24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 5f:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4bb,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win64_GenKryptik_HPIT_trojan Sample 4e7bc4bbb819… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 4e7bc4bbb819…. Malware family: Win64_GenKryptik_HPIT_trojan. Threat score 100/100. 3/26 AV engines flagged this file. 4 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/4e7bc4bbb8199dd8aebb9dd01e624f0e9b63906af056b33d0a746e6604f0e9a8","keywords":["Malicious","Win64_GenKryptik_HPIT_trojan","malware analysis","sandbox report","threat intelligence","4e7bc4bbb8199dd8aebb9dd01e624f0e9b63906af056b33d0a746e6604f0e9a8"],"about":{"@type":"SoftwareApplication","name":"winhelp.exe","applicationCategory":["compressed","7zip"],"identifier":"4e7bc4bbb8199dd8aebb9dd01e624f0e9b63906af056b33d0a746e6604f0e9a8","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win64_GenKryptik_HPIT_trojan","antivirusDetections":{"malicious":3,"total":26},"behavioralIndicators":{"malicious":4,"suspicious":23},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T404,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "4e7bc4bbb8199dd8aebb9dd01e624f0e9b63906af056b33d0a746e6604f0e9a8.bin") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "4e7bc4bbb8199dd8aebb9dd01e624f0e9b63906af056b33d0a746e6604f0e9a8.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003888.00000000.141822.EA262000.00000002.mdmp, 00000000-00003888.00000001.141985.810AA000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003888.00000000.141822.EA262000.00000002.mdmp, 00000000-00003888.00000001.141985.810AA000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00003888.00000001.141985.810AA000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00003888.00000001.141985.810AA000.00000002.mdmp")26:T6a0," {" (Indicator: "postmessage"; Source: "00000000-00005396.00000000.141301.00040000.00000004.mdmp") Found reference to API "return postMessageSupported ? ((token, callbacks) => {" (Indicator: "postmessage"; Source: "00000000-00005396.00000000.141301.00040000.00000004.mdmp") Found reference to API "_global.postMessage(token, "*");" (Indicator: "postmessage"; Source: "00000000-00005396.00000000.141301.00040000.00000004.mdmp") Found reference to API "isFunction(_global.postMessage)" (Indicator: "postmessage"; Source: "00000000-00005396.00000000.141301.00040000.00000004.mdmp")2d:T2f45,""- Location: [%TEMP%\nsb2386.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\build\koffi\darwin_x64\koffi.node]- [targetUID: 00000000-00005396] "koffi.node" has type "ELF 32-bit LSB shared object Intel i386 version 1 (GNU/Linux) dynamically linked BuildID[sha1]=6a8195d892dc7ed77ffc87a266cbb80dcb10211c not stripped"- Location: [%TEMP%\nsb2386.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\build\koffi\linux_ia32\koffi.node]- [targetUID: 00000000-00005396] "koffi.node" has type "Mach-O 64-bit arm64 dynamically linked shared library flags:"- Location: [%TEMP%\nsb2386.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\build\koffi\darwin_arm64\koffi.node]- [targetUID: 00000000-00005396] "koffi.node" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsb2386.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\build\koffi\win32_x64\koffi.node]- [targetUID: 00000000-00005396] "koffi.node" has type "PE32+ executable for MS Windows 6.02 (DLL) ARM64 6 sections"- Location: [%TEMP%\3AOPX9tNoqoLejapXaR75PGa6Zp\resources\app.asar.unpacked\node_modules\koffi\build\koffi\win32_arm64\koffi.node]- [targetUID: 00000000-00005396] "better_sqlite3.node" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\3AOPX9tNoqoLejapXaR75PGa6Zp\resources\app.asar.unpacked\node_modules\better-sqlite3\build\Release\better_sqlite3.node]- [targetUID: 00000000-00002276] "koffi.node" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nsb2386.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\build\koffi\win32_ia32\koffi.node]- [targetUID: 00000000-00005396] "loader.node" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsb2386.tmp\7z-out\resources\napi\loader.node]- [targetUID: 00000000-00002276] "sqlite3.h" has type "C source ASCII text"- Location: [%TEMP%\nsb2386.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\sqlite3\sqlite3.h]- [targetUID: 00000000-00002276] "better_sqlite3.cpp" has type "C++ source ASCII text with very long lines (1292)"- Location: [%TEMP%\3AOPX9tNoqoLejapXaR75PGa6Zp\resources\app.asar.unpacked\node_modules\better-sqlite3\src\better_sqlite3.cpp]- [targetUID: 00000000-00002276] "better_sqlite3.hpp" has type "C++ source ASCII text"- Location: [%TEMP%\3AOPX9tNoqoLejapXaR75PGa6Zp\resources\app.asar.unpacked\node_modules\better-sqlite3\src\better_sqlite3.hpp]- [targetUID: 00000000-00002276] "sqlite3ext.h" has type "C source ASCII text"- Location: [%TEMP%\nsb2386.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\sqlite3\sqlite3ext.h]- [targetUID: 00000000-00002276] "benchmarks.md" has type "HTML document Unicode text UTF-8 text"- Location: [%TEMP%\nsb2386.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\doc\pages\benchmarks.md]- [targetUID: 00000000-00002276] "index.html" has type "HTML document ASCII text"- Location: [%TEMP%\nsb2386.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\src\koffi\examples\nwjs\src\index.html]- [targetUID: 00000000-00002276] "index.html" has type "HTML document ASCII text"- Location: [%TEMP%\3AOPX9tNoqoLejapXaR75PGa6Zp\resources\app.asar.unpacked\node_modules\koffi\src\koffi\examples\electron-builder\src\index.html]- [targetUID: 00000000-00002276] "download.sh" has type "Bourne-Again shell script ASCII text executable"- Location: [%TEMP%\nsb2386.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\download.sh]- [targetUID: 00000000-00002276] "mimetypes_gen.py" has type "Python script Unicode text UTF-8 text executable"- Location: [%TEMP%\3AOPX9tNoqoLejapXaR75PGa6Zp\resources\app.asar.unpacked\node_modules\koffi\src\core\libcc\mimetypes_gen.py]- [targetUID: 00000000-00002276] "sqlite3.gyp" has type "ASCII text"- Location: [%TEMP%\3AOPX9tNoqoLejapXaR75PGa6Zp\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\sqlite3.gyp]- [targetUID: 00000000-00002276] "platforms.md" has type "HTML document Unicode text UTF-8 text"- Location: [%TEMP%\3AOPX9tNoqoLejapXaR75PGa6Zp\resources\app.asar.unpacked\node_modules\koffi\doc\pages\platforms.md]- [targetUID: 00000000-00002276] "code.html" has type "HTML document Unicode text UTF-8 text"- Location: [%TEMP%\nsb2386.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\doc\templates\code.html]- [targetUID: 00000000-00002276] "page.html" has type "HTML document Unicode text UTF-8 text"- Location: [%TEMP%\3AOPX9tNoqoLejapXaR75PGa6Zp\resources\app.asar.unpacked\node_modules\koffi\doc\templates\page.html]- [targetUID: 00000000-00002276] "sqlite.cmake" has type "Unicode text UTF-8 text"- Location: [%TEMP%\nsb2386.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\src\koffi\cmake\sqlite.cmake]- [targetUID: 00000000-00002276] "sqlite-error.js" has type "JavaScript source ASCII text"- Location: [%TEMP%\3AOPX9tNoqoLejapXaR75PGa6Zp\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\sqlite-error.js]- [targetUID: 00000000-00005396] "develop.sh" has type "Bourne-Again shell script ASCII text executable"- Location: [%TEMP%\nsb2386.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\doc\develop.sh]- [targetUID: 00000000-00002276]45:T5ed," "$TEMP/source.zip" || exit 1echo "extracting source..."unzip "$TEMP/source.zip" -d "$TEMP" > /dev/null || exit 1cd "$TEMP/sqlite-src-$VERSION" || exit 1echo "configuring amalgamation..."sh configure > /dev/null || exit 1echo "building amalgamation..."make OPTIONS="$CFLAGS" sqlite3.c > /dev/null || exit 1echo "copying amalgamation..."cp sqlite3.c sqlite3.h sqlite3ext.h "$OUTPUT/" || exit 1echo "applying patches..."cd "$DEPS" || exit 1for patch in patches/*.patch; do # If a patch fails just skip it an move on. # By default `patch` tries to be clever and reverse the patch so we have to specify `--forward`. # If the patch fails we # don't write .orig and .rej files, so we have to specify `--no-backup-if-mismatch` and `--reject-file=-`. patch --batch --forward --no-backup-if-mismatch --reject-file=- -p2 < "$patch"doneecho "updating gyp configs..."GYP="$DEPS/defines.gypi"printf "# THIS FILE IS AUTOMATICALLY GENERATED BY deps/download.sh (DO NOT EDIT)\n\n{\n 'defines': [\n" > "$GYP"printf "$DEFINES" | sed -e "/^\s*$/d" -e "s/$.*$/ '\1',/" >> "$GYP"printf " ],\n}\n" >> "$GYP"echo "updating docs..."DOCS="$DEPS/../docs/compilation.md"MAJOR=`expr "${VERSION:0:1}" + 0`MINOR=`expr "${VERSION:1:2}" + 0`PATCH=`expr "${VERSION:3:2}" + 0`sed -Ei.bak -e "s/version [0-9]+\.[0-9]+\.[0-9]+/version $MAJOR.$MINOR.$PATCH/g" "$DOCS"sed -i.bak -e "/^SQLITE_/,\$d" "$DOCS"sed -i.bak -e "/^HAVE_/,\$d" "$DOCS"rm "$DOCS".bakprintf "$DEFINES" | sed -e "/^\s*$/d" >> "$DOCS"printf "\`\`\`\n" >> "$DOCS"echo "cleaning up..."cd - > /dev/null || exit 1rm -rf "$TEMP"echo "done!"" (Indicator: ""curl") in Source: download.sh, Observed string: "#!/usr/bin/env bash# ===# This script defines and generates the bundled SQLite unit (sqlite3.c).# The following steps are taken:# 1. populate the shell environment with the defined compile-time options.# 2. download and extract the SQLite source code into a temporary directory.# 3. run "sh configure" and "make sqlite3.c" within the source directory.# 4. copy the generated amalgamation into the output directory (./sqlite3).# 5. export the defined compile-time options to a gyp file (./defines.gypi).# 6. update the docs (../docs/compilation.md) with details of this distribution.# When a user builds better-sqlite3, the following steps are taken:# 1. node-gyp loads the previously exported compile-time options (defines.gypi).# 2. the copy.js script copies the bundled amalgamation into the build folder.# 3. node-gyp compiles the copied sqlite3.c along with better_sqlite3.cpp.# 4. node-gyp links the two resulting binaries to generate better_sqlite3.node.# ===YEAR="2025"VERSION="3480000"# Defines below are sorted alphabeticallyDEFINES="HAVE_INT16_T=1HAVE_INT32_T=1HAVE_INT8_T=1HAVE_STDINT_H=1HAVE_UINT16_T=1HAVE_UINT32_T=1HAVE_UINT8_T=1HAVE_USLEEP=1SQLITE_DEFAULT_CACHE_SIZE=-16000SQLITE_DEFAULT_FOREIGN_KEYS=1SQLITE_DEFAULT_MEMSTATUS=0SQLITE_DEFAULT_WAL_SYNCHRONOUS=1SQLITE_DQS=0SQLITE_ENABLE_COLUMN_METADATASQLITE_ENABLE_DBSTAT_VTABSQLITE_ENABLE_DESERIALIZESQLITE_ENABLE_FTS3SQLITE_ENABLE_FTS3_PARENTHESISSQLITE_ENABLE_FTS4SQLITE_ENABLE_FTS5SQLITE_ENABLE_GEOPOLYSQLITE_ENABLE_JSON1SQLITE_ENABLE_MATH_FUNCTIONSSQLITE_ENABLE_RTREESQLITE_ENABLE_STAT4SQLITE_ENABLE_UPDATE_DELETE_LIMITSQLITE_LIKE_DOESNT_MATCH_BLOBSSQLITE_OMIT_DEPRECATEDSQLITE_OMIT_PROGRESS_CALLBACKSQLITE_OMIT_SHARED_CACHESQLITE_OMIT_TCL_VARIABLESQLITE_SOUNDEXSQLITE_THREADSAFE=2SQLITE_TRACE_SIZE_LIMIT=32SQLITE_USE_URI=0# ========== START