in ransomware/artifact.lua [316:349]
function utils.PrintOperationTables(processData)
local creates = 0
local modifies = 0
local deletes = 0
local renames = 0
local overwrites = 0
for _, v in pairs(processData.createExtensions) do
creates = creates + #v
end
for _, v in pairs(processData.modifyExtensions) do
for _, _ in pairs(v) do
modifies = modifies + 1
end
end
for _, v in pairs(processData.deleteExtensions) do
deletes = deletes + #v
end
for _, v in pairs(processData.renameExtensions) do
renames = renames + #v
end
for _, v in pairs(processData.overwriteExtensions) do
overwrites = overwrites + #v
end
local operationString =
'PID: ' .. processData.processId .. ' Creates: ' .. creates .. ' | Modifies: ' .. modifies .. ' | Deletes: ' ..
deletes .. ' | Renames: ' .. renames .. ' | Overwrites: ' .. overwrites
return operationString
end