Trojan.DownLoader23.33403

Malicious functions:

Creates and executes the following:

'%TEMP%\IQIYIsetup_senxing@kb008.exe' (downloaded from the Internet)
'%TEMP%\kuwo_jm634.exe' (downloaded from the Internet)
'%TEMP%\kele20161027Silent_22810000000.exe' (downloaded from the Internet)
'%TEMP%\luyou_s_1026.exe' (downloaded from the Internet)
'%TEMP%\FunSirius_PS_c7905_s.exe' (downloaded from the Internet)
'%TEMP%\XMPSetupLite-SIaqws10.exe' (downloaded from the Internet)
'%TEMP%\inst_buychannel_34.exe' (downloaded from the Internet)
'%TEMP%\Browser_V5.7.16400.16_r_4396_(Build1611171340).exe' (downloaded from the Internet)
'%TEMP%\5590a2a9_1202000632.exe' (downloaded from the Internet)
'%TEMP%\lenovopcmanager_support2.lenovo.exe' (downloaded from the Internet)
'%TEMP%\Baidu_Setup_3.1.200.2978_ftn_1050123723.exe' (downloaded from the Internet)
'%TEMP%\lany_Y_907453_feitian.exe' (downloaded from the Internet)
'%TEMP%\160wifi_Build33024[6092]_Setup.exe' (downloaded from the Internet)
'%TEMP%\BFQuickUrl_000002.exe' (downloaded from the Internet)
'%TEMP%\QBDownload_10024040.exe' (downloaded from the Internet)

Executes the following:

Modifies file system:

Creates the following files:

Deletes the following files:

Network activity:

Connects to:

TCP:

HTTP GET requests:

http://do##.kuwo.cn/mbox/kuwo_jm634.exe
http://dl.###tic.iqiyi.com/hz/IQIYIsetup_senxing@kb008.exe
http://do##2.uc.cn/pcbrowser/down.php?pi######
http://c.###e55.com/c/kele20161027Silent_22810000000.exe
http://xm#.##wn.sandai.net/kankan/XMPSetupLite-SIaqws10.exe
http://mc.##nshion.com/interface/mc?mc#######
http://fi###.#uyoudashi.com/file/luyou_s_1026.exe
http://dl.##0safe.com/ludashi/inst_buychannel_34.exe
http://re#.#aoha.com/soft/160wifi/160wifi_Build33024[6092]_Setup.exe
http://s1.#.#ysdknb.com/down/lian/lenovopcmanager_support2.lenovo.exe
http://w.#.#aidu.com/go/full/201/1202000632 via 12#.#25.114.144
http://pv.#ohu.com/cityjson
http://sc######lsw.br.baidu.com/original/201612/Baidu_Setup_3.1.200.2978_ftn_1050123723.exe via 12#.#25.114.144
http://dl###1.qq.com/invc/tt/QBDownload_10024040.exe
http://dl.##.cdyunduo.com/XS/BFQuickUrl_000002.exe
http://cd#.#unshark.cn/lany_Y_907453_feitian.exe
http://a.###aforall.cn/b662ef49.exe/40.html

UDP:

Miscellaneous:

Searches for the following windows: