Malicious
Malicious

d8ebae54f85db7e248e1533487a4ef80

Share on LinkedIn
Print
ZIP Archive
MD5: d8ebae54f85db7e248e1533487a4ef80
Size: 13.23 MB
application/zip
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 d8ebae54f85db7e248e1533487a4ef80
Sha1 67767d25dc6f77349f10ed610f071be643ab2444
Sha256 148322138dc8b3fe438007441b2eb6ef5546417f72204a0b3b5eb9cf0a4d6163
Sha384 f43464a3fa8a9446926dddc1de2b0f06f5764b482ba8c16190397128c2ffdda4692aae13259b53145c067ff6ba26ab81
Sha512 1499b5c15f3160d17acb64b5b361e6ede6a762dd79cd69c9f9e246712120cd6a4fe90cd712cc9f5118ee251919db752a694607adb1d4ccbe554a8a0668620408
SSDeep 393216:BjFGFWU+GrInh9y9VUMm04Kj6byVtbMpItfr:BJgFcnUkLKm+vMpItT
TLSH C3D612A491FB0817DF0EB6FBF0C59186ADECC7EA5C255C66283C23CA4C961B11BD621D
d8ebae54f85db7e248e1533487a4ef80
Malicious
node_modules
Malicious
corepack
Malicious
CHANGELOG.md
dist
Malicious
corepack.js
lib
Malicious
corepack.cjs
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Base64-Block]
npm.js
npx.js
pnpm.js
pnpx.js
yarn.js
yarnpkg.js
LICENSE.md
package.json
README.md
shims
corepack
corepack.cmd
corepack.ps1
nodewin
corepack
corepack.cmd
corepack.ps1
npm
npm.cmd
npm.ps1
npx
npx.cmd
npx.ps1
pnpm
pnpm.cmd
pnpm.ps1
pnpx
pnpx.cmd
pnpx.ps1
yarn
yarn.cmd
yarn.ps1
yarnpkg
yarnpkg.cmd
yarnpkg.ps1
npm
npm.cmd
npm.ps1
npx
npx.cmd
npx.ps1
pnpm
pnpm.cmd
pnpm.ps1
pnpx
pnpx.cmd
pnpx.ps1
yarn
yarn.cmd
yarn.ps1
yarnpkg
yarnpkg.cmd
yarnpkg.ps1
npm
Malicious
.npmrc
bin
node-gyp-bin
node-gyp
node-gyp.cmd
npm
npm-cli.js
npm-prefix.js
npm.cmd
npm.ps1
npx
npx-cli.js
npx.cmd
npx.ps1
docs
content
commands
npm-access.md
npm-adduser.md
npm-audit.md
npm-bugs.md
npm-cache.md
npm-ci.md
npm-completion.md
npm-config.md
npm-dedupe.md
npm-deprecate.md
npm-diff.md
npm-dist-tag.md
npm-docs.md
npm-doctor.md
npm-edit.md
npm-exec.md
npm-explain.md
npm-explore.md
npm-find-dupes.md
npm-fund.md
npm-help-search.md
npm-help.md
npm-init.md
npm-install-ci-test.md
npm-install-test.md
npm-install.md
npm-link.md
npm-login.md
npm-logout.md
npm-ls.md
npm-org.md
npm-outdated.md
npm-owner.md
npm-pack.md
npm-ping.md
npm-pkg.md
npm-prefix.md
npm-profile.md
npm-prune.md
npm-publish.md
npm-query.md
npm-rebuild.md
npm-repo.md
npm-restart.md
npm-root.md
npm-run.md
npm-sbom.md
npm-search.md
npm-shrinkwrap.md
npm-star.md
npm-stars.md
npm-start.md
npm-stop.md
npm-team.md
npm-test.md
npm-token.md
npm-undeprecate.md
npm-uninstall.md
npm-unpublish.md
npm-unstar.md
npm-update.md
npm-version.md
npm-view.md
npm-whoami.md
npm.md
npx.md
configuring-npm
folders.md
install.md
npm-shrinkwrap-json.md
npmrc.md
package-json.md
package-lock-json.md
using-npm
config.md
dependency-selectors.md
developers.md
logging.md
orgs.md
package-spec.md
registry.md
removal.md
scope.md
scripts.md
workspaces.md
lib
index.js
output
commands
npm-access.html
npm-adduser.html
npm-audit.html
npm-bugs.html
npm-cache.html
npm-ci.html
npm-completion.html
npm-config.html
npm-dedupe.html
npm-deprecate.html
npm-diff.html
npm-dist-tag.html
npm-docs.html
npm-doctor.html
npm-edit.html
npm-exec.html
npm-explain.html
npm-explore.html
npm-find-dupes.html
npm-fund.html
npm-help-search.html
npm-help.html
npm-init.html
npm-install-ci-test.html
npm-install-test.html
npm-install.html
npm-link.html
npm-login.html
npm-logout.html
npm-ls.html
npm-org.html
npm-outdated.html
npm-owner.html
npm-pack.html
npm-ping.html
npm-pkg.html
npm-prefix.html
npm-profile.html
npm-prune.html
npm-publish.html
npm-query.html
npm-rebuild.html
npm-repo.html
npm-restart.html
npm-root.html
npm-run.html
npm-sbom.html
npm-search.html
npm-shrinkwrap.html
npm-star.html
npm-stars.html
npm-start.html
npm-stop.html
npm-team.html
npm-test.html
npm-token.html
npm-undeprecate.html
npm-uninstall.html
npm-unpublish.html
npm-unstar.html
npm-update.html
npm-version.html
npm-view.html
npm-whoami.html
npm.html
npx.html
configuring-npm
folders.html
install.html
npm-json.html
npm-shrinkwrap-json.html
npmrc.html
package-lock-json.html
using-npm
config.html
dependency-selectors.html
developers.html
logging.html
orgs.html
package-spec.html
registry.html
removal.html
scope.html
scripts.html
workspaces.html
workspaces.html
0x00000959.svg
0x00000959.svg-preview.jpg
0x00002FE6.svg
0x00002FE6.svg-preview.jpg
index.js
lib
arborist-cmd.js
base-cmd.js
cli
entry.js
exit-handler.js
update-notifier.js
validate-engines.js
cli.js
commands
access.js
adduser.js
audit.js
bugs.js
cache.js
ci.js
completion.js
config.js
dedupe.js
deprecate.js
diff.js
dist-tag.js
docs.js
doctor.js
edit.js
exec.js
explain.js
explore.js
find-dupes.js
fund.js
get.js
help-search.js
help.js
init.js
install-ci-test.js
install-test.js
install.js
link.js
ll.js
login.js
logout.js
ls.js
org.js
outdated.js
owner.js
pack.js
ping.js
pkg.js
prefix.js
profile.js
prune.js
publish.js
query.js
rebuild.js
repo.js
restart.js
root.js
run.js
sbom.js
search.js
set.js
shrinkwrap.js
star.js
stars.js
start.js
stop.js
team.js
test.js
token.js
undeprecate.js
uninstall.js
unpublish.js
unstar.js
update.js
version.js
view.js
whoami.js
lifecycle-cmd.js
npm.js
package-url-cmd.js
utils
audit-error.js
auth.js
cmd-list.js
completion.fish
completion.sh
did-you-mean.js
display.js
error-message.js
explain-dep.js
explain-eresolve.js
format-bytes.js
format-search-stream.js
format.js
get-identity.js
get-workspaces.js
installed-deep.js
installed-shallow.js
is-windows.js
log-file.js
npm-usage.js
oidc.js
open-url.js
output-error.js
ping.js
queryable.js
read-user-info.js
reify-finish.js
reify-output.js
sbom-cyclonedx.js
sbom-spdx.js
tar.js
timers.js
update-workspaces.js
validate-lockfile.js
verify-signatures.js
LICENSE
man
man1
npm-access.1
npm-adduser.1
npm-audit.1
npm-bugs.1
npm-cache.1
npm-ci.1
npm-completion.1
npm-config.1
npm-dedupe.1
npm-deprecate.1
npm-diff.1
npm-dist-tag.1
npm-docs.1
npm-doctor.1
npm-edit.1
npm-exec.1
npm-explain.1
npm-explore.1
npm-find-dupes.1
npm-fund.1
npm-help-search.1
npm-help.1
npm-init.1
npm-install-ci-test.1
npm-install-test.1
npm-install.1
npm-link.1
npm-login.1
npm-logout.1
npm-ls.1
npm-org.1
npm-outdated.1
npm-owner.1
npm-pack.1
npm-ping.1
npm-pkg.1
npm-prefix.1
npm-profile.1
npm-prune.1
npm-publish.1
npm-query.1
npm-rebuild.1
npm-repo.1
npm-restart.1
npm-root.1
npm-run.1
npm-sbom.1
npm-search.1
npm-shrinkwrap.1
npm-star.1
npm-stars.1
npm-start.1
npm-stop.1
npm-team.1
npm-test.1
npm-token.1
npm-undeprecate.1
npm-uninstall.1
npm-unpublish.1
npm-unstar.1
npm-update.1
npm-version.1
npm-view.1
npm-whoami.1
npm.1
npx.1
man5
folders.5
install.5
npm-json.5
npm-shrinkwrap-json.5
npmrc.5
package-lock-json.5
man7
config.7
dependency-selectors.7
developers.7
logging.7
orgs.7
package-spec.7
registry.7
removal.7
scope.7
scripts.7
workspaces.7
node_modules
Malicious
@isaacs
balanced-match
dist
commonjs
index.js
package.json
esm
index.js
package.json
LICENSE.md
package.json
brace-expansion
dist
commonjs
index.js
esm
index.js
LICENSE
package.json
fs-minipass
dist
commonjs
index.js
esm
index.js
LICENSE
package.json
string-locale-compare
index.js
LICENSE
package.json
@npmcli
agent
lib
agents.js
dns.js
errors.js
index.js
options.js
proxy.js
package.json
arborist
bin
actual.js
audit.js
funding.js
ideal.js
index.js
lib
logging.js
options.js
print-tree.js
timers.js
license.js
prune.js
reify.js
