Windows Analysis Report
0438.pdf.exe

Overview

General Information

Sample name: 0438.pdf.exe
renamed because original name is a hash value
Original sample name: .pdf.exe
Analysis ID: 1545741
MD5: 2d11dba46735af1cb1c0a42e9564e20d
SHA1: b2e17960c6d080f7aba7df87f57c08b4bc2e7051
SHA256: e19477a56b247e6cc435fee367abcf6e0c3db21de91ae2514b4a6b1807233c53
Infos:

Detection

Score: 76
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for submitted file
Sigma detected: Suspicious Double Extension File Execution
Connects to many ports of the same IP (likely port scanning)
Enables network access during safeboot for specific services
Enables remote desktop connection
Initial sample is a PE file and has a suspicious name
Uses an obfuscated file name to hide its real file extension (double extension)
Checks for available system drives (often done to infect USB drives)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to communicate with device drivers
Contains functionality to launch a program with higher privileges
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Creates or modifies windows services
Deletes files inside the Windows folder
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Enables debug privileges
File is packed with WinRar
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
Launches processes in debugging mode, may be used to hinder debugging
May sleep (evasive loops) to hinder dynamic analysis
PE file contains executable resources (Code or Archives)
PE file contains more sections than normal
PE file contains sections with non-standard names
PE file contains strange resources
Queries disk information (often used to detect virtual machines)
Queries the installation date of Windows
Queries the product ID of Windows
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Suspicious Outbound SMTP Connections
Stores files to the Windows start menu directory
Stores large binary data to the registry
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: 0438.pdf.exe ReversingLabs: Detection: 44%
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\LiteManager Pro - Server\EULA.rtf Jump to behavior
Source: 0438.pdf.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Source: Binary string: D:\Projects\WinRAR\sfx\build\sfxrar64\Release\sfxrar.pdb source: 0438.pdf.exe
Checks for available system drives (often done to infect USB drives)
Source: C:\Windows\System32\msiexec.exe File opened: z: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: x: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: v: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: t: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: r: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: p: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: n: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: l: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: j: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: h: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: f: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: b: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: y: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: w: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: u: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: s: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: q: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: o: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: m: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: k: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: i: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: g: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: e: Jump to behavior
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe File opened: c:
Source: C:\Windows\System32\msiexec.exe File opened: a: Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe Code function: 0_2_00007FF655DAB190 EndDialog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,EndDialog,GetDlgItem,SendMessageW,SendMessageW,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetWindowTextW,SetDlgItemTextW,SetWindowTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,SendMessageW,SendDlgItemMessageW,GetDlgItem,SendMessageW,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EndDialog,EnableWindow,SendMessageW,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn, 0_2_00007FF655DAB190
Source: C:\Users\user\Desktop\0438.pdf.exe Code function: 0_2_00007FF655D940BC FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn, 0_2_00007FF655D940BC
Source: C:\Users\user\Desktop\0438.pdf.exe Code function: 0_2_00007FF655DBFCA0 FindFirstFileExA, 0_2_00007FF655DBFCA0

Networking
barindex
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 111.90.140.76 ports 5651,8080,1,465,5,6,80
Enables network access during safeboot for specific services
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Registry value created: NULL Service
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.6:49785 -> 111.90.140.76:5651
Source: global traffic TCP traffic: 192.168.2.6:49790 -> 65.21.245.7:5555
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 96.7.168.138 96.7.168.138
Source: Joe Sandbox View IP Address: 65.21.245.7 65.21.245.7
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: SHINJIRU-MY-AS-APShinjiruTechnologySdnBhdMY SHINJIRU-MY-AS-APShinjiruTechnologySdnBhdMY
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: unknown TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown TCP traffic detected without corresponding DNS query: 111.90.140.76
Source: unknown TCP traffic detected without corresponding DNS query: 111.90.140.76
Source: unknown TCP traffic detected without corresponding DNS query: 111.90.140.76
Source: unknown TCP traffic detected without corresponding DNS query: 111.90.140.76
Source: unknown TCP traffic detected without corresponding DNS query: 111.90.140.76
Source: unknown TCP traffic detected without corresponding DNS query: 111.90.140.76
Source: unknown TCP traffic detected without corresponding DNS query: 111.90.140.76
Source: unknown TCP traffic detected without corresponding DNS query: 65.21.245.7
Source: unknown TCP traffic detected without corresponding DNS query: 111.90.140.76
Source: unknown TCP traffic detected without corresponding DNS query: 65.21.245.7
Source: unknown TCP traffic detected without corresponding DNS query: 65.21.245.7
Source: unknown TCP traffic detected without corresponding DNS query: 65.21.245.7
Source: unknown TCP traffic detected without corresponding DNS query: 111.90.140.76
Source: unknown TCP traffic detected without corresponding DNS query: 111.90.140.76
Source: unknown TCP traffic detected without corresponding DNS query: 111.90.140.76
Source: unknown TCP traffic detected without corresponding DNS query: 111.90.140.76
Source: unknown TCP traffic detected without corresponding DNS query: 111.90.140.76
Source: unknown TCP traffic detected without corresponding DNS query: 111.90.140.76
Source: unknown TCP traffic detected without corresponding DNS query: 111.90.140.76
Source: unknown TCP traffic detected without corresponding DNS query: 111.90.140.76
Source: unknown TCP traffic detected without corresponding DNS query: 65.21.245.7
Source: unknown TCP traffic detected without corresponding DNS query: 65.21.245.7
Source: unknown TCP traffic detected without corresponding DNS query: 65.21.245.7
Source: unknown TCP traffic detected without corresponding DNS query: 65.21.245.7
Source: unknown TCP traffic detected without corresponding DNS query: 111.90.140.76
Source: unknown TCP traffic detected without corresponding DNS query: 111.90.140.76
Source: unknown TCP traffic detected without corresponding DNS query: 111.90.140.76
Source: unknown TCP traffic detected without corresponding DNS query: 111.90.140.76
Source: unknown TCP traffic detected without corresponding DNS query: 65.21.245.7
Source: unknown TCP traffic detected without corresponding DNS query: 65.21.245.7
Source: unknown TCP traffic detected without corresponding DNS query: 65.21.245.7
Source: unknown TCP traffic detected without corresponding DNS query: 65.21.245.7
Source: unknown TCP traffic detected without corresponding DNS query: 65.21.245.7
Source: unknown TCP traffic detected without corresponding DNS query: 65.21.245.7
Source: unknown TCP traffic detected without corresponding DNS query: 111.90.140.76
Source: unknown TCP traffic detected without corresponding DNS query: 111.90.140.76
Source: unknown TCP traffic detected without corresponding DNS query: 111.90.140.76
Source: unknown TCP traffic detected without corresponding DNS query: 111.90.140.76
Source: unknown TCP traffic detected without corresponding DNS query: 111.90.140.76
Source: unknown TCP traffic detected without corresponding DNS query: 111.90.140.76
Source: global traffic HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: global traffic DNS traffic detected: DNS query: x1.i.lencr.org
Source: AledensoftIpcServer.dll.4.dr String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: 0438.pdf.exe, 00000000.00000003.2142040479.000001D852E3C000.00000004.00000020.00020000.00000000.sdmp, 0438.pdf.exe, 00000000.00000003.2142040479.000001D852DFE000.00000004.00000020.00020000.00000000.sdmp, pdf.msi.0.dr String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: svchost.exe, 00000006.00000002.3404980914.00000152CDA00000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.ver)
Source: qmgr.db.6.dr String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.6.dr String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.6.dr String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.6.dr String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.6.dr String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.6.dr String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.6.dr String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.6.dr String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: ROMFUSClient.exe, 00000015.00000002.3396748932.00000000027CC000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 00000015.00000002.3396748932.00000000026CC000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://litemanager.com/
Source: ROMFUSClient.exe, 00000015.00000002.3396748932.00000000027D3000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://litemanager.com/03
Source: ROMServer.exe, 00000012.00000002.3395697625.000000000165C000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://litemanager.com/03f
Source: ROMFUSClient.exe, 0000000B.00000000.2240253019.00000000008E4000.00000002.00000001.01000000.0000000B.sdmp, ROMServer.exe, 0000000C.00000000.2255406199.00000000009FE000.00000002.00000001.01000000.0000000C.sdmp String found in binary or memory: http://litemanager.ru/
Source: ROMServer.exe, 0000000C.00000000.2252577316.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, ROMServer.exe.4.dr String found in binary or memory: http://litemanager.ru/noip.txtU
Source: AledensoftIpcServer.dll.4.dr String found in binary or memory: http://ocsp.comodoca.com0
Source: 0438.pdf.exe, 00000000.00000003.2142040479.000001D852E3C000.00000004.00000020.00020000.00000000.sdmp, 0438.pdf.exe, 00000000.00000003.2142040479.000001D852DFE000.00000004.00000020.00020000.00000000.sdmp, pdf.msi.0.dr String found in binary or memory: http://ocsp.thawte.com0
Source: 0438.pdf.exe, 00000000.00000003.2142040479.000001D852E3C000.00000004.00000020.00020000.00000000.sdmp, 0438.pdf.exe, 00000000.00000003.2142040479.000001D852DFE000.00000004.00000020.00020000.00000000.sdmp, pdf.msi.0.dr String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: 0438.pdf.exe, 00000000.00000003.2142040479.000001D852E3C000.00000004.00000020.00020000.00000000.sdmp, 0438.pdf.exe, 00000000.00000003.2142040479.000001D852DFE000.00000004.00000020.00020000.00000000.sdmp, pdf.msi.0.dr String found in binary or memory: http://s2.symcb.com0
Source: 0438.pdf.exe, 00000000.00000003.2142040479.000001D852E3C000.00000004.00000020.00020000.00000000.sdmp, 0438.pdf.exe, 00000000.00000003.2142040479.000001D852DFE000.00000004.00000020.00020000.00000000.sdmp, pdf.msi.0.dr String found in binary or memory: http://sv.symcb.com/sv.crl0f
Source: 0438.pdf.exe, 00000000.00000003.2142040479.000001D852E3C000.00000004.00000020.00020000.00000000.sdmp, 0438.pdf.exe, 00000000.00000003.2142040479.000001D852DFE000.00000004.00000020.00020000.00000000.sdmp, pdf.msi.0.dr String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: 0438.pdf.exe, 00000000.00000003.2142040479.000001D852E3C000.00000004.00000020.00020000.00000000.sdmp, 0438.pdf.exe, 00000000.00000003.2142040479.000001D852DFE000.00000004.00000020.00020000.00000000.sdmp, pdf.msi.0.dr String found in binary or memory: http://sv.symcd.com0&
Source: 0438.pdf.exe, 00000000.00000003.2142040479.000001D852E3C000.00000004.00000020.00020000.00000000.sdmp, 0438.pdf.exe, 00000000.00000003.2142040479.000001D852DFE000.00000004.00000020.00020000.00000000.sdmp, pdf.msi.0.dr String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: 0438.pdf.exe, 00000000.00000003.2142040479.000001D852E3C000.00000004.00000020.00020000.00000000.sdmp, 0438.pdf.exe, 00000000.00000003.2142040479.000001D852DFE000.00000004.00000020.00020000.00000000.sdmp, pdf.msi.0.dr String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: 0438.pdf.exe, 00000000.00000003.2142040479.000001D852E3C000.00000004.00000020.00020000.00000000.sdmp, 0438.pdf.exe, 00000000.00000003.2142040479.000001D852DFE000.00000004.00000020.00020000.00000000.sdmp, pdf.msi.0.dr String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: ROMFUSClient.exe, 0000000B.00000003.2259126135.0000000002807000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 0000000B.00000000.2234439109.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, ROMServer.exe, 0000000C.00000000.2252577316.0000000000951000.00000020.00000001.01000000.0000000C.sdmp, ROMServer.exe, 0000000C.00000003.2257147255.0000000002A67000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 0000000D.00000003.2277324013.0000000002917000.00000004.00001000.00020000.00000000.sdmp, ROMServer.exe, 0000000E.00000003.2275541366.0000000002A17000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 0000000F.00000003.2316937821.0000000002907000.00000004.00001000.00020000.00000000.sdmp, ROMServer.exe, 00000011.00000003.2312303381.0000000002907000.00000004.00001000.00020000.00000000.sdmp, ROMServer.exe, 00000012.00000002.3395697625.00000000015C0000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 00000014.00000002.3395273674.00000000027B7000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 00000015.00000002.3396748932.0000000002737000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 00000016.00000003.2313692708.0000000002677000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 00000017.00000003.2327332686.00000000027A7000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 00000018.00000003.2336010144.00000000027D7000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 00000019.00000003.2345721402.00000000027F7000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 0000001A.00000003.2356406295.0000000002727000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 0000001B.00000003.2379336714.0000000002877000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 0000001D.00000003.3132372949.00000000028C7000.00000004.00001000.00020000.00000000.sdmp, ROMServer.exe.4.dr String found in binary or memory: http://www.indyproject.org/
Source: 0438.pdf.exe, 00000000.00000003.2142040479.000001D852E3C000.00000004.00000020.00020000.00000000.sdmp, 0438.pdf.exe, 00000000.00000003.2142040479.000001D852DFE000.00000004.00000020.00020000.00000000.sdmp, pdf.msi.0.dr String found in binary or memory: http://www.symauth.com/cps0(
Source: 0438.pdf.exe, 00000000.00000003.2142040479.000001D852E3C000.00000004.00000020.00020000.00000000.sdmp, 0438.pdf.exe, 00000000.00000003.2142040479.000001D852DFE000.00000004.00000020.00020000.00000000.sdmp, pdf.msi.0.dr String found in binary or memory: http://www.symauth.com/rpa00
Source: 2D85F72862B55C4EADD9E66E06947F3D0.5.dr String found in binary or memory: http://x1.i.lencr.org/
Source: 0438.pdf.exe, 00000000.00000003.2142040479.000001D852E3C000.00000004.00000020.00020000.00000000.sdmp, 0438.pdf.exe, 00000000.00000003.2142040479.000001D852DFE000.00000004.00000020.00020000.00000000.sdmp, pdf.msi.0.dr String found in binary or memory: https://d.symcb.com/cps0%
