Trojan.DownLoader33.63163

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKCU>\Software\Classes\discord-719262050668511282\shell\open\command] '' = '<Current directory>\FoxEX.exe'

Modifies file system

Creates the following files

%WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\metadata\f0accf77cdcbff39f6191887f6d2d357
<Current directory>\monaco\vs\editor\editor.main.nls.es.js
<Current directory>\monaco\vs\editor\editor.main.nls.de.js
<Current directory>\monaco\vs\editor\editor.main.js
<Current directory>\monaco\vs\editor\editor.main.css
<Current directory>\monaco\vs\editor\contrib\suggest\media\string_inverse_16x.svg
<Current directory>\monaco\vs\editor\contrib\suggest\media\string_16x.svg
<Current directory>\monaco\vs\basic-languages\yaml\yaml.js
<Current directory>\monaco\vs\basic-languages\redshift\redshift.js
<Current directory>\monaco\vs\basic-languages\xml\xml.js
<Current directory>\monaco\vs\basic-languages\swift\swift.js
<Current directory>\monaco\vs\basic-languages\st\st.js
<Current directory>\monaco\vs\basic-languages\sql\sql.js
<Current directory>\monaco\vs\basic-languages\solidity\solidity.js
<Current directory>\monaco\vs\basic-languages\scss\scss.js
<Current directory>\monaco\vs\basic-languages\sb\sb.js
<Current directory>\monaco\vs\basic-languages\rust\rust.js
<Current directory>\monaco\vs\basic-languages\vb\vb.js
<Current directory>\monaco\vs\basic-languages\ruby\ruby.js
<Current directory>\monaco\vs\editor\editor.main.nls.fr.js
<Current directory>\monaco\vs\language\css\cssworker.js
<Current directory>\monaco\vs\loader.js
<Current directory>\monaco\vs\language\typescript\tsworker.js
<Current directory>\monaco\vs\language\typescript\tsmode.js
<Current directory>\monaco\vs\language\typescript\lib\typescriptservices.js
<Current directory>\monaco\vs\language\json\jsonworker.js
<Current directory>\monaco\vs\language\json\jsonmode.js
<Current directory>\monaco\vs\language\html\htmlworker.js
<Current directory>\monaco\vs\editor\editor.main.nls.ja.js
<Current directory>\monaco\vs\editor\editor.main.nls.it.js
<Current directory>\monaco\vs\language\css\cssmode.js
<Current directory>\monaco\vs\editor\standalone\browser\quickopen\symbol-sprite.svg
<Current directory>\monaco\vs\editor\editor.main.nls.zh-tw.js
<Current directory>\monaco\vs\editor\editor.main.nls.zh-cn.js
<Current directory>\monaco\vs\editor\editor.main.nls.ru.js
<Current directory>\monaco\vs\editor\editor.main.nls.ko.js
<Current directory>\monaco\vs\editor\editor.main.nls.js
<Current directory>\monaco\vs\language\html\htmlmode.js
<Current directory>\monaco\vs\basic-languages\redis\redis.js
<Current directory>\monaco\vs\basic-languages\razor\razor.js
<Current directory>\monaco\vs\basic-languages\r\r.js
<Current directory>\monaco\vs\basic-languages\cpp\cpp.js
<Current directory>\monaco\vs\basic-languages\coffee\coffee.js
<Current directory>\monaco\vs\basic-languages\bat\bat.js
<Current directory>\monaco\vs\base\worker\workermain.js
<Current directory>\monaco\monaco.html
<Current directory>\monaco\globalv.txt
<Current directory>\monaco\vs\basic-languages\csp\csp.js
<Current directory>\monaco\globalns.txt
<Current directory>\monaco\classfunc.txt
<Current directory>\monaco\base.txt
<Current directory>\foxex.exe
<Current directory>\exploit-main.dll
<Current directory>\discord-rpc-w32.dll
<Current directory>\foxex\foxex.zip
%WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\content\f0accf77cdcbff39f6191887f6d2d357
<Current directory>\monaco\globalf.txt
<Current directory>\monaco\vs\basic-languages\css\css.js
<Current directory>\monaco\vs\basic-languages\csharp\csharp.js
<Current directory>\monaco\vs\basic-languages\dockerfile\dockerfile.js
<Current directory>\monaco\vs\basic-languages\python\python.js
<Current directory>\monaco\vs\basic-languages\msdax\msdax.js
<Current directory>\monaco\vs\basic-languages\pug\pug.js
<Current directory>\monaco\vs\basic-languages\powershell\powershell.js
<Current directory>\monaco\vs\basic-languages\postiats\postiats.js
<Current directory>\monaco\vs\basic-languages\php\php.js
<Current directory>\monaco\vs\basic-languages\pgsql\pgsql.js
<Current directory>\monaco\vs\basic-languages\objective-c\objective-c.js
<Current directory>\monaco\vs\basic-languages\mysql\mysql.js
<Current directory>\monaco\vs\basic-languages\markdown\markdown.js
<Current directory>\monaco\vs\basic-languages\fsharp\fsharp.js
<Current directory>\monaco\vs\basic-languages\lua\lua.js
<Current directory>\monaco\vs\basic-languages\less\less.js
<Current directory>\monaco\vs\basic-languages\java\java.js
<Current directory>\monaco\vs\basic-languages\ini\ini.js
<Current directory>\monaco\vs\basic-languages\html\html.js
<Current directory>\monaco\vs\basic-languages\handlebars\handlebars.js
<Current directory>\monaco\vs\basic-languages\go\go.js
<Current directory>\scripts\thanks for using foxex.txt
<Current directory>\wearedevs_api.cpp.dll