropped PE file which has not been started: C:\Program Files\GlgCE.4.4_x64\DEMOS_C#\ComboChart\Glg.NetCE.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Dropped PE file which has not been started: C:\Program Files\GlgCE.4.4_x64\DEMOS_C#\GraphLayout\JurassicGLG.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Dropped PE file which has not been started: C:\Program Files\GlgCE.4.4_x64\DEMOS_C#\Diagram\Glg.NetCE.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Dropped PE file which has not been started: C:\Program Files\GlgCE.4.4_x64\examples_vbnet_ocx\process\Interop.GlgoleLib.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Dropped PE file which has not been started: C:\Program Files\GlgCE.4.4_x64\examples_vbnet_ocx\animation\Interop.GlgoleLib.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Dropped PE file which has not been started: C:\Program Files\GlgCE.4.4_x64\examples_vbnet_ocx\BarGraph2D\AxInterop.GlgoleLib.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Dropped PE file which has not been started: C:\Program Files\GlgCE.4.4_x64\DEMOS_C#\GraphLayout\Glg.Net.GraphLayoutCE.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Dropped PE file which has not been started: C:\Program Files\GlgCE.4.4_x64\DEMOS_C#\Aircombat\Glg.NetCE.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Dropped PE file which has not been started: C:\Program Files\GlgCE.4.4_x64\examples_ASP.NET\SimpleViewerHandlerSource\SimpleViewerHandler\bin\SimpleViewerHandler.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Dropped PE file which has not been started: C:\Program Files\GlgCE.4.4_x64\examples_vbnet_ocx\Dashboard\Interop.GlgoleLib.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Dropped PE file which has not been started: C:\Program Files\GlgCE.4.4_x64\DEMOS_C#\AirTraffic\Glg.NetCE.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Dropped PE file which has not been started: C:\Program Files\GlgCE.4.4_x64\DEMOS_C#\AirTraffic\JurassicGLG.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Dropped PE file which has not been started: C:\Program Files\GlgCE.4.4_x64\examples_vbnet_ocx\gis\Interop.GlgoleLib.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nse1CC8.tmp\nsDialogs.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Dropped PE file which has not been started: C:\Program Files\GlgCE.4.4_x64\DEMOS_C#\Avionics\JurassicGLG.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Dropped PE file which has not been started: C:\Program Files\GlgCE.4.4_x64\examples_vbnet_ocx\BarGraph2D\Interop.GlgoleLib.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Dropped PE file which has not been started: C:\Program Files\GlgCE.4.4_x64\examples_vbnet_ocx\RealTimeChartSimple\Interop.GlgoleLib.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Dropped PE file which has not been started: C:\Program Files\GlgCE.4.4_x64\DEMOS_C#\Animation\Glg.NetCE.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Dropped PE file which has not been started: C:\Program Files\GlgCE.4.4_x64\SimpleViewer\SingleThreaded\C#\Glg.NetCE.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Dropped PE file which has not been started: C:\Program Files\GlgCE.4.4_x64\DEMOS_C#\AirTrafficExt\Glg.NetCE.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Dropped PE file which has not been started: C:\Program Files\GlgCE.4.4_x64\DEMOS_C#\SCADAViewer\Glg.NetCE.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Dropped PE file which has not been started: C:\Program Files\GlgCE.4.4_x64\DEMOS_C#\Controls\Glg.NetCE.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Dropped PE file which has not been started: C:\Program Files\GlgCE.4.4_x64\DEMOS_C#\ElectricCircuit\JurassicGLG.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Dropped PE file which has not been started: C:\Program Files\GlgCE.4.4_x64\DEMOS_C#\Map\Glg.NetCE.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Dropped PE file which has not been started: C:\Program Files\GlgCE.4.4_x64\DEMOS_C#\RealTimeChart\Glg.NetCE.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Dropped PE file which has not been started: C:\Program Files\GlgCE.4.4_x64\DEMOS_C#\Diagram\JurassicGLG.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Dropped PE file which has not been started: C:\Program Files\GlgCE.4.4_x64\examples_ASP.NET\GraphSelectionHandlerSource\GraphSelectionHandler\bin\GraphSelectionHandler.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Dropped PE file which has not been started: C:\Program Files\GlgCE.4.4_x64\examples_ASP.NET\CircuitHandlerSource\CircuitHandler\bin\CircuitHandler.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Dropped PE file which has not been started: C:\Program Files\GlgCE.4.4_x64\DEMOS_C#\Trajectory\Glg.NetCE.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Dropped PE file which has not been started: C:\Program Files\GlgCE.4.4_x64\DEMOS_C#\RobotArm\Glg.NetCE.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Dropped PE file which has not been started: C:\Program Files\GlgCE.4.4_x64\DEMOS_C#\Process\JurassicGLG.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Dropped PE file which has not been started: C:\Program Files\GlgCE.4.4_x64\DEMOS_C#\GraphLayout\Glg.NetCE.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Dropped PE file which has not been started: C:\Program Files\GlgCE.4.4_x64\DEMOS\satellite\satellite.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Dropped PE file which has not been started: C:\Program Files\GlgCE.4.4_x64\DEMOS_C#\Animation\JurassicGLG.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Dropped PE file which has not been started: C:\Program Files\GlgCE.4.4_x64\DEMOS_C#\Avionics\Glg.NetCE.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Dropped PE file which has not been started: C:\Program Files\GlgCE.4.4_x64\DEMOS_C#\Process\Glg.NetCE.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Dropped PE file which has not been started: C:\Program Files\GlgCE.4.4_x64\examples_vbnet_ocx\gis\AxInterop.GlgoleLib.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Dropped PE file which has not been started: C:\Program Files\GlgCE.4.4_x64\DEMOS_C#\Aircombat\JurassicGLG.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Dropped PE file which has not been started: C:\Program Files\GlgCE.4.4_x64\examples_ASP.NET\GISHandlerSource\GISHandler\bin\GISHandler.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Dropped PE file which has not been started: C:\Program Files\GlgCE.4.4_x64\SimpleViewer\SingleThreaded\C#\JurassicGLG.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Dropped PE file which has not been started: C:\Program Files\GlgCE.4.4_x64\examples_vbnet_ocx\Dashboard\AxInterop.GlgoleLib.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Dropped PE file which has not been started: C:\Program Files\GlgCE.4.4_x64\DEMOS_C#\Satellite\JurassicGLG.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Dropped PE file which has not been started: C:\Program Files\GlgCE.4.4_x64\DEMOS_C#\FighterJet\Glg.NetCE.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Dropped PE file which has not been started: C:\Program Files\GlgCE.4.4_x64\DEMOS_C#\Network\Glg.NetCE.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Dropped PE file which has not been started: C:\Program Files\GlgCE.4.4_x64\DEMOS_C#\Map\JurassicGLG.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Dropped PE file which has not been started: C:\Program Files\GlgCE.4.4_x64\DEMOS_C#\AirTrafficExt\JurassicGLG.dll	Jump to dropped file

Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File Volume queried: C:\Program Files FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File Volume queried: C:\Program Files FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 Windows Service	1 Windows Service	12 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 Process Injection	1 Rundll32	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	1 Process Injection	Security Account Manager	12 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Source	Detection	Scanner	Link
C:\Program Files\GlgCE.4.4_x64\DEMOS_C#\AirTrafficExt\Glg.NetCE.dll	0%	ReversingLabs
C:\Program Files\GlgCE.4.4_x64\DEMOS_C#\AirTrafficExt\JurassicGLG.dll	0%	ReversingLabs
C:\Program Files\GlgCE.4.4_x64\DEMOS_C#\AirTrafficExt\JurassicGLG.dll	0%	Virustotal	Browse
C:\Program Files\GlgCE.4.4_x64\DEMOS_C#\AirTraffic\Glg.NetCE.dll	0%	ReversingLabs
C:\Program Files\GlgCE.4.4_x64\DEMOS_C#\AirTraffic\JurassicGLG.dll	0%	ReversingLabs
C:\Program Files\GlgCE.4.4_x64\DEMOS_C#\AirTraffic\JurassicGLG.dll	0%	Virustotal	Browse
C:\Program Files\GlgCE.4.4_x64\DEMOS_C#\Aircombat\Glg.NetCE.dll	0%	ReversingLabs
C:\Program Files\GlgCE.4.4_x64\DEMOS_C#\Aircombat\JurassicGLG.dll	0%	ReversingLabs
C:\Program Files\GlgCE.4.4_x64\DEMOS_C#\Aircombat\JurassicGLG.dll	0%	Virustotal	Browse
C:\Program Files\GlgCE.4.4_x64\DEMOS_C#\Animation\Glg.NetCE.dll	0%	ReversingLabs
C:\Program Files\GlgCE.4.4_x64\DEMOS_C#\Animation\JurassicGLG.dll	0%	ReversingLabs
C:\Program Files\GlgCE.4.4_x64\DEMOS_C#\Animation\JurassicGLG.dll	0%	Virustotal	Browse
C:\Program Files\GlgCE.4.4_x64\DEMOS_C#\Avionics\Glg.NetCE.dll	0%	ReversingLabs
C:\Program Files\GlgCE.4.4_x64\DEMOS_C#\Avionics\JurassicGLG.dll	0%	ReversingLabs
C:\Program Files\GlgCE.4.4_x64\DEMOS_C#\Avionics\JurassicGLG.dll	0%	Virustotal	Browse
C:\Program Files\GlgCE.4.4_x64\DEMOS_C#\ComboChart\Glg.NetCE.dll	0%	ReversingLabs
C:\Program Files\GlgCE.4.4_x64\DEMOS_C#\ComboChart\JurassicGLG.dll	0%	ReversingLabs
C:\Program Files\GlgCE.4.4_x64\DEMOS_C#\ComboChart\JurassicGLG.dll	0%	Virustotal	Browse
C:\Program Files\GlgCE.4.4_x64\DEMOS_C#\Controls\Glg.NetCE.dll	0%	ReversingLabs
C:\Program Files\GlgCE.4.4_x64\DEMOS_C#\Controls\JurassicGLG.dll	0%	ReversingLabs
C:\Program Files\GlgCE.4.4_x64\DEMOS_C#\Controls\JurassicGLG.dll	0%	Virustotal	Browse
C:\Program Files\GlgCE.4.4_x64\DEMOS_C#\Diagram\Glg.NetCE.dll	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://www.genlogic.com/architecture.html#Resource_Based_Data_Access	0%	Avira URL Cloud	safe
http://my_web_server.com/Scripts/GlmScript.pl?VERSION=1.3.0&REQUEST=GetMap&SRS=AUTO2:42003	0%	Avira URL Cloud	safe
http://www.genlogic.com/ajax_demos.html	0%	Avira URL Cloud	safe
http://www.genlogic.comPublisherGeneric	0%	Avira URL Cloud	safe
http://www.genlogic.com/widgets.html#2D_Graphs	0%	Avira URL Cloud	safe
http://www.genlogic.com/toolkit.html#Unlimited_Geometrical_Dynamics	0%	Avira URL Cloud	safe
http://www.genlogic.com/toolkit.html#Graphics_Builder	0%	Avira URL Cloud	safe
http://www.genlogic.com/toolkit.html#Graphics_Builder	0%	Virustotal		Browse
http://www.genlogic.com/ajax_demos.html	0%	Virustotal		Browse
http://www.genlogic.com/widgets.html#2D_Graphs	0%	Virustotal		Browse
http://www.genlogic.com/architecture.html#Resource_Based_Data_Access	0%	Virustotal		Browse
http://www.genlogic.com/toolkit.html#Unlimited_Geometrical_Dynamics	0%	Virustotal		Browse
http://www.genlogic.com	0%	Virustotal		Browse
http://www.genlogic.com	0%	Avira URL Cloud	safe
http://www.genlogic.com/widgets.html#Avionics	0%	Avira URL Cloud	safe
http://www.genlogic.com/graphics_server.html	0%	Avira URL Cloud	safe
http://www.genlogic.com/toolkit.html#Inherent_Dynamics	0%	Avira URL Cloud	safe
http://my_web_server.com/Scripts/GlmScript.pl?VERSION=1.3.0&REQUEST=GetMap&SRS=EPSG:4326&WIDTH=800&H	0%	Avira URL Cloud	safe
http://www.genlogic.com/widgets.html#Controls	0%	Avira URL Cloud	safe
http://www.genlogic.com/doc_html/javascript_doc/index.html	0%	Avira URL Cloud	safe
http://www.genlogic.com/toolkit.html#Scalable_Vector_Graphics	0%	Avira URL Cloud	safe
http://www.genlogic.com/doc_html/java_doc/index.html	0%	Avira URL Cloud	safe
http://www.genlogic.com/widgets.html#Avionics	0%	Virustotal		Browse
http://www.genlogic.com/doc_html/csharp_doc/index.html	0%	Avira URL Cloud	safe
http://www.genlogic.com/widgets.html#Controls	0%	Virustotal		Browse
http://www.genlogic.com/favicon.ico	0%	Avira URL Cloud	safe
http://www.genlogic.com/doc_html/javascript_doc/index.html	0%	Virustotal		Browse
http://www.genlogic.com/integration.html#Data_Supply	0%	Avira URL Cloud	safe
http://www.genlogic.com/doc_html/index.html	0%	Avira URL Cloud	safe
http://www.genlogic.com/doc_html/java_doc/index.html	0%	Virustotal		Browse
http://www.genlogic.com/favicon.ico	0%	Virustotal		Browse
http://www.genlogic.com/toolkit.html#Inherent_Dynamics	0%	Virustotal		Browse
http://www.genlogic.com/widgets.html#Process_Control	0%	Avira URL Cloud	safe
http://www.myserver.com	0%	Avira URL Cloud	safe
http://www.genlogic.com/integration.html#Data_Supply	0%	Virustotal		Browse
http://www.genlogic.com/index.html#Products	0%	Avira URL Cloud	safe
http://www.genlogic.com/toolkit.html#Scalable_Vector_Graphics	0%	Virustotal		Browse
http://www.genlogic.com/demos.html	0%	Avira URL Cloud	safe
http://www.genlogic.com/doc_html/index.html	0%	Virustotal		Browse
http://www.myserver.com	0%	Virustotal		Browse
http://www.genlogic.com/index.html#Products	0%	Virustotal		Browse
http://www.genlogic.com/widgets.html#Process_Control	0%	Virustotal		Browse
http://www.genlogic.com/graphics_server.html	0%	Virustotal		Browse
http://www.genlogic.com/doc_html/csharp_doc/index.html	0%	Virustotal		Browse
http://www.genlogic.com/demos.html	0%	Virustotal		Browse

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.betterhostreview.com/turn-on-iis-windows-10.html	SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2283509937.0000000002D48000.00000004.00000020.00020000.00000000.sdmp	false		high
http://my_web_server.com/Scripts/GlmScript.pl?VERSION=1.3.0&REQUEST=GetMap&SRS=AUTO2:42003	SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2283509937.0000000002D48000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.genlogic.com/ajax_demos.html	SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp, dial_demo.htm.0.dr, electric_circuit.htm.0.dr, gis_demo.htm.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.genlogic.com/widgets.html#2D_Graphs	gis_demo.htm.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.genlogic.com/architecture.html#Resource_Based_Data_Access	electric_circuit.htm.0.dr, gis_demo.htm.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.genlogic.comPublisherGeneric	SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.genlogic.com/toolkit.html#Unlimited_Geometrical_Dynamics	electric_circuit.htm.0.dr, gis_demo.htm.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.genlogic.com/toolkit.html#Graphics_Builder	dial_demo.htm.0.dr, gis_demo.htm.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.genlogic.com	gis_demo.htm.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://gdavidcarter.blogspot.com/2016/04/installing-perl-on-windows-2012r2-iis-85.html	SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2283509937.0000000002D48000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.genlogic.com/widgets.html#Avionics	gis_demo.htm.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://nsis.sf.net/NSIS_ErrorError	SetupGLG-CE-4-4-x64-vs2015.exe	false		high
http://www.genlogic.com/toolkit.html#Inherent_Dynamics	gis_demo.htm.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://my_web_server.com/Scripts/GlmScript.pl?VERSION=1.3.0&REQUEST=GetMap&SRS=EPSG:4326&WIDTH=800&H	SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2283509937.0000000002D48000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.genlogic.com/graphics_server.html	gis_demo.htm.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.genlogic.com/widgets.html#Controls	dial_demo.htm.0.dr, gis_demo.htm.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.genlogic.com/doc_html/javascript_doc/index.html	SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp, SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000003.1956225300.0000000007760000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.genlogic.com/toolkit.html#Scalable_Vector_Graphics	electric_circuit.htm.0.dr, gis_demo.htm.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://nsis.sf.net/NSIS_Error	SetupGLG-CE-4-4-x64-vs2015.exe	false		high
http://www.genlogic.com/doc_html/java_doc/index.html	SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp, SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000003.1955742589.0000000007760000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.genlogic.com/doc_html/csharp_doc/index.html	SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp, SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000003.1955964812.0000000007760000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.genlogic.com/favicon.ico	gis_demo.htm.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.genlogic.com/integration.html#Data_Supply	gis_demo.htm.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.genlogic.com/doc_html/index.html	SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.genlogic.com/widgets.html#Process_Control	gis_demo.htm.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.myserver.com	SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2283509937.0000000002D48000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.genlogic.com/index.html#Products	dial_demo.htm.0.dr, electric_circuit.htm.0.dr, gis_demo.htm.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.genlogic.com/demos.html	SetupGLG-CE-4-4-x64-vs2015.exe, 00000000.00000002.2278337105.000000000065A000.00000004.00000020.00020000.00000000.sdmp, dial_demo.htm.0.dr, electric_circuit.htm.0.dr, gis_demo.htm.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1431668
Start date and time:	2024-04-25 15:55:11 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 9s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SetupGLG-CE-4-4-x64-vs2015.exe
Detection:	CLEAN
Classification:	clean12.rans.winEXE@2/1025@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 10 Number of non-executed functions: 9
Cookbook Comments:	Found application associated with file extension: .exe

Process:	C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1007
Entropy (8bit):	5.214935032860389
Encrypted:	false
SSDEEP:	24:JdS4+lOjcLQWAOjXCLQWAOjt/LQWAOjXgu/LQWI:3QliviBisia
MD5:	01F2D036959CE7ED233A78ECC4CC8EA9
SHA1:	A01436FAC26A9D1BB3BF16C521F03A14FBAAAC53
SHA-256:	FFF8CE4770C1B1FA467B298C42607BB2606271E12A28E94DB5185AAD5BBDA6E2
SHA-512:	8360A5A30F9F736C2D852EB1E036B2BAA87B5832266C36F17180A049F2162ECD5479B8310B2F4F6B5FA99FFBF8A50829059036F458E01068A389220CC6DBF551
Malicious:	false
Reputation:	low
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">.. <PropertyGroup Condition="'$(Configuration)\|$(Platform)'=='Debug\|Win32'">.. <LocalDebuggerCommand>.\map.exe</LocalDebuggerCommand>.. <DebuggerFlavor>WindowsLocalDebugger</DebuggerFlavor>.. </PropertyGroup>.. <PropertyGroup Condition="'$(Configuration)\|$(Platform)'=='Release\|Win32'">.. <LocalDebuggerCommand>.\map.exe</LocalDebuggerCommand>.. <DebuggerFlavor>WindowsLocalDebugger</DebuggerFlavor>.. </PropertyGroup>.. <PropertyGroup Condition="'$(Configuration)\|$(Platform)'=='Debug\|x64'">.. <LocalDebuggerCommand>.\map.exe</LocalDebuggerCommand>.. <DebuggerFlavor>WindowsLocalDebugger</DebuggerFlavor>.. </PropertyGroup>.. <PropertyGroup Condition="'$(Configuration)\|$(Platform)'=='Release\|x64'">.. <LocalDebuggerCommand>.\map.exe</LocalDebuggerCommand>.. <DebuggerFlavor>WindowsLocalDebugger</DebuggerFlavor>.. </PropertyGroup>..</P

