there is one, [Link Removed]
COULD BE INFECTED!
------------
starts a server listening to 127.0.0.1:0
performs http requests
ciphering the documents (possible)
has some weird behavior -> could lock your computer till you pay some bitcoin to xxx adress
ways of phising emails
Original file name: Node.exe
Imports
dbghelp.dll
bcrypt.dll
IPHLPAPI.DLL
WINMM.dll
CRYPT32.dll
KERNEL32.dll
ADVAPI32.dll
PSAPI.DLL
WS2_32.dll
USER32.dll
---
also connects to a websocket
// EDIT: Removed link to potential malware (Krypton)