Technical Information
Modifies file system
Creates the following files
- %TEMP%\rarsfx0\cybermania.url
- %TEMP%\rarsfx0\64.exe
- %TEMP%\rarsfx0\filerecoveryprosetup.exe
- %TEMP%\rarsfx0\32.exe
- %TEMP%\rarsfx0\32or64.cmd
- %TEMP%\is-paqqq.tmp\filerecoveryprosetup.tmp
- %TEMP%\is-ot8is.tmp\_isetup\_setup64.tmp
- %TEMP%\is-ot8is.tmp\_isetup\_shfoldr.dll
- %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-nmqqp.tmp
- %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-jl9sl.tmp
- %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-r9099.tmp
- %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-evfoh.tmp
- %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-9c2m2.tmp
- %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-fh502.tmp
- %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-n7b16.tmp
- %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-7tlj2.tmp
- %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-b6g9q.tmp
- %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-1lrdm.tmp
- %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-ccmsd.tmp
- %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-okre8.tmp
- %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-er2gn.tmp
- %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-7uvbb.tmp
- %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-40mnn.tmp
- %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-avnpr.tmp
- %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-7n1pk.tmp
- %ProgramFiles%\lsoft technologies\active@ file recovery professional\platforms\is-6lj2p.tmp
- %ProgramFiles%\lsoft technologies\active@ file recovery professional\printsupport\is-rie3s.tmp
- %ProgramFiles%\lsoft technologies\active@ file recovery professional\imageformats\is-iik9i.tmp
- %ProgramFiles%\lsoft technologies\active@ file recovery professional\imageformats\is-hbm77.tmp
- %ProgramFiles%\lsoft technologies\active@ file recovery professional\imageformats\is-uan1n.tmp
- %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-vsn5j.tmp
- %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-qgbl5.tmp
- %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-hmtg8.tmp
- %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-d2npu.tmp
- %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-1v8ll.tmp
- %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-j87od.tmp
- %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-sp0vg.tmp
- %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-n1s15.tmp
- %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-ess0p.tmp
- %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-gcvj2.tmp
- %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-77bjm.tmp
- %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-p9ih5.tmp
- %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-sej7n.tmp
- %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-dkl8r.tmp
- %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-tbvvj.tmp
- %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-in07l.tmp
- %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-3ruv8.tmp
- %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-qhk1g.tmp
- %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-s2e9u.tmp
- %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-mie6e.tmp
- %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-c84g4.tmp
- %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-kke8q.tmp
- %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-h1adg.tmp
- %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-3vnj7.tmp
- %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-e43n2.tmp
- %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-v6reh.tmp
- %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-g11p1.tmp
- %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-5vnnp.tmp
- %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-1lt4r.tmp
- %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-gfm6b.tmp
- %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-ifhf7.tmp
- %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-7io1r.tmp
- %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-h4nu6.tmp
- %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-jfq83.tmp
- %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-v0s6t.tmp
- %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-fbu36.tmp
- %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-gq7rr.tmp
- %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-682ff.tmp
- %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-ud0ap.tmp
- %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-u5phh.tmp
- %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-68jaj.tmp
- %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-3o6s7.tmp
- %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-badpj.tmp
- %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-k7i6l.tmp
- %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-g5pb6.tmp
- %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-h6qi4.tmp
- %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-ils64.tmp
- %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-8bm09.tmp
- %ProgramFiles%\lsoft technologies\active@ file recovery professional\settings.ini