SCRIPT ========== #echo "setting up environment..."DEPS="$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)"TEMP="$DEPS/temp"OUTPUT="$DEPS/sqlite3"rm -rf "$TEMP"rm -rf "$OUTPUT"mkdir -p "$TEMP"mkdir -p "$OUTPUT"export CFLAGS=`echo $(echo "$DEFINES" | sed -e "/^\s*$/d" -e "s/^/-D/")`echo "downloading source..."curl -#f "https://www.sqlite.org/$YEAR/sqlite-src-$VERSION.zip" > "$TEMP/source.zip" || exit 1echo "extracting source..."unzip "$TEMP/source.zip" -d "$TEMP" > /dev/null || exit 1cd "$TEMP/sqlite-src-$VERSION" || exit 1echo "configuring amalgamation..."sh configure > /dev/null || exit 1echo "building amalgamation..."make OPTIONS="$CFLAGS" sqlite3.c > /dev/null || exit 1echo "copying amalgamation..."cp sqlite3.c sqlite3.h sqlite3ext.h "$OUTPUT/" || exit 1echo "applying patches..."cd "$DEPS" || exit 1for patch in patches/*.patch; do # If a patch fails, just skip it an move on. # By default `patch` tries to be clever and reverse the patch, so we have to specify `--forward`. # If the patch fails, we # don't write .orig and .rej files so we have to specify `--no-backup-if-mismatch` and `--reject-file=-`. patch --batch --forward --no-backup-if-mismatch --reject-file=- -p2 < "$patch"doneecho "updating gyp configs..."GYP="$DEPS/defines.gypi"printf "# THIS FILE IS AUTOMATICALLY GENERATED BY deps/download.sh (DO NOT EDIT)\n\n{\n 'defines': [\n" > "$GYP"printf "$DEFINES" | sed -e "/^\s*$/d" -e "s/$.*$/ '\1',/" >> "$GYP"printf " ],\n}\n" >> "$GYP"echo "updating docs..."DOCS="$DEPS/../docs/compilation.md"MAJOR=`expr "${VERSION:0:1}" + 0`MINOR=`expr "${VERSION:1:2}" + 0`PATCH=`expr "${VERSION:3:2}" + 0`sed -Ei.bak -e "s/version [0-9]+\.[0-9]+\.[0-9]+/version $MAJOR.$MINOR.$PATCH/g" "$DOCS"sed -i.bak -e "/^SQLITE_/,\$d" "$DOCS"sed -i.bak -e "/^HAVE_/,\$d" "$DOCS"rm "$DOCS".bakprintf "$DEFINES" | sed -e "/^\s*$/d" >> "$DOCS"printf "\`\`\`\n" >> "$DOCS"echo "cleaning up..."cd - > /dev/null || exit 1rm -rf "$TEMP"echo "done!"" (Indicator: "curl -") in Source: download.sh4b:T739,Found reference to API "GetHostNameW" (Indicator: "gethostname"; Source: "00000000-00005396-00000C2C-1179169890") Found reference to API "ote: There is some performance penalty associated with assembly bind failure logging." (Indicator: " bind "; Source: "00000000-00003888.00000000.141822.D2010000.00000004.mdmp, 00000000-00003888.00000001.141985.D2010000.00000004.mdmp") Found reference to API "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." (Indicator: " bind "; Source: "00000000-00003888.00000000.141822.D4340000.00000004.mdmp, 00000000-00003888.00000001.141985.D4340000.00000004.mdmp") Found reference to API "// Destroys the socket on timeout" (Indicator: " socket "; Source: "00000000-00005396.00000000.141301.00040000.00000004.mdmp") Found reference to API "// Start the timer if or when the socket is opened" (Indicator: " socket "; Source: "00000000-00005396.00000000.141301.00040000.00000004.mdmp") Found reference to API "* @param {Object} thisArg The object to bind function to" (Indicator: " bind "; Source: "00000000-00005396.00000000.141301.00040000.00000004.mdmp") Found reference to API "// Sometime, the response will be very slow, and does not respond, the connect event will be block by event loop system." (Indicator: " connect "; Source: "00000000-00005396.00000000.141301.00040000.00000004.mdmp") Found reference to API "// At this time, if we have a large number of request, nodejs will hang up some socket on background. and the number will up and