Source: 0438.pdf.exe, 00000000.00000003.2142040479.000001D852E3C000.00000004.00000020.00020000.00000000.sdmp, 0438.pdf.exe, 00000000.00000003.2142040479.000001D852DFE000.00000004.00000020.00020000.00000000.sdmp, pdf.msi.0.dr String found in binary or memory: https://d.symcb.com/rpa0
Source: qmgr.db.6.dr String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000006.00000003.2167957236.00000152CD900000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: ROMFUSClient.exe, 0000000B.00000000.2234439109.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, ROMServer.exe, 0000000C.00000000.2252577316.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, ROMServer.exe.4.dr String found in binary or memory: https://litemanager.com/romversion.txt
Source: ROMFUSClient.exe, 0000000B.00000000.2234439109.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, ROMServer.exe, 0000000C.00000000.2252577316.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, ROMServer.exe.4.dr String found in binary or memory: https://litemanager.com/soft/pro/ROMServer.zip
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown Network traffic detected: HTTP traffic on port 49760 -> 443

System Summary
barindex
Initial sample is a PE file and has a suspicious name
Source: initial sample Static PE information: Filename: 0438.pdf.exe
Contains functionality to communicate with device drivers
Source: C:\Users\user\Desktop\0438.pdf.exe Code function: 0_2_00007FF655D8C2F0: CreateFileW,CloseHandle,wcscpy,wcscpy,wcscpy,wcscpy,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn, 0_2_00007FF655D8C2F0
Creates files inside the system directory
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\533823.msi Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\SourceHash{71FFA475-24D5-44FB-A51F-39B699E3D82C} Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\inprogressinstallinfo.ipi Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSI3BEC.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C} Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\ARPPRODUCTICON.exe Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\ROMServer.exe_9D09B2BC25A2414CBD848E2B75898676.exe Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\UNINST_Uninstall_L_78AA5B6662514D94A847D6C603AF0895.exe Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\stop_server_51B516B87C64408FA3C56354EA2277C2.exe Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\config_server_B6BD2967C67B44649764F06ADFFD6458.exe Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\533826.msi Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\533826.msi Jump to behavior
Source: C:\Windows\System32\svchost.exe File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp Jump to behavior
Deletes files inside the Windows folder
Source: C:\Windows\System32\msiexec.exe File deleted: C:\Windows\Installer\533826.msi Jump to behavior
Detected potential crypto function
Source: C:\Users\user\Desktop\0438.pdf.exe Code function: 0_2_00007FF655D8F930 0_2_00007FF655D8F930
Source: C:\Users\user\Desktop\0438.pdf.exe Code function: 0_2_00007FF655D94928 0_2_00007FF655D94928
Source: C:\Users\user\Desktop\0438.pdf.exe Code function: 0_2_00007FF655DB0754 0_2_00007FF655DB0754
Source: C:\Users\user\Desktop\0438.pdf.exe Code function: 0_2_00007FF655DAB190 0_2_00007FF655DAB190
Source: C:\Users\user\Desktop\0438.pdf.exe Code function: 0_2_00007FF655D9A4AC 0_2_00007FF655D9A4AC
Source: C:\Users\user\Desktop\0438.pdf.exe Code function: 0_2_00007FF655DA3484 0_2_00007FF655DA3484
Source: C:\Users\user\Desktop\0438.pdf.exe Code function: 0_2_00007FF655DA1F20 0_2_00007FF655DA1F20
Source: C:\Users\user\Desktop\0438.pdf.exe Code function: 0_2_00007FF655DACE88 0_2_00007FF655DACE88
Source: C:\Users\user\Desktop\0438.pdf.exe Code function: 0_2_00007FF655D85E24 0_2_00007FF655D85E24
Source: C:\Users\user\Desktop\0438.pdf.exe Code function: 0_2_00007FF655D876C0 0_2_00007FF655D876C0
Source: C:\Users\user\Desktop\0438.pdf.exe Code function: 0_2_00007FF655DC2550 0_2_00007FF655DC2550
Source: C:\Users\user\Desktop\0438.pdf.exe Code function: 0_2_00007FF655DBC838 0_2_00007FF655DBC838
Source: C:\Users\user\Desktop\0438.pdf.exe Code function: 0_2_00007FF655D84840 0_2_00007FF655D84840
Source: C:\Users\user\Desktop\0438.pdf.exe Code function: 0_2_00007FF655D8A310 0_2_00007FF655D8A310
Source: C:\Users\user\Desktop\0438.pdf.exe Code function: 0_2_00007FF655D8C2F0 0_2_00007FF655D8C2F0
Source: C:\Users\user\Desktop\0438.pdf.exe Code function: 0_2_00007FF655D87288 0_2_00007FF655D87288
Source: C:\Users\user\Desktop\0438.pdf.exe Code function: 0_2_00007FF655D9126C 0_2_00007FF655D9126C
Source: C:\Users\user\Desktop\0438.pdf.exe Code function: 0_2_00007FF655DA21D0 0_2_00007FF655DA21D0
Source: C:\Users\user\Desktop\0438.pdf.exe Code function: 0_2_00007FF655D9F180 0_2_00007FF655D9F180
Source: C:\Users\user\Desktop\0438.pdf.exe Code function: 0_2_00007FF655D9B534 0_2_00007FF655D9B534
Source: C:\Users\user\Desktop\0438.pdf.exe Code function: 0_2_00007FF655DA53F0 0_2_00007FF655DA53F0
Source: C:\Users\user\Desktop\0438.pdf.exe Code function: 0_2_00007FF655D9AF18 0_2_00007FF655D9AF18
Source: C:\Users\user\Desktop\0438.pdf.exe Code function: 0_2_00007FF655DA8DF4 0_2_00007FF655DA8DF4
Source: C:\Users\user\Desktop\0438.pdf.exe Code function: 0_2_00007FF655DB0754 0_2_00007FF655DB0754
Source: C:\Users\user\Desktop\0438.pdf.exe Code function: 0_2_00007FF655DA2D58 0_2_00007FF655DA2D58
Source: C:\Users\user\Desktop\0438.pdf.exe Code function: 0_2_00007FF655DC2080 0_2_00007FF655DC2080
Source: C:\Users\user\Desktop\0438.pdf.exe Code function: 0_2_00007FF655DC5AF8 0_2_00007FF655DC5AF8
Source: C:\Users\user\Desktop\0438.pdf.exe Code function: 0_2_00007FF655D81AA4 0_2_00007FF655D81AA4
Source: C:\Users\user\Desktop\0438.pdf.exe Code function: 0_2_00007FF655DA2AB0 0_2_00007FF655DA2AB0
Source: C:\Users\user\Desktop\0438.pdf.exe Code function: 0_2_00007FF655DBFA94 0_2_00007FF655DBFA94
Source: C:\Users\user\Desktop\0438.pdf.exe Code function: 0_2_00007FF655D91A48 0_2_00007FF655D91A48
Source: C:\Users\user\Desktop\0438.pdf.exe Code function: 0_2_00007FF655DB89A0 0_2_00007FF655DB89A0
Source: C:\Users\user\Desktop\0438.pdf.exe Code function: 0_2_00007FF655DA3964 0_2_00007FF655DA3964
Source: C:\Users\user\Desktop\0438.pdf.exe Code function: 0_2_00007FF655D9C96C 0_2_00007FF655D9C96C
Source: C:\Users\user\Desktop\0438.pdf.exe Code function: 0_2_00007FF655DB8C1C 0_2_00007FF655DB8C1C
Source: C:\Users\user\Desktop\0438.pdf.exe Code function: 0_2_00007FF655DA4B98 0_2_00007FF655DA4B98
Source: C:\Users\user\Desktop\0438.pdf.exe Code function: 0_2_00007FF655D9BB90 0_2_00007FF655D9BB90
Source: C:\Users\user\Desktop\0438.pdf.exe Code function: 0_2_00007FF655D95B60 0_2_00007FF655D95B60
PE file contains executable resources (Code or Archives)
Source: ROMViewer.exe.4.dr Static PE information: Resource name: RT_VERSION type: Intel ia64 COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: ROMServer.exe.4.dr Static PE information: Resource name: RT_VERSION type: Intel ia64 COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: ROMServer.exe0.4.dr Static PE information: Resource name: RT_VERSION type: Intel ia64 COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
PE file contains more sections than normal
Source: ROMServer.exe.4.dr Static PE information: Number of sections : 11 > 10
Source: ROMFUSClient.exe.4.dr Static PE information: Number of sections : 11 > 10
Source: ROMServer.exe0.4.dr Static PE information: Number of sections : 11 > 10
Source: ROMViewer.exe.4.dr Static PE information: Number of sections : 11 > 10
PE file contains strange resources
Source: ROMViewer.exe.4.dr Static PE information: Resource name: RT_RCDATA type: Delphi compiled form 'TfmEditBinaryValue'
Sample file is different than original file name gathered from version info
Source: 0438.pdf.exe, 00000000.00000003.2142040479.000001D852DC2000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename_IsIcoRes.exe< vs 0438.pdf.exe
Source: 0438.pdf.exe, 00000000.00000003.2142040479.000001D852DC2000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameSetAllUsers.dll< vs 0438.pdf.exe