shrinkwrap.js
virtual.js
lib
add-rm-pkg-deps.js
arborist
build-ideal-tree.js
index.js
isolated-reifier.js
load-actual.js
load-virtual.js
rebuild.js
reify.js
audit-report.js
calc-dep-flags.js
can-place-dep.js
case-insensitive-map.js
consistent-resolve.js
debug.js
deepest-nesting-target.js
dep-valid.js
diff.js
edge.js
from-path.js
gather-dep-set.js
index.js
inventory.js
link.js
node.js
optional-set.js
override-resolves.js
override-set.js
packument-cache.js
peer-entry-sets.js
place-dep.js
printable.js
query-selector-all.js
realpath.js
relpath.js
reset-dep-flags.js
retire-path.js
shrinkwrap.js
signal-handling.js
signals.js
spec-from-lock.js
tracker.js
tree-check.js
version-from-tgz.js
vuln.js
yarn-lock.js
LICENSE.md
package.json
README.md
config
lib
definitions
definition.js
definitions.js
index.js
env-replace.js
errors.js
index.js
nerf-dart.js
parse-field.js
set-envs.js
type-defs.js
type-description.js
umask.js
LICENSE
package.json
README.md
fs
lib
common
get-options.js
node.js
cp
errors.js
index.js
LICENSE
polyfill.js
index.js
move-file.js
readdir-scoped.js
with-temp-dir.js
package.json
git
lib
clone.js
errors.js
find.js
index.js
is-clean.js
is.js
lines-to-revs.js
make-error.js
opts.js
revs.js
spawn.js
utils.js
which.js
LICENSE
package.json
installed-package-contents
bin
index.js
lib
index.js
package.json
README.md
map-workspaces
lib
index.js
package.json
metavuln-calculator
lib
advisory.js
get-dep-spec.js
hash.js
index.js
package.json
name-from-folder
lib
index.js
LICENSE
package.json
node-gyp
lib
index.js
LICENSE
package.json
package-json
lib
index.js
normalize-data.js
normalize.js
read-package.js
sort.js
update-dependencies.js
update-scripts.js
update-workspaces.js
LICENSE
package.json
promise-spawn
lib
escape.js
index.js
package.json
query
lib
index.js
package.json
redact
lib
deep-map.js
error.js
index.js
matchers.js
server.js
utils.js
LICENSE
package.json
run-script
lib
is-server-package.js
make-spawn-args.js
node-gyp-bin
node-gyp
node-gyp.cmd
package-envs.js
run-script-pkg.js
run-script.js
set-path.js
signal-manager.js
validate-options.js
package.json
@sigstore
bundle
dist
build.js
bundle.js
error.js
index.js
serialized.js
utility.js
validate.js
LICENSE
package.json
core
dist
asn1
error.js
index.js
length.js
obj.js
parse.js
tag.js
crypto.js
dsse.js
encoding.js
index.js
json.js
oid.js
pem.js
rfc3161
error.js
index.js
timestamp.js
tstinfo.js
stream.js
x509
cert.js
ext.js
index.js
sct.js
package.json
protobuf-specs
dist
index.js
rekor
v2
index.js
__generated__
envelope.js
events.js
google
api
field_behavior.js
protobuf
any.js
descriptor.js
timestamp.js
rekor
v2
dsse.js
entry.js
hashedrekord.js
verifier.js
sigstore_bundle.js
sigstore_common.js
sigstore_rekor.js
sigstore_trustroot.js
sigstore_verification.js
package.json
sign
dist
bundler
base.js
bundle.js
dsse.js
index.js
message.js
config.js
error.js
external
error.js
fetch.js
fulcio.js
rekor-v2.js
rekor.js
tsa.js
identity
ci.js
index.js
index.js
signer
fulcio
ca.js
ephemeral.js
index.js
index.js
signer.js
util
index.js
oidc.js
ua.js
witness
index.js
tlog
client.js
entry.js
index.js
tsa
client.js
index.js
package.json
tuf
dist
appdata.js
client.js
error.js
index.js
target.js
package.json
seeds.json
verify
dist
bundle
dsse.js
index.js
message.js
error.js
index.js
key
certificate.js
index.js
sct.js
policy.js
timestamp
index.js
tsa.js
tlog
checkpoint.js
dsse.js
hashedrekord.js
index.js
intoto.js
merkle.js
set.js
trust
filter.js
index.js
verifier.js
package.json
@tufjs
canonical-json
lib
index.js
LICENSE
package.json
models
dist
base.js
delegations.js
error.js
file.js
index.js
key.js
metadata.js
role.js
root.js
signature.js
snapshot.js
targets.js
timestamp.js
utils
guard.js
index.js
key.js
oid.js
verify.js
package.json
abbrev
lib
index.js
LICENSE
package.json
agent-base
dist
helpers.js
index.js
LICENSE
package.json
ansi-regex
index.js
license
package.json
aproba
index.js
LICENSE
package.json
archy
examples
beep.js
multi_line.js
index.js
LICENSE
package.json
bin-links
lib
bin-target.js
check-bin.js
check-bins.js
fix-bin.js
get-node-modules.js
get-paths.js
get-prefix.js
index.js
is-windows.js
link-bin.js
link-bins.js
link-gently.js
link-mans.js
man-target.js
shim-bin.js
package.json
binary-extensions
binary-extensions.json
index.js
license
package.json
cacache
lib
content
path.js
read.js
rm.js
write.js
entry-index.js
get.js
index.js
memoization.js
put.js
rm.js
util
glob.js
hash-to-segments.js
tmp.js
verify.js
LICENSE.md
package.json
chalk
license
package.json
source
index.js
utilities.js
vendor
ansi-styles
index.js
supports-color
browser.js
index.js
chownr
dist
commonjs
index.js
esm
index.js
LICENSE.md
package.json
ci-info
index.js
LICENSE
package.json
vendors.json
cidr-regex
dist
index.js
LICENSE
package.json
cli-columns
color.js
index.js
license
package.json
test.js
cmd-shim
lib
index.js
to-batch-syntax.js
LICENSE
package.json
common-ancestor-path
dist
commonjs
index.js
esm
index.js
LICENSE.md
package.json
cssesc
bin
cssesc
cssesc.js
LICENSE-MIT.txt
man
cssesc.1
package.json
README.md
debug
LICENSE
package.json
src
browser.js
common.js
index.js
node.js
diff
CONTRIBUTING.md
dist
diff.js
diff.min.js
eslint.config.mjs
libcjs
convert
dmp.js
xml.js
diff
array.js
base.js
character.js
css.js
json.js
line.js
sentence.js
word.js
index.js
package.json
patch
apply.js
create.js
line-endings.js
parse.js
reverse.js
util
array.js
distance-iterator.js
params.js
string.js
libesm
convert
dmp.js
xml.js
diff
array.js
base.js
character.js
css.js
json.js
line.js
sentence.js
word.js
index.js
package.json
patch
apply.js
create.js
line-endings.js
parse.js
reverse.js
types.js
util
array.js
distance-iterator.js
params.js
string.js
LICENSE
package.json
release-notes.md
emoji-regex
es2015
index.js
text.js
index.js
package.json
text.js
encoding
lib
encoding.js
LICENSE
package.json
env-paths
index.js
package.json
err-code
bower.json
index.js
index.umd.js
package.json
exponential-backoff
dist
backoff.js
delay
always
always.delay.js
delay.base.js
delay.factory.js
delay.interface.js
skip-first
skip-first.delay.js
jitter
full
full.jitter.js
jitter.factory.js
no
no.jitter.js
options.js
LICENSE
package.json
fastest-levenshtein
bench.js
esm
mod.js
LICENSE.md
mod.js
package.json
test.js
fs-minipass
lib
index.js
package.json
glob
dist
commonjs
glob.js
has-magic.js
ignore.js
index.js
pattern.js
processor.js
walker.js
esm
glob.js
has-magic.js
ignore.js
index.js
pattern.js
processor.js
walker.js
package.json
graceful-fs
clone.js
graceful-fs.js
legacy-streams.js
LICENSE
package.json
polyfills.js
hosted-git-info
lib
from-url.js
hosts.js
index.js
parse-url.js
LICENSE
package.json
http-cache-semantics
index.js
LICENSE
package.json
http-proxy-agent
dist
index.js
LICENSE
package.json
https-proxy-agent
dist
index.js
parse-proxy-response.js
package.json
iconv-lite
encodings
dbcs-codec.js
dbcs-data.js
index.js
internal.js
sbcs-codec.js
sbcs-data-generated.js
sbcs-data.js
tables
big5-added.json
cp936.json
cp949.json
cp950.json
eucjp.json
gb18030-ranges.json
gbk-added.json
shiftjis.json
utf16.js
utf32.js
utf7.js
lib
bom-handling.js
index.js
streams.js
LICENSE
package.json
ignore-walk
lib
index.js
package.json
imurmurhash
imurmurhash.js
imurmurhash.min.js
package.json
ini
lib
ini.js
package.json
init-package-json
lib
default-input.js
init-package-json.js
LICENSE.md
package.json
ip-address
dist
address-error.js
common.js
ip-address.js
ipv4.js
ipv6.js
v4
constants.js
v6
constants.js
helpers.js
regular-expressions.js
LICENSE
package.json
ip-regex
index.js
package.json
is-cidr
dist
index.js
package.json
is-fullwidth-code-point
index.js
package.json
isexe
dist
cjs
index.js
options.js
posix.js
win32.js
mjs
index.js
options.js
posix.js
win32.js
package.json
json-parse-even-better-errors
lib
index.js
LICENSE.md
package.json
json-stringify-nice
index.js
package.json
jsonparse
bench.js
examples
twitterfeed.js
jsonparse.js
LICENSE
package.json
samplejson
basic.json
basic2.json
just-diff
index.cjs
index.mjs
LICENSE
package.json
rollup.config.js
just-diff-apply
index.cjs
index.mjs
package.json
libnpmaccess
lib
index.js
LICENSE
package.json
README.md
libnpmdiff
lib
format-diff.js
index.js
should-print-patch.js
tarball.js
untar.js
LICENSE
package.json
README.md
libnpmexec
lib
file-exists.js
get-bin-from-manifest.js
index.js
is-windows.js
no-tty.js
run-script.js
with-lock.js
package.json
README.md
libnpmfund
lib
index.js
LICENSE
package.json
README.md
libnpmorg
lib
index.js
package.json
README.md
libnpmpack
lib
index.js
package.json
README.md
libnpmpublish
lib
index.js
provenance.js
publish.js
unpublish.js
package.json
README.md
libnpmsearch
lib
index.js
package.json
README.md
libnpmteam
lib
index.js
package.json
README.md
libnpmversion
lib
commit.js
enforce-clean.js
index.js
read-json.js
retrieve-tag.js
tag.js
version.js
write-json.js
package.json
README.md
lru-cache
dist
commonjs
index.js
index.min.js
esm
index.js
index.min.js
package.json
make-fetch-happen
lib
cache
entry.js
errors.js
index.js
key.js
policy.js
fetch.js
index.js
options.js
pipeline.js
remote.js
LICENSE
package.json
minimatch
dist
commonjs
assert-valid-pattern.js
ast.js
brace-expressions.js
escape.js
index.js
unescape.js
esm
assert-valid-pattern.js
ast.js
brace-expressions.js
escape.js
index.js
unescape.js
LICENSE.md
package.json
minipass
dist
commonjs
index.js
esm
index.js
LICENSE
package.json
minipass-collect
index.js
LICENSE
package.json
minipass-fetch
lib
abort-error.js
blob.js
body.js
fetch-error.js
headers.js
index.js
request.js
response.js
LICENSE
package.json
minipass-flush
index.js
node_modules
minipass
index.js
LICENSE
package.json
package.json
minipass-pipeline
index.js
package.json
minipass-sized
index.js
package.json
minizlib
dist
commonjs
constants.js
index.js
esm
constants.js
index.js
LICENSE
package.json
ms
index.js
license.md
package.json
mute-stream
lib
index.js
package.json
negotiator
HISTORY.md
index.js
lib
charset.js
encoding.js
language.js
mediaType.js
LICENSE
package.json
node-gyp
Malicious
.release-please-manifest.json
addon.gypi
bin
node-gyp.js
CHANGELOG.md
CODE_OF_CONDUCT.md
CONTRIBUTING.md
eslint.config.js
gyp
.release-please-manifest.json
data
ninja
build.ninja
win
large-pdb-shim.cc
docs
GypVsCMake.md
Hacking.md
InputFormatReference.md
LanguageSpecification.md
README.md
Testing.md
UserDocumentation.md
gyp
gyp.bat
gyp_main.py
LICENSE
pylib
gyp
common.py
common_test.py
easy_xml.py
easy_xml_test.py
flock_tool.py
generator
analyzer.py
android.py
cmake.py
compile_commands_json.py
dump_dependency_json.py
eclipse.py
gypd.py
gypsh.py
make.py
msvs.py
msvs_test.py
ninja.py
ninja_test.py
xcode.py
xcode_test.py
__pycache__
msvs.cpython-313.pyc
msvs.cpython-314.pyc
ninja.cpython-313.pyc
ninja.cpython-314.pyc
__init__.cpython-313.pyc
__init__.cpython-314.pyc
input.py
input_test.py
mac_tool.py
MSVSNew.py
MSVSProject.py
MSVSSettings.py
MSVSSettings_test.py
MSVSToolFile.py
MSVSUserFile.py
MSVSUtil.py
MSVSVersion.py
msvs_emulation.py
ninja_syntax.py
simple_copy.py
win_tool.py
xcodeproj_file.py
xcode_emulation.py
xcode_emulation_test.py
xcode_ninja.py
xml_fix.py
__init__.py
__pycache__
common.cpython-313.pyc
common.cpython-314.pyc
easy_xml.cpython-313.pyc
easy_xml.cpython-314.pyc
input.cpython-313.pyc
input.cpython-314.pyc
MSVSNew.cpython-313.pyc
MSVSNew.cpython-314.pyc
MSVSProject.cpython-313.pyc
MSVSProject.cpython-314.pyc
MSVSSettings.cpython-313.pyc
MSVSSettings.cpython-314.pyc
MSVSToolFile.cpython-313.pyc
MSVSToolFile.cpython-314.pyc
MSVSUserFile.cpython-313.pyc
MSVSUserFile.cpython-314.pyc
MSVSUtil.cpython-313.pyc
MSVSUtil.cpython-314.pyc
MSVSVersion.cpython-313.pyc
MSVSVersion.cpython-314.pyc
msvs_emulation.cpython-313.pyc
msvs_emulation.cpython-314.pyc
ninja_syntax.cpython-313.pyc
ninja_syntax.cpython-314.pyc
simple_copy.cpython-313.pyc
simple_copy.cpython-314.pyc
xcode_emulation.cpython-313.pyc
xcode_emulation.cpython-314.pyc
__init__.cpython-313.pyc
__init__.cpython-314.pyc
packaging
LICENSE
LICENSE.APACHE
LICENSE.BSD
markers.py
metadata.py
requirements.py
specifiers.py
tags.py
utils.py
version.py
_elffile.py
_manylinux.py
_musllinux.py
_parser.py
_structures.py
_tokenizer.py
__init__.py
__pycache__
version.cpython-313.pyc
version.cpython-314.pyc
_structures.cpython-313.pyc
_structures.cpython-314.pyc
__init__.cpython-313.pyc
__init__.cpython-314.pyc
pyproject.toml
release-please-config.json
test_gyp.py
lib
Malicious
build.js
clean.js
configure.js
create-config-gypi.js
download.js
find-node-directory.js
find-python.js
Find-VisualStudio.cs
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
find-visualstudio.js
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[Base64-Block]
install.js
list.js
log.js
node-gyp.js
process-release.js
rebuild.js
remove.js
util.js
LICENSE
macOS_Catalina_acid_test.sh
package.json
README.md
release-please-config.json
SECURITY.md
src
win_delay_load_hook.cc
nopt
bin
nopt.js
lib
debug.js
nopt-lib.js
nopt.js
type-defs.js
package.json
README.md
npm-audit-report
lib
colors.js
exit-code.js
index.js
reporters
detail.js
install.js
json.js
quiet.js
package.json
npm-bundled
lib
index.js
package.json
npm-install-checks
lib
current-env.js
dev-engines.js
index.js
LICENSE
package.json
npm-normalize-package-bin
lib
index.js
package.json
npm-package-arg
lib
npa.js
package.json
npm-packlist
lib
index.js
package.json
npm-pick-manifest
lib
index.js
package.json
npm-profile
lib
index.js
package.json
npm-registry-fetch
lib
auth.js
check-response.js
default-opts.js
errors.js
index.js
json-stream.js
package.json
npm-user-validate
lib
index.js
LICENSE
package.json
p-map
index.js
package.json
pacote
bin
index.js
lib
dir.js
fetcher.js
file.js
git.js
index.js
registry.js
remote.js
util
add-git-sha.js
cache-dir.js
is-package-bin.js
npm.js
protected.js
tar-create-options.js
trailing-slashes.js
LICENSE
package.json
README.md
parse-conflict-json
lib
index.js
package.json
path-scurry
dist
commonjs
index.js
esm
index.js
package.json
postcss-selector-parser
API.md
dist
index.js
parser.js
processor.js
selectors
attribute.js
className.js
combinator.js
comment.js
constructors.js
container.js
guards.js
id.js
index.js
namespace.js
nesting.js
node.js
pseudo.js
root.js
selector.js
string.js
tag.js
types.js
universal.js
sortAscending.js
tokenize.js
tokenTypes.js
util
ensureObject.js
getProp.js
index.js
stripComments.js
unesc.js
LICENSE-MIT
package.json
proc-log
lib
index.js
LICENSE
package.json
proggy
lib
client.js
index.js
tracker.js
package.json
promise-all-reject-late
index.js
package.json
promise-call-limit
dist
commonjs
index.js
esm
index.js
package.json
promise-retry
index.js
LICENSE
package.json
promzard
lib
index.js
package.json
qrcode-terminal
.travis.yml
bin
qrcode-terminal.js
example
basic.js
basic.png
basic.png-preview.png
callback.js
small-qrcode.js
lib
main.js
LICENSE
package.json
README.md
vendor
QRCode
index.js
QR8bitByte.js
QRBitBuffer.js
QRErrorCorrectLevel.js
QRMaskPattern.js
QRMath.js
QRMode.js
QRPolynomial.js
QRRSBlock.js
QRUtil.js
read
dist
commonjs
read.js
esm
read.js
package.json
read-cmd-shim
lib
index.js
package.json
retry
equation.gif
equation.gif-preview.png
example
dns.js
stop.js
index.js
lib
retry.js
retry_operation.js
License
Makefile
package.json
safer-buffer
dangerous.js
LICENSE
package.json
Porting-Buffer.md
safer.js
tests.js
semver
bin
semver.js
classes
comparator.js
index.js
range.js
semver.js
functions
clean.js
cmp.js
coerce.js
compare-build.js
compare-loose.js
compare.js
diff.js
eq.js
gt.js
gte.js
inc.js
lt.js
lte.js
major.js
minor.js
neq.js
parse.js
patch.js
prerelease.js
rcompare.js
rsort.js
satisfies.js
sort.js
valid.js
index.js
internal
constants.js
debug.js
identifiers.js
lrucache.js
parse-options.js
re.js
package.json
preload.js
range.bnf
ranges
gtr.js
intersects.js
ltr.js
max-satisfying.js
min-satisfying.js
min-version.js
outside.js
simplify.js
subset.js
to-comparators.js
valid.js
README.md
signal-exit
dist
cjs
browser.js
index.js
signals.js
mjs
browser.js
index.js
signals.js
LICENSE.txt
package.json
sigstore
dist
config.js
index.js
sigstore.js
package.json
smart-buffer
build
smartbuffer.js
utils.js
LICENSE
package.json
socks
build
client
socksclient.js
common
constants.js
helpers.js
receivebuffer.js
util.js
index.js
docs
examples
index.md
javascript
associateExample.md
bindExample.md
connectExample.md
typescript
associateExample.md
bindExample.md
connectExample.md
index.md
migratingFromV1.md
LICENSE
package.json
socks-proxy-agent
dist
index.js
package.json
spdx-correct
index.js
LICENSE
node_modules
spdx-expression-parse
AUTHORS
index.js
LICENSE
package.json
parse.js
scan.js
package.json
spdx-exceptions
deprecated.json
index.json
package.json
spdx-expression-parse
package.json
scan.js
spdx-license-ids
deprecated.json
index.json
package.json
ssri
lib
index.js
LICENSE.md
package.json
string-width
index.js
package.json
strip-ansi
index.js
package.json
supports-color
browser.js
index.js
package.json
tar
dist
commonjs
create.js
cwd-error.js
extract.js
get-write-flag.js
header.js
index.js
large-numbers.js
list.js
make-command.js
mkdir.js
mode-fix.js
normalize-unicode.js
normalize-windows-path.js
options.js
pack.js
parse.js
path-reservations.js
pax.js
read-entry.js
replace.js
strip-absolute-path.js
strip-trailing-slashes.js
symlink-error.js
types.js
unpack.js
update.js
warn-method.js
winchars.js
write-entry.js
esm
create.js
cwd-error.js
extract.js
get-write-flag.js
header.js
index.js
large-numbers.js
list.js
make-command.js
mkdir.js
mode-fix.js
normalize-unicode.js
normalize-windows-path.js
options.js
pack.js
parse.js
path-reservations.js
pax.js
read-entry.js
replace.js
strip-absolute-path.js
strip-trailing-slashes.js
symlink-error.js
types.js
unpack.js
update.js
warn-method.js
winchars.js
write-entry.js
node_modules
yallist
dist
commonjs
index.js
esm
index.js
package.json
package.json
text-table
example
align.js
center.js
dotalign.js
doubledot.js
table.js
index.js
package.json
tiny-relative-date
lib
factory.js
index.js
LICENSE.md
package.json
src
factory.js
index.js
translations
da.js
de.js
en-short.js
en.js
