Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'engel' = '%APPDATA%\updates\updates.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
- <SYSTEM32>\netsh.exe advfirewall firewall add rule name="<Virus name>" dir=in action=allow program="<Full path to virus>"
- %APPDATA%\engel\updates.exe
- '41.##0.31.92':3128
- '21#.#66.215.62':3128
- '12#.#94.140.152':3128
- '95.#5.75.75':3128
- '49.##6.45.39':3128
- '11#.88.5.13':3128
- '11#.#40.109.197':3128
- '18#.#6.194.72':3128
- '89.##4.151.41':3128
- '84.##.104.175':3128
- '88.##7.27.33':3128
- '11#.#02.23.106':3128
- '46.##0.112.49':3128
- '20#.#65.203.183':3128
- '22#.2.13.47':3128
- '10#.#51.147.237':3128
- '95.##.233.122':3128
- '49.##2.249.101':3128
- '17#.#24.144.209':3128
- '17#.#1.110.124':3128
- '39.##9.155.26':3128
- '46.##5.46.206':3128
- '18#.#44.80.107':3128
- '95.##.220.108':3128
- '11#.#54.19.40':3128
- '62.##2.69.149':3128
- '11#.#75.255.51':3128
- '82.##5.23.140':3128
- '27.##6.118.71':3128
- '12#.#03.182.166':3128
- '12#.#6.139.101':3128
- '11#.#40.48.193':3128
- '2.###.208.64':3128
- '18#.#87.53.243':3128
- '21#.#72.250.98':3128
- '18#.#69.204.17':3128
- '17#.#1.32.159':3128
- '92.##.145.19':3128
- '87.##0.166.58':3128
- '22#.#27.56.183':3128
- '18#.#9.85.152':3128
- '21#.#99.229.80':3128
- '82.##9.197.225':3128
- '12#.#23.125.151':3128
- '95.#1.38.46':3128
- '58.#.237.130':3128
- '19#.#5.24.42':3128
- '95.#8.7.141':3128
- '93.##0.211.228':3128
- '49.##1.9.131':3128
- '17#.#52.201.106':3128
- '11#.#03.58.59':3128
- '21#.#2.200.158':3128
- '1.##.142.137':3128
- '12#.#36.41.33':3128
- '59.##.99.249':3128
- '95.#9.30.62':3128
- '95.##.240.44':3128
- '12#.#65.14.56':3128
- '59.##3.24.219':3128
- '17#.#0.132.165':3128
- '89.##.44.170':3128
- '11#.#5.39.148':3128
- '99.##8.63.179':3128
- '42.##1.164.33':3128
- '46.##8.70.59':3128
- '67.##7.250.135':3128
- '59.##3.69.57':3128
- '27.##5.48.116':3128
- '11#.#54.55.162':3128
- '17#.#23.118.199':3128
- '11#.#07.216.200':3128
- '18#.#30.97.78':3128
- '78.#0.213.7':3128
- '39.##9.143.108':3128
- '41.##1.126.80':3128
- '94.##7.75.85':3128
- '17#.#23.83.5':3128
- '11#.#99.188.187':3128
- '20#.#7.126.195':3128
- '93.##0.194.242':3128
- '18#.#.203.235':3128
- '93.##2.188.75':3128
- '17#.#69.6.198':3128
- '49.##7.136.193':3128
- '14.#8.68.81':3128
- '49.#02.4.16':3128
- '49.##.156.146':3128
- '67.##6.245.120':3128
- '12#.#28.117.102':3128
- '95.##.235.25':3128
- '77.##.45.219':3128
- '95.##1.221.49':3128
- '95.#7.33.21':3128
- '17#.#25.247.121':3128
- '11#.#.247.123':3128
- '18#.#6.153.92':3128
- '94.##.140.106':3128
- '11#.#02.64.30':3128
- '59.##.144.201':3128
- '18#.#.253.99':3128
- '18#.#53.221.4':3128
- '12#.#65.39.15':3128
- '11#.#41.157.225':3128
- '46.##8.45.111':3128
- '18#.#.195.118':3128
- '18#.#.144.113':3128
- '20#.#71.184.40':3128
- '11#.#6.111.162':3128
- '31.##.245.116':3128
- '11#.#18.238.203':3128
- '17#.#72.191.50':3128
- '41.##7.98.191':3128
- '91.##0.136.114':3128
- '80.#7.88.67':3128
- '59.##.112.110':3128
- '12#.#3.68.10':3128
- '18#.#.116.160':3128
- '18#.#14.53.84':3128
- '46.##2.69.61':3128
- '41.##7.248.212':3128
- '46.##9.5.193':3128
- '85.##.182.12':3128
- '11#.#4.204.182':3128
- '77.##.184.157':3128
- '41.##0.144.6':3128
- '39.##9.208.243':3128
- '20#.#59.19.196':3128
- '18#.#91.240.91':3128
- '12#.#38.180.28':3128
- '18#.#2.139.222':3128
- '11#.#41.35.46':3128
- '59.##.191.137':3128
- '21#.#19.100.149':3128
- '49.##8.246.162':3128
- '1.##.157.5':3128
- '19#.#2.13.230':3128
- '18#.#.152.188':3128
- '17#.#2.128.122':3128
- '17#.#15.206.198':3128
- '89.##6.102.235':3128
- '27.##5.23.42':3128
- '41.##1.81.175':3128
- '17#.#22.81.11':3128
- '93.##3.85.250':3128
- '81.#0.0.18':3128
- '21#.#86.183.4':3128
- '11#.#12.47.2':3128
- '31.##.11.176':3128
- '11#.#54.20.221':3128
- '41.##5.128.33':3128
- '11#.#54.186.74':3128
- '46.##7.167.236':3128
- '49.##0.53.100':3128
- '17#.#49.18.198':3128
- '42.##1.177.91':3128
- '27.##6.82.199':3128
- '12#.#45.170.114':3128
- '22#.#34.206.77':3128
- '11#.#54.122.116':3128
- '11#.#8.2.234':3128
- '10#.#7.81.35':3128
- '88.##.250.151':3128
- '80.##1.211.253':3128
- '12#.#65.35.217':3128
- '94.##6.157.30':3128
- '79.##5.138.210':3128
- '87.##1.19.76':3128
- '79.##4.74.49':3128
- '11#.#98.224.240':3128
- '46.##8.59.178':3128
- '39.##9.183.194':3128
- '1.##.231.0':3128
- '18#.8.5.230':3128
- '17#.#25.253.245':3128
- '12#.#65.12.242':3128
- '95.##1.186.246':3128
- '12#.#25.191.202':3128
- '11#.#01.180.11':3128
- '11#.#8.27.189':3128
- '20#.#3.44.133':3128
- '18#.8.13.53':3128
- '12#.#94.185.92':3128
- '95.#9.9.50':3128
- '46.##3.144.152':3128
- '95.##1.151.88':3128
- '18#.#7.86.103':3128
- '46.##3.46.208':3128
- '17#.#22.182.220':3128
- '27.##.194.124':3128
- '41.##1.61.18':3128
- '46.##7.134.227':3128
- '95.#1.45.44':3128
- '41.##.224.27':3128
- '20#.#05.31.103':3128
- '41.#0.72.11':3128
- '18#.#.177.55':3128
- '89.##6.76.103':3128
- '12#.#8.25.65':3128
- '18#.#.190.166':3128
- '85.##.172.102':3128
- '22#.#4.50.193':3128
- '49.##8.162.231':3128
- '41.##.215.14':3128
- '11#.#9.35.116':3128
- '86.##8.16.154':3128
- '95.#9.2.230':3128
- '81.#0.0.17':3128
- '79.##4.179.110':3128
- '41.##1.77.228':3128
- '12#.#37.53.158':3128
- '93.#5.6.116':3128
- '61.##.254.212':3128
- '49.##2.94.245':3128
- '59.##.188.92':3128
- '95.#9.44.15':3128
- '41.#51.0.29':3128
- '11#.#05.151.247':3128
- '59.##5.112.202':3128
- '11#.#10.232.221':3128
- '92.##.151.167':3128
- '95.##.34.142':3128
- '82.##8.52.224':3128
- '11#.#00.36.145':3128
- '92.##.155.198':3128
- '95.#9.9.95':3128
- '41.##1.65.51':3128
- '41.##.222.141':3128
- '46.##9.53.153':3128
- '11#.#01.88.1':3128
- '17#.#22.22.89':3128
- '12#.#36.100.207':3128
- '11#.#2.128.207':3128
- '95.##0.18.162':3128
- '2.###.182.12':3128
- '18#.#78.173.8':3128
- '92.#0.50.48':3128
- '22#.#2.80.14':3128
- '20#.#9.136.120':3128
- '85.##5.168.32':3128
- '79.#78.14.1':3128
- '17#.#9.170.50':3128
- '17#.#22.49.23':3128
- '86.##3.31.54':3128
- '95.##.215.240':3128
- '95.##.14.200':3128
- '95.##.242.174':3128
- '18#.#92.159.199':3128
- '11#.#01.52.133':3128
- '49.##.195.135':3128
- '92.##.173.122':3128
- '11#.#04.163.236':3128
- '41.##3.223.125':3128
- '12#.#8.45.214':3128
- '17#.#22.225.10':3128
- '85.##.172.133':3128
- '93.##2.11.182':3128
- '11#.#2.136.48':3128
- '11#.#98.130.53':3128
- '92.##.128.105':3128
- '41.##1.251.106':3128
- '17#.#25.200.10':3128
- '11#.#32.251.17':3128
- '41.##.163.87':3128
- '10#.#29.172.141':3128
- '18#.#15.206.196':3128
- '19#.#62.70.69':3128
- '11#.#12.64.227':3128
- '89.##6.70.55':3128
- '93.#4.58.59':3128
- '61.##3.224.72':3128
- '14.##5.111.86':3128
- '11#.#42.80.135':3128
- '10#.#62.90.151':3128
- '11#.#54.184.108':3128
- '11#.#52.211.189':3128
- '17#.#50.220.119':3128
- '95.##.197.16':3128
- '39.##5.10.116':3128
- '39.##3.166.178':3128
- '18#.#46.239.135':3128
- '18#.#.178.112':3128
- '18#.#.172.191':3128
- '46.##3.120.214':3128
- '11#.#8.49.126':3128
- '60.##3.77.237':3128
- '11#.#10.1.73':3128
- '76.##9.224.82':3128
- '46.##3.122.236':3128
- '18#.88.99.9':3128
- '39.##0.38.52':3128
- '82.##9.165.28':3128
- '11#.#98.149.121':3128
- '22#.#41.41.207':3128
- '12#.#45.163.41':3128
- '18#.#24.23.241':3128
- '18#.#1.26.236':3128
- '11#.#42.12.203':3128
- '18#.#29.139.212':3128
- '46.##2.136.58':3128
- '86.##2.85.62':3128
- '17#.#20.202.85':3128
- '92.#7.89.24':3128
- '41.##.121.109':3128
- '58.##4.33.166':3128
- '59.##1.177.179':3128
- '88.##7.47.168':3128
- '93.##.168.162':3128
- '49.##8.45.216':3128
- '12#.#65.133.225':3128
- '46.##8.156.24':3128
- '17#.#25.216.134':3128
- '41.##3.70.135':3128
- '27.##.237.107':3128
- '49.##1.152.39':3128
- '27.##.209.46':3128
- '31.##4.132.4':3128
- '41.##2.126.203':3128
- '19#.#1.127.97':3128
- '11#.#98.33.59':3128
- '18#.#91.137.227':3128
- '78.##.24.183':3128
- '17#.#06.57.162':3128
- '95.#1.5.190':3128
- '11#.#02.92.65':3128
- '95.##2.76.35':3128
- '46.##8.38.37':3128
- '95.##.240.78':3128
- '41.#2.37.69':3128
- '11#.#97.65.248':3128
- '11#.#01.102.163':3128
- '68.##.222.177':3128
- '27.#.64.21':3128
- '95.##.60.232':3128
- '10#.#6.137.31':3128
- '39.##1.190.122':3128
- '11#.#04.237.85':3128
- '18#.#58.229.170':3128
- '81.#5.41.2':3128
- '20#.#08.97.129':3128
- '20#.#6.17.30':3128
- '12#.#.183.193':3128
- '11#.#8.4.239':3128
- '41.##.152.171':3128
- '21#.76.23.8':3128
- '49.##2.164.204':3128
- '59.##.218.193':3128
- '49.##1.36.195':3128
- '59.##.213.166':3128
- '89.##6.67.170':3128
- '92.##.170.198':3128
- '17#.#22.191.85':3128
- '46.##7.253.247':3128
- '12#.#73.65.144':3128
- '95.##1.228.46':3128
- '84.#4.75.4':3128
- '11#.#10.206.75':3128
- '39.##1.61.88':3128
- '95.##.60.199':3128
- '41.##2.133.161':3128
- '18#.#13.138.85':3128
- '11#.#1.186.41':3128
- '18#.#.63.215':3128
- '19#.#13.93.102':3128
- '11#.#02.39.47':3128
- '49.##1.61.106':3128
- '95.##1.190.17':3128
- '78.##.48.127':3128
- '93.##6.239.231':3128
- '17#.#0.132.1':3128
- 'localhost':7703
- '46.##1.228.217':3128
- '10#.#42.157.225':3128
- '94.##3.115.185':3128
- '11#.#54.181.207':3128
- '11#.#54.22.91':3128
- '41.##2.205.43':3128
- '77.##.220.38':3128
- '21#.#30.102.24':3128
- '12#.#65.25.59':3128
- '77.##5.6.118':3128
- '31.##4.200.21':3128
- '93.##0.195.30':3128
- '94.##3.172.65':3128
- '59.##1.123.248':3128
- '59.##.248.208':3128
- '17#.#22.248.4':3128
- '95.#1.39.74':3128
- '11#.#03.160.111':3128
- '85.##2.62.74':3128
- '91.##3.234.203':3128
- '49.##.98.248':3128
- '39.##5.93.15':3128
- '95.#1.41.24':3128
- '49.##2.91.18':3128
- '67.##2.68.59':3128
- '83.##8.82.159':3128
- '11#.#8.161.59':3128
- '41.#2.163.7':3128
- '58.##7.37.200':3128
- '27.##7.163.253':3128
- '12#.#01.165.139':3128
- '92.##.176.210':3128
- '17#.#22.90.207':3128
- '41.##1.234.203':3128
- '22#.#91.11.144':3128
- '46.##.24.147':3128
- '12#.#58.146.214':3128
- '12#.#8.33.144':3128
- '89.##3.98.138':3128
- '19#.#8.107.124':3128
- '42.##1.170.43':3128
- '82.##8.19.81':3128
- '49.##2.131.204':3128
- '49.##6.226.254':3128
- '16#.9.22.72':3128
- '39.#11.26.4':3128
- '12#.#0.186.3':3128
- '19#.#5.159.202':3128
- '46.##3.58.162':3128
- '95.##1.231.62':3128
- '11#.#41.28.239':3128
- '18#.#20.157.29':3128
- '77.##1.186.127':3128
- '21#.#67.195.98':3128
- '11#.#07.84.169':3128
- '21#.#27.249.58':3128
- '11#.88.1.64':3128
- '11#.#43.227.242':3128
- '46.##3.60.67':3128
- '27.##5.12.60':3128
- '12#.#45.112.227':3128
- '93.##0.219.221':3128
- '94.##.56.138':3128
- '20#.#71.243.106':3128
- '19#.#98.102.213':3128
- '17#.#1.107.133':3128
- '18#.#.122.169':3128
- '58.#.10.89':3128
- '93.##7.183.205':3128
- '18#.#6.88.171':3128
- '11#.#0.73.130':3128
- '11#.#40.223.217':3128
- '41.##1.253.103':3128
- '59.##3.212.13':3128
- '11#.#07.220.48':3128
- '46.##7.137.114':3128
- '95.##1.163.105':3128
- '95.##1.65.242':3128
- '49.##8.231.65':3128
- '92.##.181.233':3128
- '11#.#10.167.60':3128
- '11#.#5.90.116':3128
- '18#.#73.132.98':3128
- '21#.#6.216.242':3128
- '18#.#3.175.173':3128
- '94.##6.150.167':3128
- '12#.0.54.42':3128
- '79.##8.218.135':3128
- '22#.#83.254.137':3128
- '89.##3.36.103':3128
- '2.##2.34.47':3128
- '19#.#4.152.98':3128
- '49.##1.120.108':3128
- '27.##.187.19':3128
- '19#.#07.204.94':3128
- '14.##.117.207':3128
- '27.##7.16.79':3128
- '78.##7.24.89':3128
- '17#.#9.38.166':3128
- '19#.#55.211.81':3128
- '18#.0.15.33':3128
- '86.#7.74.44':3128
- '92.##.150.99':3128
- '95.##.190.156':3128
- '49.##.110.123':3128
- '49.##.86.165':3128
- '11#.#5.133.232':3128
- '18#.#4.118.177':3128
- '27.##7.217.100':3128
- '11#.#54.42.3':3128
- '11#.#54.35.135':3128
- '10#.#29.47.34':3128
- '27.##.108.156':3128
- '61.##4.82.199':3128
- '20#.#64.57.10':3128
- '60.##9.107.243':3128
- '27.#7.115.8':3128
- '11#.#54.47.195':3128
- '39.##0.210.214':3128
- '95.#7.15.31':3128
- '89.##6.105.214':3128
- '18#.#.200.250':3128
- '17#.#24.9.153':3128
- '11#.#03.246.60':3128
- '19#.#2.242.199':3128
- '18#.#.129.24':3128
- '59.#8.10.52':3128
- '12#.#22.41.111':3128
- '11#.#10.102.230':3128
- '59.##.157.48':3128
- '89.##5.244.229':3128
- '95.##.205.10':3128
- '11#.#4.189.50':3128
- '12#.#65.188.94':3128
- '11#.#40.184.184':3128
- '41.##8.141.22':3128
- '95.##.76.215':3128
- '49.##.111.192':3128
- '41.##7.154.3':3128
- '10#.#42.189.227':3128
- '89.##6.105.180':3128
- '18#.#.161.123':3128
- '11#.#6.185.254':3128
- '95.##.189.59':3128
- '11#.#17.132.179':3128
- '22#.#44.38.249':3128
- '11#.#54.148.169':3128
- '49.##6.124.143':3128
- '19#.#29.104.80':3128
- '92.##3.93.130':3128
- '19#.#0.161.143':3128
- '17#.#4.212.235':3128
- '41.##1.86.12':3128
- '12#.#45.35.144':3128
- '11#.#03.56.169':3128
- '95.##.69.171':3128
- '19#.#07.204.220':3128
- '27.##7.74.124':3128
- '11#.#84.237.148':3128
- '95.#9.72.75':3128
- '94.##4.41.159':3128
- '95.##.24.218':3128
- '17#.#22.226.189':3128
- '95.##.11.142':3128
- '62.##5.73.118':3128
- '21#.#19.47.106':3128
- '91.##.200.195':3128
- '11#.#5.83.171':3128
- '95.##.235.126':3128
- '49.##2.143.20':3128
- '17#.#37.87.218':3128
- '41.##.132.241':3128
- '18#.#2.170.237':3128
- '24.##.243.93':3128
- '18#.#6.149.51':3128
- '81.##.253.164':3128
- '81.##.184.190':3128
- '92.#6.10.39':3128
- '41.##6.155.220':3128
- '46.##4.243.37':3128
- '39.##3.38.247':3128
- '93.##0.208.238':3128
- '95.##1.195.26':3128
- '18#.#12.138.56':3128
- '95.##1.183.67':3128
- '92.##.90.196':3128
- '11#.#01.59.244':3128
- '77.##5.0.235':3128
- '18#.#.226.167':3128
- '77.##1.241.91':3128
- '18#.#88.238.225':3128
- '11#.#06.176.96':3128
- '46.##7.252.162':3128
- '2.###.236.57':3128
- '88.##5.130.65':3128
- '18#.#20.31.228':3128
- '89.##5.181.251':3128
- '12#.#23.149.199':3128
- '95.##.206.57':3128
- '95.##.70.109':3128
- '62.##8.214.33':3128
- '12#.#3.226.179':3128
- '93.##4.148.101':3128
- '59.##.240.134':3128
- '46.#8.55.94':3128
- '46.##3.88.81':3128
- '11#.#13.35.210':3128
- '11#.#2.145.23':3128
- '18#.#2.132.170':3128
- '95.##.90.111':3128
- '60.#.145.171':3128
- '11#.#05.37.241':3128
- '49.#5.96.65':3128
- '95.##2.54.134':3128
- '18#.#07.153.58':3128
- '82.##2.103.247':3128
- '81.##.164.231':3128
- '10#.#08.63.205':3128
- '79.##8.237.132':3128
- '81.##7.8.192':3128
- '10#.#62.27.205':3128
- '17#.#21.100.97':3128
- '84.##.102.72':3128
- '91.##.164.48':3128
- '20#.#4.215.9':3128
- '10#.#39.6.192':3128
- '94.##3.196.63':3128
- '89.##.255.65':3128
- '89.##7.123.176':3128
- '49.##1.38.83':3128
- '22#.#86.46.78':3128
- '92.##.23.163':3128
- '39.##9.131.83':3128
- '10#.#62.134.185':3128
- '46.##7.145.146':3128
- '91.##3.253.129':3128
- '17#.#23.217.145':3128
- '12#.#65.22.161':3128
- '46.##9.4.203':3128
- '94.##1.74.143':3128
- '17#.#25.136.176':3128
- '12#.#8.99.223':3128
- '1.##.71.127':3128
- '88.##5.25.250':3128
- '21#.#16.126.18':3128
- '46.##7.196.120':3128
- '58.##9.167.7':3128
- '41.##.153.11':3128
- '18#.#12.160.198':3128
- '92.##.185.62':3128
- '17#.#22.45.223':3128
- '41.#3.14.81':3128
- '78.##.77.186':3128
- '17#.#23.49.147':3128
- '11#.#03.136.109':3128
- '59.##.185.93':3128
- '18#.8.92.6':3128
- '87.##2.245.77':3128
- '11#.#70.15.239':3128
- '94.##3.125.38':3128
- '49.##6.144.101':3128
- '19#.#34.97.105':3128
- '17#.#25.242.9':3128
- '41.##2.133.209':3128
- '58.##3.125.236':3128
- '95.#7.13.40':3128
- '17#.#0.30.57':3128
- '11#.#54.116.17':3128
- '18#.#3.112.93':3128
- '11#.#02.70.9':3128
- '12#.#36.235.109':3128
- '11#.#54.124.72':3128
- '10#.#7.95.183':3128
- '46.##7.140.242':3128
- '41.#42.46.3':3128
- '27.##7.172.89':3128
- '11#.#54.134.161':3128
- '17#.#06.57.75':3128
- '92.#6.65.97':3128
- DNS ASK h.###aldomain
- ClassName: 'Indicator' WindowName: ''