Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Divolt' = '"%LOCALAPPDATA%\Programs\divolt-desktop\Divolt.exe"'
Вредоносные функции
Внедряет код в
следующие пользовательские процессы:
- divolt.exe
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\nsybf69.tmp\system.dll
- %APPDATA%\divolt-desktop\network\62271905-e665-4cdf-ba2b-009f09951e35.tmp
- %APPDATA%\divolt-desktop\session storage\log
- %APPDATA%\divolt-desktop\session storage\manifest-000001
- %APPDATA%\divolt-desktop\session storage\000001.dbtmp
- %APPDATA%\divolt-desktop\session storage\000003.log
- %APPDATA%\divolt-desktop\en-us-9-0.bdic
- %APPDATA%\divolt-desktop\cache\cache_data\f_000001
- %APPDATA%\divolt-desktop\network\cookies
- %APPDATA%\divolt-desktop\dictionaries\en-us-9-0.bdic
- %APPDATA%\divolt-desktop\cache\cache_data\f_000002
- %APPDATA%\divolt-desktop\code cache\js\c438f029f32c5c9a_0
- %APPDATA%\divolt-desktop\quotamanager-journal
- %APPDATA%\divolt-desktop\quotamanager
- %APPDATA%\divolt-desktop\indexeddb\https_divolt.xyz_0.indexeddb.leveldb\log
- %APPDATA%\divolt-desktop\indexeddb\https_divolt.xyz_0.indexeddb.leveldb\manifest-000001
- %APPDATA%\divolt-desktop\indexeddb\https_divolt.xyz_0.indexeddb.leveldb\000001.dbtmp
- %APPDATA%\divolt-desktop\indexeddb\https_divolt.xyz_0.indexeddb.leveldb\000003.log
- %APPDATA%\divolt-desktop\cache\cache_data\f_000003
- %APPDATA%\divolt-desktop\code cache\js\3959a1b85eebed70_0
- %APPDATA%\divolt-desktop\service worker\database\log
- %APPDATA%\divolt-desktop\service worker\scriptcache\index
- %APPDATA%\divolt-desktop\7cdb5b98-f3eb-445c-a9b0-de124d61b6a3.tmp
- %APPDATA%\divolt-desktop\local storage\leveldb\000001.dbtmp
- %APPDATA%\divolt-desktop\code cache\wasm\index
- %APPDATA%\divolt-desktop\code cache\wasm\index-dir\temp-index
- %APPDATA%\divolt-desktop\config.json.tmp-93963490721eb786
- %APPDATA%\divolt-desktop\config.json.tmp-93963491276cd821
- %APPDATA%\divolt-desktop\gpucache\index
- %APPDATA%\divolt-desktop\16d7568e-88bd-4df9-9b07-f26fd9cbecdb.tmp
- %APPDATA%\divolt-desktop\code cache\js\index
- %APPDATA%\divolt-desktop\network\cookies-journal
- %APPDATA%\divolt-desktop\gpucache\data_0
- %APPDATA%\divolt-desktop\cache\cache_data\index
- %APPDATA%\divolt-desktop\cache\cache_data\data_0
- %APPDATA%\divolt-desktop\cache\cache_data\data_1
- %APPDATA%\divolt-desktop\cache\cache_data\data_2
- %APPDATA%\divolt-desktop\544bb823-eaf4-4620-831e-034e2e7a75a3.tmp
- %APPDATA%\divolt-desktop\cache\cache_data\data_3
- %APPDATA%\divolt-desktop\gpucache\data_1
- %APPDATA%\divolt-desktop\gpucache\data_2
- %APPDATA%\divolt-desktop\gpucache\data_3
- %LOCALAPPDATA%\programs\divolt-desktop\locales\ml.pak
- %APPDATA%\divolt-desktop\service worker\database\manifest-000001
- %APPDATA%\divolt-desktop\cache\cache_data\f_000009
- %APPDATA%\divolt-desktop\service worker\cachestorage\5400e2953fbd394aed212c87a57b4f253e5ca5c6\ea9cfcbd-2c36-4b83-9095-57ebfa119eda\06fe31e72117b427_0