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\active@ file recovery professional\active@ file recovery.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\active@ file recovery professional\active@ disk editor.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\active@ file recovery professional\documentation\active@ file recovery.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\active@ file recovery professional\documentation\active@ disk editor.lnk
- %ProgramFiles%\lsoft technologies\active@ file recovery professional\unins000.msg
- %ProgramFiles%\lsoft technologies\active@ file recovery professional\unins000.dat
- %ProgramFiles%\lsoft technologies\active@ file recovery professional\version.dll
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6a9ddb57-c48.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6a9ddb5c-105c.pma
- %LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000002
- %LOCALAPPDATA%\microsoft\edge\user data\default\000002.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\index
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_2
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_3
- %LOCALAPPDATA%\microsoft\edge\user data\default\cookies-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\cookies
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\index
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_2
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_3
- %LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\936eabdc5eee30bf_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000002
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\fe9608174796ebdb_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\333f9187d9485454_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000003
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\9e5c59d5a0eec716_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000004
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000005
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000006
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\5610223cb6087d2f_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\99a566994112de1e_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000007
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\f641755f5061cfca_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000008
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000009
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000a
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000b
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\ff3bd32648f2472d_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000c
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\c638b9fd40e9bdf9_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\0adbadbe64fcf409_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000d
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000e
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\2afd9e300613832c_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\970813dcab12e27a_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\76c0a79a5d40bddc_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\79155c1c6b7f653b_0
- %TEMP%\f58ec6f1-58d6-4503-b735-fb14476dbc66.tmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\index-dir\temp-index
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\60cdcbf5823c0949_0
- %LOCALAPPDATA%\microsoft\edge\user data\functional data-wal
- %LOCALAPPDATA%\microsoft\edge\user data\functional san data-wal
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000f
- %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\heavy_ad_intervention_opt_out.db-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\heavy_ad_intervention_opt_out.db
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000002
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000002.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\previews_opt_out.db-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\previews_opt_out.db
- %LOCALAPPDATA%\microsoft\edge\user data\default\shortcuts-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\network action predictor-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\shortcuts
- %LOCALAPPDATA%\microsoft\edge\user data\default\network action predictor
- %LOCALAPPDATA%\microsoft\edge\user data\last browser
- %LOCALAPPDATA%\microsoft\edge\user data\default\preferredapps
- %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000003.log
Deletes following files that it created itself
- %TEMP%\is-ot8is.tmp\_isetup\_setup64.tmp
- %TEMP%\is-ot8is.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-paqqq.tmp\filerecoveryprosetup.tmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6a9ddb57-c48.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6a9ddb5c-105c.pma
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000001
Moves the following files
- from %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-nmqqp.tmp to %ProgramFiles%\lsoft technologies\active@ file recovery professional\unins000.exe
- from %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-jl9sl.tmp to %ProgramFiles%\lsoft technologies\active@ file recovery professional\filerecovery.exe
- from %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-r9099.tmp to %ProgramFiles%\lsoft technologies\active@ file recovery professional\filerecovery.chm
- from %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-evfoh.tmp to %ProgramFiles%\lsoft technologies\active@ file recovery professional\filepreview.exe
