Analysis
- user interaction
yes - max time kernel
298s - max time network
282s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
16/04/2026, 12:30
General
- Target Merluis.exe
- Size 116.7MB
- Sample260416-ppsshaft9m
- SHA256 a60007d2f163abc208e36a5e52d54e41d1b84b4b5ca6345d652089d92c00bc92
Malware Config
Signatures
- Family: HadesStealer
HadesStealer is a Windows stealer based on ElectronJS.
- Detects HadeStealer 1 IoCs
- Enumerates VirtualBox registry keys 2 TTPs 4 IoCs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
- Looks for VirtualBox Guest Additions in registry 2 TTPs 4 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell and hide display window.
- Looks for VMWare Tools registry key 2 TTPs 4 IoCs
- Looks for VMWare services registry key. 1 TTPs 4 IoCs
- Executes dropped EXE 20 IoCs
- Loads dropped DLL 45 IoCs
- Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
- Adds Run key to start application 2 TTPs 5 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates processes with tasklist 1 TTPs 4 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 4 IoCs
- Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 64 IoCs
Processor information is often read in order to detect sandboxing environments.
- Detects videocard installed 1 TTPs 4 IoCs
Uses WMIC.exe to determine videocard installed.
- Suspicious behavior: EnumeratesProcesses 54 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 9 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Merluis.exe"C:\Users\Admin\AppData\Local\Temp\Merluis.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if (Get-Command Get-CimInstance -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }"2⤵
- Hide Artifacts: Ignore Process Interrupts
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-ExecutionPolicy -Scope Process) -eq 'Restricted') { exit 1 } else { exit 0 }"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Program Files\Merluis' -Force; Add-MpPreference -ExclusionProcess 'Merluis.exe' -Force"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files\Merluis\Merluis.exe"C:\Program Files\Merluis\Merluis.exe" --startup1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Merluis\Merluis.exe"C:\Program Files\Merluis\Merluis.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\Merluis" --gpu-preferences=SAAAAAAAAADgAQAEAAAAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=disabled --field-trial-handle=1708,i,15771964614545839086,14530898641445615618,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1712,i,5789804440097356793,11043356610867558405,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1704 /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Merluis\Merluis.exe"C:\Program Files\Merluis\Merluis.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\Merluis" --field-trial-handle=1708,i,15771964614545839086,14530898641445615618,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1712,i,5789804440097356793,11043356610867558405,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2088 /prefetch:112⤵
- Executes dropped EXE
-
-
C:\Program Files\Merluis\Merluis.exe"C:\Program Files\Merluis\Merluis.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Merluis" --app-user-model-id=electron.app.Merluis --app-path="C:\Program Files\Merluis\resources\app.asar" --no-sandbox --no-zygote --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1708,i,15771964614545839086,14530898641445615618,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1712,i,5789804440097356793,11043356610867558405,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2232 /prefetch:12⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic computersystem get model"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get model3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\HARDWARE\ACPI\DSDT\VBOX__""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg query "HKLM\HARDWARE\ACPI\DSDT\VBOX__"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions"3⤵
- Looks for VirtualBox Guest Additions in registry
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest"3⤵
- Enumerates VirtualBox registry keys
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools"3⤵
- Looks for VMWare Tools registry key
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmmouse""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg query "HKLM\SYSTEM\CurrentControlSet\Services\vmmouse"3⤵
- Looks for VMWare services registry key.
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell "(Get-PhysicalDisk).BusType""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "(Get-PhysicalDisk).BusType"3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell "[System.Windows.Forms.Cursor]::Position.X""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "[System.Windows.Forms.Cursor]::Position.X"3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell "Get-WmiObject MsAcpi_ThermalZoneTemperature -Namespace root/wmi""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "Get-WmiObject MsAcpi_ThermalZoneTemperature -Namespace root/wmi"3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width"3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get serialnumber"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get serialnumber3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic /namespace:\\root\wmi PATH MsAcpi_ThermalZoneTemperature get CurrentTemperature"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\wmi PATH MsAcpi_ThermalZoneTemperature get CurrentTemperature3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path Win32_Fan get DeviceID"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic path Win32_Fan get DeviceID3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic computersystem get model"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get model3⤵
-
-
-
C:\Program Files\Merluis\Merluis.exe"C:\Program Files\Merluis\Merluis.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Merluis" --app-user-model-id=electron.app.Merluis --app-path="C:\Program Files\Merluis\resources\app.asar" --no-sandbox --no-zygote --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1708,i,15771964614545839086,14530898641445615618,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1712,i,5789804440097356793,11043356610867558405,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3148 /prefetch:12⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Merluis\Merluis.exe"C:\Program Files\Merluis\Merluis.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Merluis\Merluis.exe"C:\Program Files\Merluis\Merluis.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\Merluis" --gpu-preferences=SAAAAAAAAADgAQAEAAAAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=disabled --field-trial-handle=2120,i,16434273835408005321,17171654597261650410,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2124,i,6246834156183377892,14560414531059244040,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2116 /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Merluis\Merluis.exe"C:\Program Files\Merluis\Merluis.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\Merluis" --field-trial-handle=2120,i,16434273835408005321,17171654597261650410,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2124,i,6246834156183377892,14560414531059244040,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2404 /prefetch:112⤵
- Executes dropped EXE
-
-
C:\Program Files\Merluis\Merluis.exe"C:\Program Files\Merluis\Merluis.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Merluis" --app-user-model-id=electron.app.Merluis --app-path="C:\Program Files\Merluis\resources\app.asar" --no-sandbox --no-zygote --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1776342605388963 --launch-time-ticks=537492707 --field-trial-handle=2120,i,16434273835408005321,17171654597261650410,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2124,i,6246834156183377892,14560414531059244040,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2428 /prefetch:12⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic computersystem get model"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get model3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\HARDWARE\ACPI\DSDT\VBOX__""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg query "HKLM\HARDWARE\ACPI\DSDT\VBOX__"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions"3⤵
- Looks for VirtualBox Guest Additions in registry
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest"3⤵
- Enumerates VirtualBox registry keys
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools""2⤵
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools"3⤵
- Looks for VMWare Tools registry key
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmmouse""2⤵
-
C:\Windows\system32\reg.exereg query "HKLM\SYSTEM\CurrentControlSet\Services\vmmouse"3⤵
- Looks for VMWare services registry key.
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell "(Get-PhysicalDisk).BusType""2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "(Get-PhysicalDisk).BusType"3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell "[System.Windows.Forms.Cursor]::Position.X""2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "[System.Windows.Forms.Cursor]::Position.X"3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell "Get-WmiObject MsAcpi_ThermalZoneTemperature -Namespace root/wmi""2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "Get-WmiObject MsAcpi_ThermalZoneTemperature -Namespace root/wmi"3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width""2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width"3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get serialnumber"2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get serialnumber3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic /namespace:\\root\wmi PATH MsAcpi_ThermalZoneTemperature get CurrentTemperature"2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\wmi PATH MsAcpi_ThermalZoneTemperature get CurrentTemperature3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path Win32_Fan get DeviceID"2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic path Win32_Fan get DeviceID3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic computersystem get model"2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get model3⤵
-
-
-
C:\Program Files\Merluis\Merluis.exe"C:\Program Files\Merluis\Merluis.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Merluis" --app-user-model-id=electron.app.Merluis --app-path="C:\Program Files\Merluis\resources\app.asar" --no-sandbox --no-zygote --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1776342605388963 --launch-time-ticks=542391922 --field-trial-handle=2120,i,16434273835408005321,17171654597261650410,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2124,i,6246834156183377892,14560414531059244040,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3156 /prefetch:12⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Merluis\Merluis.exe"C:\Program Files\Merluis\Merluis.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Merluis\Merluis.exe"C:\Program Files\Merluis\Merluis.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\Merluis" --gpu-preferences=SAAAAAAAAADgAQAEAAAAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=disabled --field-trial-handle=1660,i,14705014778037037582,12179624354661247478,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1664,i,581001275871244679,12299770320489524151,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1656 /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Merluis\Merluis.exe"C:\Program Files\Merluis\Merluis.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\Merluis" --field-trial-handle=1660,i,14705014778037037582,12179624354661247478,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1664,i,581001275871244679,12299770320489524151,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2120 /prefetch:112⤵
- Executes dropped EXE
-
-
C:\Program Files\Merluis\Merluis.exe"C:\Program Files\Merluis\Merluis.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Merluis" --app-user-model-id=electron.app.Merluis --app-path="C:\Program Files\Merluis\resources\app.asar" --no-sandbox --no-zygote --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1776342605388963 --launch-time-ticks=537469744 --field-trial-handle=1660,i,14705014778037037582,12179624354661247478,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1664,i,581001275871244679,12299770320489524151,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2384 /prefetch:12⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic computersystem get model"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get model3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\HARDWARE\ACPI\DSDT\VBOX__""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg query "HKLM\HARDWARE\ACPI\DSDT\VBOX__"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions"3⤵
- Looks for VirtualBox Guest Additions in registry
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest"3⤵
- Enumerates VirtualBox registry keys
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools"3⤵
- Looks for VMWare Tools registry key
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmmouse""2⤵
-
C:\Windows\system32\reg.exereg query "HKLM\SYSTEM\CurrentControlSet\Services\vmmouse"3⤵
- Looks for VMWare services registry key.
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell "(Get-PhysicalDisk).BusType""2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "(Get-PhysicalDisk).BusType"3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell "[System.Windows.Forms.Cursor]::Position.X""2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "[System.Windows.Forms.Cursor]::Position.X"3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell "Get-WmiObject MsAcpi_ThermalZoneTemperature -Namespace root/wmi""2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "Get-WmiObject MsAcpi_ThermalZoneTemperature -Namespace root/wmi"3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width""2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width"3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get serialnumber"2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get serialnumber3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic /namespace:\\root\wmi PATH MsAcpi_ThermalZoneTemperature get CurrentTemperature"2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\wmi PATH MsAcpi_ThermalZoneTemperature get CurrentTemperature3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path Win32_Fan get DeviceID"2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic path Win32_Fan get DeviceID3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic computersystem get model"2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get model3⤵
-
-
-
C:\Program Files\Merluis\Merluis.exe"C:\Program Files\Merluis\Merluis.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Merluis" --app-user-model-id=electron.app.Merluis --app-path="C:\Program Files\Merluis\resources\app.asar" --no-sandbox --no-zygote --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1776342605388963 --launch-time-ticks=542954394 --field-trial-handle=1660,i,14705014778037037582,12179624354661247478,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1664,i,581001275871244679,12299770320489524151,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3096 /prefetch:12⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Merluis\Merluis.exe"C:\Program Files\Merluis\Merluis.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
-
C:\Program Files\Merluis\Merluis.exe"C:\Program Files\Merluis\Merluis.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\Merluis" --gpu-preferences=SAAAAAAAAADgAQAEAAAAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=disabled --field-trial-handle=1692,i,3446291620813167651,1879637546311440331,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1696,i,3629898597801635058,15167431825445546798,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1708 /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Merluis\Merluis.exe"C:\Program Files\Merluis\Merluis.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\Merluis" --field-trial-handle=1692,i,3446291620813167651,1879637546311440331,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1696,i,3629898597801635058,15167431825445546798,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2064 /prefetch:112⤵
- Executes dropped EXE
-
-
C:\Program Files\Merluis\Merluis.exe"C:\Program Files\Merluis\Merluis.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Merluis" --app-user-model-id=electron.app.Merluis --app-path="C:\Program Files\Merluis\resources\app.asar" --no-sandbox --no-zygote --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1692,i,3446291620813167651,1879637546311440331,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1696,i,3629898597801635058,15167431825445546798,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2420 /prefetch:12⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic computersystem get model"2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get model3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\HARDWARE\ACPI\DSDT\VBOX__""2⤵
-
C:\Windows\system32\reg.exereg query "HKLM\HARDWARE\ACPI\DSDT\VBOX__"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions""2⤵
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions"3⤵
- Looks for VirtualBox Guest Additions in registry
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest""2⤵
-
C:\Windows\system32\reg.exereg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest"3⤵
- Enumerates VirtualBox registry keys
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools""2⤵
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools"3⤵
- Looks for VMWare Tools registry key
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmmouse""2⤵
-
C:\Windows\system32\reg.exereg query "HKLM\SYSTEM\CurrentControlSet\Services\vmmouse"3⤵
- Looks for VMWare services registry key.
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell "(Get-PhysicalDisk).BusType""2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "(Get-PhysicalDisk).BusType"3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell "[System.Windows.Forms.Cursor]::Position.X""2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "[System.Windows.Forms.Cursor]::Position.X"3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell "Get-WmiObject MsAcpi_ThermalZoneTemperature -Namespace root/wmi""2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "Get-WmiObject MsAcpi_ThermalZoneTemperature -Namespace root/wmi"3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width""2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width"3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get serialnumber"2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get serialnumber3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic /namespace:\\root\wmi PATH MsAcpi_ThermalZoneTemperature get CurrentTemperature"2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\wmi PATH MsAcpi_ThermalZoneTemperature get CurrentTemperature3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path Win32_Fan get DeviceID"2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic path Win32_Fan get DeviceID3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic computersystem get model"2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get model3⤵
-
-
-
C:\Program Files\Merluis\Merluis.exe"C:\Program Files\Merluis\Merluis.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Merluis" --app-user-model-id=electron.app.Merluis --app-path="C:\Program Files\Merluis\resources\app.asar" --no-sandbox --no-zygote --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1692,i,3446291620813167651,1879637546311440331,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1696,i,3629898597801635058,15167431825445546798,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3172 /prefetch:12⤵
- Executes dropped EXE
- Loads dropped DLL
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Ignore Process Interrupts
1Modify Registry
1Virtualization/Sandbox Evasion
5Replay Monitor
Loading Replay Monitor...
Downloads
chrome_100_percent.pak
number.js
async.h
backup.h
powershell.exe.log
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_eyo045ke.p0h.ps1
LICENSE.electron.txt
LICENSES.chromium.html
chrome_200_percent.pak
d3dcompiler_47.dll
dxcompiler.dll
dxil.dll
ffmpeg.dll
icudtl.dat
libEGL.dll
libGLESv2.dll
af.pak
am.pak
ar.pak
bg.pak
bn.pak
ca.pak
cs.pak
da.pak
de.pak
el.pak
en-GB.pak
en-US.pak
es-419.pak
es.pak
et.pak
fa.pak
fi.pak
fil.pak
fr.pak
gu.pak
he.pak
hi.pak
hr.pak
hu.pak
id.pak
it.pak
ja.pak
kn.pak
ko.pak
lt.pak
lv.pak
ml.pak
mr.pak
ms.pak
nb.pak
nl.pak
pl.pak
pt-BR.pak
pt-PT.pak
ro.pak
ru.pak
sk.pak
sl.pak
sr.pak
sv.pak
sw.pak
ta.pak
te.pak
th.pak
tr.pak
uk.pak
ur.pak
vi.pak
zh-CN.pak
zh-TW.pak
resources.pak
app.asar
esbuild.exe
package.json
index.js
package.json
node.napi.node
dpapi_addon.h
dpapi_not_supported.cpp
dpapi_win.cpp
main.cpp
LICENSE.txt
koffi.node
koffi.node
koffi.node
koffi.node
koffi.node
koffi.node
koffi.node
koffi.node
koffi.node
koffi.node
koffi.node
koffi.node
koffi.node
koffi.node
koffi.node
koffi.exp
koffi.lib
koffi.node
koffi.exp
koffi.lib
koffi.node