- %APPDATA%\divolt-desktop\cache\cache_data\f_00000b
- %APPDATA%\divolt-desktop\service worker\cachestorage\5400e2953fbd394aed212c87a57b4f253e5ca5c6\ea9cfcbd-2c36-4b83-9095-57ebfa119eda\6099e9a609d48f9d_0
- %TEMP%\8a1d37b4-6e6d-4761-a35e-8aaa03f60e56.tmp
- %APPDATA%\divolt-desktop\service worker\cachestorage\5400e2953fbd394aed212c87a57b4f253e5ca5c6\ea9cfcbd-2c36-4b83-9095-57ebfa119eda\627cffe162b9ba75_0
- %APPDATA%\divolt-desktop\service worker\cachestorage\5400e2953fbd394aed212c87a57b4f253e5ca5c6\ea9cfcbd-2c36-4b83-9095-57ebfa119eda\cff567e430d91128_0
- %APPDATA%\divolt-desktop\service worker\cachestorage\5400e2953fbd394aed212c87a57b4f253e5ca5c6\ea9cfcbd-2c36-4b83-9095-57ebfa119eda\1a4dcde16e1412c2_0
- %APPDATA%\divolt-desktop\service worker\cachestorage\5400e2953fbd394aed212c87a57b4f253e5ca5c6\ea9cfcbd-2c36-4b83-9095-57ebfa119eda\ae30e38d5f6d7fa9_0
- %APPDATA%\divolt-desktop\cache\cache_data\f_00000a
- %APPDATA%\divolt-desktop\service worker\cachestorage\5400e2953fbd394aed212c87a57b4f253e5ca5c6\ea9cfcbd-2c36-4b83-9095-57ebfa119eda\26b81b9ce8fa49f3_0
- %APPDATA%\divolt-desktop\service worker\cachestorage\5400e2953fbd394aed212c87a57b4f253e5ca5c6\ea9cfcbd-2c36-4b83-9095-57ebfa119eda\ceec8326931e9d12_0
- %APPDATA%\divolt-desktop\cache\cache_data\f_00000d
- %APPDATA%\divolt-desktop\service worker\cachestorage\5400e2953fbd394aed212c87a57b4f253e5ca5c6\ea9cfcbd-2c36-4b83-9095-57ebfa119eda\368305ca79798951_0
- %APPDATA%\divolt-desktop\service worker\cachestorage\5400e2953fbd394aed212c87a57b4f253e5ca5c6\ea9cfcbd-2c36-4b83-9095-57ebfa119eda\1106abc8396b9970_0
- %APPDATA%\divolt-desktop\service worker\cachestorage\5400e2953fbd394aed212c87a57b4f253e5ca5c6\ea9cfcbd-2c36-4b83-9095-57ebfa119eda\965e66f575b9df5e_0
- %APPDATA%\divolt-desktop\cache\cache_data\f_00000e
- %APPDATA%\divolt-desktop\cache\cache_data\f_00000c
- %APPDATA%\divolt-desktop\cache\cache_data\f_000008
- %APPDATA%\divolt-desktop\service worker\cachestorage\5400e2953fbd394aed212c87a57b4f253e5ca5c6\ea9cfcbd-2c36-4b83-9095-57ebfa119eda\2c2e91807a2ca4f4_0
- %APPDATA%\divolt-desktop\service worker\cachestorage\5400e2953fbd394aed212c87a57b4f253e5ca5c6\ea9cfcbd-2c36-4b83-9095-57ebfa119eda\7d4dc59b0ba826bd_0
- %APPDATA%\divolt-desktop\service worker\cachestorage\5400e2953fbd394aed212c87a57b4f253e5ca5c6\ea9cfcbd-2c36-4b83-9095-57ebfa119eda\4eb26031119bccb8_0
- %APPDATA%\divolt-desktop\service worker\database\000001.dbtmp
- %APPDATA%\divolt-desktop\service worker\scriptcache\2cc80dabc69f58b6_0
- %APPDATA%\divolt-desktop\service worker\scriptcache\2cc80dabc69f58b6_1
- %APPDATA%\divolt-desktop\fontlookuptablecache\font_unique_name_table.pb
- %APPDATA%\divolt-desktop\network\c0aeb20c-4ec1-4fa3-9d24-0c801d765fe7.tmp
- %APPDATA%\divolt-desktop\service worker\cachestorage\5400e2953fbd394aed212c87a57b4f253e5ca5c6\ea9cfcbd-2c36-4b83-9095-57ebfa119eda\index
- %APPDATA%\divolt-desktop\service worker\cachestorage\5400e2953fbd394aed212c87a57b4f253e5ca5c6\index.txt.tmp
- %APPDATA%\divolt-desktop\service worker\cachestorage\5400e2953fbd394aed212c87a57b4f253e5ca5c6\ea9cfcbd-2c36-4b83-9095-57ebfa119eda\index-dir\temp-index
- %APPDATA%\divolt-desktop\service worker\cachestorage\5400e2953fbd394aed212c87a57b4f253e5ca5c6\ea9cfcbd-2c36-4b83-9095-57ebfa119eda\bedb1e4e9a001ae2_0
- %APPDATA%\divolt-desktop\service worker\database\000003.log
- %APPDATA%\divolt-desktop\code cache\js\98c798d893c200be_0
- %APPDATA%\divolt-desktop\service worker\cachestorage\5400e2953fbd394aed212c87a57b4f253e5ca5c6\ea9cfcbd-2c36-4b83-9095-57ebfa119eda\939c188a38e46dbd_0
- %APPDATA%\divolt-desktop\cache\cache_data\f_000004
- %APPDATA%\divolt-desktop\cache\cache_data\f_000005
- %APPDATA%\divolt-desktop\service worker\cachestorage\5400e2953fbd394aed212c87a57b4f253e5ca5c6\ea9cfcbd-2c36-4b83-9095-57ebfa119eda\629fbe7e372df98a_0
- %APPDATA%\divolt-desktop\cache\cache_data\f_000006
- %APPDATA%\divolt-desktop\service worker\cachestorage\5400e2953fbd394aed212c87a57b4f253e5ca5c6\ea9cfcbd-2c36-4b83-9095-57ebfa119eda\7898e86bfc424633_0
- %APPDATA%\divolt-desktop\cache\cache_data\f_000007
- %APPDATA%\divolt-desktop\local storage\leveldb\manifest-000001
- %APPDATA%\divolt-desktop\code cache\js\2ee971766a4016d3_0
- %APPDATA%\divolt-desktop\code cache\js\index-dir\temp-index
- %APPDATA%\divolt-desktop\local storage\leveldb\log
- %APPDATA%\divolt-desktop\.updaterid
- %HOMEPATH%\desktop\divolt.lnk
- %LOCALAPPDATA%\programs\divolt-desktop\locales\es.pak
- %LOCALAPPDATA%\programs\divolt-desktop\locales\et.pak
- %LOCALAPPDATA%\programs\divolt-desktop\locales\fa.pak
- %LOCALAPPDATA%\programs\divolt-desktop\locales\fi.pak
- %LOCALAPPDATA%\programs\divolt-desktop\locales\fil.pak
- %LOCALAPPDATA%\programs\divolt-desktop\locales\fr.pak
- %LOCALAPPDATA%\programs\divolt-desktop\locales\en-gb.pak
- %LOCALAPPDATA%\programs\divolt-desktop\locales\de.pak
- %LOCALAPPDATA%\programs\divolt-desktop\locales\es-419.pak
- %LOCALAPPDATA%\programs\divolt-desktop\locales\gu.pak
- %LOCALAPPDATA%\programs\divolt-desktop\locales\hu.pak
- %LOCALAPPDATA%\programs\divolt-desktop\locales\id.pak
- %LOCALAPPDATA%\programs\divolt-desktop\locales\it.pak
- %LOCALAPPDATA%\programs\divolt-desktop\locales\ja.pak
- %LOCALAPPDATA%\programs\divolt-desktop\locales\kn.pak
- %LOCALAPPDATA%\programs\divolt-desktop\locales\ko.pak
- %LOCALAPPDATA%\programs\divolt-desktop\locales\he.pak
- %LOCALAPPDATA%\programs\divolt-desktop\locales\hi.pak
- %LOCALAPPDATA%\programs\divolt-desktop\locales\hr.pak
- %LOCALAPPDATA%\programs\divolt-desktop\locales\el.pak
- %LOCALAPPDATA%\programs\divolt-desktop\locales\da.pak
- %LOCALAPPDATA%\programs\divolt-desktop\locales\lt.pak
- %TEMP%\nsybf69.tmp\spiderbanner.dll
- %TEMP%\nsybf69.tmp\nsexec.dll
- %TEMP%\nsybf69.tmp\app-64.7z
- %TEMP%\nsybf69.tmp\nsis7z.dll
