File name:

Silviozas Premium Proxy.exe

Full analysis: https://app.any.run/tasks/4ebab7e0-b262-495f-8bca-dcd164cb6b5e
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: December 09, 2024, 19:19:18
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
ims-api
generic
growtopia
stealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (console) x86-64, for MS Windows, 3 sections
MD5:

A52EFEBFF36B2E16639E5C4F7D229C82

SHA1:

E96828E276BE590838BE8351FBC0AE82C7FCD780

SHA256:

7C8ED722D41722E8DF5C2C6134587E07F80A95154654CFC08253F6671E202CCE

SSDEEP:

98304:uWWBl0lgHaIbTqzLxsC4mn2yUHpryR3YNaHSYsy+2DxuSPgFeI/o30rfZUnEVttT:mRi

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Adds path to the Windows Defender exclusion list

      • Silviozas Premium Proxy.exe (PID: 6760)
      • cmd.exe (PID: 5300)

    • GROWTOPIA has been detected (YARA)

      • Silviozas Premium Proxy.exe (PID: 6760)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • Silviozas Premium Proxy.exe (PID: 6760)

    • Script adds exclusion path to Windows Defender

      • cmd.exe (PID: 5300)

    • Executable content was dropped or overwritten

      • Silviozas Premium Proxy.exe (PID: 6760)

    • Likely accesses (executes) a file from the Public directory

      • powershell.exe (PID: 5464)
      • cmd.exe (PID: 5300)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 5300)

    • Possible usage of Discord/Telegram API has been detected (YARA)

      • Silviozas Premium Proxy.exe (PID: 6760)

  • INFO

    • Reads the computer name

      • Silviozas Premium Proxy.exe (PID: 6760)

    • Checks supported languages

      • Silviozas Premium Proxy.exe (PID: 6760)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 5464)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 5464)

    • Gets the hash of the file via CERTUTIL.EXE

      • certutil.exe (PID: 4556)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

ims-api

(PID) Process(6760) Silviozas Premium Proxy.exe
Discord-Webhook-Tokens (1)972513769420902420/uHnh17PrJLhjDcGlQXffyAYWa_ca_ZEVL867y1KZBViRbxoQJu9144vAMEB51dh7EuII
Discord-Info-Links
972513769420902420/uHnh17PrJLhjDcGlQXffyAYWa_ca_ZEVL867y1KZBViRbxoQJu9144vAMEB51dh7EuII
Get Webhook Infohttps://discord.com/api/webhooks/972513769420902420/uHnh17PrJLhjDcGlQXffyAYWa_ca_ZEVL867y1KZBViRbxoQJu9144vAMEB51dh7EuII
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2024:12:05 21:40:16+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.35
CodeSize: 2109440
InitializedDataSize: 73728
UninitializedDataSize: 7172096
EntryPoint: 0x8d9630
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows command line
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
140
Monitored processes
12
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start #GROWTOPIA silviozas premium proxy.exe conhost.exe no specs cmd.exe no specs cmd.exe no specs powershell.exe no specs cmd.exe no specs cmd.exe no specs certutil.exe no specs find.exe no specs find.exe no specs svchost.exe silviozas premium proxy.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
556"C:\Users\admin\Downloads\Silviozas Premium Proxy.exe" C:\Users\admin\Downloads\Silviozas Premium Proxy.exe—explorer.exe
User:
admin
Company:
Silviozas
Integrity Level:
MEDIUM
Description:
A program that makes an easier playing experience.
Exit code:
3221226540
Modules
Images
c:\users\admin\downloads\silviozas premium proxy.exe
c:\windows\system32\ntdll.dll
2192C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2928C:\WINDOWS\system32\cmd.exe /c color 0AC:\Windows\System32\cmd.exe—Silviozas Premium Proxy.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
4556certutil -hashfile "C:\Users\admin\Downloads\Silviozas Premium Proxy.exe" MD5 C:\Windows\System32\certutil.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
CertUtil.exe
Exit code:
2147942402
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\certutil.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
5000C:\WINDOWS\system32\cmd.exe /c certutil -hashfile "C:\Users\admin\Downloads\Silviozas Premium Proxy.exe" MD5 | find /i /v "md5" | find /i /v "certutil"C:\Windows\System32\cmd.exe—Silviozas Premium Proxy.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
5096find /i /v "md5" C:\Windows\System32\find.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Find String (grep) Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\find.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\fsutilext.dll
5300C:\WINDOWS\system32\cmd.exe /c powershell "Add-MpPreference -ExclusionPath 'C:\Users\Public\Proxy_Stuff\Silviozas Premium Proxy.exe'"C:\Windows\System32\cmd.exe—Silviozas Premium Proxy.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
5464powershell "Add-MpPreference -ExclusionPath 'C:\Users\Public\Proxy_Stuff\Silviozas Premium Proxy.exe'"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
5588find /i /v "certutil"C:\Windows\System32\find.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Find String (grep) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\find.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\fsutilext.dll
6760"C:\Users\admin\Downloads\Silviozas Premium Proxy.exe" C:\Users\admin\Downloads\Silviozas Premium Proxy.exe
explorer.exe
User:
admin
Company:
Silviozas
Integrity Level:
HIGH
Description:
A program that makes an easier playing experience.
Modules
Images
c:\users\admin\downloads\silviozas premium proxy.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
ims-api
(PID) Process(6760) Silviozas Premium Proxy.exe
Discord-Webhook-Tokens (1)972513769420902420/uHnh17PrJLhjDcGlQXffyAYWa_ca_ZEVL867y1KZBViRbxoQJu9144vAMEB51dh7EuII
Discord-Info-Links
972513769420902420/uHnh17PrJLhjDcGlQXffyAYWa_ca_ZEVL867y1KZBViRbxoQJu9144vAMEB51dh7EuII
Get Webhook Infohttps://discord.com/api/webhooks/972513769420902420/uHnh17PrJLhjDcGlQXffyAYWa_ca_ZEVL867y1KZBViRbxoQJu9144vAMEB51dh7EuII
Total events
5 962
Read events
5 959
Write events
3
Delete events
0

Modification events

(PID) Process:(4556) certutil.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.60.3.1!7
Operation:writeName:Name
Value:
szOID_ROOT_PROGRAM_AUTO_UPDATE_CA_REVOCATION
(PID) Process:(4556) certutil.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.60.3.2!7
Operation:writeName:Name
Value:
szOID_ROOT_PROGRAM_AUTO_UPDATE_END_REVOCATION
(PID) Process:(4556) certutil.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.60.3.3!7
Operation:writeName:Name
Value:
szOID_ROOT_PROGRAM_NO_OCSP_FAILOVER_TO_CRL
Executable files
1
Suspicious files
2
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
5464powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_k52kcee3.sn0.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6760Silviozas Premium Proxy.exeC:\Windows\System32\drivers\etc\hoststext
MD5:8535DF8EB6E60D5AE829097E907C8C56
SHA256:3548A615D4610D6108C5DD52CF5A110482D92E603A715886E010336A28392C6D
6760Silviozas Premium Proxy.exeC:\Users\admin\Downloads\Silviozas Premium Proxy.lnkbinary
MD5:28135C5E20F1189139D74A2168F5E6DF
SHA256:494D59B28EB4D09AE0D320101E9595BB7CD995045C0D5FCC8354D55C2D078E34
6760Silviozas Premium Proxy.exeC:\Users\Public\Proxy_Stuff\Silviozas Premium Proxy.exeexecutable
MD5:A52EFEBFF36B2E16639E5C4F7D229C82
SHA256:7C8ED722D41722E8DF5C2C6134587E07F80A95154654CFC08253F6671E202CCE
5464powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:705B37F20665653EE95852D600E0926B
SHA256:21DCC01FF0F793E34013D8774786A66796705672866287BD36C1C10306D62175
5464powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_bccnnywo.ell.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
35
DNS requests
23
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
184.24.77.42:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6072
svchost.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6412
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
5540
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
2892
svchost.exe
GET
304
2.18.161.41:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
5540
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4712
MoUsoCoreWorker.exe
184.24.77.42:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
23.52.120.96:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
6072
svchost.exe
23.52.120.96:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5064
SearchApp.exe
2.16.110.131:443
www.bing.com
Akamai International B.V.
DE
whitelisted
1176
svchost.exe
20.190.159.68:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1176
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
5064
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 184.24.77.42
  • 184.24.77.10
  • 184.24.77.35
  • 184.24.77.7
  • 184.24.77.37
  • 184.24.77.23
whitelisted
google.com
  • 142.250.186.110
whitelisted
www.microsoft.com
  • 23.52.120.96
  • 88.221.169.152
whitelisted
www.bing.com
  • 2.16.110.131
  • 2.16.110.138
  • 2.16.110.168
  • 2.16.110.171
  • 2.16.110.203
  • 2.16.110.170
  • 2.16.110.123
  • 2.16.110.195
whitelisted
login.live.com
  • 20.190.159.68
  • 40.126.31.73
  • 20.190.159.64
  • 20.190.159.2
  • 20.190.159.23
  • 40.126.31.67
  • 20.190.159.75
  • 20.190.159.0
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
go.microsoft.com
  • 23.213.170.81
whitelisted
www.growtopia1.com
  • 2.19.120.155
  • 2.19.120.159
unknown
www.growtopia2.com
  • 44.217.242.239
  • 44.199.132.1
unknown

Threats

PID
Process
Class
Message
6760
Silviozas Premium Proxy.exe
Potentially Bad Traffic
ET INFO KeyAuth Open-source Authentication System Domain (keyauth .win) in TLS SNI
2192
svchost.exe
Potentially Bad Traffic
ET INFO KeyAuth Open-source Authentication System Domain in DNS Lookup (keyauth .win)
6760
Silviozas Premium Proxy.exe
Potentially Bad Traffic
ET INFO KeyAuth Open-source Authentication System Domain (keyauth .win) in TLS SNI
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Silviozas Premium Proxy.exe