koffi.exp
koffi.lib
koffi.node
assets.ini
build.sh
develop.sh
pages.ini
highlight.js
koffi.css
koffi.png
logo.webp
perf_linux.png
perf_windows.png
print.css
code.html
page.html
index.js
base.hh
crc.inc
crc_gen.py
mimetypes.inc
mimetypes_gen.py
tower.hh
unicode.inc
unicode_gen.py
package.json
FindCNoke.cmake
toolchains.json
win_delay_hook.c
cnoke.js
package.json
builder.js
index.js
tools.js
CMakeLists.txt
raylib.cmake
sqlite3.cmake
package.json
app.js
index.html
preload.js
forge.config.js
package.json
index.css
main.js
renderer.js
webpack.main.config.js
webpack.renderer.config.js
webpack.rules.js
index.js
package.json
package.json
index.html
package.json
package.json
abi_arm32_asm.S
abi_arm64_asm.S
abi_arm64_asm.asm
abi_loong64_asm.S
abi_riscv64_asm.S
abi_x64_sysv_asm.S
abi_x64_win_asm.S
abi_x64_win_asm.asm
abi_x86_asm.S
abi_x86_asm.asm
call.hh
errno.inc
ffi.hh
init.js
parser.hh
armasm.inc
gnu.inc
masm32.inc
prototypes.inc
util.hh
uv.def
uv.hh
win32.hh
function_args.js
index.js
property_descriptor.js
common.gypi
eslint.config.js
except.gypi
index.js
napi-inl.deprecated.h
napi-inl.h
napi.h
node_addon_api.gyp
node_api.gyp
noexcept.gypi
package-support.json
package.json
release-please-config.json
addon.js
index.js
index.js
package.json
addon_data.js
array_buffer.js
async_context.js
async_progress_queue_worker.js
async_progress_worker.js
async_worker.js
async_worker_nocallback.js
async_worker_persistent.js
array.js
boolean.js
value.js
bigint.js
buffer.h
buffer.js
buffer_new_or_copy-inl.h
callbackInfo.js
callbackscope.js
addon.js
addon_data.js
objectwrap_function.js
threadsafe_function_exception.js
typed_threadsafe_function_exception.js
index.js
test_helper.h
dataview.js
dataview_read_write.js
date.js
env_cleanup.js
env_misc.js
error.js
error_handling_for_primitives.js
error_terminating_environment.js
except_all.js
exports.js
external.js
finalizer_order.js
function.js
function_reference.js
global_object_delete_property.js
global_object_get_property.js
global_object_has_own_property.js
global_object_set_property.js
handlescope.js
index.js
index.js
memory_management.js
movable_callbacks.js
name.js
napi_child.js
delete_property.js
finalizer.js
get_property.js
has_own_property.js
has_property.js
object.js
object_deprecated.js
object_freeze_seal.js
set_property.js
subscript_operator.js
object_reference.js
objectwrap.js
objectwrap_constructor_exception.js
objectwrap_function.js
objectwrap_multiple_inheritance.js
objectwrap_removewrap.js
objectwrap_worker_thread.js
promise.js
reference.js
index.js
index.js
run_script.js
symbol.js
testUtil.js
threadsafe_function.js
threadsafe_function_ctx.js
threadsafe_function_exception.js
threadsafe_function_existing_tsfn.js
threadsafe_function_ptr.js
threadsafe_function_sum.js
threadsafe_function_unref.js
thunking_manual.js
type_taggable.js
typed_threadsafe_function.js
typed_threadsafe_function_ctx.js
typed_threadsafe_function_exception.js
typed_threadsafe_function_existing_tsfn.js
typed_threadsafe_function_ptr.js
typed_threadsafe_function_sum.js
typed_threadsafe_function_unref.js
typedarray-bigint.js
typedarray.js
value_type_cast.js
version_management.js
check-napi.js
clang-format.js
conversion.js
binding-file-template.js
exceptions.js
generate-binding-cc.js
injectTestParams.js
listOfTestModules.js
matchModules.js
