Trojan.DownLoader8.54944

Malicious functions:

Creates and executes the following:

Injects code into

the following system processes:

Modifies file system :

Creates the following files:

<SYSTEM32>\ovuajnej.exe
<SYSTEM32>\inkqylmi.exe
<SYSTEM32>\wawhydsk.exe
<SYSTEM32>\yftzizyv.exe
<SYSTEM32>\lysbvzmq.exe
<SYSTEM32>\qsojsltp.exe
<SYSTEM32>\oktdzpyt.exe
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\drivetable.txt
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\_filelst.cfg
<SYSTEM32>\lkjfarnc.exe
<SYSTEM32>\xhkigikq.exe
<SYSTEM32>\aszqoumk.exe
<SYSTEM32>\jlpwhpwi.exe
<SYSTEM32>\cjneqwbw.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\1759CB3B5124F217143044[1]
<SYSTEM32>\msslmwop.exe
<SYSTEM32>\nntwibat.exe
<SYSTEM32>\obcflyfl.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\1759CB3B5124F217143044[1]
<SYSTEM32>\mswinsck.ocx
<SYSTEM32>\aigdiuau.exe
<SYSTEM32>\phehvjke.exe
<SYSTEM32>\xeyyvmxi.exe
<SYSTEM32>\wsqajkgh.exe
<SYSTEM32>\fbqoikvg.exe
<SYSTEM32>\jucinvjy.exe
<SYSTEM32>\lckwkfuk.exe

Sets the 'hidden' attribute to the following files:

Deletes the following files:

%TEMP%\~DFFF0A.tmp
%TEMP%\~DF1D37.tmp
%TEMP%\~DF74EC.tmp
%TEMP%\~DF5423.tmp
%TEMP%\~DFD6F0.tmp
%TEMP%\~DF9B45.tmp
%TEMP%\~DFE911.tmp
%TEMP%\~DF878.tmp
%TEMP%\~DF5E32.tmp
%TEMP%\~DFC003.tmp
%TEMP%\~DF4399.tmp
%TEMP%\~DFAE50.tmp
<SYSTEM32>\Restore\MachineGuid.txt
%TEMP%\~DF4099.tmp
%TEMP%\~DFB4E7.tmp
%TEMP%\~DF603E.tmp
%TEMP%\~DF856D.tmp
%TEMP%\~DFEB19.tmp
%TEMP%\~DF1126.tmp
%TEMP%\~DF2EC7.tmp
%TEMP%\~DF864E.tmp
%TEMP%\~DFE8BE.tmp
%TEMP%\~DF69ED.tmp
%TEMP%\~DFCBF.tmp
%TEMP%\~DFA1E7.tmp
%TEMP%\~DFFB73.tmp
%TEMP%\~DF68F5.tmp
%TEMP%\~DF7C29.tmp
%TEMP%\~DFAEC3.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\1759CB3B5124F217143044[1]
%TEMP%\~DFD62B.tmp
%TEMP%\~DF136F.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\1759CB3B5124F217143044[1]
%TEMP%\~DF429A.tmp
%TEMP%\~DFD3AE.tmp
%TEMP%\~DF5152.tmp
%TEMP%\~DFD91E.tmp
%TEMP%\~DF317D.tmp
%TEMP%\~DF8ACB.tmp
%TEMP%\~DFB318.tmp
%TEMP%\~DFF9E2.tmp
%TEMP%\~DF4029.tmp
%TEMP%\~DFBF5E.tmp
%TEMP%\~DF2094.tmp
%TEMP%\~DF793E.tmp
%TEMP%\~DF9766.tmp