File name:

Minecraft Premium Account Generator.exe

Full analysis: https://app.any.run/tasks/b79c32a3-d65a-4812-9cdf-7c6b059a408f
Verdict: Malicious activity
Analysis date: April 11, 2024, 02:51:02
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

D71C73413A1A32F963D505ABFB747712

SHA1:

8F8F270C0EECFFFFB53DB7CCBFA9F3FCB2E0C8A4

SHA256:

A31B7BE525623FAA8A38BBB513B0E9BF250EFF1A0D4FB7CB05F63BFF88C547B4

SSDEEP:

49152:F7AUo0XuXmHm3imvi0A8n2rJOQlo0A8n2rJOQlz0A8n2rJOQly0A8n2rJOQlhYEW:GUnWmHVkn2rVokn2rVzkn2rVykn2rVhy

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Minecraft Premium Account Generator.exe (PID: 2860)

  • SUSPICIOUS

    • Reads the Internet Settings

      • Minecraft Premium Account Generator.exe (PID: 2860)

    • Reads security settings of Internet Explorer

      • Minecraft Premium Account Generator.exe (PID: 2860)

    • Reads Microsoft Outlook installation path

      • Minecraft Premium Account Generator.exe (PID: 2860)

    • Reads settings of System Certificates

      • Minecraft Premium Account Generator.exe (PID: 2860)

    • Checks Windows Trust Settings

      • Minecraft Premium Account Generator.exe (PID: 2860)

    • Reads Internet Explorer settings

      • Minecraft Premium Account Generator.exe (PID: 2860)

    • Process requests binary or script from the Internet

      • Minecraft Premium Account Generator.exe (PID: 2860)

  • INFO

    • Reads the computer name

      • Minecraft Premium Account Generator.exe (PID: 2860)

    • Checks supported languages

      • Minecraft Premium Account Generator.exe (PID: 2860)

    • Reads the machine GUID from the registry

      • Minecraft Premium Account Generator.exe (PID: 2860)

    • Checks proxy server information

      • Minecraft Premium Account Generator.exe (PID: 2860)

    • Reads the software policy settings

      • Minecraft Premium Account Generator.exe (PID: 2860)

    • Creates files or folders in the user directory

      • Minecraft Premium Account Generator.exe (PID: 2860)

    • Create files in a temporary directory

      • Minecraft Premium Account Generator.exe (PID: 2860)

    • Reads Environment values

      • Minecraft Premium Account Generator.exe (PID: 2860)

    • Manual execution by a user

      • taskmgr.exe (PID: 2248)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (45.1)
.exe | Win32 Executable MS Visual C++ (generic) (19.2)
.exe | Win64 Executable (generic) (17)
.scr | Windows screen saver (8)
.dll | Win32 Dynamic Link Library (generic) (4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2016:06:03 17:27:02+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 11
CodeSize: 972800
InitializedDataSize: 154624
UninitializedDataSize: -
EntryPoint: 0xef78e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileDescription: Minecraft Premium Account Generator
FileVersion: 1.0.0.0
InternalName: Minecraft Premium Account Generator.exe
LegalCopyright: Copyright © 2016
OriginalFileName: Minecraft Premium Account Generator.exe
ProductName: Minecraft Premium Account Generator
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start minecraft premium account generator.exe taskmgr.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2248"C:\Windows\system32\taskmgr.exe" /4C:\Windows\System32\taskmgr.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Task Manager
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2860"C:\Users\admin\AppData\Local\Temp\Minecraft Premium Account Generator.exe" C:\Users\admin\AppData\Local\Temp\Minecraft Premium Account Generator.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Minecraft Premium Account Generator
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\minecraft premium account generator.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
11 614
Read events
11 555
Write events
48
Delete events
11

Modification events

(PID) Process:(2860) Minecraft Premium Account Generator.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2860) Minecraft Premium Account Generator.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2860) Minecraft Premium Account Generator.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2860) Minecraft Premium Account Generator.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2860) Minecraft Premium Account Generator.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2860) Minecraft Premium Account Generator.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:ProxyServer
Value:
(PID) Process:(2860) Minecraft Premium Account Generator.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:ProxyOverride
Value:
(PID) Process:(2860) Minecraft Premium Account Generator.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:AutoConfigURL
Value:
(PID) Process:(2860) Minecraft Premium Account Generator.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:AutoDetect
Value:
(PID) Process:(2860) Minecraft Premium Account Generator.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000005C010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
0
Suspicious files
23
Text files
29
Unknown types
10

Dropped files

PID
Process
Filename
Type
2860Minecraft Premium Account Generator.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:—
SHA256:—
2860Minecraft Premium Account Generator.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:—
SHA256:—
2860Minecraft Premium Account Generator.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:—
SHA256:—
2860Minecraft Premium Account Generator.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464binary
MD5:—
SHA256:—
2860Minecraft Premium Account Generator.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464binary
MD5:—
SHA256:—
2860Minecraft Premium Account Generator.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\0L9I4TZQ.txttext
MD5:—
SHA256:—
2860Minecraft Premium Account Generator.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506compressed
MD5:—
SHA256:—
2860Minecraft Premium Account Generator.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506binary
MD5:—
SHA256:—
2860Minecraft Premium Account Generator.exeC:\Users\admin\AppData\Local\Temp\Cab4689.tmpcompressed
MD5:—
SHA256:—
2860Minecraft Premium Account Generator.exeC:\Users\admin\AppData\Local\Temp\Tar468A.tmpcat
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
22
TCP/UDP connections
41
DNS requests
26
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2860
Minecraft Premium Account Generator.exe
GET
301
188.114.97.3:80
http://adf.ly/1aQfM4
unknown
—
—
unknown
2860
Minecraft Premium Account Generator.exe
GET
302
172.67.194.101:80
http://yxeepsek.net/-1ZWFD/1aQfM4?rndad=3050745195-1712803871
unknown
—
—
unknown
2860
Minecraft Premium Account Generator.exe
GET
304
93.186.134.58:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?f298ca30347c3779
unknown
—
—
unknown
2860
Minecraft Premium Account Generator.exe
GET
200
216.58.206.67:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
—
—
unknown
2860
Minecraft Premium Account Generator.exe
GET
200
216.58.206.67:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFCjJ1PwkYAi7fE%3D
unknown
—
—
unknown
2860
Minecraft Premium Account Generator.exe
GET
200
93.186.134.58:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?0ccd5e715b3eca47
unknown
—
—
unknown
—
—
GET
200
184.25.169.5:80
http://x2.c.lencr.org/
unknown
—
—
unknown
2860
Minecraft Premium Account Generator.exe
GET
200
184.25.169.5:80
http://x1.c.lencr.org/
unknown
—
—
unknown
2860
Minecraft Premium Account Generator.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
unknown
—
—
unknown
2860
Minecraft Premium Account Generator.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
2860
Minecraft Premium Account Generator.exe
188.114.97.3:80
adf.ly
CLOUDFLARENET
NL
unknown
2860
Minecraft Premium Account Generator.exe
172.67.194.101:80
yxeepsek.net
CLOUDFLARENET
US
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2860
Minecraft Premium Account Generator.exe
104.26.15.247:443
publisher.linkvertise.com
CLOUDFLARENET
US
unknown
2860
Minecraft Premium Account Generator.exe
93.186.134.58:80
ctldl.windowsupdate.com
TELECOM ITALIA SPARKLE S.p.A.
IT
unknown
2860
Minecraft Premium Account Generator.exe
216.58.206.67:80
ocsp.pki.goog
GOOGLE
US
whitelisted
2860
Minecraft Premium Account Generator.exe
188.114.97.3:443
adf.ly
CLOUDFLARENET
NL
unknown

DNS requests

Domain
IP
Reputation
adf.ly
  • 188.114.97.3
  • 188.114.96.3
shared
yxeepsek.net
  • 172.67.194.101
  • 104.21.20.204
unknown
publisher.linkvertise.com
  • 104.26.15.247
  • 172.67.69.167
  • 104.26.14.247
whitelisted
ctldl.windowsupdate.com
  • 93.186.134.58
  • 93.186.134.80
  • 93.186.134.40
whitelisted
ocsp.pki.goog
  • 216.58.206.67
whitelisted
link-to.net
  • 188.114.97.3
  • 188.114.96.3
malicious
x1.c.lencr.org
  • 184.25.169.5
whitelisted
x2.c.lencr.org
  • 184.25.169.5
whitelisted
linkvertise.com
  • 104.26.15.247
  • 104.26.14.247
  • 172.67.69.167
whitelisted
cdnjs.cloudflare.com
  • 104.17.25.14
  • 104.17.24.14
whitelisted

Threats

PID
Process
Class
Message
1080
svchost.exe
Misc activity
ET INFO URL Shortener Service Domain in DNS Lookup (is .gd)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Minecraft Premium Account Generator.exe