Trojan.DownLoader34.47975

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKCU>\Software\Classes\discord-690288190283972619\shell\open\command] '' = '<Full path to file>'

Modifies file system

Creates the following files

<Current directory>\del5.bat
<Current directory>\scripts\[fe] drop hats.txt
<Current directory>\scripts\[fe] enable inventory.txt
<Current directory>\scripts\[fe] energize animation gui.txt
<Current directory>\scripts\[fe] epix gui.txt
<Current directory>\scripts\[fe] faint.txt
<Current directory>\scripts\[fe] fe gui reborn.txt
<Current directory>\scripts\[fe] fe hax v15 gui.txt
<Current directory>\scripts\[fe] fe script [press every key].txt
<Current directory>\scripts\[fe] filter my ass gui.txt
<Current directory>\scripts\[fe] fling.txt
<Current directory>\scripts\[fe] floating head.txt
<Current directory>\scripts\[fe] floating sit.txt
<Current directory>\scripts\[fe] fly [press e].txt
<Current directory>\scripts\[fe] friend request spam.txt
<Current directory>\scripts\[fe] fuck fe gui.txt
<Current directory>\scripts\[fe] full swing.txt
<Current directory>\scripts\[fe] get tool [use with save tool].txt
<Current directory>\scripts\[fe] glitchmax gui.txt
<Current directory>\scripts\[fe] god.txt
<Current directory>\scripts\[fe] grape gui.txt
<Current directory>\scripts\[fe] gui.txt
<Current directory>\scripts\[fe] gui2.txt
<Current directory>\scripts\[fe] happy dance.txt
<Current directory>\scripts\[fe] hatspin.txt
<Current directory>\scripts\[fe] hax gui.txt
<Current directory>\scripts\[fe] head throw.txt
<Current directory>\scripts\[fe] headless.txt
<Current directory>\scripts\[fe] hold dick.txt
<Current directory>\scripts\[fe] hold hands.txt
<Current directory>\scripts\[fe] drop hats gui.txt
<Current directory>\scripts\waifu.txt
<Current directory>\scripts\[fe] double jump.txt
<Current directory>\scripts\[fe] crouch.txt
<Current directory>\scripts\[fe] animation gui.txt
<Current directory>\scripts\[fe] animations gui 1.txt
<Current directory>\scripts\[fe] animations gui 2.txt
<Current directory>\scripts\[fe] another r15 gui.txt
<Current directory>\scripts\[fe] arm detach.txt
<Current directory>\scripts\[fe] arm flap.txt
<Current directory>\scripts\[fe] arm turbine.txt
<Current directory>\scripts\[fe] arms.txt
<Current directory>\scripts\[fe] armsout.txt
<Current directory>\scripts\[fe] arosia gui.txt
<Current directory>\scripts\[fe] balkus gui.txt
<Current directory>\scripts\[fe] barrel roll.txt
<Current directory>\scripts\[fe] blackhole.txt
<Current directory>\scripts\[fe] blink.txt
<Current directory>\scripts\[fe] block hats.txt
<Current directory>\scripts\[fe] block.txt
<Current directory>\scripts\[fe] bow down.txt
<Current directory>\scripts\[fe] break character.txt
<Current directory>\scripts\[fe] bring [need tools].txt
<Current directory>\scripts\[fe] carpet.txt
<Current directory>\scripts\[fe] chat troll.txt
<Current directory>\scripts\[fe] check.txt
<Current directory>\scripts\[fe] chop.txt
<Current directory>\scripts\[fe] click tp tool.txt
<Current directory>\scripts\[fe] clone.txt
<Current directory>\scripts\[fe] cock sucking.txt
<Current directory>\scripts\[fe] crawl.txt
<Current directory>\scripts\[fe] creeper [r15].txt
<Current directory>\scripts\[fe] creeper [r6].txt
<Current directory>\scripts\[fe] dab.txt
<Current directory>\scripts\wyd form.txt
<Current directory>\scripts\[fe] hug.txt
<Current directory>\scripts\[fe] ihax gui.txt
<Current directory>\scripts\[fe] r15 speed [bypasses some games].txt
<Current directory>\scripts\[fe] r15 waist removal.txt
<Current directory>\scripts\[fe] random chat bot.txt
<Current directory>\scripts\[fe] rape.txt
<Current directory>\scripts\[fe] respawn.txt
<Current directory>\scripts\[fe] safe fe kill.txt
<Current directory>\scripts\[fe] save tool [use with get tool].txt
<Current directory>\scripts\[fe] scared.txt
<Current directory>\scripts\[fe] scream.txt
<Current directory>\scripts\[fe] script hub.txt
<Current directory>\scripts\[fe] shutdown.txt
<Current directory>\scripts\[fe] silidius gui.txt
<Current directory>\scripts\[fe] slap.txt
<Current directory>\scripts\blazing heart sword.txt
<Current directory>\scripts\[fe] smelly run.txt
<Current directory>\scripts\[fe] spam pm.txt
<Current directory>\scripts\[fe] spin attack.txt
<Current directory>\scripts\[fe] spin dance 1.txt
<Current directory>\scripts\[fe] spin dance 2.txt
<Current directory>\scripts\[fe] spin.txt
<Current directory>\scripts\[fe] stab.txt
<Current directory>\scripts\[fe] sword hit.txt
<Current directory>\scripts\[fe] sword strike.txt
<Current directory>\scripts\[fe] sword.txt
<Current directory>\scripts\[fe] teleport others.txt
<Current directory>\scripts\[fe] trick-clip gui.txt
<Current directory>\scripts\[fe] verpsin gui.txt
<Current directory>\scripts\[fe] walkthrough.txt
<Current directory>\scripts\[fe] r15 gui.txt
<Current directory>\scripts\[fe] r15 root removal.txt
<Current directory>\scripts\[fe] i got hit.txt
<Current directory>\scripts\[fe] hypertotal gui.txt
<Current directory>\scripts\[fe] quick save tool.txt
<Current directory>\scripts\[fe] insane and dab gui.txt
<Current directory>\scripts\[fe] insane.txt
<Current directory>\scripts\[fe] invisible.txt
<Current directory>\scripts\[fe] jailbrika's broken scripts hub [sad].txt
<Current directory>\scripts\[fe] jump land.txt
<Current directory>\scripts\[fe] kgui.txt
<Current directory>\scripts\[fe] kick.txt
<Current directory>\scripts\[fe] kill all [need sword].txt
<Current directory>\scripts\[fe] kill [need tools].txt
<Current directory>\scripts\[fe] legohax 6.9.txt
<Current directory>\scripts\[fe] levitate.txt
<Current directory>\scripts\[fe] loophead.txt
<Current directory>\scripts\[fe] magnet gui.txt
<Current directory>\scripts\[fe] max annoy gui.txt
<Current directory>\scripts\[fe] moon dance.txt
<Current directory>\scripts\[fe] moving dance.txt
<Current directory>\scripts\[fe] multi dimensional character.txt
<Current directory>\scripts\[fe] newbies gui.txt
<Current directory>\scripts\[fe] noclip keybind.txt
<Current directory>\scripts\[fe] noltx gui.txt
<Current directory>\scripts\[fe] novole animation gui.txt
<Current directory>\scripts\[fe] oof.txt
<Current directory>\scripts\[fe] opstatchange gui.txt
<Current directory>\scripts\[fe] pirate walk.txt
<Current directory>\scripts\[fe] play animation.txt
<Current directory>\scripts\[fe] punch.txt
<Current directory>\scripts\[fe] push.txt
<Current directory>\scripts\[fe] r15 animation gui by illremember.txt
<Current directory>\scripts\[fe] i low gui.txt
<Current directory>\scripts\[fe] r15 cut.txt
<Current directory>\scripts\voodoo child.txt
<Current directory>\scripts\virdis.txt
<Current directory>\scripts\unsc truck.txt
<Current directory>\monaco\vs\basic-languages\redshift\redshift.js
<Current directory>\monaco\vs\basic-languages\ruby\ruby.js
<Current directory>\monaco\vs\basic-languages\rust\rust.js
<Current directory>\monaco\vs\basic-languages\sb\sb.js
<Current directory>\monaco\vs\basic-languages\scss\scss.js
<Current directory>\monaco\vs\basic-languages\solidity\solidity.js
<Current directory>\monaco\vs\basic-languages\sql\sql.js
<Current directory>\monaco\vs\basic-languages\st\st.js
<Current directory>\monaco\vs\basic-languages\swift\swift.js
<Current directory>\monaco\vs\basic-languages\vb\vb.js
<Current directory>\monaco\vs\basic-languages\xml\xml.js
<Current directory>\monaco\vs\basic-languages\yaml\yaml.js
<Current directory>\monaco\vs\editor\contrib\suggest\media\string_16x.svg
<Current directory>\monaco\vs\editor\contrib\suggest\media\string_inverse_16x.svg
<Current directory>\monaco\vs\editor\editor.main.css
<Current directory>\monaco\vs\editor\editor.main.js
<Current directory>\monaco\vs\editor\editor.main.nls.de.js
<Current directory>\monaco\vs\editor\editor.main.nls.es.js
<Current directory>\monaco\vs\editor\editor.main.nls.fr.js
<Current directory>\monaco\vs\editor\editor.main.nls.it.js
<Current directory>\monaco\vs\editor\editor.main.nls.ja.js
<Current directory>\monaco\vs\editor\editor.main.nls.js
<Current directory>\monaco\vs\editor\editor.main.nls.ko.js
<Current directory>\monaco\vs\editor\editor.main.nls.ru.js
<Current directory>\monaco\vs\editor\editor.main.nls.zh-cn.js
<Current directory>\monaco\vs\editor\editor.main.nls.zh-tw.js
<Current directory>\monaco\vs\editor\standalone\browser\quickopen\symbol-sprite.svg
<Current directory>\monaco\vs\language\css\cssmode.js
<Current directory>\monaco\vs\basic-languages\razor\razor.js
<Current directory>\monaco\vs\language\css\cssworker.js
<Current directory>\monaco\vs\basic-languages\r\r.js
<Current directory>\monaco\vs\basic-languages\pug\pug.js
<Current directory>\discord-rpc-w32.dll
<Current directory>\monaco.zip
<Current directory>\workspace.zip
<Current directory>\scripts.zip
<Current directory>\monaco\monaco.html
<Current directory>\monaco\vs\base\worker\workermain.js
<Current directory>\monaco\vs\basic-languages\bat\bat.js
<Current directory>\monaco\vs\basic-languages\coffee\coffee.js
<Current directory>\monaco\vs\basic-languages\cpp\cpp.js
<Current directory>\monaco\vs\basic-languages\csharp\csharp.js
<Current directory>\monaco\vs\basic-languages\csp\csp.js
<Current directory>\monaco\vs\basic-languages\css\css.js
<Current directory>\monaco\vs\basic-languages\dockerfile\dockerfile.js
<Current directory>\monaco\vs\basic-languages\fsharp\fsharp.js
<Current directory>\monaco\vs\basic-languages\go\go.js
<Current directory>\monaco\vs\basic-languages\handlebars\handlebars.js
<Current directory>\monaco\vs\basic-languages\html\html.js
<Current directory>\monaco\vs\basic-languages\ini\ini.js
<Current directory>\monaco\vs\basic-languages\java\java.js
<Current directory>\monaco\vs\basic-languages\less\less.js
<Current directory>\monaco\vs\basic-languages\lua\lua.js
<Current directory>\monaco\vs\basic-languages\markdown\markdown.js
<Current directory>\monaco\vs\basic-languages\msdax\msdax.js
<Current directory>\monaco\vs\basic-languages\mysql\mysql.js
<Current directory>\monaco\vs\basic-languages\objective-c\objective-c.js
<Current directory>\monaco\vs\basic-languages\pgsql\pgsql.js
<Current directory>\monaco\vs\basic-languages\php\php.js
<Current directory>\monaco\vs\basic-languages\postiats\postiats.js
<Current directory>\monaco\vs\basic-languages\powershell\powershell.js
<Current directory>\monaco\vs\basic-languages\python\python.js
<Current directory>\monaco\vs\language\html\htmlmode.js
<Current directory>\monaco\vs\basic-languages\redis\redis.js
<Current directory>\monaco\vs\language\html\htmlworker.js
<Current directory>\scripts\grab knife v2.txt
<Current directory>\scripts\grab knife v4.txt
<Current directory>\scripts\guest bypass.txt
<Current directory>\scripts\hells door.txt
<Current directory>\scripts\hunter.txt
<Current directory>\scripts\insanity powers.txt
<Current directory>\scripts\ishida sword and armor.txt
<Current directory>\scripts\john doe.txt
<Current directory>\scripts\liron.txt
<Current directory>\scripts\lustris v2 sword.txt
<Current directory>\scripts\memeusv2.txt
<Current directory>\scripts\monika.txt
<Current directory>\scripts\noob baseball bat.txt
<Current directory>\scripts\nuke launcher.txt
<Current directory>\scripts\nuke.txt
<Current directory>\scripts\project 44033514.txt
<Current directory>\scripts\realistic guillotine ultra rare.txt
<Current directory>\scripts\reaper v2.txt
<Current directory>\scripts\ruiner v2 ultra rare.txt
<Current directory>\scripts\sezhu's infectious visualizer.txt
<Current directory>\scripts\shadow ravager.txt
<Current directory>\scripts\sin unleashed.txt
<Current directory>\scripts\star dust huge weapon.txt
<Current directory>\scripts\talha gui.txt
<Current directory>\scripts\tl3mc war tank.txt
<Current directory>\scripts\topkek_4.0.txt
<Current directory>\scripts\trap gun.txt
<Current directory>\scripts\uganda knuckles.txt
<Current directory>\scripts\grab knife v1.txt
<Current directory>\scripts\genocider.txt
<Current directory>\scripts\grab knife v3.txt
<Current directory>\scripts\golden gun.txt
<Current directory>\scripts\gandalfs nutsack [bypassed audios].txt
<Current directory>\monaco\vs\language\json\jsonmode.js
<Current directory>\monaco\vs\language\typescript\lib\typescriptservices.js
<Current directory>\monaco\vs\language\typescript\tsmode.js
<Current directory>\monaco\vs\language\typescript\tsworker.js
<Current directory>\monaco\vs\loader.js
<Current directory>\workspace\iy_fe.iy
<Current directory>\scripts\! most anim credits goes to illremember.txt
<Current directory>\scripts\! [fe] astrava gui [best].txt
<Current directory>\scripts\! [fe] opfinality gui [best].txt
<Current directory>\scripts\! [fe] reviz admin cmd [best].txt
<Current directory>\scripts\albertstuff.txt
<Current directory>\scripts\archive admin hub.txt
<Current directory>\scripts\audio stealer.txt
<Current directory>\scripts\ban hammer.txt
<Current directory>\scripts\[fe] wenght animation gui.txt
<Current directory>\scripts\[fe] snowy gui.txt
<Current directory>\scripts\blackcell gui.txt
<Current directory>\scripts\body guards v2.txt
<Current directory>\scripts\bomb vest.txt
<Current directory>\scripts\bypassed audios [favorites].txt
<Current directory>\scripts\bypassed audios.txt
<Current directory>\scripts\commands.txt
<Current directory>\scripts\content cop.txt
<Current directory>\scripts\dancer visualizer.txt
<Current directory>\scripts\death note.txt
<Current directory>\scripts\death star [op].txt
<Current directory>\scripts\decals-tshirts bypassing discord servers.txt
<Current directory>\scripts\drawing visulaizer.txt
<Current directory>\scripts\ender.txt
<Current directory>\scripts\flying musical drone.txt
<Current directory>\monaco\vs\language\json\jsonworker.js
<Current directory>\scripts\bloxwatch.txt
<Current directory>\scripts\[fe] xex gui.txt

Network activity

TCP

HTTP GET requests

http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt

'pa###bin.com':443

'ra#.####ubusercontent.com':443

'cd#.##scordapp.com':443

UDP

DNS ASK pa###bin.com
DNS ASK ra#.####ubusercontent.com
DNS ASK cd#.##scordapp.com
DNS ASK microsoft.com

Miscellaneous

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c ""<Current directory>\del5.bat" "
'%WINDIR%\syswow64\timeout.exe' /t 1

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial