!ml
. No idea if it's possible to avoid this detection with any build changes, obviously they are secretive about how their detection works. I guess the combination of fetching various files via HTTP and capability to execute files trips the generic detection.GetModuleFileNameW
, it's not very common for software to be concerned with the current executable path