setup.js
spawnTask.js
test.js
LICENSE
js_native_api.def
node_api.def
js_native_api.h
js_native_api_types.h
node_api.h
node_api_types.h
uv.h
aix.h
bsd.h
darwin.h
errno.h
linux.h
os390.h
posix.h
sunos.h
threadpool.h
tree.h
unix.h
version.h
win.h
index.js
clang-utils.js
parse-utils.js
package.json
release-please-config.json
update-headers.js
write-symbols.js
write-win32-def.js
symbols.js
parse-utils.js
LICENSE
node_sqlite3.node
common-sqlite.gypi
extract.js
sqlite-autoconf-3440200.tar.gz
sqlite3.gyp
sqlite3-binding.js
sqlite3.js
trace.js
package.json
database.h
gcc-preinclude.h
macros.h
statement.h
threading.h
Service.node
elevate.exe
snapshot_blob.bin
v8_context_snapshot.bin
vk_swiftshader.dll
vk_swiftshader_icd.json
vulkan-1.dll
SpiderBanner.dll
StdUtils.dll
System.dll
WinShell.dll
nsExec.dll
nsis7z.dll
data_0
data_1
data_2
data_3
Local State
Local State
45f1094f-ce37-417d-941c-2b5ec538d7c0.tmp
Network Persistent State
Preferences
CURRENT
MANIFEST-000001
default.dic
memory/544-3495-0x0000013FFD260000-0x0000013FFD272000-memory.dmp
memory/544-3494-0x0000013FE4CF0000-0x0000013FE4CFC000-memory.dmp
memory/812-3376-0x0000028BF0B20000-0x0000028BF0B2C000-memory.dmp
memory/812-3377-0x0000028BF1210000-0x0000028BF1222000-memory.dmp
memory/920-3357-0x000001B3848F0000-0x000001B3848FC000-memory.dmp
memory/920-3358-0x000001B39CE80000-0x000001B39CE92000-memory.dmp
memory/1160-3198-0x000001E0952E0000-0x000001E0952EC000-memory.dmp
memory/1160-3199-0x000001E095340000-0x000001E095352000-memory.dmp
memory/1740-2800-0x000002B3F7920000-0x000002B3F7944000-memory.dmp
memory/1740-3178-0x000002B3F70F0000-0x000002B3F7102000-memory.dmp
memory/1740-2788-0x000002B3F7830000-0x000002B3F78E3000-memory.dmp
memory/1740-2787-0x000002B3F7810000-0x000002B3F782C000-memory.dmp
memory/1740-2789-0x000002B3F78F0000-0x000002B3F78FA000-memory.dmp
memory/1740-2776-0x000002B3F77A0000-0x000002B3F77C2000-memory.dmp
memory/1740-2790-0x000002B3F7920000-0x000002B3F793C000-memory.dmp
memory/1740-2792-0x000002B3F7900000-0x000002B3F790A000-memory.dmp
memory/1740-2793-0x000002B3F7910000-0x000002B3F791A000-memory.dmp
memory/1740-3177-0x000002B3F5830000-0x000002B3F583C000-memory.dmp
memory/1740-2799-0x000002B3F7920000-0x000002B3F794A000-memory.dmp
memory/2456-3381-0x0000028378020000-0x0000028378032000-memory.dmp
memory/2456-3380-0x0000028377AA0000-0x0000028377AAC000-memory.dmp
memory/3056-3188-0x000001EC2D910000-0x000001EC2D91C000-memory.dmp
memory/3056-3189-0x000001EC47650000-0x000001EC47662000-memory.dmp
memory/3344-3392-0x0000013AD71B0000-0x0000013AD71BC000-memory.dmp
memory/3344-3393-0x0000013AD8A20000-0x0000013AD8A32000-memory.dmp
memory/3372-3342-0x0000015ED1070000-0x0000015ED107C000-memory.dmp
memory/3372-3343-0x0000015EE9580000-0x0000015EE9592000-memory.dmp
memory/3828-808-0x0000000002B60000-0x0000000002C5E000-memory.dmp
memory/3952-3339-0x000001FED2610000-0x000001FED261C000-memory.dmp
memory/3952-3340-0x000001FEEC3A0000-0x000001FEEC3B2000-memory.dmp
memory/4372-3331-0x0000011790F60000-0x0000011790F72000-memory.dmp
memory/4372-3322-0x00000117AB0F0000-0x00000117AB1A3000-memory.dmp
memory/4372-3330-0x0000011790F00000-0x0000011790F0C000-memory.dmp
memory/4500-3485-0x000001F8131A0000-0x000001F8131AC000-memory.dmp
memory/4500-3486-0x000001F82B8B0000-0x000001F82B8C2000-memory.dmp