Source: 0438.pdf.exe, 00000000.00000003.2153671361.000001D84EE2F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameAcrobat.exe< vs 0438.pdf.exe
Source: 0438.pdf.exe, 00000000.00000003.2153805384.000001D854283000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameAcrobat.exe< vs 0438.pdf.exe
Source: 0438.pdf.exe, 00000000.00000002.2158391585.000001D854283000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameAcrobat.exe< vs 0438.pdf.exe
Source: 0438.pdf.exe, 00000000.00000002.2157778409.000001D84EE2F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameAcrobat.exe< vs 0438.pdf.exe
Source: 0438.pdf.exe, 00000000.00000003.2142040479.000001D852E56000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename_IsIcoRes.exe< vs 0438.pdf.exe
Source: 0438.pdf.exe, 00000000.00000003.2142040479.000001D852E48000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename_IsIcoRes.exe< vs 0438.pdf.exe
Source: 0438.pdf.exe, 00000000.00000003.2157020100.000001D84EE2F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameAcrobat.exe< vs 0438.pdf.exe
Source: 0438.pdf.exe, 00000000.00000003.2153945402.000001D84EE2F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameAcrobat.exe< vs 0438.pdf.exe
Source: 0438.pdf.exe, 00000000.00000003.2142040479.000001D852DFE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameISRegSvr.dll vs 0438.pdf.exe
Source: 0438.pdf.exe, 00000000.00000003.2142040479.000001D852E62000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename_IsIcoRes.exe< vs 0438.pdf.exe
Source: classification engine Classification label: mal76.troj.evad.winEXE@51/93@1/4
Source: C:\Users\user\Desktop\0438.pdf.exe Code function: 0_2_00007FF655D8B6D8 GetLastError,FormatMessageW,LocalFree, 0_2_00007FF655D8B6D8
Source: C:\Users\user\Desktop\0438.pdf.exe Code function: 0_2_00007FF655DA8624 FindResourceW,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,CreateStreamOnHGlobal,GdipAlloc,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree, 0_2_00007FF655DA8624
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\LiteManager Pro - Server Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal Jump to behavior
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\ROMFUSLocal
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\ROMFUSTray
Source: C:\Users\user\Desktop\0438.pdf.exe File created: C:\Users\user\AppData\Local\Temp\__tmp_rar_sfx_access_check_5451828 Jump to behavior
Source: Yara match File source: 11.0.ROMFUSClient.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.0.ROMServer.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000B.00000000.2234439109.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000000.2252577316.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match File source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe, type: DROPPED
Source: Yara match File source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe, type: DROPPED
Source: Yara match File source: C:\Program Files (x86)\LiteManager Pro - Server\files\ROMViewer.exe, type: DROPPED
Source: 0438.pdf.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\Desktop\0438.pdf.exe File read: C:\Windows\win.ini Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: 0438.pdf.exe ReversingLabs: Detection: 44%
Source: C:\Users\user\Desktop\0438.pdf.exe File read: C:\Users\user\Desktop\0438.pdf.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\0438.pdf.exe "C:\Users\user\Desktop\0438.pdf.exe"
Source: C:\Users\user\Desktop\0438.pdf.exe Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\pdf.msi" /qn
Source: C:\Users\user\Desktop\0438.pdf.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\Doc.pdf"
Source: unknown Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1736,i,7783600837662025009,4322504478347230784,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\msiexec.exe Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /server /siex /silentinstall
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe" /siex /silentinstall
Source: C:\Windows\System32\msiexec.exe Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /server /firewall
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe" /firewall
Source: C:\Windows\System32\msiexec.exe Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /server /start
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe" /start
Source: unknown Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe"
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe"
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray
Source: C:\Users\user\Desktop\0438.pdf.exe Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\pdf.msi" /qn Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\Doc.pdf" Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /server /siex /silentinstall Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /server /firewall Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /server /start Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1736,i,7783600837662025009,4322504478347230784,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe" /siex /silentinstall
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe" /firewall
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe" /start
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe"
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray
Source: C:\Users\user\Desktop\0438.pdf.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe Section loaded: dxgidebug.dll Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe Section loaded: riched20.dll Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe Section loaded: usp10.dll Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe Section loaded: msls31.dll Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe Section loaded: pcacli.dll Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: srpapi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: tsappcmp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: tsappcmp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: pcacli.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: cabinet.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: dlnashext.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: wpdshext.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: linkinfo.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: ntshrui.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: cscapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: qmgr.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: bitsperf.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: firewallapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: esent.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: fwbase.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: flightsettings.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: netprofm.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: npmproxy.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: bitsigd.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: upnp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ssdpapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: appxdeploymentclient.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wsmauto.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wsmsvc.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: dsrole.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: pcwum.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msv1_0.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ntlmshared.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: cryptdll.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: webio.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: rmclient.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: usermgrcli.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: execmodelclient.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: twinapi.appcore.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: execmodelproxy.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: resourcepolicyclient.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: vssapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: vsstrace.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: samlib.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: es.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: bitsproxy.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: winmm.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: wininet.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: avicap32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: version.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: netapi32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: msacm32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: dsound.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: msvfw32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: powrprof.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: powrprof.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: netutils.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: umpdc.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: winsta.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: security.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: secur32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: sspicli.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: idndl.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: wldp.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: propsys.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: dwmapi.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: profapi.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: edputil.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: urlmon.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: iertutil.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: srvcli.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: windows.staterepositoryps.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: wintypes.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: appresolver.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: bcp47langs.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: slc.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: userenv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: sppc.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: onecorecommonproxystub.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: apphelp.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: pcacli.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: mpr.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: sfc_os.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: apphelp.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: winmm.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: wininet.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: avicap32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: version.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: netapi32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: avifil32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: msvfw32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: wsock32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: dsound.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: msvfw32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: winmm.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: winmm.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: powrprof.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: powrprof.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: msacm32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: netutils.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: umpdc.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: winsta.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: security.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: secur32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: sspicli.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: wldp.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: winmm.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: wininet.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: avicap32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: version.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: netapi32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: msacm32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: dsound.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: msvfw32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: winmm.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: powrprof.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: powrprof.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: winmm.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: netutils.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: umpdc.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: winsta.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: security.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: secur32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: sspicli.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: idndl.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: wldp.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: dwmapi.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: propsys.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: profapi.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: edputil.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: urlmon.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: iertutil.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: srvcli.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: windows.staterepositoryps.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: wintypes.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: appresolver.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: bcp47langs.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: slc.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: userenv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: sppc.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: onecorecommonproxystub.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: pcacli.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: mpr.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: sfc_os.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: winmm.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: wininet.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: avicap32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: version.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: netapi32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: avifil32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: msvfw32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: wsock32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: dsound.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: msvfw32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: msvfw32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: msacm32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: powrprof.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: powrprof.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: netutils.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: umpdc.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: winsta.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: security.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: secur32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: sspicli.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: firewallapi.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: fwbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: fwpolicyiomgr.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: sxs.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: winmm.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: wininet.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: avicap32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: version.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: netapi32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: msacm32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: dsound.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: msvfw32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: powrprof.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: powrprof.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: netutils.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: umpdc.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: winsta.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: security.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: secur32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: sspicli.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: idndl.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: wldp.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: dwmapi.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: propsys.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: profapi.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: edputil.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: urlmon.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: iertutil.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: srvcli.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: windows.staterepositoryps.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: wintypes.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: appresolver.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: bcp47langs.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: slc.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: userenv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: sppc.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: onecorecommonproxystub.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: pcacli.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: mpr.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: sfc_os.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: winmm.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: wininet.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: avicap32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: version.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: netapi32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: avifil32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: msvfw32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: wsock32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: dsound.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: msvfw32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: msvfw32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: msacm32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: powrprof.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: powrprof.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: netutils.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: umpdc.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: winsta.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: security.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: secur32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: sspicli.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: wldp.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: winmm.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: wininet.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: avicap32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: version.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: netapi32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: avifil32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: msvfw32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: wsock32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: dsound.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: msvfw32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: msvfw32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: msacm32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: powrprof.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: powrprof.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: netutils.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: umpdc.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: winsta.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: security.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: secur32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: sspicli.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: wldp.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: idndl.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: msxml6.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: iccvid.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: iyuv_32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: iyuv_32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: msrle32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: msvidc32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: tsbyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: iccvid.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: iyuv_32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: iyuv_32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: msrle32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: msvidc32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: tsbyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: iccvid.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: iyuv_32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: iyuv_32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: msrle32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: msvidc32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: tsbyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: iccvid.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: iyuv_32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: iyuv_32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: msrle32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: msvidc32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: tsbyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: iccvid.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: iyuv_32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: iyuv_32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: msrle32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: msvidc32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: userenv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: profapi.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: tsbyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: iccvid.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: iyuv_32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: iyuv_32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: msrle32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: msvidc32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: tsbyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: iccvid.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: iyuv_32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: iyuv_32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: msrle32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: msvidc32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: tsbyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Section loaded: mswsock.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: winmm.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: wininet.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Section loaded: avicap32.dll
Source: C:\Users\user\Desktop\0438.pdf.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32 Jump to behavior
Source: Start LM-Server.lnk.4.dr LNK file: ..\..\..\..\..\..\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe
Source: Uninstall LiteManager - Server.lnk.4.dr LNK file: ..\..\..\..\..\..\Windows\SysWOW64\msiexec.exe
Source: Stop LM-Server.lnk.4.dr LNK file: ..\..\..\..\..\..\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe
Source: Settings for LM-Server.lnk.4.dr LNK file: ..\..\..\..\..\..\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe
Source: Window Recorder Window detected: More than 3 window changes detected
Source: 0438.pdf.exe Static PE information: Image base 0x140000000 > 0x60000000
Source: 0438.pdf.exe Static file information: File size 11654747 > 1048576
Source: 0438.pdf.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 0438.pdf.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 0438.pdf.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 0438.pdf.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 0438.pdf.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 0438.pdf.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: 0438.pdf.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Source: 0438.pdf.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: D:\Projects\WinRAR\sfx\build\sfxrar64\Release\sfxrar.pdb source: 0438.pdf.exe
Source: 0438.pdf.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 0438.pdf.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 0438.pdf.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 0438.pdf.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 0438.pdf.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
File is packed with WinRar
Source: C:\Users\user\Desktop\0438.pdf.exe File created: C:\Users\user\AppData\Local\Temp\__tmp_rar_sfx_access_check_5451828 Jump to behavior
PE file contains sections with non-standard names
Source: 0438.pdf.exe Static PE information: section name: .didat
Source: 0438.pdf.exe Static PE information: section name: _RDATA
Source: ROMViewer.exe.4.dr Static PE information: section name: .didata
Source: ROMFUSClient.exe.4.dr Static PE information: section name: .didata
Source: ROMwln.dll.4.dr Static PE information: section name: .didata
Source: ROMServer.exe.4.dr Static PE information: section name: .didata
Source: HookDrv.dll.4.dr Static PE information: section name: .didata
Source: ROMServer.exe0.4.dr Static PE information: section name: .didata
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\0438.pdf.exe Code function: 0_2_00007FF655DC5156 push rsi; retf 0_2_00007FF655DC5157
Source: C:\Users\user\Desktop\0438.pdf.exe Code function: 0_2_00007FF655DC5166 push rsi; retf 0_2_00007FF655DC5167
Drops PE files
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\config_server_B6BD2967C67B44649764F06ADFFD6458.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\stop_server_51B516B87C64408FA3C56354EA2277C2.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\LiteManager Pro - Server\files\ROMServer.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\ARPPRODUCTICON.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\LiteManager Pro - Server\HookDrv.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\UNINST_Uninstall_L_78AA5B6662514D94A847D6C603AF0895.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\LiteManager Pro - Server\ROMwln.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\LiteManager Pro - Server\AledensoftIpcServer.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\LiteManager Pro - Server\files\ROMViewer.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\ROMServer.exe_9D09B2BC25A2414CBD848E2B75898676.exe Jump to dropped file
Drops PE files to the windows directory (C:\Windows)
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\config_server_B6BD2967C67B44649764F06ADFFD6458.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\stop_server_51B516B87C64408FA3C56354EA2277C2.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\ARPPRODUCTICON.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\UNINST_Uninstall_L_78AA5B6662514D94A847D6C603AF0895.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\ROMServer.exe_9D09B2BC25A2414CBD848E2B75898676.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\LiteManager Pro - Server\EULA.rtf Jump to behavior
Creates or modifies windows services
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Application\romserver.exe
Stores files to the Windows start menu directory
Source: C:\Windows\System32\msiexec.exe File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LiteManager Pro - Server Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LiteManager Pro - Server\Start LM-Server.lnk Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LiteManager Pro - Server\Uninstall LiteManager - Server.lnk Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LiteManager Pro - Server\Stop LM-Server.lnk Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LiteManager Pro - Server\Settings for LM-Server.lnk Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Uses an obfuscated file name to hide its real file extension (double extension)
Source: Possible double extension: pdf.exe Static PE information: 0438.pdf.exe
Stores large binary data to the registry
Source: C:\Windows\System32\msiexec.exe Key value created or modified: HKEY_LOCAL_MACHINE\SYSTEM\LiteManager\v3.4\Server\Parameters NoIPSettings Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Window / User API: threadDelayed 3225
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Window / User API: threadDelayed 6579
Found dropped PE file which has not been started or loaded
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\config_server_B6BD2967C67B44649764F06ADFFD6458.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\stop_server_51B516B87C64408FA3C56354EA2277C2.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\LiteManager Pro - Server\files\ROMServer.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\ARPPRODUCTICON.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\LiteManager Pro - Server\HookDrv.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\UNINST_Uninstall_L_78AA5B6662514D94A847D6C603AF0895.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\LiteManager Pro - Server\ROMwln.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\LiteManager Pro - Server\AledensoftIpcServer.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\LiteManager Pro - Server\files\ROMViewer.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\ROMServer.exe_9D09B2BC25A2414CBD848E2B75898676.exe Jump to dropped file
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\System32\svchost.exe TID: 4364 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe TID: 8080 Thread sleep time: -60000s >= -30000s
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe TID: 8028 Thread sleep count: 208 > 30
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe TID: 7384 Thread sleep time: -1612500s >= -30000s
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe TID: 7384 Thread sleep time: -3289500s >= -30000s
Queries disk information (often used to detect virtual machines)
Source: C:\Windows\System32\svchost.exe File opened: PhysicalDrive0 Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Last function: Thread delayed
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe Code function: 0_2_00007FF655DAB190 EndDialog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,EndDialog,GetDlgItem,SendMessageW,SendMessageW,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetWindowTextW,SetDlgItemTextW,SetWindowTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,SendMessageW,SendDlgItemMessageW,GetDlgItem,SendMessageW,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EndDialog,EnableWindow,SendMessageW,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn, 0_2_00007FF655DAB190
Source: C:\Users\user\Desktop\0438.pdf.exe Code function: 0_2_00007FF655D940BC FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn, 0_2_00007FF655D940BC
Source: C:\Users\user\Desktop\0438.pdf.exe Code function: 0_2_00007FF655DBFCA0 FindFirstFileExA, 0_2_00007FF655DBFCA0
Source: C:\Users\user\Desktop\0438.pdf.exe Code function: 0_2_00007FF655DB16A4 VirtualQuery,GetSystemInfo, 0_2_00007FF655DB16A4
Source: ROMFUSClient.exe, 0000000D.00000002.2278363197.0000000000B5A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: ROMFUSClient.exe, 0000000D.00000002.2278363197.0000000000B5A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: ROMFUSClient.exe, 0000001D.00000002.3134326476.0000000000C78000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll/
Source: ROMFUSClient.exe, 00000014.00000002.3393245652.0000000000D18000.00000004.00000020.00020000.00000000.sdmp, ROMFUSClient.exe, 00000016.00000002.2316974063.0000000000B88000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllp
Source: svchost.exe, 00000006.00000002.3400883318.00000152C842B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.3405086246.00000152CDA40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.3405187560.00000152CDA53000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: ROMFUSClient.exe, 0000000D.00000002.2278363197.0000000000B5A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: ROMFUSClient.exe, 0000000F.00000003.2318499997.0000000000BF9000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}|
Source: ROMFUSClient.exe, 0000000B.00000002.2261534094.0000000000D09000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}BL
Source: ROMFUSClient.exe, 00000017.00000002.2329035587.0000000000D78000.00000004.00000020.00020000.00000000.sdmp, ROMFUSClient.exe, 00000018.00000002.2337206079.0000000000AA8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll]
Source: ROMServer.exe, 00000012.00000002.3392369050.0000000000DA8000.00000004.00000020.00020000.00000000.sdmp, ROMFUSClient.exe, 00000015.00000002.3393174730.0000000000CB8000.00000004.00000020.00020000.00000000.sdmp, ROMFUSClient.exe, 00000019.00000002.2352309440.0000000000D38000.00000004.00000020.00020000.00000000.sdmp, ROMFUSClient.exe, 0000001A.00000002.2358537336.0000000000AF8000.00000004.00000020.00020000.00000000.sdmp, ROMFUSClient.exe, 0000001B.00000002.2380622367.0000000000C28000.00000004.00000020.00020000.00000000.sdmp, ROMFUSClient.exe, 0000001E.00000002.3336564501.0000000000B58000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Windows\System32\msiexec.exe Process information queried: ProcessInformation Jump to behavior
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\0438.pdf.exe Code function: 0_2_00007FF655DB76D8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00007FF655DB76D8
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\0438.pdf.exe Code function: 0_2_00007FF655DC0D20 GetProcessHeap, 0_2_00007FF655DC0D20
Enables debug privileges
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Process token adjusted: Debug
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Process token adjusted: Debug
Launches processes in debugging mode, may be used to hinder debugging
Source: C:\Windows\System32\msiexec.exe Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /server /start Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe Code function: 0_2_00007FF655DB76D8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00007FF655DB76D8
Source: C:\Users\user\Desktop\0438.pdf.exe Code function: 0_2_00007FF655DB3170 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00007FF655DB3170
Source: C:\Users\user\Desktop\0438.pdf.exe Code function: 0_2_00007FF655DB2510 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_00007FF655DB2510
Source: C:\Users\user\Desktop\0438.pdf.exe Code function: 0_2_00007FF655DB3354 SetUnhandledExceptionFilter, 0_2_00007FF655DB3354
Contains functionality to launch a program with higher privileges
Source: C:\Users\user\Desktop\0438.pdf.exe Code function: 0_2_00007FF655DAB190 EndDialog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,EndDialog,GetDlgItem,SendMessageW,SendMessageW,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetWindowTextW,SetDlgItemTextW,SetWindowTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,SendMessageW,SendDlgItemMessageW,GetDlgItem,SendMessageW,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EndDialog,EnableWindow,SendMessageW,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn, 0_2_00007FF655DAB190
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\0438.pdf.exe Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\pdf.msi" /qn Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\Doc.pdf" Jump to behavior
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe" /siex /silentinstall
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe" /firewall
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe" /start
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\Desktop\0438.pdf.exe Code function: 0_2_00007FF655DC58E0 cpuid 0_2_00007FF655DC58E0
Contains functionality to query locales information (e.g. system language)
Source: C:\Users\user\Desktop\0438.pdf.exe Code function: GetLocaleInfoW,GetNumberFormatW, 0_2_00007FF655DAA2CC
Queries the installation date of Windows
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate
Queries the product ID of Windows
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\System32\msiexec.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe Code function: 0_2_00007FF655DB0754 GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,MapViewOfFile,UnmapViewOfFile,CloseHandle,SetEnvironmentVariableW,GetLocalTime,swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,DialogBoxParamW,Sleep,DeleteObject,DeleteObject,CloseHandle,OleUninitialize,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn, 0_2_00007FF655DB0754
Source: C:\Users\user\Desktop\0438.pdf.exe Code function: 0_2_00007FF655D951A4 GetVersionExW, 0_2_00007FF655D951A4

Remote Access Functionality
barindex
Enables remote desktop connection
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe Registry key created or modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Terminal Server AllowRemoteRPC
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1545741 Sample: 0438.pdf.exe Startdate: 30/10/2024 Architecture: WINDOWS Score: 76 57 x1.i.lencr.org 2->57 59 edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com 2->59 61 2 other IPs or domains 2->61 71 Multi AV Scanner detection for submitted file 2->71 73 Sigma detected: Suspicious Double Extension File Execution 2->73 75 Uses an obfuscated file name to hide its real file extension (double extension) 2->75 77 2 other signatures 2->77 9 ROMServer.exe 2->9         started        13 msiexec.exe 99 61 2->13         started        16 0438.pdf.exe 6 9 2->16         started        18 svchost.exe 1 1 2->18         started        signatures3 process4 dnsIp5 63 111.90.140.76, 465, 49785, 49786 SHINJIRU-MY-AS-APShinjiruTechnologySdnBhdMY Malaysia 9->63 65 65.21.245.7, 49789, 49790, 49798 CP-ASDE United States 9->65 79 Enables remote desktop connection 9->79 81 Enables network access during safeboot for specific services 9->81 20 ROMFUSClient.exe 9->20         started        22 ROMFUSClient.exe 9->22         started        24 ROMFUSClient.exe 9->24         started        36 7 other processes 9->36 49 C:\Program Files (x86)\...\ROMServer.exe, PE32 13->49 dropped 51 stop_server_51B516...3C56354EA2277C2.exe, PE32 13->51 dropped 53 config_server_B6BD...764F06ADFFD6458.exe, PE32 13->53 dropped 55 9 other files (none is malicious) 13->55 dropped 26 ROMFUSClient.exe 13->26         started        28 ROMFUSClient.exe 13->28         started        30 ROMFUSClient.exe 13->30         started        32 Acrobat.exe 72 16->32         started        34 msiexec.exe 16->34         started        67 127.0.0.1 unknown unknown 18->67 file6 signatures7 process8 process9 38 ROMServer.exe 26->38         started        40 ROMServer.exe 28->40         started        42 ROMServer.exe 30->42         started        44 AcroCEF.exe 107 32->44         started        process10 46 AcroCEF.exe 44->46         started        dnsIp11 69 96.7.168.138, 443, 49760 INTERNEXABRASILOPERADORADETELECOMUNICACOESSABR United States 46->69
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
96.7.168.138
 unknown United States
262589 INTERNEXABRASILOPERADORADETELECOMUNICACOESSABR false
111.90.140.76
 unknown Malaysia
45839 SHINJIRU-MY-AS-APShinjiruTechnologySdnBhdMY true
65.21.245.7
 unknown United States
199592 CP-ASDE false

Private

IP
127.0.0.1

Contacted Domains

Name IP Active
bg.microsoft.map.fastly.net 199.232.210.172 true
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com 84.201.210.37 true
x1.i.lencr.org unknown unknown