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.999946926879999
TrID:	Win32 Executable (generic) a (10002005/4) 92.16% NSIS - Nullsoft Scriptable Install System (846627/2) 7.80% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SetupGLG-CE-4-4-x64-vs2015.exe
File size:	46'456'984 bytes
MD5:	fb96e42527566991cb7f45c08b7b411b
SHA1:	e5658793c41761981c0ad4cb3e421e12839869d0
SHA256:	3363b944fbd66e33ee0d3deb12d249e22e1ee17696783db3814c108f2cd5335d
SHA512:	7470a94d95f9cbb0f3581faf1b738e07212ebc21e2c6163ce19c8ba80cbcded92d85151c2f37845173d74336874afca2926b72f520052b3e354433a5eef1e505
SSDEEP:	786432:AcfHTxv94WPi+NVr3EeIGT8zvabb7kVaxk2TP6AqtJJgLRf1nXYL9hH1jTm+DKiw:AcHT/4iv3E3L4b76axTWal9n815nJw
TLSH:	C0A73308F8FE425EEAC769335A03C89F4C46778538DD6F46673A6800D98E6027E567BC
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..iu..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i........................PE..L......K.................\.........

Entrypoint:	0x40323c
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x4B1AE3C6 [Sat Dec 5 22:50:46 2009 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	099c0646ea7282d232219f8807883be0

Signature Valid:	true
Signature Issuer:	CN=Sectigo Public Code Signing CA R36, O=Sectigo Limited, C=GB
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	04/01/2023 01:00:00 04/01/2026 00:59:59
Subject Chain	CN="Generic Logic, Inc.", O="Generic Logic, Inc.", S=Massachusetts, C=US
Version:	3
Thumbprint MD5:	CE13F225BED86D066B85370EB0F25AB9
Thumbprint SHA-1:	B1952E9A2B138332F99A9738A0D449156EB961EE
Thumbprint SHA-256:	05BE7DF20D4E21F08C79320F48863C19781275DE25F3E751E0DD331035915D62
Serial:	00A83C5D67A39FC03451AFDF54E0197D09