memory/4696-3512-0x000001BFE8F20000-0x000001BFE8F2C000-memory.dmp
memory/4696-3513-0x000001BFE90C0000-0x000001BFE90D2000-memory.dmp
memory/5004-2778-0x00000000054A0000-0x000000000559E000-memory.dmp
memory/5004-2763-0x0000000007280000-0x0000000007295000-memory.dmp
memory/5004-2676-0x00000000056E0000-0x0000000005A37000-memory.dmp
memory/5004-2687-0x0000000005D20000-0x0000000005D6C000-memory.dmp
memory/5004-2758-0x0000000006F80000-0x0000000007024000-memory.dmp
memory/5004-2751-0x000000006FA90000-0x000000006FADC000-memory.dmp
memory/5004-2759-0x0000000007240000-0x0000000007251000-memory.dmp
memory/5004-2762-0x0000000007270000-0x000000000727E000-memory.dmp
memory/5004-2769-0x0000000007380000-0x0000000007388000-memory.dmp
memory/5004-2780-0x0000000006BE0000-0x0000000006BFD000-memory.dmp
memory/5004-2779-0x0000000005CC0000-0x0000000005CE5000-memory.dmp
memory/5004-2768-0x0000000007360000-0x000000000737A000-memory.dmp
memory/5064-33-0x000000007F9A0000-0x000000007F9B0000-memory.dmp
memory/5064-30-0x0000000005AD0000-0x0000000005E27000-memory.dmp
memory/5064-34-0x0000000006F10000-0x0000000006F44000-memory.dmp
memory/5064-35-0x0000000070030000-0x000000007007C000-memory.dmp
memory/5064-44-0x0000000006510000-0x000000000652E000-memory.dmp
memory/5064-43-0x0000000004DF0000-0x0000000004E00000-memory.dmp
memory/5064-42-0x0000000004DF0000-0x0000000004E00000-memory.dmp
memory/5064-45-0x0000000006F50000-0x0000000006FF4000-memory.dmp
memory/5064-46-0x00000000078C0000-0x0000000007F3A000-memory.dmp
memory/5064-47-0x0000000007280000-0x000000000729A000-memory.dmp
memory/5064-48-0x0000000007300000-0x000000000730A000-memory.dmp
memory/5064-49-0x0000000007490000-0x00000000074BA000-memory.dmp
memory/5064-50-0x00000000074C0000-0x00000000074E4000-memory.dmp
memory/5064-51-0x0000000070220000-0x0000000070577000-memory.dmp
memory/5064-54-0x0000000004F30000-0x000000000502E000-memory.dmp
memory/5064-19-0x0000000004DF0000-0x0000000004E00000-memory.dmp
memory/5064-18-0x0000000002960000-0x0000000002996000-memory.dmp
memory/5064-17-0x0000000004DF0000-0x0000000004E00000-memory.dmp
memory/5064-21-0x0000000005070000-0x0000000005092000-memory.dmp
memory/5064-22-0x0000000005310000-0x0000000005376000-memory.dmp
memory/5064-23-0x0000000005A60000-0x0000000005AC6000-memory.dmp
memory/5064-20-0x0000000005430000-0x0000000005A5A000-memory.dmp
memory/5064-31-0x0000000005F20000-0x0000000005F3E000-memory.dmp
memory/5064-32-0x0000000005F60000-0x0000000005FAC000-memory.dmp
memory/5316-3367-0x0000018BB3080000-0x0000018BB3092000-memory.dmp
memory/5316-3366-0x0000018BB1830000-0x0000018BB183C000-memory.dmp
memory/5496-67-0x0000000006270000-0x00000000065C7000-memory.dmp
memory/5496-77-0x0000000007D00000-0x0000000007D11000-memory.dmp
memory/5496-76-0x0000000007DA0000-0x0000000007E36000-memory.dmp
memory/5496-69-0x0000000070030000-0x000000007007C000-memory.dmp
memory/5496-79-0x0000000005560000-0x000000000565E000-memory.dmp
memory/5496-59-0x00000000030E0000-0x00000000030F0000-memory.dmp
memory/5496-60-0x00000000030E0000-0x00000000030F0000-memory.dmp
memory/5720-3209-0x000002056ED20000-0x000002056ED32000-memory.dmp
memory/5720-3208-0x000002056EC70000-0x000002056EC7C000-memory.dmp
memory/5900-3504-0x000001FB7F1B0000-0x000001FB7F1C2000-memory.dmp
memory/5900-3503-0x000001FB7D8F0000-0x000001FB7D8FC000-memory.dmp