Technical Information
Modifies file system
Creates the following files
- D:\windows\system32\config\software.log1
- D:\program files (x86)\crdbf\demo\supl\is-gtpll.tmp
- D:\program files (x86)\crdbf\demo\supl\is-r2fre.tmp
- D:\program files (x86)\crdbf\demo\supl\is-r78ti.tmp
- D:\program files (x86)\crdbf\is-2f12h.tmp
- D:\program files (x86)\crdbf\is-077uj.tmp
- D:\program files (x86)\crdbf\is-q2or7.tmp
- D:\program files (x86)\crdbf\repairdbf.ini
- D:\program files (x86)\crdbf\demo\supl\is-ficnc.tmp
- D:\program files (x86)\crdbf\demo\supl\is-mkioh.tmp
- D:\program files (x86)\crdbf\unins000.dat
- D:\system volume information\syscache.hve
- D:\users\user\appdata\local\temp\license.txt
- D:\windows\system32\config\system.log1
- D:\windows\system32\config\system
- D:\windows\system32\winevt\logs\system.evtx
- D:\windows\system32\winevt\logs\security.evtx
- D:\windows\system32\winevt\logs\microsoft-windows-networkprofile%4operational.evtx
- D:\program files (x86)\crdbf\cr_dbf.exe
- D:\system volume information\syscache.hve.log1
- D:\program files (x86)\crdbf\demo\supl\is-9b7mp.tmp
- D:\program files (x86)\crdbf\demo\supl\is-g9m8h.tmp
- D:\program files (x86)\crdbf\demo\is-6shna.tmp
- D:\users\user\appdata\local\microsoft\windows\usrclass.dat.log1
- D:\users\user\appdata\local\microsoft\windows\usrclass.dat
- D:\users\user\appdata\local\temp\is-q4ri8.tmp\is-a4egk.tmp
- D:\users\user\appdata\local\temp\is-peoq7.tmp\_isetup\_setup64.tmp
- D:\users\user\appdata\local\temp\is-peoq7.tmp\_isetup\_shfoldr.dll
- D:\users\user\appdata\local\temp\is-peoq7.tmp\_isdecmp.dll
- D:\users\user\appdata\local\temp\is-peoq7.tmp\_iscrypt.dll
- D:\users\user\ntuser.dat.log1
- D:\windows\system32\config\software
- D:\users\user\ntuser.dat
- D:\program files (x86)\crdbf\is-694c5.tmp
- D:\program files (x86)\crdbf\is-a9gio.tmp
- D:\program files (x86)\crdbf\is-rgsju.tmp
- D:\program files (x86)\crdbf\is-mpbr3.tmp
- D:\program files (x86)\crdbf\demo\is-0uv53.tmp
- D:\program files (x86)\crdbf\demo\is-ehbmf.tmp
- D:\program files (x86)\crdbf\demo\is-n4e9h.tmp
- D:\program files (x86)\crdbf\demo\is-trmm4.tmp
- D:\program files (x86)\crdbf\is-neirg.tmp
- D:\windows\system32\winevt\logs\application.evtx
- D:\windows\serviceprofiles\localservice\appdata\local\lastalive1.dat
Moves the following files
- from D:\program files (x86)\crdbf\is-neirg.tmp to D:\program files (x86)\crdbf\unins000.exe
- from D:\program files (x86)\crdbf\is-2f12h.tmp to D:\program files (x86)\crdbf\repairdbf.key
- from D:\program files (x86)\crdbf\demo\supl\is-r78ti.tmp to D:\program files (x86)\crdbf\demo\supl\tstdbf9.dbf
- from D:\program files (x86)\crdbf\demo\supl\is-r2fre.tmp to D:\program files (x86)\crdbf\demo\supl\tstdbf8.dbf
- from D:\program files (x86)\crdbf\demo\supl\is-gtpll.tmp to D:\program files (x86)\crdbf\demo\supl\tstdbf7.dbf
- from D:\program files (x86)\crdbf\demo\supl\is-mkioh.tmp to D:\program files (x86)\crdbf\demo\supl\tstdbf6.dbf
- from D:\program files (x86)\crdbf\demo\supl\is-ficnc.tmp to D:\program files (x86)\crdbf\demo\supl\tstdbf5.dbf
- from D:\program files (x86)\crdbf\demo\supl\is-9b7mp.tmp to D:\program files (x86)\crdbf\demo\supl\tstdbf4.dbf
- from D:\program files (x86)\crdbf\demo\supl\is-g9m8h.tmp to D:\program files (x86)\crdbf\demo\supl\tstdbf2.dbf
- from D:\program files (x86)\crdbf\demo\is-6shna.tmp to D:\program files (x86)\crdbf\demo\tstdbf5.dbf
- from D:\program files (x86)\crdbf\demo\is-trmm4.tmp to D:\program files (x86)\crdbf\demo\tstdbf4.dbf
- from D:\program files (x86)\crdbf\demo\is-n4e9h.tmp to D:\program files (x86)\crdbf\demo\tstdbf3.dbf
- from D:\program files (x86)\crdbf\demo\is-ehbmf.tmp to D:\program files (x86)\crdbf\demo\tstdbf2.dbf
- from D:\program files (x86)\crdbf\demo\is-0uv53.tmp to D:\program files (x86)\crdbf\demo\tstdbf1.dbf
- from D:\program files (x86)\crdbf\is-mpbr3.tmp to D:\program files (x86)\crdbf\pars.txt
- from D:\program files (x86)\crdbf\is-rgsju.tmp to D:\program files (x86)\crdbf\repairdbf.ini
- from D:\program files (x86)\crdbf\is-a9gio.tmp to D:\program files (x86)\crdbf\chkrepairdbf.chm
- from D:\program files (x86)\crdbf\is-694c5.tmp to D:\program files (x86)\crdbf\cr_dbf.exe
- from D:\program files (x86)\crdbf\is-077uj.tmp to D:\program files (x86)\crdbf\help.ico
- from D:\program files (x86)\crdbf\is-q2or7.tmp to D:\program files (x86)\crdbf\icons.bmp
Network activity
Connects to
- 'jo####rdmust.sbs':80
TCP
HTTP GET requests
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?64########
HTTP POST requests
- http://jo####rdmust.sbs/new/net_api
Other
- 'localhost':49158
- '34.##0.144.191':443
- '34.##1.73.144':443
- '35.##1.9.150':443
UDP
- DNS ASK jo####rdmust.sbs
Miscellaneous
Searches for the following windows
- ClassName: 'bdaa81_CRDBG48Class_bdaa81' WindowName: ''
Creates and executes the following
- 'D:\users\user\appdata\local\temp\is-q4ri8.tmp\is-a4egk.tmp' /SL4 $50224 "<Full path to file>" 4260970 51712
- 'D:\program files (x86)\crdbf\cr_dbf.exe'
- 'D:\program files (x86)\crdbf\cr_dbf.exe' f5359e8a25e49fa12b8d03017f51c99e