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x73a4	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x57000	0x5288	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x2c4b528	0x2b70
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x7000	0x28c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5a5a	0x5c00	0bc2ffd32265a08d72b795b18265828d	False	0.6604534646739131	data	6.417698236857409	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x7000	0x1190	0x1200	f179218a059068529bdb4637ef5fa28e	False	0.4453125	data	5.181627099249737	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x9000	0x1af98	0x400	975304d6dd6c4a4f076b15511e2bbbc0	False	0.55859375	data	4.70902740305165	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x24000	0x33000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x57000	0x5288	0x5400	3ed26783525131e2e6caa7c718debd0a	False	0.10988653273809523	data	1.6185355158535717	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_BITMAP	0x57340	0x666	Device independent bitmap graphic, 96 x 16 x 8, image size 1538, resolution 2868 x 2868 px/m, 15 important colors	English	United States	0.18192918192918192
RT_ICON	0x579a8	0x25a8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	English	United States	0.02686721991701245
RT_ICON	0x59f50	0x10a8	data	English	United States	0.006332082551594747
RT_ICON	0x5aff8	0x468	data	English	United States	0.015957446808510637
RT_DIALOG	0x5b460	0x120	data	English	United States	0.5138888888888888
RT_DIALOG	0x5b580	0x118	data	English	United States	0.5428571428571428
RT_DIALOG	0x5b698	0x200	data	English	United States	0.3984375
RT_DIALOG	0x5b898	0xf8	data	English	United States	0.6290322580645161
RT_DIALOG	0x5b990	0xa0	data	English	United States	0.60625
RT_DIALOG	0x5ba30	0xd4	data	English	United States	0.5990566037735849
RT_DIALOG	0x5bb08	0xee	data	English	United States	0.6260504201680672
RT_GROUP_ICON	0x5bbf8	0x30	data	English	United States	0.8125
RT_VERSION	0x5bc28	0x29c	data	English	United States	0.5149700598802395
RT_MANIFEST	0x5bec8	0x3be	XML 1.0 document, ASCII text, with very long lines (958), with no line terminators	English	United States	0.5198329853862212

DLL	Import
KERNEL32.dll	CompareFileTime, SearchPathA, GetShortPathNameA, GetFullPathNameA, MoveFileA, SetCurrentDirectoryA, GetFileAttributesA, GetLastError, CreateDirectoryA, SetFileAttributesA, Sleep, GetTickCount, CreateFileA, GetFileSize, GetModuleFileNameA, GetCurrentProcess, CopyFileA, ExitProcess, SetFileTime, GetTempPathA, GetCommandLineA, SetErrorMode, LoadLibraryA, lstrcpynA, GetDiskFreeSpaceA, GlobalUnlock, GlobalLock, CreateThread, CreateProcessA, RemoveDirectoryA, GetTempFileNameA, lstrlenA, lstrcatA, GetSystemDirectoryA, GetVersion, CloseHandle, lstrcmpiA, lstrcmpA, ExpandEnvironmentStringsA, GlobalFree, GlobalAlloc, WaitForSingleObject, GetExitCodeProcess, GetModuleHandleA, LoadLibraryExA, GetProcAddress, FreeLibrary, MultiByteToWideChar, WritePrivateProfileStringA, GetPrivateProfileStringA, WriteFile, ReadFile, MulDiv, SetFilePointer, FindClose, FindNextFileA, FindFirstFileA, DeleteFileA, GetWindowsDirectoryA
USER32.dll	EndDialog, ScreenToClient, GetWindowRect, EnableMenuItem, GetSystemMenu, SetClassLongA, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongA, SetCursor, LoadCursorA, CheckDlgButton, GetMessagePos, LoadBitmapA, CallWindowProcA, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, RegisterClassA, TrackPopupMenu, AppendMenuA, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextA, GetDlgItemTextA, MessageBoxIndirectA, CharPrevA, DispatchMessageA, PeekMessageA, DestroyWindow, CreateDialogParamA, SetTimer, SetWindowTextA, PostQuitMessage, SetForegroundWindow, wsprintfA, SendMessageTimeoutA, FindWindowExA, SystemParametersInfoA, CreateWindowExA, GetClassInfoA, DialogBoxParamA, CharNextA, OpenClipboard, ExitWindowsEx, IsWindow, GetDlgItem, SetWindowLongA, LoadImageA, GetDC, EnableWindow, InvalidateRect, SendMessageA, DefWindowProcA, BeginPaint, GetClientRect, FillRect, DrawTextA, EndPaint, ShowWindow
GDI32.dll	SetBkColor, GetDeviceCaps, DeleteObject, CreateBrushIndirect, CreateFontIndirectA, SetBkMode, SetTextColor, SelectObject
SHELL32.dll	SHGetPathFromIDListA, SHBrowseForFolderA, SHGetFileInfoA, ShellExecuteA, SHFileOperationA, SHGetSpecialFolderLocation
ADVAPI32.dll	RegQueryValueExA, RegSetValueExA, RegEnumKeyA, RegEnumValueA, RegOpenKeyExA, RegDeleteKeyA, RegDeleteValueA, RegCloseKey, RegCreateKeyExA
COMCTL32.dll	ImageList_AddMasked, ImageList_Destroy, ImageList_Create
ole32.dll	CoTaskMemFree, OleInitialize, OleUninitialize, CoCreateInstance
VERSION.dll	GetFileVersionInfoSizeA, GetFileVersionInfoA, VerQueryValueA