- %LOCALAPPDATA%\programs\divolt-desktop\assets\icon.png
- %LOCALAPPDATA%\programs\divolt-desktop\assets\icontemplate.png
- %LOCALAPPDATA%\programs\divolt-desktop\assets\icontemplate@2x.png
- %LOCALAPPDATA%\programs\divolt-desktop\chrome_100_percent.pak
- %TEMP%\nsybf69.tmp\stdutils.dll
- %LOCALAPPDATA%\programs\divolt-desktop\chrome_200_percent.pak
- %LOCALAPPDATA%\programs\divolt-desktop\license.electron.txt
- %LOCALAPPDATA%\programs\divolt-desktop\licenses.chromium.html
- %LOCALAPPDATA%\programs\divolt-desktop\locales\am.pak
- %LOCALAPPDATA%\programs\divolt-desktop\locales\ar.pak
- %LOCALAPPDATA%\programs\divolt-desktop\locales\bg.pak
- %LOCALAPPDATA%\programs\divolt-desktop\locales\bn.pak
- %LOCALAPPDATA%\programs\divolt-desktop\locales\ca.pak
- %LOCALAPPDATA%\programs\divolt-desktop\locales\cs.pak
- %LOCALAPPDATA%\programs\divolt-desktop\icudtl.dat
- %APPDATA%\divolt-desktop\service worker\cachestorage\5400e2953fbd394aed212c87a57b4f253e5ca5c6\ea9cfcbd-2c36-4b83-9095-57ebfa119eda\9f5b85b48b12ccfe_0
- %APPDATA%\divolt-desktop\service worker\scriptcache\index-dir\temp-index
- %LOCALAPPDATA%\programs\divolt-desktop\locales\lv.pak
- %LOCALAPPDATA%\programs\divolt-desktop\locales\nb.pak
- %LOCALAPPDATA%\programs\divolt-desktop\v8_context_snapshot.bin
- %LOCALAPPDATA%\programs\divolt-desktop\vk_swiftshader_icd.json
- %LOCALAPPDATA%\programs\divolt-desktop\d3dcompiler_47.dll
- %LOCALAPPDATA%\programs\divolt-desktop\divolt.exe
- %LOCALAPPDATA%\programs\divolt-desktop\ffmpeg.dll
- %LOCALAPPDATA%\programs\divolt-desktop\libegl.dll
- %LOCALAPPDATA%\programs\divolt-desktop\resources\app-update.yml
- %LOCALAPPDATA%\programs\divolt-desktop\libglesv2.dll
- %LOCALAPPDATA%\programs\divolt-desktop\snapshot_blob.bin
- %LOCALAPPDATA%\programs\divolt-desktop\swiftshader\libegl.dll
- %LOCALAPPDATA%\programs\divolt-desktop\vk_swiftshader.dll
- %LOCALAPPDATA%\programs\divolt-desktop\vulkan-1.dll
- %LOCALAPPDATA%\divolt-desktop-updater\installer.exe
- %LOCALAPPDATA%\programs\divolt-desktop\uninstall divolt.exe
- %APPDATA%\microsoft\windows\start menu\programs\divolt.lnk
- %TEMP%\nsybf69.tmp\winshell.dll
- %LOCALAPPDATA%\programs\divolt-desktop\resources\elevate.exe
- %LOCALAPPDATA%\programs\divolt-desktop\locales\en-us.pak
- %LOCALAPPDATA%\programs\divolt-desktop\swiftshader\libglesv2.dll
- %LOCALAPPDATA%\programs\divolt-desktop\resources\app.asar
- %LOCALAPPDATA%\programs\divolt-desktop\resources.pak
- %LOCALAPPDATA%\programs\divolt-desktop\locales\zh-tw.pak
- %LOCALAPPDATA%\programs\divolt-desktop\locales\nl.pak
- %LOCALAPPDATA%\programs\divolt-desktop\locales\pl.pak
- %LOCALAPPDATA%\programs\divolt-desktop\locales\pt-br.pak
- %LOCALAPPDATA%\programs\divolt-desktop\locales\pt-pt.pak
- %LOCALAPPDATA%\programs\divolt-desktop\locales\ro.pak
- %LOCALAPPDATA%\programs\divolt-desktop\locales\ru.pak
- %LOCALAPPDATA%\programs\divolt-desktop\locales\sk.pak
- %LOCALAPPDATA%\programs\divolt-desktop\locales\ms.pak
- %LOCALAPPDATA%\programs\divolt-desktop\locales\sl.pak
- %LOCALAPPDATA%\programs\divolt-desktop\locales\sv.pak
- %LOCALAPPDATA%\programs\divolt-desktop\locales\sw.pak
- %LOCALAPPDATA%\programs\divolt-desktop\locales\ta.pak
- %LOCALAPPDATA%\programs\divolt-desktop\locales\te.pak
- %LOCALAPPDATA%\programs\divolt-desktop\locales\th.pak
- %LOCALAPPDATA%\programs\divolt-desktop\locales\tr.pak
- %LOCALAPPDATA%\programs\divolt-desktop\locales\uk.pak
- %LOCALAPPDATA%\programs\divolt-desktop\locales\vi.pak
- %LOCALAPPDATA%\programs\divolt-desktop\locales\sr.pak
- %LOCALAPPDATA%\programs\divolt-desktop\locales\zh-cn.pak
- %LOCALAPPDATA%\programs\divolt-desktop\locales\mr.pak
- %APPDATA%\divolt-desktop\network\c5a405c2-c5ed-4314-aafb-abfe61c9e823.tmp
Удаляет следующие файлы
- %TEMP%\nsybf69.tmp\app-64.7z
- %TEMP%\nsybf69.tmp\nsexec.dll
- %TEMP%\nsybf69.tmp\nsis7z.dll
- %TEMP%\nsybf69.tmp\spiderbanner.dll
- %TEMP%\nsybf69.tmp\stdutils.dll
- %TEMP%\nsybf69.tmp\system.dll
- %TEMP%\nsybf69.tmp\winshell.dll
- %APPDATA%\divolt-desktop\preferences~rf157b37.tmp
- %APPDATA%\divolt-desktop\service worker\scriptcache\index-dir\the-real-index~rf15ee44.tmp
- %APPDATA%\divolt-desktop\network\network persistent state~rf15ffe1.tmp
- %APPDATA%\divolt-desktop\code cache\js\index-dir\the-real-index~rf16056c.tmp
- %APPDATA%\divolt-desktop\service worker\cachestorage\5400e2953fbd394aed212c87a57b4f253e5ca5c6\ea9cfcbd-2c36-4b83-9095-57ebfa119eda\index-dir\the-real-index~rf1628c4.tmp
- %APPDATA%\divolt-desktop\service worker\cachestorage\5400e2953fbd394aed212c87a57b4f253e5ca5c6\index.txt~rf1628f3.tmp
- %APPDATA%\divolt-desktop\network\network persistent state~rf16c7c1.tmp
Перемещает следующие файлы
- %APPDATA%\divolt-desktop\code cache\js\index-dir\temp-index в %APPDATA%\divolt-desktop\code cache\js\index-dir\the-real-index
- %APPDATA%\divolt-desktop\service worker\cachestorage\5400e2953fbd394aed212c87a57b4f253e5ca5c6\ea9cfcbd-2c36-4b83-9095-57ebfa119eda\index-dir\the-real-index в %APPDATA%\divolt-desktop\service worker\cachestorage\5400e2953fbd394aed212c87a57b4f253e5ca5c6\ea9cfcbd-2c36-4b83-9095-57ebfa119eda\index-dir\the-real-index~rf1628c4.tmp
- %APPDATA%\divolt-desktop\code cache\js\index-dir\the-real-index в %APPDATA%\divolt-desktop\code cache\js\index-dir\the-real-index~rf16056c.tmp
- %APPDATA%\divolt-desktop\network\network persistent state в %APPDATA%\divolt-desktop\network\network persistent state~rf15ffe1.tmp
- %APPDATA%\divolt-desktop\service worker\scriptcache\index-dir\the-real-index в %APPDATA%\divolt-desktop\service worker\scriptcache\index-dir\the-real-index~rf15ee44.tmp
- %APPDATA%\divolt-desktop\network\c0aeb20c-4ec1-4fa3-9d24-0c801d765fe7.tmp в %APPDATA%\divolt-desktop\network\transportsecurity
- %APPDATA%\divolt-desktop\service worker\cachestorage\5400e2953fbd394aed212c87a57b4f253e5ca5c6\ea9cfcbd-2c36-4b83-9095-57ebfa119eda\index-dir\temp-index в %APPDATA%\divolt-desktop\service worker\cachestorage\5400e2953fbd394aed212c87a57b4f253e5ca5c6\ea9cfcbd-2c36-4b83-9095-57ebfa119eda\index-dir\the-real-index
- %APPDATA%\divolt-desktop\service worker\cachestorage\5400e2953fbd394aed212c87a57b4f253e5ca5c6\index.txt.tmp в %APPDATA%\divolt-desktop\service worker\cachestorage\5400e2953fbd394aed212c87a57b4f253e5ca5c6\index.txt
- %APPDATA%\divolt-desktop\service worker\database\000001.dbtmp в %APPDATA%\divolt-desktop\service worker\database\current
- %APPDATA%\divolt-desktop\service worker\scriptcache\index-dir\temp-index в %APPDATA%\divolt-desktop\service worker\scriptcache\index-dir\the-real-index
- %APPDATA%\divolt-desktop\indexeddb\https_divolt.xyz_0.indexeddb.leveldb\000001.dbtmp в %APPDATA%\divolt-desktop\indexeddb\https_divolt.xyz_0.indexeddb.leveldb\current
- %APPDATA%\divolt-desktop\session storage\000001.dbtmp в %APPDATA%\divolt-desktop\session storage\current
- %APPDATA%\divolt-desktop\network\62271905-e665-4cdf-ba2b-009f09951e35.tmp в %APPDATA%\divolt-desktop\network\network persistent state
- %APPDATA%\divolt-desktop\preferences в %APPDATA%\divolt-desktop\preferences~rf157b37.tmp
- %APPDATA%\divolt-desktop\16d7568e-88bd-4df9-9b07-f26fd9cbecdb.tmp в %APPDATA%\divolt-desktop\preferences
- %APPDATA%\divolt-desktop\544bb823-eaf4-4620-831e-034e2e7a75a3.tmp в %APPDATA%\divolt-desktop\local state
- %APPDATA%\divolt-desktop\config.json.tmp-93963491276cd821 в %APPDATA%\divolt-desktop\config.json
- %APPDATA%\divolt-desktop\config.json.tmp-93963490721eb786 в %APPDATA%\divolt-desktop\config.json
- %APPDATA%\divolt-desktop\code cache\wasm\index-dir\temp-index в %APPDATA%\divolt-desktop\code cache\wasm\index-dir\the-real-index
- %APPDATA%\divolt-desktop\local storage\leveldb\000001.dbtmp в %APPDATA%\divolt-desktop\local storage\leveldb\current
- %APPDATA%\divolt-desktop\service worker\cachestorage\5400e2953fbd394aed212c87a57b4f253e5ca5c6\index.txt в %APPDATA%\divolt-desktop\service worker\cachestorage\5400e2953fbd394aed212c87a57b4f253e5ca5c6\index.txt~rf1628f3.tmp
- %APPDATA%\divolt-desktop\network\network persistent state в %APPDATA%\divolt-desktop\network\network persistent state~rf16c7c1.tmp
Подменяет следующие файлы
- %APPDATA%\divolt-desktop\preferences
- %APPDATA%\divolt-desktop\service worker\scriptcache\index-dir\temp-index
- %APPDATA%\divolt-desktop\service worker\scriptcache\index-dir\the-real-index
- %APPDATA%\divolt-desktop\network\network persistent state
- %APPDATA%\divolt-desktop\code cache\js\index-dir\temp-index
- %APPDATA%\divolt-desktop\code cache\js\index-dir\the-real-index
- %APPDATA%\divolt-desktop\service worker\cachestorage\5400e2953fbd394aed212c87a57b4f253e5ca5c6\ea9cfcbd-2c36-4b83-9095-57ebfa119eda\index-dir\temp-index
- %APPDATA%\divolt-desktop\service worker\cachestorage\5400e2953fbd394aed212c87a57b4f253e5ca5c6\ea9cfcbd-2c36-4b83-9095-57ebfa119eda\index-dir\the-real-index
- %APPDATA%\divolt-desktop\service worker\cachestorage\5400e2953fbd394aed212c87a57b4f253e5ca5c6\index.txt.tmp
- %APPDATA%\divolt-desktop\service worker\cachestorage\5400e2953fbd394aed212c87a57b4f253e5ca5c6\index.txt
Сетевая активность
Подключается к
- 're####ctor.gvt1.com':443
- 'ra#.####ubusercontent.com':443
- 'gi##ub.com':443
- 'dn#.google':443
- '17#.#7.211.53':443
- '10#.#1.53.92':443
TCP
Другие
- 'ra#.####ubusercontent.com':443
- 're####ctor.gvt1.com':443
- 'dn#.google':443
- 'gi##ub.com':443
- 'r1######pivhx-n8vl.gvt1.com':443
- '17#.#7.211.53':443
- '10#.#1.53.92':443
UDP
- DNS ASK ra#.####ubusercontent.com
- DNS ASK gi##ub.com
- DNS ASK re####ctor.gvt1.com
- DNS ASK dn#.google
- DNS ASK r1######pivhx-n8vl.gvt1.com
- 'r1######pivhx-n8vl.gvt1.com':443
- 'dn#.google':443
- '17#.#7.211.53':443
Другое
Ищет следующие окна
- ClassName: '#32770' WindowName: ''
- ClassName: 'SysListView32' WindowName: ''
- ClassName: 'Chrome_MessageWindow' WindowName: '%APPDATA%\divolt-desktop'
Создает и запускает на исполнение
- '%LOCALAPPDATA%\programs\divolt-desktop\divolt.exe'
- '%LOCALAPPDATA%\programs\divolt-desktop\divolt.exe' --type=gpu-process --user-data-dir="%APPDATA%\divolt-desktop" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAA...
- '%LOCALAPPDATA%\programs\divolt-desktop\divolt.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="%APPDATA%\divolt-desktop" --mojo-platform-channel-handle=1424 --field-tr...
- '%LOCALAPPDATA%\programs\divolt-desktop\divolt.exe' --type=renderer --user-data-dir="%APPDATA%\divolt-desktop" --app-user-model-id=Divolt --app-path="%LOCALAPPDATA%\Programs\divolt-desktop\resources\app.asar" --no-sandbox --no-zygote --lang=en-U...
- '%LOCALAPPDATA%\programs\divolt-desktop\divolt.exe' --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="%APPDATA%\divolt-desktop" --mojo-platform-channel-handle=2300 --field-trial...
- '%WINDIR%\syswow64\cmd.exe' /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Divolt.exe" | find "Divolt.exe"' (со скрытым окном)
- '<SYSTEM32>\reg.exe' QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Divolt' (со скрытым окном)
- '<SYSTEM32>\reg.exe' ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Divolt /t REG_SZ /d "\"%LOCALAPPDATA%\Programs\divolt-desktop\Divolt.exe\"" /f' (со скрытым окном)
Запускает на исполнение
- '%WINDIR%\syswow64\cmd.exe' /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Divolt.exe" | find "Divolt.exe"
- '%WINDIR%\syswow64\tasklist.exe' /FI "USERNAME eq user" /FI "IMAGENAME eq Divolt.exe"
- '%WINDIR%\syswow64\find.exe' "Divolt.exe"
- '<SYSTEM32>\reg.exe' QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Divolt
- '<SYSTEM32>\reg.exe' ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Divolt /t REG_SZ /d "\"%LOCALAPPDATA%\Programs\divolt-desktop\Divolt.exe\"" /f
