Trojan.DownLoader30.30836

Техническая информация

Изменения в файловой системе

Создает следующие файлы

%TEMP%\157b72d.tmp
%TEMP%\157c577.tmp
<LS_APPDATA>\microsoft\windows\history\history.ie5\mshist012019102720191028\index.dat

Удаляет следующие файлы

%TEMP%\157b72d.tmp
%TEMP%\157c577.tmp

Сетевая активность

TCP

Запросы HTTP GET

http://ca########erupdater.cacaotools.com/cacaoencoderupdater/config?ki##########################################################################################################################...
http://c.##1st.com/img/default/main/english_topcontroller_close.gif
http://c.##1st.com/img/default/main/global_deliv_kotxt.gif
http://c.##1st.com/img/common/v2/sp_header_util.png
http://c.##1st.com/img/common/v2/sp_header_search.png
http://c.##1st.com/html/browsing/main/mainHeadData.js
http://c.##1st.com/img/common/v2/sp_header_gnb_v2.png
http://c.##1st.com/img/common/v2/sp_header_gnb.png
http://www.11##.co.kr/html/
http://c.##1st.com/js/common/handlebars.helper.js
http://www.11##.co.kr/html/blank.html
http://c.##1st.com/img/main/v2/sp_main.png
http://s.##1st.com/img/common/blank.gif
http://c.##1st.com/img/common/v2/sp_footer.png
http://www.11##.co.kr/html/browsing/main/mainLegoData.js
http://s.##1st.com/img/product/no_image_110.gif
http://www.11##.co.kr/img/prd_size/noimg_130.gif
http://c.##1st.com/js/lib/jquery/jquery.lazyload.min.js
http://c.##1st.com/js/lego/lego.js
http://www.11##.co.kr/html/browsing/main/mainFootData.js
http://www.11##.co.kr/img/prd_size/noimg_100.gif
http://c.##1st.com/js/common/footerCommonJs.js
http://c.##1st.com/js/include/inc_footer.js
http://c.##1st.com/html/inc_footer_data.js
http://c.##1st.com/img/default/icon/bar_10px_c4c4c4.gif
http://c.##1st.com/img/common/v2/sp_common_v2.png
http://www.11##.co.kr/browsing/MainAjax.tmall?me############################
http://c.##1st.com/img/default/main/icon_glogal_deliv.gif
http://c.##1st.com/css/main/main_v3.css
http://mu##.co.kr/count/windowstab/page_cucu.php
http://www.ab###-tab.com/windowstab/tabview.asp?pt####################
http://www.11##.co.kr/connect/Gateway.tmall?me######################################################################################
http://www.11##.co.kr/js/common/headerCommonJs.js
http://www.11##.co.kr/html/reserveKeywordList.js
http://www.go#####analytics.com/analytics.js
http://www.go#####agmanager.com/gtm.js?id##########################
http://www.11##.co.kr/favicon.ico
http://www.11##.co.kr/html/main.html?ut######################################################################################################################################
http://c.##1st.com/html/experiment/experimentMetaInfo.js
http://c.##1st.com/js/plab/plab-web-sdk-0.9.1.min.js
http://c.##1st.com/js/lib/jquery/jquery-1.5.min.js
http://c.##1st.com/img/default/main/global_deliv_h2bg.gif
http://c.##1st.com/js/lib/html5.js
http://c.##1st.com/js/lib/handlebars/handlebars-v4.0.5.min.js
http://c.##1st.com/html/inc_header_data.js
http://c.##1st.com/js/common/headerCommonJs.js
http://c.##1st.com/html/browsing/main/mainAdDsData.js
http://c.##1st.com/html/browsing/main/mainAdData.js
http://c.##1st.com/js/local/main2016.js
http://c.##1st.com/js/common/inc_header_v7.js
http://c.##1st.com/img/main/v2/bnr_upgrade.png
http://c.##1st.com/img/default/main/english_global_delev.gif
http://c.##1st.com/img/default/main/english_topcontroller_bg_v02.gif
http://c.##1st.com/img/default/main/global_deliv_dotline.gif
http://c.##1st.com/js/common/inc_floatingEvent.js

Запросы HTTP POST

http://www.11##.co.kr/commons/HeaderAjaxAction.tmall?me################
http://www.11##.co.kr/browsing/MainAjax.tmall?me###########################
http://www.11##.co.kr/browsing/MainAjax.tmall?me############################################
http://www.11##.co.kr/browsing/MainAjax.tmall?me######################################################

UDP