up." (Indicator: " socket "; Source: "00000000-00005396.00000000.141301.00040000.00000004.mdmp") Found reference to API "// And then these socket which be hang up will devouring CPU little by little." (Indicator: " socket "; Source: "00000000-00005396.00000000.141301.00040000.00000004.mdmp")4c:T2a1c,Heuristic match: ")~.tc" Heuristic match: "fdt.pa" Heuristic match: "kz@.sj" Heuristic match: "r 8z.gn" Heuristic match: "c|.lb" Heuristic match: "@)c3m.pe" Heuristic match: ".t].do" Heuristic match: "^p.so" Heuristic match: "el).be" Pattern match: "http://nsis.sf.net/nsis_error" Pattern match: "https://www.raylib.com/" Pattern match: "https://www.sqlite.org/$year/sqlite-src-$version.zip" Pattern match: "https://github.com/jshttp/mime-db#" Pattern match: "https://nodejs.org/" Pattern match: "https://www.npmjs.com/package/koffi" Heuristic match: "adapters-invitations-seating-sims.trycloudflare.com" Heuristic match: "floppy-excited-advertisers-hosted.trycloudflare.com" Heuristic match: "ipinfo.io" Heuristic match: "%temp%\nsb2386.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\download.sh" Heuristic match: "%temp%\nsb2386.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\doc\develop.sh" Heuristic match: "%temp%\nsb2386.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\doc\pages\benchmarks.md" Heuristic match: "%temp%\nsb2386.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\doc\pages\callbacks.md" Heuristic match: "%temp%\nsb2386.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\doc\pages\contribute.md" Heuristic match: "%temp%\nsb2386.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\doc\pages\functions.md" Heuristic match: "%temp%\nsb2386.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\doc\pages\index.md" Heuristic match: "%temp%\nsb2386.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\doc\pages\input.md" Heuristic match: "%temp%\nsb2386.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\doc\pages\migration.md" Heuristic match: "%temp%\nsb2386.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\doc\pages\misc.md" Heuristic match: "%temp%\nsb2386.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\doc\pages\output.md" Heuristic match: "%temp%\nsb2386.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\doc\pages\packaging.md" Heuristic match: "%temp%\nsb2386.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\doc\pages\platforms.md" Heuristic match: "%temp%\nsb2386.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\doc\pages\pointers.md" Heuristic match: "%temp%\nsb2386.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\doc\pages\start.md" Heuristic match: "%temp%\nsb2386.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\doc\pages\unions.md" Heuristic match: "%temp%\nsb2386.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\doc\pages\variables.md" Heuristic match: "%temp%\nsb2386.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\doc\readme.md" Heuristic match: "%temp%\nsb2386.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\src\cnoke\readme.md" Heuristic match: "%temp%\nsb2386.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\src\koffi\src\abi_x86_asm.as" Heuristic match: "%windir%\system32\chcp.com" Heuristic match: "soft.net" Pattern match: "microsoft.net/framework64/v4.0.30319/" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "www.digicert.com1$0" Pattern match: "http://crl.securetrust.com/stca.crl0" Heuristic match: ":\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "??\c:\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: ":\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "ntrust.net" Pattern match: "sign.net/root.cr" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "www.digicert.com1" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "0www.entrust.net/cps" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "www.digicert.com1!0" Pattern match: "http://repository.swisssign.com/0" Pattern match: "http://www.microsoft.com0" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "http://www.validationtest.contoso.com/test%d.html" Heuristic match: "ystem.management.automation.re" Heuristic match: "system.tp" Pattern match: "www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0" Pattern match: "http://www.microsoft.com/windows" Pattern match: "www.microsoft.com/pki/docs/cps/default.htm0@" Pattern match: "microsoft.net/assembly/gac_msil/system.management.automation/v4.0_3.0.0.0__31bf3856ad364e35/system.management.automation.dll" Heuristic match: "ement.au" Heuristic match: "string.prototype.at" Heuristic match: "%typedarray%.prototype.at" Pattern match: "https://github.com/nodejs/node/issues/22066" Pattern match: "https://github.com/isaacs/node-glob/issues/205" Pattern match: "foo.txt/**" Pattern match: "https://github.com/nodejs/node/blob/b3fcc245fb25539909ef1d5eaa01dbf92e168633/lib/path.js#l56" Pattern match: "https://github.com/isaacs/node-glob/issues/167" Pattern match: "https://github.com/digitalbrainjs/axiospromise/blob/16deab13710ec09779922131f3fa5954320f83ab/lib/utils.js#l11-l34" Pattern match: "http://www.google.com" Pattern match: "http://localhost" Pattern match: "https://nodejs.org/api/http.html#http_message_headers" Pattern match: "https://github.com/axios/axios/issues/69" Pattern match: "https://www.npmjs.com/package/form-data" Pattern match: "https://github.com/cloudflare/workerd/issues/902" Pattern match: "https://nodejs.org/download/release/v20.18.1/win-x64/node.lib" Pattern match: "https://nodejs.org/download/release/v20.18.1/node-v20.18.1.tar.gz" Pattern match: "https://nodejs.org/download/release/v20.18.1/node-v20.18.1-headers.tar.gz" Heuristic match: "rf.gi" Heuristic match: "# 102.54.94.97 rhino.acme.com" Heuristic match: "readme.md" Heuristic match: "download.sh" Heuristic match: "$migration_guide.md" Heuristic match: "license.md" Heuristic match: "readme-zh_cn.md" Heuristic match: "evelop.sh" Heuristic match: "develop.sh" Heuristic match: "misc.md" Heuristic match: "type_taggable.md" Heuristic match: "type_error.md" Heuristic match: ",threadsafe_function.md" Heuristic match: "history.md" Heuristic match: "security.md" Heuristic match: "pathexists.md" Heuristic match: "$pathexists-sync.md" Heuristic match: "porting-buffer.md" Heuristic match: "$code_of_conduct.md" Heuristic match: "contributing.md" Heuristic match: "copy-sync.md" Heuristic match: "copy.md" Heuristic match: "emptydir-sync.md" Heuristic match: "emptydir.md" Heuristic match: "ensuredir-sync.md" Heuristic match: "ensuredir.md" Heuristic match: "$ensurefile-sync.md" Heuristic match: "ensurefile.md" Heuristic match: "$ensurelink-sync.md" Heuristic match: "ensurelink.md" Heuristic match: "*ensuresymlink-sync.md" Heuristic match: "ensuresymlink.md" Heuristic match: "fs-read-write.md" Heuristic match: "move-sync.md" Heuristic match: "move.md" Heuristic match: "$outputfile-sync.md" Heuristic match: "outputfile.md" Heuristic match: "$outputjson-sync.md" Heuristic match: "outputjson.md" Heuristic match: "readjson-sync.md" Heuristic match: "readjson.md" Heuristic match: "remove-sync.md" Heuristic match: "remove.md" Heuristic match: "writejson-sync.md" Heuristic match: "writejson.md"4d:Ta93,"