Adware.Downware.946

Technical Information

Modifies file system

Creates the following files

%TEMP%\sdm143\000f56f0
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\close_disabled[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\minimize_up[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\caasbycl\offlineheader[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\initialized[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\emptyfooter[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\initializedfailed[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\caasbycl\header_pixel_blue[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\connecting_anim[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\wizard_back_offline[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\defines[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\dialogs[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\defines[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\caasbycl\connecting_anim[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\conf_defines[2]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\util[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\caasbycl\pageurlinfo[2]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\disconnected[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\header_pixel_small[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\caasbycl\close_up[2]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\caasbycl\retry_up[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\cancel_up[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\offlineheader[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\caasbycl\initialized[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\header_pixel_blue[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\header_pixel[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\caasbycl\jquery-1.7.2.min[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\caasbycl\close_up[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\functions[1]
%TEMP%\sdm143\cmhelper.exe
%TEMP%\sdm143\exentctlinstaller.dll
%TEMP%\sdm143\free ride games.exe
%TEMP%\sdm143\resourcedll.dll
%TEMP%\_uninsep.bat
%TEMP%\sdm143\sdmlog.log
%TEMP%\sdm143\sdm_db_143.xml
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\caasbycl\index[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\defines[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\conf_defines[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\caasbycl\util[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\connection[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\bubbleleft[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\controller[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\caasbycl\pageurlinfo[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\configuration[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\extrnalhandler[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\progress[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\caasbycl\measurements[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\sdmhtmlinterfaces[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\gamesinqueue[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\sdm[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\caasbycl\bubbleright[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\bubbleright[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\bubbleleft[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\wizard_back_offline[1]

Deletes the following files

%TEMP%\sdm143\000f56f0
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\defines[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\defines[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\conf_defines[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\caasbycl\util[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\caasbycl\close_up[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\caasbycl\offlineheader[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\initialized[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\caasbycl\header_pixel_blue[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\connecting_anim[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\wizard_back_offline[1]

Deletes itself.

Network activity

UDP

DNS ASK fr####degames.com
DNS ASK cb#.##ldchat.com
DNS ASK cd#.#xent.com

Miscellaneous

Searches for the following windows

ClassName: 'SDM_Singleton' WindowName: 'SDM_Singleton'
ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebCheckMonitor' WindowName: ''

Creates and executes the following

'%TEMP%\sdm143\free ride games.exe' "u 'http://www.fr####degames.com/do/SDM?ac######################### p '143' c '676750' l 'Installer'"
'%TEMP%\sdm143\free ride games.exe' "u 'http://www.fr####degames.com/do/SDM?ac######################### p '143' c '676750' l 'Installer'"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\_uninsep.bat" "' (with hidden window)

Executes the following