| File name: | VGMÂ WORD - SO.4208 - PO WK16 TPES25040659.scr |
| Full analysis: | https://app.any.run/tasks/f2011d51-1b5a-4e89-bc21-64ce5231e3cc |
| Verdict: | Malicious activity |
| Threats: | Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links. |
| Analysis date: | April 29, 2025, 03:48:45 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections |
| MD5: | 63E69D6AA489B9486D4833CD70645751 |
| SHA1: | AEA576B2C5861FAD4BFEA1E2928380829CD72C54 |
| SHA256: | E87F8539CE8AC8DCA6A61AB1D1543EF892043DD2793AE52EF893FCDF8F2A92F5 |
| SSDEEP: | 49152:Kkrv8gkkrvefEuF93v5IKLnsO3pJnMui9lQZBf5y7O6czrXmLOGmTN5Z2tOWPcO6:Kkrv8gkkrvefEuXFLnswpDiAIOpzrXP1 |
| .exe | | | Generic CIL Executable (.NET, Mono, etc.) (63.1) |
|---|---|---|
| .exe | | | Win64 Executable (generic) (23.8) |
| .dll | | | Win32 Dynamic Link Library (generic) (5.6) |
| .exe | | | Win32 Executable (generic) (3.8) |
| .exe | | | Generic Win/DOS Executable (1.7) |
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2025:04:29 02:41:44+00:00 |
| ImageFileCharacteristics: | Executable, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 48 |
| CodeSize: | 1060864 |
| InitializedDataSize: | 10752 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x104e7a |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Neutral |
| CharacterSet: | Unicode |
| Comments: | Engaging word puzzle game with multiple challenge levels and vocabulary enhancement |
| CompanyName: | Phantom Dimension Software |
| FileDescription: | LexiQuest Deluxe |
| FileVersion: | 1.0.0.0 |
| InternalName: | zNxa.exe |
| LegalCopyright: | Copyright © Phantom Dimension Software 2025 |
| LegalTrademarks: | LexiQuest™ |
| OriginalFileName: | zNxa.exe |
| ProductName: | LexiQuest Deluxe |
| ProductVersion: | 1.0.0.0 |
| AssemblyVersion: | 1.0.3.0 |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 684 | "C:\Users\admin\AppData\Local\Temp\VGMÂ WORD - SO.4208 - PO WK16 TPES25040659.scr.exe" | C:\Users\admin\AppData\Local\Temp\VGMÂ WORD - SO.4208 - PO WK16 TPES25040659.scr.exe | VGMÂ WORD - SO.4208 - PO WK16 TPES25040659.scr.exe | ||||||||||||
User: admin Company: Phantom Dimension Software Integrity Level: MEDIUM Description: LexiQuest Deluxe Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
| 856 | "C:\ProgramData\Adobe-Reader\Adobe-Reader.exe" | C:\ProgramData\Adobe-Reader\Adobe-Reader.exe | — | explorer.exe | |||||||||||
User: admin Company: Phantom Dimension Software Integrity Level: MEDIUM Description: LexiQuest Deluxe Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
| 1324 | C:\WINDOWS\System32\slui.exe -Embedding | C:\Windows\System32\slui.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Activation Client Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2268 | "C:\Users\admin\AppData\Local\Temp\VGMÂ WORD - SO.4208 - PO WK16 TPES25040659.scr.exe" | C:\Users\admin\AppData\Local\Temp\VGMÂ WORD - SO.4208 - PO WK16 TPES25040659.scr.exe | VGMÂ WORD - SO.4208 - PO WK16 TPES25040659.scr.exe | ||||||||||||
User: admin Company: Phantom Dimension Software Integrity Level: HIGH Description: LexiQuest Deluxe Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
| 3304 | C:\Windows\SysWOW64\recover.exe /stext "C:\Users\admin\AppData\Local\Temp\vqwr" | C:\Windows\SysWOW64\recover.exe | — | Adobe-Reader.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Recover Files Utility Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4224 | "C:\Users\admin\AppData\Local\Temp\VGMÂ WORD - SO.4208 - PO WK16 TPES25040659.scr.exe" | C:\Users\admin\AppData\Local\Temp\VGMÂ WORD - SO.4208 - PO WK16 TPES25040659.scr.exe | — | explorer.exe | |||||||||||
User: admin Company: Phantom Dimension Software Integrity Level: MEDIUM Description: LexiQuest Deluxe Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
| 4628 | C:\Windows\SysWOW64\recover.exe /stext "C:\Users\admin\AppData\Local\Temp\lwrynnozrczmmdvypqucpieklpsktbgn" | C:\Windows\SysWOW64\recover.exe | Adobe-Reader.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Recover Files Utility Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4932 | C:\WINDOWS\SysWOW64\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7} | C:\Windows\SysWOW64\dllhost.exe | svchost.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: COM Surrogate Exit code: 0 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5508 | "C:\ProgramData\Adobe-Reader\Adobe-Reader.exe" | C:\ProgramData\Adobe-Reader\Adobe-Reader.exe | Adobe-Reader.exe | ||||||||||||
User: admin Company: Phantom Dimension Software Integrity Level: HIGH Description: LexiQuest Deluxe Version: 1.0.0.0 Modules
| |||||||||||||||
| 6480 | C:\Windows\SysWOW64\recover.exe /stext "C:\Users\admin\AppData\Local\Temp\aumgmudfduhzcoyuygibeejtdaaja" | C:\Windows\SysWOW64\recover.exe | Adobe-Reader.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Recover Files Utility Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| (PID) Process: | (4932) dllhost.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer |
| Operation: | write | Name: | SlowContextMenuEntries |
Value: 6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000 | |||
| (PID) Process: | (2268) VGMÂ WORD - SO.4208 - PO WK16 TPES25040659.scr.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run |
| Operation: | write | Name: | Adobe-Reader-ZH1IFZ |
Value: "C:\ProgramData\Adobe-Reader\Adobe-Reader.exe" | |||
| (PID) Process: | (2268) VGMÂ WORD - SO.4208 - PO WK16 TPES25040659.scr.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run |
| Operation: | write | Name: | Adobe-Reader-ZH1IFZ |
Value: "C:\ProgramData\Adobe-Reader\Adobe-Reader.exe" | |||
| (PID) Process: | (5508) Adobe-Reader.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run |
| Operation: | write | Name: | Adobe-Reader-ZH1IFZ |
Value: "C:\ProgramData\Adobe-Reader\Adobe-Reader.exe" | |||
| (PID) Process: | (5508) Adobe-Reader.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run |
| Operation: | write | Name: | Adobe-Reader-ZH1IFZ |
Value: "C:\ProgramData\Adobe-Reader\Adobe-Reader.exe" | |||
| (PID) Process: | (5508) Adobe-Reader.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Adobe-Reader-ZH1IFZ |
| Operation: | write | Name: | exepath |
Value: 2B606D87BB9F144CC45DED747D2D0C60D0E843607C7427AE39FC2D70CF42B945517096FFAC0AB7ED34F0FDFA48782A4E4EE19C8BD515114EFDCDDA721BC9C3AD7542FED8625815F0FB97A1398E28EF5E0C80C4884B439796CC24 | |||
| (PID) Process: | (5508) Adobe-Reader.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Adobe-Reader-ZH1IFZ |
| Operation: | write | Name: | licence |
Value: DF0EC413BD1D113528BA88DD201F6EB7 | |||
| (PID) Process: | (5508) Adobe-Reader.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Adobe-Reader-ZH1IFZ |
| Operation: | write | Name: | time |
Value: | |||
| (PID) Process: | (5508) Adobe-Reader.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Adobe-Reader-ZH1IFZ |
| Operation: | write | Name: | UID |
Value: 41298772 | |||
| (PID) Process: | (5508) Adobe-Reader.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6480 | recover.exe | C:\Users\admin\AppData\Local\Temp\bhv8049.tmp | — | |
MD5:— | SHA256:— | |||
| 6480 | recover.exe | C:\Users\admin\AppData\Local\Temp\aumgmudfduhzcoyuygibeejtdaaja | text | |
MD5:73AFEF57A57FF8285682E59AEBA8FE4A | SHA256:9081F636845E9A6B7D781F2F35A28B33B7FDF5373075B435C5B373119D0934A3 | |||
| 2268 | VGMÂ WORD - SO.4208 - PO WK16 TPES25040659.scr.exe | C:\ProgramData\Adobe-Reader\Adobe-Reader.exe | executable | |
MD5:63E69D6AA489B9486D4833CD70645751 | SHA256:E87F8539CE8AC8DCA6A61AB1D1543EF892043DD2793AE52EF893FCDF8F2A92F5 | |||
| 5508 | Adobe-Reader.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\json[1].json | binary | |
MD5:1C78AE016232CE6688FDEE2E02A34EAC | SHA256:AAE80B553F651F8B2BEF722772860C49349D68E51770D88CA84311DC4A2E543C | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
5496 | MoUsoCoreWorker.exe | GET | 200 | 2.16.164.49:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
5496 | MoUsoCoreWorker.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 2.23.77.188:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
4108 | SIHClient.exe | GET | 200 | 23.38.73.129:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
5508 | Adobe-Reader.exe | GET | 200 | 178.237.33.50:80 | http://geoplugin.net/json.gp | unknown | — | — | whitelisted |
4108 | SIHClient.exe | GET | 200 | 23.38.73.129:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
2104 | svchost.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5496 | MoUsoCoreWorker.exe | 2.16.164.49:80 | crl.microsoft.com | Akamai International B.V. | NL | whitelisted |
5496 | MoUsoCoreWorker.exe | 95.101.149.131:80 | www.microsoft.com | Akamai International B.V. | NL | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
2112 | svchost.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
3216 | svchost.exe | 172.211.123.249:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | FR | whitelisted |
6544 | svchost.exe | 40.126.32.138:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6544 | svchost.exe | 2.23.77.188:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
geoplugin.net |
| whitelisted |
PID | Process | Class | Message |
|---|---|---|---|
5508 | Adobe-Reader.exe | A Network Trojan was detected | REMOTE [ANY.RUN] REMCOS TLS Connection JA3 Hash |
5508 | Adobe-Reader.exe | Malware Command and Control Activity Detected | ET JA3 Hash - Remcos 3.x/4.x TLS Connection |
5508 | Adobe-Reader.exe | A Network Trojan was detected | REMOTE [ANY.RUN] REMCOS TLS Connection JA3 Hash |
5508 | Adobe-Reader.exe | Malware Command and Control Activity Detected | ET JA3 Hash - Remcos 3.x/4.x TLS Connection |