Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'engel' = '%APPDATA%\updates\updates.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
- <SYSTEM32>\netsh.exe advfirewall firewall add rule name="<Имя вируса>" dir=in action=allow program="<Полный путь к вирусу>"
- %APPDATA%\engel\updates.exe
- '19#.#.103.21':3128
- '89.##3.128.162':3128
- '78.##.47.250':3128
- '19#.#8.223.124':3128
- '17#.#23.190.206':3128
- '17#.#22.71.119':3128
- '95.##.175.189':3128
- '62.##3.176.118':3128
- '17#.#23.44.93':3128
- '18#.#96.142.123':3128
- '20#.#8.21.237':3128
- '76.#6.30.39':3128
- '11#.#24.216.244':3128
- '61.##.131.206':3128
- '20#.#65.227.159':3128
- '80.##.202.126':3128
- '11#.#8.196.60':3128
- '95.##.198.179':3128
- '12#.#27.65.181':3128
- '79.##5.138.210':3128
- '12#.#9.88.129':3128
- '41.##3.57.72':3128
- '12#.#31.201.68':3128
- '85.##1.145.247':3128
- '89.##6.238.249':3128
- '11#.#6.124.137':3128
- '89.#3.210.7':3128
- '58.##3.125.236':3128
- '14.##5.130.95':3128
- '18#.#88.253.13':3128
- '93.##.61.137':3128
- '17#.#26.2.11':3128
- '18#.#18.81.191':3128
- '12#.#1.184.203':3128
- '10#.#.140.177':3128
- '84.##.69.185':3128
- '87.##1.19.76':3128
- '77.##0.180.124':3128
- '89.##0.164.105':3128
- '20#.#66.43.130':3128
- '41.##.162.210':3128
- '18#.#96.138.106':3128
- '46.##6.155.13':3128
- '82.##0.33.111':3128
- '18#.#12.138.52':3128
- '19#.#51.53.33':3128
- '10#.#39.46.219':3128
- '20#.#12.129.137':3128
- '12#.#92.69.237':3128
- '20#.#10.236.148':3128
- '18#.#29.171.243':3128
- '83.##.172.192':3128
- '89.##.230.250':3128
- '79.##5.253.7':3128
- '11#.#9.2.129':3128
- '94.##.112.74':3128
- '94.##7.182.140':3128
- '20#.#62.60.235':3128
- '22#.#58.173.198':3128
- '20#.#53.86.208':3128
- '11#.#53.193.94':3128
- '41.##4.180.37':3128
- '11#.#8.79.41':3128
- '19#.#3.151.16':3128
- '11#.#6.206.49':3128
- '78.#9.76.18':3128
- '87.##9.73.144':3128
- '12#.#18.153.19':3128
- '17#.#25.201.94':3128
- '78.##.186.228':3128
- '20#.#36.119.141':3128
- '11#.#07.21.34':3128
- '12#.#25.64.82':3128
- '17#.#11.154.107':3128
- '95.##.50.233':3128
- '91.##.126.12':3128
- '94.#0.39.72':3128
- '11#.#9.129.136':3128
- '21#.#5.88.163':3128
- '94.##8.215.205':3128
- '41.##3.25.235':3128
- '79.##6.165.190':3128
- '10#.#85.168.169':3128
- '82.##8.19.32':3128
- '20#.#49.127.77':3128
- '84.##8.105.142':3128
- '46.#9.67.20':3128
- '87.##6.74.225':3128
- '85.##6.104.184':3128
- '21#.#27.80.51':3128
- '11#.#2.72.149':3128
- '92.#7.4.97':3128
- '20#.#17.51.159':3128
- '27.##5.56.137':3128
- '10#.#0.50.238':3128
- '46.##9.27.48':3128
- '18#.#2.150.202':3128
- '11#.#37.86.98':3128
- '19#.#2.90.65':3128
- '17#.#50.60.10':3128
- '11#.#52.105.162':3128
- '87.##6.203.32':3128
- '95.##.230.132':3128
- '18#.#24.226.4':3128
- '19#.#03.64.7':3128
- '11#.#6.99.46':3128
- '89.#6.59.46':3128
- '83.##2.81.217':3128
- '82.##.125.210':3128
- '21#.#96.68.177':3128
- '18#.88.14.8':3128
- '11#.#93.161.122':3128
- '11#.#04.205.58':3128
- '99.##9.85.175':3128
- '89.##4.139.50':3128
- '24.##0.238.113':3128
- '20#.#48.243.134':3128
- '79.##2.91.208':3128
- '11#.#8.214.212':3128
- '89.##7.75.85':3128
- '11#.#07.129.130':3128
- '11#.#52.56.220':3128
- '11#.#1.185.189':3128
- '20#.#29.54.51':3128
- '11#.#64.192.24':3128
- '78.##.242.233':3128
- '18#.#15.160.10':3128
- '46.##.133.103':3128
- '92.##5.120.56':3128
- '78.##.160.45':3128
- '11#.#52.241.216':3128
- '19#.#3.163.69':3128
- '12#.#94.160.227':3128
- '41.##1.74.239':3128
- '11#.#9.2.101':3128
- '18#.#8.130.143':3128
- '18#.#29.211.240':3128
- '85.##0.73.139':3128
- '95.##.20.216':3128
- '11#.#0.239.202':3128
- '18#.#15.36.80':3128
- '41.##3.57.74':3128
- '41.##1.77.33':3128
- '11#.#93.128.2':3128
- '89.##4.70.215':3128
- '18#.#63.14.0':3128
- '95.##.129.248':3128
- '46.##.73.184':3128
- '18#.#20.226.164':3128
- '77.##.45.219':3128
- '11#.186.1.5':3128
- '92.##4.107.208':3128
- '22#.#43.61.190':3128
- '18#.#2.80.42':3128
- '20#.#32.21.165':3128
- '74.#15.3.63':3128
- '18#.#5.9.149':3128
- '19#.#18.179.26':3128
- '77.##7.205.28':3128
- '10#.#6.243.83':3128
- '18#.#30.192.195':3128
- '21#.#.52.166':3128
- '88.##8.146.177':3128
- '94.##6.145.173':3128
- '88.##5.193.47':3128
- '21#.#18.119.40':3128
- '86.##3.31.54':3128
- '12#.#62.206.88':3128
- '21#.#2.200.158':3128
- '1.##.150.111':3128
- '11#.#97.17.82':3128
- '16#.9.22.67':3128
- '89.##.218.70':3128
- '21#.#11.249.148':3128
- '95.##.174.183':3128
- '18#.#73.49.47':3128
- '11#.#52.191.187':3128
- '21#.#11.222.2':3128
- '93.##3.49.61':3128
- '41.##1.251.106':3128
- '82.##.238.16':3128
- '84.##3.38.28':3128
- '79.##5.224.117':3128
- '94.##8.129.185':3128
- '89.##8.163.103':3128
- '86.##3.143.34':3128
- '11#.#52.7.105':3128
- '18#.#2.38.238':3128
- '20#.#32.61.93':3128
- '89.##2.4.225':3128
- '94.##4.41.159':3128
- '92.##5.151.107':3128
- '78.##7.180.250':3128
- '21#.#09.80.142':3128
- '95.##4.33.171':3128
- '92.##.85.163':3128
- '19#.#09.33.20':3128
- '86.##6.237.212':3128
- '93.##.246.147':3128
- '95.##.61.119':3128
- '18#.#30.82.40':3128
- '80.##.120.34':3128
- '20#.#48.139.95':3128
- '19#.#4.73.134':3128
- '61.##.186.155':3128
- '20#.#11.203.98':3128
- '18#.#77.138.92':3128
- '19#.#22.143.202':3128
- '11#.#54.47.113':3128
- '50.##.133.19':3128
- '21#.#75.4.226':3128
- '78.##3.48.99':3128
- '93.##5.96.73':3128
- '20#.#3.53.212':3128
- '62.##8.214.33':3128
- '22#.#7.108.247':3128
- '17#.#33.138.146':3128
- '18#.#37.65.39':3128
- '31.#.140.210':3128
- '95.##8.56.82':3128
- '85.##0.81.228':3128
- '94.##.129.207':3128
- '12#.#60.42.118':3128
- '86.##6.230.114':3128
- '95.##.26.116':3128
- '93.##8.250.214':3128
- '83.##8.82.159':3128
- '94.##4.183.148':3128
- '94.##9.250.181':3128
- '77.##2.62.127':3128
- '94.##.95.239':3128
- '19#.#7.45.175':3128
- '19#.#07.110.169':3128
- '18#.#20.91.116':3128
- '67.##7.198.35':3128
- '94.##.107.65':3128
- '10#.#7.133.180':3128
- '94.##.56.138':3128
- '81.#8.61.41':3128
- '21#.#13.246.28':3128
- '12#.#78.65.249':3128
- '20#.#7.218.96':3128
- '18#.#73.105.196':3128
- '86.#7.89.35':3128
- '94.##7.75.85':3128
- '41.##1.82.208':3128
- '93.##3.85.241':3128
- '19#.#04.38.89':3128
- '95.##.43.209':3128
- '78.##4.140.172':3128
- '59.##3.48.53':3128
- '94.#2.57.11':3128
- '18#.#0.181.170':3128
- '94.##.136.173':3128
- '21#.#33.174.238':3128
- '10#.#39.36.54':3128
- '82.##9.165.28':3128
- '18#.#7.65.57':3128
- '77.##6.167.28':3128
- '22#.#30.69.202':3128
- '77.##3.37.253':3128
- '11#.#7.11.143':3128
- '89.##6.183.97':3128
- '19#.#05.12.237':3128
- '11#.#6.125.169':3128
- '10#.#39.40.50':3128
- '18#.#93.55.21':3128
- '81.#0.0.18':3128
- '86.##1.54.123':3128
- '88.##6.111.111':3128
- '17#.#23.56.162':3128
- '18#.#29.211.24':3128
- '41.##1.112.152':3128
- '21#.#12.254.186':3128
- '82.##.88.127':3128
- '85.##.156.118':3128
- '82.#28.3.71':3128
- '17#.#0.145.197':3128
- '41.##5.78.172':3128
- '19#.#25.94.189':3128
- '82.##7.106.170':3128
- '46.##2.47.133':3128
- '2.###.52.138':3128
- '41.##5.12.152':3128
- '19#.#02.180.33':3128
- '20#.#4.201.167':3128
- '96.##.68.136':3128
- '46.##.133.16':3128
- '12#.#65.113.62':3128
- '78.#7.50.29':3128
- '46.##.53.183':3128
- '11#.#6.12.94':3128
- '95.##.131.253':3128
- '58.##7.129.53':3128
- '92.##5.119.253':3128
- '83.##8.197.86':3128
- '60.##8.114.171':3128
- '78.##9.161.87':3128
- '20#.#1.160.62':3128
- '87.##0.166.58':3128
- '78.##.217.138':3128
- '91.##4.33.154':3128
- '19#.#55.209.74':3128
- '92.##.156.249':3128
- '18#.#30.33.95':3128
- '92.##.142.154':3128
- '18#.#6.239.214':3128
- '27.##.34.144':3128
- '41.##3.57.76':3128
- '18#.#2.216.51':3128
- '12#.#6.219.206':3128
- '17#.#1.27.162':3128
- '18#.#29.215.124':3128
- '82.##2.103.247':3128
- '12#.#36.25.75':3128
- '13#.#.157.199':3128
- '95.##.194.164':3128
- '12#.#53.128.30':3128
- '18#.#2.218.50':3128
- '18#.#2.242.128':3128
- '18#.3.72.5':3128
- '10#.#7.192.82':3128
- '89.##.80.162':3128
- '41.##1.75.228':3128
- '17#.#23.54.228':3128
- '12#.#38.17.64':3128
- '11#.#00.211.107':3128
- '94.##6.159.103':3128
- '86.##6.40.27':3128
- '18#.#29.218.150':3128
- '50.##.246.189':3128
- '78.##.202.75':3128
- '17#.#7.74.78':3128
- DNS ASK 41######.##025284.4268776.41025516ttttp
- DNS ASK 50######.50462468.4268776.ttttp
- ClassName: 'Indicator' WindowName: ''