Technical Information
Modifies file system
Creates the following files
- D:\users\user\ntuser.dat.log1
- D:\program files (x86)\cr dbf\is-csp57.tmp
- D:\program files (x86)\cr dbf\is-f7fpa.tmp
- D:\program files (x86)\cr dbf\repairdbf.ini
- D:\program files (x86)\cr dbf\unins000.dat
- D:\program files (x86)\cr dbf\cr_dbf.exe
- D:\users\user\appdata\local\microsoft\windows\usrclass.dat.log1
- D:\users\user\appdata\local\microsoft\windows\usrclass.dat
- D:\program files (x86)\cr dbf\demo\supl\is-p4o62.tmp
- D:\program files (x86)\cr dbf\is-btii2.tmp
- D:\system volume information\syscache.hve.log1
- D:\windows\system32\winevt\logs\system.evtx
- D:\windows\system32\config\system.log1
- D:\windows\system32\config\system
- D:\windows\system32\winevt\logs\security.evtx
- D:\windows\system32\winevt\logs\microsoft-windows-networkprofile%4operational.evtx
- D:\windows\system32\config\software.log1
- D:\windows\system32\config\software
- D:\system volume information\syscache.hve
- D:\users\user\appdata\local\temp\license.txt
- D:\program files (x86)\cr dbf\demo\supl\is-gb5su.tmp
- D:\program files (x86)\cr dbf\demo\supl\is-h70jb.tmp
- D:\program files (x86)\cr dbf\demo\supl\is-bpi33.tmp
- D:\users\user\appdata\local\temp\is-8mstk.tmp\is-70q5s.tmp
- D:\users\user\appdata\local\temp\is-0eejp.tmp\_isetup\_setup64.tmp
- D:\users\user\appdata\local\temp\is-0eejp.tmp\_isetup\_shfoldr.dll
- D:\users\user\appdata\local\temp\is-0eejp.tmp\_isdecmp.dll
- D:\users\user\appdata\local\temp\is-0eejp.tmp\_iscrypt.dll
- D:\program files (x86)\cr dbf\is-6p2sa.tmp
- D:\program files (x86)\cr dbf\is-4r3l8.tmp
- D:\program files (x86)\cr dbf\is-0rop6.tmp
- D:\users\user\ntuser.dat
- D:\program files (x86)\cr dbf\is-lv0h3.tmp
- D:\program files (x86)\cr dbf\demo\is-c128e.tmp
- D:\program files (x86)\cr dbf\demo\is-5dug2.tmp
- D:\program files (x86)\cr dbf\demo\is-3msmi.tmp
- D:\program files (x86)\cr dbf\demo\is-cmgo9.tmp
- D:\program files (x86)\cr dbf\demo\is-3se74.tmp
- D:\program files (x86)\cr dbf\demo\supl\is-ef7gi.tmp
- D:\program files (x86)\cr dbf\demo\supl\is-dubru.tmp
- D:\program files (x86)\cr dbf\demo\supl\is-64723.tmp
- D:\program files (x86)\cr dbf\is-ir5tu.tmp
- D:\windows\system32\winevt\logs\application.evtx
- D:\windows\serviceprofiles\localservice\appdata\local\lastalive1.dat
Moves the following files
- from D:\program files (x86)\cr dbf\is-6p2sa.tmp to D:\program files (x86)\cr dbf\unins000.exe
- from D:\program files (x86)\cr dbf\is-btii2.tmp to D:\program files (x86)\cr dbf\repairdbf.key
- from D:\program files (x86)\cr dbf\demo\supl\is-p4o62.tmp to D:\program files (x86)\cr dbf\demo\supl\tstdbf9.dbf
- from D:\program files (x86)\cr dbf\demo\supl\is-gb5su.tmp to D:\program files (x86)\cr dbf\demo\supl\tstdbf8.dbf
- from D:\program files (x86)\cr dbf\demo\supl\is-h70jb.tmp to D:\program files (x86)\cr dbf\demo\supl\tstdbf7.dbf
- from D:\program files (x86)\cr dbf\demo\supl\is-bpi33.tmp to D:\program files (x86)\cr dbf\demo\supl\tstdbf6.dbf
- from D:\program files (x86)\cr dbf\demo\supl\is-64723.tmp to D:\program files (x86)\cr dbf\demo\supl\tstdbf5.dbf
- from D:\program files (x86)\cr dbf\demo\supl\is-dubru.tmp to D:\program files (x86)\cr dbf\demo\supl\tstdbf4.dbf
- from D:\program files (x86)\cr dbf\demo\supl\is-ef7gi.tmp to D:\program files (x86)\cr dbf\demo\supl\tstdbf2.dbf
- from D:\program files (x86)\cr dbf\demo\is-3se74.tmp to D:\program files (x86)\cr dbf\demo\tstdbf5.dbf
- from D:\program files (x86)\cr dbf\demo\is-cmgo9.tmp to D:\program files (x86)\cr dbf\demo\tstdbf4.dbf
- from D:\program files (x86)\cr dbf\demo\is-3msmi.tmp to D:\program files (x86)\cr dbf\demo\tstdbf3.dbf
- from D:\program files (x86)\cr dbf\demo\is-5dug2.tmp to D:\program files (x86)\cr dbf\demo\tstdbf2.dbf
- from D:\program files (x86)\cr dbf\demo\is-c128e.tmp to D:\program files (x86)\cr dbf\demo\tstdbf1.dbf
- from D:\program files (x86)\cr dbf\is-ir5tu.tmp to D:\program files (x86)\cr dbf\pars.txt
- from D:\program files (x86)\cr dbf\is-lv0h3.tmp to D:\program files (x86)\cr dbf\repairdbf.ini
- from D:\program files (x86)\cr dbf\is-0rop6.tmp to D:\program files (x86)\cr dbf\chkrepairdbf.chm
- from D:\program files (x86)\cr dbf\is-4r3l8.tmp to D:\program files (x86)\cr dbf\cr_dbf.exe
- from D:\program files (x86)\cr dbf\is-csp57.tmp to D:\program files (x86)\cr dbf\help.ico
- from D:\program files (x86)\cr dbf\is-f7fpa.tmp to D:\program files (x86)\cr dbf\icons.bmp
Network activity
Connects to
- 'jo####rdmust.sbs':80
TCP
HTTP GET requests
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?64########
HTTP POST requests
- http://jo####rdmust.sbs/new/net_api
UDP
- DNS ASK jo####rdmust.sbs
Miscellaneous
Searches for the following windows
- ClassName: 'bfbd75_CRDBF46Class_bfbd75' WindowName: ''
Creates and executes the following
- 'D:\users\user\appdata\local\temp\is-8mstk.tmp\is-70q5s.tmp' /SL4 $70264 "<Full path to file>" 4257101 51712
- 'D:\program files (x86)\cr dbf\cr_dbf.exe'
- 'D:\program files (x86)\cr dbf\cr_dbf.exe' b85ed4b2bac9b3ffbb0c7d6a9f213efb
