Analysis
- user interaction
yes - max time kernel
149s - max time network
156s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
24/07/2026, 21:54
General
- Target Native-Access_2 (2).exe
- Size 177.5MB
- Sample260724-1sektstybs
- SHA256 acc62e1fa90cf6bdfdfa26c3e27f5e9f1c91f00df8e5e724bcb361332718a7d0
Malware Config
Signatures
- Executes dropped EXE 8 IoCs
- Loads dropped DLL 18 IoCs
- Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs
Using powershell.exe command.
- Drops file in Program Files directory 64 IoCs
- Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 10 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 24 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies registry class 13 IoCs
- Suspicious behavior: EnumeratesProcesses 35 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 5 IoCs
- Suspicious use of SendNotifyMessage 7 IoCs
- Suspicious use of WriteProcessMemory 40 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Native-Access_2 (2).exe"C:\Users\Admin\AppData\Local\Temp\Native-Access_2 (2).exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Native Instruments\Native Access\VC_redist.x64.exe"C:\Program Files\Native Instruments\Native Access\VC_redist.x64.exe" /install /quiet /norestart2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{F0621DE1-FB5A-4387-A5D3-E4D1AA37A837}\.cr\VC_redist.x64.exe"C:\Windows\Temp\{F0621DE1-FB5A-4387-A5D3-E4D1AA37A837}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Program Files\Native Instruments\Native Access\VC_redist.x64.exe" -burn.filehandle.attached=724 -burn.filehandle.self=728 /install /quiet /norestart3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{2F8BBD85-97CA-4A28-8E99-1B17BA6A3FB5}\.be\VC_redist.x64.exe"C:\Windows\Temp\{2F8BBD85-97CA-4A28-8E99-1B17BA6A3FB5}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{55F7AA2E-AFE8-4A6B-AC10-8DE1202D2A06} {A5B4A6A8-29FD-40A2-875A-EFCEBD15D43A} 49444⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if (Get-Command Get-CimInstance -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }"2⤵
- Hide Artifacts: Ignore Process Interrupts
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-ExecutionPolicy -Scope Process) -eq 'Restricted') { exit 1 } else { exit 0 }"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-CimInstance -ClassName Win32_Process | ? {$_.Path -and $_.Path.StartsWith('C:\Program Files\Native Instruments\Native Access', 'CurrentCultureIgnoreCase')}).Count -gt 0) { exit 0 } else { exit 1 }"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Native Instruments\Native Access\Native Access.exe"C:\Program Files\Native Instruments\Native Access\Native Access.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp3⤵
-
-
-
C:\Program Files\Native Instruments\Native Access\Native Access.exe"C:\Program Files\Native Instruments\Native Access\Native Access.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Native Instruments\Native Access" /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Native Instruments\Native Access\Crashpad" --url=https://f.a.k/e --annotation=_productName=nativeaccess2 --annotation=_version=3.25.2 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=41.7.0 --initial-client-data=0x530,0x534,0x538,0x52c,0x53c,0x7ff613522114,0x7ff613522120,0x7ff6135221302⤵
- Executes dropped EXE
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\Software\Native Instruments\Native Access" /v LastLoggedInUsername"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKCU\Software\Native Instruments\Native Access" /v LastLoggedInUsername3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"2⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; Get-CimInstance Win32_ComputerSystemProduct | select Name,Vendor,Version,IdentifyingNumber,UUID | fl"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; Get-CimInstance Win32_OperatingSystem | select Caption,SerialNumber,BuildNumber,ServicePackMajorVersion,ServicePackMinorVersion | fl"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; (Get-CimInstance Win32_ComputerSystem).HypervisorPresent"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.SystemInformation]::TerminalServerSession"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; reg query \"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\" /v DisplayVersion"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v DisplayVersion3⤵
-
-
-
C:\Program Files\Native Instruments\Native Access\Native Access.exe"C:\Program Files\Native Instruments\Native Access\Native Access.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Native Instruments\Native Access" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2216,i,5133281684368017422,16156487226693167222,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2220,i,12874328427848562640,3760846878017221571,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2212 /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Native Instruments\Native Access\Native Access.exe"C:\Program Files\Native Instruments\Native Access\Native Access.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Native Instruments\Native Access" --standard-schemes=na-app --secure-schemes=na-app,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --field-trial-handle=2216,i,5133281684368017422,16156487226693167222,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2220,i,12874328427848562640,3760846878017221571,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2424 /prefetch:112⤵
- Executes dropped EXE
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\Software\Native Instruments\Shared""2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKCU\Software\Native Instruments\Shared"3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe ADD "HKCU\Software\Native Instruments\Native Access" /f"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKCU\Software\Native Instruments\Native Access" /f3⤵
-
-
-
C:\Program Files\Native Instruments\Native Access\Native Access.exe"C:\Program Files\Native Instruments\Native Access\Native Access.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Native Instruments\Native Access" --standard-schemes=na-app --secure-schemes=na-app,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --app-path="C:\Program Files\Native Instruments\Native Access\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1784929892392989 --launch-time-ticks=575077881 --field-trial-handle=2216,i,5133281684368017422,16156487226693167222,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2220,i,12874328427848562640,3760846878017221571,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=3024 /prefetch:12⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; Get-CimInstance Win32_ComputerSystemProduct | select UUID | fl"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe ADD "HKCU\Software\Native Instruments\Native Access" /v ExecutablePath /t REG_SZ /d "C:\Program Files\Native Instruments\Native Access\Native Access.exe" /f"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKCU\Software\Native Instruments\Native Access" /v ExecutablePath /t REG_SZ /d "C:\Program Files\Native Instruments\Native Access\Native Access.exe" /f3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log""2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\findstr.exefindstr /C:"Detected boot environment" "C:\Windows\Panther\setupact.log"3⤵
-
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; Get-CimInstance MS_Systeminformation -Namespace \"root/wmi\" | select systemsku | fl "2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe ADD "HKCU\Software\Native Instruments\Shared" /f"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKCU\Software\Native Instruments\Shared" /f3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe ADD "HKCU\Software\Native Instruments\Shared" /v uret-machine-id /t REG_SZ /d 11111111-1111-1111-1111-111111111111 /f"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKCU\Software\Native Instruments\Shared" /v uret-machine-id /t REG_SZ /d 11111111-1111-1111-1111-111111111111 /f3⤵
-
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; Get-CimInstance Win32_bios | select Version, SerialNumber, SMBIOSBIOSVersion"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
VC_redist.x64.exe
chrome_100_percent.pak
powershell.exe.log
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_k3cgq5d3.khs.ps1
LICENSE.electron.txt
LICENSES.chromium.html
chrome_200_percent.pak
d3dcompiler_47.dll
dxcompiler.dll
dxil.dll
ffmpeg.dll
icudtl.dat
libEGL.dll
libGLESv2.dll
af.pak
am.pak
ar.pak
bg.pak
bn.pak
ca.pak
cs.pak
da.pak
de.pak
el.pak
en-GB.pak
en-US.pak
es-419.pak
es.pak
et.pak
fa.pak
fi.pak
fil.pak
fr.pak
gu.pak
he.pak
hi.pak
hr.pak
hu.pak
id.pak
it.pak
ja.pak
kn.pak
ko.pak
lt.pak
lv.pak
ml.pak
mr.pak
ms.pak
nb.pak
nl.pak
pl.pak
pt-BR.pak
pt-PT.pak
ro.pak
ru.pak
sk.pak
sl.pak
sr.pak
sv.pak
sw.pak
ta.pak
te.pak
th.pak
tr.pak
uk.pak
ur.pak
vi.pak
zh-CN.pak
zh-TW.pak
resources.pak
app-update.yml
.codeclimate.yml
.editorconfig
.eslintrc.js
.jekyll-metadata
CHANGES.md
LICENSE.markdown
README.markdown
deps.js
jszip.js
jszip.min.js
graph.svg
base64.js
compressedObject.js
compressions.js
crc32.js
defaults.js
external.js
flate.js
ZipFileWorker.js
index.js
index.js
license_header.js
load.js
nodejsUtils.js
NodejsStreamInputAdapter.js
NodejsStreamOutputAdapter.js
object.js
readable-stream-browser.js
ArrayReader.js
DataReader.js
NodeBufferReader.js
StringReader.js
Uint8ArrayReader.js
readerFor.js
signature.js
ConvertWorker.js
Crc32Probe.js
DataLengthProbe.js
DataWorker.js
GenericWorker.js
StreamHelper.js
support.js
utf8.js
utils.js
zipEntries.js
zipEntry.js
zipObject.js
package.json
sponsors.md
tsconfig.json
FileSaver.js
.mocharc.js
CMakeLists.txt
LICENSE.txt
LICENSE_MPL-2.0.txt
addon.node
addon.node
addon.node
addon.node
addon.node
addon.node
addon.node
addon.node
addon.node
manifest.json
addon.node
addon.node
addon.node
addon.node
addon.node
draft.js
compat.js
compat.js.map
capabilities.js
capabilities.js.map
long-options.js
long-options.js.map
poll-states.js
poll-states.js.map
send-options.js
send-options.js.map
socket-states.js
socket-states.js.map
types.js
types.js.map
draft.js
draft.js.map
errors.js
errors.js.map
index.js
index.js.map
load-addon.js
load-addon.js.map
native.js
native.js.map
tsconfig.tsbuildinfo
util.js
util.js.map
package.json
install-deps.sh
install.js
macos-cross-arm-deps.sh
merge-artifacts.mts
smoke-test.bash
closable.h
compat.ts
capabilities.ts
long-options.ts
poll-states.ts
send-options.ts
socket-states.ts
types.ts
context.h
draft.ts
errors.ts
incoming_msg.h
index.ts
inline.h
load-addon.ts
module.h
native.ts
observer.h
outgoing_msg.h
poller.h
proxy.h
socket.h
tsconfig.json
util.ts
arguments.h
async_scope.h
electron_helper.h
error.h
object.h
reaper.h
string_or_buffer.h
take.h
trash.h
uvdelayed.h
uvhandle.h
uvloop.h
uvwork.h
zmq_inc.h
tsconfig.json
v5-compat.js
vcpkg.json
NTKDaemon 1.31.1 Setup PC.exe
elevate.exe
snapshot_blob.bin
v8_context_snapshot.bin
vk_swiftshader.dll
vk_swiftshader_icd.json
vulkan-1.dll
SpiderBanner.dll
StdUtils.dll
System.dll
WinShell.dll
nsExec.dll
nsis7z.dll
default.dic
data_0
data_1
data_2
data_3
Preferences
Preferences~RFe598bbc.TMP
CURRENT
scope_v3.json
native-access.log
native-access.log
logo.png
wixstdba.dll
VC_redist.x64.exe
memory/240-93-0x0000000006300000-0x000000000631E000-memory.dmp
memory/240-107-0x00000000076F0000-0x00000000076FA000-memory.dmp
memory/240-83-0x0000000005580000-0x00000000055A2000-memory.dmp
memory/240-82-0x00000000055E0000-0x0000000005C0A000-memory.dmp
memory/240-81-0x0000000004F70000-0x0000000004FA6000-memory.dmp
memory/240-84-0x0000000005D80000-0x0000000005DE6000-memory.dmp
memory/240-92-0x0000000005E60000-0x00000000061B7000-memory.dmp
memory/240-110-0x0000000070560000-0x00000000708B7000-memory.dmp
memory/240-94-0x0000000006350000-0x000000000639C000-memory.dmp
memory/240-95-0x00000000068E0000-0x0000000006914000-memory.dmp
memory/240-109-0x00000000078B0000-0x00000000078D4000-memory.dmp
memory/240-108-0x0000000007880000-0x00000000078AA000-memory.dmp
memory/240-96-0x0000000070400000-0x000000007044C000-memory.dmp
memory/240-103-0x0000000006940000-0x000000000695E000-memory.dmp
memory/240-104-0x00000000075A0000-0x0000000007644000-memory.dmp
memory/240-105-0x0000000007CD0000-0x000000000834A000-memory.dmp
memory/240-106-0x0000000007670000-0x000000000768A000-memory.dmp
memory/240-85-0x0000000005DF0000-0x0000000005E56000-memory.dmp
memory/612-2263-0x00000210C22D0000-0x00000210C2383000-memory.dmp
memory/2260-144-0x0000000070400000-0x000000007044C000-memory.dmp
memory/2260-151-0x0000000070560000-0x00000000708B7000-memory.dmp
memory/3032-2193-0x000001DBF3480000-0x000001DBF3533000-memory.dmp
memory/3032-2203-0x000001DBF37C0000-0x000001DBF37EA000-memory.dmp
memory/3032-2204-0x000001DBF37C0000-0x000001DBF37E4000-memory.dmp
memory/4364-124-0x0000000070400000-0x000000007044C000-memory.dmp
memory/4364-131-0x0000000007A10000-0x0000000007AA6000-memory.dmp
memory/4364-132-0x0000000007940000-0x0000000007951000-memory.dmp
memory/5232-2068-0x00007FFC15BB0000-0x00007FFC15BB1000-memory.dmp
memory/5232-2067-0x00007FFC15FF0000-0x00007FFC15FF1000-memory.dmp
memory/5232-2237-0x000001FEF7070000-0x000001FEF710E000-memory.dmp
memory/5548-1997-0x000001ECDD320000-0x000001ECDD342000-memory.dmp
memory/5548-2202-0x000001ECF54F0000-0x000001ECF54FA000-memory.dmp
memory/5856-2176-0x0000017224B10000-0x0000017224B2C000-memory.dmp