Target ID:	0
Start time:	15:55:41
Start date:	25/04/2024
Path:	C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SetupGLG-CE-4-4-x64-vs2015.exe"
Imagebase:	0x400000
File size:	46'456'984 bytes
MD5 hash:	FB96E42527566991CB7F45C08B7B411B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	18
Start time:	15:57:14
Start date:	25/04/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Imagebase:	0x7ff6f2d40000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SetupGLG-CE-4-4-x64-vs2015.exe

Overview

General Information

Detection

Compliance

Signatures

Classification

Analysis Advice

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\GlgCE.4.4_x64\DEMOS\map_demo\mapG.vcxproj.user

C:\Program Files\GlgCE.4.4_x64\DEMOS\map_demo\map_demo.g

C:\Program Files\GlgCE.4.4_x64\DEMOS\map_demo\map_proto.h

C:\Program Files\GlgCE.4.4_x64\DEMOS\map_demo\no_alarms.g

C:\Program Files\GlgCE.4.4_x64\DEMOS\map_demo\no_alarms.gif

C:\Program Files\GlgCE.4.4_x64\DEMOS\map_demo\palette.g

C:\Program Files\GlgCE.4.4_x64\DEMOS\map_demo\resource.h

C:\Program Files\GlgCE.4.4_x64\DEMOS\map_demo\us_map.g

C:\Program Files\GlgCE.4.4_x64\DEMOS\map_demo\warning.g

C:\Program Files\GlgCE.4.4_x64\DEMOS\map_demo\world_map.g

C:\Program Files\GlgCE.4.4_x64\DEMOS\process_demo\README.txt

C:\Program Files\GlgCE.4.4_x64\DEMOS\process_demo\Script1.rc

C:\Program Files\GlgCE.4.4_x64\DEMOS\process_demo\process.exe

C:\Program Files\GlgCE.4.4_x64\DEMOS\process_demo\process.g

C:\Program Files\GlgCE.4.4_x64\DEMOS\process_demo\process.ico

C:\Program Files\GlgCE.4.4_x64\DEMOS\process_demo\process.sln

C:\Program Files\GlgCE.4.4_x64\DEMOS\process_demo\process.vcxproj

C:\Program Files\GlgCE.4.4_x64\DEMOS\process_demo\process.vcxproj.filters

C:\Program Files\GlgCE.4.4_x64\DEMOS\process_demo\process.vcxproj.user

C:\Program Files\GlgCE.4.4_x64\DEMOS\process_demo\processG.c

C:\Program Files\GlgCE.4.4_x64\DEMOS\process_demo\resource.h

C:\Program Files\GlgCE.4.4_x64\DEMOS\satellite\README.txt

C:\Program Files\GlgCE.4.4_x64\DEMOS\satellite\Script1.rc

Windows Analysis Report
SetupGLG-CE-4-4-x64-vs2015.exe

Execution Coverage:	15.8%
Dynamic/Decrypted Code Coverage:	47%
Signature Coverage:	6.5%
Total number of Nodes:	413
Total number of Limit Nodes:	18

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre