Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'engel' = '%APPDATA%\updates\updates.exe'
- %HOMEPATH%\Start Menu\Programs\Startup\updates.exe
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
- <SYSTEM32>\netsh.exe advfirewall firewall add rule name="<Virus name>" dir=in action=allow program="<Full path to virus>"
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Associations] 'LowRiskFileTypes' = '.exe'
- %APPDATA%\engel\updates.exe
- '21#.#30.98.194':3128
- '50.##1.147.143':3128
- '17#.#39.144.158':3128
- '15#.#81.171.132':3128
- '11#.81.33.8':3128
- '17#.#78.139.96':3128
- '21#.#6.9.182':3128
- '18#.42.20.9':3128
- '19#.#13.207.4':3128
- '93.##6.41.54':3128
- '19#.#00.145.63':3128
- '41.##2.197.241':3128
- '92.##.76.179':3128
- '95.#9.15.58':3128
- '41.##7.116.230':3128
- '41.##2.147.248':3128
- '19#.#50.13.17':3128
- '21#.#12.106.132':3128
- '19#.#.80.193':3128
- '80.##.168.140':3128
- '19#.#98.195.50':3128
- '41.##2.49.188':3128
- '21#.#33.172.247':3128
- '18#.#6.87.230':3128
- '19#.#98.154.40':3128
- '95.#6.18.34':3128
- '17#.#48.45.36':3128
- '18#.#2.116.18':3128
- '86.##9.52.121':3128
- '18#.#22.136.3':3128
- '11#.#93.65.200':3128
- '20#.#04.66.213':3128
- '18#.#94.251.254':3128
- '20#.#4.204.104':3128
- '19#.#45.114.4':3128
- '24.##7.164.141':3128
- '11#.#9.51.172':3128
- '24.#.209.53':3128
- '31.##.235.100':3128
- '17#.#0.42.201':3128
- '2.##2.57.72':3128
- '19#.#52.82.7':3128
- '37.##.66.183':3128
- '77.##.45.219':3128
- '20#.#.47.120':3128
- '91.##.152.206':3128
- '70.##.244.203':3128
- '41.##2.124.217':3128
- '50.##3.22.15':3128
- '17#.#25.68.206':3128
- '59.##.210.166':3128
- '84.##.230.244':3128
- '17#.#1.195.132':3128
- '2.###.199.146':3128
- '2.###.35.192':3128
- '19#.#9.147.157':3128
- '14#.#55.133.69':3128
- '80.##.168.127':3128
- '19#.#06.234.208':3128
- '19#.#9.130.10':3128
- '41.##2.36.24':3128
- '21#.#19.209.131':3128
- '12#.#5.248.82':3128
- '41.##.139.57':3128
- '11#.#9.49.172':3128
- '85.##.151.242':3128
- '41.##2.231.102':3128
- '98.##7.188.102':3128
- '19#.#9.135.30':3128
- '20#.#64.75.145':3128
- '18#.#0.45.250':3128
- '20#.#19.4.10':3128
- '37.#9.67.46':3128
- '78.##.151.25':3128
- '19#.#86.112.150':3128
- '19#.#13.15.230':3128
- '20#.#7.154.195':3128
- '37.#9.25.64':3128
- '18#.#80.114.10':3128
- '92.##0.215.231':3128
- '84.##.110.184':3128
- '46.##0.245.150':3128
- '17#.#96.216.199':3128
- '91.##1.159.1':3128
- '10#.#53.113.112':3128
- '16#.#67.212.235':3128
- '17#.#0.94.162':3128
- '95.##.248.174':3128
- '93.##6.154.250':3128
- '19#.#9.16.252':3128
- '2.###.122.36':3128
- '82.##0.168.67':3128
- '21#.96.2.58':3128
- '15#.#81.188.209':3128
- '20#.#09.156.166':3128
- '2.###.219.232':3128
- '18#.#5.240.29':3128
- '19#.#11.134.80':3128
- '11#.#9.54.172':3128
- '77.##.129.213':3128
- '98.##8.202.56':3128
- '2.###.65.197':3128
- '20#.#67.25.76':3128
- '89.##.45.224':3128
- '37.#9.73.63':3128
- '17#.#75.204.158':3128
- '19#.#9.16.102':3128
- '19#.#99.20.84':3128
- '87.##1.19.76':3128
- '18#.#59.141.115':3128
- '67.##0.45.117':3128
- '77.##7.133.37':3128
- '11#.#06.12.115':3128
- '21#.#9.35.15':3128
- '20#.#09.175.103':3128
- '46.#8.132.8':3128
- '18#.#84.206.109':3128
- '18#.#8.59.232':3128
- '2.###.10.181':3128
- '41.##3.57.76':3128
- '95.##.228.37':3128
- '92.#7.72.8':3128
- '19#.#20.153.49':3128
- '20#.#67.15.217':3128
- '20#.#59.212.85':3128
- '31.#.238.176':3128
- '2.###.197.249':3128
- '17#.#1.114.77':3128
- '95.##.32.186':3128
- '2.###.169.53':3128
- '2.###.249.180':3128
- '41.##2.60.146':3128
- '17#.#44.161.209':3128
- '2.##2.56.58':3128
- '79.##7.45.154':3128
- '62.##.46.191':3128
- '65.##.67.118':3128
- '19#.#6.228.227':3128
- '96.##7.166.214':3128
- '80.##.168.144':3128
- '82.##2.65.253':3128
- '98.##6.110.103':3128
- '2.###.34.106':3128
- '2.###.65.217':3128
- '67.##7.145.130':3128
- '70.##.129.218':3128
- '19#.#55.210.80':3128
- '19#.#1.164.150':3128
- '19#.#50.4.75':3128
- '41.##5.21.229':3128
- '12#.#69.142.139':3128
- '11#.#8.0.130':3128
- '19#.#4.243.152':3128
- '82.##5.17.103':3128
- '20#.#09.207.154':3128
- '78.#3.47.42':3128
- '98.##6.159.183':3128
- '20#.#22.53.220':3128
- '12#.#2.115.8':3128
- '2.###.44.222':3128
- '80.##.108.138':3128
- '92.##.15.249':3128
- '20#.#7.115.209':3128
- '41.#9.7.53':3128
- '18#.#8.39.102':3128
- '31.##.234.148':3128
- '18#.#6.199.147':3128
- '17#.#00.136.231':3128
- '19#.#9.17.88':3128
- '21#.#9.181.49':3128
- '82.##.218.17':3128
- '72.##2.207.162':3128
- '17#.#25.47.182':3128
- '95.##.35.110':3128
- '19#.#42.238.65':3128
- '19#.#4.209.230':3128
- '18#.92.4.30':3128
- '18#.#14.97.87':3128
- '18#.#8.64.136':3128
- '41.##.89.226':3128
- '41.##2.123.137':3128
- '20#.#3.216.26':3128
- '20#.8.94.29':3128
- '41.##3.57.78':3128
- '80.##.168.27':3128
- '19#.#3.101.58':3128
- '98.##.154.203':3128
- '18#.#2.200.29':3128
- '2.##2.50.90':3128
- '20#.#4.201.240':3128
- '13#.#05.165.34':3128
- '19#.#07.142.177':3128
- '19#.#22.233.166':3128
- '17#.#25.151.13':3128
- '20#.#5.120.24':3128
- '80.##.168.43':3128
- '24.##9.159.77':3128
- '98.##7.180.139':3128
- '2.###.38.164':3128
- '84.##0.207.80':3128
- '41.##0.37.54':3128
- '17#.#5.14.97':3128
- '19#.#3.165.73':3128
- '41.##5.229.1':3128
- '61.##4.150.206':3128
- '84.##8.143.240':3128
- '19#.#6.11.170':3128
- '85.##5.83.227':3128
- '58.##3.125.236':3128
- '20#.#05.34.98':3128
- '2.###.240.86':3128
- '18#.#7.12.186':3128
- '18#.#81.181.202':3128
- '18#.#95.46.87':3128
- '46.##5.100.81':3128
- '18#.#0.222.9':3128
- '82.##.23.180':3128
- '77.##.233.235':3128
- '21#.#3.15.59':3128
- '95.##.54.251':3128
- '18#.#8.45.228':3128
- '20#.#1.216.225':3128
- '91.##5.141.145':3128
- '17#.#2.172.221':3128
- '17#.#25.85.114':3128
- '19#.#01.75.104':3128
- '18#.#16.160.2':3128
- '18#.#4.241.171':3128
- '20#.#4.26.210':3128
- '18#.#61.143.224':3128
- '11#.#9.48.172':3128
- '19#.#74.77.184':3128
- '2.###.40.244':3128
- '41.##2.49.181':3128
- '64.##0.246.224':3128
- '95.#5.36.51':3128
- '18#.#5.114.159':3128
- '20#.#32.56.152':3128
- '19#.#50.3.10':3128
- '11#.#9.12.38':3128
- '66.##5.219.88':3128
- '21#.#07.229.228':3128
- '19#.#.218.213':3128
- '66.##4.107.193':3128
- '17#.#27.205.189':3128
- '76.##1.89.146':3128
- '19#.#42.33.87':3128
- '14#.#85.30.114':3128
- '64.##0.246.5':3128
- '19#.#02.203.110':3128
- '19#.#29.50.248':3128
- '19#.#3.152.196':3128
- '11#.#9.48.28':3128
- '41.##2.27.179':3128
- '2.###.65.225':3128
- '18#.#81.119.57':3128
- '20#.#73.13.27':3128
- '19#.#74.71.52':3128
- '12#.#20.63.207':3128
- '21#.#41.20.31':3128
- '72.##2.168.108':3128
- '11#.#39.101.66':3128
- '46.#0.2.58':3128
- '20#.#1.190.170':3128
- '18#.#94.194.45':3128
- '19#.#6.54.168':3128
- '79.#.79.155':3128
- '18#.#14.97.126':3128
- '77.##5.6.251':3128
- '68.##5.66.202':3128
- '11#.#20.209.219':3128
- '21#.#49.86.130':3128
- '92.#7.96.97':3128
- '17#.#2.172.201':3128
- '18#.#14.99.129':3128
- '95.#6.58.64':3128
- '18#.#80.80.19':3128
- '95.##1.151.172':3128
- '65.##5.112.162':3128
- '11#.#9.50.101':3128
- '11#.#49.99.195':3128
- '21#.#8.140.44':3128
- '20#.#07.242.62':3128
- '20#.#04.110.23':3128
- '72.##2.176.94':3128
- '70.##0.64.179':3128
- '19#.#45.114.5':3128
- '18#.#4.243.187':3128
- '16#.#67.84.222':3128
- '2.###.244.48':3128
- '27.##1.137.118':3128
- '95.#6.1.6':3128
- '41.##2.210.106':3128
- '92.##.183.80':3128
- '21#.#98.26.199':3128
- '19#.#0.53.132':3128
- '18#.#81.26.58':3128
- '74.#15.0.21':3128
- '18#.#8.75.56':3128
- '20#.#7.153.40':3128
- '77.##5.15.116':3128
- '93.#26.35.4':3128
- '87.##7.39.181':3128
- '79.##5.253.7':3128
- '10#.#9.146.224':3128
- '84.##0.194.4':3128
- '84.##.103.91':3128
- '18#.#81.187.137':3128
- '11#.#9.48.101':3128
- '82.##8.97.240':3128
- '2.##2.37.84':3128
- '78.##.244.94':3128
- '41.##3.82.250':3128
- '18#.#8.85.241':3128
- '18#.#14.97.240':3128
- '41.##7.123.46':3128
- '2.##2.51.25':3128
- '18#.#14.101.56':3128
- '84.##8.121.56':3128
- '2.##2.48.85':3128
- '80.##.168.20':3128
- '19#.#50.3.77':3128
- '80.##.76.179':3128
- '11#.#9.53.172':3128
- '80.##1.38.165':3128
- '17#.#17.73.187':3128
- '20#.#7.116.159':3128
- '74.#15.3.63':3128
- '41.##1.50.141':3128
- '20#.#8.128.80':3128
- '19#.#4.86.122':3128
- '2.###.240.217':3128
- '41.##2.34.54':3128
- '41.##7.116.34':3128
- '87.##.100.41':3128
- '41.##8.138.77':3128
- '19#.#03.28.182':3128
- '19#.#1.36.106':3128
- '21#.#9.141.17':3128
- '17#.#68.44.113':3128
- '46.##9.114.170':3128
- '19#.#13.207.107':3128
- '18#.#2.133.182':3128
- '17#.#22.170.125':3128
- '85.##0.98.101':3128
- '83.#.53.203':3128
- '18#.#8.80.32':3128
- '19#.#50.0.36':3128
- '95.##.124.38':3128
- '20#.#48.3.233':3128
- '2.##2.61.21':3128
- '31.##.25.203':3128
- '19#.#4.168.223':3128
- '41.##.184.254':3128
- '19#.#7.208.172':3128
- '2.###.217.199':3128
- '11#.#8.215.123':3128
- '2.###.245.44':3128
- '12#.#38.184.171':3128
- '17#.#66.128.213':3128
- '92.##.140.118':3128
- '19#.#6.76.68':3128
- '41.##.17.192':3128
- '20#.#65.181.129':3128
- '98.##3.35.199':3128
- '19#.#5.160.204':3128
- '98.#95.76.6':3128
- '19#.#86.112.59':3128
- '84.##.245.107':3128
- '19#.#7.239.45':3128
- '77.#45.6.14':3128
- '46.##4.151.194':3128
- '21#.#46.218.57':3128
- '74.#15.3.67':3128
- '41.##3.57.75':3128
- '37.#9.67.80':3128
- '87.##0.166.58':3128
- '19#.#98.24.179':3128
- '89.##9.100.164':3128
- '11#.#09.222.32':3128
- '21#.#12.254.91':3128
- '2.###.243.170':3128
- '67.##0.47.37':3128
- '19#.#20.156.106':3128
- '2.##2.67.96':3128
- '18#.#6.230.116':3128
- '11#.#9.55.101':3128
- '89.##5.244.229':3128
- '85.##4.253.12':3128
- ClassName: 'Indicator' WindowName: ''