- from %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-9c2m2.tmp to %ProgramFiles%\lsoft technologies\active@ file recovery professional\custom_signatures.txt
- from %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-fh502.tmp to %ProgramFiles%\lsoft technologies\active@ file recovery professional\deact.exe
- from %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-n7b16.tmp to %ProgramFiles%\lsoft technologies\active@ file recovery professional\diskeditor.exe
- from %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-7tlj2.tmp to %ProgramFiles%\lsoft technologies\active@ file recovery professional\disk_editor.chm
- from %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-b6g9q.tmp to %ProgramFiles%\lsoft technologies\active@ file recovery professional\filerec.pdf
- from %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-1lrdm.tmp to %ProgramFiles%\lsoft technologies\active@ file recovery professional\diskeditor.pdf
- from %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-ccmsd.tmp to %ProgramFiles%\lsoft technologies\active@ file recovery professional\qt5core.dll
- from %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-okre8.tmp to %ProgramFiles%\lsoft technologies\active@ file recovery professional\qt5gui.dll
- from %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-er2gn.tmp to %ProgramFiles%\lsoft technologies\active@ file recovery professional\qt5network.dll
- from %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-7uvbb.tmp to %ProgramFiles%\lsoft technologies\active@ file recovery professional\qt5printsupport.dll
- from %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-40mnn.tmp to %ProgramFiles%\lsoft technologies\active@ file recovery professional\qt5widgets.dll
- from %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-avnpr.tmp to %ProgramFiles%\lsoft technologies\active@ file recovery professional\qt5multimedia.dll
- from %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-7n1pk.tmp to %ProgramFiles%\lsoft technologies\active@ file recovery professional\qt5winextras.dll
- from %ProgramFiles%\lsoft technologies\active@ file recovery professional\platforms\is-6lj2p.tmp to %ProgramFiles%\lsoft technologies\active@ file recovery professional\platforms\qwindows.dll
- from %ProgramFiles%\lsoft technologies\active@ file recovery professional\printsupport\is-rie3s.tmp to %ProgramFiles%\lsoft technologies\active@ file recovery professional\printsupport\windowsprintersupport.dll
- from %ProgramFiles%\lsoft technologies\active@ file recovery professional\imageformats\is-iik9i.tmp to %ProgramFiles%\lsoft technologies\active@ file recovery professional\imageformats\qgif.dll
- from %ProgramFiles%\lsoft technologies\active@ file recovery professional\imageformats\is-hbm77.tmp to %ProgramFiles%\lsoft technologies\active@ file recovery professional\imageformats\qico.dll
- from %ProgramFiles%\lsoft technologies\active@ file recovery professional\imageformats\is-uan1n.tmp to %ProgramFiles%\lsoft technologies\active@ file recovery professional\imageformats\qjpeg.dll
- from %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-vsn5j.tmp to %ProgramFiles%\lsoft technologies\active@ file recovery professional\msvcp140.dll
- from %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-qgbl5.tmp to %ProgramFiles%\lsoft technologies\active@ file recovery professional\msvcp140_1.dll
- from %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-hmtg8.tmp to %ProgramFiles%\lsoft technologies\active@ file recovery professional\msvcp140_2.dll
- from %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-d2npu.tmp to %ProgramFiles%\lsoft technologies\active@ file recovery professional\vcruntime140.dll
- from %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-1v8ll.tmp to %ProgramFiles%\lsoft technologies\active@ file recovery professional\vcruntime140_1.dll
- from %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-j87od.tmp to %ProgramFiles%\lsoft technologies\active@ file recovery professional\ucrtbase.dll
- from %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-sp0vg.tmp to %ProgramFiles%\lsoft technologies\active@ file recovery professional\api-ms-win-core-console-l1-1-0.dll
- from %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-n1s15.tmp to %ProgramFiles%\lsoft technologies\active@ file recovery professional\api-ms-win-core-console-l1-2-0.dll
- from %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-ess0p.tmp to %ProgramFiles%\lsoft technologies\active@ file recovery professional\api-ms-win-core-datetime-l1-1-0.dll
- from %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-gcvj2.tmp to %ProgramFiles%\lsoft technologies\active@ file recovery professional\api-ms-win-core-debug-l1-1-0.dll
- from %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-77bjm.tmp to %ProgramFiles%\lsoft technologies\active@ file recovery professional\api-ms-win-core-errorhandling-l1-1-0.dll
- from %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-p9ih5.tmp to %ProgramFiles%\lsoft technologies\active@ file recovery professional\api-ms-win-core-file-l1-1-0.dll
- from %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-sej7n.tmp to %ProgramFiles%\lsoft technologies\active@ file recovery professional\api-ms-win-core-file-l1-2-0.dll
- from %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-dkl8r.tmp to %ProgramFiles%\lsoft technologies\active@ file recovery professional\api-ms-win-core-file-l2-1-0.dll
- from %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-tbvvj.tmp to %ProgramFiles%\lsoft technologies\active@ file recovery professional\api-ms-win-core-handle-l1-1-0.dll
- from %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-in07l.tmp to %ProgramFiles%\lsoft technologies\active@ file recovery professional\api-ms-win-core-heap-l1-1-0.dll
- from %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-3ruv8.tmp to %ProgramFiles%\lsoft technologies\active@ file recovery professional\api-ms-win-core-interlocked-l1-1-0.dll
- from %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-qhk1g.tmp to %ProgramFiles%\lsoft technologies\active@ file recovery professional\api-ms-win-core-libraryloader-l1-1-0.dll
- from %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-s2e9u.tmp to %ProgramFiles%\lsoft technologies\active@ file recovery professional\api-ms-win-core-localization-l1-2-0.dll
- from %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-mie6e.tmp to %ProgramFiles%\lsoft technologies\active@ file recovery professional\api-ms-win-core-memory-l1-1-0.dll
- from %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-c84g4.tmp to %ProgramFiles%\lsoft technologies\active@ file recovery professional\api-ms-win-core-namedpipe-l1-1-0.dll
- from %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-kke8q.tmp to %ProgramFiles%\lsoft technologies\active@ file recovery professional\api-ms-win-core-processenvironment-l1-1-0.dll
- from %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-h1adg.tmp to %ProgramFiles%\lsoft technologies\active@ file recovery professional\api-ms-win-core-processthreads-l1-1-0.dll
- from %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-3vnj7.tmp to %ProgramFiles%\lsoft technologies\active@ file recovery professional\api-ms-win-core-processthreads-l1-1-1.dll
- from %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-e43n2.tmp to %ProgramFiles%\lsoft technologies\active@ file recovery professional\api-ms-win-core-profile-l1-1-0.dll
- from %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-v6reh.tmp to %ProgramFiles%\lsoft technologies\active@ file recovery professional\api-ms-win-core-rtlsupport-l1-1-0.dll
- from %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-g11p1.tmp to %ProgramFiles%\lsoft technologies\active@ file recovery professional\api-ms-win-core-string-l1-1-0.dll
- from %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-5vnnp.tmp to %ProgramFiles%\lsoft technologies\active@ file recovery professional\api-ms-win-core-synch-l1-1-0.dll
- from %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-1lt4r.tmp to %ProgramFiles%\lsoft technologies\active@ file recovery professional\api-ms-win-core-synch-l1-2-0.dll
- from %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-gfm6b.tmp to %ProgramFiles%\lsoft technologies\active@ file recovery professional\api-ms-win-core-sysinfo-l1-1-0.dll
- from %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-ifhf7.tmp to %ProgramFiles%\lsoft technologies\active@ file recovery professional\api-ms-win-core-timezone-l1-1-0.dll
- from %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-7io1r.tmp to %ProgramFiles%\lsoft technologies\active@ file recovery professional\api-ms-win-core-util-l1-1-0.dll
- from %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-h4nu6.tmp to %ProgramFiles%\lsoft technologies\active@ file recovery professional\api-ms-win-crt-conio-l1-1-0.dll
- from %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-jfq83.tmp to %ProgramFiles%\lsoft technologies\active@ file recovery professional\api-ms-win-crt-convert-l1-1-0.dll
- from %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-v0s6t.tmp to %ProgramFiles%\lsoft technologies\active@ file recovery professional\api-ms-win-crt-environment-l1-1-0.dll
- from %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-fbu36.tmp to %ProgramFiles%\lsoft technologies\active@ file recovery professional\api-ms-win-crt-filesystem-l1-1-0.dll
- from %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-gq7rr.tmp to %ProgramFiles%\lsoft technologies\active@ file recovery professional\api-ms-win-crt-heap-l1-1-0.dll
- from %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-682ff.tmp to %ProgramFiles%\lsoft technologies\active@ file recovery professional\api-ms-win-crt-locale-l1-1-0.dll
- from %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-ud0ap.tmp to %ProgramFiles%\lsoft technologies\active@ file recovery professional\api-ms-win-crt-math-l1-1-0.dll
- from %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-u5phh.tmp to %ProgramFiles%\lsoft technologies\active@ file recovery professional\api-ms-win-crt-multibyte-l1-1-0.dll
- from %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-68jaj.tmp to %ProgramFiles%\lsoft technologies\active@ file recovery professional\api-ms-win-crt-private-l1-1-0.dll
- from %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-3o6s7.tmp to %ProgramFiles%\lsoft technologies\active@ file recovery professional\api-ms-win-crt-process-l1-1-0.dll
- from %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-badpj.tmp to %ProgramFiles%\lsoft technologies\active@ file recovery professional\api-ms-win-crt-runtime-l1-1-0.dll
- from %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-k7i6l.tmp to %ProgramFiles%\lsoft technologies\active@ file recovery professional\api-ms-win-crt-stdio-l1-1-0.dll
- from %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-g5pb6.tmp to %ProgramFiles%\lsoft technologies\active@ file recovery professional\api-ms-win-crt-string-l1-1-0.dll
- from %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-h6qi4.tmp to %ProgramFiles%\lsoft technologies\active@ file recovery professional\api-ms-win-crt-time-l1-1-0.dll
- from %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-ils64.tmp to %ProgramFiles%\lsoft technologies\active@ file recovery professional\api-ms-win-crt-utility-l1-1-0.dll
- from %ProgramFiles%\lsoft technologies\active@ file recovery professional\is-8bm09.tmp to %ProgramFiles%\lsoft technologies\active@ file recovery professional\license.txt
- from %LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\current
- from %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\current
- from %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\current
- from %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\current
- from %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\current
- from %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\current
- from %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\current
- from %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\current
- from %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\current
Modifies the following files
- %LOCALAPPDATA%\microsoft\edge\user data\last version
- %LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\site characteristics database\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data
- %LOCALAPPDATA%\microsoft\tokenbroker\cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres
- %LOCALAPPDATA%\microsoft\edge\user data\default\visited links
- %LOCALAPPDATA%\microsoft\edge\user data\default\history-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\history
- %LOCALAPPDATA%\microsoft\edge\user data\default\local storage\leveldb\000003.log
- %TEMP%\.ses
- %LOCALAPPDATA%\microsoft\edge\user data\default\favicons-journal
Substitutes the following files
- %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
- %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Platform Notifications\LOG
Network activity
Connects to
- 'co####.edge.skype.com':443
- 'cy###mania.ws':443
- 'go#####agmanager.com':443
- 'st####e.ko-fi.com':443
- 'st###.#.doubleclick.net':443
- 'dr#######bidk.cloudfront.net':443
- 'st####.##oudflareinsights.com':443
- 'cr#.####g2.amazontrust.com':80
- 'a###ytics.google.com':443
- 'gh####ethec.info':443
- 'uk####ngwithea.com':443
- 'fo###.#oogleapis.com':443
- 'as####olitet.org':443
- 'mo####ghthathel.org':443
- 'fo###.gstatic.com':443
- 'accounts.google.com':443
- 'x1.#.lencr.org':80
- 'go##le.ru':443
- 'fa###ook.com':443
- 'll##n.com':443
- 'he####quettef.org':443
- 'lu##y.com':443
- 'go######s.g.doubleclick.net':443
TCP
HTTP GET requests
- http://cr#.####g2.amazontrust.com/rootg2.cer
- http://x1.#.lencr.org/
Other
- 'co####.edge.skype.com':443
- 'cy###mania.ws':443
- 'go#####agmanager.com':443
- 'my.##mark.net':443
- 'pa#####.#ooglesyndication.com':443
- 'dr#######bidk.cloudfront.net':443
- 'st####.##oudflareinsights.com':443
- 'a###ytics.google.com':443
- 'gh####ethec.info':443
- 'uk####ngwithea.com':443
- 'fo###.#oogleapis.com':443
- 'as####olitet.org':443
- 'mo####ghthathel.org':443
- 'fo###.gstatic.com':443
- 'accounts.google.com':443
- 'go##le.ru':443
- 'fa###ook.com':443
- 'll##n.com':443
- 'he####quettef.org':443
- 'lu##y.com':443
- 'go######s.g.doubleclick.net':443
UDP
- DNS ASK co####.edge.skype.com
- DNS ASK cy###mania.ws
- DNS ASK fo###.#oogleapis.com
- DNS ASK go#####agmanager.com
- DNS ASK dr#######bidk.cloudfront.net
- DNS ASK st####e.ko-fi.com
- DNS ASK a###ytics.google.com
- DNS ASK st###.#.doubleclick.net
- DNS ASK cr#.####g2.amazontrust.com
- DNS ASK st####.##oudflareinsights.com
- DNS ASK x.##2.us
- DNS ASK mo####ghthathel.org
- DNS ASK as####olitet.org
- DNS ASK gh####ethec.info
- DNS ASK uk####ngwithea.com
- DNS ASK go##le.ru
- DNS ASK fa###ook.com
- DNS ASK accounts.google.com
- DNS ASK ll##n.com
- DNS ASK fo###.gstatic.com
- DNS ASK x1.#.lencr.org
- DNS ASK pa#####.#ooglesyndication.com
- DNS ASK he####quettef.org
- DNS ASK my.##mark.net
- DNS ASK lu##y.com
- DNS ASK go######s.g.doubleclick.net
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Microsoft\Edge\User Data'
Creates and executes the following
- '%TEMP%\rarsfx0\filerecoveryprosetup.exe' /silent
- '%TEMP%\is-paqqq.tmp\filerecoveryprosetup.tmp' /SL5="$302B2,33629215,72192,%TEMP%\RarSFX0\FileRecoveryProSetup.exe" /silent
- '%TEMP%\is-ot8is.tmp\_isetup\_setup64.tmp' 105 0x3F8
- '%ProgramFiles%\lsoft technologies\active@ file recovery professional\filepreview.exe' /RegServer
- '%TEMP%\rarsfx0\64.exe'
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\RarSFX0\32or64.cmd" "
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://www.cybermania.ws/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --flag-switches-begin --flag-switches-end --do-not-de-elevate https://www.cybermania.ws/
- '%ProgramFiles(x86)%\microsoft\edge\application\89.0.774.68\identity_helper.exe' --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1880,9661308585278944215,11761432738083925318,131072 --lang=en-US --service-sandbox-type=none --mojo-...
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\RarSFX0\32or64.cmd" "' (with hidden window)
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --flag-switches-begin --flag-switches-end --do-not-de-elevate https://www.cybermania.ws/' (with hidden window)