es.js
fa.js
ne.js
tinyglobby
dist
index.cjs
index.d.cts
index.mjs
LICENSE
node_modules
fdir
dist
index.cjs
index.d.cts
index.mjs
LICENSE
package.json
picomatch
index.js
lib
constants.js
parse.js
picomatch.js
scan.js
utils.js
LICENSE
package.json
posix.js
package.json
treeverse
lib
breadth.js
depth-descent.js
depth.js
index.js
package.json
tuf-js
dist
config.js
error.js
fetcher.js
index.js
store.js
updater.js
utils
tmpfile.js
url.js
package.json
unique-filename
lib
index.js
LICENSE
package.json
unique-slug
lib
index.js
LICENSE
package.json
util-deprecate
browser.js
History.md
LICENSE
node.js
package.json
validate-npm-package-license
index.js
package.json
validate-npm-package-name
lib
builtin-modules.json
index.js
LICENSE
package.json
walk-up-path
dist
commonjs
index.js
esm
index.js
LICENSE
package.json
which
bin
which.js
lib
index.js
package.json
README.md
write-file-atomic
lib
index.js
LICENSE.md
package.json
yallist
iterator.js
package.json
yallist.js
npmrc
package.json
README.md
SDK
FvSDKTestClient_Public.exe
[Authenticode]_3d13d807.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
Public_Release
FvSDK.h
FvSDK_x64.dll
[Authenticode]_b63f1470.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.rsrc
.reloc
FvSDK_x64.lib
FvSDK_x64.pdb
FvSDK_x64UWP.lib
FvSDK_x86.dll
[Authenticode]_76d2135e.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.rsrc
.reloc
FvSDK_x86.lib
FvSDK_x86.pdb
python36.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
RT_MANIFEST
ID:0001
ID:1033
Setuр.exe
[Authenticode]_b0cec5c3.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.gfids
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:1033
ID:1033-preview.png
ID:0002
ID:1033
ID:0003
ID:1033
ID:0004
ID:1033
ID:0005
ID:1033
ID:0006
ID:1033
ID:0007
ID:1033
ID:1033-preview.png
ID:0008
ID:1033
ID:0009
ID:1033
ID:000A
ID:1033
ID:000B
ID:1033
ID:000C
ID:1033
RT_GROUP_CURSOR4
ID:0001
ID:1033
RT_VERSION
ID:0001
ID:1033
svga3dsw.dll
vcruntime140.dll
[Authenticode]_8d21be08.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.data
.idata
_RDATA
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
zlib1.dll
[Authenticode]_b68c9129.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.gfids
.rsrc
.reloc
Resources
RT_STRING
ID:003F
ID:1033
RT_VERSION
ID:0001
ID:1033
RT_MANIFEST
ID:0002
ID:1033
bin
amd_ags_x64.dll
[Authenticode]_48e49f07.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
FrameViewKMD.sys
[Authenticode]_330e64d4.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
INIT
.rsrc
.reloc
Resources
WEVT_TEMPLATE
ID:0001
ID:1033
RT_MESSAGETABLE
ID:0001
ID:1033
FvSDK_x64.dll
[Authenticode]_6f108b05.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.rsrc
.reloc
Resources
RT_MANIFEST
ID:0002
ID:1033
mouseLut.json
nvrla.exe
[Authenticode]_cd5d1aa9.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.didat
_RDATA
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
PresentMon_x64.exe
[Authenticode]_f6ca6052.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.didat
_RDATA
.rsrc
.reloc
Resources
WEVT_TEMPLATE
ID:0001
ID:1033
RT_MESSAGETABLE
ID:0001
ID:1033
RT_VERSION
ID:0001
ID:1033
RT_MANIFEST
ID:0001
ID:1033
licenses
LICENSES.txt
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 11 STICH kept: 3secondary ignored: 8
bin 5img 3

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
3 / 3
Path arc:zip>scr:ps1~T1027~T1059.001
Shape arc:zip>scr:ps1
malicious 2 nodes
Path arc:zip>scr:ps1~T1059.001
Shape arc:zip>scr:ps1
technique2 nodes
Deobfuscated PowerShell UNKNWOWNmalicious
"use shuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